irraz / vulnerator-ai
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
irraz / vulnerator-ai
kamalx06 / TornadoC2
Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.
usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
SWE-agent / SWE-agent
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
SnailSploit / Claude-Red
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
infobyte / faraday
Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
ihebski / DefaultCreds-cheat-sheet
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️
elementalsouls / Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
gadievron / raptor
Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.
codingo / NoSQLMap
Automated NoSQL database enumeration and web application exploitation tool.
dirkjanm / ROADtools
A collection of Azure AD/Entra tools for offensive and defensive security purposes
Syslifters / sysreptor
A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.
owtf / owtf
Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp
vulnersCom / getsploit
Search and download public exploits from the Vulners database — online, or fully offline from a local SQLite FTS5 index.
0xSteph / pentest-ai
Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.
7h30th3r0n3 / Raspyjack
Small offensive network toolkit for Raspberry Pi (+ Waveshare 1.44″ LCD HAT) and Cardputer Zero inspired by pager and sharkjack fonctionnalities. For redteam and educational purposes only.
laluka / bypass-url-parser
bypass-url-parser
ASCIT31 / Dark-Moon
Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.
OffensivePython / Saddam
DDoS Amplification Tool
SpecterOps / Nemesis
An offensive data enrichment pipeline
cdxiaodong / cain-agent
Real-world AI penetration testing engineer for authorized assessments — built-in cloud module covering AWS/Azure/GCP + Aliyun/Tencent/Huawei clouds. Built on Claude Agent SDK
Zyrexnn / Cybermes
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
SudoHopeX / KaliGPT
KaliGPT: an Agentic AI (built with Gemini, ChatGPT, Ollama, OpenRouter Models) fine tuned for ethical hackers & students in offensive security making workflows smarter, faster, and more accessible.
Frissi0n / GTFONow
Automatic privilege escalation for misconfigured capabilities, sudo and suid binaries using GTFOBins.
pablosnt / rekono
Offensive security platform that automates attack surface discovery and vulnerability management
FishCodeTech / muteki
Project Muteki (無敵): Open-source AI-powered offensive security harness for automated penetration testing.
martian56 / redcell
AI red-team platform. Autonomous LLM agents run a penetration test end to end inside a Kali container and write the report. LangGraph plan/act engine, provider-agnostic models via LiteLLM, PDF/JSON/SARIF output. FastAPI + React.
Mr-Destroyer / ZimZilla
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
devZero-Security / redStackPRO
A canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself. Your cloud credentials never leave your machine.
Bert-JanP / EntraTrace
EntraTrace is a defensive security research tool for tracking and identifying the behavior of offensive tooling targeting Microsoft Entra ID.
lordx64 / pentestkit
Autonomous multi-agent pentest framework — plans, exploits, verifies (proof-required), CVSS-scores and writes client-ready reports. 104/104 (100%) on the XBOW validation benchmarks, powered by Kimi K3.
mouteee / autonomous-offensive-llm-handbook
Step-by-step handbook for building autonomous security agents with clear limits, runnable lessons, diagrams, and honest evidence.
PolarPatch / BlueWatch
Passive Bluetooth neighbourhood monitor for Raspberry Pi and Linux: a live radar, device triage, categories and alerts for new devices.
xiabai2008 / ruoyi-scan
RuoYi (若依) dedicated vulnerability scanner: plugin architecture, three-state verdict, WAF bypass, exploit chains, AI POC generation, nuclei compatible. 若依专项漏洞扫描器
P-BitM-Framework / P-BitM
P-BitM is a containerized platform for controlled and weaponized Browser-in-the-Middle
dmdhrumilmistry / security-harness
A multi-agent application-security review harness for Claude Code (and, later, other AI agents). One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies real impact, and reports to README/JSON/SARIF/doc/PDF.
Tangruwo / RuwoScan
基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。
MorDavid / NucleiSniper
AI-powered Nuclei template prioritization using deep target fingerprinting and TypeSafe Jev to surface relevant security findings faster.
weidutech / PentestPi
Autonomous Penetration Testing Agent Framework with External State Memory & Anti-False-Falsification Guardrails.
francordel / myrtia
Myrtia — agent-native red teaming for LLMs and AI agents: a deliberating council of attacker models (propose, cross-critique, Borda vote, chairman synthesis), 13 attack strategies, live turn-by-turn UI and ASR analytics. Open-source, built on IBM ARES.
lupingQAQ / JGD
Autonomous agent that mines Java deserialization gadget chains from any JAR directory. Static bytecode analysis + dynamic JVM probes + dual-model adversarial auditing → weaponized PoC. Solving the last mile.
shaheeryasirofficial / ClickMyPayload
ClickMyPayload creates realistic browser verification pages that silently copy PowerShell or CMD commands to the clipboard, display decoy tokens, and guide users to execute them via Win+R. Optional binary payloads can download automatically on page load