vxcontrol / pentagi
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
vxcontrol / pentagi
gitleaks / gitleaks
Find secrets with Gitleaks ๐
rawfilejson / awesome-osint-arsenal
OSINT & recon toolkit // 100+ tools, one-command installer, SOCMINT, GEOINT, network recon, dark web, forensics & more.
x64dbg / x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
opentrap / opentrap
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
Autumn-27 / ScopeSentry
ScopeSentry-Cyberspace mapping, subdomain enumeration, port scanning, sensitive information discovery, vulnerability scanning, distributed nodes
Fazmin / cve-intel
Local security intelligence for CVE triage - 31 data sources and 32 tools, risk scores and an MCP server for AI agents, all in native Rust. Private by default.
edoardottt / awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
JoasASantos / Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
CyberDefenderAI / AI-Security-Tools-Applied-Scenarios
A highly actionable, curated list of open-source tools and practical use cases leveraging AI, ML, and LLMs to solve complex information security challenges. This module bridges the gap between theoretical AI capabilities and daily security operations.
kamalx06 / TornadoC2
Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.
usestrix / strix
Open-source AI penetration testing tool to find and fix your appโs vulnerabilities.
KeygraphHQ / shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
aquasecurity / trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
lissy93 / web-check
๐ต๏ธโโ๏ธ All-in-one OSINT tool for analysing any website
Infisical / infisical
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
trufflesecurity / trufflehog
Find, verify, and analyze leaked credentials
lissy93 / personal-security-checklist
๐ A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
NVIDIA / SkillSpector
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
bee-san / RustScan
๐ค The Modern Port Scanner ๐ค
motdotla / dotenv
Loads environment variables from .env for nodejs projects.
fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
prowler-cloud / prowler
Prowler is the worldโs most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
shadow1ng / fscan
ไธๆฌพๅ ็ฝ็ปผๅๆซๆๅทฅๅ ท๏ผๆนไพฟไธ้ฎ่ชๅจๅใๅ จๆนไฝๆผๆซๆซๆใ(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
secdev / scapy
Scapy: the Python-based interactive packet manipulation program & library.
future-architect / vuls
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
jason5ng32 / MyIP
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
BishopFox / sliver
Adversary Emulation Framework
google / osv-scanner
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
toniblyx / my-arsenal-of-aws-security-tools
List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
We5ter / Scanners-Box
The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agentsโโ้ขๅๆๅฎขใไผไธไธ AI ๆบ่ฝไฝ็ๅ จๅๅผๆบ็ฝ็ปๅฎๅ จๅทฅๅ ท็ฉ้ต
securego / gosec
Go security checker
smallstep / certificates
๐ก๏ธ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
yogeshojha / rengine
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
CarterPerez-dev / Cybersecurity-Projects
Building 70 Projects ranging from beginner to advanced so anyone can โ learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning ๐
PyCQA / bandit
Bandit is a tool designed to find common security issues in Python code.
six2dez / reconftw
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
trickest / cve
Gather and update all available and newest CVEs with their PoC.
presidentbeef / brakeman
A static analysis security vulnerability scanner for Ruby on Rails applications
authzed / spicedb
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
Tencent / AI-Infra-Guard
A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.
zizmorcore / zizmor
Static analysis for GitHub Actions (and more)
The-Z-Labs / linux-exploit-suggester
Linux privilege escalation auditing tool
j3ssie / osmedeus
A Modern Orchestration Engine for Security
decalage2 / awesome-security-hardening
A collection of awesome security hardening guides, tools and other resources
google / syzkaller
syzkaller is an unsupervised coverage-guided kernel fuzzer
vavkamil / awesome-bugbounty-tools
A curated list of various bug bounty tools
hak5 / usbrubberducky-payloads
The Official USB Rubber Ducky Payload Repository
Pennyw0rth / NetExec
The Network Execution Tool
dotenvx / dotenvx
a secure dotenvโfrom the creator of `dotenv`
OWASP / Nettacker
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
kaifcodec / user-scanner
๐ต๏ธโโ๏ธ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
elementalsouls / Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
DedSecInside / TorBot
Dark Web OSINT Tool
Security-Onion-Solutions / securityonion
Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
Astrosp / Awesome-OSINT-List
๐ก Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.
smallstep / cli
๐งฐ A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc.