opentrap / opentrap
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
opentrap / opentrap
chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
MobSF / Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
bunkerity / bunkerweb
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
vavkamil / awesome-bugbounty-tools
A curated list of various bug bounty tools
elementalsouls / Claude-BugHunter
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
lirantal / awesome-nodejs-security
Awesome Node.js Security resources
colinlet / PHP-Interview-QA
系统性的 PHP 技术面试问答大全（面经）。涵盖 PHP8、MySQL、Redis、Nginx、系统设计、算法、Laravel 源码及高并发架构原理，助你斩获后端研发 Offer。PHP Interview Questions & Answers.
vmoranv / jshookmcp
A search-first, profile-aware reverse-engineering workspace for AI agents — 735 tools across 36 domains in one MCP server.
Safe3 / uusec-waf
Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.
six2dez / burp-ai-agent
Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more
lissy93 / domain-locker
🌐 The all-in-one tool, for keeping track of your domain name portfolio. Got domain names? Get Domain Locker!
webpwnized / mutillidae
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.
trhhubsd / ARTEX
ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军
stanislav-web / OpenDoor
OWASP Web Recon & Directory Discovery Platform
Check-Risk-WAF / Check-Risk-WAF
Check Risk WAF is an all-in-one Web Application Firewall with Anti-Bot and Anti-DDoS protection at L3, L4, and L7. Available on-premises or as SaaS, it protects web apps against OWASP Top 10 attacks, CWE vulnerabilities, botnets, and DoS/DDoS. Free and unlimited for everyone, forever for personal, non-commercial use.
jdevalk / specification.website
Website specification — HTML, accessibility, security, SEO, agent-readiness. Platform-agnostic, sourced, MIT.
fabriziosalmi / caddy-waf
Caddy WAF (Regex Rules, IP and DNS filtering, Rate Limiting, GeoIP, Tor, Anomaly Detection)
asdfgh1445 / ctf-super-hub
面向小白用户的 CTF / 逆向 Skills 整合包：自动分流、头脑风暴、教学模式、比赛模式、只提示模式
h5i-dev / h5i
Unified Rust framework for building, verifying, and testing web apps. Kernel-based architecture for Lean 4 verification and GPU acceleration. Built-in red-teaming tools for automated vulnerability detection.
Lookyloo / lookyloo
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.
hueristiq / xurlfind3r
A command-line tool for discovering URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly available.
tempesta-tech / tempesta
Web application acceleration, advanced DDoS protection and web security
mdpsec / bug-bounty-hunting-prompts
Reusable prompts for a structured, evidence-first bug bounty hunting workflow
yyhuni / xingrin
Open-source attack surface management and authorized security automation platform for asset discovery, service probing, scan orchestration, and security result management.
dmdhrumilmistry / pyhtools
A Python Hacking Library consisting of network scanner, arp spoofer and detector, dns spoofer, code injector, packet sniffer, network jammer, email sender, downloader, wireless password harvester credential harvester, keylogger, download&execute, ransomware, data harvestors, etc.
OWASP / www-project-web-security-testing-guide
The Web Security Testing Guide (WSTG) Project produces the premier cybersecurity testing resource for web application developers and security professionals.
scrapfly / Antibot-Detector
Real-time detection of anti-bot systems, captchas & fingerprinting techniques. Identifies Cloudflare, Akamai, DataDome, reCAPTCHA, hCaptcha, Shape Security & more with confidence scoring and advanced capture tools.
Fausto-404 / js-reverse-automation--skill
结合chrome-devtools-mcp的能力并加上Skill的规范，实现JSRPC+Flask+autoDecoder方案的前端JS逆向自动化分析，提升JS逆向的效率
JasonLovesDoggo / caddy-defender
Caddy module to block or manipulate requests originating from AIs or cloud services trying to train on your websites
cc1a2b / JShunter
jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for and bug bounty hunters and security researchers.
edoardottt / csprecon
Discover new target domains using Content Security Policy
pis10 / TraceSurface
发现藏在前端代码里的 API，验证未授权访问风险 · 动态浏览器追踪 × JavaScript 静态分析
eldarshiraliyev / BugScanner
🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports
DotRacel / etherfi-session-manager
Tampermonkey 用户脚本：ether.fi Cash 设备会话管理工具
armourinfosec / Secure-PHP-Development
Secure PHP Development — lab-driven study notes: modern PHP 8.2/8.3 through a full OWASP-mapped catalogue of PHP vulnerabilities with exploit-then-fix labs. CC BY 4.0.
chingchog / dr-web-security-space-windows-setup-guide
Dr.Web Security Space Setup Guide 2026 for Windows 11 and 10
duriantaco / ravage
AI powered web security testing for authorized targets
kulchankas / paranoid
Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.
divinelabio / Aegis
Next-Gen Selfhosted Web Application Firewall (WAF) & Edge Reverse Proxy built in Go. Real-time threat defense, L7 traffic control, and unified admin console.
MarinJursic / production-readiness-checklist
Evidence-driven production readiness checklist for shipping web applications with confidence
HotStartLabs / glassbox
Client-side browser-fingerprint bench — see what any website can measure about your browser, and how identifiable you are. Live: https://glassbox.codecanary.org
sanjarbiy / bugbountyrules
Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, coverage, no false positives, never quits early.
Tangruwo / RuwoScan
基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。
armourinfosec / Offensive-Web-Application-Security
A lab-driven course on breaking web applications and explaining how to fix them — 491 notes, 36 reproducible labs, mapped to OWASP WSTG and the PortSwigger Top 10 Web Hacking Techniques.
SagarBiswas-MultiHAT / The-BlackHAT-roadmap
The complete hacking & penetration testing roadmap. From beginner to elite. 44,982 lines, 150+ Diagram across the roadmap: OPSEC, web security, Active Directory, binary exploitation, EDR evasion, and 0-day research. 300+ tools, 200+ MITRE techniques, C & Rust payloads, lab guides, books, courses, blogs, practice platforms, and AI security resources
DuskSwordsmanWrath / Burp-Suite-Professional
Burp Suite Professional for Windows — the complete professional build with every module enabled: HTTP inspection, web security testing, and API analysis, no edition limits after install.
m0m0x01d / strata
See why a web vulnerability works, not just how to trigger it — a single-file, zero-dependency security lab that renders a vulnerable app as a 7-layer cross-section. 17 labs, attacker & defender modes, AI-authorable.