zentralopensource / zentral
Zentral is a control plane for secure, observable Apple endpoints in enterprises. Configure, observe, and enforce the desired state of every Apple endpoint. Manage that desired state as code through GitOps and Terraform.
toby-bridges / api-relay-audit
Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, error leakage, and Web3 wallet risks.
arm / metis
Metis is an open-source, AI-driven tool for deep security code review
drego85 / tosint
Tosint is a Telegram OSINT tool that extracts actionable intelligence from bot tokens and chat IDs for security investigations.
nix-community / vulnix
Vulnerability (CVE) scanner for Nix/NixOS [maintainer=@henrirosten]
duriantaco / skylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
flosell / trailscraper
A command-line tool to get valuable information out of AWS CloudTrail
asdfgh1445 / ctf-super-hub
面向小白用户的 CTF / 逆向 Skills 整合包：自动分流、头脑风暴、教学模式、比赛模式、只提示模式
blacklanternsecurity / badsecrets
A library for detecting known secrets across many web frameworks
Vu1nT0tal / yarb
方便获取每日安全资讯的爬虫和推送程序
Guard-Core / fastapi-guard
A security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts, honeypot setup, behavioural analysis, emergency mode lockdown, block Cloud Provider IPs, country blocking, and much more... It integrates seamlessly with FastAPI to offer robust protection against various security threats.
Katakate / k7
Your own self-hosted infra for lightweight VM sandboxes to safely execute untrusted code. CLI, API, Python SDK. ⭐ Star it if you like it! ⭐
fronzbot / blinkpy
A Python library for the Blink Camera system
google / turbinia
Automation and Scaling of Digital Forensics Tools
MobSF / mobsfscan
mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.
BlessedRebuS / Krawl
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
Lookyloo / lookyloo
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
knostic / OpenAnt
OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery and remediation product, helping defenders proactively find and patch verified security flaws while minimizing both false positives and negatives. Stage 1 detects. Stage 2 attacks. What survives is real.
Coldcard / firmware
❄️ Firmware and simulator for Coldcard Hardware Wallet
ADScanPro / adscan
Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.
MattKeeley / Spoofy
Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.
chadi0x / TheBigBrother
The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
dapr / dapr-agents
Build autonomous, resilient and observable AI agents with built-in workflow orchestration, security, statefulness and telemetry.
CycodeLabs / raven
CI/CD Security Analyzer
SudoHopeX / KaliGPT
KaliGPT: an Agentic AI (built with Gemini, ChatGPT, Ollama, OpenRouter Models) fine tuned for ethical hackers & students in offensive security making workflows smarter, faster, and more accessible.
hynek / argon2-cffi
Secure Password Hashes for Python
aboutcode-org / vulnerablecode
A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/
alinaqi / maggy
What started as an opinionated Claude Code setup kit is now an autonomous AI engineering command center
mitre-attack / attack-stix-data
STIX data representing MITRE ATT&CK
pallets-eco / flask-security
Quick and simple security for Flask applications
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
OWASP / OFFAT
The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.
trailofbits / fickling
A Python pickling decompiler and static analyzer
PaulDuvall / ai-development-patterns
A comprehensive collection of AI development patterns for building software with AI assistance, organized by implementation maturity and development lifecycle phases. Includes Foundation, Development, and Operations patterns with practical examples and anti-patterns.
Privado-Inc / privado
Open Source Static Scanning tool to detect data flows in your code, find data security vulnerabilities & generate accurate Play Store Data Safety Report.
BullsEye0 / ghost_eye
Ghost Eye Informationgathering Footprinting Scanner and Recon Tool Release. Ghost Eye is an Information Gathering Tool I made in python 3. To run Ghost Eye, it only needs a domain or ip. Ghost Eye can work with any Linux distros if they support Python 3. Author: Jolanda de Koff
dmdhrumilmistry / pyhtools
A Python Hacking Library consisting of network scanner, arp spoofer and detector, dns spoofer, code injector, packet sniffer, network jammer, email sender, downloader, wireless password harvester credential harvester, keylogger, download&execute, ransomware, data harvestors, etc.
DataDog / dd-trace-py
Datadog Python APM Client
Frissi0n / GTFONow
Automatic privilege escalation for misconfigured capabilities, sudo and suid binaries using GTFOBins.
Mafifrizi / ARES
ARES - authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting.
pablosnt / rekono
Offensive security platform that automates attack surface discovery and vulnerability management
dougburks / so-crates
SO-CRATES: Security Onion Containerized Rapid Analysis of Threats, Evil, and Sus!
7onez / cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
shenril / Sitadel
Web Application Security Scanner
FishCodeTech / muteki
Project Muteki (無敵): Open-source AI-powered offensive security harness for automated penetration testing.
The-Art-of-Hacking / websploit
This is a learning created by Omar Santos (@santosomar) for different Cybersecurity training sessions. It includes many intentionally vulnerable applications running in Docker containers and thousands of cybersecurity resources.
cedricbonhomme / Stegano
A pure Python steganography module.
OpenCTI-Platform / connectors
OpenCTI Connectors
Ostorlab / oxo
OXO is a security scanning orchestrator for the modern age.
aws-samples / service-screener-v2
A tool for customers to evaluate their AWS service configurations based on AWS and community best practices and receive recommendations on potential improvements.
vognik / maltego-telegram
🔎 OSINT Maltego Transforms for investigating Telegram channels, groups, and users, including deanonymization via stickers, forwarded messages, similar channels, deleted posts, and more.
keylime / keylime
A CNCF Project to Bootstrap & Maintain Trust on the Edge / Cloud and IoT
CybercentreCanada / assemblyline
Assemblyline 4: File triage and malware analysis
crocs-muni / javacard-curated-list
Curated list of open-source Java Card applets and related applications for cryptographic smartcards
QubesOS / qubes-secpack
Qubes Security Pack
LinOTP / LinOTP
LinOTP - the open source solution for two factor authentication
ImKKingshuk / LockKnife
LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for deep Android security research, built for researchers and hackers. Powered by Python orchestration and a Rust-accelerated core, enabling AI agent–driven hacking, credential recovery/cracking, APK analysis, intelligence gathering, runtime inspection.
google / mcp-security
—
zricethezav / h1domains
HackerOne "in scope" domains
armijnhemel / binaryanalysis-ng
Binary Analysis Next Generation (BANG)