Global

) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Built by Sachin Sharma — Bug Hunting & GenAI Security Research.

Community curated list of templates for the nuclei engine to find security vulnerabilities.

Your local copy of HackTricks will be available at after <5 minutes (it needs to build the book, be patient).

More elaborate documentation that goes through many features with a lot of examples is available in the ffuf wiki at

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more

NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.

dirsearch is being actively developed by @maurosoria and @shelld3v.

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

Features • Install • Usage • API Setup • Library • Join Discord

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community.

com run命令为例，OneForAll在默认参数正常执行完毕会在results目录生成相应结果：

A list of resources for those interested in getting started in bug bounties

BBOT consistently finds 20-50% more subdomains than other tools. The bigger the domain, the bigger the difference. To learn how this is possible, see How It Works.