Autumn-27 / ScopeSentry

Distributed security asset discovery platform covering subdomain enumeration, port scanning, vulnerability scanning, and page monitoring.

projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

edoardottt / awesome-hacker-search-engines

A curated Markdown list of search engines for security work, covering servers, vulnerabilities, exploits, leaks, and threat intelligence.

OWASP / wstg

A community-written guide covering methods and test cases for security testing web applications and web services.

six2dez / reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

elementalsouls / Claude-BugHunter

A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.

vavkamil / awesome-bugbounty-tools

A curated list of various bug bounty tools

maurosoria / dirsearch

Web path scanner

projectdiscovery / httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

Kritt-ai / open-kritt

Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.

Mr-Destroyer / ZimZilla

THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING

projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

blacklanternsecurity / bbot

The recursive internet scanner for hackers. 🧡

reddelexc / hackerone-reports

Top disclosed reports from HackerOne

jonaslejon / malicious-pdf

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

six2dez / burp-ai-agent

Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more

lord-alfred / ipranges

🔨 List all IP ranges from: Google (Cloud & GoogleBot), Bing (Bingbot), Amazon (AWS), Microsoft, Oracle (Cloud), GitHub, Facebook (Meta), OpenAI (GPTBot) and other with daily updates.

projectdiscovery / urlfinder

A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.

yogeshojha / rengine

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

ihebski / DefaultCreds-cheat-sheet

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

j3ssie / osmedeus

A Modern Orchestration Engine for Security

commixproject / commix

Automated Αll-in-One OS command injection exploitation tool.

hahwul / dalfox

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

projectdiscovery / interactsh

An OOB interaction gathering server and client library

edoardottt / cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

Findomain / Findomain

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.

codingo / NoSQLMap

Automated NoSQL database enumeration and web application exploitation tool.

gwen001 / pentest-tools

A collection of custom security tools for quick needs.

six2dez / OneListForAll

Rockyou for web fuzzing

projectdiscovery / uncover

Quickly discover exposed hosts on the internet using multiple search engines.

Impact-I / reFlutter

Flutter Reverse Engineering Framework

haccer / subjack

DNS Takeover tool written in Go

wallarm / gotestwaf

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

doyensec / inql

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

trickest / wordlists

Real-world infosec wordlists, updated regularly

vavkamil / awesome-vulnerable-apps

Awesome Vulnerable Applications

Proviesec / google-dorks

Useful Google Dorks for WebSecurity and Bug Bounty

topscoder / nuclei-wordfence-cve

80k+ WordPress Nuclei templates, updated daily from Wordfence intel—filter by severity/tags/CVE and scan in one line. 🚀🔒

edoardottt / scilla

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

hahwul / jwt-hack

JSON Web Token Hack Toolkit

pikpikcu / airecon

AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is designed to automate security assessments, penetration testing, and bug bounty reconnaissance — without any API keys or cloud dependency.

Zarcolio / sitedorks

Search Google/Bing/Ecosia/DuckDuckGo/Yandex/Yahoo for a search term (dork) with a default set of websites, bug bounty programs or custom collection.

0xPugal / fuzz4bounty

1337 Wordlists for Bug Bounty Hunting

intigriti / misconfig-mapper

Misconfig Mapper is a fast tool to help you uncover security misconfigurations on popular third-party services used by your company and/or bug bounty targets!

saeidshirazi / Awesome-Smart-Contract-Security

A curated list of Smart Contract Security materials and resources For Researchers

fyoorer / ShadowClone

Unleash the power of cloud

RevoltSecurities / Subdominator

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

halilkirazkaya / arsenal-ng

The classic launcher, evolved. Fast, Go-based command library equipped with 200+ cybersecurity cheat-sheets. Just install and start hacking.

GhostTroops / TOP

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

Ishanoshada / GDorks

Google Dork List - Uncover the Hidden Gems of the Internet ( There are at least 320+ categories ) + Web App

MindPatch / scant3r

ScanT3r - Module based Bug Bounty Automation Tool ( use Lotus instead github.com/bugBlocker/lotus )

eslam3kl / SQLiDetector

Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases.

vflame6 / leaker

Passive leak enumeration tool.

AdnaneKhan / gato-x

GitHub Attack Toolkit - Extreme Edition - A static analysis and exploit toolkit for GitHub Actions.

kac89 / vulnrepo

VULNRΞPO - Free vulnerability report generator and repository, end-to-end encrypted! Templates of issues, CWE,CVE,MITRE ATT&CK,PCI DSS, import Nmap/Nessus/Burp/OpenVAS/Bugcrowd/Trivy, Jira export, TXT/JSON/MARKDOWN/HTML/DOCX, attachments, automatic changelog, stats, vulnerability management, bugbounty, local ai/llm, super fast pentest reporting!

anmolksachan / TheTimeMachine

Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not

edoardottt / csprecon

Discover new target domains using Content Security Policy

akha-security / akca

AKCA Advanced Web Security Scanner

hackwither / reap

reconnaissance for agent attack surfaces

sanjarbiy / bugbountyrules

Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, coverage, no false positives, never quits early.