c1h2e1 Goto Github PK

altdns

Generates permutations, alterations and mutations of subdomains and then resolves them

awesome-asset-discovery

List of Awesome Asset Discovery Resources

blasting_dictionary

爆破字典

bugbounty-cheatsheet

A list of interesting payloads, tips and tricks for bug bounty hunters.

bugbountytips

BugBountyTips collect

burpbounty

Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

c1h2e1.github.io

can-i-take-over-xyz

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

dictionaries

Misc dictionaries for directory/file enumeration, username enumeration, password dictionary/bruteforce attacks

docs.hackerone.com

HackerOne Platform Documentation

fuzzdb

一个fuzzdb扩展库

ghazi

Ghazi is a BurpSuite Plugins For Testing various PayLoads Like "XSS,SQLi,SSTI,SSRF,RCE and LFI" through Different tabs , Where Each Tab Will Replace Every GET or POST Parameters With Selected TAB in "Proxy" or "Repeater" TAB

hosts_scan

这是一个用于IP和域名碰撞匹配访问的小工具，旨意用来匹配出渗透过程中需要绑定hosts才能访问的弱主机或内部系统。

httprobe

Take a list of domains and probe for working HTTP and HTTPS servers

ico-spider

imagetragick-cve-2016-3714-rshell

iprotate_burp_extension

Extension for Burp Suite which uses AWS API Gateway to rotate your IP on every request.

jackson-rce-via-spel

An example project that exploits the default typing issue in Jackson-databind via Spring application contexts and expressions

jsonp

jsonp is a Burp Extension which attempts to reveal JSONP functionality behind JSON endpoints. This could help reveal cross-site script inclusion vulnerabilities or aid in bypassing content security policies.

log4j2-rce-scanner

BurpSuite Extension: Log4j RCE Scanner

meg

Fetch many paths for many hosts - without killing the hosts

payloadsallthethings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

recon

Easy Fast recon script

saidict

弱口令,敏感目录,敏感文件等渗透测试常用攻击字典

seclists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

subjsfinder

Send output from subjs to LinkFinder

upload-fuzz-dic-builder

上传漏洞fuzz字典生成脚本

webshell

This is a webshell open source project

woodpecker-framwork-release

高危漏洞精准检测与深度利用框架