10.5. Fuzzing

10.5.1. Web Fuzz

• wfuzz

• SecLists

• fuzzdb

• foospidy payloads

• ffuf Fast web fuzzer written in Go

10.5.2. Scanners

• Nuclei a fast tool for configurable targeted vulnerability scanning based on templates offering massive extensibility and ease of use

• xray security assessment tool, supports scanning of common web security issues and custom poc

10.5.3. XSS Payloads

• PORTSWIGGER XSS cheat sheet

• Pgaijin66 XSS-Payloads

• OWASP XSS

10.5.4. Burp plugin

• BurpBounty Scan Check Builder

• BurpShiroPassiveScan

• IntruderPayloads A collection of Burpsuite Intruder payloads

10.5.5. Dictionaries

• Blasting dictionary

• pydictor A powerful and useful hacker dictionary builder for a brute-force attack

• fuzzDicts Web Pentesting Fuzz Dictionary

• bruteforce lists

• CT subdomains

• PentesterSpecialDict specific reduced dictionary

10.5.6. Unicode Fuzz

• utf16encode

10.5.7. WAF Bypass

• abuse ssl bypass waf

• wafninja