Shubs

altdns. Generates permutations, alterations and mutations of subdomains and then resolves them

enumXFF. Enumerating IPs in X-Forwarded-Headers to bypass 403 restrictions

bugbountydash. [depreciated] Terminal dashboard for bug bounty hunters that use HackerOne and Bugcrowd

little-doctor. 🔥🔥🔥 Out of the Browser into the Fire - Cross platform XSS worm framework 🔥🔥🔥

fuzzdb. Automatically exported from code.google.com/p/fuzzdb

websec-weekly. The databases, API's and managers behind https://websecweekly.org

webappsec-toolkit. Web Application Security related tools. Includes backdoors, proof of concepts and tricks

phishJS. Abusing trust boundaries to deliver effective phishing payloads

CaptchaJackingPoC. Web security concept of CaptchaJacking Proof of Concept Code | Made very quickly, serves purely as a PoC only

enumapis. Traverse JS files for APIs/Endpoints

52-technologies-in-2016. Let's learn a new technology every week. A new technology blog every Sunday in 2016.

bug-bounty-standards. A list of edge cases that occur in bug bounty programs, conversations on how they should be handled. The goal is to standardise the way that specific situations are handled in bug bounties.

learning-c. A documentation of all the C code I write in University - encouraging myself to write better, and cleaner code

PERS. A passive scanning tool for finding expired domain vulnerabilities while you browse.

twofactorauth. List of popular sites and whether or not they accept two factor auth.

sonar.js. A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration combined with WebSockets and external resource fingerprinting.

subfinder. Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.

heartdestroy. Multi-threaded, mass scanner for the Heartbleed vulnerability, in Python

dirsearch. Web path scanner

subbrute. A subdomain enumeration tool for penetration testers.

ruxcon-talk.

CNA-Registry. Public CNA Registry

proxy.py. Lightweight HTTP Proxy Server in Python

ActiveScanPlusPlus. ActiveScan++ Burp Suite Plugin

gobuster. Directory/file & DNS busting tool written in Go

GeoLite-mmdb-csv. MaxMind's GeoIP2 GeoLite2 Country, City, and ASN databases in MMDB and CSV format updated often

domain. Setup script for Regon-ng

sectalks. sectalks

omgcatz. Source code for the latest version of omgcatz.com.

voicemail-check. A small web app to check if your (Australian) voicemail is vulnerable to information disclosure.

nanomebia_quote_generator. Just some me-me's

xntrik_quote_generator. Shit xntrik Would Say

csesoc-website. Python

Ghost.py. Webkit based scriptable web browser for python.

httpcomponents-client. Mirror of Apache HttpClient

octopress. Octopress is an obsessively designed framework for Jekyll blogging. It’s easy to configure and easy to deploy. Sweet huh?

meilisearch-go. Golang wrapper for the MeiliSearch API

forte. A simple tool to help you manage your music playlists at events.

next-netlify-starter. Hack

gunicorn. gunicorn 'Green Unicorn' is a WSGI HTTP Server for UNIX, fast clients and sleepy applications.

golang-book. Just my progressive attempts at the go-lang book.

heartthreader. Massive testing anyone?