Tools - ap00rv/Appsec-wiki GitHub Wiki

Recon tools

massdns- a fast subdomain bruteforcing tool

findsubdomains.com -search for subdomains for any website

Search for TLS certificates in public logs

Tools and Burp/ZAP extension for web

---

• Automatic Server-Side Template Injection Detection and Exploitation Tool

• Automated Mongo database and NoSQL web application exploitation tool

• A tool for testing race conditions

• Single Page Application (SPA) crawler

• Chrome extension to test for XSS

• Record your screen, network traffic & JavaScript logs and screenshot sessions too

• Awesome static analysis tools

• Burp smartbuster, a smart content discovery tool

• Burpkit, nextgen plguin for Burp

• Burp plugin for missing/weak CSP directives

• Google CSP evaluator tool

• Flash hacking tool from Cure53

• Http request generator in many languages - Burp plugin

• Tool for finding second order XSS vulns

• HTML5 XSS testing guide

• python script that gathers all info from Shodan about an IP

• SSO openID attack tool

• Reflected file download checker Burp plugin

• Burp extender for web cache deception attacks

• CyberChef from GCHQ

---

Tools for android

• [Detect regex DOS vulns in Android apps ] (https://github.com/olivo/redos-detector)

Tools for iOS

• [iOS security assessment tools] (http://www.kitploit.com/2016/12/idb-ios-app-security-assessment-tool.html)