ifixai-ai / iFixAi
Independent Auditing of AI Agents. Run by human or the agent itself, to answer the most crucial question in the AI Agent Economy. Is the agent doing what is supposed to do? With iFixAi you can have this answer in less than 120 seconds.
interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
escudero / brandpose
Personal project: where shoppers look, estimated from an ordinary security camera and open source AI (YOLO11, Gaze-LLE, Depth Anything V2)
chaenmasahiro0425 / claude-security-scan
「セキュリティチェックして」の一言で、Mac・リポジトリ・GitHub・Vercel・AWS・Gmailを読み取り専用で横断点検する Claude Code スキル
irraz / vulnerator-ai
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
kamalx06 / TornadoC2
Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.
Palladiymateria / sharecheck
Local CLI that checks your project for accidental secrets, sensitive files, and oversized assets before publishing to GitHub. No uploads. No runtime dependencies.
threathunterX / underground-slang-lexicon
A continuously updated lexicon of underground slang in the online fraud and gray-market economy: definitions, supply-chain roles, sanitized real-world usage and false-positive warnings. Chinese-dominant, with Brazilian Portuguese, English, Indonesian, Tagalog and Vietnamese entries. Maintained by the Threat Hunter research team.
sherlock-project / sherlock
Hunt down social media accounts by username across social networks
usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
mitmproxy / mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
soxoj / maigret
🕵️♂️ Collect a dossier on a person by username from 6K websites
sqlmapproject / sqlmap
Automatic SQL injection and database takeover tool
jumpserver / jumpserver
JumpServer is an Open-source Privileged Access Management (PAM) platform with AI-powered capabilities, providing DevOps and IT teams a unified workspace to securely access SSH, RDP, Kubernetes, databases, websites, RemoteApp, VirtualApp, and more.
StevenBlack / hosts
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
trailofbits / algo
Set up a personal VPN in the cloud
goauthentik / authentik
The authentication glue you need.
NVIDIA / SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
SWE-agent / SWE-agent
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
eosphoros-ai / DB-GPT
open-source agentic AI data assistant for the next generation of AI + Data products.
fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
opensandbox-group / OpenSandbox
Secure, Fast, and Extensible Sandbox runtime for AI agents.
AgriciDaniel / claude-obsidian
Self-organizing AI second brain for Obsidian + Claude Code. Drop any source and Claude reads, links, and files it into one connected knowledge graph of plain Markdown you own. AI note-taking, personal knowledge management (PKM), and an open-source Notion alternative. Based on Karpathy's LLM Wiki pattern.
mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
prowler-cloud / prowler
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
maurosoria / dirsearch
Web path scanner
e2b-dev / E2B
Open-source, secure environment with real-world tools for enterprise-grade agents.
OWASP / mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
secdev / scapy
Scapy: the Python-based interactive packet manipulation program & library.
SigmaHQ / sigma
Main Sigma Rule Repository
bunkerity / bunkerweb
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
frappe / frappe
Low code web framework for real world applications, in Python and Javascript
blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
OpenMined / PySyft
Perform data science on data that remains in someone else's server
xonsh / xonsh
🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.
NVIDIA / garak
the LLM vulnerability scanner
JerBouma / FinanceDatabase
This is a database of 300.000+ symbols containing Equities, ETFs, Funds, Indices, Currencies, Cryptocurrencies and Money Markets.
antoniaci / blackbird
An OSINT tool to search for accounts by username and email in social networks.
bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
firerpa / lamda
Android Full-Stack Device Control Platform: WebRTC/H.264 remote desktop, UI/OCR/image-matching automation, one-click MITM, built-in Frida, proxy/VPN/frp/P2P networking, MCP/Agent, 160+ APIs, designed for multi-device clusters and engineered deployments.
stamparm / maltrail
Malicious traffic detection system
PyCQA / bandit
Bandit is a tool designed to find common security issues in Python code.
trailofbits / skills
Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows
SnailSploit / Claude-Red
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
apache / caldera
Automated Adversary Emulation Platform
NVIDIA-NeMo / Guardrails
NeMo Guardrails is an open-source toolkit for easily adding programmable guardrails to LLM-based conversational systems.
bee-san / pyWhat
🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙♀️
netalertx / NetAlertX
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
bleachbit / bleachbit
BleachBit system cleaner for Windows and Linux
lintsinghua / DeepAudit
DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。让安全不再昂贵，让审计不再复杂。
onionshare / onionshare
Securely and anonymously share files, host websites, and chat with friends using the Tor network
Tencent / AI-Infra-Guard
A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.
CTFd / CTFd
CTFs as you need them
ricequant / rqalpha
A extendable, replaceable Python algorithmic backtest && trading framework supporting multiple securities
infobyte / faraday
Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
ihebski / DefaultCreds-cheat-sheet
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️
reddelexc / hackerone-reports
Top disclosed reports from HackerOne
cowrie / cowrie
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
microsoft / agent-governance-toolkit
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.