Shuffle / Shuffle
Shuffle: A general purpose security automation platform. Our focus is on collaboration and resource sharing.
Shuffle / Shuffle
RoseSecurity / Red-Teaming-TTPs
Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike!
tirrenotechnologies / tirreno
tirreno is an open-source framework for building sovereign security, compliance and fraud prevention applications. Detect account takeovers, cyberfraud and business logic abuse inside your product.
webpwnized / mutillidae
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.
thalesgroup-cert / Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
0ct0sec / M5PORKCHOP
ON NO! Someone put an RPG in a packet sniffer
center-for-threat-informed-defense / attack-flow
Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
BlessedRebuS / Krawl
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
knostic / OpenAnt
OpenAnt from Knostic is the leading open source LLM-based vulnerability discovery and remediation product, helping defenders proactively find and patch verified security flaws while minimizing both false positives and negatives. Stage 1 detects. Stage 2 attacks. What survives is real.
OWASP / cve-lite-cli
Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.
Avarok-Cybersecurity / atlas
Pure Rust Inference Engine
DrHazemAli / enterprise-system-design
A source-grounded course and architectural reference for engineers designing systems that must survive real traffic, partial failure, security review, and changing requirements, spanning enterprise system design, distributed systems, AI systems, cybersecurity, reliability, cloud, HPC, edge, and mission-critical infrastructure.
The-Art-of-Hacking / websploit
This is a learning created by Omar Santos (@santosomar) for different Cybersecurity training sessions. It includes many intentionally vulnerable applications running in Docker containers and thousands of cybersecurity resources.
SecNN / AiScan-N
AiScan-N 来了！这是一款基于人工智能驱动的Ai自动化网络安全（运维）工具，专注于网络安全评估、漏洞扫描、运维、应急响应、渗透测试自动化，Ai大模型工具集【CLI Agent】 ，Ai驱动的安全检测技术，提升安全测试（运维）效率，专为企业和个人用户打造，尤其适合初学者（小白）快速上手使用，让你轻松迈入智能安全攻防时代！适用场景 ：如（红队演练、CTF比赛、Web应用渗透测试、内网横向移动、密码破解与暴力攻击、流量分析与威胁检测、APT攻击模拟、漏洞赏金挑战等场景）🎥演示视频（文章中）：https://mp.weixin.qq.com/s/7lsUdbrxkDy4P5pZhEWv7Q
devZero-Security / redStackPRO
A canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself. Your cloud credentials never leave your machine.
M4elstr0m / gophoner
Check simultaneously if a phone number is registered on popular apps & websites, without any prerequisite 📞
UseOSINT / Skills
28 OSINT Agent Skills that turn Cursor, Claude & AI coding agents into a full open-source intelligence platform — reconnaissance, attribution, GEOINT, breach checks & due diligence. Ethical, sourced, passive-first.
grepleaks / grepleaks
Grepleaks — your AI pentest environment. An AI pentest agent that lives in your terminal.
weidutech / PentestPi
Autonomous Penetration Testing Agent Framework with External State Memory & Anti-False-Falsification Guardrails.
kaifcodec / phonsint
🕵️♂️ Advanced phone number OSINT suite engineered for silent reconnaissance. Extracts masked emails, profile avatars and uncovers cross-platform account registrations, and enriches identity footprints with zero SMS alerts.
berty / berty
Berty is a secure peer-to-peer messaging app that works with or without internet access, cellular data or trust in the network
decalage2 / awesome-security-hardening
A collection of awesome security hardening guides, tools and other resources
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
frankwxu / digital-forensics-lab
Free hands-on digital forensics labs for students and faculty
x90skysn3k / brutespray
Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.
notthehiddenwiki / NTHW
Not The Hidden Wiki - The largest repository of links related to cybersecurity
cyb3rxp / awesome-soc
A curated knowledge base to build, run and mature a SOC (including CSIRT).
splunk / security_content
Splunk Security Content
xaitax / SploitScan
SploitScan is a sophisticated cybersecurity utility designed to provide detailed information on vulnerabilities and associated exploits.
infosecB / awesome-detection-engineering
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
freelabz / secator
secator - the pentester's swiss knife
Athena-OS / athena
Athena OS is a Arch/Nix-based distro focused on Cybersecurity. Learn, practice and enjoy with any hacking tool!
taranis-ai / taranis-ai
Taranis AI is an advanced Open-Source Intelligence (OSINT) tool, leveraging Artificial Intelligence to revolutionize information gathering and situational analysis.
FunnyWolf / agentic-soc-platform
Agentic SOC Platform: A powerful, flexible, open-source, and agent-centric automated security operations platform (AI SOC)
GamehunterKaan / AutoPWN-Suite
AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.
mitre-attack / mitreattack-python
A python module for working with ATT&CK
mitre-attack / attack-stix-data
STIX data representing MITRE ATT&CK
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
yaklang / yaklang
A programming language exclusively designed for cybersecurity
kviklet / kviklet
Pull Request-like Review/Approval flow for database queries. For compliant but smooth Engineering access to production.
raphabot / awesome-cybersecurity-agentic-ai
—
OpenCTI-Platform / connectors
OpenCTI Connectors
CybercentreCanada / assemblyline
Assemblyline 4: File triage and malware analysis
infosecB / LOOBins
Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.
GACWR / OpenUBA
A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]
0sec-labs / 0
The AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities 24/7.
WMAL / kodachios
Kodachi OS is a Debian-based privacy & security OS by Warith Al Maawali, built for uncompromising privacy, anonymity, and reliability. It pairs hardened defaults with a curated toolkit for private browsing, advanced networking, and incident response, all in an intuitive interface.
jassics / cybersecurity-roadmap
Skills and career roadmap for various security roles like application security, cloud security, DevSecOps, security engineer, security researchers, pentesting, api security, network security, mobile security and so on with helpful resources, guidelines
s4ntrx / Cybersecurity-Threats-Guide
Cybersecurity Threats & Vulnerabilities Guide is a comprehensive educational resource that provides detailed documentation, detection scripts, and prevention strategies for various cybersecurity threats.
lordx64 / pentestkit
Autonomous multi-agent pentest framework — plans, exploits, verifies (proof-required), CVSS-scores and writes client-ready reports. 104/104 (100%) on the XBOW validation benchmarks, powered by Kimi K3.
TaroYamada08 / Hacker
This repository is maintained by Hex Core and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org
S12cybersecurity / LogonStealer
Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks
shaheeryasirofficial / SmuggleMyPayload
SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smuggling techniques, payload encoding options, JavaScript variations, and pre-built HTML templates.
yingfff123 / AtlasX
企业暴露面收集与持续监控（ASM）自托管系统：多源采集、存活与指纹富化、风险线索与变更对照。支持 Linux/Docker 一键部署。
P-BitM-Framework / P-BitM
P-BitM is a containerized platform for controlled and weaponized Browser-in-the-Middle
DevCop95 / shodan_reconsx
Portable passive hostname reconnaissance through Shodan CTL
ErSilh0x / VULNaware
Open-source vulnerability prioritization engine that enriches scanner findings with vulnerability intelligence, identifies urgent risks, and automates alerts and ITSM ticketing.
AhmadJeddi / SafeIP
A lightweight network security tool that verifies IP location, validates network safety, and prevents access to protected links when unexpected location changes are detected.
mahialjaber / SOC-Log-Analysis-Datasets
Curated, simulated dataset of security logs (Windows, Web, Firewall, Cloud) with embedded attack vectors for SOC analysts to practice SIEM ingestion, threat hunting, and log analysis.
SagarBiswas-MultiHAT / awesome-cybersecurity-paths
The complete cybersecurity career roadmap and handbook. 36 roles across pentesting, red teaming, bug bounty, SOC, incident response, digital forensics, cloud security, DevSecOps, threat hunting, OSINT, and GRC. Each role covers skills, 150+ tools, 50+ certifications, and career progression paths.