vxcontrol / pentagi
Self-hosted multi-agent system that autonomously plans and runs penetration tests using tools like nmap, Metasploit and sqlmap in Docker.
vxcontrol / pentagi
Asymptote-Labs / agent-beacon
Open-source memory layer that captures coding-agent session history across harnesses and turns it into reusable knowledge for future agents.
jiwoochris / artex-global
ARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)
gitleaks / gitleaks
Scans git repos, files, and stdin for hardcoded secrets such as passwords, API keys, and tokens.
trhhubsd / ARTEX
ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军
CarterPerez-dev / Cybersecurity-Projects
Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning 👇
Autumn-27 / ScopeSentry
Distributed security asset discovery platform covering subdomain enumeration, port scanning, vulnerability scanning, and page monitoring.
aquasecurity / trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
trufflesecurity / trufflehog
Scans repositories, filesystems, and chats for leaked credentials, then verifies whether each one is still live.
shadow1ng / fscan
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
pipelab-org / pipelock
Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.
google / osv-scanner
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
betterleaks / betterleaks
Find leaked secrets everywhere.
BishopFox / sliver
Adversary Emulation Framework
olafhartong / sysmon-modular
A repository of sysmon configuration modules
future-architect / vuls
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
smallstep / certificates
🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
DataDog / KubeHound
Tool for building Kubernetes attack paths
M4elstr0m / gophoner
Check simultaneously if a phone number is registered on popular apps & websites, without any prerequisite 📞
securego / gosec
Go security checker
authzed / spicedb
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
j3ssie / osmedeus
A Modern Orchestration Engine for Security
google / syzkaller
syzkaller is an unsupervised coverage-guided kernel fuzzer
smallstep / cli
🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc.
edoardottt / cariddi
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
ContainerSSH / ContainerSSH
ContainerSSH: Launch containers on demand
google / osv.dev
Open source vulnerability DB and triage service.
Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
rabbitstack / fibratus
Security sensor for realtime threat detection and protection
Zouuup / landrun
Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.
gabrie30 / ghorg
Quickly clone or backup massive amounts of org/users repositories into one directory - Supports GitHub, GitLab, Bitbucket, and more 🐇🥚
aquasecurity / trivy-operator
Kubernetes-native security toolkit
wallarm / gotestwaf
An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses
GreenmaskIO / greenmask
Database anonymization and test data management
project-copacetic / copacetic
🧵 CLI tool for directly patching container images!
NHAS / reverse_ssh
SSH based reverse shell
edoardottt / scilla
Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration
xalgorix / xalgorix
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
goshs-labs / goshs
Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.
secureCodeBox / secureCodeBox
secureCodeBox (SCB) - continuous secure delivery out of the box
Chocapikk / wpprobe
A fast WordPress plugin enumeration tool
fabriziosalmi / caddy-waf
Caddy WAF (Regex Rules, IP and DNS filtering, Rate Limiting, GeoIP, Tor, Anomaly Detection)
synfinatic / aws-sso-cli
A powerful tool for using AWS Identity Center for the CLI and web console.
activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
yaklang / yaklang
A programming language exclusively designed for cybersecurity
eraser-dev / eraser
🧹 Cleaning up images from Kubernetes nodes
dmachard / DNS-collector
Grab your DNS logs, detect anomalies, and finally understand what's happening on your network. The missing piece between DNS servers and your data stack.
in-toto / witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
edoardottt / csprecon
Discover new target domains using Content Security Policy
Mah3Sec / ForgeGuardian
Local-first, AI-native Software Supply Chain Security Platform
yyhuni / lunafox
Open-source, self-hosted attack surface management platform with distributed agents for asset discovery, scan orchestration, and vulnerability management.
hackwither / reap
reconnaissance for agent attack surfaces
Spade-sec / jsowl
JsOwl —— Go 编写的 Web 安全信息收集利器。集 JavaScript 信息收集、API 端点提取、敏感信息扫描、攻击面梳理 于一体，同时提供 CLI 工具与 Go 库。内置 direct / browser / auto 三种采集模式，兼容 HaE 规则，支持登录态扫描、运行时交互、AI 辅助分析与 MCP Server，输出 JSON 与交互式 HTML 报告，是渗透测试、红队信息收集与 Web 安全测试的高效自动化方案。