ZigZagBoi1 / PS5-14.10-Research
Open PS5 firmware 14.10 research: Lua userland experiments, syscall and attack-surface analysis. Kernel read/write and a complete exploit are not demonstrated.
ZigZagBoi1 / PS5-14.10-Research
projectdiscovery / nuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
j3ssie / osmedeus
A Modern Orchestration Engine for Security
cloudquery / cloudquery
Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.
ivre / ivre
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
samugit83 / redamon
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.
projectdiscovery / uncover
Quickly discover exposed hosts on the internet using multiple search engines.
microsoft / AttackSurfaceAnalyzer
Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.
owasp-noir / noir
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
stanislav-web / OpenDoor
OWASP Web Recon & Directory Discovery Platform
yyhuni / xingrin
Open-source attack surface management and authorized security automation platform for asset discovery, service probing, scan orchestration, and security result management.
pablosnt / rekono
Offensive security platform that automates attack surface discovery and vulnerability management
vmfunc / sif
the blazing-fast pentesting suite.
cc1a2b / JShunter
jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for and bug bounty hunters and security researchers.
Jueze-2019 / dsh-redteam-mode
DSH RedTeam 模式：把 DeepSeek Harness 变成红队作战指挥台——一个靶标名称拉起信息收集/漏洞检测/漏洞利用/内网渗透四个角色，资产与战果实时落入本地 SQLite 事实库（仅供已授权测试）
eldarshiraliyev / BugScanner
🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports
LINGYK352 / Watchtower
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
yingfff123 / AtlasX
企业暴露面收集与持续监控（ASM）自托管系统：多源采集、存活与指纹富化、风险线索与变更对照。支持 Linux/Docker 一键部署。
MorDavid / NucleiSniper
AI-powered Nuclei template prioritization using deep target fingerprinting and TypeSafe Jev to surface relevant security findings faster.
dotdna-io / assetatlas
Open-source asset inventory — turn scattered, contradictory tool data into one reliable inventory, then chat with it using the LLM of your choice. Tagging, posture rules, and alerting built in.
OWASP / OWASP-Subtractive-Hardening-Top-10
The OWASP Subtractive Security Top 10 Project is an initiative to identify, document, and promote the highest-impact opportunities for reducing cyber risk through the elimination of attack paths.