Kong'

A web tool for converting BIP39 mnemonic codes

基于 EMA 通道策略的多市场投资回测 Python 脚本，支持加密货币、美股、港股、A股等多种市场的历史数据回测，可配置回测周期、不同 K 线数据类型，并提供详细的回测结果分析和可视化。

渗透 超全面的渗透资料💯 包含：0day，xss，sql注入，提权……

No description.

xxl-job RESTful API RCE

No description.

A mutation testing tool for Solidity Smart Contracts

Alchemist Test Generator

No description.

Xiaomi Home Integration for Home Assistant

Get the source code of the specified address from the chain

No description.

CVE-2023-38831 winrar exploit generator

2018年初整理的一些内网渗透TIPS，后面更新的慢，所以整理出来希望跟小伙伴们一起更新维护~

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

Checklist of the most important security countermeasures when designing, testing, and releasing your API

Finds matching solidity function signatures for a given 4 byte signature hash and arguments.

No description.

No description.

The ETH smart contract for the Provable Token!

The bot will monitor all new contract creations

A compilation of smart contracts I find cool/fun/interesting.

An awesome curated list of Cryptoeconomic research and learning materials

A tool for tracking updates in Github repositories and sending push notifications to Telegram / Twitter.

Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

Tools for gathering information and actions forensic

Automate downloading archived deleted Tweets.

Official repository for Paradigm CTF 2021

Get up to speed on Maximum Extractable Value

No description.

No description.

轻量级知识库&POC管理平台

Quickly upload files to aliyun OSS by aliyun-oss-csharp-sdk

No description.

InQL - A Burp Extension for GraphQL Security Testing

unc0ver jailbreak for iOS 11.0 - 12.4

Simple interface for flashbots.net

An exhaustive list of all the possible ways you can chain your Blind SSRF vulnerability

No description.

Bash script to extract data from an Android device

《How to Hack Like a Pornstar》中文翻译

Tool for automating customized attacks against web applications. Full made in C language with pthreads, have a fast performance.

Top disclosed reports from HackerOne

CobaltStrike's source code

dex修复程序

Recovers passwords from pixelized screenshots

安卓逆向工程 ELFRead、Frida、FridaDump、DexDump、SoDump、Ghidra、IdaPro、GDA、Jadx、Objection、Xposed...

A box containing all you need to get started with developing Aave v1 flash loans

No description.

This is a SMS And Call Bomber For Linux And Termux

Exploitation Framework for Embedded Devices

No description.

A fast port scanner written in go with focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests

溯光 (TrackRay) 3 beta⚡渗透测试框架（资产扫描|指纹识别|暴力破解|网页爬虫|端口扫描|漏洞扫描|代码审计|AWVS|NMAP|Metasploit|SQLMap）

ARL(Asset Reconnaissance Lighthouse)资产侦察灯塔系统旨在快速侦察与目标关联的互联网资产，构建基础资产信息库。 协助甲方安全团队或者渗透测试人员有效侦察和检索资产，发现存在的薄弱点和攻击面。

Sifter is a OSINT, recon & vulnerability scanner. It incorporates a plethara of tools within different module sets that tries to cover every attack vector. Allowing you to quickly perform recon tasks and organize the results in one place. From OSINT to Recon, Exploitation, Post-Exploitation, OpSec, Threat Analysis, XSS, SQLinjection, Network Scanning, WebApp Analysis or DNS enumeration.. Sifter should be able to cover it all.

When MVC magic turns black

No description.

Image Payload Creating/Injecting tools

中国程序员容易发音错误的单词

Differential Fuzz Testing of Ethereum Virtual Machine

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

Find cloud assets that no one wants exposed 🔎 ☁️

百宝箱

The best design tools for everything 👉

No description.

Burp suite 分块传输辅助插件

A denial-of-service proof-of-concept for CVE-2020-1350

The Offensive Manual Web Application Penetration Testing Framework.

Ah shhgit! Find GitHub secrets in real time

No description.

A curated list of awesome Ethereum security references

The purpose of this document is to gather public information on vulnerabilities introduced on Blockchains software.

A curated list of awesome things related to blockchain security

收集所有区块链(BlockChain)技术开发相关资料，包括Fabric和Ethereum开发资料

F5 BIG-IP Scanner (CVE-2020-5902)

A tool for checking BigSpender vulnerability in your Bitcoin wallet

Making Favicon.ico based Recon Great again !

gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat的漏洞利用脚本，优先更新高危且易利用的漏洞利用脚本，最新添加CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2019-2618、CVE-2019-6340

Static analysis tools for all programming languages, build tools, config files and more.

🔍 gowitness - a golang, web screenshot utility using Chrome Headless

A Conversational AI RPA SDK for Chatbot

No description.

No description.

SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 checklist

Fastjson vulnerability quickly exploits the framework（fastjson漏洞快速利用框架）

fastjson命令执行利用工具， remote code execute

A simple script to screenshot a list of websites

A survey of active mixer efforts on Ethereum, including history, context and benchmarks. Commissioned by MolochDAO 👹.

This is an exploit for CVE-2020-0674 that runs on the x64 version of IE 8, 9, 10, and 11 on Windows 7.

GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic) parameters grep

A command line tool to download Android applications directly from the Google Play Store by specifying their package name (an initial one-time configuration is required)

A collection of open source and commercial tools that aid in red team operations.

No description.

Infosec Wordlists

A wordlist of API names for web application assessments

No description.

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

Gitbook

GitHound pinpoints exposed API keys on GitHub using pattern matching, commit history searching, and a unique result scoring system. A batch-catching, pattern-matching, patch-attacking secret snatcher.

Sudomy is a subdomain enumeration tool, created using a bash script, to analyze domains and collect subdomains in fast and comprehensive way . Report output in HTML or CSV format

爆破字典

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

Find broken links, missing images, etc within your HTML.

Stowaway -- Multi-hop Proxy Tool for pentesters

JNDI 注入利用工具

:cat2:美杜莎扫描器（scanner） http://medusa.ascotbe.com

通过BurpSuite来构建自己的爆破字典，可以通过字典爆破来发现隐藏资产。

此项目用来提取收集以往泄露的密码中符合条件的强弱密码

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

Penetration tests guide based on OWASP including test cases, resources and examples.

No description.

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

一个fuzzdb扩展库

织梦全版本漏洞扫描

Awesome Burp Suite Resources. 400+ open source Burp plugins, 500+ posts and videos.

No description.

Web Pentesting Fuzz 字典,一个就够了。

eosio-web-ide

xray 安全评估工具

异步漏洞并发通用的EXP，可进行短信1分钟限制发送时长绕过，购物购买并发漏洞，如果你思路可以，你也可以用它来抢票~

中国大陆 31 个省份1978 年至 2019 年一千多万工商企业注册信息，包含企业名称、注册地址、统一社会信用代码、地区、注册日期、经营范围、法人代表、注册资金、企业类型等详细资料。This repository is an dataset of over 10,000,000 enterprise registration data of 31 provinces in Chinese mainland from 1978 to 2019.【工商大数据】、【企业信息】、【enterprise registration data】。

K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)

github泄露扫描系统

应急响应实战笔记，一个安全工程师的自我修养。

在线cms识别|旁站|c段|信息泄露|工控|系统|物联网安全|cms漏洞扫描|nmap端口扫描|子域名获取|待续..

All Algorithms implemented in Python

No description.