xer0dayz

Sn1per. Automated penetration testing & attack surface management platform. Recon, scan, exploit, report — 600+ exploits, 90+ integrations, 10K+ detections.

IntruderPayloads. A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.

BruteX. Automatically brute force all services running on a target.

Findsploit. Find exploits in local and online databases instantly

BlackWidow. A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

PrivEsc. A collection of Windows, Linux and MySQL privilege escalation scripts and exploits.

ReverseAPK. Quickly analyze and reverse engineer Android packages

Goohak. Automatically Launch Google Hacking Queries Against A Target Domain

Wordpress-XMLRPC-Brute-Force-Exploit. Wordpress XMLRPC System Multicall Brute Force Exploit (0day) by 1N3 @ CrowdShield

MassBleed. MassBleed SSL Vulnerability Scanner

Exploits. Exploits by 1N3 @CrowdShield @xer0dayz @XeroSecurity

PRISM-AP. An automated Wireless RogueAP MITM attack framework.

XSSTracer. A small python script to check for Cross-Site Tracing (XST)

AttackSurfaceManagement. Discover the attack surface and prioritize risks with our continuous Attack Surface Management (ASM) platform - Sn1per Professional #pentest #redteam #bugbounty

HTTPoxyScan. HTTPoxy Exploit Scanner by 1N3 @CrowdShield

PowerExfil. A collection of data exfiltration scripts for Red Team assessments.

SuperMicro-Password-Scanner. Supermicro IPMI/BMC Cleartext Password Scanner

CloudHunter. Find unreferenced AWS S3 buckets which have CloudFront CNAME records pointing to them

1N3. Sr. Penetration Tester. Creator of Sn1per. Top 20 worldwide on @BugCrowd in 2016. OSCE/OSCP/CISSP/Security+

CTF-Writeups. CTF Writeups

forbidden. Bypass 4xx HTTP response status codes and more. Based on PycURL.

Sublist3r. Fast subdomains enumeration tool for penetration testers

gitGraber. gitGraber: monitor GitHub to search and find sensitive data in real time for different online services such as: Google, Amazon, Paypal, Github, Mailgun, Facebook, Twitter, Heroku, Stripe...

IPGeoLocation. Retrieve IP Geolocation information

Amass. In-depth Attack Surface Mapping and Asset Discovery

DirDar. DirDar is a tool that searches for (403-Forbidden) directories to break it and get dir listing on it

jexboss. JexBoss: Jboss (and Java Deserialization Vulnerabilities) verify and EXploitation Tool

LinkFinder. A python script that finds endpoints in JavaScript files

massdns. A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

InfoSec-Black-Friday. All the deals for InfoSec related software/tools this Black Friday

CVE-2018-15473-Exploit. Exploit written in Python for CVE-2018-15473 with threading and export formats

rapiddns. Rapidly enumerate subdomains and domains using rapiddns.io.

github-endpoints. Find endpoints on GitHub.

slurp. S3 bucket enumerator