irraz / vulnerator-ai
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
irraz / vulnerator-ai
sherlock-project / sherlock
Hunt down social media accounts by username across social networks
usestrix / strix
Open-source AI penetration testing tool to find and fix your appโs vulnerabilities.
soxoj / maigret
๐ต๏ธโโ๏ธ Collect a dossier on a person by username from 6K websites
sqlmapproject / sqlmap
Automatic SQL injection and database takeover tool
maurosoria / dirsearch
Web path scanner
OWASP / mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
blacklanternsecurity / bbot
The recursive internet scanner for hackers. ๐งก
antoniaci / blackbird
An OSINT tool to search for accounts by username and email in social networks.
infobyte / faraday
Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
ihebski / DefaultCreds-cheat-sheet
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password ๐ก๏ธ
AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.
BitterSecurity / Decepticon
Autonomous Hacking Agent for Red Team
androguard / androguard
Reverse engineering and pentesting for Android applications
Pennyw0rth / NetExec
The Network Execution Tool
commixproject / commix
Automated ฮll-in-One OS command injection exploitation tool.
OWASP / Nettacker
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
kaifcodec / user-scanner
๐ต๏ธโโ๏ธ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
elementalsouls / Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
jonaslejon / malicious-pdf
๐ Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh
gwen001 / pentest-tools
A collection of custom security tools for quick needs.
GH05TCREW / pentestagent
PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.
samugit83 / redamon
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.
ThePorgs / Exegol
Fully featured and community-driven hacking environment
Syslifters / sysreptor
A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.
vulnersCom / getsploit
Search and download public exploits from the Vulners database โ online, or fully offline from a local SQLite FTS5 index.
wgpsec / AboutSecurity
Everything for pentest. | ๆธ้ๆต่ฏ็ฅ่ฏๅบ๏ผไปฅ AI Agent ๅฏๆง่ก็ๆ ผๅผๆฒๆทๅฎๅ จๆนๆณ่ฎบใ
0xSteph / pentest-ai
Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.
0xMarcio / pocindex
Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
Hacking-Notes / Hacker-Roadmap
A detailed plan to achieve proficiency in hacking and penetration testing, with pathways including obtaining a degree in cybersecurity or earning relevant certifications.
freelabz / secator
secator - the pentester's swiss knife
topscoder / nuclei-wordfence-cve
80k+ WordPress Nuclei templates, updated daily from Wordfence intelโfilter by severity/tags/CVE and scan in one line. ๐๐
ipa-lab / hackingBuddyGPT
Helping Ethical Hackers use LLMs in 50 Lines of Code or less..
yashab-cyber / hackpilot
HackPilot Enterprise is a production-ready, cloud-native AI-powered penetration testing platform designed for enterprise security teams. It combines advanced AI, machine learning, microservices architecture, and comprehensive security frameworks to deliver professional-grade cybersecurity assessments.
CERT-Polska / Artemis
A modular vulnerability scanner with automatic report generation capabilities.
blackhillsinfosec / WifiForge
WifiForge is a tool developed by Black Hills InfoSec to help train Pentesters on different Wi-Fi attack vectors and Wireless capabilities.
GamehunterKaan / AutoPWN-Suite
AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.
AKCodez / hackingtool-plugin
Claude Code plugin: 183+ pentesting & OSINT tools from Z4nzu/hackingtool. Auto-runs what it can, hands off the rest.
ASCIT31 / Dark-Moon
Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.
JackJuly / linkook
๐ An OSINT tool for discovering linked social accounts and associated emails across multiple platforms using a single username.
stanislav-web / OpenDoor
OWASP Web Recon & Directory Discovery Platform
Cyber-Buddy / APKHunt
APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.
FLOCK4H / Freeway
WiFi Penetration Testing & Auditing Tool
EONRaider / RootWire
RootWire: A network traffic monitor for GNU/Linux โ Live Capture, PCAP Replay, NDJSON Output. Formerly Packet-Sniffer.
ADScanPro / adscan
Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.
MattKeeley / Spoofy
Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.
chadi0x / TheBigBrother
The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
Frissi0n / GTFONow
Automatic privilege escalation for misconfigured capabilities, sudo and suid binaries using GTFOBins.
pablosnt / rekono
Offensive security platform that automates attack surface discovery and vulnerability management
AISecurityLab / hackagent
HackAgent is an open-source security toolkit to detect vulnerabilities of your AI Agents
martian56 / redcell
AI red-team platform. Autonomous LLM agents run a penetration test end to end inside a Kali container and write the report. LangGraph plan/act engine, provider-agnostic models via LiteLLM, PDF/JSON/SARIF output. FastAPI + React.
Noz2 / RootHound
Map your path from a low-priv user to roo, like BloodHound, for local Linux privesc.
Mr-Destroyer / ZimZilla
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
warpedatom / NoiseHound
Detection-aware BloodHound attack-path scoring - the quietest route to your objective, calibrated across five detection tiers (audit/EDR/Elastic/MDI/WDAC) plus Azure.
pale-knight / redteam-skill
Redteam / Pentest Skill Pack โ semi-automated workflow + on-demand module selection + real-world attack chains | Kali + Claude Code ็บข้/ๆธ้/ๆ่ฝๅ - ๅ่ชๅจๅทฅไฝๆต + ๆ้็น้ๆจกๅ + ๅฎๆๅฉ็จ้พ | ๅบไบ Kali ไธ Claude Code
shaikarifali / bundlebleed
AI/LLM-assisted JS Recon and vulnerability triage for authorized bug bounty testing & pentesting โ scope-gated, passive-by-default, human-verified
MorDavid / NucleiSniper
AI-powered Nuclei template prioritization using deep target fingerprinting and TypeSafe Jev to surface relevant security findings faster.
prox0959 / CyberCodex
Autonomous 23-Source Zero-Cost OSINT, Binary Image Forensics (EXIF/GPS/Stego), Data Breach/Leak & Threat Intelligence Engine in Pure Python
SagarBiswas-MultiHAT / NmapScanningTool
A secure, production-ready Python CLI wrapper for Nmap that makes powerful scans easy and repeatable. Includes 12 built-in profiles (SYN, aggressive, OS detection, vulnerability/NSE checks), interactive and non-interactive modes, strict input validation, Docker support, CI, and script-friendly flags for automation.