Web Application Security

HTTP parameter discovery tool for finding hidden GET and POST parameters.

Integrated web proxy and testing platform for intercepting, modifying, and automating HTTP traffic.

OS command injection payloads, separators, blind detection, and filter bypasses for achieving RCE on authorized targets.

Automated command injection detection and exploitation in web parameters and headers.

Fast parameter-based XSS scanner and proof-of-concept generator for web apps.

CMS scanner focused on Drupal, Silverstripe, and WordPress plugin enumeration.

Joomla CMS vulnerability scanner and version or component enumerator.

JSON Web Token attacks: alg=none, weak secret cracking, key confusion (RS256→HS256), and claim tampering on authorized targets.

JSON Web Token testing for algorithm confusion, weak secrets, and claim tampering.

Local file inclusion and directory traversal payloads, PHP wrappers, and log-poisoning RCE for authorized testing.

Interactive TLS-capable HTTP proxy for intercepting, replaying, and scripting web traffic.

Open-source web app security proxy with passive/active scanning and automation API.

Mines archived URLs to extract unique parameters for a domain from web archives.

Manual SQL injection payloads and techniques for detection, UNION extraction, blind, and authentication bypass on authorized targets.

Automated SQL injection detection and exploitation for web parameters, headers, and cookies.

Server-side request forgery payloads: cloud metadata access, internal port scanning, filter bypasses, and blind SSRF detection.

SSRF exploitation framework with modules for cloud metadata, port scan, and shell.

Server-Side Template Injection detection and exploitation for multiple template engines.

WordPress security scanner for users, plugins, themes, and known vulnerabilities.

Hidden parameter discovery via response status, body, and reflection diffing.

Cross-site scripting payloads and filter bypasses for reflected, stored, and DOM-based XSS on authorized targets.

Advanced XSS detection with context analysis, fuzzing, and WAF-aware payload generation.

XML External Entity payloads for file read, SSRF, blind out-of-band exfiltration, and denial of service on authorized targets.