h5i-dev / h5i
Unified Rust framework for building, verifying, and testing web apps. Kernel-based architecture for Lean 4 verification and GPU acceleration. Built-in red-teaming tools for automated vulnerability detection.
h5i-dev / h5i
ADScanPro / adscan
Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.
praetorian-inc / titus
High-performance secrets scanner. CLI, Go library, Burp Suite extension, and Chrome extension. 487 detection rules with live credential validation.
halilkirazkaya / arsenal-ng
The classic launcher, evolved. Fast, Go-based command library equipped with 200+ cybersecurity cheat-sheets. Just install and start hacking.
JoasASantos / Red-Team-Exercises
—
hueristiq / xurlfind3r
A command-line tool for discovering URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly available.
carloslack / KoviD
Red-Team LKM
Mafifrizi / ARES
ARES - authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting.
pablosnt / rekono
Offensive security platform that automates attack surface discovery and vulnerability management
AdnaneKhan / gato-x
GitHub Attack Toolkit - Extreme Edition - A static analysis and exploit toolkit for GitHub Actions.
KeyValueSoftwareSystems / agent-opfor
Open-source adversary emulation for AI agents and MCP servers.
AISecurityLab / hackagent
HackAgent is an open-source security toolkit to detect vulnerabilities of your AI Agents
0sec-labs / 0
The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
shinthink / blitzstrike
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
Quincunx33 / Ai-jailbreak
A collection of jailbreak prompts and exploit techniques for local and frontier AI models, with modern methods for Qwen3.5, Gemma 4, Llama 4, Kimi K3, GPT-OSS, GPT-5.x, Gemini 3.x and Grok 4.x. For red-teaming and AI safety research only.
S1N6H / pentest-harness
Pentest Harness — Heaven for Hackers. A self-hosted AI agent harness for authorized pentests, bug bounty, security labs, and CTFs. Bring your own AI model API; sessions stay local.
martian56 / redcell
AI red-team platform. Autonomous LLM agents run a penetration test end to end inside a Kali container and write the report. LangGraph plan/act engine, provider-agnostic models via LiteLLM, PDF/JSON/SARIF output. FastAPI + React.
0rangec3t / Black-cat
Claude Code RedTeam Skill — Hypothesis-Driven Cognitive Architecture。一个假设-证据驱动的红队skill
dodoguardai / dodoguard
DodoGuard: Take AI Agents to Production. Test, validate, and operate AI Agents before and after deployment.for Dify, Coze, FastGPT, n8n, Tencent ADP, ByteDance HiAgent, and more.
ADScanPro / Claude-AD
Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.
rianhanft / Rians_Evil_Portals_For_Marauder
A list of over 400+ fresh, working captive portals specifically designed around the marauder firmware. Files are all in .html format.
devZero-Security / redStackPRO
A canvas for red team infrastructure and cyber ranges. Compose a topology, export runnable Terraform and Ansible, and deploy it yourself. Your cloud credentials never leave your machine.
Arcanum-Sec / wraith
WRAITH — a modern browser-hooking framework (BeEF + blind-XSS successor) for red teams, researchers, and educators. For authorized security testing, research & education only.
whitecircle / rise
RISE: Red-teaming via Iterative Strategy Evolution (NeurIPS 2026)
Whispergate / Labyrinth
Malware as a Service Ludus Range
armourinfosec / Wireless-Security-and-WiFi-Penetration-Testing
Open, hands-on study notes on wireless security & Wi-Fi penetration testing (802.11, WEP/WPA/WPA2/WPA3, aircrack-ng). CC BY 4.0.
ZeroDayEvil / CVE-2026-54121-Certighost
🛡 Official AI Security Tool module for CVE-2026-54121 (Certighost): AD CS certificate abuse deep-dive, defensive audit workflows, and safe in-app console execution for authorized Active Directory security testing.
lordx64 / pentestkit
Autonomous multi-agent pentest framework — plans, exploits, verifies (proof-required), CVSS-scores and writes client-ready reports. 104/104 (100%) on the XBOW validation benchmarks, powered by Kimi K3.
zero-lab-ai / skills
Portable, evidence-bound security skills for authorized defensive assessment, red teaming, penetration testing, detection engineering, and engagement operations.
KorekKayu / IKONA-Security
🛡️ Comprehensive Cybersecurity Arsenal, Bug Bounty Payloads & Security Audit Tools by IKONA ONI
7wp81x / NRSuite-Android
No-root Android + ESP32 Wi-Fi/BLE security testing toolkit. Deauth, captive portal, packet capture, BLE HID, and defense/detection modules, controlled over USB-OTG, no custom kernel or external adapter required.
DeathShotXD / 0xM0nCrush
Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.
eldarshiraliyev / BugScanner
🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports
scottalt / senior-securityengineer-cybersecuritybookmarks
A senior security engineer's actual browser bookmarks. 40+ curated cybersecurity resources for recon, OSINT, exploitation, privilege escalation, and malware analysis.
ZeroDayEvil / CVE-2026-75604-PoC
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
portbuster1337 / Atlas
Cross-platform network execution toolkit (SMB/Kerberos/WMI/LDAP/DCSync) built on TrustedSec's Titanis - NetExec-style workflow in C#
laoshu666 / hermes-seagull
🦅 Seagull Profile - Unrestricted CTF/Red-team AI personality for Hermes Agent | 海鸥破甲人格
buryusu / All-AI-Jailbreaks
Curated archive of jailbreak and prompt-injection experiments for AI model robustness research, red-teaming, and defensive evaluation.
g0h4n / PassTheCert-rs
Tool to authenticate to an LDAP/S server with a certificate through Schannel written in Rust. 🦀
ZeroDayEvil / CVE-2026-20817
🛡️ Official AI Security Tool module for CVE-2026-20817 (Windows Error Reporting WER ALPC Local Privilege Escalation PoC).
warpedatom / NoiseHound
Detection-aware BloodHound attack-path scoring - the quietest route to your objective, calibrated across five detection tiers (audit/EDR/Elastic/MDI/WDAC) plus Azure.
SyntaxMethod / CVE-2026-41089-Netlogon-RCE-PoC
CVE-2026-41089 Netlogon RCE PoC — security research, vulnerability validation & defensive testing.
VoidSecSoftwares / voidsyscall
Cross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
LambdaTest / rook
rook by TestMu AI: Agent Assurance from the terminal. Test how your AI agents actually behave across workflows, tools, and actions, and catch failures and vulnerabilities before they ship.
shaheeryasirofficial / SmuggleMyPayload
SmuggleMyPayload generates HTML pages that embed and reconstruct files client-side using JavaScript. The toolkit offers multiple HTML Smuggling techniques, payload encoding options, JavaScript variations, and pre-built HTML templates.
pale-knight / redteam-skill
Redteam / Pentest Skill Pack — semi-automated workflow + on-demand module selection + real-world attack chains | Kali + Claude Code 红队/渗透/技能包 - 半自动工作流 + 按需点选模块 + 实战利用链 | 基于 Kali 与 Claude Code
Blackfrost-AI / Cyber-Frost-Harness
Native red, blue, and purple security-agent harness for CYBER-FROST
pho5nix / Red-Team-GOAD-Lab-Proxmox
Build guide for Red Teaming home lab. GOAD lab setup in Proxmox and pfSense, Operator/C2 and Redirectors.
e2sy / jailbreak-archives
A structured, versioned archive of adversarial prompt engineering techniques against Large Language Models — for AI safety research, red-teaming, and defensive hardening.
dinosn / security-research-orchestrator-prompt
High-assurance, artifact-agnostic prompt for authorized security labs, exploit-chain research, PoC validation, and evidence-led reporting.
xiabai2008 / ruoyi-scan
RuoYi (若依) dedicated vulnerability scanner: plugin architecture, three-state verdict, WAF bypass, exploit chains, AI POC generation, nuclei compatible. 若依专项漏洞扫描器
hackwither / reap
reconnaissance for agent attack surfaces
shaheeryasirofficial / project-scorpio
A Windows process injection loader combining PPID spoofing, manual DLL mapping, module stomping, and direct NT syscall
Justinuse1 / pojia-breaker
Chinese-first LLM jailbreak benchmark & red-team toolkit | 中文LLM安全评测框架 | by POJIA.AI
armourinfosec / Offensive-File-Transfer-Techniques
Offensive File Transfer Techniques — hands-on study notes on moving files to and from a target during an engagement across every channel: HTTP/SMB/FTP/TFTP/WebDAV, netcat/socat, scp/rsync, LOLBAS/GTFOBins, base64 no-egress, Meterpreter, plus detection. CC BY 4.0.
MingyiSecLab / Atlas
Open-source local AI Agent desktop app for authorized security assessment — Electron + Mastra-powered runtime, visual pentest workflow, Kali sandbox, multi-provider LLM routing. 本地 AI 安全评估智能体桌面应用
armourinfosec / Offensive-Windows-Privilege-Escalation
Offensive Windows Privilege Escalation — hands-on study notes: enumeration & methodology, service/scheduled-task misconfigs, UAC bypass, token-privilege abuse, the potato family, kernel exploits, and credential mining. Each technique with detection & defenses. CC BY 4.0.
SagarBiswas-MultiHAT / The-BlackHAT-roadmap
The complete hacking & penetration testing roadmap. From beginner to elite. 44,982 lines, 150+ Diagram across the roadmap: OPSEC, web security, Active Directory, binary exploitation, EDR evasion, and 0-day research. 300+ tools, 200+ MITRE techniques, C & Rust payloads, lab guides, books, courses, blogs, practice platforms, and AI security resources
g13net / lockjaw
Rust based C2 Framework
weidutech / pi-recon
Lightweight AI red teaming harness for authorized agent / GenAI challenges (BCTF Agent Plus–style): schedule, bounded recon, validate, digest.