Gwendal Le Coguic

pentest-tools. A collection of custom security tools for quick needs.

github-search. A collection of tools to perform searches on GitHub.

github-subdomains. Find subdomains on GitHub.

s3-buckets-finder. Find AWS S3 buckets and test their permissions.

cloudflare-origin-ip. Try to find the origin IP of a webapp protected by Cloudflare.

BB-datas. Tools and datas related to Bug Bounty.

github-endpoints. Find endpoints on GitHub.

offsectools_www. A vast collection of security tools and resources curated by the community.

DataExtractor. A Burp Suite extension to extract datas from source code while browsing.

keyhacks.sh. Automation of tokens/api keys testing.

related-domains. Find related domains of a given domain.

gitlab-subdomains. Find subdomains on GitLab.

vhost-brute. A PHP tool to brute force vhost configured on a server.

dnspy. Find subdomains and takeovers.

actarus. Actarus is a custom tool for bug bounty

bugbountytips. Webapp to search tips on Twitter through #bugbountytips

github-regexp. Basically a regexp over a GitHub search.

google-search. Returns results from Google search.

bxss. Alternative to XSS Hunter for blind XSS.

myrecon.py. My recon script

favicon-hashtrick. Python script implementing the favicon hash trick to find subdomains.

BBstats. Bug Bounty statistics tool.

csp-analyzer. Analyze Content-Security-Policy header of a given URL.

apk-analyzer. Analyze an APK archive.

BBvuln. A listing of the most common vuln that you can link in your PoCs

extract-endpoints. Extract endpoints from source files.

testxss. PHP tool to test XSS

detectify-cves. Find CVEs that don't have a Detectify modules.

graphql-introspection-analyzer. Graphql introspection query analyzer.

gitgrep. Webapp to perform regexp search over GitHub search.

gitpillage. Extract data from a .git directory.

dnsexpire. Test domain expiration dates.

shotTheWorld. PHP tool that takes screenshots of a given ips/ports combo list and then try to guess the service.

urlgrabber. PHP tool to grab urls of a specific site.

gwen001.

testidor. PHP tool to test IDOR

thegarden. Vulnerable web application made with Laravel.

dotfiles. me dotfiles

autoknoxss. Custom PHP tool to automate calls to KNOXSS

icmp-send-file. send file with ping

testcrlf. PHP tool to test CRLF

php-stegano-lsb. Hide file using Least Significant bits method.

act_custom. Custom scripts for Actarus

3rdparty-services. PHP tool to test 3rd party service validity

testcors. PHP tool to test CORS

ipsites. PHP tool to find websites hosted by a given ip

github-stargazer. View stars evolution of GitHub repositories.

testssrf. PHP tool to test SSRF

ultimate-open-redirect. PHP tool to test open redirect

testcsrf. PHP tool to test CSRF

testionion. PHP script to find onion websites

setricks. Small search engine tool usefull to find the position of a given website

10degres.net_jenkins. http://10degres.net

gwen001.github.io. Silence is golden.

MyPhpDirb. GoBuster like written in PHP

domlink. A tool to link a domain with registered organisation names and emails, to other domains.

poc_subto. JavaScript

asnlookup. Leverage ASN to look up IP addresses (IPv4 & IPv6) owned by a specific organization for reconnaissance purposes, then run port scanning on it.