alextudu Goto Github PK

allthingsssrf

This is a collection of writeups, cheatsheets, videos, books related to SSRF in one single location

assetfinder

Find domains and subdomains related to a given domain

benchmark

OWASP Benchmark is a test suite designed to verify the speed and accuracy of software vulnerability detection tools. A fully runnable web app written in Java, it supports analysis by Static (SAST), Dynamic (DAST), and Runtime (IAST) tools that support Java. The idea is that since it is fully runnable and all the vulnerabilities are actually exploitable, it’s a fair test for any kind of vulnerability detection tool. For more details on this project, please see the OWASP Benchmark Project home page.

blackwidow

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

burp-plugin

A Burp plugin to export findings to DefectDojo

cheatsheets

My cheatsheets

cicdtest

For testing CI CD pipeline

codepulse

Code Pulse is a real-time code coverage tool for penetration testing activities

crtndstry

Yet another subdomain finder

dependency-track

Dependency-Track is an intelligent Supply Chain Component Analysis platform that allows organizations to identify and reduce risk from the use of third-party and open source components.

dependencycheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

django-defectdojo

DefectDojo is an open-source application vulnerability correlation and security orchestration tool.

docker-security

Getting a handle on container security

esapi-java-legacy

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications.

eyewitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

findomain

The fastest and cross-platform subdomain enumerator, don't waste your time.

go-scp

Go programming language secure coding practices guide

httprobe

Take a list of domains and probe for working HTTP and HTTPS servers

juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

letsbrutewithforce

DIrectory bruteforcing tool

meg

Fetch many paths for many hosts - without killing the hosts

metasploit-framework

Metasploit Framework

owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)

owasp-swag

Swag for the OWASP projects and chapters

owasp-vwad

The OWASP Vulnerable Web Applications Directory Project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

owtf

Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp

pepper

An open source script to perform malware static analysis on Portable Executable

privilege-escalation

This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.

samm

seclists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.