🧰 Bug Bounty Tools Collection
This catalog aggregates the principal security tools and utilities utilized across my bug hunting workflows. Each card links directly to its corresponding detailed reference wiki, command-line cheatsheet, and integration guide under the main /tools/ directory.
🔍 Reconnaissance & Subdomain Enumeration
Tools used for passive discovery, DNS mapping, and domain asset harvesting.
Subfinder
Fast passive subdomain discovery tool querying dozens of public certificate and API databases.
View Usage Wiki →OWASP Amass
Deep network footprinting and active DNS enumeration mapping external asset relationships.
View Usage Wiki →Naabu
Ultra-fast port scanning tool designed for bulk host sweeps and active service discovery.
View Usage Wiki →Nmap
The standard network mapper for port scanning, operating system detection, and script auditing.
View Usage Wiki →🕸️ Web Fuzzing & Parameter Discovery
Tools used to bruteforce web paths, analyze parameters, and audit web application inputs.
FFUF
Fast web fuzzer written in Go, optimized for directory discovery, host header fuzzing, and parameter sweeps.
View Usage Wiki →Gobuster
URI path and DNS brute-forcer designed to locate hidden files and directories on target web servers.
View Usage Wiki →Arjun
HTTP parameter discovery suite, locating hidden GET/POST variables with heuristic query engines.
View Usage Wiki →x8
Rust-based parameter and custom header discovery utility, built to find bypass mechanisms.
View Usage Wiki →🛡️ Vulnerability Scanners & Exploitation
Automating vulnerability audits, SQL injections, XSS detection, and remote system exploitation.
Nuclei
Fast, template-based vulnerability scanner automating checks using custom community YAML rules.
View Usage Wiki →Nikto
Classic web server scanner auditing configurations, server software versions, and common server files.
View Usage Wiki →SQLMap
The definitive database exploitation framework automating SQL injection detection and server takeovers.
View Usage Wiki →XSStrike
Advanced Cross-Site Scripting (XSS) detection suite equipped with smart payload parsing and filter bypasses.
View Usage Wiki →Commix
Command injection exploitation tool designed to find and automate shell creation in OS command injections.
View Usage Wiki →🛠️ Custom In-House Tools & Repositories
Proprietary toolsets, syscall tracers, setup files, and provisioners.
Vulntrace
Dynamic binary instrumentation trace framework monitoring memory leaks and API taint allocations.
View Usage Wiki →Kali Master
Automated configuration provisioner designed to rapidly build customized hacking environments.
View Usage Wiki →Lab Manager
Docker and Vagrant provisioning infrastructure for orchestrating offline vulnerable labs.
View Usage Wiki →