All repos — GH Trending Explorer

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

OSINT & recon toolkit // 100+ tools, one-command installer, SOCMINT, GEOINT, network recon, dark web, forensics & more.

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — supports bug bounty, continuous monitoring, and CTF modes. Built with Go and 7+ native security tools.

opentrap / opentrap

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

OWASP / wstg

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

FlowPackerPulse / meanp-rpocket-remap

Modern C++23 Runtime Patching Framework for 2026 Windows Memory Analysis

kamalx06 / TornadoC2

Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.

usestrix / strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

KeygraphHQ / shannon

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

The-Art-of-Hacking / h4cker

This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org

Datalux / Osintgram

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

maurosoria / dirsearch

Web path scanner

We5ter / Scanners-Box

The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵

yogeshojha / rengine

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

six2dez / reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

trickest / cve

Gather and update all available and newest CVEs with their PoC.

AIPentest / CyberStrikeAI

The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.

Mr-xn / Penetration_Testing_POC

渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

infobyte / faraday

Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.

j3ssie / osmedeus

A Modern Orchestration Engine for Security

AzeemIdrisi / PhoneSploit-Pro

An all-in-one hacking tool to remotely take over Android devices.

BitterSecurity / Decepticon

Autonomous Hacking Agent for Red Team

OWASP / Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

awarexone / Agentic-Bug-Hunter

AI-powered bug bounty hunting toolkit that works with or without subscription.

Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

jonaslejon / malicious-pdf

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

zan8in / afrog

A Security Tool for Bug Bounty, Pentest and Red Teaming.

0xsyr0 / Awesome-Cybersecurity-Handbooks

A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.

jekil / awesome-hacking

Awesome hacking is an awesome collection of hacking tools.

edoardottt / cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

Netw0rkNoob / VulnClaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排，配合大语言模型，自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

e-m-b-a / emba

EMBA - The firmware security analyzer

kelvinBen / AppInfoScanner

一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。

codingo / NoSQLMap

Automated NoSQL database enumeration and web application exploitation tool.

CyberStrikeus / CyberStrike

Open-source AI-powered offensive security harness for automated penetration testing.

GH05TCREW / pentestagent

PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.

samugit83 / redamon

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

ThePorgs / Exegol

Fully featured and community-driven hacking environment

jayofelony / pwnagotchi

(⌐■_■) - Raspberry Pi instrumenting Bettercap for Wi-Fi pwning.

pwndoc / pwndoc

Pentest Report Generator

Hacking-the-Cloud / hackingthe.cloud

An encyclopedia for offensive and defensive security knowledge in cloud native technologies.

Syslifters / sysreptor

A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.

x90skysn3k / brutespray

Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.

ZerBea / hcxtools

A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.

OWASP / masvs

The OWASP MASVS (Mobile Application Security Verification Standard) is the industry standard for mobile app security.

Ch0pin / medusa

Mobile Edge-Dynamic Unified Security Analysis

0xSteph / pentest-ai-agents

Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.

lefayjey / linWinPwn

linWinPwn is a bash script that streamlines the use of a number of Active Directory tools

ZerBea / hcxdumptool

Small tool to capture packets from wlan devices.

m14r41 / PentestingEverything

initstring / cloud_enum

Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

yogsec / Hacking-Tools

A curated list of penetration testing and ethical hacking tools, organized by category. This compilation includes tools from Kali Linux and other notable sources.

Ragnt / AngryOxide

802.11 Attack Tool

MichaelGrafnetter / DSInternals

Directory Services Internals (DSInternals) PowerShell Module and Framework

GhostManager / Ghostwriter

The SpecterOps project management and reporting engine

fsociety-team / fsociety

A Modular Penetration Testing Framework

jiwoochris / artex-global

ARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)

doyensec / inql

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

trickest / wordlists

Real-world infosec wordlists, updated regularly

wgpsec / AboutSecurity

Everything for pentest. | 渗透测试知识库，以 AI Agent 可执行的格式沉淀安全方法论。