模糊测试
========================================

Web Fuzz
----------------------------------------
- `wfuzz <https://github.com/xmendez/wfuzz>`_
- `SecLists <https://github.com/danielmiessler/SecLists>`_
- `fuzzdb <https://github.com/fuzzdb-project/fuzzdb>`_
- `foospidy payloads <https://github.com/foospidy/payloads>`_
- `ffuf <https://github.com/ffuf/ffuf>`_ Fast web fuzzer written in Go

扫描器
----------------------------------------
- `Nuclei <https://github.com/projectdiscovery/nuclei>`_ a fast tool for configurable targeted vulnerability scanning based on templates offering massive extensibility and ease of use
- `xray <https://github.com/chaitin/xray>`_ 安全评估工具，支持常见 web 安全问题扫描和自定义 poc

XSS Payloads
----------------------------------------
- `PORTSWIGGER XSS cheat sheet <https://portswigger.net/web-security/cross-site-scripting/cheat-sheet>`_
- `Pgaijin66 XSS-Payloads <https://github.com/Pgaijin66/XSS-Payloads>`_
- `OWASP XSS <https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet>`_

Burp插件
----------------------------------------
- `BurpBounty <https://github.com/wagiro/BurpBounty>`_ Scan Check Builder
- `BurpShiroPassiveScan <https://github.com/pmiaowu/BurpShiroPassiveScan>`_
- `IntruderPayloads <https://github.com/1N3/IntruderPayloads>`_ A collection of Burpsuite Intruder payloads

字典
----------------------------------------
- `Blasting dictionary <https://github.com/rootphantomer/Blasting_dictionary>`_
- `pydictor <https://github.com/LandGrey/pydictor>`_ A powerful and useful hacker dictionary builder for a brute-force attack
- `fuzzDicts <https://github.com/TheKingOfDuck/fuzzDicts>`_ Web Pentesting Fuzz 字典
- `bruteforce lists <https://github.com/random-robbie/bruteforce-lists>`_
- `CT subdomains <https://github.com/internetwache/CT_subdomains>`_
- `PentesterSpecialDict <https://github.com/ppbibo/PentesterSpecialDict>`_ 渗透测试人员专用精简化字典

Unicode Fuzz
----------------------------------------
- `utf16encode <http://www.fileformat.info/info/charset/UTF-16/list.htm>`_

WAF Bypass
----------------------------------------
- `abuse ssl bypass waf <https://github.com/LandGrey/abuse-ssl-bypass-waf>`_
- `wafninja <https://github.com/khalilbijjou/wafninja>`_