costelm

costelm's Stars

• KingOfBugbounty/KingOfBugBountyTips

  Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters..

  Language:Go4.2k812

• robre/scripthunter

  Tool to find JavaScript files on Websites

  Language:Shell51395

• robre/jsmon

  a javascript change monitoring tool for bugbounties

  Language:Python58883

• teknogeek/ssrf-sheriff

  A simple SSRF-testing sheriff written in Go

  Language:Go31559

• davidson679/Bypass-Web-Application-Firewalls

  Bypassing-Web-Application-Firewalls-And-XSS-Filters A series of python scripts for generating weird character combinations and lists for BurpSuite Pro for bypassing web application firewalls (WAF) and XSS filters. These python scripts have been created to fuzz wierd combinations: URL Escape Characters HTML Escape Characters Binary Characters These scripts were created during an assessment, while trying to bypass a Web Application Firewall (WAF) in order to exploit a XSS vulnerability. Differnt webservers and browsers interpret URL and strange characters differently which could lead to the bypassing of security controls. When I tried to send a > or < character the WAF would block the request. The following URL escapes I have noticed are traslated to < > ' by Apache2 based web servers: %(N%(n%)S%)U%)^%)s%)u%*C%*E%*c%*e%,.%.#%1N%1n%2S%2U%2^%2s%2u%3C%3E%3c%3e%5.%7#%:C%:E %:c%:e%HN%Hn%IS%IU%I^%Is%Iu%JC%JE%Jc%Je%L.%N#%XN%Xn%YS%YU%Y^%Ys%Yu%ZC%ZE%Zc%Ze%.%^# %hN%hn%iS%iU%i^%is%iu%jC%jE%jc%je%l.%n#%xN%xn%yS%yU%y^%ys%yu%zC%zE%zc%ze%|

  Language:Python14234

• cujanovic/subdomain-bruteforce-list

  subdomain bruteforce list

  9838

• cujanovic/Markdown-XSS-Payloads

  XSS payloads for exploiting Markdown syntax

  447177

• cujanovic/CRLF-Injection-Payloads

  Payloads for CRLF Injection

  21691

• cujanovic/SSRF-Testing

  SSRF (Server Side Request Forgery) testing resources

  Language:Python2.3k480

• devsecops/awesome-devsecops

  An authoritative list of awesome devsecops tools with the help from community experiments and contributions.

  4.6k968

• devsecops/bootcamp

  A open contribute bootcamp to develop DevSecOps skills...

  Language:Shell704351

• pxb1988/dex2jar

  Tools to work with android .dex and java .class files

  Language:Java12.3k2.1k

• infosecn1nja/ThreatHunter-Playbook

  A Threat hunter's playbook to aid the development of techniques and hypothesis for hunting campaigns.

  1010

• infosecn1nja/Red-Team-Infrastructure-Wiki

  Wiki to collect Red Team infrastructure hardening resources

  188

• infosecn1nja/Red-Teaming-Toolkit

  This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

  9.1k2.2k

• infosecn1nja/AD-Attack-Defense

  Attack and defend active directory using modern post exploitation adversary tradecraft activity

  4.4k1k

• certsocietegenerale/IRM-deprecated

  Incident Response Methodologies

  1k216

• googleprojectzero/BrokenType

  TrueType and OpenType font fuzzing toolset

  Language:C++43073

• AndProx/AndProx

  Native Android Proxmark3 client (no root required)

  Language:Java23343

• ewhitehats/InvisiblePersistence

  Persisting in the Windows registry "invisibly"

  Language:C++33864

• NVISOsecurity/MagiskTrustUserCerts

  A Magisk/KernelSU module that automatically adds user certificates to the system root CA store

  Language:Shell1.8k210

• Nekmo/dirhunt

  Find web directories without bruteforce

  Language:Python1.8k255

• nccgroup/house

  A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python.

  Language:JavaScript1.4k226

• P3GLEG/Whaler

  Program to reverse Docker images into Dockerfiles

  Language:Go1.1k95

• s0md3v/XSStrike

  Most advanced XSS scanner.

  Language:Python13.4k1.9k

• threat9/routersploit

  Exploitation Framework for Embedded Devices

  Language:Python12.2k2.3k

• archerysec/archerysec

  ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec.

  Language:JavaScript2.3k504

• federicodotta/Brida

  The new bridge between Burp Suite and Frida!

  Language:Java1.6k208

• OffXec/Samurai

  Samurai Email Discovery - SED is a email discovery framework that grabs emails via google dork, company name, or domain name.

  Language:Shell8019

• cryps1s/DARKSURGEON

  DARKSURGEON is a Windows packer project to empower incident response, digital forensics, malware analysis, and network defense.

  Language:PowerShell46368