This repository is a curated collection of powerful tools used in Bug Bounty Hunting, Penetration Testing, and Red Teaming. It covers the complete engagement flow — from reconnaissance to exploitation and post-exploitation — with a focus on automation, vulnerability discovery, and real-world attack simulation.
-
Nmap – Scan for open ports and services.
sudo apt install nmap -
Amass – Subdomain enumeration & passive recon.
git clone https://github.com/owasp-amass/amass.git -
Shodan – Exposed device intelligence.
pip install shodanSetup guide -
theHarvester – Emails, subdomains, hosts & more.
git clone https://github.com/laramies/theHarvester.git -
Assetfinder – Subdomain finder.
git clone https://github.com/tomnomnom/assetfinder.git
-
Burp Suite – Intercept, test, manipulate HTTP/S. Download from (GUI tool)
-
OWASP ZAP – Automated vulnerability scanner.
git clone https://github.com/zaproxy/zaproxy.git -
Nikto – Web server scanner.
git clone https://github.com/sullo/nikto.git -
SQLmap – SQL injection automation.
git clone https://github.com/sqlmapproject/sqlmap.git -
Dirb / Dirbuster – Directory bruteforcers.
sudo apt install dirbgit clone https://github.com/OWASP/DirBuster.git
-
JWT Toolkit – Test JWT vulnerabilities.
git clone https://github.com/ticarpi/jwt_tool.git -
Hydra – Credential bruteforce across services.
sudo apt install hydra -
NoSQLMap – NoSQL injection exploitation.
git clone https://github.com/codingo/NoSQLMap.git
-
XSStrike – Advanced XSS detection & exploitation.
git clone https://github.com/s0md3v/XSStrike.git -
Commix – Command injection automation.
git clone https://github.com/commixproject/commix.git -
XSSer – Automated XSS scanner.
git clone https://github.com/epsylon/xsser.git
-
Metasploit Framework – Exploitation framework.
sudo apt install metasploit-framework -
Cobalt Strike – Advanced red teaming (Paid Tool). Official site
-
FFUF – Web fuzzer & dir discovery.
git clone https://github.com/ffuf/ffuf.git -
Wfuzz – Fuzzing GET/POST params.
git clone https://github.com/xmendez/wfuzz.git
-
Retire.js – Find vulnerable JS libraries.
git clone https://github.com/RetireJS/retire.js.git -
GitLeaks – Secrets detection in git repos.
git clone https://github.com/gitleaks/gitleaks.git -
Semgrep – Lightweight static code analysis.
git clone https://github.com/returntocorp/semgrep.git
- OS: Kali Linux / Parrot OS / Ubuntu
- Language support: Python3 / Go / Java / Node.js
- Skills: Basic Web App Security knowledge