🐶 A curated list of Web Security materials and resources.

🎯 Cross Site Scripting ( XSS ) Vulnerability Payload List

🎯 SQL Injection Payload List

🎯 PHP / ASP - Shell Backdoor List 🎯

Dictionary collection project such as Pentesing, Fuzzing, Bruteforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。

China's first CTFTools framework.中国国内首个CTF工具框架,旨在帮助CTFer快速攻克难关

A Collection of Notes, Checklists, Writeups on Bug Bounty Hunting and Web Application Security.

🎯 XML External Entity (XXE) Injection Payload List

CyberSecurityRSS: A collection of cybersecurity rss to make you better!

Web漏洞演练平台

🎯 Open Redirect Payload List

🎯 RFI/LFI Payload List

Useful Google Dorks for WebSecurity and Bug Bounty

网络安全学习资料，欢迎补充

一款功能强大的漏洞扫描器，子域名爆破使用aioDNS，asyncio异步快速扫描，覆盖目标全方位资产进行批量漏洞扫描，中间件信息收集，自动收集ip代理，探测Waf信息时自动使用来保护本机真实Ip，在本机Ip被Waf杀死后，自动切换代理Ip进行扫描，Waf信息收集(国内外100+款waf信息)包括安全狗，云锁，阿里云，云盾，腾讯云等，提供部分已知waf bypass 方案，中间件漏洞检测(Thinkphp,weblogic等 CVE-2018-5955,CVE-2018-12613,CVE-2018-11759等)，支持SQL注入, XSS, 命令执行,文件包含, ssrf 漏洞扫描, 支持自定义漏洞邮箱推送功能

Twitter vulnerable snippets

Red team Arsenal - An intelligent scanner to detect security vulnerabilities in company's layer 7 assets.

🎯 Server Side Template Injection Payloads

Exercises for (legacy) Computer Security course in the University of Oulu

🐛 A multi threads web application source leak scanner