Soroush Dalili

IIS-ShortName-Scanner. latest version of scanners for IIS short filename (8.3) disclosure vulnerability

top10webseclist. Top Ten Web Hacking Techniques List

ysonet. Deserialization payload generator for a variety of .NET formatters

httpninja. HTTP.ninja

BurpSuiteJSBeautifier. Burp Suite JS Beautifier

BurpSuiteSharpenerEx. This extension enhances Burp Suite by adding several UI and functional features, making it more user-friendly.

auraditor. A Burp Suite extension for Lightning/Aura framework security testing with advanced action management, context editing, and comprehensive audit capabilities.

OutlookLeakTest. The Outlook HTML Leak Test Project

BurpTabEssentials. This changes the style of Burp Suite's Repeater tabs to help the testers

updated-SWFIntruder. Updated version of SWFIntruder

crapsecrets. A library for detecting known secrets across many web frameworks

BurpRunnerShells. This makes it easier to open and run the latest version of Burp Suite via terminal or command line

Flash-Files-Vulnerability-Database. Known vulnerable Flash files will be listed here possibly with their exploit

BChecks. BChecks collection for Burp Suite Professional

BlazorTrafficProcessor. Java

Awesome-WAF. 🔥 Everything awesome about web-application firewalls (WAF).

dnschef_updated. DNSChef - DNS proxy for Penetration Testers and Malware Analysts

vulnerable-node-app. A NoSQL Injectable Node App

waf_bypadd. This Burp Suite extension is designed to bypass Web Application Firewalls (WAFs) by padding HTTP requests with dummy data.

CrossSiteContentHijacking. Content hijacking proof-of-concept using Flash, PDF and Silverlight

privatecollaborator. A script for installing private Burp Collaborator with free Let's Encrypt SSL-certificate

shortscan. An IIS short filename enumeration tool

cve-2025-53770-exploit. SharePoint WebPart Injection Exploit Tool

WebShell-2. Webshell

CloudRecon. Go

PaddingOracleHunter. Python

github-subdomains. Find subdomains on GitHub.

ExploitDotNetDCOM. A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET.

Stepper. A natural evolution of Burp Suite's Repeater tool

rhino. Rhino is an open-source implementation of JavaScript written entirely in Java

trufflehog. Find and verify credentials

JDBC-Attack. JDBC Connection URL Attack

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

ysoserial. ysoserial for su18

GitDorker. A Python program to scrape secrets from GitHub through usage of a large repository of dorks.

afrog. A Security Tool for Bug Bounty, Pentest and Red Teaming.

ayfabtu. Scripts to extract files from SCM directories left on web servers

gojwtcrack. Fast JSON Web Token (JWT) cracker written in Go

VulnerableDotNetHTTPRemoting. Example Vulnerable .NET HTTP Remoting