HyperDbg / HyperDbg
State-of-the-art native debugging tools
HyperDbg / HyperDbg
jekil / awesome-hacking
Awesome hacking is an awesome collection of hacking tools.
edoardottt / cariddi
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
Netw0rkNoob / VulnClaw
基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。
e-m-b-a / emba
EMBA - The firmware security analyzer
onecli / onecli
Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.
kelvinBen / AppInfoScanner
一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。
BlackArch / blackarch
An ArchLinux based distribution for penetration testers and security researchers.
vulnersCom / nmap-vulners
Nmap NSE scripts that turn a service scan into CVEs, CVSS scores and known exploits — fingerprints software from HTTP responses and checks every detected CPE against the Vulners database.
codingo / NoSQLMap
Automated NoSQL database enumeration and web application exploitation tool.
gwen001 / pentest-tools
A collection of custom security tools for quick needs.
chipsec / chipsec
Platform Security Assessment Framework
pglombardo / PasswordPusher
🔐 Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audit logs.
CyberStrikeus / CyberStrike
Open-source AI-powered offensive security harness for automated penetration testing.
olafhartong / sysmon-modular
A repository of sysmon configuration modules
ContainerSSH / ContainerSSH
ContainerSSH: Launch containers on demand
google / osv.dev
Open source vulnerability DB and triage service.
microsoft / AttackSurfaceAnalyzer
Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.
opencve / opencve
Vulnerability Intelligence Platform
ComplianceAsCode / content
Security automation content in SCAP, Bash, Ansible, and other formats
Bearer / bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
rubysec / bundler-audit
Patch-level verification for Bundler
Checkmarx / kics
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
honmashironeko / ProxyCat
一款部署于云端或本地的隧道代理池中间件，可将静态代理IP灵活运用成隧道IP，提供固定请求地址，一次部署终身使用
rabbitstack / fibratus
Security sensor for realtime threat detection and protection
google / mantis
A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.
0xSteph / pentest-ai-agents
Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.
Zouuup / landrun
Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.
Kritt-ai / open-kritt
Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.
betterleaks / betterleaks
Find leaked secrets everywhere.
gabrie30 / ghorg
Quickly clone or backup massive amounts of org/users repositories into one directory - Supports GitHub, GitLab, Bitbucket, and more 🐇🥚
phishdestroy / destroylist
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats
Asymptote-Labs / agent-beacon
The cross-harness, self-improving memory layer for AI agents. Join our community: https://discord.com/invite/zdNChS2fBu
RogueMaster / awesome-flipperzero-withModules
A collection of awesome resources & modules for the Flipper Zero device. Best used with Rogue Master Flipper Zero Custom Firmware.
Ragnt / AngryOxide
802.11 Attack Tool
aquasecurity / trivy-operator
Kubernetes-native security toolkit
konstruktoid / hardening
Hardening Ubuntu. Systemd edition.
vulnersCom / getsploit
Search and download public exploits from the Vulners database — online, or fully offline from a local SQLite FTS5 index.
JesseCHale / HaleHound-CYD
ESP32-DIV HaleHound Edition for Cheap Yellow Display - Multi-protocol offensive security toolkit
jiwoochris / artex-global
ARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)
wallarm / gotestwaf
An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses
doyensec / inql
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
lirantal / npq
safely install npm packages by auditing them pre-install stage
ossf / cve-bin-tool
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
GreenmaskIO / greenmask
Database anonymization and test data management
project-copacetic / copacetic
🧵 CLI tool for directly patching container images!
wireghoul / graudit
grep rough audit - source code auditing tool
scito / extract_otp_secrets
Extract one time password (OTP) secrets from QR codes exported by two-factor authentication (2FA) apps such as "Google Authenticator". The exported QR codes from authentication apps can be captured by camera, read from images, or read from text files. The secrets can be exported to JSON or CSV, or printed as QR codes to console.
scadastrangelove / awesome-ai-security-tools
A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.
KatrielMoses / MailAccess
Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
attify / firmware-analysis-toolkit
Firmware security research platform combining binary analysis, taint tracing, and emulation across IoT, edge AI, mobile devices, and robotics.
NHAS / reverse_ssh
SSH based reverse shell
ssh-mitm / ssh-mitm
SSH-MITM - ssh audits made simple
0xMarcio / pocindex
Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
trhhubsd / ARTEX
ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军
ChiChou / grapefruit
Open-source mobile security testing suite for iOS and Android. Previously Passionfruit
silverhack / monkey365
Monkey365 is an open-source security assessment tool for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals identify misconfigurations, review cloud security posture, and evaluate environments against industry security best practices and compliance standards.
freelabz / secator
secator - the pentester's swiss knife
2akouwu / reverify
Stop your AI from making things up — it proposes, deterministic tools decide, every claim checked against ground truth with evidence. Grounded facts and context survive resets. Reverse engineering is the proving ground. MCP server + CLI.
owasp-dep-scan / dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.