Web offensive penetration testing techniques and scripts for educational purposes in a controlled lab environment.
This repository is intended strictly for educational purposes in a controlled lab environment. All content, including scripts and manual testing techniques, was developed to understand and study web vulnerabilities and not for malicious use.
By using any script or technique documented in this repository, you agree that:
- You have explicit written permission from the system owner before testing
- You will only apply these scripts or techniques in environments you own or are authorized to test
- You understand that unauthorized use against real systems is illegal and punishable by law
- The author holds no responsibility for any misuse or damage caused by content in this repository
Penetration testing without authorization is a criminal offense in most countries, including under the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act (CMA), and similar legislation worldwide.
A software developer with a focus on Application Security, this repository documents hands on study of web offensive security techniques. Each entry is built from scratch to understand the mechanics behind common web vulnerabilities, not just to run tools but to understand why they work.
This repository includes custom penetration testing scripts developed alongside select vulnerability studies. Not every technique requires one, some vulnerabilities are demonstrated entirely through manual exploitation, using an intercepting proxy and browser developer tools, showing that a strong understanding of the underlying mechanics is enough to exploit them without automation or specialized tooling. Each README notes whether a companion script exists or whether the technique was solved manually.
Entries are organized by vulnerability category, each with its own README covering the vulnerability context, attack methodology, usage, assumptions, and limitations, written in the style of a standard security report to practice Threat Intelligence reporting.
Varies per entry, some require Python and specific libraries, others require only an intercepting proxy such as Burp Suite. Check the README inside each folder for specific requirements, tooling, and setup instructions.