Web Security Blog

[websecurityblog]

Web application fuzzer. Contribute to xmendez/wfuzz development by creating an account on GitHub.

Wfuzz is an outstanding web fuzzer if you don’t have PRO version of Burp.

[websecurityblog]

The cheat sheet about Java Deserialization vulnerabilities - GrrrDog/Java-Deserialization-Cheat-Sheet

A cheat sheet for pentesters and researchers about deserialization vulnerabilities in various Java (JVM) serialization libraries.

[websecurityblog]

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, ...

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to enable a security tester to pull this repository onto a new testing box and have access to every type of list that may be needed.

[websecurityblog]

Web applications testing guide for penetration testers.

[websecurityblog]

Server-Side Template Injection and Code Injection Detection and Exploitation Tool - epinna/tplmap

Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operating system. More information about Server-Side Template Injection vulnerability you can find in the Portswigger blog post https://portswigger.net/blog/server-side-template-injection

[websecurityblog]

HTTP parameter discovery suite. Contribute to s0md3v/Arjun development by creating an account on GitHub.

Arjun tool is useful for identifying hidden parameters in WEB applications.

[websecurityblog]

Most advanced XSS scanner. Contribute to s0md3v/XSStrike development by creating an account on GitHub.

XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler.