A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Automatic SQL injection and database takeover tool

Impacket is a collection of Python classes for working with network protocols.

Freeze (package) Python programs into stand-alone executables

Fast subdomains enumeration tool for penetration testers

Credentials recovery project

A swiss army knife for pentesting networks

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

An advanced memory forensics framework

Web application fuzzer

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Windows Exploit Suggester - Next Generation

Veil 3.1.X (Check version info in Veil at runtime)

This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public expl…

Printer Exploitation Toolkit - The tool that made dumpster diving obsolete.

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.

A DNS meta-query spider that enumerates DNS records, and subdomains.

Tool to look for several security related Android application vulnerabilities

The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.

Automated NoSQL database enumeration and web application exploitation tool.

Mimikatz implementation in pure Python

Investigate malicious Windows logon by visualizing and analyzing Windows event log

Privilege Escalation Project - Windows / Linux / Mac

MS17-010

A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.

Notes about attacking Jenkins servers

A Python based ingestor for BloodHound

Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner

Network Infrastructure Penetration Testing Tool