CTF Field Guide

Written by Trail of Bits.

Hacker101

Written by hackerone.

Infosec Newbie

Written by Mark Robinson.

PayloadsAllTheThings

Written by @swisskyrepo.

The Daily Swig - Web security digest

Written by PortSwigger.

The Magic of Learning

Written by @bitvijays.

Web Application Security Zone by Netsparker

Written by Netsparker.

tl;dr sec

Weekly summary of top security tools, blog posts, and security research.

Dark Reading

Connecting The Information Security Community.

HackDig

Dig high-quality web security articles for hacker.

Phrack Magazine

Ezine written by and for hackers.

Security Weekly

The security podcast network.

The Hacker News

Security in a serious way.

The Register

Biting the hand that feeds IT.

C.XSS Guide

Written by @JakobKallin and Irene Lobo Valbuena.

Cross-Site Scripting – Application Security – Google

Written by Google.

H5SC

Written by @cure53.

THE BIG BAD WOLF - XSS AND MAINTAINING ACCESS

Written by Paulos Yibelo.

AwesomeXSS

Written by @s0md3v.

XSS.png

Written by @jackmasa.

PayloadsAllTheThings

Written by @swisskyrepo.

Laravel Content Security Policy: Complete Implementation Guide

Hands-on guide to implementing Content Security Policy in Laravel — nonce lifecycle, Vite and Livewire integration, violation reporting, and a pre-enforcement checklist, by @itxshakil.

Prototype pollution attack in NodeJS application

Written by @HoLyVieR.

CSV Injection -> Meterpreter on Pornhub

Written by Andy.

The Absurdly Underestimated Dangers of CSV Injection

Written by George Mauer.

PayloadsAllTheThings

Written by @swisskyrepo.

SQL Injection Cheat Sheet

Written by @netsparker.

SQL Injection Pocket Reference

Written by @LightOS.

SQL Injection Wiki

Written by NETSPI.

PayloadsAllTheThings

Written by @swisskyrepo.

Potential command injection in resolv.rb

Written by @drigg3r.

PayloadsAllTheThings

Written by @swisskyrepo.

HQL : Hyperinsane Query Language (or how to access the whole SQL API within a HQL injection ?)

Written by @_m0bius.

HQL for pentesters

Written by @h3xstream.

ORM Injection

Written by Simone Onofri.

ORM2Pwn: Exploiting injections in Hibernate ORM

Written by Mikhail Egorov.

Advisory: Java/Python FTP Injections Allow for Firewall Bypass

Written by Timothy Morgan.

SMTP over XXE − how to send emails using Java's XML parser

Written by Alexander Klink.

XXE

Written by @phonexicum.

PayloadsAllTheThings

Written by @swisskyrepo.

XML external entity (XXE) injection

Written by portswigger.

Wiping Out CSRF

Written by @jrozner.

PayloadsAllTheThings

Written by @swisskyrepo.

Clickjacking

Written by Imperva.

X-Frame-Options: All about Clickjacking?

Written by Mario Heiderich.

SSRF bible. Cheatsheet

Written by Wallarm.

PayloadsAllTheThings

Written by @swisskyrepo.

Practical Web Cache Poisoning

Written by @albinowax.

PayloadsAllTheThings

Written by @swisskyrepo.

Large-scale analysis of style injection by relative path overwrite

Written by The Morning Paper.

MBSD Technical Whitepaper - A few RPO exploitation techniques

Written by Mitsui Bussan Secure Directions, Inc..

Open Redirect Vulnerability

Written by s0cket7.

PayloadsAllTheThings

Written by @swisskyrepo.

How to Hunt Bugs in SAML; a Methodology - Part I

Written by epi.

How to Hunt Bugs in SAML; a Methodology - Part II

Written by epi.

How to Hunt Bugs in SAML; a Methodology - Part III

Written by epi.

PayloadsAllTheThings

Written by @swisskyrepo.

File Upload Restrictions Bypass

Written by Haboob Team.

PayloadsAllTheThings

Written by @swisskyrepo.

Rails Security - First part

Written by @qazbnm456.

Official Rails Security Guide

Written by Rails team.

Rails SQL Injection

Written by @presidentbeef.

Zen Rails Security Checklist

Written by @brunofacca.

DOM based Angular sandbox escapes

Written by @garethheyes.

XSS without HTML: Client-Side Template Injection with AngularJS

Written by Gareth Heyes.

XSS via a spoofed React element

Written by Daniel LeCheminant.

SSL & TLS Penetration Testing

Written by APTIVE.

Practical introduction to SSL/TLS

Written by @Hakky54.

State of TLS on the public web

Live-data research across thousands of scanned hosts: protocol adoption, the TLS-versus-headers maturity gap, ECDSA drawing even with RSA, certificate lifetimes against the CA/B Forum 47-day schedule, and the end of OCSP stapling. Figures recompute from the scan corpus on each load.

NFS | PENETRATION TESTING ACADEMY

Written by PENETRATION ACADEMY.

PENETRATION TESTING AWS STORAGE: KICKING THE S3 BUCKET

Written by Dwight Hohnstein from Rhino Security Labs.

AWS PENETRATION TESTING PART 1. S3 BUCKETS

Written by VirtueSecurity.

AWS PENETRATION TESTING PART 2. S3, IAM, EC2

Written by VirtueSecurity.

Cloud Security Risks (Part 1): Azure CSV Injection Vulnerability

Written by @spengietz.

Common Azure Security Vulnerabilities and Misconfigurations

Written by @rhinobenjamin.

Applied Crypto Hardening

Written by The bettercrypto.org Team.

What is a Side-Channel Attack ?

Written by J.M Porup.

Hacking with JSP Shells

Written by @_nullbind.

Hunting for Web Shells

Written by Jacob Baines.

Hacking Cryptocurrency Miners with OSINT Techniques

Written by @s3yfullah.

OSINT x UCCU Workshop on Open Source Intelligence

Written by Philippe Lin.

102 Deep Dive in the Dark Web OSINT Style Kirby Plessas

Presented by @kirbstr.

The most complete guide to finding anyone’s email

Written by Timur Daudpota.

Attacking Private Networks from the Internet with DNS Rebinding

Written by @brannondorsey.

Hacking home routers from the Internet

Written by @radekk.

What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.

Written by @breenmachine.

.NET Roulette: Exploiting Insecure Deserialization in Telerik UI

Written by @noperator.

Attacking .NET deserialization

Written by @pwntester.

How to exploit the DotNetNuke Cookie Deserialization

Written by CRISTIAN CORNEA.

HOW TO EXPLOIT LIFERAY CVE-2020-7961 : QUICK JOURNEY TO POC

Written by @synacktiv.

Altus iX Developer XAML Deserialization RCE

Root-cause analysis and reproducible PoC for a XAML deserialization RCE (CVSS 7.3) in a SCADA HMI engineering IDE, including affected versions and a self-contained exploit script, published by 0day Rubbish.

What is going on with OAuth 2.0? And why you should not use it for authentication.

Written by @damianrusinek.

Introduction to OAuth 2.0 and OpenID Connect

Written by @PhilippeDeRyck.

Hardcoded secrets, unverified tokens, and other common JWT mistakes

Written by @ermil0v.

Bypass Fix of OOB XXE Using Different encoding

Written by @SpiderSec.

CSP: bypassing form-action with reflected XSS

Written by Detectify Labs.

TWITTER XSS + CSP BYPASS

Written by Paulos Yibelo.

Neatly bypassing CSP

Written by Wallarm.

Evading CSP with DOM-based dangling markup

Written by portswigger.

GitHub's CSP journey

Written by @ptoomey3.

GitHub's post-CSP journey

Written by @ptoomey3.

Any protection against dynamic module import?

Written by @shhnjk.

Airbnb – When Bypassing JSON Encoding, XSS Filter, WAF, CSP, and Auditor turns into Eight Vulnerabilities

Written by @Brett Buerhaus.

How to bypass libinjection in many WAF/NGWAF

Written by @d0znpp.

Web Application Firewall (WAF) Evasion Techniques

Written by @secjuice.

Web Application Firewall (WAF) Evasion Techniques #2

Written by @secjuice.

JavaScript MVC and Templating Frameworks

Written by Mario Heiderich.

Trend Micro Threat Discovery Appliance - Session Generation Authentication Bypass (CVE-2016-8584)

Written by @malerisch and @steventseeley.

Neat tricks to bypass CSRF-protection

Written by Twosecurity.

Stealing CSRF tokens with CSS injection (without iFrames)

Written by @dxa4481.

If HttpOnly You Could Still CSRF… Of CORS you can!

Written by @GraphX.

Clickjackings in Google worth 14981.7$

Written by @raushanraj_65039.

DRUPAL 7.X SERVICES MODULE UNSERIALIZE() TO RCE

Written by Ambionics Security.

Exploiting Node.js deserialization bug for Remote Code Execution

Written by OpSecX.

GitHub Enterprise Remote Code Execution

Written by @iblue.

How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!

Written by Orange.

How we exploited a remote code execution vulnerability in math.js

Written by @capacitorset.

$36k Google App Engine RCE

Written by Ezequiel Pereira.

Poor RichFaces

Written by CODE WHITE.

Remote Code Execution on a Facebook server

Written by @blaklis_.

WebLogic RCE (CVE-2019-2725) Debug Diary

Written by Badcode@Knownsec 404 Team.

What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.

Written by @breenmachine.

CVE-2019-1306: ARE YOU MY INDEX?

Written by @yu5k3.

DON'T TRUST THE DOM: BYPASSING XSS MITIGATIONS VIA SCRIPT GADGETS

Written by Sebastian Lekies, Krzysztof Kotowicz, and Eduardo Vela.

ECMAScript 6 from an Attacker's Perspective - Breaking Frameworks, Sandboxes, and everything else

Written by Mario Heiderich.

How I found a $5,000 Google Maps XSS (by fiddling with Protobuf)

Written by @marin_m.

Query parameter reordering causes redirect page to render unsafe URL

Written by kenziy.

Uber XSS via Cookie

Written by zhchbin.

Stored XSS on Facebook

Written by Enguerran Gillier.

Another XSS in Google Colaboratory

Written by Michał Bentkowski.

XSS in Google Colaboratory + CSP bypass

Written by Michał Bentkowski.

XSS-Auditor — the protector of unprotected and the deceiver of protected.

Written by @terjanq.

XSS without parentheses and semi-colons

Written by @garethheyes.

GitHub Enterprise SQL Injection

Written by Orange.

Making a Blind SQL Injection a little less blind

Written by TomNomNom.

Red Team Tales 0x01: From MSSQL to RCE

Written by Tarlogic.

MySQL Error Based SQL Injection Using EXP

Written by @osandamalith.

SQL INJECTION AND POSTGRES - AN ADVENTURE TO EVENTUAL RCE

Written by @denandz.

GraphQL NoSQL Injection Through JSON Types

Written by Pete.

XML Out-Of-Band Data Retrieval

Written by @a66at and Alexey Osipov.

Evil XML with two encodings

Written by Arseniy Sharoglazov.

Automating local DTD discovery for XXE exploitation

Written by Philippe Arteau.

Exploiting XXE with local DTD files

Written by Arseniy Sharoglazov.

Forcing XXE Reflection through Server Error Messages

Written by Antti Rantasaari.

Pre-authentication XXE vulnerability in the Services Drupal module

Written by Renaud Dubourguais.

XML Out-Of-Band Data Retrieval

Written by @a66at and Alexey Osipov.

XXE in WeChat Pay Sdk ( WeChat leave a backdoor on merchant websites)

Written by Rose Jackcode.

XXE OOB extracting via HTTP+FTP using single opened port

Written by skavans.

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

Written by Orange.

SSRF in https://imgur.com/vidgif/url

Written by aesteral.

PHP SSRF Techniques

Written by @themiddleblue.

SSRF in Exchange leads to ROOT access in all instances

Written by @0xacb.

Into the Borg – SSRF inside Google production network

Written by opnsec.

Piercing the Veil: Server Side Request Forgery to NIPRNet access

Written by Alyssa Herrera.

All you need to know about SSRF and how may we write tools to do auto-detect

Written by @Auxy233.

AWS takeover through SSRF in JavaScript

Written by Gwen.

Bypassing Web Cache Poisoning Countermeasures

Written by @albinowax.

Cache poisoning and other dirty tricks

Written by Wallarm.

Advisory: Java/Python FTP Injections Allow for Firewall Bypass

Written by Timothy Morgan.

[dev.twitter.com] XSS

Written by Sergey Bobrov.

Phishing with Unicode Domains

Written by Xudong Zheng.

Some Problems Of URLs

Written by Chris Palmer.

Unicode Domains are bad and you should feel bad for supporting them

Written by VRGSEC.

Inducing DNS Leaks in Onion Web Services

Written by @epidemics-scepticism.

Stored XSS, and SSRF in Google using the Dataset Publishing Language

Written by @signalchaos.

How I hacked Google’s bug tracking system itself for $15,600 in bounties

Written by @alex.birsan.

Some Tricks From My Secret Group

Written by phithon.

IE11 Information disclosure - local file detection

Written by James Lee.

JSON hijacking for the modern web

Written by portswigger.

Особенности Safari в client-side атаках

Written by Bo0oM.

How do we Stop Spilling the Beans Across Origins?

Written by aaj at google.com and mkwst at google.com.

Setting arbitrary request headers in Chromium via CRLF injection

Written by Michał Bentkowski.

The inception bar: a new phishing method

Written by jameshfisher.

Bypassing Mobile Browser Security For Fun And Profit

Written by @rafaybaloch.

The Cookie Monster in Your Browsers

Written by @filedescriptor.

The world of Site Isolation and compromised renderer

Written by @shhnjk.

Sending arbitrary IPC messages via overriding Function.prototype.apply

Written by @kinugawamasato.

SSD Advisory – Chrome Turbofan Remote Code Execution

Written by SecuriTeam Secure Disclosure (SSD).

PUSHING WEBKIT'S BUTTONS WITH A MOBILE PWN2OWN EXPLOIT

Written by @wanderingglitch.

A Methodical Approach to Browser Exploitation

Written by RET2 SYSTEMS, INC.

CVE-2017-2446 or JSC::JSGlobalObject::isHavingABadTime.

Written by Diary of a reverse-engineer.

Breaking UC Browser

Written by Доктор Веб.

awesome-cve-poc

Curated list of CVE PoCs by @qazbnm456.

js-vuln-db

Collection of JavaScript engine CVEs with PoCs by @tunz.

Some-PoC-oR-ExP

各种漏洞poc、Exp的收集或编写 by @coffeehb.

uxss-db

Collection of UXSS CVEs with PoCs by @Metnew.

SPLOITUS

Exploits & Tools Search Engine by @i_bo0om.

Exploit Database

ultimate archive of Exploits, Shellcode, and Security Papers by Offensive Security.

Capture the Flag CheatSheet

Written by @uppusaikiran.

XSS Cheat Sheet - 2018 Edition

Written by @brutelogic.

A2SV

Auto Scanning to SSL Vulnerability by @hahwul.

prowler

Tool for AWS security assessment, auditing and hardening by @Alfresco.

slurp

Evaluate the security of S3 buckets by @hehnope.

commix

Automated All-in-One OS command injection and exploitation tool by @commixproject.

Censys

Censys is a search engine that allows computer scientists to ask questions about the devices and networks that compose the Internet by University of Michigan.

FOCA

FOCA (Fingerprinting Organizations with Collected Archives) is a tool used mainly to find metadata and hidden information in the documents its scans by ElevenPaths.

FOFA

Cyberspace Search Engine by BAIMAOHUI.

gitrob

Reconnaissance tool for GitHub organizations by @michenriksen.

GSIL

Github Sensitive Information Leakage（Github敏感信息泄露）by @FeeiCN.

NSFOCUS

THREAT INTELLIGENCE PORTAL by NSFOCUS GLOBAL.

raven

raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin by @0x09AL.

Shodan

Shodan is the world's first search engine for Internet-connected devices by @shodanhq.

SpiderFoot

Open source footprinting and intelligence-gathering tool by @binarypool.

urlscan.io

Service which analyses websites and the resources they request by @heipei.

xray

XRay is a tool for recon, mapping and OSINT gathering from public networks by @evilsocket.

ZoomEye

Cyberspace Search Engine by @zoomeye_team.

Databases - start.me

Various databases which you can use for your OSINT research by @technisette.

peoplefindThor

the easy way to find people on Facebook by postkassen.

tinfoleak

The most complete open-source tool for Twitter intelligence analysis by @vaguileradiaz.

Photon

Incredibly fast crawler designed for OSINT by @s0md3v.

ReconDog

Reconnaissance Swiss Army Knife by @s0md3v.

espi0n/Dockerfiles

Dockerfiles for various OSINT tools by @espi0n.

Raccoon

High performance offensive security tool for reconnaissance and vulnerability scanning by @evyatarmeged.

Social Mapper

Social Media Enumeration & Correlation Tool by Jacob Wilkin (Greenwolf).

Marshall Extensions

OSINT and security extensions for the Marshall privacy browser, providing reconnaissance and security-testing plugins by @bad-antics.

OpenBuckets

Search engine for misconfigured public cloud storage buckets across any provider.

AQUATONE

Tool for Domain Flyovers by @michenriksen.

Certificate Search

Enter an Identity (Domain Name, Organization Name, etc), a Certificate Fingerprint (SHA-1 or SHA-256) or a crt.sh ID to search certificate(s) by @crtsh.

Certificate Transparency

Google's Certificate Transparency project fixes several structural flaws in the SSL certificate system by @google.

domain_analyzer

Analyze the security of any domain by finding all the information possible by @eldraco.

EyeWitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible by @ChrisTruncer.

GSDF

Domain searcher named GoogleSSLdomainFinder by @We5ter.

subDomainsBrute

A simple and fast sub domain brute tool for pentesters by @lijiejie.

VirusTotal domain information

Searching for domain information by VirusTotal.

Sublist3r

Sublist3r is a multi-threaded sub-domain enumeration tool for penetration testers by @aboul3la.

VWGen

Vulnerable Web applications Generator by @qazbnm456.

charsetinspect

Script that inspects multi-byte character sets looking for characters with specific user-defined properties by @hack-all-the-things.

IPObfuscator

Simple tool to convert the IP to a DWORD IP by @OsandaMalith.

wfuzz

Web application bruteforcer by @xmendez.

domato

DOM fuzzer by @google.

FuzzDB

Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.

dirhunt

Web crawler optimized for searching and analyzing the directory structure of a site by @nekmo.

ssltest

Online service that performs a deep analysis of the configuration of any SSL web server on the public internet. Provided by Qualys SSL Labs.

fuzz.txt

Potentially dangerous files by @Bo0oM.

wayparam

Cross-platform Python CLI that fetches historical URLs from the Wayback CDX API and outputs normalized parameterized URLs for fuzzing, by @aleff-github.

SpiderSuite

Cross-platform web security crawler supporting standard, headless, interactive, brute-force, and archive crawling modes, for attack-surface mapping and endpoint discovery, by @3nock.

JoomlaScan

Free software to find the components installed in Joomla CMS, built out of the ashes of Joomscan by @drego85.

wpscan

WPScan is a black box WordPress vulnerability scanner by @wpscanteam.

Nuclei

Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use by @projectdiscovery.

Vigolium

High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision, maintained by @j3ssie.

ZAP by Checkmarx

Open-source web application security scanner maintained by the ZAP Core Team.

Trust Scan

URL security scanner combining threat intelligence (URLhaus, PhishTank, Spamhaus) with 40+ scam and phishing pattern detection by @undeadlist.

ZeroTrust

Privacy-first Chrome extension that analyzes website security locally with on-device AI (WebGPU), producing trust scores from HTTPS, phishing, malicious-script, and cookie-compliance signals, by @sattyamjjain.

SecuriTool

Free online collection of 29 client-side web security tools: web auditor, JWT attacker/decoder, CVE search, CSP evaluator, email security checker (SPF/DKIM/DMARC), subdomain scanner, and more. 100% client-side, privacy-first, open source by @ReplikanteK.

Burp Suite

Burp Suite is an integrated platform for performing security testing of web applications by portswigger.

Astra

Automated Security Testing For REST API's by @flipkart-incubator.

aws_pwn

A collection of AWS penetration testing junk by @dagrz.

grayhatwarfare

Public buckets by grayhatwarfare.

TIDoS-Framework

A comprehensive web application audit framework to cover up everything from Reconnaissance and OSINT to Vulnerability Analysis by @_tID.

numasec

AI-driven penetration-testing platform that coordinates 10 agents and 38 vulnerability scanners covering OWASP Top 10, by @FrancescoStabile.

ARS3NAL

Offline-first, self-hosted pentest & bug-bounty arsenal - searchable payloads, a click-to-build command generator, GTFOBins, wordlists, an embedded CyberChef, reverse shells and per-vulnerability checklists, with a live static demo - by @inflictx.

Darkmoon

Open source autonomous AI penetration testing platform that orchestrates 80+ offensive tools via Markdown playbooks and MCP across web, cloud, Active Directory and Kubernetes, with an evidence trail per finding by @ASCIT31.

xssor2

XSS'OR - Hack with JavaScript by @evilcos.

XSStrike

XSStrike is a program which can fuzz and bruteforce parameters for XSS. It can also detect and bypass WAFs by @s0md3v.

beef

The Browser Exploitation Framework Project by beefproject.

JShell

Get a JavaScript shell with XSS by @s0md3v.

csp evaluator

A tool for evaluating content-security-policies by Csper.

sqlmap

Automatic SQL injection and database takeover tool.

tplmap

Code and Server-Side Template Injection Detection and Exploitation Tool by @epinna.

dtd-finder

List DTDs and generate XXE payloads using those local DTDs by @GoSecure.

XSRFProbe

The Prime CSRF Audit & Exploitation Toolkit by @0xInfection.

CSS-Keylogging

Chrome extension and Express server that exploits keylogging abilities of CSS by @maxchehab.

DVCS-Pillage

Pillage web accessible GIT, HG and BZR repositories by @evilpacket.

dvcs-ripper

Rip web accessible (distributed) version control systems: SVN/GIT/HG... by @kost.

gitleaks

Searches full repo history for secrets and keys by @zricethezav.

GitMiner

Tool for advanced mining for content on Github by @UnkL4b.

HTTPLeaks

All possible ways, a website can leak HTTP requests by @cure53.

pwngitmanager

Git manager for pentesters by @allyshka.

snallygaster

Tool to scan for secret files on HTTP servers by @hannob.

LinkFinder

Python script that finds endpoints in JavaScript files by @GerbenJavado.

keyFinder

Chrome extension that passively scans web pages for leaked API keys, tokens, and credentials across 10 attack surfaces using 80+ detection patterns and Shannon-entropy analysis, by @momenbasel.

bXSS

bXSS is a simple Blind XSS application adapted from cure53.de/m by @LewisArdern.

malware-jail

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction by @HynekPetrak.

repo-supervisor

Scan your code for security misconfiguration, search for passwords and secrets.

retire.js

Scanner detecting the use of JavaScript libraries with known vulnerabilities by @RetireJS.

sqlchop

SQL injection detection engine by chaitin.

xsschop

XSS detection engine by chaitin.

OpenRASP

An open source RASP solution actively maintained by Baidu Inc. With context-aware detection algorithm the project achieved nearly no false positives. And less than 3% performance reduction is observed under heavy server load.

GuardRails

A GitHub App that provides security feedback in Pull Requests.

js-xss

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist by @leizongmin.

Acra

Client-side encryption engine for SQL databases, with strong selective encryption, SQL injections prevention and intrusion detection by @cossacklabs.

DOMPurify

DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG by Cure53.

Csper

A set of tools for building/evaluating/monitoring content-security-policy to prevent/detect cross site scripting by Csper.

UUSEC WAF

An open-source web application firewall and API security gateway maintained by UUCORP.

BunkerWeb

A next-generation open-source Web Application Firewall built on nginx, maintained by Bunkerity.

FCaptcha

Self-hosted CAPTCHA with behavioral analysis, vision-AI agent detection, headless-browser fingerprinting, and SHA-256 proof-of-work, maintained by WebDecoy.

Pompelmi

In-process file-upload security middleware for Node.js that scans untrusted uploads before storage to detect malware, MIME spoofing, and risky archives, maintained by pompelmi.

WebDecoy

Zero-configuration WordPress bot-detection plugin combining WebDriver detection, headless-browser fingerprinting, behavioral analysis, and SHA-256 proof-of-work, maintained by WebDecoy.

CrowdSec

Open-source collaborative IPS written in Go that analyzes visitor behavior and shares threat signals across a community of operators, maintained by CrowdSec.

Laravel CSP Generator

Interactive Content Security Policy builder for Laravel that outputs ready-to-use PHP middleware with nonce support and violation reporting, by @itxshakil.

verifyfetch

Browser-side integrity verification and resumable downloads for large files using SRI hashes, defending against CDN compromise and supply-chain attacks, by @hamzaydia.

Charles

HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet.

mitmproxy

Interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers by @mitmproxy.

Proxelar

Single-binary intercepting proxy for HTTP, HTTPS, and WebSocket traffic that pauses and edits requests in flight, replays them, rewrites traffic with Lua hooks, and exports captures as HAR, curl, or raw HTTP, available as a terminal UI, web GUI, or headless REST API, by @emanuele-em.

reverse-shell

Reverse Shell as a Service by @lukechilds.

Reverse-Shell-Manager

Reverse Shell Manager via Terminal @WangYihang.

webshell

This is a webshell open source project by @tennc.

Webshell-Sniper

Manage your website via terminal by @WangYihang.

Weevely

Weaponized web shell by @epinna.

nano

Family of code golfed PHP shells by @s0md3v.

PhpSploit

Full-featured C2 framework which silently persists on webserver via evil PHP oneliner by @nil0x42.

Iaitō

Qt and C++ GUI for radare2 reverse engineering framework by @hteso.

plasma

Plasma is an interactive disassembler for x86/ARM/MIPS by @plasma-disassembler.

radare2

Unix-like reverse engineering framework and commandline tools by @radare.

CFR

Another java decompiler by @LeeAtBenf.

DNS Rebind Toolkit

DNS Rebind Toolkit is a frontend JavaScript framework for developing DNS Rebinding exploits against vulnerable hosts and services on a local area network (LAN) by @brannondorsey.

dref

DNS Rebinding Exploitation Framework. Dref does the heavy-lifting for DNS rebinding by @mwrlabs.

Singularity of Origin

It includes the necessary components to rebind the IP address of the attack server DNS name to the target machine's IP address and to serve attack payloads to exploit vulnerable software on the target machine by @nccgroup.

Whonow DNS Server

A malicious DNS server for executing DNS Rebinding attacks on the fly by @brannondorsey.

CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis - by @GCHQ.

cefdebug

Minimal code to connect to a CEF debugger by @taviso.

ctftool

Interactive CTF Exploration Tool by @taviso.

ntlm_challenger

Parse NTLM over HTTP challenge messages by @b17zr.

haveibeenpwned

Check if you have an account that has been compromised in a data breach by Troy Hunt.

Hudson Rock

Check if your email or domain was compromised by infostealer malware, maintained by Hudson Rock.

BRETT BUERHAUS

Vulnerability disclosures and rambles on application security.

Broken Browser

Fun with Browser Vulnerabilities.

James Kettle

Head of Research at PortSwigger Web Security.

leavesongs

China's talented web penetrator.

n0tr00t

~# n0tr00t Security Team.

OpnSec

Open Mind Security!.

Orange

Taiwan's talented web penetrator.

Scrutiny

Internet Security through Web Browsers by Dhiraj Mishra.

0Day Labs

Awesome bug-bounty and challenges writeups.

Blog of Osanda

Security Researching and Reverse Engineering.

@cure53berlin

Cure53 is a German cybersecurity firm.

@filedescriptor

Active penetrator often tweets and writes useful articles.

@garethheyes

English web penetrator.

@h3xstream

Security Researcher, interested in web security, crypto, pentest, static analysis but most of all, samy is my hero.

@HackwithGitHub

Initiative to showcase open source hacking tools for hackers and pentesters.

@hasegawayosuke

Japanese javascript security researcher.

@kinugawamasato

Japanese web penetrator.

@XssPayloads

The wonderland of JavaScript unexpected usages, and more.

@shhnjk

Web and Browsers Security Researcher.

SELinux Game

Learn SELinux by doing. Solve Puzzles, show skillz - Written by @selinuxgame.

BadLibrary

Vulnerable web application for training - Written by @SecureSkyTechnology.

Hackxor

Realistic web application hacking game - Written by @albinowax.

OWASP Juice Shop

Probably the most modern and sophisticated insecure web application - Written by @bkimminich and the @owasp_juiceshop team.

Portswigger Web Security Academy

Free trainings and labs - Written by PortSwigger.

OopsSec Store

Intentionally vulnerable e-commerce application built with Next.js - Written by @kOaDT.

The Next.js security-headers pitfall

Shows how a correct-looking Next.js headers() block can overwrite route-specific rules or differ from final CDN responses, with an inventory, merge, preview, deployed-route verification, and rollback workflow.

Where the LLM Stops: Deterministic Scoring in an AI-Assisted VAPT Pipeline

Technical write-up on designing an AI-assisted VAPT pipeline with deterministic CVSS scoring, passive confidence verification, and LLM-generated vulnerability explanations and remediation.

The 200 That Proved Nothing

Why a 200 OK is not proof of an access-control bug: a seeded BOLA benchmark where a model asked to confirm a secure endpoint 79 times and a downgrade-only code gate refused every one, plus the similarity thresholds, a deterministic check that failed the same way, and a plausible fix measured and…

FLAWS

Amazon AWS CTF challenge - Written by @0xdabbad00.

CloudGoat

Rhino Security Labs' "Vulnerable by Design" AWS infrastructure setup tool - Written by @RhinoSecurityLabs.

alert(1) to win

Series of XSS challenges - Written by @steike.

XSS Challenges

Series of XSS challenges - Written by yamagata21.

XSS game

Google XSS Challenge - Written by Google.

ModSecurity / OWASP ModSecurity Core Rule Set

Series of tutorials to install, configure and tune ModSecurity and the Core Rule Set - Written by @ChrFolini.

Reddit

Stack Overflow

A glimpse into GitHub's Bug Bounty workflow

Written by @gregose.

awesome-bug-bounty

Comprehensive curated list of available Bug Bounty & Disclosure Programs and write-ups by @djadmin.

Brute Forcing Your Facebook Email and Phone Number

Written by PwnDizzle.

bug-bounty-reference

List of bug bounty write-up that is categorized by the bug nature by @ngalongc.

Cybersecurity Campaign Playbook

Written by Belfer Center for Science and International Affairs.

EQGRP

Decrypted content of eqgrp-auction-file.tar.xz by @x0rz.

Google VRP and Unicorns

Written by Daniel Stelter-Gliese.

Infosec_Reference

Information Security Reference That Doesn't Suck by @rmusser01.

notes

Some public notes by @ChALkeR.

Pentest + Exploit dev Cheatsheet wallpaper

Penetration Testing and Exploit Dev CheatSheet.

The Definitive Security Data Science and Machine Learning Guide

Written by JASON TROS.

$7.5k Google services mix-up

Written by Ezequiel Pereira.

The Bug Hunters Methodology v2.1

Written by @jhaddix.

How I exploited ACME TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain using shared hosting

Written by @fransrosen.

TL:DR: VPN leaks users’ IPs via WebRTC. I’ve tested seventy VPN providers and 16 of them leaks users’ IPs via WebRTC…

Written by voidsec.

Be careful what you copy: Invisibly inserting usernames into text with Zero-Width Characters

Written by @umpox.

Escape and Evasion Egressing Restricted Networks

Written by Chris Patten, Tom Steele.

Introduction to Web Application Security

Written by @itsC0rg1, @jmkeads and @matir.

Finding The Real Origin IPs Hiding Behind CloudFlare or TOR

Written by Paul Dannewitz.

An example why NAT is NOT security

Written by @0daywork.

WEB APPLICATION PENETRATION TESTING NOTES

Written by Jayson.

List of bug bounty writeups

Written by Mariem.

The bug bounty program that changed my life

Written by Gwen.

Why Facebook's api starts with a for loop

Written by @AntoGarand.

WCTF2019: Gyotaku The Flag

Written by @t0nk42.

How we abused Slack's TURN servers to gain access to internal services

Written by @sandrogauci.

DOS File Path Magic Tricks

Written by @clr2of8.

How I got my first big bounty payout with Tesla

Written by @cj.fairhead.

Grokking Web Application Security

Hands-on introduction to web application security fundamentals by Malcolm McDonald (Manning).

htb-writeups

Comprehensive Hack The Box writeup collection covering 75+ web challenges including XSS, SQLi, SSTI, SSRF, and deserialization, by @momenbasel.

From DNS Evidence to a Finding: DNS and Mail Security Methodology

How DNSSEC, DANE, SPF/DKIM/DMARC and SMTP transport evidence becomes a finding, with the decision logic for each, the dig invocations to reproduce it independently, and the false positives to expect.