interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
interplains / zero-breach
edoardottt / awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
JoasASantos / Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
threathunterX / underground-slang-lexicon
A continuously updated lexicon of underground slang in the online fraud and gray-market economy: definitions, supply-chain roles, sanitized real-world usage and false-positive warnings. Chinese-dominant, with Brazilian Portuguese, English, Indonesian, Tagalog and Vietnamese entries. Maintained by the Threat Hunter research team.
hagezi / dns-blocklists
DNS-Blocklists: For a better internet - keep the internet clean!
crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
OpenCTI-Platform / opencti
Open Cyber Threat Intelligence Platform
fastfire / deepdarkCTI
Collection of Cyber Threat Intelligence sources from the deep and dark web
MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
kaifcodec / user-scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
Astrosp / Awesome-OSINT-List
📡 Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.
Neo23x0 / signature-base
YARA signature and IOC database for my scanners and tools
osintbrazuca / osint-brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
mitre-attack / attack-navigator
Web app that provides basic navigation and annotation of ATT&CK matrices
beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
mitre / cti
Cyber Threat Intelligence Repository expressed in STIX 2.0
phishdestroy / destroylist
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats
mthcht / awesome-lists
Awesome Security lists for SOC/CERT/CTI
ninoseki / mitaka
A browser extension for OSINT search
OpenOSINT / OpenOSINT
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
KatrielMoses / MailAccess
Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
mytechnotalent / Hacking-Windows
A FREE Windows C development course where we will learn the Win32API and reverse engineer each step utilizing IDA Free in both an x86 and x64 environment.
TheHive-Project / Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
mukul975 / cve-mcp-server
Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.
0xMarcio / pocindex
Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
thalesgroup-cert / Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
mrwadams / attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
potato-security / PotatoTool
这款工具是一款功能强大的网络安全综合工具，旨在为安全从业者、红蓝对抗人员和网络安全爱好者提供全面的网络安全解决方案。它集成了多种实用功能，包括解密、分析、扫描、溯源等，为用户提供了便捷的操作界面和丰富的功能选择。This tool offers robust network security solutions for professionals and enthusiasts. With features like decryption, analysis, scanning, and traceability, it provides a user-friendly interface and diverse functionality.
jacobdjwilson / awesome-annual-security-reports
A curated list of annual cyber security reports
sroberts / awesome-iocs
Curated sources of indicators of compromise, detection signatures and IOC tools.
frangelbarrera / OSINT-BIBLE
Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
marc-shade / world-intel-mcp
160-tool MCP server for real-time global intelligence from free public APIs: markets, liquidity, prediction markets, SEC filings, conflict, military, aircraft-cohort early warning, migration and border flows, cyber, climate, news and more. Dated observation history, 29 research prompts, cited briefs, geofences, SSE dashboard. MIT, no paid API keys.
Bert-JanP / Open-Source-Threat-Intel-Feeds
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.
ninoseki / mihari
A query aggregator for OSINT based threat hunting
KatrielMoses / voidaccess
Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
center-for-threat-informed-defense / attack-flow
Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
chadi0x / TheBigBrother
The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
mitre-attack / mitreattack-python
A python module for working with ATT&CK
drb-ra / C2IntelFeeds
Automatically created C2 Feeds
mitre-attack / attack-stix-data
STIX data representing MITRE ATT&CK
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
RansomLook / RansomLook
Yet another Ransomware gang tracker
NoblerWorks-HQ / IRONSIGHT
Real-time OSINT command center for the Iran/Israel and Russia/Ukraine theaters — 50+ live open-source intelligence sources (news, Telegram, military aircraft & naval tracking, missile alerts, prediction & defense markets) in one dashboard. No API keys. Free. Next.js + TypeScript.
activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
darama22 / Malware-Research-Hub
Self-contained malware research hub: curated catalog of 80 families (1971-2024) + 2,764 real encrypted samples, indexed and searchable. Local Flask app, bilingual.
Spacial / awesome-csirt
Awesome CSIRT is an curated list of links and resources in security and CSIRT daily activities.
MISP / misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
MISP / misp-galaxy
Clusters and elements to attach to MISP events or attributes (like threat actors)
PaloAltoNetworks / Unit42-timely-threat-intel
A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.
duggytuxy / Data-Shield_IPv4_Blocklist
Data-Shield provides maintained IPv4 blocklists for inbound filtering on firewalls, gateways and web application firewalls.
7onez / cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
mitre-attack / attack-website
MITRE ATT&CK Website
utmstack / UTMStack
Enterprise-ready SIEM, SOAR and Compliance powered by real-time correlation and threat intelligence.
OpenCTI-Platform / connectors
OpenCTI Connectors
google / mcp-security
—
FSECDEV / Threat-Intelligence-Hackers-Forums
A directory of hacker forums
s4ntrx / Cybersecurity-Threats-Guide
Cybersecurity Threats & Vulnerabilities Guide is a comprehensive educational resource that provides detailed documentation, detection scripts, and prevention strategies for various cybersecurity threats.