beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
interplains / zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
hagezi / dns-blocklists
DNS-Blocklists: For a better internet - keep the internet clean!
blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
marc-shade / world-intel-mcp
160-tool MCP server for real-time global intelligence from free public APIs: markets, liquidity, prediction markets, SEC filings, conflict, military, aircraft-cohort early warning, migration and border flows, cyber, climate, news and more. Dated observation history, 29 research prompts, cited briefs, geofences, SSE dashboard. MIT, no paid API keys.
crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
KatrielMoses / voidaccess
Self-hosted dark web OSINT platform. Automated threat intelligence from query to graph in 13 steps. Free alternative to Recorded Future, DarkOwl, and Flare.
edoardottt / awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
kaifcodec / user-scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
OpenCTI-Platform / opencti
Open Cyber Threat Intelligence Platform
Astrosp / Awesome-OSINT-List
📡 Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.
KatrielMoses / MailAccess
Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
0xMarcio / pocindex
Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
OpenOSINT / OpenOSINT
Open-source engine for passive OSINT checks: 21 tools as CLI, MCP server and web UI. Hosted Monitor & Diligence at app.openosint.tech.
threathunterX / underground-slang-lexicon
A continuously updated lexicon of underground slang in the online fraud and gray-market economy: definitions, supply-chain roles, sanitized real-world usage and false-positive warnings. Chinese-dominant, with Brazilian Portuguese, English, Indonesian, Tagalog and Vietnamese entries. Maintained by the Threat Hunter research team.
fastfire / deepdarkCTI
Collection of Cyber Threat Intelligence sources from the deep and dark web
MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
phishdestroy / destroylist
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats
mukul975 / cve-mcp-server
Production-grade MCP server giving Claude 27 security intelligence tools across 21 APIs — CVE lookup, EPSS scoring, CISA KEV, MITRE ATT&CK, Shodan, VirusTotal, and more.
mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
osintbrazuca / osint-brazuca
Repositório criado com intuito de reunir informações, fontes(websites/portais) e tricks de OSINT dentro do contexto Brasil.
frangelbarrera / OSINT-BIBLE
Comprehensive 2026 OSINT field guide: tools, AI intelligence, investigation workflows, threat intel, verification, GEOINT, OPSEC and ethics.
yogsec / Hacking-Tools
A curated list of 900+ penetration testing and ethical hacking tools.
JoasASantos / Malvex
AI-driven malware analysis framework with 30+ integrated tools, web REPL, and MCP server
sroberts / awesome-iocs
Curated sources of indicators of compromise, detection signatures and IOC tools.
mthcht / awesome-lists
Awesome Security lists for SOC/CERT/CTI
Bert-JanP / Open-Source-Threat-Intel-Feeds
This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. Contains multiple types such as IP, URL, CVE and Hash.
RansomLook / RansomLook
Yet another Ransomware gang tracker
NoblerWorks-HQ / IRONSIGHT
Real-time OSINT command center for the Iran/Israel and Russia/Ukraine theaters — 50+ live open-source intelligence sources (news, Telegram, military aircraft & naval tracking, missile alerts, prediction & defense markets) in one dashboard. No API keys. Free. Next.js + TypeScript.
Spacial / awesome-csirt
Awesome CSIRT is an curated list of links and resources in security and CSIRT daily activities.
7onez / cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
UseOSINT / Skills
28 OSINT Agent Skills that turn Cursor, Claude & AI coding agents into a full open-source intelligence platform — reconnaissance, attribution, GEOINT, breach checks & due diligence. Ethical, sourced, passive-first.
kaifcodec / phonsint
🕵️♂️ Advanced phone number OSINT suite engineered for silent reconnaissance. Extracts masked emails, profile avatars and uncovers cross-platform account registrations, and enriches identity footprints with zero SMS alerts.
mitre-attack / attack-navigator
Web app that provides basic navigation and annotation of ATT&CK matrices
TheHive-Project / Cortex
Cortex: a Powerful Observable Analysis and Active Response Engine
thalesgroup-cert / Watcher
Watcher - Open Source AI-powered Cyber Threat Intelligence & Hunting Platform. Developed with Django & React JS.
ninoseki / mihari
A query aggregator for OSINT based threat hunting
center-for-threat-informed-defense / attack-flow
Attack Flow helps executives, SOC managers, and defenders easily understand how attackers compose ATT&CK techniques into attacks by developing a representation of attack flows, modeling attack flows for a small corpus of incidents, and creating visualization tools to display attack flows.
mitre-attack / attack-stix-data
STIX data representing MITRE ATT&CK
stanfrbd / cyberbro
A simple application that extracts your IoCs from garbage input and checks their reputation using multiple CTI services.
FSECDEV / Threat-Intelligence-Hackers-Forums
A directory of hacker forums
intelowlproject / IntelOwl
IntelOwl: manage your Threat Intelligence at scale
Neo23x0 / signature-base
YARA signature and IOC database for my scanners and tools
jacobdjwilson / awesome-annual-security-reports
A curated list of annual cyber security reports
mitre-attack / mitreattack-python
A python module for working with ATT&CK
activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
MISP / misp-galaxy
Clusters and elements to attach to MISP events or attributes (like threat actors)
mitre-attack / attack-website
MITRE ATT&CK Website
OpenCTI-Platform / connectors
OpenCTI Connectors
s4ntrx / Cybersecurity-Threats-Guide
Cybersecurity Threats & Vulnerabilities Guide is a comprehensive educational resource that provides detailed documentation, detection scripts, and prevention strategies for various cybersecurity threats.
mitre / cti
Cyber Threat Intelligence Repository expressed in STIX 2.0
mrwadams / attackgen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
drb-ra / C2IntelFeeds
Automatically created C2 Feeds
darama22 / Malware-Research-Hub
Self-contained malware research hub: curated catalog of 80 families (1971-2024) + 2,764 real encrypted samples, indexed and searchable. Local Flask app, bilingual.
MISP / misp-warninglists
Warning lists to inform users of MISP about potential false-positives or other information in indicators
PaloAltoNetworks / Unit42-timely-threat-intel
A collection of files with indicators supporting social media posts from Palo Alto Network's Unit 42 team to disseminate timely threat intelligence.
duggytuxy / Data-Shield_IPv4_Blocklist
Data-Shield provides maintained IPv4 blocklists for inbound filtering on firewalls, gateways and web application firewalls.
google / mcp-security
—
Tcotl / AgentCapture
新一代反制型蜜罐平台：通过反向代理在真实业务系统中无损植入蜜饵与虚拟路由，利用功能性伪装与反向提示词注入反控 AI 渗透 Agent，实现攻击捕获、画像溯源与上线反制。
aaravshah1311 / Agent-2
An autonomous AI agentic harness built to code anything, automate terminals, perform cybersecurity tasks, and execute complex real-world workflows with minimal human intervention. From writing and debugging code to analyzing systems, managing files, running commands, and orchestrating tools, Agent-2 turns simple prompts into autonomous execution.