GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the target's server and by means of advanced Google searches (Google Dorking).

Extract uncompiled, uncompressed SPA code from Webpack source maps.

Utility to download and extract document metadata from an organization. This technique can be used to identify: domains, usernames, software/version numbers and naming conventions.

WEB SERVICE SECURITY ASSESSMENT TOOL

Joomla! < 4.2.8 - Unauthenticated information disclosure

Here you can get full exploit for SAP NetWeaver AS JAVA

Metasploit-like pentest framework derived from TIDoS (https://github.com/0xInfection/TIDoS-Framework)

A set of YARA rules for the AIL framework to detect leak or information disclosure

Sniper. Passive Secrets Hunting.🚬

A PoC exploit for CVE-2017-7921 - Hikvision Camera Series Improper Authentication Vulnerability.

CVE-2020-14179 Scanner

Exploit Code, notes, and resources to accompany PortSwiggers' WebAcademy Labs.

Writeups for portswigger labs.

AfterLogic Products Vulnerabilities

Quick DNS Zone Transfer

A PoC exploit for CVE-2021-43798 - Grafana Directory Traversal

Notes from Portswigger

Utility to scan wordpress installations using their on-by-default REST endpoints

solutions of hack-yourself-first