WPScan is a free, for non-commercial use, black box WordPress vulnerability scanner written for security professionals and blog maintainers to test the security of their sites.

HackerOne "in scope" domains for all your fuzzing needs

List of periodically validated public DNS resolvers

The most exhaustive list of reliable DNS resolvers.

List of Hourly Updated Fresh DNS resolvers

get things from one computer to another, safely

My files for security assessments, bug bounty and more

Compiles a list of major CDN and WAF subnets.

RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, se…

Maximizing BloodHound. Max is a good boy.

Faster Nmap Scanning with Rust

A source code static analysis platform for AppSec enthusiasts.

OSINT automation for hackers.

Kubernetes community content

Beyond XSS: Explore the Web Front-end Security Universe. A series about front-end security

A python script to scan for Apache Tomcat server vulnerabilities.

Real-world infosec wordlists, updated regularly

Our security focused static analysis tool for Android and Java applications.

jSQL Injection is a Java application for automatic SQL database injection.

Privilege Escalation Enumeration Script for Windows

Slack Enumeration and Extraction Tool - extract sensitive information from a Slack Workspace

Security Auditor Utility for GraphQL APIs

Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers

Here I gather all the resources about PenTesting and Bug Bounty Hunting that I find interesting

PingCastle - Get Active Directory Security at 80% in 20% of the time

Create randomly insecure VMs

A repository for learning various heap exploitation techniques.

A CLI-based HTTP intercept and replay proxy

Network recon framework, published by @cea-sec & @ANSSI-FR. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, c…