GithubTwitterTryHackMeHackTheBox

Web Penetration Testing Tools

Bug Bounty Tools

Forked from Awesome Bug Bounty tools Project.

Table of Contents

  • Reconnaissance

    • Subdomain Enumeration

    • Port Scanning

    • Screenshots

    • Technologies

    • Content Discovery

    • Links

    • Parameters

    • Fuzzing

  • Exploitation

    • Command Injection

    • CORS Misconfiguration

    • CRLF Injection

    • CSRF Injection

    • Directory Traversal

    • File Inclusion

    • GraphQL Injection

    • Header Injection

    • Insecure De-serialization

    • Insecure Direct Object References

    • Open Redirect

    • Race Condition

    • Request Smuggling

    • Server Side Request Forgery

    • SQL Injection

    • XSS Injection

    • XXE Injection

  • Miscellaneous

    • Passwords

    • Secrets

    • Git

    • Buckets

    • CMS

    • JSON Web Token

    • Post Message

    • Subdomain Takeover

  • Non Categorized

Reconnaissance

List of useful Tools for web reconnaissance to find i.e files, directories, subdomains etc.

Subdomain Enumeration Tools

Ports Scanning Tools

Screenshot Related Tools

Technologies Inspection Tools

Content Discovery Specific Tools

Parameter Fuzzing Specific

Links Collection Tools

Exploitation

Useful tools to exploit different web vulnerabilities.

Command Injection

  • commix (https://github.com/commixproject/commix) - Automated All-in-One OS command injection and exploitation tool. ### CORS Misconfiguration.

  • Corsy (https://github.com/s0md3v/Corsy) - CORS Misconfiguration Scanner.

  • CORStest (https://github.com/RUB-NDS/CORStest) - A simple CORS misconfiguration scanner.

  • cors-scanner (https://github.com/laconicwolf/cors-scanner) - A multi-threaded scanner that helps identify CORS flaws/misconfiguration.

  • CorsMe (https://github.com/Shivangx01b/CorsMe) - Cross Origin Resource Sharing Misconfiguration Scanner ### CRLF Injection.

  • CRLFsuite (https://github.com/Nefcore/CRLFsuite) - A fast tool specially designed to scan CRLF injection.

  • crlfuzz (https://github.com/dwisiswant0/crlfuzz) - A fast tool to scan CRLF vulnerability written in Go.

  • CRLF-Injection-Scanner (https://github.com/MichaelStott/CRLF-Injection-Scanner) - Command line tool for testing CRLF injection on a list of domains.

  • Injectus (https://github.com/BountyStrike/Injectus) - CRLF and open redirect fuzzer ### CSRF Injection.

  • XSRFProbe (https://github.com/0xInfection/XSRFProbe) -The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

Directory Traversal

  • dotdotpwn (https://github.com/wireghoul/dotdotpwn) - DotDotPwn - The Directory Traversal Fuzzer.

  • FDsploit (https://github.com/chrispetrou/FDsploit) - File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool.

  • off-by-slash (https://github.com/bayotop/off-by-slash) - Burp extension to detect alias traversal via NGINX misconfiguration at scale.

  • liffier (https://github.com/momenbasel/liffier) - tired of manually add dot-dot-slash to your possible path traversal? this short snippet will increment ../ on the URL.

GraphQL Injection

  • inql (https://github.com/doyensec/inql) - InQL - A Burp Extension for GraphQL Security Testing.

  • GraphQLmap (https://github.com/swisskyrepo/GraphQLmap) - GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.

  • shapeshifter (https://github.com/szski/shapeshifter) - GraphQL security testing tool.

  • graphql_beautifier (https://github.com/zidekmat/graphql_beautifier) - Burp Suite extension to help make Graphql request more readable

  • clairvoyance (https://github.com/nikitastupin/clairvoyance) - Obtain GraphQL API schema despite disabled introspection!

Header Injection

  • headi (https://github.com/mlcsec/headi) - Customizable and automated HTTP header injection.

Insecure De-serialization

  • ysoserial (https://github.com/frohoff/ysoserial) - A proof-of-concept tool for generating payloads that exploit unsafe Java object de-serialization.

  • GadgetProbe (https://github.com/BishopFox/GadgetProbe) - Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

  • ysoserial.net (https://github.com/pwntester/ysoserial.net) - Deserialization payload generator for a variety of .NET formatters.

  • phpggc (https://github.com/ambionics/phpggc) - PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

Insecure Direct Object References

  • Autorize (https://github.com/Quitten/Autorize) - Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawil

Open Redirect

  • Oralyzer (https://github.com/r0075h3ll/Oralyzer) - Open Redirection Analyzer.

  • Injectus (https://github.com/BountyStrike/Injectus) - CRLF and open redirect fuzzer.

  • dom-red (https://github.com/Naategh/dom-red) - Small script to check a list of domains against open redirect vulnerability

  • OpenRedireX (https://github.com/devanshbatham/OpenRedireX) - A Fuzzer for OpenRedirect issues.

Race Condition

  • razzer (https://github.com/compsec-snu/razzer) - A Kernel fuzzer focusing on race bugs.

  • racepwn (https://github.com/racepwn/racepwn) - Race Condition framework.

  • requests-racer (https://github.com/nccgroup/requests-racer) - Small Python library that makes it easy to exploit race conditions in web apps with Requests.

  • turbo-intruder (https://github.com/PortSwigger/turbo-intruder) - Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results.

  • race-the-web (https://github.com/TheHackerDev/race-the-web) - Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.

Request Smuggling

  • http-request-smuggling (https://github.com/anshumanpattnaik/http-request-smuggling) - HTTP Request Smuggling Detection Tool

  • smuggler (https://github.com/defparam/smuggler) - Smuggler - An HTTP Request Smuggling / Desync testing tool written in Python 3.

  • h2csmuggler (https://github.com/BishopFox/h2csmuggler) - HTTP Request Smuggling over HTTP/2 Cleartext (h2c).

  • tiscripts (https://github.com/defparam/tiscripts) - These scripts is use to create Request Smuggling Desync payloads for CLTE and TECL style attacks.

Server Side Request Forgery

  • SSRFmap (https://github.com/swisskyrepo/SSRFmap) - Automatic SSRF fuzzer and exploitation tool.

  • Gopherus (https://github.com/tarunkant/Gopherus) - This tool generates gopher link for exploiting SSRF and gaining RCE in various servers.

  • ground-control (https://github.com/jobertabma/ground-control) - A collection of scripts that run on my web server. Mainly for debugging SSRF, blind XSS, and XXE vulnerabilities.

  • SSRFire (https://github.com/micha3lb3n/SSRFire) - An automated SSRF finder. Just give the domain name and your server and chill! ;) Also has options to find XSS and open redirects.

  • httprebind (https://github.com/daeken/httprebind) - Automatic tool for DNS rebinding-based SSRF attacks.

  • ssrf-sheriff (https://github.com/teknogeek/ssrf-sheriff) - A simple SSRF-testing sheriff written in Go.

  • B-XSSRF (https://github.com/SpiderMate/B-XSSRF) - Toolkit to detect and keep track on Blind XSS, XXE & SSRF.

  • extended-ssrf-search (https://github.com/Damian89/extended-ssrf-search) - Smart ssrf scanner using different methods like parameter brute forcing in post and get.

  • gaussrf (https://github.com/KathanP19/gaussrf) - Fetch known URLs from AlienVault’s Open Threat Exchange, the Wayback Machine, and Common Crawl and Filter Urls With OpenRedirection or SSRF Parameters.

  • ssrfDetector (https://github.com/JacobReynolds/ssrfDetector) - Server-side request forgery detector.

  • grafana-ssrf (https://github.com/RandomRobbieBF/grafana-ssrf) - Authenticated SSRF in Grafana.

  • sentrySSRF (https://github.com/xawdxawdx/sentrySSRF) - Tool to searching sentry config on page or in javascript files and check blind SSRF.

  • lorsrf (https://github.com/knassar702/lorsrf) - Bruteforcing on Hidden parameters to find SSRF vulnerability using GET and POST Methods.

  • singularity (https://github.com/nccgroup/singularity) - A DNS rebinding attack framework.

  • whonow (https://github.com/brannondorsey/whonow) - A “malicious” DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53).

  • dns-rebind-toolkit (https://github.com/brannondorsey/dns-rebind-toolkit) - A front-end JavaScript toolkit for creating DNS rebinding attacks.

  • dref (https://github.com/FSecureLABS/dref) - DNS Rebinding Exploitation Framework

  • rbndr (https://github.com/taviso/rbndr) - Simple DNS Rebinding Service.

  • httprebind (https://github.com/daeken/httprebind) - Automatic tool for DNS rebinding-based SSRF attacks.

  • dnsFookup (https://github.com/makuga01/dnsFookup) - DNS rebinding toolkit ### SQL Injection.

SQL Injection

XSS Injection

XXE Injection

Miscellaneous

Some other tools for different purposes such as password brute forcing, secrets protections, CMS etc and more.

Password Brute forcing Tools

Secrets

  • git-secrets (https://github.com/awslabs/git-secrets) - Prevents you from committing secrets and credentials into git repositories

  • gitleaks (https://github.com/zricethezav/gitleaks) - Scan git repos (or files) for secrets using regex and entropy

  • truffleHog (https://github.com/dxa4481/truffleHog) - Searches through git repositories for high entropy strings and secrets, digging deep into commit history

  • gitGraber (https://github.com/hisxo/gitGraber) - gitGraber: monitor GitHub to search and find sensitive data in real time for different online services

  • talisman (https://github.com/thoughtworks/talisman) - By hooking into the pre-push hook provided by Git, Talisman validates the outgoing change set for things that look suspicious - such as authorization tokens and private keys.

  • GitGot (https://github.com/BishopFox/GitGot) - Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

  • git-all-secrets (https://github.com/anshumanbh/git-all-secrets) - A tool to capture all the git secrets by leveraging multiple open source git searching tools

  • github-search (https://github.com/gwen001/github-search) - Tools to perform basic search on GitHub.

  • git-vuln-finder (https://github.com/cve-search/git-vuln-finder) - Finding potential software vulnerabilities from git commit messages

  • commit-stream (https://github.com/x1sec/commit-stream) - #OSINT tool for finding Github repositories by extracting commit logs in real time from the Github event API

  • gitrob (https://github.com/michenriksen/gitrob) - Reconnaissance tool for GitHub organizations

  • repo-supervisor (https://github.com/auth0/repo-supervisor) - Scan your code for security misconfiguration, search for passwords and secrets.

  • GitMiner (https://github.com/UnkL4b/GitMiner) - Tool for advanced mining for content on Github

  • shhgit (https://github.com/eth0izzle/shhgit) - Ah shhgit! Find GitHub secrets in real time

  • detect-secrets (https://github.com/Yelp/detect-secrets) - An enterprise friendly way of detecting and preventing secrets in code.

  • rusty-hog (https://github.com/newrelic/rusty-hog) - A suite of secret scanners built in Rust for performance. Based on TruffleHog

  • whispers (https://github.com/Skyscanner/whispers) - Identify hardcoded secrets and dangerous behaviours

  • yar (https://github.com/nielsing/yar) - Yar is a tool for plunderin’ organizations, users and/or repositories.

  • dufflebag (https://github.com/BishopFox/dufflebag) - Search exposed EBS volumes for secrets

  • secret-bridge (https://github.com/duo-labs/secret-bridge) - Monitors Github for leaked secrets

  • earlybird (https://github.com/americanexpress/earlybird) - EarlyBird is a sensitive data detection tool capable of scanning source code repositories for clear text password violations, PII, outdated cryptography methods, key files and more.

  • Trufflehog-Chrome-Extension (https://github.com/trufflesecurity/Trufflehog-Chrome-Extension) - Trufflehog-Chrome-Extension

Git

  • GitTools (https://github.com/internetwache/GitTools) - A repository with 3 tools for pwn’ing websites with .git repositories available

  • gitjacker (https://github.com/liamg/gitjacker) - Leak git repositories from misconfigured websites

  • git-dumper (https://github.com/arthaud/git-dumper) - A tool to dump a git repository from a website

  • GitHunter (https://github.com/digininja/GitHunter) - A tool for searching a Git repository for interesting content

  • dvcs-ripper (https://github.com/kost/dvcs-ripper) - Rip web accessible (distributed) version control systems: SVN/GIT/HG.. ### Buckets

  • S3Scanner (https://github.com/sa7mon/S3Scanner) - Scan for open AWS S3 buckets and dump the contents

  • AWSBucketDump (https://github.com/jordanpotti/AWSBucketDump) - Security Tool to Look For Interesting Files in S3 Buckets

  • CloudScraper (https://github.com/jordanpotti/CloudScraper) - CloudScraper: Tool to enumerate targets in search of cloud resources. S3 Buckets, Azure Blobs, Digital Ocean Storage Space.

  • s3viewer (https://github.com/SharonBrizinov/s3viewer) - Publicly Open Amazon AWS S3 Bucket Viewer

  • festin (https://github.com/cr0hn/festin) - FestIn- S3 Bucket Weakness Discovery

  • s3reverse (https://github.com/hahwul/s3reverse) - The format of various s3 buckets is convert in one format. for bugbounty and security testing.

  • mass-s3-bucket-tester (https://github.com/random-robbie/mass-s3-bucket-tester) - This tests a list of s3 buckets to see if they have dir listings enabled or if they are uploadable

  • S3BucketList (https://github.com/AlecBlance/S3BucketList) - Firefox plugin that lists Amazon S3 Buckets found in requests

  • dirlstr (https://github.com/cybercdh/dirlstr) - Finds Directory Listings or open S3 buckets from a list of URLs

  • Burp-AnonymousCloud (https://github.com/codewatchorg/Burp-AnonymousCloud) - Burp extension that performs a passive scan to identify cloud buckets and then test them for publicly accessible vulnerabilities

  • kicks3 (https://github.com/abuvanth/kicks3) - S3 bucket finder from html,js and bucket misconfiguration testing tool

  • 2tearsinabucket (https://github.com/Revenant40/2tearsinabucket) - Enumerate s3 buckets for a specific target.

  • s3_objects_check (https://github.com/nccgroup/s3_objects_check) - Whitebox evaluation of effective S3 object

  • permissions, to identify publicly accessible files.

  • s3tk (https://github.com/ankane/s3tk) - A security toolkit for Amazon S3

  • CloudBrute (https://github.com/0xsha/CloudBrute) - Awesome cloud enumerator

  • s3cario (https://github.com/0xspade/s3cario) - This tool will get the CNAME first if it’s a valid Amazon s3 bucket and if it’s not, it will try to check if the domain is a bucket name.

  • S3Cruze (https://github.com/JR0ch17/S3Cruze) - All-in-one AWS S3 bucket tool for pentesters ### CMS

  • wpscan (https://github.com/wpscanteam/wpscan) - WPScan is a free, for non-commercial use, black box WordPress security scanner

  • WPSpider (https://github.com/cyc10n3/WPSpider) - A centralized dashboard for running and scheduling WordPress scans powered by wpscan utility.

  • wprecon (https://github.com/blackcrw/wprecon) - Wordpress Recon

  • CMSmap (https://github.com/Dionach/CMSmap) - CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs.

  • joomscan (https://github.com/OWASP/joomscan) - OWASP Joomla Vulnerability Scanner Project

  • pyfiscan (https://github.com/fgeek/pyfiscan) - Free web-application vulnerability and version scanner

JSON Web Token

  • jwt_tool (https://github.com/ticarpi/jwt_tool) - A toolkit for testing, tweaking and cracking JSON Web Tokens

  • c-jwt-cracker (https://github.com/brendan-rius/c-jwt-cracker) - JWT brute force cracker written in C

  • jwt-heartbreaker (https://github.com/wallarm/jwt-heartbreaker) - The Burp extension to check JWT (JSON Web Tokens) for using keys from known from public sources

  • jwtear (https://github.com/KINGSABRI/jwtear) - Modular command-line tool to parse, create and manipulate JWT tokens for hackers

  • jwt-key-id-injector (https://github.com/dariusztytko/jwt-key-id-injector) - Simple python script to check against hypothetical JWT vulnerability.

  • jwt-hack (https://github.com/hahwul/jwt-hack) - jwt-hack is tool for hacking / security testing to JWT.

  • jwt-cracker (https://github.com/lmammino/jwt-cracker) - Simple HS256 JWT token brute force cracker

POST Message

  • postMessage-tracker (https://github.com/fransr/postMessage-tracker) - A Chrome Extension to track postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon

  • PostMessage_Fuzz_Tool (https://github.com/kiranreddyrebel/PostMessage_Fuzz_Tool)

Subdomain Takeover

  • subjack (https://github.com/haccer/subjack) - Subdomain Takeover tool written in Go

  • SubOver (https://github.com/Ice3man543/SubOver) - A Powerful Subdomain Takeover Tool

  • autoSubTakeover (https://github.com/JordyZomer/autoSubTakeover) - A tool used to check if a CNAME resolves to the scope address. If the CNAME resolves to a non-scope address it might be worth checking out if subdomain takeover is possible.

  • NSBrute (https://github.com/shivsahni/NSBrute) - Python utility to takeover domains vulnerable to AWS NS Takeover

  • can-i-take-over-xyz (https://github.com/EdOverflow/can-i-take-over-xyz) - “Can I take over XYZ?” — a list of services and how to claim (sub)domains with dangling DNS records.

  • cnames (https://github.com/cybercdh/cnames) - take a list of resolved subdomains and output any corresponding CNAMES en masse.

  • subHijack (https://github.com/vavkamil/old-repos-backup/tree/master/subHijack-master) - Hijacking forgotten & misconfigured subdomains

  • tko-subs (https://github.com/anshumanbh/tko-subs) - A tool that can help detect and takeover subdomains with dead DNS records

  • HostileSubBruteforcer (https://github.com/nahamsec/HostileSubBruteforcer) - This app will bruteforce for existing subdomains and provide information if the 3rd party host has been properly setup.

  • second-order (https://github.com/mhmdiaa/second-order) - Second-order subdomain takeover scanner

  • takeover (https://github.com/mzfr/takeover) - A tool for testing subdomain takeover possibilities at a mass scale.

  • dnsReaper (https://github.com/punk-security/dnsReaper) - DNS Reaper is yet another sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal!

Vulnerability Scanners

  • nuclei (https://github.com/projectdiscovery/nuclei) - Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use.

  • Sn1per (https://github.com/1N3/Sn1per) - Automated pentest framework for offensive security experts

  • metasploit-framework (https://github.com/rapid7/metasploit-framework) - Metasploit Framework

  • nikto (https://github.com/sullo/nikto) - Nikto web server scanner

  • arachni (https://github.com/Arachni/arachni) - Web Application Security Scanner Framework

  • jaeles (https://github.com/jaeles-project/jaeles) - The Swiss Army knife for automated Web Application Testing

  • retire.js (https://github.com/RetireJS/retire.js) - scanner detecting the use of JavaScript libraries with known vulnerabilities

  • Osmedeus (https://github.com/j3ssie/Osmedeus) - Fully automated offensive security framework for reconnaissance and vulnerability scanning

  • getsploit (https://github.com/vulnersCom/getsploit) - Command line utility for searching and downloading exploits

  • flan (https://github.com/cloudflare/flan) - A pretty sweet vulnerability scanner

  • Findsploit (https://github.com/1N3/Findsploit) - Find exploits in local and online databases instantly

  • BlackWidow (https://github.com/1N3/BlackWidow) - A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

  • backslash-powered-scanner (https://github.com/PortSwigger/backslash-powered-scanner) - Finds unknown classes of injection vulnerabilities

  • Eagle (https://github.com/BitTheByte/Eagle) - Multithreaded Plugin based vulnerability scanner for mass detection of web-based applications vulnerabilities

  • cariddi (https://github.com/edoardottt/cariddi) - Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more…

  • OWASP ZAP (https://github.com/zaproxy/zaproxy) - World’s most popular free web security tools and is actively maintained by a dedicated international team of volunteers

Non Categorized

  • JSONBee (https://github.com/zigoo0/JSONBee) - A ready to use JSONP endpoints/payloads to help bypass content security policy (CSP) of different websites.

  • CyberChef (https://github.com/gchq/CyberChef) - The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis()

  • bountyplz (https://github.com/fransr/bountyplz) - Automated security reporting from markdown templates (HackerOne and Bugcrowd are currently the platforms supported)

  • PayloadsAllTheThings (https://github.com/swisskyrepo/PayloadsAllTheThings) - A list of useful payloads and bypass for Web Application Security and Pentest/CTF

  • bounty-targets-data (https://github.com/arkadiyt/bounty-targets-data) - This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports

  • android-security-awesome (https://github.com/ashishb/android-security-awesome) - A collection of android security related resources

  • awesome-mobile-security (https://github.com/vaib25vicky/awesome-mobile-security) - An effort to build a single place for all useful android and iOS security related stuff.

  • awesome-vulnerable-apps (https://github.com/vavkamil/awesome-vulnerable-apps) - Awesome Vulnerable Applications

  • XFFenum (https://github.com/vavkamil/XFFenum) - X-Forwarded-For [403 forbidden] enumeration

  • httpx (https://github.com/projectdiscovery/httpx) - httpx is a fast and multi-purpose HTTP toolkit allow to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads.

PreviousXML External Entity InjectionsNextTryHackMe

Last updated