Your Bug Hunting Arsenal

ASN Lookup

Look up ASN information for any IP: network range, country, description. Network intelligence tool

Cookie Security Checker

Analyze Set-Cookie headers for Secure, HttpOnly, SameSite flags. Detect insecure cookie configurations that enable session hijacking

CORS Checker

Test CORS misconfigurations including origin reflection, null origin, and wildcard trust

CRT.sh Cert. Transparency

Query Certificate Transparency logs for subdomains, wildcards, and expired certificates

DNS Record Lookup

Query A, AAAA, MX, TXT, NS, CNAME, SOA records with TTL and resolver details

URL & Domain Parser

Parse URLs into protocol, subdomain, domain, TLD, path, query params, and fragment. Essential for URL analysis

Google Dork Generator

Auto-generate targeted Google dork queries from recon objectives like SQLi, exposed panels, or cloud buckets

Email Extractor

Extract email addresses from any text. Detects standard and obfuscated email formats for OSINT gathering

Email Variant Generator

Generate common email variants from names and domains (first.last@, flast@, etc). OSINT account discovery tool

IP Address Converter

Convert IPv4/IPv6 between dotted decimal, hex, binary, integer formats. CIDR and reverse DNS helper

IP Geolocation

Lookup IP location: country, city, ISP, ASN, coordinates, and timezone

JS Endpoint Extractor

Download and parse JavaScript files to extract API endpoints, secret patterns, and embedded parameters

Redirect Tracker

Follow HTTP redirect chains with status codes and timing per hop. Detect redirect loops and insecure redirects

Social Media Finder

Extract social media links and usernames for Twitter, LinkedIn, GitHub, Instagram from text content

Subdomain Discovery

Extract domains, TLDs, and subdomains from natural text; verify via CRT.sh and wordlist fallback

Tech Stack Analyzer

Detect servers, frameworks, databases, and security headers from live HTTP responses

URL Fuzzer

Generate targeted directory and parameter fuzzing wordlists for web content discovery

Username Generator

Generate common usernames from names with dots, underscores, numbers, and leetspeak variations

Wayback URL Extractor

Extract historical URLs, endpoints, and parameters from Internet Archive's Wayback Machine

WHOIS Lookup

Domain registration details: registrar, dates, name servers, and raw WHOIS output

Certificate Decoder

Parse PEM/DER x509 certificates: issuer, subject, SAN, expiry, key algorithm, fingerprint

Cipher Solver

Auto-detect and decode ROT13/47, Caesar, Atbash, Vigenere, Morse, Base64, Hex, Binary

CSS Color Converter

Convert between Hex, RGB, RGBA, HSL, HSLA, HWB, CMYK, and named CSS colors with live preview swatches

Emoji Decoder

Decode emoji to Unicode code points, hex values, CLDR names. Analyze emoji-based payloads

Multi-Format Encoder/Decoder

Base64, URL, HTML, Hex, Binary, Octal, ASCII, and decimal encoding with live preview

JSON/YAML/XML Converter

Convert between JSON, YAML, XML, TOML, and CSV with validation and formatting

Hash Identifier & Generator

Identify hash types by length and pattern; generate MD5, SHA1, SHA256, bcrypt hashes

XOR / Hex Tool

Single-byte XOR brute-force, hex-to-ASCII conversion, and XOR two hex strings together

HTML Entity Encoder/Decoder

Encode/decode HTML named and numeric entities (& < '). Essential for XSS testing

JWT Debugger & Inspector

Decode JWT header/payload, verify signature, detect alg=none and weak secret attacks

MSFvenom Command Generator

Generate msfvenom commands for staged/bind/reverse payloads with encoding and format options

Number Base Converter

Convert numbers between binary, octal, decimal, hex, and any base 2-36. CTF puzzle solver

Payload Encoder

Encode payloads for WAF bypass: double URL encoding, Unicode normalization, comment injection, hex encoding

Color Converter

Convert between RGB, Hex, HSL, RGBA color formats with live color swatch preview

Roman Numeral Converter

Convert between Arabic numbers and Roman numerals (1-3999). CTF numeral puzzle solver

String Manipulator

Case conversion, string reversal, leetspeak encoding, whitespace removal, and substring extraction

Text to Binary Converter

Convert text to 8-bit binary and binary back to text. CTF binary puzzle solver

Text to Octal Converter

Convert text to octal representation and back. CTF steganography and encoding solver

Unicode Normalizer

Normalize Unicode text, detect homograph attack characters, and inspect code points

Unicode Poison Generator

Generate Bidi overrides, zero-width spaces, homoglyph attacks for code review testing

User Agent Generator

Generate realistic browser user-agent strings for Chrome, Firefox, Safari, and mobile devices

UUID Generator

Generate bulk UUID v4 identifiers with customizable count and format options

Web Shell Generator

Generate PHP, ASP, JSP web shells with file management and command execution capabilities

CVE Research Summarizer

CVSS scores, affected versions, exploit maturity, and published references for any CVE ID

JSON Formatter & Validator

Format, validate, and minify JSON with syntax highlighting. Detect malformed JSON structure

Markdown Converter

Convert between text, Markdown, and HTML formats. Clean formatting for bug bounty reports

Markdown Note Organizer

Structure raw engagement notes into clean markdown with headers, code blocks, and task lists

Regex Tester

Test regex patterns with real-time matching, capture groups, flags, and replace functionality

Bug Bounty Report Template

Generate structured HackerOne/Bugcrowd reports with severity, CVSS, PoC, remediation, and timeline sections

Text Diff Tool

Compare two texts side by side with line-level diff highlighting and unified output

Write-up Helper

Convert Nmap XML, Nuclei JSON, and Burp exports into formatted security write-ups

CI/CD Hardening Advisor

Hardening recommendations for GitHub Actions, GitLab CI, and Jenkins pipeline security

Code Language Detector

Detect 30+ programming languages from source code snippets. Python, JS, Go, Rust, C++, Java and more

Security Code Reviewer

Find RCE, SQLi, XSS, path traversal, hardcoded secrets, and unsafe deserialization in source code

Docker/Cloud Config Auditor

Audit Dockerfiles for privilege escalation, exposed ports, and cloud IAM misconfigurations

HTTP Security Audit

Scan URLs for HSTS, CSP, X-Frame-Options, and other security headers. Get a security grade

HTTPS Enforce Checker

Verify HTTPS redirect, HSTS headers, certificate validity. Detect mixed content and SSL issues

SSL/TLS Certificate Checker

Live SSL check: issuer, validity dates, SANs, cipher suite, certificate chain, and security rating

IP Subnet Calculator

CIDR ranges, subnet masks, network/broadcast addresses, wildcard masks, and usable host counts

Command Injection Generator

Generate OS command injection payloads for Linux/Windows with blind, OOB, and time-based techniques

HTTP Request Builder

Craft custom HTTP requests with any method, headers, params, and body for API security testing

LDAP Injection Generator

Generate LDAP filter injection payloads for auth bypass and directory extraction

LFI Path Checker

Test URLs for LFI using path traversal, null byte, and PHP wrapper payloads

LFI Payload Generator

Generate LFI payloads with PHP wrappers, null byte injection, and log poisoning techniques

NoSQL Injection Generator

Generate MongoDB NoSQL injection payloads with $where, $ne, $regex, and boolean techniques

Open Redirect Checker

Test URLs for open redirect by injecting payloads into parameters. Detect phishing vectors

Open Redirect Payload Generator

Generate open redirect payloads with URL encoding, protocol smuggling, and whitelist bypass

Prototype Pollution Generator

Generate JS prototype pollution payloads for __proto__, constructor, and merge/clone techniques

Reverse Shell Generator

Generate one-liner reverse shells in 10+ languages for Linux and Windows targets

SQLi Payload Generator

SQL injection payloads for MySQL, PostgreSQL, MSSQL, Oracle, SQLite using error/union/blind/time techniques

SSRF Vulnerability Checker

Test URLs for SSRF by injecting internal IPs, cloud metadata endpoints, and URL scheme bypasses

SSRF Payload Generator

Generate SSRF payloads for AWS/GCP/Azure metadata, internal scanning, and blind SSRF detection

SSTI Payload Generator

Template injection payloads for Jinja2, Twig, Freemarker, Velocity, Jade/Pug across 4 technique categories

XSS Payload Builder

Generate XSS payloads by type (reflected, stored, DOM) with polyglot and WAF bypass techniques

XXE Vulnerability Checker

Test XML for XXE injection: file disclosure, SSRF, DoS, and blind XXE techniques

XXE Payload Generator

Generate XXE payloads for file disclosure, SSRF, blind OOB, and billion laughs DoS attacks

Clickjacking Builder

Generate clickjacking PoC pages with transparent iframes and decoy UI. Test frame-ancestors and X-Frame-Options bypasses

CRLF Injection Generator

Generate CRLF payloads for HTTP response splitting, log injection, and cache poisoning attacks

CSP Bypass Generator

Generate CSP bypass payloads for JSONP, CDN origins, file uploads, and dangling markup vectors

CSRF PoC Generator

Generate CSRF proof-of-concept HTML with auto-submitting forms and fetch() payloads. Test SameSite and anti-CSRF tokens

GraphQL Injection Generator

Generate GraphQL introspection queries, injection payloads, batching attacks, and depth-based DoS tests

HTTP Parameter Pollution Generator

Generate HPP payloads for WAF bypass, parameter override, and server-side parsing logic exploitation

OGNL Injection Generator

Generate Struts2 OGNL expression injection payloads for RCE, file read, and command execution

SMTP Header Injection Generator

Generate SMTP injection payloads for email spoofing, header manipulation, and MIME smuggling

WebSocket Tester

Test WebSocket connections with custom handshake headers and message payloads. Verify origin validation and WSS/TLS

XPath Injection Generator

Generate XPath injection payloads for authentication bypass, XML data extraction, and blind injection

AI Bug Hunting Assistant

Chat with AI about security testing methodology, vulnerability classes, and bug hunting strategies

AI Vulnerability Analyzer

Paste code or configs for AI-powered vulnerability analysis with remediation advice

AI Payload Generator

Describe your target scenario in natural language and get custom exploit payloads from AI

AI Report Writer

Generate polished bug bounty reports with executive summaries, technical details, and CVSS scoring via AI

API Key Generator

Generate secure API keys with configurable length, prefix, and character sets. Supports hashed output

Test Credit Card Generator

Generate valid test card numbers for Visa, MC, Amex, Discover with valid Luhn checksums

Cron Expression Builder

Build cron expressions with a visual interface and human-readable schedule descriptions

CSS Formatter & Beautifier

Format, beautify, and minify CSS with configurable indentation and syntax validation

Data Size Converter

Convert between bits, bytes, KB, MB, GB, TB with binary (KiB) and decimal (KB) standards

Fake Identity Generator

Generate realistic fake person data: name, address, phone, email, DOB for testing

File Signature Detective

Identify 40+ file formats from hex magic bytes — JPEG, PNG, ZIP, ELF, PDF and more

HTTP Status Code Reference

Complete HTTP status code reference with descriptions, common causes, and SEO implications

MAC Address Generator

Generate random MACs by vendor OUI with colon, hyphen, or dot-separated formats

MIME Type Reference

Search MIME types by file extension or content type with full registry coverage

Password Generator

Generate strong random passwords with configurable length and character set inclusion

Password Strength Analyzer

Analyze password entropy, crack time estimation, character set composition, and strength scoring

Port List Generator

Common TCP/UDP ports categorized by service with protocol, description, and threat context

Security Headers Generator

Generate Content-Security-Policy, HSTS, X-Frame-Options, and other security header configs

Serial Number Generator

Generate serial numbers with configurable patterns (XXXX-XXXX), prefixes, and check digits

SQL Formatter & Beautifier

Format SQL queries with configurable indentation and keyword casing for MySQL, PG, MSSQL

Timestamp Converter

Convert Unix timestamps to readable dates and back. Supports seconds, ms, ns precision

Token Generator

Generate secure tokens for API auth, CSRF, password reset with hex, base64, alphanumeric encoding

Wordlist Generator

Custom wordlists with base words, number mutations, leetspeak substitutions, and common suffixes

XML Formatter & Validator

Format, validate, and minify XML with syntax checking and well-formedness detection

YAML Formatter & Validator

Format, lint, and validate YAML. Detect indentation errors and duplicate keys