🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

• UpdatedApr 20, 2025
• Go

💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

• UpdatedMar 12, 2025
• Python

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

• UpdatedApr 30, 2025
• Kotlin

Tips and Tutorials for Bug Bounty and also Penetration Tests.

• UpdatedFeb 12, 2024

BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.

• UpdatedJan 29, 2021
• C#

The fastest dork scanner written in Go.

• UpdatedFeb 4, 2024
• Go

ScopeSentry-Cyberspace mapping, subdomain enumeration, port scanning, sensitive information discovery, vulnerability scanning, distributed nodes

• UpdatedApr 24, 2025
• Python

A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit!

• UpdatedApr 17, 2025

Automation for javascript recon in bug bounty.

• UpdatedSep 9, 2023
• Shell

MagicRecon is a powerful shell script to maximize the recon and data collection process of an objective and finding common vulnerabilities, all this saving the results obtained in an organized way in directories and with various formats.

• UpdatedJul 23, 2024
• Shell

An IIS short filename enumeration tool

• UpdatedNov 25, 2024
• Go

Payload Arsenal for Pentration Tester and Bug Bounty Hunters

• UpdatedMay 6, 2023
• PHP

An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically.

• UpdatedJul 4, 2023
• Shell

A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

• UpdatedMar 20, 2023
• Rust

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

• UpdatedApr 15, 2025
• Python

A tool to check a bunch of URLs that contain reflecting params.

• UpdatedAug 4, 2024
• Go

A scanner/exploitation tool written in GO, which leverages client-side Prototype Pollution to XSS by exploiting known gadgets.

• UpdatedJun 22, 2022
• Go

Discover new target domains using Content Security Policy

• UpdatedApr 23, 2025
• Go

挖掘国内外漏洞平台必备的自动化捡钱赏金技巧，看了并去做了捡钱如喝水。

• UpdatedNov 17, 2020

Weekly updated list of missing CVEs in nuclei templates official repository. Mainly built for bug bounty, but useful for penetration tests and vulnerability assessments too.

• UpdatedApr 28, 2025
• Shell