zhaoxuya520 / reverse-skill

A routing pack that tells AI coding agents which reverse-engineering or pentest methodology and tools to use for APKs, binaries, JS crypto, PCAPs, and CTFs.

usestrix / strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

trhhubsd / ARTEX

ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军

opentrap / opentrap

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

Armur-Ai / Pentest-Swarm-AI

Autonomous API and web-app penetration testing tool that runs a swarm of AI agents to chain exploits and prove vulnerabilities.

sherlock-project / sherlock

Hunt down social media accounts by username across social networks

CarterPerez-dev / Cybersecurity-Projects

Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning 👇

promptfoo / promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

ZeroDayEvil / ai-security-tool

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.

KeygraphHQ / shannon

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

AIPentest / CyberStrikeAI

The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.

ZeroDayEvil / CVE-2026-75604-PoC

🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.

soxoj / maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

OWASP / wstg

A community-written guide covering methods and test cases for security testing web applications and web services.

BitterSecurity / Decepticon

Autonomous Hacking Agent for Red Team

kernelstub / Pwnbox

Privacy focused NixOS pentesting environment with a customizable desktop and security tools.

antoniaci / blackbird

An OSINT tool to search for accounts by username and email in social networks.

six2dez / reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

elementalsouls / Claude-BugHunter

A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.

sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool

juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

JesseCHale / HaleHound-CYD

ESP32-DIV HaleHound Edition for Cheap Yellow Display - Multi-protocol offensive security toolkit

irraz / vulnerator-ai

Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.

HackTricks-wiki / hacktricks

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

nicocha30 / ligolo-ng

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

JoasASantos / NeuroSploit

NeuroSploit is an advanced, AI-powered penetration testing framework designed to automate and augment various aspects of offensive security operations.

kaifcodec / user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

CyberStrikeus / CyberStrike

Open-source AI-powered offensive security harness for automated penetration testing.

0xMarcio / pocindex

Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.

itsreyi / BlockSuite

Minecraft server security assessment toolkit. Intercept, analyze, and test from a single desktop app.

ASCIT31 / Dark-Moon

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

kutukam / autonomous-pentest-agent

Autonomous Pentest Agent — LLM multi-agent autonomous penetration testing system (Go backend + Next.js UI). AGPL-3.0.

maurosoria / dirsearch

Web path scanner

moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

projectdiscovery / httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

v1s1t0r1sh3r3 / airgeddon

This is a multi-use bash script for Linux systems to audit wireless networks.

yaklang / yakit

Cyber Security ALL-IN-ONE Platform

AzeemIdrisi / PhoneSploit-Pro

An all-in-one hacking tool to remotely take over Android devices.

androguard / androguard

Reverse engineering and pentesting for Android applications

projectdiscovery / naabu

A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests

samugit83 / redamon

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

ThePorgs / Exegol

Fully featured and community-driven hacking environment

Jieyab89 / OSINT-Cheat-sheet

OSINT cheat sheet, list OSINT tools, wiki, dataset, article, book , red team OSINT for hackers and OSINT tips and OSINT branch. This repository will grow every time will research, there is a research, science and technology, tutorial. Please use it wisely.

scadastrangelove / awesome-ai-security-tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

s0ld13rr / pentestcode

PentestCode - Multi-agent AI penetration testing system with persistent engagement state, strategic coordination, and parallel autonomous operations.

Mr-Destroyer / ZimZilla

THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING

fb0sh / dsh-pentester

基于 DeepSeek Harness 的多 Agent PTES 渗透测试编排插件，支持自动化侦察、漏洞分析、验证与报告，使用 Docker/Kali 隔离工具箱 | Multi-agent PTES penetration testing plugin for DeepSeek Harness with automated recon, vulnerability analysis, validation, reporting, and Docker/Kali toolbox

bee-san / Ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

bee-san / RustScan

🤖 The Modern Port Scanner 🤖

OWASP / mastg

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

blacklanternsecurity / bbot

The recursive internet scanner for hackers. 🧡

We5ter / Scanners-Box

The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵

Orange-Cyberdefense / GOAD

game of active directory

trickest / cve

Gather and update all available and newest CVEs with their PoC.

OWASP / Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Hackplayers / evil-winrm

The ultimate WinRM shell for hacking/pentesting

Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

Astrosp / Awesome-OSINT-List

📡 Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.

jonaslejon / malicious-pdf

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

e-m-b-a / emba

EMBA - The firmware security analyzer