opentrap / opentrap
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
opentrap / opentrap
Autumn-27 / ScopeSentry
ScopeSentry-Cyberspace mapping, subdomain enumeration, port scanning, sensitive information discovery, vulnerability scanning, distributed nodes
aquasecurity / trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
projectdiscovery / nuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
promptfoo / promptfoo
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
future-architect / vuls
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
google / osv-scanner
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
We5ter / Scanners-Box
The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵
lintsinghua / DeepAudit
DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。让安全不再昂贵，让审计不再复杂。
infobyte / faraday
Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
commixproject / commix
Automated Αll-in-One OS command injection exploitation tool.
OWASP / Nettacker
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
awarexone / Agentic-Bug-Hunter
AI-powered bug bounty hunting toolkit that works with or without subscription.
greenbone / openvas-scanner
This repository contains the scanner component for Greenbone Community Edition.
mitchellkrogza / nginx-ultimate-bad-bot-blocker
Nginx Block Bad Bots, Spam Referrer Blocker, Vulnerability Scanners, User-Agents, Malware, Adware, Ransomware, Malicious Sites, with anti-DDOS, Wordpress Theme Detector Blocking and Fail2Ban Jail for Repeat Offenders
zan8in / afrog
A Security Tool for Bug Bounty, Pentest and Red Teaming.
e-m-b-a / emba
EMBA - The firmware security analyzer
vulnersCom / nmap-vulners
Nmap NSE scripts that turn a service scan into CVEs, CVSS scores and known exploits — fingerprints software from HTTP responses and checks every detected CPE against the Vulners database.
google / osv.dev
Open source vulnerability DB and triage service.
Checkmarx / kics
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
Kritt-ai / open-kritt
Open-source, self-hosted AI vulnerability research tool that orchestrates agents to find and validate security issues in code.
aquasecurity / trivy-operator
Kubernetes-native security toolkit
lirantal / npq
safely install npm packages by auditing them pre-install stage
0xSteph / pentest-ai
Open-source AI pentester that proves every finding. Machine oracles re-run each exploit; verified bugs ship a proof capsule you can replay yourself.
attify / firmware-analysis-toolkit
Firmware security research platform combining binary analysis, taint tracing, and emulation across IoT, edge AI, mobile devices, and robotics.
dwisiswant0 / crlfuzz
A fast tool to scan CRLF vulnerability written in Go
trhhubsd / ARTEX
ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军
fkie-cad / cwe_checker
cwe_checker finds vulnerable patterns in binary executables
freelabz / secator
secator - the pentester's swiss knife
owasp-dep-scan / dep-scan
OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.
CERT-Polska / Artemis
A modular vulnerability scanner with automatic report generation capabilities.
potato-security / PotatoTool
这款工具是一款功能强大的网络安全综合工具，旨在为安全从业者、红蓝对抗人员和网络安全爱好者提供全面的网络安全解决方案。它集成了多种实用功能，包括解密、分析、扫描、溯源等，为用户提供了便捷的操作界面和丰富的功能选择。This tool offers robust network security solutions for professionals and enthusiasts. With features like decryption, analysis, scanning, and traceability, it provides a user-friendly interface and diverse functionality.
xalgorix / xalgorix
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
artifact-keeper / artifact-keeper
Open-source universal artifact registry. Drop-in Artifactory/Nexus alternative with 40+ package formats, security scanning, WASM plugins, and edge replication.
GamehunterKaan / AutoPWN-Suite
AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.
berylliumsec / nebula
Cybersecurity Harness
vigolium / vigolium
Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision
ASCIT31 / Dark-Moon
Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.
mitchellkrogza / apache-ultimate-bad-bot-blocker
Apache Block Bad Bots, (Referer) Spam Referrer Blocker, Vulnerability Scanners, Malware, Adware, Ransomware, Malicious Sites, Wordpress Theme Detectors and Fail2Ban Jail for Repeat Offenders
Zyrexnn / Cybermes
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
OWASP / cve-lite-cli
Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.
nealbridges / VulnHunter
Agentic AI security scanner that hunts exploitable vulnerabilities like an adversary, proves them with executable PoCs, and fixes them test-first. A maintained fork of Capital One's VulnHunter, rebuilt for any agent harness.
chushuai / wscan
Wscan is a web security scanner that focuses on web security, dedicated to making web security accessible to everyone.
aboutcode-org / vulnerablecode
A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/
eraser-dev / eraser
🧹 Cleaning up images from Kubernetes nodes
vmfunc / sif
the blazing-fast pentesting suite.
graygnatconsole / mcp-audit-tool
🛡️ Security audit CLI for Model Context Protocol (MCP) servers — scan AI agent configs for tool poisoning, rug pulls, hardcoded secrets, command injection & supply-chain risks. Pure Python, SARIF + CI ready.
0sec-labs / 0
The multiplayer AI offensive security OS - open, self-improving, extensible. Find, verify, and fix vulnerabilities.
nmatt0 / moria
IoT firmware identification and extraction
nmatt0 / mithril
IoT static scanner for secrets, SBOM, CVEs and more.
akha-security / akca
AKCA Advanced Web Security Scanner
stijnswapped / Myrqen
Security testing that runs inside the coding agent you already use. Source-available, not open source.
rootdr-backup / Reconner
Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.
lordx64 / pentestkit
Autonomous multi-agent pentest framework — plans, exploits, verifies (proof-required), CVSS-scores and writes client-ready reports. 104/104 (100%) on the XBOW validation benchmarks, powered by Kimi K3.
eldarshiraliyev / BugScanner
🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports
SyntaxMethod / CVE-2026-42978-PoC-Research
CVE-2026-42978 Windows Push Notifications (WpnService) Use-After-Free & Race Condition PoC research, diagnostic scanner, and security audit module for AI Security Tool.
SyntaxMethod / CVE-2026-41089-Netlogon-RCE-PoC
CVE-2026-41089 Netlogon RCE PoC — security research, vulnerability validation & defensive testing.
duriantaco / ravage
AI powered web security testing for authorized targets
san3ncrypt3d / vulnometry
Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS, CISA KEV, OSV and GHSA.
xiabai2008 / ruoyi-scan
RuoYi (若依) dedicated vulnerability scanner: plugin architecture, three-state verdict, WAF bypass, exploit chains, AI POC generation, nuclei compatible. 若依专项漏洞扫描器