usestrix / strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool

Netw0rkNoob / VulnClaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

unionai-oss / pandera

A light-weight, flexible, and expressive statistical data testing library

samugit83 / redamon

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

pywinauto / pywinauto

Windows GUI Automation with Python (based on text properties)

OWASP / Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

jonaslejon / malicious-pdf

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

tlsfuzzer / tlsfuzzer

SSL and TLS protocol test suite and fuzzer

kelvinBen / AppInfoScanner

一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。

GH05TCREW / pentestagent

PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.

Syslifters / sysreptor

A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.

ashishb / adb-enhanced

🔪Swiss-army knife for Android testing and development 🔪 ⛺

se2p / pynguin

The PYthoN General UnIt Test geNerator is a test-generation tool for Python

kiwitcms / Kiwi

open source test management system with over 2 million downloads!

test-zeus-ai / testzeus-hercules

Hercules is the world’s first open-source testing agent, enabling UI, API, Security, Accessibility, and Visual validations – all without code or maintenance. Automate testing effortlessly and let Hercules handle the heavy lifting! ⚡

berylliumsec / nebula

Cybersecurity Harness

Cyber-Buddy / APKHunt

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

nose-devs / nose2

The successor to nose, based on unittest2

EONRaider / RootWire

RootWire: A network traffic monitor for GNU/Linux — Live Capture, PCAP Replay, NDJSON Output. Formerly Packet-Sniffer.

MattKeeley / Spoofy

Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.

python-trio / trustme

#1 quality TLS certs while you wait, for the discerning tester

microsoft / playwright-pytest

Pytest plugin to write end-to-end browser tests with Playwright.

MorDavid / NucleiSniper

AI-powered Nuclei template prioritization using deep target fingerprinting and TypeSafe Jev to surface relevant security findings faster.