awarexone / Agentic-Bug-Hunter
AI-powered bug bounty hunting toolkit that works with or without subscription.
awarexone / Agentic-Bug-Hunter
gadievron / raptor
Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.
nabla-c0d3 / sslyze
Fast and powerful SSL/TLS scanning library.
coreruleset / coreruleset
OWASP CRS (Official Repository)
samugit83 / redamon
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.
Alfredredbird / tookie-osint
Tookie is a advanced OSINT information gathering tool that finds social media accounts based on inputs.
cisco-ai-defense / skill-scanner
Security Scanner for Agent Skills
OpenOSINT / OpenOSINT
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
scadastrangelove / awesome-ai-security-tools
A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.
canarybyte / veridrop
在线检测：veridrop.app｜AI API 中转站检测工具：Claude 中转站检测、OpenAI 中转站检测、Gemini 中转站检测，中转站真伪检测、长上下文验证、思维签名验证、中转站红黑榜，自托管开源。
jagmarques / asqav-sdk
Python and TypeScript SDKs for verifiable evidence of AI agent actions. Signed receipts, policy enforcement, audit trails. Works with LangChain, CrewAI, MCP.
chris-ritsen / samsung-tv-root
Samsung QN90B and QN90F root
StevenBlack / hosts
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
trailofbits / algo
Set up a personal VPN in the cloud
SWE-agent / SWE-agent
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
OWASP / mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
xonsh / xonsh
🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.
bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
apache / caldera
Automated Adversary Emulation Platform
bee-san / pyWhat
🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙♀️
netalertx / NetAlertX
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
onionshare / onionshare
Securely and anonymously share files, host websites, and chat with friends using the Tor network
reddelexc / hackerone-reports
Top disclosed reports from HackerOne
microsoft / agent-governance-toolkit
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
Azure / Azure-Sentinel
Cloud-native SIEM for intelligent security analytics for your entire enterprise.
cloud-custodian / cloud-custodian
Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
Giskard-AI / giskard-oss
🐢 Open-Source Evaluation & Testing library for LLM Agents
OWASP / Nettacker
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
iflytek / astron-rpa
Agent-ready RPA suite with out-of-the-box automation tools. Built for individuals and enterprises.
google / google-ctf
Google CTF
DefectDojo / django-DefectDojo
Open-Source Unified Vulnerability Management, DevSecOps & ASPM
microsoft / PyRIT
The Python Risk Identification Tool for generative AI (PyRIT) is an open source framework built to empower security professionals and engineers to proactively identify risks in generative AI systems.
intuitem / ciso-assistant-community
CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.
meta-llama / PurpleLlama
Set of tools to assess and improve LLM security.
jtesta / ssh-audit
SSH server & client security auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)
jekil / awesome-hacking
Awesome hacking is an awesome collection of hacking tools.
TracecatHQ / tracecat
Open-source security automation platform for teams and AI agents
gmh5225 / awesome-game-security
awesome game security [Welcome to PR]
awslabs / agentcore-samples
Amazon Bedrock Agentcore accelerates AI agents into production with the scale, reliability, and security, critical to real-world deployment.
Legrandin / pycryptodome
A self-contained cryptographic library for Python
WebBreacher / WhatsMyName
Community-maintained dataset of 700+ websites for finding accounts by username — powers OSINT and digital footprint tools.
supabase / supabase-py
Python Client for Supabase. Query Postgres from Flask, Django, FastAPI. Python user authentication, security policies, edge functions, file storage, and realtime data streaming. Good first issue.
cisagov / Malcolm
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
wemake-services / wemake-django-template
Bleeding edge django template focused on code quality and security.
uber / ADR
ADR secures enterprise AI agents through observability, security benchmarking, and threat detection. Deployed at Uber.
roryclear / clearcam
Add object detection, tracking, mobile notifications, and search to any security camera.
wgpsec / AboutSecurity
Everything for pentest. | 渗透测试知识库，以 AI Agent 可执行的格式沉淀安全方法论。
ossf / cve-bin-tool
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
0xSteph / pentest-ai
Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.
scito / extract_otp_secrets
Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.
mukul975 / cve-mcp-server
Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.
ZimengXiong / tinyTouch
authenticate, sudo, login with your fingerprint wire(less)ly without having to spend $149 at the cost of some security
Hacking-Notes / Hacker-Roadmap
A detailed plan to achieve proficiency in hacking and penetration testing, with pathways including obtaining a degree in cybersecurity or earning relevant certifications.
yashab-cyber / hackpilot
HackPilot Enterprise is a production-ready, cloud-native AI-powered penetration testing platform designed for enterprise security teams. It combines advanced AI, machine learning, microservices architecture, and comprehensive security frameworks to deliver professional-grade cybersecurity assessments.
marc-shade / world-intel-mcp
160-tool MCP server for real-time global intelligence from free public APIs: markets, liquidity, prediction markets, SEC filings, conflict, military, aircraft-cohort early warning, migration and border flows, cyber, climate, news and more. Dated observation history, 29 research prompts, cited briefs, geofences, SSE dashboard. MIT, no paid API keys.
Zyrexnn / Cybermes
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
dedsec1121fk / DedSec
Official repository of the DedSec Project.