opentrap / opentrap
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
opentrap / opentrap
OWASP / wstg
The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
kernelstub / Pwnbox
Privacy focused NixOS pentesting environment with a customizable desktop and security tools.
irraz / vulnerator-ai
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
sherlock-project / sherlock
Hunt down social media accounts by username across social networks
usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
KeygraphHQ / shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
soxoj / maigret
🕵️♂️ Collect a dossier on a person by username from 6K websites
sqlmapproject / sqlmap
Automatic SQL injection and database takeover tool
promptfoo / promptfoo
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
bee-san / Ciphey
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
bee-san / RustScan
🤖 The Modern Port Scanner 🤖
ffuf / ffuf
Fast web fuzzer written in Go
maurosoria / dirsearch
Web path scanner
OJ / gobuster
Directory/File, DNS and VHost busting tool written in Go
juice-shop / juice-shop
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
OWASP / mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
HackTricks-wiki / hacktricks
Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.
blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
antoniaci / blackbird
An OSINT tool to search for accounts by username and email in social networks.
We5ter / Scanners-Box
The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵
yogeshojha / rengine
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
CarterPerez-dev / Cybersecurity-Projects
Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning 👇
six2dez / reconftw
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
trickest / cve
Gather and update all available and newest CVEs with their PoC.
epi052 / feroxbuster
A fast, simple, recursive content discovery tool written in Rust.
v1s1t0r1sh3r3 / airgeddon
This is a multi-use bash script for Linux systems to audit wireless networks.
AIPentest / CyberStrikeAI
The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.
infobyte / faraday
Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
ihebski / DefaultCreds-cheat-sheet
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️
j3ssie / osmedeus
A Modern Orchestration Engine for Security
AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.
BitterSecurity / Decepticon
Autonomous Hacking Agent for Red Team
androguard / androguard
Reverse engineering and pentesting for Android applications
hak5 / usbrubberducky-payloads
The Official USB Rubber Ducky Payload Repository
Pennyw0rth / NetExec
The Network Execution Tool
commixproject / commix
Automated Αll-in-One OS command injection exploitation tool.
OWASP / Nettacker
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
Hackplayers / evil-winrm
The ultimate WinRM shell for hacking/pentesting
kaifcodec / user-scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
elementalsouls / Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
nicocha30 / ligolo-ng
An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.
jassics / security-study-plan
Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...
jonaslejon / malicious-pdf
💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh
0xsyr0 / Awesome-Cybersecurity-Handbooks
A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.
itm4n / PrivescCheck
Privilege Escalation Enumeration Script for Windows
Mr-xn / BurpSuite-collections
有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection of burpsuite plugins (non-stores), articles and tips for using Burpsuite, no crack version file
leebaird / discover
Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Ubuntu. Limited support for Kali Linux.
ibnaleem / gosearch
🔍 Search anyone's digital footprint across 300+ websites
edoardottt / cariddi
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
e-m-b-a / emba
EMBA - The firmware security analyzer
V33RU / awesome-connected-things-sec
A Curated list of Security Resources for all connected things
BlackArch / blackarch
An ArchLinux based distribution for penetration testers and security researchers.
vulnersCom / nmap-vulners
Nmap NSE scripts that turn a service scan into CVEs, CVSS scores and known exploits — fingerprints software from HTTP responses and checks every detected CPE against the Vulners database.
gwen001 / pentest-tools
A collection of custom security tools for quick needs.
six2dez / OneListForAll
Rockyou for web fuzzing
CyberStrikeus / CyberStrike
Open-source AI-powered offensive security harness for automated penetration testing.
GH05TCREW / pentestagent
PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.
samugit83 / redamon
Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.