opentrap / opentrap
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
opentrap / opentrap
mdpsec / bug-bounty-hunting-prompts
Reusable prompts for a structured, evidence-first bug bounty hunting workflow
chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
OWASP / wstg
A community-written guide covering methods and test cases for security testing web applications and web services.
openai / codex-security
OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security
google / mantis
A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.
elementalsouls / Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
juice-shop / juice-shop
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
ComplianceAsCode / content
Security automation content in SCAP, Bash, Ansible, and other formats
Safe3 / uusec-waf
Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.
Commando-X / vuln-bank
A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn pentesting and secure coding practices.
zinja-coder / jadx-mcp-server
MCP server for JADX-AI Plugin
jassics / cybersecurity-roadmap
Skills and career roadmap for various security roles like application security, cloud security, DevSecOps, security engineer, security researchers, pentesting, api security, network security, mobile security and so on with helpful resources, guidelines
crissyfield / super-trouper
MCP server for Frida.
OWASP / CheatSheetSeries
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
jassics / security-study-plan
Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...
codingo / NoSQLMap
Automated NoSQL database enumeration and web application exploitation tool.
owtf / owtf
Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp
wallarm / gotestwaf
An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses
mrwadams / stride-gpt
An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.
MattKeeley / Spoofy
Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.
ZishanAdThandar / pentest
Pentesting and Bug Bounty Notes, Cheetsheets and Guide for Ethical Hacker, Whitehat Pentesters and CTF Players.
arcjet / arcjet-js
Runtime security for AI apps and agents: prompt injection detection, tool-call authorization, sensitive-data redaction, bot protection, and rate limiting. Drop it into your JS/TS code.
DoS0x99 / cyber-security-books
A collection of FREE cyber security books
factionsecurity / faction
Pen Test Report Generation and Assessment Collaboration
0sec-labs / 0
The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
stijnswapped / Myrqen
Security testing that runs inside the coding agent you already use. Source-available, not open source.
armourinfosec / Secure-PHP-Development
Secure PHP Development — lab-driven study notes: modern PHP 8.2/8.3 through a full OWASP-mapped catalogue of PHP vulnerabilities with exploit-then-fix labs. CC BY 4.0.
DeathShotXD / Comment2Shell
Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker
AngusKit / AngusSecurity
Application security and governance platform — one check covers code flaws, leaked secrets, and dependency/image vulnerabilities, with merge/release gates. Self-hostable.
dinosn / security-research-orchestrator-prompt
High-assurance, artifact-agnostic prompt for authorized security labs, exploit-chain research, PoC validation, and evidence-led reporting.
dmdhrumilmistry / security-harness
A multi-agent application-security review harness for Claude Code (and, later, other AI agents). One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies real impact, and reports to README/JSON/SARIF/doc/PDF.
armourinfosec / Offensive-Web-Application-Security
A lab-driven course on breaking web applications and explaining how to fix them — 491 notes, 36 reproducible labs, mapped to OWASP WSTG and the PortSwigger Top 10 Web Hacking Techniques.