637 Open source projects that are alternatives of or similar to Qsfuzz

Decode All Bases - Base Scheme Decoder

🎯 XML External Entity (XXE) Injection Payload List

HTTP Request Smuggling over HTTP/2 Cleartext (h2c)

Information Security Library

A collection of response templates for invalid bug bounty reports.

Astra is a tool to find URLs and secrets inside a webpage/files

Misc. Public Reports of Penetration Testing and Security Audits.

A Tool for Domain Flyovers

This repo is about @harshbothra_ 365 days of learning Tweet & Mindmap collection

#legalbugbounty project — creating safe harbors on bug bounty programs and vulnerability disclosure programs. Authored by Amit Elazari.

Related subdomains finder

One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password 🛡️

Turn your VPS into an attack box

goverview - Get an overview of the list of URLs

Pass in a list of URLs with query strings, get back a unique list of URLs and query string combinations

A simple python script which can check HTTP status of branch of URLs/Subdomains and grab URLs/Subdomain title

XSS in pastebin.com and reddit.com via unsanitized markdown output

巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。

This document proposes a way of standardising the structure, language, and grammar used in security policies.

For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual recon. 🛡️⚔️🧙

Intelligence tool but without API key

Multi Tool Subdomain Enumeration

A big list of Android Hackerone disclosed reports and other resources.

Subdomain Takeover tool written in Go

Scan for open AWS S3 buckets and dump the contents

Toolset for detecting reflected xss in websites

A little collection of fun and creative proof of concepts to demonstrate the potential impact of a security vulnerability.

Pentest: Subdomains enumeration tool for penetration testers.

MagicRecon is a powerful shell script to maximize the recon and data collection process of an objective and finding common vulnerabilities, all this saving the results obtained in an organized way in directories and with various formats.

GradeJS analyzes production Webpack bundles without having access to the source code of a website. Instantly see vulnerabilities, outdated packages, and more just by entering a web application URL.

Little Bug Bounty & Hacking Tools⚔️

Find exposed API keys based on RegEx and get exploitation methods for some of keys that are found

Leverage ASN to look up IP addresses (IPv4 & IPv6) owned by a specific organization for reconnaissance purposes, then run port scanning on it.

Tool that will request the public disclosures on a specific HackerOne program and show them in a localhost webserver.

Community Workflow for the Osmedeus Engine that describes basic reconnaissance methodology for you to build your own

sub domain wild card filtering tool

A collection of over 5.1 million sub-domains and assets belonging to public bug bounty programs, compiled into a repo, for performing bulk operations.

Subcert is an subdomain enumeration tool, that finds all the subdomains from certificate transparency logs.

Automated reconnaissance wrapper — TomNomNom's meg on steroids. [DEPRECATED]

Awesome cloud enumerator

The fastest dork scanner written in Go.

all manner of wordlists

Security Manage Framwork is a security management platform for enterprise intranet, which includes asset management, vulnerability management, account management, knowledge base management, security scanning automation function modules, and can be used for internal security management. This platform is designed to help Party A with fewer security personnel, complicated business lines, difficult periodic inspection and low automation to better achieve internal safety management.

Bug Bounty Guide is a launchpad for bug bounty programs and bug bounty hunters.

Collection of small security tools, mostly in Bash and Python. CTFs, Bug Bounty and other stuff.

bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.

Web path scanner

Security Mindmap that could be useful for the infosec community when doing pentest, bug bounty or red-team assessments.

Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

Hetty is an HTTP toolkit for security research.

A Storehouse of resources related to Bug Bounty Hunting collected from different sources. Latest guides, tools, methodology, platforms tips, and tricks curated by us.

RFD Checker - security CLI tool to test Reflected File Download issues

Secret and/ credential patterns used for gf.

The Swiss Army knife for automated Web Application Testing

An OSINT tool to find contacts in order to report security vulnerabilities.

A collection of some of my scripts

A list of interesting payloads, tips and tricks for bug bounty hunters.

This challenge is Inon Shkedy's 31 days API Security Tips.

Auto setup is a bash script compatible with Debian based distributions to install and setup necessary programs.

Takes a single wordlist item and tests it one by one over a large collection of websites before moving onto the next. Create signatures to cross-check vulnerabilities over multiple hosts.