Exploit

NetSentinel is a comprehensive network management tool designed for discovering devices, diagnosing connectivity issues, and monitoring network health. It features rogue device detection, detailed device inventory, bandwidth monitoring, a root cause correlator, and automated reporting capabilities, all while ensuring complete data privacy with a fully local, open-source architecture. With its extensive functionality, NetSentinel serves as a powerful aide for network administrators and users seeking to enhance both security and reliability in their network environments.

Mole is a Binary Ninja plugin that facilitates the identification of significant execution paths within binaries through backward slicing of variables, leveraging the Medium Level Intermediate Language (MLIL) in Static Single Assignment (SSA) form for static taint analysis. Its primary use case lies in vulnerability detection, where it allows users to define source and sink functions, visualize paths, and analyze them using AI integration for classifying potential vulnerabilities. Notable features include operational flexibility, extensive path exploration options, customizable path grouping strategies, persistence of analysis progress, and inter-procedural variable slicing.

CTFlearn-Writeups is a compilation of detailed solutions for various Capture The Flag challenges across multiple domains such as Cryptography, Forensics, and Web security. The tool serves as a reference for practitioners and enthusiasts looking to enhance their skills in cybersecurity challenge-solving. Notable features include categorized writeups that cover a range of problem types, providing structured insights into methodologies and techniques used in each challenge.

cwv-scanner is a Python-based tool designed to identify common web application vulnerabilities by scanning specified URLs or IP addresses. It checks for 36 types of vulnerabilities including SQL Injection, Cross-Site Scripting (XSS), and Remote Code Execution, facilitating website owners and security researchers in enhancing their application's security posture. Notable features include a straightforward installation and usage process, allowing for quick deployment in vulnerability assessments.

Android-Hacking is a comprehensive toolkit designed for rooting and unlocking the bootloader of Android devices, specifically targeting devices like the Redmi A5. The repository offers detailed tutorials in both Portuguese and English, providing users with step-by-step instructions for exploiting vulnerabilities in Unisoc chipsets. Notable features include language-translated guidance and specific exploitation techniques applicable to Android devices.

OrbitPilot is an advanced automation tool tailored for online betting that enhances user engagement through a context-aware decision-making layer. By utilizing a robust Selenium foundation and a modular plugin architecture, it offers intelligent action sequencing, multi-platform responsiveness, and native multilingual logging, while also providing innovative features like a 24/7 sentinel monitoring system and detailed session analytics. This tool enables users to transform repetitive tasks into strategic workflows, allowing for a more informed and efficient betting experience.

PatternScope is a predictive drift analysis tool designed for simulated probability environments, enabling users to identify and visualize behavioral patterns in outcomes that initially appear random. By leveraging features such as Sequence Archetype Extraction (SAE) and Drift Velocity Index (DVI), the tool provides a scientific approach to understanding probability landscapes, allowing analysts to build comprehensive historical profiles and observe shifts in real-time. The platform also facilitates multi-session analysis through 3D visualizations and maintains an encrypted comparative corpus to enhance predictive accuracy across varied session parameters.

The Arcade Ascension Toolkit is a modular performance enhancer designed for retro-style endless hopper games, providing real-time aids that improve gameplay without diminishing the core skill challenge. Key features include predictive pathfinding overlays to enhance spatial awareness, adaptive timing calibration for responsive controls, and session performance analytics to help players learn from their gameplay. With a game-agnostic framework and a sleek, immersive UI, it also offers multi-language support and a vibrant community for continuous support.

BlackOut: The Shadowforge Toolkit for Meteor Client is an advanced Minecraft modification designed to enhance Crystal PvP (CPVP) gameplay through a system of contextual automation and precise combat tools. Notable features include predictive combat algorithms, advanced movement mechanics tailored for aerial combat, and a customizable user interface that supports multilanguage interactions, providing players with an edge in competitive scenarios. The toolkit aims to elevate gameplay by automating critical actions with high precision, making it a vital asset for serious players in the 2026 competitive scene.

MindBridge Orchestrator is a behavioral framework for managing and interacting with external Windows processes through an event-driven architecture. It facilitates adaptive process discovery, seamless communication with GUI elements, and robust event handling, enabling applications to effectively converse with both legacy and modern systems. Notable features include dynamic enumeration of processes, a unified interaction vocabulary for UI elements, and resilience mechanisms such as process resurrection and session rehydration.

0sec is an open and extensible AI-driven cybersecurity tool that automates vulnerability discovery, exploitation, and remediation across various layers, including web applications, APIs, source code, and network infrastructure. It supports multi-model and multi-agent capabilities to address complex security challenges, emphasizes continuous security over point-in-time assessments, and includes a command-line interface for streamlined interactions and automation of pentesting workflows. Notable features include the ability to find a wide range of vulnerabilities, integration with various environments and systems, and a focus on supply chain security and other emerging threat vectors.

The System Programming Roadmap is an educational framework designed to guide users through the fundamentals of compiler development, malware reverse engineering, and kernel development. It emphasizes a structured approach to mastering system programming languages such as C, Rust, and C++, while also covering essential concepts in computer architecture and assembly language. Notable features include a curated list of resources and prerequisites to enhance the learning experience and ensure a comprehensive understanding of low-level programming.

r3ngine v3.7.4 is an advanced web reconnaissance and vulnerability scanning tool that facilitates comprehensive security assessments through its Target Report Generation feature, allowing users to generate detailed multi-scan PDF reports with historical vulnerability tracking. Key features include an Attack Path Modeling Engine aligned with MITRE ATT&CK, integration with WPScan/WPTaint for static analysis, and enhanced infrastructure for scalability and reliability using Django and PostgreSQL. This enterprise-grade platform is designed for thorough and efficient security analysis while ensuring operational security and ease of use.

VeltCLI is a terminal-based OSINT and defensive security research toolkit that consolidates multiple reconnaissance and analysis tasks into a single interface. Its primary use case includes vulnerability assessment, DNS checks, web security analysis, and various research workflows across social media, emails, IP intelligence, and more, all while supporting data export in formats such as JSON, CSV, and Markdown. Notable features include comprehensive vulnerability scanning, domain and cloud analysis, and detailed reporting capabilities, streamlining the security research process for users.

R3d-Buck3T is a comprehensive repository designed for penetration testing and red teaming activities, featuring an extensive collection of tools and commands across multiple security domains, including web application, cloud, network, and wireless security. Notable characteristics include detailed sections on Active Directory and vulnerability research, alongside a dedicated wiki for easy navigation and resource access. This tool serves as a vital asset for security professionals aiming to enhance their offensive security skills and methodologies.

Red Clippy is an open-source penetration testing management tool designed to integrate with AI agents for streamlined test engagements. It retains detailed records of assets, observations, and findings, ensuring that testing sessions can progress smoothly without loss of information, while enforcing protocols for data verification and reporting. Notable features include a web-based interface for managing test data, customizable engagement rules, and the ability to connect to AI agents for enhanced testing efficiency.

Stratum C2 is a cloud persistence framework designed to maintain command-and-control (C2) communication through trusted cloud storage providers like Dropbox and OneDrive, thus avoiding detection by traditional security defenses. Its notable features include end-to-end encryption with RSA and AES, the ability to switch between multiple cloud providers seamlessly, and a structurally unblockable channel that makes it difficult for security operations centers to intercept. The framework supports multiple agent formats for both Windows and Linux without requiring additional dependencies.

Vulnogram is a comprehensive tool designed for reserving, managing, and publishing Common Vulnerabilities and Exposures (CVE) information, facilitating collaboration between vendors and security researchers. It offers both solo and team modes, allowing users to edit JSON documents that conform to specified schemas, with enhanced features such as real-time collaboration, version control, and a customizable plugin architecture for various tracking needs. Notable features include a web-based frontend, integration with MongoDB for persistent storage, and security-focused configurations to ensure the integrity of vulnerability data.

Hermes Cybersecurity Lab is a comprehensive cybersecurity toolkit designed for the Hermes Agent, encompassing 2,077 skills, 131+ tools, and 28 frameworks, systematically organized across multiple repositories. Its primary use case includes security research, pentesting, forensics, and threat intelligence, with notable features like a preconfigured installation script, tool inventory awareness, and a structured methodology for tackling various phases of cybersecurity engagements. This ecosystem ensures continuous updates and knowledge accumulation, enhancing both operational efficiency and effectiveness in security practices.

Awesome Security Agent Harnesses provides a collection of AI-driven tools designed for penetration testing, code auditing, fuzzing, vulnerability discovery, and reverse engineering. The primary use case is to enhance security assessments through a variety of harnesses, sandboxes, and evaluation frameworks that streamline the detection and validation of vulnerabilities while minimizing false positives. Notable features include multi-agent collaboration, independent validation of findings, and integration with various coding agent methodologies to automate and enhance security processes.

Reverse Shell WhatsApp is a tool that exploits the WhatsApp Desktop application on Windows to enable remote code execution via a crafted `.pyz` file. When the victim opens the file, it is executed directly by the Python interpreter without any security prompts, allowing the attacker to gain full control of the victim's machine through privilege escalation. Notable features include bypassing multiple layers of security, such as Windows Defender and UAC, and operating discreetly within a trusted application context.

Acunetix Premium Web Scanner - Practical Windows release with complete modules and an easy first launch.

IFDA is a tool designed for automated reverse engineering and vulnerability discovery in IoT firmware binaries, supporting the analysis of ELF files and extracted firmware trees. It features a bilingual web UI, integrates with existing tools like Capstone and PyELFTools for disassembly and ELF parsing, and offers a structured output for findings, including severity and vulnerability classifications. The architecture includes a Python analysis core and a Go service layer for orchestration, ensuring efficient task management and live progress tracking.

RPC-Triage is a static analysis tool designed to assess the Windows RPC attack surface by analyzing compiled PE binaries to identify registered RPC servers and their corresponding method signatures, security flags, and transport bindings. It uniquely ranks interfaces based on a composite score of reachability and danger, providing detailed receipts for transparency in scoring. Notably, the tool operates without the need for symbol files, making it effective on stripped binaries found in production environments.

Patchbot is a comprehensive vulnerability scanning tool that integrates with existing scanners and threat feeds to automate the patching process in software repositories. It specializes in inventorying packages, identifying vulnerabilities, and applying fixes—either through version bumps or more complex code changes—while ensuring that each change is verified and re-scanned prior to the creation of pull requests. Notable features include the ability to utilize custom threat feeds and scanners, as well as the capability to operate independently of CI environments, thereby providing flexibility in deployment and usage.

Ingram-Pro is an enhanced network camera vulnerability scanner that builds upon the original Ingram framework, providing extensive coverage of over 40 proof of concept (POC) exploits for CVEs from 2017 to 2024, alongside brand-specific weak-password detection for more than 15 camera brands. Key features include authenticated and unauthenticated remote code execution (RCE), high concurrency scanning using gevent, and the ability to capture live snapshots from vulnerable devices. The tool is designed for authorized security assessments and facilitates rapid vulnerability detection across large IP ranges.

PageZero is a JavaScript-based browser exploitation and command-and-control (C2) framework that integrates features from both Evilginx and BeEF. It allows security professionals to deploy phishing attacks without the need for complex configurations, enabling live sessions to execute over 40 modules including credential theft, keylogging, and LAN scanning from a web admin panel. The tool is designed for authorized penetration testing and operates using a simple hook that grants persistent control over the victim's browser context.

The repository provides a comprehensive collection of cybersecurity bookmarks curated by a senior information security engineer, focusing on critical topics such as OSINT, exploitation, privilege escalation, and malware analysis. It features over 40 tools for reconnaissance, privacy, and attack methodologies, along with curated news sources, making it a valuable resource for cybersecurity professionals looking to enhance their operational security and situational awareness. Notable features include categorized tools for specific cybersecurity tasks and a visually engaging presentation of the content.

ZeroBurst is an advanced command-line application security testing framework designed for ethical hacking and vulnerability assessment. With over 55 specialized modules, it enables users to conduct thorough reconnaissance, injection testing, and auditing of web applications, focusing on various attack vectors such as server-side request forgery and SQL injection. Notable features include automated vulnerability detection across multiple tiers, advanced auditing capabilities, and comprehensive mapping tools for application infrastructure.

search_vulns is a modular tool designed for searching known vulnerabilities, exploits, and other related information across various data sources. Its primary use case is to facilitate vulnerability assessments by allowing users to query a local database with inputs such as product titles or vulnerability IDs, while supporting integration of additional data sources through its modular architecture. Notable features include a command-line interface for automated workflows, a web server for enhanced functionality, and the ability to accommodate diverse input formats.

Network Scanner is an open-source security tool designed for vulnerability assessments and penetration testing, enhancing traditional methodologies with AI capabilities for intelligent analysis and detailed reporting. Tailored for a diverse user base including beginners and professionals, it offers functionalities such as automated reconnaissance, various scan types (subdomain, port, DNS), and an AI assistant for context-sensitive support. Notable features include report generation in PDF/HTML formats, an educational learning mode, and API readiness for seamless integration.

PrestaScan Security is a PrestaShop module designed to scan PrestaShop websites for malware and known vulnerabilities in both the core and its modules. It features an intuitive installation process, regular vulnerability alerts, and is compatible with multiple PrestaShop versions, ensuring comprehensive security for e-commerce sites. This free and open-source tool is supported by a dedicated team of security experts who continually monitor and audit for potential threats.

Bex Security is an open-source tool designed to facilitate security workflows for coding agents and models, maintaining compatibility with OpenAI's Codex Security. This tool enables users to run consistent, evidence-driven security scans while supporting multiple coding agents through the Agent Client Protocol (ACP). Notable features include a CLI that integrates with various inference providers, a repeatable upstream merge workflow, and an emphasis on security outcomes from discovery to remediation.

Public Skills Builder is a tool designed to generate Claude Code bug bounty skills from publicly available HackerOne reports and GitHub writeups, specifically without requiring access to private reports. It processes over 500 disclosed reports to create 18 structured skill files for various vulnerability classes, each containing real-world techniques, payloads, and bypass patterns, thereby providing users with resourceful training data for vulnerability hunting. Notable features include support for multiple sources, including public feeds, and the ability to customize output based on specified vulnerability types.

The CVE-2026-18963-Exploit tool allows users to test for a critical security vulnerability in Keycloak versions 26.0.0 to 26.7.1, which enables unauthenticated attackers to reset passwords without victim interaction. It features a safe detection mode that requires only the base URL and realm settings, avoiding any impact on the target system. Additionally, it includes a lab environment for practical demonstration of the exploit and its remediation.

Ruoyi-Scan is a specialized vulnerability scanning tool designed for RuoYi applications, featuring a plugin-based architecture and three-state assessment (CONFIRMED / SAFE / UNKNOWN) for vulnerability status. It supports bulk scanning, multiple report formats, WAF bypass techniques, and offers enterprise-level functionalities such as API integration and a robust plugin ecosystem for various common vulnerabilities. Noteworthy capabilities include automated AI-based POC generation, extensive reporting options, and compatibility with various operating environments.

BugHunter is an AI-powered bug bounty toolkit designed for effective vulnerability assessment and reporting directly from the terminal. It automates the processes from reconnaissance to reporting, generating submission-ready documents for various platforms while utilizing an intelligent session management feature that retains discovered patterns across targets. This tool can operate independently without a subscription, enhancing accessibility for users in the cybersecurity domain.

PwnRM is an advanced WinRM post-exploitation tool designed for conducting authorized security assessments in Windows Active Directory environments. It features an interactive PowerShell runspace, support for various authentication methods, stealthy payload delivery, and a built-in Active Directory triage engine, enabling users to perform a wide range of assessment tasks through a command-line interface as well as via a Python library. Notable functionalities include file transfer capabilities, remote command execution, and comprehensive AD enumeration and session management features.

Vex8s is a tool that generates VEX documents by analyzing container vulnerabilities and correlating them with Kubernetes security settings to assess the exploitability of CVEs within workloads. It utilizes machine learning models to classify vulnerabilities and determine mitigable conditions based on Kubernetes configurations, offering both passive and active scanning modes for versatility. Notable features include integration with existing vulnerability scanners like Trivy and Grype, facilitating the suppression of reported vulnerabilities based on real-time assessments.

The RevEng.AI Ghidra Plugin integrates with Ghidra to facilitate AI-assisted binary analysis, enabling users to upload binaries for analysis and perform Binary Code Similarity operations. Its notable features include automatic function renaming based on confidence thresholds and the ability to display similar function names, which assist in reverse engineering stripped binaries. This tool is particularly useful for security researchers and software developers involved in binary analysis and reverse engineering tasks.

The Ansible Security Scanner is a static analysis tool designed for evaluating Ansible playbooks, roles, and related files to identify security vulnerabilities including malicious code and unauthorized access risks. It features a comprehensive reporting mechanism that generates outputs in various formats such as SARIF and CycloneDX SBOM, while providing remediation guidance and mapping findings to established security frameworks like OWASP and MITRE ATT&CK.

OXIDE is a precision-forged vulnerability scanner developed in Rust, designed primarily for authorized penetration testing and security research. It features a unique combination of traditional scanning methods and machine learning-based anomaly detection, along with integrations for tools like Burp Suite, and offers a modular architecture for extensibility. Notable features include a headless DOM, WAF evasion capabilities, and enhanced security with an embedded TLS certificate, making it suitable for use in both lab environments and real-world assessments.

IndustrialXPL-Forge (IXF) is an extensive Python-based security assessment and exploitation framework designed specifically for Operational Technology (OT), Industrial Control Systems (ICS), and related environments. It encompasses the entire attack lifecycle from reconnaissance to reporting, and it features over 1,190 modular tools, support for more than 50 protocols, and extensive integration with the MITRE ATT&CK for ICS framework, along with a significant library of vulnerabilities, offering a comprehensive resource for cybersecurity professionals in the industrial sector.

The ExploitDB MCP Server is a Model Context Protocol server designed to provide AI assistants with access to security exploit and vulnerability data from ExploitDB. Its primary use case is to enhance cybersecurity research and threat intelligence through functionalities like searching for exploits by various criteria, retrieving detailed exploit information, and tracking newly added exploits, all while supporting automatic database updates to ensure up-to-date information. Notable features include comprehensive search and analysis tools, statistics on exploit distribution, and batch retrieval capabilities for efficient data access.

The Offensive Linux Privilege Escalation tool serves as a comprehensive guide to help users escalate from low-privileged Linux access to root, covering various techniques such as sudo and SUID abuse, kernel exploits, and credential mining. Its primary use case is educational, providing detailed methodology, enumeration scripts, and a structured approach to experience in privilege escalation while emphasizing lawful and authorized testing. Notable features include over 50 documented techniques, automated enumeration scripts, a methodology checklist, and practical lab setups for hands-on learning.

Offensive File Transfer Techniques is an extensive guide designed for transferring files to and from target systems during security engagements, emphasizing staging payloads and exfiltrating data. It covers a diverse range of transport mechanisms, including HTTP, SMB, FTP, TFTP, and more obscure methods like base64 encoding, while also providing detection and defense mappings for each technique. The tool features organized notes with ready-to-use commands for both client and server setups, ensuring comprehensive coverage of file transfer methods in offensive security contexts.

Offensive Windows Privilege Escalation is a comprehensive guide designed for escalating privileges from a low-privileged Windows environment to Administrator or SYSTEM level, utilizing various techniques such as service misconfigurations, registry exploits, UAC bypass, and token-privilege abuse. The tool emphasizes an offensive security methodology, offering over 75 structured notes complete with hands-on exploitation and detection guidance, alongside ready-to-use commands and methodology checklists. It serves as an educational resource exclusively for authorized testing scenarios, ensuring ethical use in cybersecurity practices.

The Ethical-Hacking repository provides a comprehensive step-by-step guide for learning cybersecurity and ethical hacking using Kali Linux. It covers foundational knowledge in networking and Linux commands, introduces tools like Nmap and Metasploit, and offers practice platforms for hands-on experience. Notable features include recommended resources, structured learning paths, and additional guidance on specialized areas like web application security and certifications.

fnprint is a binary analysis tool that uniquely identifies functions in stripped executables by analyzing their behavioral side effects rather than relying on byte signatures or control-flow graphs. It emulates function execution with fabricated inputs to generate behavior-based fingerprints, allowing for more resilient matches across different compiler optimizations and versions. Key features include indexing known binaries for function identification, differential analysis to detect behavioral changes between builds, and a triage capability to assess potential vulnerabilities based on function behavior comparison.

Consortium is a modern, extensible command and control (C2) framework that supports both asynchronous multi-client interactions and language-agnostic listener-agent designs, enabling users to develop custom agents and listeners efficiently. Key features include a robust REST API for automation, role-based access control for user management, and modular architecture that allows for extensive customization and collaboration among users. Currently in the alpha phase, the framework emphasizes a high degree of flexibility while still under rapid development.

Cybermes is an advanced autonomous security research framework designed for offensive security tasks, including bug bounty hunting and red teaming. It features over 50 specialized modules for in-depth reconnaissance, attack surface analysis, and vulnerability validation, leveraging a unique integration of modern LLM reasoning and automated workflows. Notable capabilities include dynamic attack planning, multi-source knowledge retrieval, and programmatic validation of findings to ensure zero false positives.

darksword-kexploit is an Objective-C tool designed to facilitate the execution of the DarkSword kernel exploit on iOS devices running up to version 26.0.1 via a straightforward Windows setup process. Notable features include a clear, step-by-step interface suitable for non-technical users, easy integration of local release files, and basic logging to monitor progress. The tool simplifies the requirements for successfully running the exploit by guiding users through connection and configuration steps.

The Roblox Robux Generator 2026 is a tool designed to add Robux to any Roblox account through the exploitation of a group payout vulnerability, claiming to facilitate the addition of 400–10,000 Robux per day without requiring user passwords. It supports both Roblox Premium and free accounts, necessitating only the account username and a verification step to mitigate abuse. Notable features include compatibility with Windows 10/11, and the ability to function without needing root or jailbreak access.

The Roblox Robux Hack Script 2026 is a tool designed to exploit the developer exchange API of Roblox, enabling users to transfer Robux from compromised developer accounts. Its primary use case is the automated scanning for vulnerable accounts and facilitating stealthy transfers of Robux in small increments to avoid detection. Notable features include the ability to export scanned account lists to CSV, support for accounts with at least 10,000 Robux, and an operational stealth mode to minimize the risk of detection by Roblox.

Safer Dependencies is a security tool designed to enhance the integrity of package installations in AI-assisted coding environments like Claude. It automatically intercepts package addition requests to perform checks for known vulnerabilities, maintainability, and risks such as typosquats, while ensuring that only safe versions are installed across multiple ecosystems including npm, PyPI, and Maven. Notable features include its proactive blocking of vulnerable installations, automatic correction of risky dependencies, and a streamlined integration that operates in the background without user intervention.

WPRecon is a WordPress reconnaissance and vulnerability scanning tool that leverages a YAML-driven template architecture for efficient vulnerability detection and configuration assessment in WordPress installations. Notable features include parallel scanning with configurable worker pools, a library of over 150 templates for comprehensive coverage, and dynamic variable resolution, offering flexibility for security engineers to extend capabilities without recompilation. The tool supports both command-line and API interfaces, allowing for versatile integration into security workflows.

AWINRM is an advanced WinRM post-exploitation framework designed specifically for red teams and offensive research, implemented in Ruby. Its primary use case revolves around facilitating efficient post-exploitation activities with features like built-in tool staging, automated AMSI/ETW bypasses, stealth file transfers, and automatic loot extraction, addressing common challenges encountered in traditional WinRM tools. The framework provides a streamlined operator-centric workflow that enhances operational security and supports automated reconnaissance and credential gathering.

Arceus X PC is a Roblox executor designed for Windows that allows users to run Lua scripts and access a built-in script hub, facilitating game modifications for popular titles such as Blox Fruits and Arsenal. It features over 500 pre-loaded scripts, including an auto-farm for Blox Fruits and aimbot and ESP scripts for Arsenal, with one-click execution and regular updates to ensure compatibility with Roblox patches. This tool is a port from the mobile version, maintaining the core functionalities while catering to PC users.

Roblox Infinite Yield Admin Script GUI is a powerful tool designed for managing and manipulating gameplay in Roblox, featuring over 300 admin commands accessible through a full graphical user interface. Key functionalities include player teleportation, speed and gravity adjustments, server information access, and ESP commands, all of which operate without requiring in-game administrative rights. Compatible with various high-level script executors, the tool enhances the gaming experience by offering extensive control and flexibility.

Sonar Bypass is a Node.js script designed to circumvent the Sonar 2.1.x anti-bot verification mechanism for Minecraft servers by mimicking legitimate client behavior through raw socket communication. The tool operates without the need for captcha solving or manual interaction, handling various verification stages by copying the exact interactions of a real player, documented in its accompanying research files. Key features include automated packet responses and support for multiple server environments, making it effective for bypassing bot protections in targeted servers.

Getsploit is a tool designed for searching and downloading public exploits from the Vulners database, facilitating both online searches and fully offline operations via a local SQLite index. Its notable features include a comprehensive query capability across multiple exploit collections, local query support without internet connectivity, and robust JSON and tab-separated output formats, all while maintaining data privacy and integrity. The tool is compatible with Python 3.11 and above, ensuring reliable performance across various platforms.

nmap-vulners is a set of Nmap scripts designed to enhance network vulnerability assessments by converting service scan results into a detailed list of known Common Vulnerabilities and Exposures (CVEs) along with their respective CVSS scores and exploits. Notable features include three independent scripts that can perform various vulnerability lookups—one leveraging the public Vulners database, another utilizing the Vulners API for advanced scoring, and a regex-based script that identifies web software through HTTP headers. This tool aims to streamline the process of gathering security-related information during Nmap scans, improving the effectiveness of vulnerability management.

OSV.NET is a .NET library designed to interact with the Open Source Vulnerabilities (OSV) API and schema, specifically supporting version 1.7.0. Its primary use case is to facilitate querying for vulnerabilities in open source packages, and it provides flexible integration options through manual instantiation or dependency injection, making it straightforward to incorporate into .NET applications. Notable features include asynchronous querying capabilities and customizable HTTP client settings for enhanced configurability.

MassAcre is a tool designed to exploit a zero-day vulnerability in the masscan banner scanning utility, causing it to enter an infinite loop and consume 100% CPU by sending a specially crafted TLS handshake record. Its primary use case is to demonstrate a remote, unauthenticated Denial of Service (DoS) attack that stalls the banner processing of masscan, leading to lost scan results. Notably, the attack is executed with a minimal payload and targets a specific flaw in masscan's certificate handling logic.

The vuln-report-skill tool automates the generation of submission-ready DOCX vulnerability reports for security response centers, focusing on verified vulnerabilities with clear proof of concept (PoC). It employs a structured workflow that includes layered verification gates to ensure report quality, enforces strict screenshot requirements, and maintains a consistent document layout. Designed for technical accuracy and dual readability, the tool facilitates a rigorous review process to enhance report acceptance on various platforms.

Aimbot V3 is a universal aim-locking module designed for games using the default character model, offering enhanced optimization and efficiency over its predecessor, Aimbot V2. It features a simplified and organized code structure, allowing for easy integration and customization via a Lua scripting interface. This tool is primarily intended for use with exploit environments like Synapse X and Electron and includes customizable settings for enhanced gameplay precision.

Exunys ESP is a visual enhancement tool designed for gaming, offering features such as tracers, ESP, boxes, and head dots to provide players with an advantage in gameplay. Utilizing Synapse X's Drawing Library, it ensures undetectability while allowing modular support for NPCs and customizable user configurations via a GUI. The tool is optimized for performance and stability, making it a reliable choice for users seeking advanced visibility options in their gaming experience.

The CVE-2026-9830 tool is a Python-based proof of concept designed for assessing the unauthenticated exposure of the BookingPress Pro REST API in WordPress installations. It enables authorized users to validate potential vulnerabilities by normalizing target URLs, checking API endpoints for sensitive data exposure, and providing configurable options such as timeouts and filtering. Notable features include the ability to save API responses to JSON files while emphasizing the responsible handling of personal data in compliance with authorized assessment protocols.

HEAVEN is an autonomous penetration-testing framework designed to streamline and automate various stages of the penetration testing process, including reconnaissance, vulnerability detection, exploitation, risk scoring via machine learning, and reporting. It features a robust interface with 55 CLI commands, 77 API routes, and multiple scan modes, facilitating comprehensive assessments while allowing users to focus on critical decision-making tasks. Notably, it incorporates a CVSS machine learning predictor with a high correlation score, ensuring accurate risk evaluation.

ExploiterX 3.0 is an enterprise-grade web vulnerability scanner designed for security professionals and developers, capable of detecting a wide range of vulnerabilities including XSS, SQL Injection, and CSRF. Its notable features include advanced scanning capabilities with over 20 XSS payload variants, concurrency support for parallel scanning, intelligent HTML form parsing, and comprehensive reporting in multiple formats. Additionally, the tool emphasizes resilience with built-in retry mechanisms, robust error handling, and secure reporting to prevent common security vulnerabilities in output.

Aivist Verify is an access-control confirmation engine designed to eliminate false positives in testing for Broken Object Level Access (BOLA) and Insecure Direct Object Reference (IDOR) vulnerabilities. It utilizes a dual approach where an AI model proposes potential vulnerabilities based on traffic analysis, while deterministic code gates decisively validate these findings, ensuring that only fully verified threats are reported. Notably, Aivist Verify guarantees zero false positives, supported by a reproducible evidence chain that enhances the reliability of its outcomes.

ERC.Net is a robust library designed for debugging Windows applications, specifically focused on analyzing application crashes and memory vulnerabilities. It supports both 32-bit and 64-bit applications, provides functionality for parsing executable headers, identifying process information, and generating specific testing patterns. Notable features include the ability to read thread Environment Block (TEB) information, detect memory vulnerabilities, and a comprehensive testing framework that verifies memory searching and parsing capabilities.

The Malware Analysis tool focuses on dissecting and evaluating the risk associated with PDF-based malware (maldoc). It provides an in-depth exploration of PDF structures, including headers and encoding techniques, making it a valuable resource for security researchers aiming to understand and analyze malicious code embedded within PDFs. Notable features include detailed explanations of malware behaviors, obfuscation techniques, and how to identify command and control (C&C) mechanisms within PDF binaries.

The Vulnerability PoC Repository offers curated Proof-of-Concept code, test labs, and prevention rules targeting high-severity CVEs for authorized security testing, penetration testing, CTF challenges, and security research. Key features include detection-only PoC scripts, Docker test labs with both vulnerable and patched applications, and bilingual documentation in English and Korean, ensuring comprehensive resources for cybersecurity professionals.

JADX MCP Server is a pure-Java Model Context Protocol server that facilitates the reverse engineering of Android APK files utilizing the JADX decompiler. Designed for security researchers and developers, it enables detailed analysis through features such as APK loading, code decompilation, component extraction, and comprehensive manifest analysis, all while maintaining cross-platform compatibility and requiring no external dependencies.

Clipwire is a kernel exploit development harness specifically designed for the iPhone 11 series running iOS 26.1, aimed at demonstrating vulnerabilities discovered through patch diffing between versions 26.1 and 26.6 of Apple's XNU kernel. It exploits two identified bugs: one related to unlocked operations in the copy-on-write (COW) submap fault path, and the other concerning insufficient bounds checks in memory object management, allowing for potential privilege escalation and memory corruption. Notable features include a structured source code layout for various exploit stages, as well as tools for physical memory read/write operations and object discovery, catering to researchers in exploit development.

opencode-pentester is an AI-powered penetration testing and security audit framework designed to automate bug bounty hunting and vulnerability assessments. It orchestrates 12 specialized AI agents across 69 attack categories and 17 OWASP security audits, enabling comprehensive offensive and defensive testing. Notable features include the ability to run automated tests, generate professional reports, and integrate a wide array of security tools, making it suitable for security researchers, penetration testers, and DevSecOps engineers.

Hacker Bob is a local MCP (Managed Control Panel) workflow tool designed for authorized offensive security testing within CI environments or staging areas. It facilitates surface mapping, authentication setup, parallel testing, and reporting, while integrating with various MCP-capable hosts like Claude Code and Codex. Notable features include real network request capabilities, local artifact imports, and the ability to manage sensitive run data securely, all ensuring users adhere to permissions and authorization guidelines.

`agentgg` is an agentic static application security testing (SAST) scanner designed for CI environments that leverages advanced reasoning capabilities over traditional pattern-matching methods. It intelligently navigates codebases by following imports and analyzing the call graph, allowing users to run scans on entire repositories or specific git diffs for pull request assessments. Key features include the ability to auto-download a catalog of agents, resume interrupted scans, and create reusable agents from past security reports, enhancing the overall efficiency and effectiveness of code security analysis.

The LPE Toolkit 2026 (xpl2026) is an advanced collection of 26 static binaries targeting local privilege escalation (LPE) vulnerabilities on Linux systems for penetration testing and security research. Notable features include universal compatibility across various Linux distributions and kernel versions, automatic detection and filtering of applicable exploits, and an interactive user interface for seamless operation. The toolkit is especially significant for its inclusion of newly researched exploits, enhancing its utility for security professionals.

Pentestkit is a sophisticated, multi-agent penetration testing framework that utilizes the Claude Agent SDK to orchestrate a team of specialized agents. The tool excels in automating the penetration testing process by exploiting vulnerabilities, scoring them using CVSS v3.1, and generating comprehensive client-ready reports, all while accumulating knowledge in a shared database. Notable features include its ability to perform real exploitation of findings and a robust scoring system that achieved a perfect 104/104 on the XBOW benchmark suite.

HunterX is an AI-assisted offensive security engine designed for conducting authorized security assessments, integrating tools for reconnaissance, hypothesis-driven investigation, vulnerability validation, and professional reporting into a unified workflow. Unlike traditional vulnerability scanners, HunterX emphasizes thorough investigation and validation, ensuring that findings are evidence-based and report-ready. Notable features include AI-assisted reasoning, proof of concept engineering, and capabilities for reproducibility and impact assessment, enhancing the reliability of security assessments.

OBLITERATUS is an advanced red teaming framework designed for post-exploitation research and defensive evasion in Windows environments. It features a multi-layered stealth architecture for evasion, low-level syscall execution, and identity correlation through its Identity Nexus module, allowing for the bypassing of MFA and efficient credential management. Key capabilities include memory hardening, automatic UAC elevation, and a sophisticated operational interface that facilitates real-time process management and forensic analysis.

GlobalCVE is an open-source vulnerability intelligence platform that aggregates Common Vulnerabilities and Exposures (CVEs) from various national and vendor sources, aiming for a clean and developer-friendly interface. Key features include multi-source aggregation with a unified view to avoid duplicates, a minimalist design with dark mode, and a serverless architecture for scalability. The platform emphasizes transparency and community-driven development, providing a free API and fostering collaboration among developers for continual improvement.

TerraSecure is an ML-powered Infrastructure as Code (IaC) security scanner designed to identify cloud misconfigurations in Terraform and HCL files at build time, effectively preventing potential breaches. It employs a pre-trained XGBoost model that delivers 92.45% accuracy with a significantly lower false positive rate of 10.71%, offering context and remediation guidance based on real-world breach data. Notable features include a hybrid detection approach that integrates a rules engine, machine learning, and AI analysis to provide actionable insights for developers.

ALPC Enumerator is a Windows userland tool designed to enumerate and classify Advanced Local Procedure Call (ALPC) ports, including those associated with Protected Process Light (PPL) processes that evade standard enumeration techniques. It dynamically resolves ALPC Port types and employs `NtQueryInformationProcess` for classification, addressing blind spots in conventional tools, thereby benefiting threat hunters and vulnerability researchers by accurately mapping high-privilege targets and identifying potentially malicious activity. Notably, it has been validated against kernel debugger output for precision and reliability.

Web of Flaws is a Markdown-based catalog that identifies vulnerable web patterns alongside safer alternatives, aimed at both developers and automated tools. Its primary use case is to educate users on exploitable vulnerabilities and provide concrete code examples for remediation, organized by security topics and vulnerability families. Notable features include detailed guides that explain risky patterns and their fix implementations.

CVE-2023-51467 Scanner is a Python-based command-line tool designed to identify a specific vulnerability in the Apache OfBiz ERP system that allows unauthorized access due to an authentication bypass flaw. It enables users to scan individual URLs or lists of URLs for the vulnerability, supporting multiple concurrent threads for efficient scanning and providing output files for vulnerable targets. Notable features include customizable thread counts and flexible input options for URL scanning.

Threat-Patrol is a lightweight Python script designed for web application security testing, enabling users to scan websites for vulnerabilities such as SQL injection, XSS, CSRF, SSRF, LFI, and RCE. Its notable features include an easy-to-use command line interface, automatic scanning capabilities, and instant results, making it suitable for quick vulnerability detection.

The Learning Grade AI Web Vulnerability Scanner is a non-destructive tool designed for identifying common web security issues such as unauthorized security headers, insecure cookie flags, and potential SQL injection vulnerabilities. It features a queue-based crawling mechanism for polite scanning, an AI-assisted report viewer for enhanced analysis, and requires explicit user confirmation for ethical scanning practices. This tool is particularly suited for educational purposes and authorized security assessments.

Reconner is a self-hosted reconnaissance tool designed for bug bounty hunters and security researchers, facilitating comprehensive web and network scanning from a single dashboard. It offers a full pipeline of discovery, vulnerability assessment, and continuous monitoring without relying on third-party services, ensuring that all data remains on the user's system. Notable features include real-time logging, native context-aware DAST for multiple vulnerabilities, and seamless integration with Nuclei for enhanced scanning capabilities.

The Nmap Scanning Tool is an interactive wrapper for Nmap that simplifies the execution of common scans and enhances readability of results. It supports multiple scan profiles, including SYN, aggressive, and vulnerability scans, along with an optional output filter to highlight open ports. The tool requires Python and Nmap to be installed on the user's system and aids in providing helpful error messages regarding user permissions and installation checks.

The CVE-2023-22515 exploit script is designed to target and exploit the critical Broken Access Control vulnerability in Confluence Server and Data Center instances, enabling unauthorized access. It offers two operational modes: Normal for single-target exploitation via a provided URL, and Mass for bulk processing using a list of target URLs from a file, with output detailing the success of the exploitation attempts. Notable features include real-time logging of the exploitation process and clear output indicating whether unauthorized access was achieved.

The tool exploits the vulnerability CVE-2025-55182 to achieve remote code execution through prototype pollution in Next.js React Server Components. Its primary use cases include executing arbitrary commands or establishing a reverse shell on a target server, with features for specifying various listener and payload options. Additionally, a lab environment is provided for testing the exploit in a controlled Docker setup.

XSScan is a Playwright-based automated tool designed for bug bounty hunters and security researchers to detect executed cross-site scripting (XSS) vulnerabilities. Key features include real browser execution using Chromium, intelligent form submission, recursive crawling, and auto-generated reports of confirmed XSS findings, ensuring focus on vulnerabilities that are genuinely executed rather than merely reflected.

The CVE-2026-21858 tool demonstrates a full exploitation chain involving unauthorized arbitrary file read (AFR) and remote code execution (RCE) in the n8n automation platform. By leveraging content-type confusion and expression injection vulnerabilities, it allows an attacker to forge admin tokens and execute commands with critical impact. Key features include automated exploitation via a Python script and specific exploit requirements, such as vulnerable configurations of n8n workflows.

Windfall is an exploitation framework that targets critical vulnerabilities in Windmill and Nextcloud Flow, specifically focusing on unauthenticated path traversal and authenticated SQL injection vulnerabilities. Its primary use case is to demonstrate how these vulnerabilities can lead to credential leaks and remote code execution, thereby enabling an attacker to exploit the affected systems. Notable features include a comprehensive assessment of the vulnerabilities' impact with high CVSS scores and detailed analysis of attack vectors, enhancing the tool's utility for security researchers and penetration testers.

OpenLPX is an anti-packet exploit tool designed for Minecraft servers, focusing on protecting against crash packet exploits, specifically NettyCrasher attacks, without requiring any external dependencies. Key features include a smooth packet limiter with a configurable violation system, advanced packet logging capabilities for analyzing potential exploits, and compatibility with Minecraft mods like Printer and Schematica, ensuring minimal disruption to player experiences. The tool provides detailed configuration options to tailor protection measures while allowing for real-time alerts and server management commands.

Root My Pixel is an Android application that automates the acquisition of temporary root access on Google Pixel devices using the NebuSec IonStack exploit (CVE-2026-43499) and integrates with ReSukiSU / KernelSU. It employs a sophisticated installation workflow for device detection and exploit execution while providing real-time log monitoring and management features like soft reboot and log exporting. This tool specifically targets a range of supported Pixel models and requires prerequisites such as the Shizuku service and ReSukiSU Manager for optimal functionality.

This repository offers a curated collection of over 70 free cybersecurity books organized by domain and difficulty, facilitating self-paced learning in various cybersecurity disciplines. Notable features include a structured learning roadmap progressing from beginner to advanced levels, an emphasis on community maintenance for up-to-date resources, and a direct link to an extensive Google Drive library containing the materials.

Red-Team AI is a white-box red teaming tool designed specifically for agentic AI applications, capable of reading source code to identify vulnerabilities that are unique to a particular technology stack. Its primary use case involves generating tailored attacks based on an application's specific implementation, rather than relying on generic adversarial prompts. Notable features include a modern React dashboard for scan management and compliance tracking, as well as integrations with popular agent frameworks, facilitating extensive security assessments and risk assessments for AI systems.

ASLRay is a Linux-based tool designed for bypassing Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP/NX) in 32-bit and 64-bit ELF binaries through stack-spraying techniques. It leverages shell variables to efficiently exploit buffer overflow vulnerabilities, allowing successful execution of shellcode by circumventing ASLR randomness and exploiting predictable memory addresses. Notable features include cross-platform compatibility, a minimalistic design, and the ability to use return-to-libc techniques for DEP/NX mitigation on x32.

BugTraceAI-CLI is an autonomous offensive security framework designed specifically for bug bounty hunting, effectively integrating LLM-driven analysis with real-world exploitation tools. Its key features include active exploitation of vulnerabilities using SQLMap, browser-based validation, and a focus on actionable outcomes, all while utilizing AI for hypothesis generation and traditional tools for verification. The framework emphasizes a robust methodology that allows users to think analytically, exploit dynamically, and validate thoroughly.

CloudGPT is an AWS vulnerability scanner that assesses customer-managed AWS policies for potential vulnerabilities using ChatGPT. It automatically redacts sensitive information such as account numbers to ensure privacy while querying OpenAI, and primarily focuses on parsing responses to identify vulnerabilities in policies. Users are advised to manually review the outputs for context, as the tool provides initial assessments based on a simplified response format.

HexStrike AI is an advanced, AI-powered penetration testing framework designed for cybersecurity automation, featuring over 150 integrated security tools and more than 12 autonomous AI agents. Its primary use case is to enhance vulnerability assessment and exploitation processes through intelligent decision-making and real-time dashboards, optimizing testing strategies based on target analysis. Notable features include support for multi-agent architecture, a modern visual engine, and capabilities such as attack chain discovery and parameter optimization.

Hoppr-Cop is a CLI and Python library designed for generating comprehensive vulnerability reports from a CycloneDX Software Bill of Materials (SBOM) by aggregating data from multiple open-source vulnerability databases. It effectively combines information from various scanners to reduce duplicates and enhance accuracy, offering output in multiple formats such as CycloneDX VEX and HTML reports suitable for offline use. This tool provides a streamlined method for managing and communicating vulnerability information without the need to regenerate the SBOM frequently.

libformatstr is a Python library designed to facilitate format string exploitation by generating payloads for various scenarios in binary exploitation. It allows users to easily manipulate memory addresses, write ROP chains, and guess argument numbers and padding. Notable features include support for both 32-bit and 64-bit architectures, customized order of writes, and the ability to handle string inputs when constructing payloads.

Vuldash is a comprehensive vulnerability management dashboard designed for ethical hacking projects, enabling collaboration between pentesters and clients. It supports custom plugins, facilitates incident tracking and reporting in both business and technical formats, and allows for online access to reported issues. The platform also features user management capabilities and the ability to import reports from various security tools such as Nmap and Zap Proxy.

PeTeReport is an open-source application vulnerability reporting tool designed to streamline the report writing process for penetration testers and security researchers. Built using Django and Python 3, it facilitates the management of finding templates, detailed report generation in multiple formats (HTML, CSV, PDF, Jupyter, Markdown), and integration with tools like DefectDojo, while offering customizable outputs and a multilingual user interface. Notable features include a findings template database, customizable reports, and the capability to add appendices and attack flows to findings, enhancing the overall efficiency of the reporting phase in security assessments.

Grype is a vulnerability scanner designed for container images and filesystems, allowing users to detect known security issues across various OS package ecosystems and language-specific packages. Notable features include support for multiple image formats such as Docker and OCI, threat prioritization mechanisms like EPSS and KEV, and enhanced scanning capabilities through OpenVEX integration. It streamlines the vulnerability assessment process for developers and security teams by enabling quick scans of container images and SBOMs.

The Vulnerability Compliance Report Tool converts Nessus scan files into formatted HTML reports, tailored for security professionals, auditors, and pentesters. It supports parsing Basic Network and CIS Benchmark scans for various Windows operating systems, enabling users to visually present vulnerability data in a structured and accessible manner. Notable features include a user-friendly dashboard, IP and vulnerability-focused navigation, and customizable templates for report generation.

Educational dependency scanner built in pure Go—parse go.mod and go.sum, inspect direct and indirect modules, query OSV for vulnerabilities, and summarize licenses.

AuditSentry is an AI-powered smart contract auditor designed for analyzing Solidity and Vyper contracts across EVM chains. It leverages 23 specialized AI agents to conduct in-depth security assessments, providing detection of critical vulnerabilities, working exploit proof-of-concepts, and gas profiling, all formatted into professional audit reports within minutes. Notable features include mainnet-fork simulations and on-chain certificates, enhancing both accuracy and trust in the audit process.

The Trivy Operator Dashboard is a security management tool designed for Kubernetes environments, offering comprehensive insights into security posture through detailed reporting on vulnerabilities, policy validation, and compliance assessments. Notable features include user-friendly dashboards for various security reports, including vulnerability and cluster assessments, with capabilities for data export and inspection. The tool aims to streamline security monitoring and response, prioritizing simplicity in its core functionality while considering future enhancements based on community demand.

IDOR-Auto is an advanced testing tool designed specifically to identify Broken Object-Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities by employing differential access testing rather than relying on simple HTTP status codes. It distinguishes itself by utilizing multiple identity responses to determine if one user can access another user's data, while effectively minimizing false positives through robust response comparison, identifier analysis, and support for various input formats. Key features include canary detection, injection point flexibility, identification of encoded IDs, method tampering, and direct raw request importation, making it suitable for authorized security testing in penetration tests and bug bounties.

VulnAPI is an open-source dynamic application security testing (DAST) tool tailored for scanning APIs to identify common security vulnerabilities. It features a command-line interface (CLI) that allows users to discover API details and execute scans using either a curl-like syntax or OpenAPI contracts, delivering comprehensive reports on detected vulnerabilities. Notable functionalities include detailed output reports, integration with OpenAPI specifications for scanning, and the ability to leverage the discover command for gaining insights into target APIs.

ARES-RS is a Rust-based Roblox spoofer designed to protect user accounts from Byfron's detection and Roblox's ban system by modifying hardware identifiers (HWIDs). It features extensive configurability, automatic updates, and enhanced error handling, allowing users to execute spoofing operations either manually or automatically upon closing the Roblox application. Notable capabilities include spoofing BIOS, motherboard, and various hardware components, with recommendations for optimal use alongside a VPN.

Kryon is an autonomous, local-first cybersecurity agent designed for comprehensive offensive security tasks including compliance audits, penetration testing, vulnerability hunting, digital forensics, and incident response from a single command. It features a skill-based architecture that dynamically loads over 110 playbooks and employs deterministic pre-hooks for critical detections, ensuring that it provides both a thorough assessment and actionable outputs without reliance on external APIs. Additionally, it supports a wide range of compliance frameworks across multiple sectors, making it adaptable for various organizational needs.

The Quarkslab repository serves as a comprehensive archive of presentations delivered at various conferences and seminars, focusing on topics related to cybersecurity, reverse engineering, and hardware challenges. It features notable material such as workshop slides and papers on advanced techniques in Bluetooth hacking, binary instrumentation, and exploiting software vulnerabilities. This resource is primarily used for sharing knowledge and promoting discussions within the cybersecurity community through detailed lecture content and insights from industry experts.

Mixeway Flow is a comprehensive DevSecOps tool that integrates security throughout the software development lifecycle (SDLC) by automating scans for security vulnerabilities across various aspects such as source code, dependencies, infrastructure as code (IaC), and potential secret leaks. Notable features include a unified dashboard for centralized threat management, seamless Git integration with automated scans triggered by webhooks, and an upcoming AI/LLM-powered verification engine to enhance vulnerability validation directly within the source code.

The NPM Supply Chain Security Scanner is a robust tool designed to identify vulnerabilities in NPM and PyPI dependencies, specifically targeting known compromised packages associated with significant supply chain attacks from 2025 to 2026. Key features include comprehensive detection of transitive dependencies, integration with multiple programming ecosystems, and careful analysis of installation scripts and entangled dependencies for malicious patterns, alongside automated script options for continuous security monitoring and reporting.

ONUS is a locally-hosted vulnerability assessment and penetration testing tool designed for conducting comprehensive scans on authorized target domains. It features eight parallel scanning modules that assess various security aspects, employs deterministic CVSS v3.1 scoring for findings, and optionally utilizes AI for generating user-friendly remediation instructions, delivering results in both a PDF report and an interactive web dashboard. This air-gapped solution prioritizes simplicity and security, requiring no external dependencies or user accounts for self-hosted deployments.

Cyberful is an AI-driven application-security workbench designed for authorized penetration testing, code auditing, and bug bounty research. It features robust workflows including pentest phases for evaluating live targets, supports isolated tooling for independent verification, and offers report-ready outputs while maintaining a local-first approach without emitting telemetry. Notably, Cyberful emphasizes trustworthiness in security findings by ensuring actions remain within defined authorization boundaries and by providing detailed evidence tied to each engagement.

The CVE-2026-60004-POC tool provides a proof-of-concept for exploiting a pre-authentication remote code execution vulnerability in Gitea versions 1.17 through 1.27.0, with a CVSS score of 9.8. This exploitation occurs via the `diffpatch` API endpoint, allowing attackers to inject malicious Git hooks that execute arbitrary commands by manipulating Git's patch processing. Notable features include two operational modes for automation and the ability to retrieve command output directly from the target server after exploitation.

Xpsd is a vulnerability reachability analysis tool that leverages LLMs to determine if reported vulnerabilities are actually exploitable within a specified codebase. By ingesting CVE descriptions or vulnerability scan reports, it employs structural code navigation and other tools to generate structured verdicts and detailed markdown reports compatible with GitHub code scanning. Noteworthy features include GitHub CI integration, support for multiple vulnerability scanners, and flexible model switching for tailored analysis.

D(HE)ater is a proof-of-concept tool that demonstrates the D(HE)at denial-of-service attack, which targets servers by saturating their CPU through enforced Diffie-Hellman ephemeral (DHE) or elliptic-curve Diffie-Hellman ephemeral (ECDHE) key exchanges over TLS and SSH. It allows users to specify protocols and various settings like key exchange type, socket timeout, and the number of threads for executing the attack, making it suitable for defensive security testing and research purposes. The tool is built on Python 3.9+ and relies on the CryptoLyzer library for traffic generation and DHE/ECDHE support validation.

JoySafeter is an AI-native platform designed to automate and orchestrate security agents at scale, facilitating rapid security operation deployments from concepts to production in minutes. With capabilities such as autonomous APK vulnerability detection and dynamic penetration testing through adaptable DeepAgents, it eliminates the need for extensive manual coordination and integrates seamlessly with over 200 security tools via the MCP Protocol. Its focus on multi-agent collaboration and cognitive memory redefines traditional security methodologies, enabling efficient analysis and reporting with minimal human intervention.

Plecost is a professional security scanner specifically designed for WordPress installations, capable of detecting vulnerabilities in the core, plugins, and themes while referencing a daily-updated local CVE database. It offers various scanning modes, such as deep and fast scanning, along with features like asynchronous scanning, extensive configuration options, and compatibility with task queues like Celery, making it suitable for automated security assessments without any external API dependencies or data sharing.

Secuditor Lite is a Python-based diagnostic security tool designed for Windows environments, facilitating endpoint security assessments through a user-friendly graphical interface. Its primary use case involves identifying vulnerabilities, suspicious activities, and misconfigurations across systems and networks, while providing features like SSL/TLS interception analysis, operational security evaluations, and the generation of structured audit reports. The tool supports comprehensive security checks covering system hardware, network configurations, shared folder permissions, and a variety of security controls.

PWN is an open-source Ruby toolkit designed for offensive security automation, integrating various tools used in OSINT, network scanning, and vulnerability testing within a single workspace. Its primary use case is to streamline red teaming and pentesting efforts by providing a unified framework that supports automation through a tool-calling AI agent and a flexible plugin architecture. Notable features include 66 plugins, support for multiple LLM engines, and a feedback loop system that learns from previous mistakes, enhancing the efficiency of security assessments.

ExploitBot is an AI-powered penetration testing toolkit designed for autonomous operation on Apple Silicon, enabling users to conduct comprehensive pentests without cloud dependency. Notable features include local LLM inference, three distinct interaction modes (Autopilot, Copilot, Manual), integration with major penetration testing tools, and automatic report generation in multiple formats. Additionally, it supports cross-engagement artifact sharing, a local CVE database, and multilingual interfaces, enhancing efficiency in vulnerability discovery and reporting.

The Cybersecurity Handbook is an interactive, open-source knowledge base tailored for cybersecurity professionals, students, and enthusiasts. It offers over 400 comprehensive notes on diverse topics, enhanced by an interactive knowledge graph, full-text search capabilities, and a user-friendly interface that supports dark/light modes and is mobile-friendly. This community-driven resource keeps pace with the rapidly evolving cybersecurity landscape, providing practical insights into real-world threats and defense strategies without any paywalls.

Osv-detector is an open-source auditing tool designed to identify vulnerabilities in software dependencies by leveraging advisory databases that comply with the OSV specification. Its primary use case is to analyze various package lockfiles across multiple ecosystems, including npm, Python, Ruby, and more, enabling developers to efficiently pinpoint security risks in their projects. Notable features include support for a wide range of lockfile formats and the ability to automatically determine the appropriate parser based on the filename.

Awesome Reverse Engineering & Malware Analysis is a comprehensive resource that serves as a curated guide for reverse engineering and malware analysis tools, methodologies, and educational content. It categorizes entries across various disciplines such as static and dynamic analysis, exploit development, and digital forensics while providing quality assurance by checking all links and content for relevance. Notable features include structured learning tracks for different areas of focus, detailed tagging for easy navigation, and inclusion of community resources to enhance collaboration and knowledge sharing.

Android Security is a comprehensive resource aimed at enhancing secure app development for Android through various methodologies such as reverse engineering, vulnerability testing, and data protection best practices. Notable features include a catalog of online analyzers and static analysis tools that facilitate multi-faceted security assessments, providing developers the means to identify and mitigate vulnerabilities within their applications effectively.

Mr.SIP is a console-based SIP security framework designed for auditing and penetration testing of SIP-based systems. It includes three primary modules for network scanning, user enumeration, and Denial of Service (DoS) attack simulations, all leveraging high-performance multithreading and IP spoofing. The tool serves both as a research platform for SIP DDoS attacks and as a practical utility for assessing the security of VoIP infrastructures.

RobustPentestMacro is a versatile Visual Basic macro designed for penetration testing, allowing testers to embed sophisticated post-exploitation techniques into Microsoft Office documents. Key features include platform detection for Windows and MacOS, sandbox evasion mechanisms, WMI persistence for automatic execution at startup, and social engineering tactics to obscure malicious behavior. The macro facilitates easy customization by enabling users to insert tailored payloads through defined functions for both operating systems.

FinDOM-XSS is a specialized tool designed for detecting potential DOM-based XSS vulnerabilities in web applications rapidly. Its primary use case involves scanning specified URLs or lists of URLs to identify any security weaknesses, with the capability of outputting results to a designated file. Key features include its straightforward command-line interface and flexibility in handling multiple URLs through piping, complemented by dependency on LinkFinder for enhanced functionality.

GPTLens is a vulnerability detection tool that leverages the capabilities of the GPT-4 API to analyze and identify vulnerabilities in smart contracts. It incorporates a multi-step auditing process through auditors, critics, and ranking systems, allowing for fine-tuned evaluation of smart contract safety. Notable features include customizable parameters for auditing and critic evaluations, along with support for running user-defined datasets.

MagiskFrida is a tool that enables the automatic execution of the Frida server on device boot across multiple root solutions, including Magisk, KernelSU, and APatch. It supports various architectures such as arm64, arm, x86, and x86_64, and provides instant updates by integrating with the official Frida build process. This tool is particularly beneficial for developers, reverse-engineers, and security researchers looking to leverage dynamic instrumentation in rooted Android environments.

MAVS (Mobile Application Vulnerability Scanner) is a shell script designed for static analysis of Android APK files, focusing on identifying and demonstrating vulnerabilities. Its primary use case is to not only highlight potential security flaws but also provide actionable exploitation techniques, thereby enabling users to understand and mitigate risks effectively. Notable features include verbose output for detailed analysis and direct commands for exploiting vulnerabilities, enhancing the practical applicability of its findings.

aggroArgs is a command-line tool designed for probing and exploiting buffer overflows through aggressive argument testing. It features cyclic pattern overflows with automatic offset calculation, segfault monitoring, and the ability to generate proof-of-concept exploits. The tool supports various probing modes, extensive command-line option parsing, and is tailored for ELF files marked as executable, making it suitable for security researchers and penetration testers assessing software vulnerabilities.

Buffer-Overflow-Exploit-Development-Practice is a tool designed for practicing exploit development against vulnerable software running in a virtual machine environment. It provides a structured approach to mastering buffer overflow exploitation techniques, including steps to find offsets, identify "bad characters," and generate shellcode using tools like msfvenom. Notable features include detailed guidance for verifying jump instructions and crafting exploit buffers, making it particularly useful for cybersecurity professionals preparing for certification exams such as OSCP.

SMBGhost_AutomateExploitation is a Python tool designed to exploit the SMBGhost vulnerability (CVE-2020-0796) and assess the vulnerability of Windows target systems. It automates the process of executing a reverse shell or deploying custom shellcode, allowing users to interact with vulnerable machines directly while providing options for specifying various configurations, such as IP address, architecture, and payload loading. Notable features include retry logic for exploit attempts, a shellcode import function, and a built-in scanner to verify the susceptibility of target hosts.

Win7Blue is a penetration testing tool designed to scan and exploit vulnerabilities related to the EternalBlue exploit (CVE-2017-0143) specifically for Windows 7 systems. It features a vulnerability scanner that utilizes Nmap to detect susceptible targets and includes an architecture identification module to ascertain system architecture. The tool requires several dependencies including Python and Msfvenom for effective exploitation and is primarily tested on the Kali Linux platform.

WindowsExploits is a collection of precompiled exploits for Windows operating systems, primarily focused on privilege escalation vulnerabilities. The repository consists mostly of forked content from another project, providing users with ready-to-use exploit code for security testing and penetration assessments. Notable features include its emphasis on ease of use and accessibility for penetration testers.

Aktaion is an open-source machine learning tool designed for behavior-based detection of ransomware exploits, functioning independently of traditional static signatures. The prototype emphasizes the use of "Microbehaviors" to cohesively analyze multiple security signals and behaviors, supporting a more dynamic intrusion detection framework. The tool has transitioned from Java to Python3, enhancing its accessibility for educational purposes and integration into active defense strategies.

Callisto is an intelligent automated binary vulnerability analysis tool that leverages Ghidra's headless decompiler to extract and analyze pseudo code from binaries for potential security vulnerabilities. It utilizes Semgrep for initial analysis and validates findings with GPT-3.5-Turbo, enhancing accuracy and depth in vulnerability detection. The tool facilitates binary analysis and zero-day vulnerability discovery while providing a straightforward decompilation output for further manual review or integration with existing SAST tools.

PRET (Printer Exploitation Toolkit) is a security testing tool designed for evaluating printer vulnerabilities by exploiting features of PostScript, PJL, and PCL printer languages. Its primary use case is to facilitate communications with a printer to perform various attacks, such as capturing and manipulating print jobs, while also offering functionalities for printer discovery and command execution in a user-friendly manner. Notable features include support for network and USB printers, detailed attack documentation, and command options for safety checks and logging.

CVE-Collector is a Python tool designed to automate the collection of the latest CVE information, specifically targeting vulnerabilities with a severity score of 6 or higher from cvedetails.com. It features a simple delimiter-based file structure for storing collected data, eliminating the need for a traditional database management system, and allows for automated scheduling via cron jobs for continuous monitoring. The tool also provides detailed vulnerability information, including publish dates and associated CWE classifications.

The repository serves as a curated collection of academic papers focusing on topics such as fuzzing, binary analysis, IoT security, and general exploitation techniques. It categorizes publications into read and unread sections, covering various specific implementations and methodologies, including AI advancements in fuzzing and static binary analysis approaches. Users can contribute by suggesting additional relevant papers through pull requests, enhancing the repository's comprehensiveness.

The Pentest Tools Framework is a versatile Python-based platform designed for penetration testing, featuring modules for exploits, scanners, and password management. Its notable capabilities include an intuitive command interface to manage various tools, execute modules, and update the framework easily. This comprehensive toolset is geared towards enhancing security assessments by providing a centralized solution for diverse pen-testing tasks.

Porch Pirate is an OSINT framework designed to conduct reconnaissance on publicly accessible Postman entities, enabling the extraction of sensitive information such as global secrets, unique headers, and endpoints. Its notable features include support for searching, dumping data from workspaces, and extracting URLs for further analysis, all while maintaining flexibility to adapt to varied search needs without being confined to predefined keywords. This tool enhances the efficacy of reviewing Postman assets by providing a simple command-line interface for extensive data enumeration.

SploitScan is a comprehensive tool designed for cybersecurity professionals to efficiently identify exploits related to known vulnerabilities and assess their likelihood of exploitation. Key features include integration with the Exploit Prediction Scoring System (EPSS), a patching priority system based on vulnerability metrics, and the ability to import results from various vulnerability scanners. The tool also provides AI-powered risk assessments, supports multiple CVE handling with export options, and offers a user-friendly interface for streamlined operations.

ThunderCloud is a cloud exploit framework designed for penetration testing of AWS and Azure environments. It features modules for enumerating roles, extracting credentials from vulnerable Cognito endpoints, attacking S3 buckets, and phishing AWS SSO credentials. This tool facilitates various attacks, making it valuable for security professionals assessing cloud infrastructure vulnerabilities.

PEDA (Python Exploit Development Assistance for GDB) is a GDB extension that enhances the debugging experience by colorizing disassembly and providing advanced commands to assist in exploit development. Notable features include utilities for checking binary security options, displaying function arguments, dumping ROP gadgets, and generating shellcode, all streamlined to facilitate the analysis and exploitation of binaries.

The Industrial Security Exploitation Framework (ISF) is an exploitation toolkit written in Python, derived from the NSA Equation Group's Fuzzbunch framework. It primarily facilitates research into industrial control systems by providing modules for controlling various PLCs, performing Modbus injections, and scanning for vulnerabilities. Notable features include support for multiple PLC brands, recovery of Telnet passwords, and a variety of loaded plugins to enhance its functionality.

RouterSploit is an open-source exploitation framework specifically designed for penetration testing of embedded devices. Its modular architecture includes various components such as exploits, credential testing modules, scanners, and payload generators, facilitating comprehensive vulnerability assessments. The framework also supports Bluetooth Low Energy, enhancing its capabilities for testing a broader range of devices.

BootStomp is a boot-loader vulnerability analysis tool focused on identifying memory corruption and state storage vulnerabilities in ARM-compiled boot-loaders. Notable features include a taint analysis capability that tracks data flows and potential exploit paths, integration with tools like angr and IDA PRO, and the option to run analyses within a Docker container for convenience and environmental consistency.

Pacu is an open-source AWS exploitation framework aimed at facilitating offensive security testing within cloud environments. Its primary use case is for penetration testers to identify and exploit configuration vulnerabilities in AWS accounts using various modules that allow for attacks like user privilege escalation and Lambda function exploitation. Notable features include session management for storing AWS keys, a modular architecture enabling easy extension of functionalities, and comprehensive command support for executing different exploitation techniques.

PEGASUS-NEO is an advanced penetration testing framework that integrates a variety of security tools and custom modules aimed at aiding security professionals and ethical hackers in their assessments. Its primary use case includes reconnaissance, exploitation, and web hacking, supported by notable features such as automated exploitation, vulnerability scanning, and social engineering tools. The framework also provides functionalities for wireless attacks, code scanning, and forensic analysis, making it a comprehensive solution for penetration testing.

Vuln-Bot is a high-risk CVE intelligence platform designed to track and analyze critical and high-severity vulnerabilities with a probability of exploitation (EPSS) of 60% or higher. It automatically harvests and publishes vulnerability briefings every four hours, leveraging multiple authoritative data sources, including the CVEProject repository, and features advanced filtering, risk scoring, and interactive visualizations on an Alpine.js dashboard. Notable capabilities include mobile-first design, incremental harvesting for faster updates, and a robust CI/CD pipeline for security assurance.

CVE-2025-55182 is a tool designed to exploit a critical prototype pollution vulnerability in React and Next.js Server Actions, allowing for Remote Code Execution (RCE). It features an automated scanning capability via a Nuclei template and a manual exploitation script in Python, enabling the execution of arbitrary commands on vulnerable servers while extracting output effectively from response headers. This tool aims to assist security professionals in assessing the impact of this vulnerability on affected versions of React and Next.js.

The "Deep Learning for Code-centric Software Vulnerability Assessment" repository provides tools and data for assessing vulnerabilities in C/C++ code using deep learning models. Its primary use case is to facilitate automated vulnerability detection through various machine learning approaches, including both graph-based and non-graph models, with provisions for multitask learning. Notable features include a structured organization of data and model scripts, as well as detailed instructions for running each model.

Embedding Poisoning provides a data-free backdoor attack method for NLP models, allowing attackers to compromise the embedding layers by modifying a single word embedding vector without needing access to task-related datasets. The tool is particularly useful for sentiment analysis and sentence-pair classification tasks, facilitating experiments and demonstrating the vulnerabilities of embedding layers in common NLP tasks. Notable features include dataset preparation scripts, functionality for data-poisoning and testing, and compatibility with Hugging Face's Transformers library.

FIDL is a Python library designed to facilitate the use of the decompiler API within IDA Pro, focusing on vulnerability research and bug hunting in binaries. It provides a set of utilities that simplify the decompilation process for reverse engineering tasks, making it accessible for both specific security assessments and wider reverse engineering applications. Notable features include easy installation via pip, support for development mode with live editing, and comprehensive online documentation.

LLMGrep is an advanced security analysis tool that leverages the capabilities of Large Language Models and Semgrep for comprehensive vulnerability scanning and code analysis. It features a dual-engine mechanism for static analysis, AI-driven insights for vulnerability assessment, and the ability to generate custom security rules, enhancing the overall security posture of codebases. Additionally, users benefit from context-aware discussions and actionable suggestions to improve code quality and adhere to security best practices.

Oversight is a modular, web-based framework designed for the reverse engineering and red teaming of Large Language Models (LLMs). It features a plugin-based architecture allowing users to extend functionality, while providing tools for adversarial testing, prompt fuzzing, and layer analysis. The framework facilitates ease of use with an intuitive interface and the ability to generate detailed analysis reports, making it suitable for vulnerability research in LLM applications.

ReposVul is a high-quality, repository-level vulnerability dataset designed to support vulnerability detection tasks within software projects. It features a comprehensive framework for data collection, including modules for vulnerability untangling, multi-granularity dependency extraction, and trace-based filtering, allowing for the analysis of 6,134 CVE entries across multiple programming languages. This dataset aids researchers and practitioners in identifying and mitigating vulnerabilities more effectively by providing detailed, organized information on code changes and their interrelations.

This repository presents a systematic study on code obfuscation techniques aimed at thwarting vulnerabilities detected by LLM-based models. It includes components for managing obfuscated and unobfuscated code, auditing and evaluating LLM vulnerability detection results, and a suite of customizable scripts and tools for code obfuscation and analysis. Notable features include pre-existing datasets across various programming languages, integration with multiple LLM auditor models, and the capability to configure the environment for experimental setups.

CVE-Bench is a benchmarking tool designed to evaluate AI agents' capacities to exploit real-world web application vulnerabilities, specifically utilizing critical-severity Common Vulnerability and Exposure (CVE) data. The tool enables automated assessments through tasks like denial of service, remote code execution, and unauthorized access, leveraging Docker for consistent environments and reproducible results. Notable features include a focused dataset of 40 CVEs, integration of automatic exploits, and support for various attack vectors, making it a pivotal resource for researchers in AI safety and security evaluation.

KitPloit_Arsenal is an advanced security search engine that aggregates exploits and security vulnerability news to assist cybersecurity professionals and researchers. Its primary use case is to enhance penetration testing and threat assessment activities by providing a centralized resource for security tools and information. Notable features include a stable release built with Python 2.7 and a user-friendly interface that supports the open-source community.

`mimikittenz` is a post-exploitation PowerShell tool designed for extracting sensitive data, including plain-text passwords and various types of private information, from the memory of running processes using the Windows `ReadProcessMemory()` function. It supports a wide range of data extraction, including webmail credentials, financial application data, and more, employing customizable regular expressions for targeted information retrieval. Notable features include the ability to target specific processes and the flexibility for users to add custom regex patterns for further data extraction needs.

OWASP Xenotix XSS Exploit Framework is a sophisticated tool designed for detecting and exploiting Cross Site Scripting (XSS) vulnerabilities. It boasts zero false positive scanning through its Triple Browser Engine and features over 1500 distinct XSS payloads, facilitating both vulnerability detection and WAF bypass. Additionally, it includes a comprehensive information gathering module and offensive XSS exploitation capabilities aimed at penetration testing and proof of concept development.

PwnXSS is a Python-based XSS scanner designed to identify cross-site scripting vulnerabilities in web applications. Its primary use case involves crawling websites to detect potential XSS weaknesses in both GET and POST forms through customizable settings and advanced error handling. Notable features include multiprocessing support, the ability to handle various HTTP methods, and the option to configure proxies and user agents for more thorough testing.

Rex is a tool designed for advanced crash triaging, exploration, and exploitation of vulnerabilities, particularly focusing on crash scenarios like buffer overflows. Its notable features include the ability to generate exploits that manipulate registers, leak memory, and export them in various formats (C, Python, binary) while supporting Linux ELF binaries. Rex also enables users to explore crashes to identify exploitation primitives and assess the reliability of generated exploits against specific defenses.

The Trail of Bits Skills Marketplace is a plugin repository designed to enhance AI-assisted security analysis, testing, and development workflows, compatible with the Claude Code platform. It provides a variety of plugins focused on smart contract security, code auditing, and other advanced security techniques, allowing users to efficiently integrate tools for vulnerability assessment and code review into their processes. Notable features include support for multiple blockchains, GitHub Actions auditing, and customizable static analysis workflows, enhancing the overall security posture of software projects.

ATSCAN is an advanced mass scanning tool designed for automated vulnerability assessment, allowing users to perform extensive searches for exploits and issues across multiple search engines, including Google, Bing, and Shodan. It boasts features like mass dork searching, exploitation capabilities, automated command execution, and the ability to detect various web vulnerabilities such as XSS, SQL injection, and file inclusion. The tool is written in Perl, supports proxy usage, and provides options for random user agents and engines to enhance anonymity during scans.

Awesome Fuzzing is a curated repository that aggregates resources related to fuzzing and exploit development, offering a comprehensive selection of books, courses, videos, tools, and vulnerable applications for practitioners and learners. Notable features include categorized sections for various types of fuzzers, including cloud, file format, network protocol, and browser fuzzers, as well as resources for directed fuzzing and anti-fuzzing techniques. This repository serves as an essential learning platform for cybersecurity professionals seeking to enhance their skills in vulnerability detection and analysis.

The "Awesome Node.js for pentesters" repository provides a curated list of Node.js packages tailored for penetration testing, exploitation, reverse engineering, and cryptography. Its primary use case is to serve as a comprehensive toolkit for security professionals, featuring various modules for tasks such as OSINT, network scanning, brute-forcing, and post-exploitation techniques. Notable features include integration with the OWASP ZAP API, access to Shodan and Censys APIs, as well as utilities for geolocation and fingerprinting.

Priv2Admin is a security analysis tool designed to interpret Windows OS privileges and their potential impacts on system security, specifically addressing threats to administrator access, integrity, confidentiality, and availability. It prioritizes using built-in commands, PowerShell scripts, and other methods to evaluate an environment's privilege landscape, allowing users to identify and mitigate risks associated with privilege escalation. The tool provides detailed descriptions of various Windows privileges, their implications, and potential exploitation methods via external tools.

DiverseVul is a specialized dataset designed for deep learning-based vulnerability detection in source code. It includes 7,512 vulnerable code snippets and provides comprehensive metadata, enabling researchers to evaluate and enhance vulnerability detection models effectively. Notable features include detailed commit and repository links, as well as resources for conducting label noise analysis, facilitating advanced research in the field of software security.

Exploit Collector is a repository that curates a selection of exploits, providing details for each exploit along with credit attribution. Its primary use case is to serve as a resource for researchers and cybersecurity professionals interested in various exploits for educational and testing purposes. Notably, it includes both well-known exploits and some original contributions from the repository's author.

BeEF, or The Browser Exploitation Framework, is a penetration testing tool specifically designed to assess web browser security by employing client-side attack vectors. Its primary use case involves hooking web browsers to serve as launch points for directed command modules and additional attacks, thereby exploiting the inherent vulnerabilities within the browser environment. Notable features include its focus on circumventing traditional network defenses and targeting web-borne threats in a systematic manner.

Pown.js is a modular security testing and exploitation toolkit developed in Node.js, emphasizing flexibility through standalone NPM modules rather than a monolithic framework. It provides users with a command-line interface to manage modules, execute scripts, and automate tasks, allowing for the easy integration of custom tools and features. Notably, Pown.js facilitates the installation and management of additional modules from the NPM registry, enhancing its functionality and adaptability in various security testing scenarios.

DefectDojo is a comprehensive DevSecOps and application security posture management tool that facilitates vulnerability management by orchestrating security testing, tracking vulnerabilities, and generating detailed reports. Its notable features include integration with various scanning tools, deduplication of findings, and provisions for both a Community Edition and a Pro Edition, allowing for flexible deployment options via Docker.

PPPwn-Luckfox is a low-cost exploit tool designed for various PS4 firmware versions (up to 11.00) using compatible Luckfox Pico models. It features a web server interface for changing settings, executing exploits, and injecting payloads, while providing configuration options through a JSON file. Users are cautioned about known shutdown issues and can contribute to the project through pull requests for enhancements and bug fixes.

The COD Exploits repository catalogs various vulnerabilities in Call of Duty, providing proof-of-concept demonstrations for each identified exploit. It includes notable vulnerabilities such as Steam-Auth and Huffman, along with their associated CVE-IDs. The tool is intended strictly for academic research, emphasizing responsible usage to prevent misuse.

CVE-2020-0683 is a proof-of-concept (PoC) exploit targeting a Windows Installer elevation of privilege vulnerability. The tool includes source code for Visual Studio C++ 2017 and provides a compiled executable to demonstrate the exploit. Key features include detailed documentation in a PDF for step-by-step reproduction of the exploit.

FirebaseExploiter is a CLI-based tool designed for the mass scanning and exploitation of insecure Firebase databases. Its key features include the ability to scan multiple hosts for vulnerabilities, upload custom JSON data via a specified URI path during exploitation, and generate results that verify the exploitation of identified vulnerabilities.

iblessing is an iOS security exploiting toolkit designed for application information gathering, static analysis, and dynamic analysis. Notable features include a cross-platform architecture, Mach-O parsing, a comprehensive scanner for dynamic analysis of arm64 assembly code, and tools for simulating Mach-O execution to uncover key information or attack surfaces. The toolkit integrates multiple engines such as Unicorn, Capstone, and Keystone to enhance its capabilities in handling Objective-C and Swift classes.

IRIS is a neurosymbolic framework that integrates large language models (LLMs) with static analysis for the detection of security vulnerabilities in software projects. It analyzes codebases by taking a project and a specified Common Weakness Enumeration (CWE) type as input, and produces potential vulnerability reports along with data on their related CVEs. Notable features include the CWE-Bench-Java dataset, which contains 213 CVEs across 49 CWEs, manual extraction of source and sink specifications, and Docker integration for streamlined deployment.

SafeLine is a self-hosted Web Application Firewall (WAF) designed to secure web applications by filtering and monitoring HTTP traffic, thereby protecting against a wide range of attacks, including SQL injection, XSS, and code injections. Key features include proactive defense against bot abuse, HTML and JavaScript code encryption, IP-based rate limiting, and customizable web access control lists, ensuring comprehensive protection for web services.

The Mandiant Vulnerability Disclosures repository catalogs vulnerabilities identified by Mandiant, including those discovered through internal research and Red Team engagements. It serves as a resource for tracking these vulnerabilities, providing potential proof of concepts, and is governed by specific licensing for both CVE-related information and source code. Notably, Mandiant operates as a CVE Numbering Authority, focusing on both its own code and relevant third-party vulnerabilities.

exrs is a collection of exercises focused on reverse engineering and exploitation, specifically using 64-bit ELF binaries. The tool primarily serves as a training platform, enabling users to solve challenges by reverse engineering binaries to achieve objectives such as executing code or spawning shells. Notably, the exercises enforce a clear separation from traditional cracking methods, emphasizing interaction via standard input/output as if engaging with a remote service while maintaining compatibility with NX and ASLR protections.

nysm is an eBPF stealth container designed to facilitate the post-exploitation of systems by making offensive tools undetectable to system administration utilities. It achieves this by obscuring new eBPF programs, audit logs, PIDs, and sockets from tools like bpftool, ps, and auditd. Key features include the ability to run commands in a hidden context, with options for background execution and self-destruction after use.

OverRide is a cybersecurity training tool designed to explore disassembly, binary exploitation, and reverse-engineering through a series of ten progressively challenging levels. Each level includes a reverse-engineered binary, assembly disassembly notes, and a password required to advance, encouraging users to identify and exploit vulnerabilities using tools like GDB. Notable features include hands-on challenges such as Ret2Libc attacks, format string vulnerabilities, and stack overflows, making it an effective resource for enhancing penetration testing skills.

PaxOS 8 is a lightweight operating system specifically designed for PaxoPhones, featuring a multi-platform emulator that allows users to run the system on various operating systems including Linux, Windows, and macOS. Its notable features include easy build instructions across multiple platforms, comprehensive setup guidance, and included dependencies for streamlined compilation. This tool is ideal for developers looking to emulate and experiment with the PaxOS environment on their local machines.

ExploitGym is a comprehensive benchmarking platform designed to evaluate the capabilities of AI agents in exploiting a variety of real-world vulnerabilities present in userspace programs, Google's V8 engine, and the Linux kernel. It features a large-scale set of 869 instances and includes detailed setup and evaluation processes, as well as the ability to disable system defenses for more effective testing. This tool serves as an essential resource for researchers aiming to understand AI's effectiveness in security exploit development.

The Hacker Pager is a modified version of the Meshtastic project, designed specifically for the Hacker Pager hardware, enabling wireless messaging and LoRa communication functionality. Its primary use case includes long-range, low-power messaging and telemetry over a decentralized mesh network, suitable for outdoor and emergency scenarios. Notable features include support for multiple hardware platforms and the ability to share text messages and locations without relying on internet or cellular infrastructure.

The semgrep-rules repository provides a curated set of Semgrep rules specifically designed for vulnerability research in C and C++ codebases. Its primary use case involves static analysis to detect various security vulnerabilities, such as the use of insecure API functions and potential buffer overflows, thereby enhancing code security. Notable features include easy integration with Semgrep for scanning, support for generating outputs in SARIF format for further analysis, and a focus on high-priority vulnerability detection.

The "local-root-exploits" repository provides a curated collection of local privilege escalation exploits for Linux systems. Its primary use case is to facilitate security research and testing by demonstrating vulnerabilities that can be exploited to gain root access on local Linux environments. Notable features include organized categories of exploits for different Linux kernel versions and configurations.

This tool demonstrates a local privilege escalation exploit for Sudo versions 1.6.x up to 1.6.9p21 and 1.7.x up to 1.7.2p4, specifically addressing the vulnerability in the sudoedit command that allows arbitrary command execution as the root user. The primary use case is to set up a vulnerable Docker environment for educational testing, enabling attackers to exploit the flaw and gain root access. Notable features include the provision of a simple Docker setup and a scripted exploit for demonstration purposes.

This repository provides a local privilege escalation exploit for the Sudo vulnerability identified as CVE-2015-5602. It utilizes a flaw in the sudoedit functionality that allows a malicious user to exploit symlink attacks, enabling them to gain root access by modifying sensitive files. The tool includes a Docker setup for mimicking a vulnerable environment, along with an exploit script for demonstration purposes.

The rewolf-pcausa-exploit is a Windows local privilege escalation tool targeting the PCAUSA Rawether vulnerability. Its primary use case is to enable users to gain elevated permissions within a Windows environment, exploiting specific weaknesses in the PCAUSA driver. Notable features include its focus on local escalation and detailed documentation linked for further information.

The `amd_eop_poc` tool serves as a proof of concept for exploiting a privilege escalation vulnerability (CVE-2020-8950) within the AMD User Experience Program Launcher associated with Radeon Software. Its primary use case is to demonstrate the FileWrite escalation of privileges, enabling unauthorized access to system resources. Notable features include detailed documentation and references to external resources for further context on the vulnerability.

Anyelevate is a Windows x64 privilege escalation tool that leverages the anycall technique to elevate the privileges of a specified process by copying the system process token into the target process's context. The tool operates by manipulating physical memory to enable the execution of tasks with NT AUTHORITY\SYSTEM privileges, making it particularly useful for security researchers and penetration testers looking to demonstrate or exploit privilege escalation vulnerabilities. Notable features include its simplicity of use and the ability to specify a process ID for targeted elevation.

Awesome Infosec is a curated collection of Information Security resources and tools designed to aid individuals in their studies and practices of cybersecurity. It encompasses various topics, including recon, web security, penetration testing, and exploit development, while also providing links to educational courses and labs. The continuously updated repository serves as a valuable resource for both beginners and experts in the field.

AymanSecNotes is a personal compilation of cybersecurity notes in PDF format, primarily serving as a self-study resource for various security domains including mobile, web, and networks. Notable features include plans for future enhancements such as a comprehensive cheatsheet, the transition from PDF to Markdown format, and the inclusion of methodologies and bug hunting tips, aimed at facilitating practical learning and knowledge sharing within the cybersecurity community.

ByeIntegrity Lite is a tool designed to exploit a shell protocol handler hijack to bypass Windows User Account Control (UAC) and achieve elevated privileges for executing programs at a higher integrity level. It specifically alters the handler for the `ms-settings` protocol to redirect it to `cmd.exe`, allowing execution of `fodhelper.exe`, which inherits elevated tokens. Notable features include its simplicity and compatibility with all versions of Windows 10; however, there are no precompiled binaries available to prevent misuse.

ByeIntegrity is a tool designed to bypass Windows User Account Control (UAC) in order to gain elevated Administrator privileges for executing programs at a high integrity level. Its notable features include the ability to hijack DLLs in the Native Image Cache (NIC) without relying on existing native images and the use of an auxiliary file generator (AUXGen) to facilitate the loading of shellcode without direct dependency on system resources. The latest update enhances its speed, reliability, and usability by streamlining the hijacking process and minimizing the initial configuration overhead.

ByeIntegrity 2.0 is a tool designed for bypassing Windows User Account Control (UAC) to gain elevated administrator privileges by leveraging a specific elevated COM interface associated with the Internet Explorer Add-on Installer. It features a methodical approach utilizing the `COMAutoApprovalList` registry key to execute arbitrary programs via an elevated instance of `cmd.exe`, thereby circumventing UAC restrictions. This iteration builds on previous designs, sharing core functionality with the UACMe project while incorporating unique lolbin usage for execution.

ByeIntegrity 3.0 is a tool designed to bypass Windows User Account Control (UAC) to achieve elevated privileges for executing arbitrary programs. It employs an elevated COM interface alongside a shell protocol handler hijack, allowing seamless execution of commands like `cmd.exe` with admin rights. Notable features include the use of the `IWscAdmin` interface and the ability to manipulate URL protocol associations to facilitate the UAC bypass in various Windows versions.

ByeIntegrity 4.0 is a cybersecurity tool designed to exploit User Account Control (UAC) vulnerabilities in Windows for bypassing security mechanisms and achieving elevated privileges. It modifies the `windir` environment variable and utilizes a custom URL protocol to launch `cmd.exe` as an administrator, successfully circumventing UAC protections. Key features include the leveraging of COM interface methods and environment variable manipulation, making it an effective tool for demonstrating UAC bypass techniques in Windows environments.

ByeIntegrity V is an advanced tool designed to bypass User Account Control (UAC) across all notification levels, granting elevated Administrator privileges to execute any program. Utilizing a combination of DLL hijacking, environment variable manipulation, and the Task Scheduler, it effectively circumvents UAC prompts by launching tasks with the "Run with highest privileges" setting enabled. This tool is particularly notable for its ability to operate without requiring administrator access initially or modifying critical system components, making it a stealthy approach for privilege escalation in Windows environments.

ByeIntegrity 8.0 is a sophisticated Windows privilege escalation tool that exploits design and security flaws in the operating system, operational even with User Account Control (UAC) set to the highest level. It utilizes the Task Scheduler to trigger the WDI ResolutionHost task, manipulating environment variables to load a custom payload that executes with elevated privileges. Key features include controlled event triggering via ETW and direct communication with the Program Compatibility Assistant, enabling a bypass of potential policy restrictions.

This repository provides a proof-of-concept (PoC) for exploiting the CVE-2020-1034 vulnerability, which allows for privilege escalation on unpatched Windows 10 systems. It is primarily used for security research and understanding the exploitability of this specific vulnerability, with notable features including documentation links for deeper insight into exploitation techniques and the context of the vulnerability's discovery and remediation.

The CVE-2020-28243 tool exploits a command injection vulnerability within SaltStack's Salt, allowing for privilege escalation on affected minions when the master executes the `restartcheck` command. Notable features include a straightforward exploit script (`exploit.sh`) for executing arbitrary commands, and the capability to utilize pre-compiled static binaries if gcc is unavailable on the target system. This tool targets SaltStack versions from 2016.3.0rc2 to 3002.2, requiring specific access permissions to function effectively.

CVE-2021-27965 is a proof-of-concept (PoC) exploit targeting a local privilege escalation vulnerability in the MICSYS Windows driver, MsIo64.sys. This tool leverages stack-based buffer overflow in the driver's IOCTL dispatch routine, allowing arbitrary physical memory mapping, port access, and potential system crashes. Notable features include the ability to execute IOCTL requests that bypass Windows security mechanisms, facilitating unauthorized access to system-level operations.

The cve-2022-21882-poc repository provides a proof of concept (PoC) for the local privilege escalation vulnerability identified as CVE-2022-21882. Its primary use case is to demonstrate the exploitability of this vulnerability in a controlled environment, facilitating security research and testing. Notable features may include detailed instructions for replication of the exploit and potential impacts of the vulnerability.

The Privileged Access Management (PAM) repository is a curated collection of resources that encompasses software best practices, techniques, libraries, frameworks, and educational materials related to securing and managing privileged access to critical assets in cybersecurity. Notable features include categorized content for various platforms such as Linux and Windows, as well as practical guides on privilege escalation methods and access control strategies. This community-driven initiative aims to facilitate knowledge sharing and enhance best practices in the field of PAM.

Delete2SYSTEM is a tool designed to exploit arbitrary file and directory deletion vulnerabilities to achieve NT AUTHORITY\SYSTEM privileges on Windows systems. Utilizing methods derived from known techniques, it specifically targets deletion of critical folders related to Windows Error Reporting and Windows Media Player, leveraging vulnerabilities such as CVE-2020-1170 and CVE-2020-1571. Notable features include integration with the NtApiDotNet library and the ability to weaponize Windows services for privilege escalation.

Dirty Sock is a privilege escalation tool for Linux systems that exploits a vulnerability in the snapd API, allowing unauthorized user creation and root access. It provides two versions: the first requires an internet connection and SSH service to create a local user using Ubuntu SSO, while the second operates without these requirements, leveraging the installation of a "devmode" snap to execute arbitrary commands and bypass access controls. Notably, the tool can be used on both Ubuntu and other distributions with the snapd package installed, making it versatile in various environments.

The Docker Privesc script is designed to exploit misconfigurations in Docker environments for privilege escalation purposes. Its primary use case is to gain elevated permissions by leveraging Docker's default configurations, especially in scenarios where a user has access to run Docker on a target system. Notable features include simple usage instructions, requirements for operational conditions, and illustrations of potential mitigation strategies to prevent such attacks.

The "am0nsec/exploit" repository serves as a collection of exploit scripts and related resources, although the majority of the artifacts are not original contributions from the maintainer. Its primary use case is to provide a centralized resource for penetration testers and security researchers seeking various exploits. Notably, it includes links to the maintainer's social media and personal website for further engagement.

libinject is a static library designed for DLL injection into Windows x64 processes, featuring handle elevation capabilities to bypass certain protections. It enables users to obtain a process handle with higher privileges using elevated access, facilitating interaction with protected processes for debugging or analysis purposes. Notable features include process handle acquisition, memory allocation in target processes, and remote thread creation to execute the injected DLL.

Linux Kernel Exploitation is a laboratory tool designed for practicing various exploitation techniques within the Linux kernel environment. It covers advanced exploitation methods such as ret2user, memory manipulation strategies, and kernel information leaks, while providing comprehensive guidelines for compiling and preparing kernel modules and necessary utilities. Notable features include detailed instructions for building kernel sources, configuring BusyBox, and setting up an initial filesystem for testing.

Love.exe is a development tool designed for exploitation and penetration testing in Windows environments, specifically optimized for Windows 10 and 11 with default UAC settings. It offers functionalities to assist security professionals in identifying vulnerabilities within applications, and it encourages community engagement for enhancements and support. The repository is currently under active development, indicating ongoing updates and feature additions.

MIDA - Multitool is a comprehensive Bash script designed for system enumeration, vulnerability identification, and privilege escalation after system compromise. It integrates features from previous scripts like SysEnum and RootHelper, allowing users to gather detailed system information, check for useful utilities, download external tools, and search for potential cleartext credentials. Notably, it provides a robust framework for facilitating various tasks crucial for post-exploitation activities.

Mobile Heavy Artillery is a comprehensive toolkit designed for red teaming operations, facilitating reconnaissance, exploitation, and privilege escalation tasks. It includes a curated collection of open-source tools for network enumeration, web vulnerability assessment, secrets discovery, and OSINT activities, all easy to install and manage through a makefile. Notable features include a wide range of utilities for various cybersecurity processes, making it a versatile choice for penetration testers and security researchers.

PE-Linux is a Linux privilege escalation tool designed to gather extensive system and environment information to identify potential vulnerabilities and misconfigurations. Its primary use case is to assist security professionals in auditing Linux systems for privilege escalation risks through features such as user enumeration, vulnerability checks, log analysis, and the collection of sensitive information like passwords and SSH keys. Notable features include kernel vulnerability checks, cron job enumeration, and detailed system information gathering to facilitate privileged access exploitation assessments.

The polkadots tool is a local privilege escalation exploit targeting CVE-2021-3560, allowing the creation of a new privileged user to gain root access on affected Linux distributions such as RHEL 8, Fedora 21, Debian testing, and Ubuntu 20.04. It includes functionality to generate hashed passwords using OpenSSL, enabling users to customize account credentials during the exploit execution. Notable features include customizable account names and password hashes, along with default settings for easy deployment.

The Privilege Escalation tool in this repository is designed for conducting structured labs on AWS IAM privilege escalation techniques. Its primary use case is to educate users on identifying vulnerabilities and exploiting permission misconfigurations within AWS environments, utilizing tools like Pacu and AWS-IAM-Permissions-Scanner. Notable features include step-by-step guides for creating low-privilege IAM users, testing permissions, and demonstrating privilege escalation methods through policy manipulation.

The pwk-oscp repository serves as a comprehensive resource for aspiring penetration testers preparing for the OSCP certification, offering a curated collection of scripts, guides, and links to vulnerable machines and challenges. Notable features include categorized sections for enumeration, privilege escalation techniques, and certification resources, alongside curated lists of relevant literature and practical exercises from platforms like HackTheBox and VulnHub. This tool is particularly useful for individuals seeking structured guidance and useful materials throughout their penetration testing journey.

RootHelper is a Linux privilege escalation tool that facilitates the exploitation process on compromised systems through an array of eleven scripts designed for enumeration, exploit suggestion, and deployment. Notable features include support for command-line flags for quicker access and execution, as well as a collection of additional tools for enumeration and exploit deployment, such as Auto-Root-Exploit and Linux Smart Enumeration. This comprehensive suite aids penetration testers in efficiently performing privilege escalation tasks.

Rust-Privesc is a collection of proof-of-concept (POC) tools designed to demonstrate User Account Control (UAC) bypass techniques implemented in Rust. It includes methods such as exploiting fake trusted directories and manipulating environment variables to execute command shell processes. Notable features include straightforward implementations of UAC bypass methods and the execution of `cmd.exe` as a default behavior.

SUIDer is a Linux script designed to streamline the privilege escalation process by identifying exploitable binaries with the SUID bit set. It leverages GTFObins to provide relevant exploitation methods and generates links for reference. Notably, it emphasizes caution, as some SUID binaries may require custom methods not covered by the provided resources.

Suidsploit is a penetration testing tool designed to exploit 137 files with the Suid bit set, enabling attackers to potentially gain elevated privileges on a target system. Its primary use case includes obtaining a root shell, accessing sensitive files such as /etc/shadow, and establishing reverse shells. Notable features include the ability to download the tool via a simple HTTP server and its focus on user-friendly execution on both the attacker's and victim's machines.

Active-Directory-Exploitation is a comprehensive PowerShell-based toolkit designed for conducting penetration testing and security assessments on Active Directory environments. Its primary use case is to enumerate domains, escalate privileges, enable lateral movement, and achieve persistence through various methodologies, including Kerberos ticket manipulation and exploitation of SQL Server trusts. Notable features include extensive modules for local and domain privilege escalation, detailed methods for lateral movement and persistence, and capabilities for cross-forest attacks.

ChainReactor is an AI-driven tool designed to automate the discovery of privilege escalation chains on Unix systems. By analyzing system information and known vulnerabilities, it models the escalation process using Planning Domain Definition Language (PDDL) to generate potential exploitation chains. Notable features include its ability to rediscover existing exploits, identify new chains, and its successful evaluation on various platforms, including Amazon EC2 and Digital Ocean.

Confluence Hack is a tool designed to exploit CVE-2023-22515, enabling the creation of a new administrative user and compromising audit logs in Confluence servers. It features a web-based command shell plugin that allows for executing commands remotely, verified to work on Confluence Server 8.5.1. The repository is intended for educational purposes only and emphasizes ethical use.

CVE-2022-27502 is a DLL hijacking exploit targeting RealVNC Server versions up to 6.9.0, allowing for arbitrary command execution by leveraging a vulnerable installation process. The tool enables users to execute any command through a crafted DLL that captures the output in a specified output file. Notable features include the ability to modify the executed command by editing specific code lines and recompiling the DLL.

This repository provides an exploit for the Parallels Desktop vulnerability CVE-2023-27326, which allows local attackers to escalate privileges on affected installations. The exploit targets a flaw in the Toolgate component, enabling the execution of arbitrary code due to inadequate validation of user-supplied paths in file operations. It is notable for its specific applicability to version 18.0.0 of Parallels Desktop and the details of its exploitation, which are documented alongside a proof of concept.

Wall-Escape (CVE-2024-28085) is an exploit tool designed to leverage a vulnerability in the util-linux wall command that allows attackers to inject escape sequences into command line arguments, potentially leaking sensitive information such as user passwords. The tool sets up an environment to execute commands while monitoring for password input, effectively capturing credentials during user interactions—particularly in contexts like SSH login or sudo commands. Notable features include the ability to manipulate command outputs and create a fake prompt that misleads users into revealing their passwords.

CVE-2024-33352 identifies a critical vulnerability in BlueStacks for Windows, affecting versions prior to 10.40.1000.502. This flaw allows unprivileged users to access and modify configuration files stored in a world-writeable directory, enabling them to backdoor the virtual machine and gain code execution as a privileged user by manipulating shared folder settings. The README provides a detailed exploitation method and emphasizes the necessity of updating to a patched version to mitigate this security risk.

Cybersec Notes is a comprehensive, expandable checklist aimed at individuals seeking to enhance their knowledge in various cybersecurity domains, including application, mobile, API, and network security. The tool features a structured outline of key topics and vulnerabilities, supplemented with resource links, while encouraging community contributions for continuous improvement and accuracy. Notable aspects include coverage of OWASP Top 10 vulnerabilities across multiple platforms and concepts related to DevSecOps.

DeadPotato is a privilege escalation tool designed to exploit the DCOM RPCSS vulnerability to gain NT AUTHORITY\SYSTEM level access on Windows systems. Its primary use case includes executing commands, creating new administrator accounts, establishing reverse shells, and dumping sensitive credentials using various modules like `-cmd`, `-newadmin`, and `-mimi`. Notable features include the ability to disable Windows Defender and collect domain data for BloodHound, making it versatile for penetration testing and security assessments.

EPScalate is a proof-of-concept exploit that targets an elevation of privilege vulnerability (CVE-2023-31497) in QuickHeal's Seqrite Enterprise Endpoint Security solution. The tool leverages weak permissions on directory and file installations, enabling low-privilege users to escalate privileges to root by overwriting executable files or manipulating startup scripts. Notable features include the ability to perform privilege escalation via either daemon binary overwrites or injecting reverse shell commands into system initialization scripts.

The HackTheBox repository contains write-ups detailing the author’s solutions to various HackTheBox machines, primarily aimed at preparing for the Offensive Security Certified Professional (OSCP) certification. Notable features include comprehensive problem-solving approaches and methodologies applicable to penetration testing scenarios.

The Jr Penetration Tester repository provides solutions and an answer key for the Penetration Tester learning path on TryHackMe, aimed at equipping users with essential skills for a career in penetration testing. It covers various critical topics, including web hacking, Burp Suite, network security, vulnerability research, and exploitation techniques using Metasploit. Notable features include comprehensive sections that guide learners through foundational concepts and practical applications in cybersecurity.

Linux-Kernel-VR-Exploitation is a toolset designed for vulnerability research and exploitation specifically targeting the Linux and Android kernel. It provides a comprehensive environment setup guide, along with resources for exploitation tutorials, practice playgrounds, and detailed academic research papers, facilitating both practical experimentation and theoretical understanding of kernel vulnerabilities. Notable features include curated links to extensive educational materials, CTF challenges for skill development, and insights into kernel tracing and various exploitation techniques.

The Linux-Privilege-Escalation tool provides a comprehensive set of techniques for escalating privileges on Linux systems. Its primary use case includes identifying vulnerabilities related to kernel exploits, file permissions, and sudo configurations, while notable features include detailed methods for exploiting kernel vulnerabilities, leveraging GTFOBINS for privilege escalation, and examining scheduled tasks and SUID binaries for potential exploitation paths.

MSAPer is an automated mass exploitation tool designed for identifying and exploiting the CVE-2023-3076 vulnerability in MStore API versions below 3.9.9, which enables unauthenticated privilege escalation through mass addition of admin accounts and PHP file uploads. The tool utilizes GNU Parallel for efficient execution and requires a list of target URLs as input. Notable features include the ability to run on both Linux and Windows platforms, along with installation instructions for necessary dependencies.

Payloads All The Things is a comprehensive repository offering a curated list of payloads and techniques specifically designed for web application security testing. It includes detailed documentation on various vulnerabilities and how to exploit them, alongside resources for tools like Burp Intruder. Notable features include structured chapters with vulnerability descriptions, applicable payloads, and a collection of methodologies for diverse security scenarios, making it an essential toolkit for penetration testers and security professionals.

Road To Hacking is a comprehensive guide designed for enthusiasts of Ethical Hacking, providing an extensive overview of widely used tools for penetration testing and auditing. Notable features include detailed instructions on tools such as Nmap for vulnerability detection, Metasploit for exploitation, and Aircrack-ng for cracking WPA/WPA2-PSK, among many others. This resource emphasizes practical usage, ensuring users have foundational knowledge in Linux and terminal commands to effectively utilize the tools presented.

#system3 is a tool designed to facilitate system shell access and the installation of system applications on Samsung devices, bypassing restrictions imposed by the One UI 5.1 SMT patch. It leverages the Factory Test Launcher to gain system UID privileges, enabling users to downgrade and install applications without encountering standard installation errors. Notable features include support for a wide range of Samsung devices and the ability to execute installations that are typically restricted, thereby restoring functionality for various system-level applications.

AKQ_0D_PE is a playful tool designed to simulate a Zero-day local privilege escalation exploit targeting a vulnerability in the Linux PipeFS subsystem. It demonstrates memory corruption techniques, ROP injection, and namespace traversal, all while providing an interactive root shell, but it is ultimately a prank and does not exploit a real vulnerability. The tool serves as an educational illustration of exploitation methodologies and is intended for demonstration purposes only.

AIO-Pentesting is a comprehensive resource for penetration testers, encapsulating various methodologies, tools, and commands necessary for conducting thorough security assessments. It categorizes content into phases, covering pre-intrusion and intrusion techniques for both Linux and Windows environments, along with additional materials such as notes for certifications like OSCP and OSWE. Notable features include organized documentation on common pentesting stages, forensics, and various exploitation techniques, as well as links to essential vulnerability databases and binary libraries.

The Archive is a continually evolving repository that curates hacking methodologies, cheatsheets, and conceptual breakdowns, specifically designed to be a human-curated alternative to the increasing reliance on LLMs. Its primary use case is to provide easily accessible, spell-checked information along with referenced content derived solely from clear-net sources. Notable features include the inclusion of alternative resources with descriptions, page differentiation for talk notes, and plans for future enhancements such as a public REST API for querying the data.

The Awesome Windows Red Team repository is a comprehensive collection of resources tailored for Red Team professionals engaging in Windows environments. It encompasses a wide variety of materials including tools, books, courses, and techniques focused on topics such as Active Directory exploitation, lateral movement, privilege escalation, and defense evasion strategies. Notable features include structured categories for efficient navigation, making it suitable for users ranging from beginners to advanced practitioners.

Chronomaly is a kernel exploit targeting CVE-2025-38352, facilitating persistent root access on LG webOS Smart TVs running kernel version 5.4.268 on ARM64 architectures. It features an automated exploit chain that leverages novel techniques, including a redesigned write primitive and non-destructive pipe reads, ensuring reliability on physical hardware through advanced race condition manipulations. The exploit has been validated across multiple TV models and firmware versions, and was disclosed responsibly to LG's Security Researcher Program.

copyfail-detect is a detection toolkit designed to identify exploitation attempts of CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel that alters page-cache data without modifying the actual disk file. It features multiple detection layers, including real-time eBPF monitoring of suspicious activities, auditd rules for syscall tracking, and a page-cache comparison tool for post-exploitation analysis, enabling proactive defense and investigation against the vulnerability. The toolkit also provides mitigation scripts and documentation for responders to safely address incidents involving the Copy Fail exploit.

copyfail-rs is a cybersecurity tool that provides multi-vector proof-of-concept (PoC) exploitation and detection for CVE-2026-31431, specifically targeting vulnerabilities in PAM authentication systems. Its notable features include a unique PAM auth-bypass vector and a detection mechanism that identifies alterations in critical files that traditional file integrity monitoring solutions overlook, using a novel hashing approach that differentiates between actual disk state and memory cache mutations. This tool operates as a single static binary with no runtime dependencies, making it easily deployable across various Linux architectures.

copyfail-rs is a Rust implementation of the Copy Fail exploit (CVE-2026-31431), which demonstrates a local privilege escalation vulnerability on major Linux distributions by chaining the `AF_ALG` and `splice()` syscalls. This tool features a high-performance and memory-safe design, dynamic ELF payload construction, zero-copy exploitation for efficient interaction with the Linux kernel, and allows customization of commands to be executed with root privileges. It is intended strictly for educational and research purposes, focusing on understanding and mitigating similar vulnerabilities.

This tool provides a Python-based exploit for the CVE-2024-32019 vulnerability in the Netdata Agent, specifically targeting the misconfigured `ndsudo` SUID binary that incorrectly handles the `PATH` environment variable. Its primary use case is for users with authorized access to demonstrate local privilege escalation (LPE) by executing a malicious binary with root privileges. Notable features include both manual and automated exploitation methods, aimed for educational purposes to assess potential risks in affected versions of the software.

CVE-2026-41089 is a critical cybersecurity tool designed to assess Windows Active Directory Domain Controllers for a severe unauthenticated remote code execution vulnerability caused by a stack-based buffer overflow in the Netlogon service. It allows users to execute crafted requests to identify susceptible systems without prior authentication, making it a crucial tool for detecting and mitigating potential exploits in enterprise environments. The tool features a Python-based script that facilitates various testing techniques, including baseline checks and aggressive payload testing, all while ensuring system stability.

Glass Cage is a zero-click exploit chain targeting iOS 18.2.1, leveraging vulnerabilities in image processing and WebKit to achieve remote code execution, privilege escalation, and persistent control over compromised devices. The attack is initiated through a malicious PNG transmitted via iMessage, triggering an automatic parsing process that exploits multiple CVEs, ultimately allowing root access and the ability to manipulate device state without user interaction. Notable features include its stealthy operation, the capacity for device bricking, and comprehensive access to sensitive data through keychain exfiltration.

Golden dMSA is a cybersecurity tool that facilitates the exploitation of delegated Managed Service Accounts (dMSAs) through the "Golden DMSA" attack, allowing unauthorized password generation for dMSAs offline. Key features include the ability to extract KDS Root keys, enumerate dMSA accounts, guess ManagedPasswordIDs, and generate valid passwords, making it a potent tool for penetration testing and security assessments of systems with vulnerabilities in dMSA authentication. The tool is built for .NET Framework 4.7.2 and includes functionalities for password conversion, information gathering on dMSAs and KDS keys, as well as brute force password attacks.

The Offensive Security Forensics Portfolio is an educational repository showcasing practical skills in cybersecurity, particularly in forensic analysis, penetration testing, and vulnerability assessments. It features detailed documentation of various security techniques, including the implementation of Multi-Factor Authentication for SSH and memory forensics using the Volatility Framework, as well as threat hunting exercises with Splunk. This portfolio serves as a comprehensive example of applied offensive security methodologies within controlled environments.

Payloads All The Things is a comprehensive repository that provides a collection of useful payloads and techniques for web application security testing. It offers structured documentation on various vulnerabilities, including exploitation methods and payload examples, and is designed to assist penetration testers in identifying and utilizing attack vectors effectively. Notable features include templates for adding new vulnerabilities, integration with Burp Suite Intruder, and a community-driven approach to enhancing its content.

The Pentesting-Methodology repository provides a structured approach to penetration testing, encompassing networking fundamentals, reconnaissance, and analysis techniques. It includes tools for identifying web servers and technologies, brute-forcing subdomains, and performing directory enumeration, making it useful for security professionals looking to streamline their penetration testing workflows. Notable features include detailed networking information and integration with various reconnaissance tools such as Sublist3r and Amass.

PrivHunterAI is a tool designed to identify unauthorized access vulnerabilities through passive proxying, utilizing various mainstream AI engines such as Kimi, DeepSeek, and GPT. The tool's notable features include support for HTTPS traffic detection, customizable request headers, and the ability to view scan results via both terminal and a web interface. It requires configuration of AI models and API keys, allowing for flexible integration and usage in vulnerability assessments.

rfxn-defense is a Linux defense tool that provides a responsive mitigation layer against local privilege escalation (LPE) vulnerabilities by deploying kernel-level protections as soon as new vulnerabilities are identified. It supports automatic updates every four hours and requires no system reboots to apply mitigations, currently covering seven LPE classes across two families, including various techniques such as `LD_PRELOAD` and `modprobe` interventions. This tool is designed for ease of installation and ongoing security management within environments running Enterprise Linux distributions.

SecOps-CLI Guides is a curated repository providing PDF command-line cheat sheets and how-to guides tailored for security professionals, facilitating offline reference for key cybersecurity tools and techniques. Notable topics include Metasploit, Nmap, SQLMap, and Active Directory attacks, making it a valuable resource for penetration testing and security operations. The repository invites contributions to expand its collection, enhancing its utility for the security community.

The tool addresses two high-severity privilege escalation vulnerabilities, CVE-2025-32463 and CVE-2025-32462, affecting the `sudo` utility in various Linux distributions, with a critical CVSS score of 9.3 for CVE-2025-32463. It emphasizes the risks associated with misconfigured `sudoers` rules, particularly those involving wildcard commands, and provides mitigation strategies such as immediate updates to the fixed version and careful audit of `sudoers` policies. Key features include vulnerability detection guidance and examples of secure configuration practices to prevent potential exploitation.

SUID3NUM is a standalone Python script designed to identify and exploit SUID binaries on Linux systems, distinguishing between default and custom binaries. Its primary use case is in penetration testing, particularly for scenarios like Capture The Flag (CTF) challenges, where it automates the exploitation of non-default SUID binaries while providing a clear overview of potentially exploitable binaries from the GTFO Bins repository. Notable features include the ability to auto-exploit custom binaries without impacting the system, as well as color-coded output for improved readability.

Windows Kernel - Exploration is a repository that provides a collection of notes, tools, and code snippets for exploiting Windows kernel drivers, aimed at both research and offensive security applications. It covers both legacy driver vulnerabilities and modern exploitation techniques, including Bring Your Own Vulnerable Driver (BYOVD) methods, while offering resources for kernel debugging, PDB analysis, and understanding core primitives related to kernel exploits. Notable features include detailed discussions on essential exploit techniques, kernel mitigations, and various tools for PDB parsing and debugging.

WindowsPrivilegeEscalationVulnerabilityDisplayBox is a Windows executable designed for detecting and demonstrating privilege escalation vulnerabilities for security research and educational purposes. Key features include the ability to modify PowerShell execution policies, take ownership of files, elevate privileges to SYSTEM or TrustedInstaller, and display current permissions of the program. This tool is strictly for demonstration and is best utilized in controlled environments.

The repository contains a collection of writeups detailing solutions and methodologies used in various Capture The Flag (CTF) competitions, including Hack The Box (HTB). Its primary use case is to provide insights and explanations for participants looking to learn from past challenges. Notable features include links to social media for support and engagement, as well as visual representation of stargazers over time.

AIX-for-Penetration-Testers is a comprehensive enumeration guide designed for penetration testers and red team operators focusing on AIX systems. Its primary use case is to facilitate the security assessment of AIX environments through detailed methodologies and tools for effective system enumeration. The repository serves as a collaborative platform for knowledge sharing, allowing users to contribute to the evolving guide.

Apollo is a lightweight Remote Access Tool (RAT) developed in Python, designed for post-exploitation tasks, enabling remote code execution and system information retrieval across multiple platforms including Windows, Linux, FreeBSD, and macOS. Key features include AES-256 encrypted communication, support for handling multiple clients simultaneously, basic port scanning capabilities, and functionality to eradicate traces of its presence on the client system.

Auto-PostXploit is a Windows post-exploitation tool designed for Red Team operations, facilitating immediate system reconnaissance following an exploit. Its primary use case involves executing post-exploitation actions on compromised systems using Meterpreter, enabling security professionals to gather critical system information efficiently. Notable features include the ability to upload and execute scripts on target systems and automate information gathering, aiding in the assessment of security postures.

Credit-Card-Bruteforcer is a security testing tool designed to exploit vulnerabilities in credit card systems by attempting to generate valid Primary Account Numbers (PAN) using partial hashes and a set of random PINs. The tool's primary use case is to assess the strength of credit card security measures, while its intentionally incomplete functionality indicates it is intended for educational or testing purposes rather than practical exploitation.

DNS-Persist is a post-exploitation agent utilizing DNS for command and control, primarily designed for persistence in compromised systems. It features multiple persistence mechanisms including LogonScript, RunKey, and Excel Addin persistence, as well as the ability to execute commands via a pseudo-interactive shell and inject 32-bit shellcode. The tool is built with a Python server-side and a C++ agent, with plans for future enhancements including additional persistence options and encryption capabilities.

Ed is a tool designed for identifying and exploiting accessible UNIX Domain Sockets, particularly useful for locating exposed Docker.sock instances that may not be mounted in their default locations. Notable features include the ability to hunt for various types of UNIX domain sockets, perform autopwn actions, and return output in JSON format, making it suitable for both security testing in DevOps processes and integration into CI/CD pipelines.

Efes is a proof-of-concept tool that utilizes built-in speech recognition to detect and record specific keywords from spoken audio, saving the snippets for potential exfiltration. Its primary use case is in post-exploitation scenarios where capturing high-value data passively is critical. Notably, it records only short audio segments to minimize file size while focusing on relevant information.

A flexible cross-platform post-exploitation agent written in Go with basic functionalities

The LDAP-credentials-collector-backdoor-generator is a malicious tool designed to create backdoor scripts that log LDAP user credentials during HTTP basic authentication. Its primary use case involves injecting the generated backdoor into a target web application to capture sensitive username and password information from users who access the site. Notable features include customizable backdoor filename generation and the ability to store captured credentials in a file for easy retrieval by the attacker.

LinPwn is an interactive post-exploitation tool designed for enumerating information and facilitating privilege escalation on compromised Linux machines. Key features include executing shells, reading files, running scripts like LinEnum.sh for enumeration, downloading files, and extracting system password hashes and saved Wi-Fi credentials. This tool is essential for security professionals conducting penetration tests to assess vulnerabilities post-exploitation.

MacOS-WPA-PSK is a proof-of-concept script that demonstrates how macOS stores the wireless network key in plaintext within NVRAM, rendering it accessible without root privileges. This tool highlights the risks associated with the management of sensitive credentials in macOS, serving as a reminder that users should be aware of the non-secure treatment of such information. The script operates using Python and has been tested across specific versions of macOS.

The msf-auxiliarys repository contains a collection of custom Metasploit auxiliary post-modules designed for post-exploitation tasks. Its primary use case is to enhance the capabilities of Metasploit by providing additional functionalities that facilitate common post-exploitation procedures. Notable features include ease of installation and integration with the Metasploit database, making it a valuable resource for security professionals.

Poet is a post-exploitation tool that facilitates remote control and management of compromised machines through a client-server architecture. It allows attackers to perform various operations on the target, such as reconnaissance, file exfiltration, remote execution, and self-destruction of the client. Notable features include a control shell for executing commands, automatic reconnection capabilities, and the ability to remove traces post-exploitation.

The Post-Exploitation tool facilitates advanced post-exploitation tasks within PowerShell environments, primarily aimed at improving threat actor capabilities during penetration testing and red teaming exercises. Notable features include modular payload execution, session management, and comprehensive system enumeration capabilities to leverage discovered information effectively.

PostShell is a post-exploitation tool designed to facilitate advanced shell access through both bind and backconnect methods, enabling attackers to maintain an interactive TTY session with job control while remaining stealthy. Notably, it features cloaked process names to minimize detection, a compact stub size of less than 14kb for easy deployment on Unix-like systems, and built-in anti-debugging mechanisms to enhance resilience against analysis. The tool's design allows for operation in environments with limited dependencies, improving post-exploitation flexibility.

A modular pentesting framework implemented in C

The "presentations" repository contains a collection of PDF files showcasing various presentations. Its primary use case is to serve as a portfolio of educational content, presumably focused on cybersecurity topics. Notable features include accessibility as PDFs, allowing for easy distribution and review of the material.

punk.py is a post-exploitation tool designed for network pivoting from compromised Unix systems, facilitating the collection of usernames, SSH keys, and known hosts to establish SSH connections across discovered combinations. It supports both Python 2 and 3, features options for custom execution, password bypass, command execution with sudo, and the capability to crack hashed known hosts, making it versatile for penetration testing and exploitation scenarios.

RSPET (Reverse Shell and Post Exploitation Tool) is a Python-based framework designed for executing remote commands and facilitating post-exploitation activities in penetration testing scenarios. Notable features include TLS encryption for secure server-client communication, built-in file and binary transfer capabilities, support for managing multiple hosts, and a modular code design that allows for extensive customization and plug-in management through a RESTful API.

Soapy is a post-exploitation tool designed to facilitate stealthy operations within a compromised system by creating a container that hosts a root terminal shell while monitoring and scrubbing log files. Its primary use case involves executing commands to extract sensitive information such as hashes and IP addresses, map the network, and perform other tasks without detection. Notable features include the ability to specify custom log file paths, delete files from specified directories post-session, and operate with minimal user prompts.

Zombie Ant Farm is a toolset designed for offensive security practitioners to enhance evasion techniques against Linux Endpoint Detection and Response (EDR) systems. Its primary use case involves facilitating the development of custom offensive strategies through features such as distributed payload warehousing, in-memory payload delivery, and ASLR weakening shims, making it suitable for advanced penetration testing and research. The kit includes various components such as preloaders, evasion primitives, and a warehouse service, providing a modular approach to offensive operations.

AdbNet is an exploitation tool designed for identifying and compromising vulnerable Android devices across the globe. Key features include post-exploitation modules, device scanning functionalities, IP address management, and integration with APIs from Censys and Shodan for discovering susceptible devices. Users can connect to these devices through common ports, execute commands, and utilize various exploits to gain control over the target systems.

AtlasC2 is a C# command and control (C2) framework designed for Stage 1 operations, primarily used for establishing footholds within Windows environments and executing C# payloads through HTTP-based implants. Notable features include the ability to manage listeners, connect to multiple implants, execute system commands via PowerShell or CMD, and dynamically load C# assemblies into memory, making it a potent tool for post-exploitation scenarios despite current OPSEC limitations.

autoMetasploit is a Ruby script designed to streamline the processes of scanning, exploiting, and conducting post-exploitation activities with Metasploit. It automates key tasks by requiring configuration of plugins and supports report generation by integrating with external templates and email functionalities. Notable features include customizable brute force scripts, LDAP user enumeration capabilities, and the ability to send PDF reports via email.

Awesome Malware is a curated repository of various malware, botnets, and post-exploitation tools designed for research and educational purposes. It offers extensive categories such as analysis tools, banking trojans, C2 frameworks, credential stuffing checkers, and more, enabling users to explore and understand malicious software dynamics. Noteworthy features include a focus on free software projects and the inclusion of both historical and contemporary malware resources for comprehensive analysis.

AWSATT&CK is a modified version of the open-source AWS exploitation framework, Pacu, designed to add MITRE ATT&CK context to its tactics and enhance logging capabilities. This tool is primarily used for post-exploitation within AWS environments, featuring quick execution functions, event logging to SIEM solutions, and scalability enhancements to streamline security operations. Notable features include the integration of MITRE ATT&CK techniques, agile deployment options, and a focus on flexibility for security professionals tackling diverse IT and cloud-native challenges.

Bella is a potent post-exploitation and remote administration tool designed specifically for macOS, leveraging Python for high-level automation and ease of use. Its primary use case involves establishing SSL/TLS encrypted reverse shells to facilitate comprehensive data extraction, including passwords, system information, and iCloud services, while offering features like multi-user support, reverse VNC connections, and extensive logging capabilities. Notably, Bella can gain root access to expand its functionalities and maintain persistent control over the target system, all while operating undetectably.

Bifrost is an open-source command and control (C2) tool implemented as a Discord bot, allowing users to manage and communicate with compromised clients through the Discord API. It supports multiple platforms and provides features such as keylogging, antivirus enumeration, real-time encrypted communication, and file management capabilities. Designed for educational and authorized security testing purposes, Bifrost leverages the Discord infrastructure to maintain a stealthy connection with clients.

The C2 Server is a Command and Control framework that enables attackers to manage compromised target machines through a reverse shell connection. It supports various commands for file management, directory navigation, and even malicious functions like keylogging and credential spoofing, enhancing the attacker's ability to interact with the victim's system. Written in Python, it provides a user-friendly interface for executing predefined commands and extracting sensitive information from infected devices.

The Cobalt Strike Aggressor Script Collection provides a set of scripts designed to enhance post-exploitation capabilities within the Cobalt Strike framework. Key features include techniques for privilege escalation, persistence, and situational awareness, along with accessible notes that facilitate streamlined operations during engagements. This tool is primarily used by security professionals for advanced exploitation and operational efficiency in red team scenarios.

Covermyass is a post-exploitation tool designed for penetration testers to securely delete log files across multiple operating systems, including Linux, macOS, and Windows. It enables users to identify and overwrite log files with random data to obscure their activities before exiting a compromised server. Notable features include multiple overwrite iterations and the ability to handle file permissions, ensuring thorough data eradication.

Coyote is a C# post-exploitation implant designed for maintaining access to compromised Windows systems during red team operations. Its notable features include bypassing application whitelisting through InstallUtil.exe, utilizing a recursive DNS tunnel to retrieve encrypted commands, and maintaining a small footprint on both memory and network resources. The tool leverages a DLL that periodically polls a DNS TXT record for remote instructions, allowing operators to execute various payloads, such as spawning a reverse shell, while potentially evading detection.

Crowbar is a comprehensive Windows post-exploitation tool designed to facilitate various tasks such as privilege escalation and system command execution via PowerShell. It includes an extensive range of scripts and utilities, notably the 'Hail Mary' feature for launching multiple scripts simultaneously, and checks for the presence of Windows Subsystem for Linux on the target machine. The tool is actively maintained, with regular updates that introduce new scripts and enhancements to improve functionality.

DeathNote is a penetration testing cheat sheet tool that provides a collection of resources and techniques essential for conducting security assessments. Its primary use case is to streamline the penetration testing process by offering organized references for various attack vectors, including reverse shells, PowerShell exploits, Active Directory, brute-forcing, and persistence methods. Notable features include compatibility with both Python 2.7 and 3.7, straightforward installation, and customizable configurations.

DecryptRDCManager is a .NET tool designed to decrypt credentials stored in Remote Desktop Manager (.rdg) files, leveraging the functionality of RDCMan.DLL. Its primary use case is to extract and read encrypted user credentials, particularly those contained within the more reliable `<credentialsProfile>` section, while also providing an option to automate file detection via user settings. Notable features include the ease of building the tool and its ability to handle paths for .rdg files seamlessly, along with a focus on credential profile extraction for enhanced reliability.

Enumy is a high-performance enumeration tool designed for penetration testing and Capture The Flag (CTF) challenges, facilitating the identification of common security vulnerabilities on target Linux machines. Its features include configurable scan options, the ability to output results in various formats, and support for multithreaded operations to optimize scan speed and efficiency. Suitable for both professional pentesters and hobbyists, Enumy assists users in uncovering security issues during post-exploitation phases.

Evasor is an automated security assessment tool designed for Windows that identifies executables with potential vulnerabilities for bypassing Application Control rules. It offers features such as locating processes vulnerable to DLL Injection and DLL Hijacking, as well as generating detailed assessment reports inclusive of descriptions, screenshots, and mitigation suggestions. This tool caters to both blue and red teams, enhancing efficiency during the post-exploitation assessment phase.

FudgeC2 is a PowerShell-based command and control (C2) platform that enhances collaborative red teaming by providing an organized structure for managing campaigns and implants. It features a web-based interface that allows operators to easily deploy and control various implants, execute commands, and gather system information, with support for custom modules and a range of built-in commands such as persistence and file manipulation. Designed for active development, FudgeC2 aims to improve understanding of adversarial techniques through detailed reporting and campaign timelines.

HackingComm is a user-friendly penetration testing tool designed for individuals with limited terminal command knowledge. It simplifies common pentesting tasks on Kali Linux through a straightforward interface, allowing users to easily input required parameters while executing commands. Notable features include an installation script, guided prompts for user inputs, and reliance on Python for functionality, making it accessible for beginners in cybersecurity.

iPwn is a framework specifically designed for the exploitation of jailbroken iOS devices, enabling users to gain access and extract sensitive information. It incorporates a post-exploitation tool named 'iSteal', which offers various modules for information harvesting and management, including SSH brute-forcing capabilities using common credential wordlists. Notably, the framework is still under development, with ongoing enhancements for easier payload management and integration with existing iOS tweaks.

Leprechaun is a penetration testing tool that facilitates the identification of valuable targets within an internal network by aggregating netstat results from multiple hosts. Its primary use case involves analyzing network traffic connections to uncover potential vulnerabilities and traffic patterns, and it features command-line options to specify output files, ports of interest, and IP address types. Notable features include the ability to output detailed connection statistics organized by server and traffic destination ports, enhancing visibility for security assessments.

mOrc is a post-exploitation framework specifically designed for macOS, developed in Bash. Its primary use case is to facilitate post-exploitation activities by providing a shell environment that minimizes traceable artifacts, such as disabling the history file and preventing core dumps. Notable features include its integration as an ENV script and its capability to execute various post-exploitation commands securely.

mythic-crate is a development environment for the Mythic Command and Control (C2) framework, designed to run on Ubuntu 18.04 using VirtualBox and Vagrant. It automates the setup of Mythic dependencies, facilitates port forwarding, and enables folder sharing between the host and guest systems. Notable features include SSH access, streamlined administration via host commands, and the ability to customize VM disk size.

NTLMX is a post-exploitation tool designed for extracting local NTLM user password hashes from the Windows registry, supporting both modern AES-128-CBC techniques introduced in Windows 10 and traditional MD5/RC4 methods for earlier versions. The tool requires SYSTEM privileges to operate and can be easily installed via PowerShell Gallery or from the GitHub repository. It has been validated on multiple Windows versions, ensuring compatibility across various PowerShell environments.

OffensiveAutoIt is a collection of proof-of-concept scripts leveraging AutoIt v3 for offensive security purposes, focusing on UI automation and the execution of external code. The repository includes features for compiling scripts into standalone executables, decompiling AutoIt binaries, and obfuscating scripts, facilitating the development of malware and tradecraft research. Its notable use cases involve executing PowerShell and .NET assemblies while bypassing security mechanisms like AMSI and ETW.

OffensivePH is a post-exploitation tool designed to bypass user-mode access controls using an outdated Process Hacker driver. Its primary use case is to execute shellcode or terminate processes, enabling actions such as process hijacking and API call redirection through DLL injection. Notable features include a standalone executable for process management, integration for shellcode injection, and automatic cleanup of its driver after execution.

Orc is a post-exploitation toolkit designed for Linux environments, implemented in Bash. It provides a variety of functions for privilege escalation, system enumeration, and network analysis, while ensuring output is concealed by using a temporary directory that is auto-deleted on exit. Notable features include functionalities to check Docker access, list D-Bus services, and exploit known vulnerabilities, making it a versatile component for offensive security operations.

PEH (Post Exploitation Helper) is a script designed to facilitate the downloading of common post-exploitation tools onto a target machine with minimal commands. Its primary use case is to operate on machines lacking internet access, allowing users to specify tool files and network interfaces for resource acquisition. Key features include flexible file input, configurable network interface and port options, and straightforward usage through command-line commands.

PentaDrone is an asynchronous PowerShell post-exploitation agent designed for red teaming and penetration testing, utilizing the Mitre Att&ck framework for automation through an autopilot mode. It allows security researchers to simulate HTTP loader-style botnets, facilitating malware research while providing extensive configurability for command-and-control server connections and agent behavior. Notable features include various persistence methods, USB spreading options, and customizable operational parameters.

Powerexploit is a PowerShell-based exploitation framework designed to facilitate offensive post-exploitation tasks in Windows environments. It enables security professionals to automate the process of gaining and maintaining access to targets, quickly exfiltrating sensitive information, and leveraging vulnerabilities within the system. Notable features include a modular architecture for plugins, support for various attack vectors, and inherent obfuscation techniques to evade detection by security tools.

PXEnum is a shell script designed for automated post-exploitation enumeration on *NIX systems, facilitating the collection of essential system and network information to aid security assessments. It executes a comprehensive set of checks related to user, hardware, BIOS, network activity, and permissions, providing an organized output of findings, while ensuring compatibility across various Unix-like environments. Notable features include the ability to read directly from system files for improved reliability and the streamlined output format for enhanced readability.

rpc2socks is a client-server solution designed to establish a SOCKS5 proxy tunnel through a custom RPC and SMB connection for remote execution and communication between Unix or Windows hosts and Windows targets. The tool leverages a dedicated named pipe for communication, supports DNS resolution, and operates without authentication by default, making it suitable for establishing secure tunnels on networks where direct connectivity may be restricted. Notably, the client is a Python package while the server is a statically-linked C++ console application compatible with both 32-bit and 64-bit Windows environments.

SBD is a script designed to provide users with access to essential Linux utilities on compromised systems, including the ability to deploy BusyBox and download static binaries for various networking tools like Ncat, Socat, Nmap, and Ngrok. Its primary use case is to enhance functionality on a limited or compromised environment by offering a menu-driven interface for managing these utilities. Notable features include the ability to set output directories for downloads, clean up downloaded files, and a straightforward installation process using available commands like `wget` or `git`.

Sharp Login Prompt is a cybersecurity tool designed to create a phishing login interface that captures the username and password of the current user without interacting with lsass or requiring administrative credentials. Its primary use case is for red team assessments, allowing security professionals to simulate phishing attacks. Notable features include customizable headings and subheadings for the login interface, enhancing the deception in social engineering scenarios.

Shennina is an automated host exploitation framework that leverages Artificial Intelligence for comprehensive scanning, vulnerability analysis, and exploitation of target systems. Integrated with Metasploit and Nmap, it features a self-learning AI engine for identifying exploits, supports post-exploitation capabilities, and automates data exfiltration while covering over 40 techniques from the MITRE ATT&CK framework. Notable features include heuristics mode for exploit recommendations, high concurrency performance, and cross-platform support for various operating systems.

sudo_sniff is a discreet tool designed for post-exploitation scenarios to capture user passwords when executing the sudo command by manipulating the user's `$PATH`. It functions by hijacking the sudo execution to record both successful and failed password entries, storing them in a specified temporary file. Notable features include the ability to adapt to different system configurations for sudo and potential enhancements for stealthier operation.

swap_digger is a Bash script designed for automating the analysis of Linux swap space for post-exploitation and forensic purposes. It extracts sensitive information such as user credentials, web form credentials, and WiFi keys from the swap area, and offers extensive options for customization, including extended searches and optional logging. The tool is especially useful in penetration testing scenarios and can operate on local or mounted swap devices.

TokenPlayer is a tool designed for manipulating and abusing Windows access tokens, focusing on the Win32 API. Its primary use case includes stealing and impersonating tokens, bypassing User Account Control (UAC) via token duplication, and creating new tokens for network authentication without elevated privileges. Notable features include the ability to execute applications under an impersonated context, spoof parent process IDs, and operate within non-interactive environments, making it suitable for various privilege escalation and security testing scenarios.

Ghost Framework is an Android post-exploitation tool that leverages the Android Debug Bridge for remote device administration. It provides a user-friendly interface to execute various remote management tasks such as accessing the device shell, installing applications, capturing screenshots, and managing device settings. Notable features include password removal capabilities and comprehensive system information retrieval.

Agent Loader is a modular command-and-control (C2) tool designed to facilitate the deployment of in-memory payloads and covert operations through a DNS-over-HTTPS channel. Its notable features include dynamic function encryption, a reverse-shell module, and extensive file system management capabilities, alongside a customizable CLI builder for creating tailored implants via Python. The tool also offers a Node.js web panel for interactive management, showcasing a bot list and persistence mechanisms through OneDrive and Task Scheduler.

Alan Framework is a post-exploitation framework designed for red-team activities, enabling advanced functionality such as in-memory tool execution and encrypted communication. It supports multiple agent types including Powershell, DLL, and executable formats across different architectures and operating systems, with a powerful command shell and real-time agent configuration updates. Notable features include a fully compliant SOCKS5 proxy, JavaScript execution capabilities, and a lack of external dependencies, making it suitable for stealthy operational tasks.

Ant is a post-exploitation tool designed to automate the deployment of tunnels and port forwarding over a specified network topology using configuration files. Key features include support for WMI, WinRM, and SMB protocols, along with four main commands—deploy, desinfect, redeploy, and probe—that facilitate topology management. The tool also includes validation for configuration file accuracy and allows comments for better user guidance.

AntiForensic.NET is a lightweight library designed for Windows that facilitates the eradication of forensic trace logs from a computer system. Its primary use case involves implementing various anti-forensic techniques to ensure user privacy by removing artifacts such as application logs, event logs, and cached data. Notable features include the automatic deletion of numerous types of logs and cache files, including Recycle Bin contents, recent items, and compatibility logs, thereby aiding users in evading potential tracing.

awesome-cyber is a curated repository that aggregates a diverse range of cybersecurity tools catering to red, blue, and purple team operations. This resource aims to provide an up-to-date collection of tools across various cybersecurity domains, including offensive and defensive techniques, forensics, and incident response. Notable features include organized categories for easy navigation and an open invitation for community contributions to keep the toolset relevant.

C_keylogger is a stealthy keylogging tool developed in C for Windows that utilizes a traditional approach to log keystrokes without relying on WinAPI hooks. It features persistence, remote activation, a stealth handler to hide the Command Prompt window, and efficient memory management through variable reuse. The tool is designed for educational purposes in a controlled lab environment, requiring specific amendments before compilation to ensure connectivity.

C2KepExec is a Command and Control (C2) server designed to manage a BotNet of machines running a Remote Administration Trojan and is developed for educational purposes. Its notable features include remote keylogging, file management capabilities (uploading and downloading), integrated session control for multiple targets, and persistent infection techniques on Windows systems. The tool also allows for advanced monitoring functions such as screen captures and webcam access.

C2PE is a tool designed for Red Team operations, focusing on Command and Control (C2) capabilities and post-exploitation activities. It features experimental code implementations suitable for hacking scenarios, allowing users to deploy C2 infrastructures and manage compromised systems effectively. The tool is developed in Python and Go, ensuring cross-platform compatibility and adherence to PEP8 code standards.

Clipboard-Hijacker is a post-exploitation payload designed for penetration testing that monitors and captures clipboard data on a target machine. It automatically sends captured clipboard contents, which may include sensitive information, to a specified web server or webhook every 10 seconds, while also optionally logging data locally. Notable features include the ability to modify clipboard contents and error handling mechanisms for reliable data transmission.

The csharp_reverse_shell is a proof-of-concept tool for executing reverse shell operations in C# that supports SSL/TLS encryption and various evasion techniques. Its primary use case includes providing a stealthy command execution environment with features such as a no-visible-window mode, dual operation modes for interactive shell and shellcode execution, and advanced evasion strategies like AMSI and ETW bypassing. Notable functionalities include silent error handling and selective unhooking of system calls to avoid detection.

DFEX is a tool designed for DNS-based data exfiltration, leveraging the DNS protocol to transmit files across networks while circumventing traditional firewalls. Its primary use case is in post-exploitation scenarios, employing unique tactics to outsmart advanced firewalls, including techniques that disguise data transfers in plain sight. Notable features include a dual-client and server architecture, and compatibility with Python environments to facilitate easy installation and setup.

DNS Tunnel Keylogger is a post-exploitation tool designed to covertly exfiltrate keystrokes via DNS tunneling, allowing for lightweight and persistent data exfiltration while minimizing detection risks. The tool features separate components for Linux and Windows, employing bash scripts and a compiled executable respectively, along with a server setup that listens on UDP port 53 by default. Notably, it can send keystrokes silently and can be configured for automatic startup in interactive shells to maintain persistence.

ExtractBitlockerKeys is a post-exploitation script designed for system administrators to automate the extraction of BitLocker recovery keys from a domain. It features multithreaded LDAP connections to retrieve data from domain controllers, supports pagination for large domains, and allows for exporting results in various formats, including JSON, XLSX, and SQLite3. This tool is essential for managing BitLocker recovery information in a secure and efficient manner.

GOD-OF-RAT is an advanced Python Remote Access Trojan (RAT) framework designed for authorized penetration testing, offering extensive control over compromised systems. Its notable features include live screen controlling, credentials harvesting from various sources, an interactive agent builder with encryption capabilities, and advanced evasion techniques. The framework also supports remote shell access, file system management, and a suite of fun modules for additional functionalities.

GTFOBins CLI is a command-line tool designed for security professionals to quickly access and search for Unix binary exploitation techniques. It features capabilities such as fuzzy searching, filtering exploitation types, and an interactive mode for ease of navigation, all while providing an offline database for fast, local access. The tool supports cross-platform usage and enhances readability with syntax highlighting, allowing for efficient identification of security bypass methods.

The Hacker Road Map repository provides a comprehensive overview of resources and tools necessary for learning penetration testing and practicing ethical hacking. It features a categorized collection of UNIX-compatible, free, and open-source tools, along with guidance on essential concepts, basic steps of penetration testing, and additional educational materials to support newcomers in the field of information security. Notably, the project has been archived, indicating that the content may be outdated as a new initiative is anticipated to replace it.

HVNC is a remote administration toolkit designed for red-team operators, enabling covert access to an invisible Windows desktop without user awareness. Its primary use case is to facilitate stealthy remote operations by creating a hidden session that processes actions off-screen and communicates with the operator via VNC-like commands, supporting functionalities such as file transfers, keylogging, and launching applications. Notable features include simultaneous session handling in separate console windows and a clean-up script for system hygiene post-usage.

KitsuneC2 is a pure-Go adversary emulation framework designed for security testing, providing both a web and CLI interface for user interaction with implants. Its notable features include dynamic implant generation, in-memory execution of shellcode, and malleable C2 traffic, making it a versatile tool for organizations aiming to evaluate their cybersecurity defenses. However, it is not intended for professional engagements as there are more mature frameworks available.

LOLSpoof is an interactive shell program designed to spoof command line arguments of spawned processes, specifically targeting 64-bit LOLBins. Its primary use case is to obscure such processes from detection by telemetry solutions used by antivirus, endpoint detection and response (EDR) systems, and security analysts. Notable features include the ability to craft a spoofed command line, the manipulation of process creation telemetry, and the handling of suspended processes to override command line parameters.

MagikIndex is an advanced keylogger designed for stealthy data capture, boasting a low detection rate and various persistence mechanisms. It retrieves logged information via email, supports clipboard monitoring, and can capture screenshots with configurable modes while encrypting logs for security. Notable features include an auto-update capability, extensive system information logging, and a customizable architecture for tailored functionality.

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

The Metasploit-Tutorial repository provides comprehensive guidance on utilizing the Metasploit framework, a robust open-source toolset designed for network enumeration, vulnerability identification, and exploit development. Users can learn key functionalities such as exploit execution, payload creation, and post-exploitation techniques through detailed sections covering various components and workflows of Metasploit. Notable features of the tutorial include practical exercises with modules, sessions, and Meterpreter commands, enabling hands-on experience with real-world cybersecurity tasks.

MsfMania is a Python-based payload obfuscation framework primarily aimed at evading endpoint detection and antivirus systems on Windows platforms. It boasts notable features such as dynamic code generation, multi-layer encryption using RC4, local memory injection, and extensive metadata spoofing, making it suitable for authorized security testing and research activities.

pE is a comprehensive post-exploitation framework designed for offensive security operations, focusing on practical techniques and tool development across multiple programming languages including Bash, Python, C, and Go. It offers a structured roadmap for activities such as credential access, lateral movement, persistence techniques, and data exfiltration, alongside custom script creation and defense evasion strategies. Key features include detailed sections on host enumeration, Active Directory abuse, and environmental setup, aimed at enhancing the effectiveness and efficiency of post-exploitation efforts.

PivotSuite is a network pivoting toolkit designed for Red Teamers and penetration testers, enabling the movement within a compromised network using either forward or reverse connections. Notable features include support for TCP tunneling, SOCKS5 proxies, and various network enumeration functions, all without requiring administrative access on the compromised host. The tool operates independently of installation requirements, utilizing only Python's standard libraries, making it versatile across different platforms and environments.

Powtel is a remote system control tool designed for Windows environments, utilizing PowerShell and Telegram as its communication interface. Its primary use case is for authorized security testing and post-exploitation activities, providing features such as task scheduling, file upload/download capabilities, and screenshot functionality. The tool emphasizes ethical usage, aiming to aid cybersecurity professionals and researchers in controlled settings.

PyADRecon is a Python-based tool designed for gathering comprehensive information from Microsoft Active Directory environments, catering to the needs of penetration testers and blue teams. It supports NTLM and Kerberos authentication methods, can generate XLSX reports, and offers an HTML dashboard for visualizing collected data, making it a versatile resource for Active Directory reconnaissance. Additionally, it provides options for standalone report generation from CSV files, enhancing its usability in various assessment scenarios.

PyExfil is a Python-based tool designed for stress testing the detection capabilities of security systems against various exfiltration and communication techniques employed by threat actors. It allows users to deploy multiple experimental and stable exfiltration methods, such as DNS queries, HTTP cookies, and ICMP packets, enabling organizations to evaluate their defenses. Notable features include a wide array of techniques for data exfiltration and communication, with the ability to configure and run tests across different operating systems.

PyIris is a modular remote access trojan (RAT) toolkit implemented in Python, designed for the dynamic creation, encoding, and encryption of RAT payloads to facilitate the remote control of compromised systems. Its notable features include cross-platform compatibility for both Windows and Linux, robust error handling, dynamic payload generation, and advanced functionalities such as keylogging, webcam access, and file manipulation, making it a versatile tool for malicious actors. The ongoing development aims to enhance its capabilities further with improved encryption methods and operational persistence techniques.

PythonRAT is a Command and Control (C2) server that orchestrates multiple machines infected with a Remote Administration Trojan (RAT), enabling the formation of a botnet cluster. Its primary use case is for educational purposes in cybersecurity training, allowing users to remotely control, monitor, and manipulate target sessions. Notable features include an integrated keylogger, screenshot and webcam capture, file transfer capabilities, privilege checking, and the ability to issue commands to all active sessions simultaneously.

Reave is a post-exploitation framework developed for hypervisor endpoints, designed to facilitate automated penetration testing in heavily virtualized environments. This Python-based tool operates on a listener/agent model, offering features such as real-time interactive terminal sessions, automatic hypervisor enumeration, and modular payloads for tasks including exfiltration and persistence. Notably, Reave supports versatile configurations for agents, enabling comprehensive control over operations and network interactions.

Redpill is a post-exploitation tool designed to facilitate various tasks following initial access via reverse TCP shells, particularly for red team engagements. It comprises a collection of PowerShell scripts, with the main script, redpill.ps1, serving as a central hub to download, configure, and execute these scripts, offering functionalities similar to the meterpreter environment. Notable features include system enumeration, remote process management, web server deployment, and a keystroke logger, all intended to enhance the capabilities of shell access in compromised systems.

RedVision is a collection of custom-designed HTML user interfaces specifically intended for Command & Control (C2) systems. Its primary use case is to enhance the operational efficiency of security professionals by providing a visually appealing and functional interface for managing C2 capabilities. Notable features include an array of templates, each visually distinct, allowing for flexible customization to suit various C2 deployment scenarios.

ReHTTP is a PowerShell-based HTTP shell that features a web user interface, designed primarily for remote management and control of clients on a Windows platform. Key functionalities include executing PowerShell commands, managing client connections, and creating custom modules and variables, along with sophisticated event handling capabilities for connection management. This tool also supports scheduled tasks and offers a history feature for command execution, enhancing its usability in system administration and penetration testing contexts.

Rogue is a bash script that automates penetration testing workflows by integrating tools such as Nmap, Metasploit, and John the Ripper. It streamlines the scanning, exploiting, and reporting phases of pentesting, providing a modular and customizable experience for security professionals. Notable features include automated scans, exploitation configuration, credential harvesting, and structured report generation, all initiated with a simple input of a target IP address.

RustVersary is a comprehensive toolkit designed for malware development and penetration testing using the Rust programming language. It includes a variety of tools and scripts that facilitate tasks such as enumeration, exploitation, and post-exploitation, each thoroughly documented to aid both personal use and community contributions. Notable features include advanced techniques for process injection, persistence mechanisms, and a structured catalog of utilities tailored for security assessment challenges.

Searchbins is an offline command-line tool designed to search for GTFOBins binaries that allow users to bypass local security restrictions in misconfigured systems. Its notable features include the ability to enumerate specific binary functions, display commands to exploit those functions, maintain an up-to-date GTFOBins database, and allow for file-based binary searches. This tool serves as a valuable resource for security professionals to identify and utilize potential vulnerabilities in binary applications.

The SeaShell Framework is a post-exploitation tool designed for iOS and macOS that facilitates remote access to devices, allowing for control and extraction of sensitive data. Its notable features include a powerful payload named Pwny which supports custom post-exploitation modules, encrypted communication via TLS 1.3, and a basic set of modules for exfiltrating user data such as SMS, voicemail, and browsing history. Actively updated, it supports a wide array of iOS versions susceptible to specific vulnerabilities, enhancing its utility in security assessments and penetration testing.

Sh3ller is a lightweight command-and-control (C2) framework designed for managing incoming reverse shells via PowerShell. Its primary use case is to maintain persistent access to compromised systems, allowing users to manage multiple shell sessions simultaneously with minimal dependencies. Notable features include an always-on listening mode, support for various reverse shell payloads, and intuitive session management commands.

Silkwire is a gRPC-based Command and Control (C2) framework designed for authorized penetration testing and red team operations. It supports multiple platforms (Windows, Linux, macOS) and offers advanced features including dynamic implant generation, post-exploitation modules, keylogging, and enhanced evasion techniques against detection mechanisms. The tool emphasizes encryption for communications and session management, making it a robust option for security professionals in performing comprehensive security assessments.

SoundShell is a Command-and-Control (C2) tool developed in Go that utilizes the Spotify Web API to execute encoded commands and generate corresponding playlists. Its primary use case is to dynamically create playlists based on user-inputted commands, with notable features including custom command execution, command encoding for playlist generation, and random track selection from a predefined song pool.

Sshimpanzee is a tool for creating a static reverse SSH server that initiates connections from the victim machine to an attacker's IP, bypassing the need for incoming connection requests. It provides all standard SSH functionalities, including port forwarding and dynamic SOCKS proxies, while also offering advanced tunneling methods like DNS Tunneling, ICMP Tunneling, and HTTP encapsulation to facilitate communication in restrictive network environments. Notable features include customizable build configurations, support for multiple tunneling mechanisms, and the ability to generate new SSH keys upon build.

The FreeZeroDays/TTPs repository serves as a curated collection of offensive security notes, focusing on Tactics, Techniques, and Procedures (TTPs). It provides a repository of validated commands and resources targeted towards researchers and practitioners in offensive security. Notably, the documentation emphasizes accuracy and reliability, and it draws inspiration from other established collections in the field.

Unicorn is a Command and Control (C2) framework designed for post-exploitation and remote control operations. Built using Python and Flask, it features a client-server architecture that supports multiple listeners, dynamic command execution, and client chat synchronization, while still being in development with planned enhancements such as a proxy server and GUI integration. This tool is aimed at cybersecurity professionals for managing agents and executing commands in compromised environments.

Venus is a VS Code extension designed to serve as an agent for the Mythic C2 framework, enabling operators to create and deliver payloads to target systems. This tool automates the packaging of VS Code extensions and supports various commands for interacting with the system environment, although it currently lacks support for encrypted payloads. Notably, Venus is cross-platform compatible and requires manual installation on target machines after preparation.

WebcamBOF is a Beacon Object File (BOF) for Cobalt Strike that enables webcam capture functionality. Its primary use case is to facilitate remote image acquisition by allowing users to save webcam images either to disk or download them directly over the Cobalt Strike beacon. Notable features include multiple save methods, including capturing images as screenshots, and the ability to enumerate connected webcam devices.

WindowSpy is a Cobalt Strike Beacon Object File designed for targeted user surveillance, facilitating stealthy detection of significant user activities such as entering credentials or accessing confidential documents. It operates by comparing active window titles against a customizable list to trigger specific actions, like screenshots, only when relevant activities are detected, thus minimizing unnecessary data collection. Key features include easy integration with Cobalt Strike, a configurable keyword list for triggering surveillance, and the ability to customize the actions performed upon detection.

XENA is a cross-platform cybersecurity automation framework designed for adversary simulations and red team operations, featuring a built-in post-exploitation agent and a command-and-control (C2) server. Notable features include an elegant dark-themed user interface that supports desktop, web, and mobile formats, along with high-level automation capabilities for orchestrating C2 clusters. This community edition serves as an integrated tool for penetration testing, facilitating a comprehensive approach to security assessment.

ZeroPulse is a modern Command & Control (C2) platform designed for secure remote management and monitoring of systems, utilizing Cloudflare Tunnel technology for encrypted connections. Key features include built-in authentication, support for WinRM and SSH interactions, a responsive React interface with real-time terminal integration, and comprehensive DNS management. The tool is currently in active development and is intended primarily for testing and evaluation purposes.

BYOB is an open-source post-exploitation framework designed for educational purposes that facilitates command and control operations following a system compromise. It features a comprehensive web GUI for managing post-exploitation tasks, customizable payload generation for multiple platforms, and the ability to dynamically load third-party packages without leaving traces on the disk. The framework is optimized for ease of use, allowing students, researchers, and developers to extend its capabilities with minimal effort.

linux-priv-esc-audit is a Linux system auditing script designed to identify privilege escalation vulnerabilities and enhance security. It offers dual-mode operation for both root and low-privilege users, generates comprehensive audit reports with vulnerability insights, and provides user-friendly guidance throughout the audit process. Regular updates ensure the tool remains effective against new security threats and techniques.

ShellCode Elevator is a sophisticated tool for bypassing User Account Control (UAC) and injecting shellcode into processes on x64 systems while maintaining stealth and undetectability. Its primary features include fully undetectable operation, privilege escalation, memory-only execution, and anti-debugging mechanisms to prevent detection by security tools. This makes it a potent option for executing malicious payloads without alerts on target systems.

ShellOrd is a cross-platform Command & Control (C2) framework designed for authorized penetration testing and educational purposes, implemented in Rust and Java. It supports Windows, MacOS, and Linux, and features a modular architecture with extensions, secure memory handling, and encrypted data transmission over TCP or UDP. The framework enables users to build and automate workflows, serving as an alternative to Trickest, while emphasizing speed and security.

CryptoLyzer is a comprehensive security auditing tool that analyzes various cryptographic protocols, including TLS, SSL, SSH, IKE, and DNSSEC. It uniquely identifies over 400 cipher suites and cryptographic algorithms using a custom implementation that operates independently of OpenSSL, enabling the detection of vulnerabilities often missed by traditional tools. With both command-line and API interfaces, CryptoLyzer offers versatile output formats and a unified approach, making it an essential solution for security assessments across multiple cryptographic attack surfaces.

PySentry is a robust vulnerability scanning tool for Python dependencies, designed to audit projects against known security issues by analyzing lock files or manifests and resolving the full dependency tree. Its notable features include support for various dependency formats, integration with multiple vulnerability databases for comprehensive reporting, and capabilities for continuous integration (CI) environments, allowing detailed output formats and customizable failure thresholds. The tool is optimized for speed, utilizing a Rust core for efficient processing and local caching.

TrivySummary is a reporting tool designed to interpret and summarize JSON outputs from Trivy vulnerability scans, facilitating visual and comparative reports for package vulnerabilities. It consolidates vulnerabilities by CVE and provides functionality for generating PDF or JSON reports, comparing scan results over time, and integrating with CI/CD pipelines to enforce security thresholds. Notable features include customizable report generation, integration of EPSS scores for exploitability assessment, and whitelisting capabilities for specific CVEs.

Argus is a comprehensive security scanning tool that integrates Static Application Security Testing (SAST), container security, Infrastructure as Code (IaC) scanning, and dynamic application security testing (DAST) into a single command-line interface (CLI) or GitHub Actions workflow. It supports various scanners such as Bandit, Gitleaks, and Trivy, enabling users to detect vulnerabilities, secrets, and security weaknesses across code, containers, and cloud configurations. Notable features include an interactive terminal UI for triaging scan findings, customizable integration with CI pipelines, and export options for results.

The TMAS Scan Action is a GitHub Action that integrates the TMAS (TrendAI™ Artifact Scanner) CLI tool to scan artifacts in the GitHub workspace for open-source vulnerabilities, malware, or sensitive secrets. Notable features include detailed scan results displayed in action logs, summary reports in job summaries, and automated comments on related pull requests, enhancing CI/CD pipelines with security assessments for files, directories, and container images.

AutoCVE is an automated tool designed for end-to-end CVE discovery, encompassing project screening, source code auditing, vulnerability verification, and report generation. Its notable features include a multi-agent collaborative auditing system and flexible auditing modes tailored for different objectives, enabling efficient management of vulnerability assessment through structured automated workflows. The tool simplifies the CVE reporting process, allowing users to easily submit their findings after a comprehensive auditing experience.

h1domains is a Python tool that retrieves and lists domains approved for bug bounty programs on HackerOne, focusing specifically on those marked as "in-scope." Its primary use case is to assist security researchers in identifying valid targets for vulnerability testing while providing a regularly updated repository of domains. Notable features include an automated script to fetch the latest data and a comprehensive list of domains across various companies and services.

Mercator is an open source web application designed for dynamic mapping of information systems, providing IT professionals with a comprehensive overview of their digital environments. It enables users to visualize dependencies, track compliance, generate architectural reports, and facilitate risk management through features like graphical representations, compliance monitoring, and integration with security tools. Notably, Mercator supports multi-user collaboration and offers a REST API for seamless system integration, making it a valuable asset for organizations aiming to enhance information system governance.

PermCheck is a lightweight tool designed for verifying proper executable permissions on files within a PHP project. By utilizing a customizable XML configuration file, it allows users to specify which directories and files should be executable, thus enhancing project consistency and security. Notable features include support for various PHP versions, minimal dependencies, and integration with the Symfony Console Component for ease of use.

Bearer is a static application security testing (SAST) tool that scans source code for security and privacy risks by analyzing data flows. It supports a wide range of programming languages and offers features like detection of vulnerabilities in line with OWASP Top 10 and CWE Top 25, as well as identifying sensitive data flows for privacy compliance reporting. Bearer is available in both an open-source CLI version and a comprehensive commercial version, providing advanced analysis capabilities.

Bugsy is a command-line tool designed for automatic security vulnerability remediation in code, functioning as both a scanner and analyzer for SAST (Static Application Security Testing) reports from various vendors like Checkmarx and Snyk. Its notable features include two operational modes—Scan, which runs SAST scans and identifies vulnerabilities directly, and Analyze, which processes pre-generated SAST reports to provide automated code fixes, effectively streamlining the remediation process for developers. Additional functionality allows Bugsy to be utilized as an MCP server for enhanced integration with AI tools in vulnerability scanning and fixing.

Cynative is a read-only cybersecurity tool designed for deep infrastructure research, allowing users to query various systems such as GitHub, GitLab, AWS, GCP, Azure, and Kubernetes in a unified manner. It executes code in an ephemeral sandbox to provide verified insights while maintaining strict access controls, thereby ensuring that users can confidently audit their cloud environments without compromising security. Notable features include its ability to reason through code-to-runtime environments, a robust action-gate mechanism for authorization, and evidence-backed findings that trace back to their origins.

ReARM is a Release Governance Platform that facilitates the management of software releases by providing insights into their composition, security posture, and compliance through the storage and organization of Software Bill of Materials (SBOMs), security artifacts, and vulnerability data. Notable features include support for OCI-compatible storage, adherence to regulatory frameworks, and the introduction of a Product-Component relationship model for enhanced release metadata organization. This tool is particularly useful for organizations aiming to streamline their release processes while ensuring compliance with various security standards.

The "references" repository serves as a compiled collection of reusable references, providing access to a variety of resources related to contemporary issues such as the Russo-Ukrainian War and political events. Notable features include links to remote documents, calendars, and an emphasis on critical themes like agnotology, which explores the social fabric of ignorance. The repository aims to facilitate informed discussions and act as a resource for understanding the implications of various socio-political phenomena.

Rust-in-Peace is an autonomous security review tool specifically designed for Rust programming, facilitating the detection and remediation of vulnerabilities related to memory safety and panic handling in unsafe contexts. It integrates various detectors such as Miri and AddressSanitizer into a comprehensive pipeline that automates the process of finding, grading, and reporting vulnerabilities while also enabling targeted fuzzing. This tool emphasizes a structured approach by utilizing a machine-readable threat model and supports a recall-first strategy to improve detection accuracy through multiple scanning runs.

SecObserve is an open source vulnerability and license management tool designed for software development teams and cloud environments, enabling efficient assessment and reporting of vulnerabilities across multiple scanning tools. It features a centralized dashboard for viewing and filtering scan results, as well as easy integration into CI/CD pipelines through pre-defined GitLab CI templates and GitHub Actions for streamlined vulnerability scanning. This tool aims to simplify the vulnerability management process, allowing teams to focus on addressing significant security issues.

Syzkaller is an unsupervised coverage-guided kernel fuzzer designed to discover security vulnerabilities in various operating system kernels, including Linux, FreeBSD, and Windows. Its notable features include support for multiple OS environments, a focus on automated bug detection, and an extensive documentation set for setup and usage. Initially developed for Linux, Syzkaller has broadened its capabilities to include several other operating systems, enhancing its utility in kernel security research.

Trivy is a versatile security scanner designed for identifying vulnerabilities and misconfigurations across various targets, including container images, filesystems, Git repositories, virtual machine images, and Kubernetes environments. It can detect OS packages, known vulnerabilities, infrastructure as code (IaC) issues, sensitive data, and software licenses. Trivy is easily integrable with popular tools and platforms, supporting a wide range of programming languages and systems, making it a comprehensive choice for security assessments.

VulnerableCode is an open-source database designed to catalog software package vulnerabilities, accessible through a Web UI and a comprehensive API. Its primary use case is to provide detailed information on vulnerabilities affecting software packages, including upstream and downstream impact analysis, thereby facilitating better vulnerability management. Notable features include its focus on Package URLs (PURLs) for easy identification of packages, along with the ability to build custom instances of the database.

Wildbox is a self-hosted, open-source security operations platform designed for comprehensive threat monitoring, analysis, and automated responses, allowing users to maintain full control over their data. It features aggregated threat intelligence from over 50 sources, cloud security posture management for major providers, and utilizes YAML-based playbooks for incident automation, alongside advanced LLM capabilities for enhanced threat analysis and reporting. The architecture is built on microservices, providing flexibility and scalability through a robust API gateway, identity management, and integrated data management tools.

The 'suspicious_IPs' repository provides a compiled list of potentially malicious or harmful IP addresses. Its primary use case is for cybersecurity professionals to enhance threat detection and mitigation measures by identifying and blocking traffic from these suspicious IPs. Notable features include a straightforward format that allows for easy integration into firewall rules and intrusion detection systems.

Rev·Deck is a localized static-analysis workstation that integrates Ghidra with an AI-driven web interface for reverse engineering binaries. It allows users to browse deterministic evidence from analyzed binaries without executing them, while an AI assistant provides fact-based responses citing specific evidence. This tool supports various LLM backends and enables secure, efficient analysis with a user-friendly interface.

Reversecore MCP is an AI-powered server designed to facilitate reverse engineering and security analysis by integrating 120 analysis tools into a unified interface. It utilizes natural language processing to allow AI assistants to perform tasks like malware analysis, vulnerability research, and source code auditing, significantly simplifying the interaction with complex command-line tools. Notable features include structured tool results that AI can reason about and chain into follow-up queries, making it highly efficient for rapid security assessments and investigations.

Augur is an advanced IDA headless plugin designed for efficient analysis of binary files by extracting strings and associated pseudocode. Its primary use case is to streamline vulnerability research by organizing and storing the pseudocode of functions that reference specific strings in an intuitive directory structure, leveraging the Hex-Rays decompiler's capabilities. Notable features include rapid processing, support for various architectures, and a robust decompilation process using the `decompile_to_file` API from the Haruspex library.

DeepZero is an automated vulnerability research pipeline engine that allows users to define and orchestrate data processing workflows using YAML configuration files. Notable features include support for parallel execution, resumable runs, integration with language model providers, and extensibility for custom processing components, making it ideal for analyzing and assessing vulnerabilities in a target corpus of files. The tool is built to enhance efficiency in vulnerability research while ensuring fault tolerance and state management during execution.

The `ghidra-scripts` repository comprises a collection of scripts designed for Ghidra to enhance reverse engineering and vulnerability research. It features tools that locate insecure function calls, extract pseudocode, and resolve iOS and MIPS syscalls, thereby streamlining the analysis process for security researchers. Compatibility is maintained with Ghidra version 12.0.2.

Haruspex is an advanced headless plugin for IDA Pro that efficiently extracts pseudocode from binaries, formatted for integration with IDEs or further parsing by static analysis tools like Semgrep. Notable features include its high-speed performance, compatibility with various architectures supported by IDA's Hex-Rays decompiler, and structured output where each function's pseudocode is saved separately for easy analysis.

Oneiromancer is a reverse engineering assistant designed to enhance code analysis by utilizing a locally running large language model (LLM) that has been fine-tuned for Hex-Rays pseudocode interpretation. Its primary use case is to analyze code snippets, providing high-level descriptions, suggested function names, and variable renaming recommendations, while also saving improved pseudocode for further inspection. Notable features include cross-platform compatibility, integration with the pseudocode extractor 'haruspex', and the ability to invoke analysis through external crates, facilitating a seamless development experience.

ReverseLab is an open-source reverse engineering lab designed for capturing and analyzing various attack scenarios across multiple domains, including CTF pentesting, APK reverse engineering, and PE binary analysis. Its notable features include a comprehensive knowledge base organized into specialized categories, over 100 automation tools for rapid execution, and a modular architecture that supports various signal types and attack chains. Users can easily set up the tool on multiple platforms with provided scripts, ensuring a streamlined onboarding experience.

Rhabdomancer is a high-performance headless plugin for IDA that identifies calls to potentially insecure API functions within binary files. It aids security auditors by backtracking from these functions to find vulnerabilities related to untrusted input, complete with a prioritization system that categorizes known bad API calls. Notable features include support for various C/C++ binary targets and the ability to customize the list of bad API functions according to user-defined criteria.

Rizin is a comprehensive reverse engineering framework designed for analyzing binaries, disassembling code, and debugging programs, offering enhanced usability and features compared to its predecessor, radare2. It supports a wide array of operating systems and architectures, includes multiple utilities for scripting and binary manipulation, and facilitates interaction with popular programming languages through rzpipe. Notable features include a command-line assembler, tools for binary comparison and pattern searching, as well as extensive file format compatibility.

Torii Gateway is a middleware solution designed to provide researchers with persistent, authenticated access to advanced inference pathways of large language models (LLMs) while bypassing tiered consumption limits imposed by commercial APIs. Its notable features include protocol reflection to mimic enterprise-tier traffic, token frame rebalancing to adjust apparent consumption rates, and session entropy injection for neutralizing identifiable session fingerprints, facilitating a seamless connection to multiple inference providers without altering client-side code. This tool serves as a crucial resource for overcoming restrictions that hinder research and experimentation with frontier LLM capabilities.

TryHackMeWriteups is a comprehensive repository that curates free TryHackMe rooms, providing organized resources for cybersecurity enthusiasts to learn and practice various skills. Notable features include categorized rooms across diverse topics, detailed notes and summaries, step-by-step writeups for Capture The Flag challenges, and continuous updates, making it an ideal starting point for beginners in cybersecurity and ethical hacking.

Bento is a lightweight Docker container designed for penetration testers and Capture The Flag (CTF) players, providing a minimalistic environment with essential tools for web and infrastructure security testing. It supports GUI applications via X forwarding, allowing users to seamlessly run tools like Burp Suite, and includes collaborative features through an embedded code-sharing pad (CodiMD). Notable features include minimal bloat, portability, and customizable deployment options via Docker Compose.

Cannon is a post-exploitation framework developed in Python, designed primarily for Unix-based systems to facilitate post-access tasks on compromised machines. Its functionalities include uploading and downloading files, executing pre-defined modules, and harvesting reverse shells, making it a powerful tool for security professionals and penetration testers. The framework also offers some compatibility with Windows systems, expanding its utility across different platforms.

cgPwn is a specialized Ubuntu virtual machine designed for hardware hacking, reverse engineering (RE), and wargaming, equipped with an extensive suite of tools such as Pwndbg, Pwntools, and Radare2. Its primary use case is to provide a comprehensive environment for cybersecurity practitioners to develop, test, and exploit vulnerabilities. Notable features include easy setup using Vagrant, a sophisticated collection of debugging and exploitation tools, and customizable configurations through personal dotfiles.

FirstBlood is a Python 3 library designed to extend built-in objects and enhance utility functions, primarily for rapid development in Capture The Flag (CTF) scenarios. Notable features include method chaining for easier function calls, advanced manipulation of strings and bytes, and integrated cryptographic functions such as XOR and various hashing algorithms. However, users should exercise caution, as the library may alter standard Python behavior and is not intended for production environments.

FlagWarehouse is a Flask-based flag submission system designed for Attack/Defense Capture The Flag (CTF) competitions, utilizing SQLite for data management. It allows teams to submit flags to a verification server while providing a user-friendly web interface to display statistics and manage flag submissions efficiently. Key features include customizable configurations for flag formats and submission intervals, automatic flag extraction from exploits, and real-time feedback on submissions.

jwtXploiter is a security testing tool designed to assess the vulnerabilities of JSON Web Tokens (JWTs). It enables penetration testers and developers to exploit known CVEs, manipulate token payloads, verify JWTs, and perform key confusion attacks by retrieving public keys from SSL connections. Notable features include support for all JWT algorithms, automated generation of JSON Web Keys (JWK), and the ability to tamper with vulnerable header claims like kid, jku, and x5u.

Karkinos is a comprehensive library database tool designed for binary exploitation on Linux, facilitating the identification of unknown libraries and their associated symbols. It provides capabilities to locate library packages, dump useful symbols and gadgets for return-oriented programming (ROP), and supports various architectures, including x86, ARM, and more, by indexing a wide range of libraries like glibc and libstdc++. Key features include commands to find libraries by offsets, dump detailed library information, and update the internal database autonomously.

Scuffed Low Level Stash is a curated resource repository focused on binary exploitation and reverse engineering, providing a wealth of educational materials including tutorials, courses, and reference links related to assembly language and low-level programming. Its notable features include a comprehensive list of recommended resources, practical tutorials, and useful references for both beginner and advanced practitioners in the field. The tool serves as a centralized platform for learners and professionals looking to enhance their skills in binary exploitation tactics.

YAPS is a lightweight PHP reverse shell that operates as a single file, allowing users to execute commands on remote systems through a TCP listener. It features customizable password protection, enumeration capabilities for gathering system information, and the ability to manage concurrent connections and execute PHP code remotely. Notably, it can auto-download enumeration tools, exploit known vulnerabilities like CVE-2021-4034, and send shellcode to the target host while supporting operations on both Linux and Windows in future updates.

The bug-bounty-tips repository provides a comprehensive collection of resources and tools tailored for bug bounty hunters. It includes a curated list of required scripts and tools like Amass, SQLMap, and Fuff, facilitating efficient reconnaissance and vulnerability assessment. The repository emphasizes community engagement through platforms like Telegram and Twitter, aiming to enhance knowledge sharing among cybersecurity professionals.

CTF-Checklist is a comprehensive resource aimed at cybersecurity enthusiasts participating in Capture The Flag (CTF) challenges, providing a curated list of vulnerabilities and associated tools for exploitation across various domains including forensics, web, and binary exploitation. Noteworthy features include a variety of tools such as packet analyzers, password crackers, SQL injection frameworks, and binary exploitation utilities, assisting users in effectively evaluating and leveraging security weaknesses. It serves as a vital reference for those looking to enhance their skills in ethical hacking and vulnerability assessment.

The length-extension-tool is a Python library that implements hash length extension attacks and supports multiple hashing algorithms, including MD5, SHA1, and SHA256. Its primary use case is to exploit vulnerabilities in hashing algorithms that utilize the Merkle-Damgård construction, allowing an attacker to append data to a hashed message without knowing the original input. Notable features include a straightforward API for computing hashes and performing extension attacks, as well as built-in tests to validate the implementation against standard Python hashing libraries.

Pwndra is a collection of utilities designed to enhance the Ghidra reverse engineering environment, specifically for pwn and Capture the Flag (CTF) challenges. Key features include the ability to replace constants with human-readable counterparts, annotate system calls and their arguments, conveniently convert character representations, and quickly navigate to the main function of binaries. This toolset streamlines the analysis workflow, improving usability for cybersecurity practitioners working with various CPU architectures.

The TryHackMe - Hackers Learning Path repository provides a structured framework for beginners in cybersecurity to learn and practice through a series of rooms and hands-on exercises. Key features include an automated environment setup script, instructional content covering foundational topics like Linux, networking, and various security tools (e.g., Nmap, Burp Suite, Metasploit), and practical penetration testing exercises to simulate real-world attacks. This resource is designed to guide users incrementally from introductory levels to more advanced cybersecurity skills.

Avala is a tool designed for the rapid development, execution, and monitoring of exploits in attack-defense capture the flag (CTF) competitions. It simplifies the process for teams by allowing them to focus on exploiting vulnerabilities and implementing patches without being bogged down by technical complexities. Notably, Avala is informed by the practical experiences of the Serbian National ECSC Team and provides functionality for integrating with various services to facilitate quick exploit deployment.

The CTF Resources repository is a comprehensive collection of cybersecurity tools and practice platforms specifically designed for Capture the Flag (CTF) competitions. It includes an extensive array of tools categorized into areas such as Open Source Intelligence (OSINT), steganography, and anonymous communication, offering functionalities from data gathering and analysis to secure and anonymous internet browsing. Notable features include links to various open-source tools, detailed descriptions, and categorization for ease of use, supporting users in enhancing their digital security skills.

Live Exploit is a comprehensive Python-based tool tailored for Capture The Flag (CTF) challenges, exploit development, and vulnerability research. It offers a rich feature set including buffer overflow payload generation, ROP chain creation, fuzzing, and interactive command execution, all presented through an intuitive command-line interface. This all-in-one toolkit is designed for both novice and advanced users, streamlining numerous exploit-related tasks while being cross-platform compatible.

The Reversing Bits Cheatsheets repository serves as a comprehensive resource for assembly programming, reverse engineering, and binary analysis tools. It includes in-depth guides on installation, usage examples, and advanced tips for a variety of tools, such as assemblers, debuggers, disassemblers, and binary analysis frameworks, catering to different operating systems and user needs in the field of cybersecurity. Notably, it features prominent tools like Ghidra, IDA Pro, and GDB, making it a valuable reference for professionals involved in security and malware analysis.

TryHackMe is a free cybersecurity learning path designed to advance users from novice to expert through a range of practical exercises, introductory Capture The Flag (CTF) challenges, and educational modules covering topics like OpenVPN, Linux fundamentals, web scanning, and Metasploit. This resource is suitable for both newcomers to the field and those looking to enhance their skills, and it culminates in a comprehensive foundation in cybersecurity, preparing users to address more complex challenges. Notable features include diverse content formats, hands-on labs, and accessible learning materials to foster practical experience in cybersecurity practices.

vHeap is an extendable visualization and exploitation tool designed for glibc heap memory analysis during debugging sessions, primarily targeting security researchers and CTF players. It allows users to visualize heap memory in real-time within a web browser leveraging GDB's pwndbg integration, with features like automatic heap state updates and customizable extensions for other debuggers. Notably, vHeap facilitates easier exploitation of heap memory by transforming complex memory structures into interactive visual representations.

Ataka is a command-line tool designed for running exploits in competitive Capture The Flag (CTF) hacking environments, allowing players to create, manage, and test their exploits efficiently. Notable features include the ability to set up exploits with specified target IPs, hot-reload configurations, and a templating system for easy exploit creation. The tool operates within a Docker container, providing a flexible and isolated environment for users to conduct their attacks and tests.

CTF Tools is a curated repository that aggregates a variety of resources, websites, and tools specifically designed to assist in solving Capture The Flag (CTF) challenges. It organizes tools by category, providing practical links ranging from ASCII tables to cryptographic calculators, thus serving as a quick reference resource for CTF participants and teams during competitions. Notable features include a wide assortment of utility tools for cryptography, data conversion, and training resources, as well as guidelines for collaborative contributions to the repository.

CTF Helper is a multifunctional tool designed for Capture The Flag (CTF) competitions and various cybersecurity tasks. It features capabilities for decoding data formats such as Base64 and hex, JWT decoding and brute-forcing, web exploit utilities, and OSINT tools for geolocation and Shodan lookups, all built with modularity and extensibility in mind. This tool serves as a comprehensive resource for security professionals engaging in threat analysis and live security challenges.

ctf-party is a command-line interface (CLI) tool and library designed for Capture The Flag (CTF) participants and security professionals, streamlining the process of scripting and exploit writing. It enhances Ruby's String class with concise methods for common coding tasks, like encoding and decoding, thus minimizing the need for extensive code and dependencies. Notable features include a range of easy-to-use commands that perform various encoding and transformation operations, making it particularly useful for rapid development in CTF contexts.

ExploitFarm is a distributed attack platform designed for security competitions, enabling users to easily share and execute exploits in a coordinated manner. The tool facilitates the replication of attacks, flag submissions, and data collection for analysis, all while providing a user-friendly TUI and centralized server management. Key features include client-server architecture, customizable configurations for competition settings, and detailed tracking of attack performance.

FTP Scanner is a lightweight tool designed for penetration testing and Capture The Flag (CTF) challenges, capable of detecting anonymous logins, listing files, and performing banner grabbing. It features heuristic software and version extraction, alongside a local exploit database lookup for identifying potential vulnerabilities based on the FTP server's banner. This portable tool operates as a single Python script, requiring minimal dependencies and offering customizable usage options, including the ability to specify custom ports and vulnerability database paths.

MyCTFLib is a collection of templates for Capture The Flag (CTF) competitions, designed to assist with various challenge types, including exploitation, cryptography, and web vulnerabilities. It features scripts to easily copy relevant libraries for pwn, crypto, and web challenges, streamlining the setup process for participants. The library includes specific tools and functionalities such as exploited scripts, cryptographic algorithms, and web exploitation techniques.

ronin-payloads is a Ruby micro-framework designed for constructing and executing exploit payloads as plain Ruby classes, providing a modular and user-friendly alternative to tools like msfvenom. It supports a variety of languages and payload types, facilitates cross-compilation, and includes built-in common payloads for reverse and bind shells across multiple operating systems. Noteworthy features include a simple command-line interface, extensive documentation and test coverage, and the flexibility to host additional payloads in separate repositories, promoting decentralized usage.

`seg` is a command-line utility designed for analyzing and exploiting ELF binaries, offering comprehensive binary intelligence with a single command. Its primary use case targets CTF players and penetration testers, providing features such as dangerous function detection, libc resolution, and automatic exploit strategy suggestions. Notably, `seg` supports dual output formats for both human readability and automation pipelines, streamlining the reconnaissance process by integrating multiple tool functionalities into a cohesive reporting system.

sentinel-reverse is an AI-powered autonomous binary reverse engineering tool designed to enhance the efficiency of analyzing complex binaries by automating traditional manual processes. It features capabilities such as AI-driven function decompilation, LLM-based semantic inference for variable naming, and context-aware vulnerability detection, enabling analysis of 50-200 functions per hour with complete data privacy and zero API costs. This tool leverages GPU acceleration and incorporates a multi-round confidence-driven analysis to optimize the reverse engineering workflow.

Winpwn is a Windows-centric debugging and exploitation toolset designed for both user and kernel modes, built upon Python's capabilities. It supports various debugging environments, including Windbg and GDB, and offers features like process memory manipulation, remote connections, and assembly/disassembly functionalities, making it ideal for security researchers and developers focused on Windows exploitation. The tool is compatible with both Python 2 and 3 and facilitates an extensive configuration for customized debugging sessions.

This repository provides a proof-of-concept exploit for CVE-2024-10924, allowing an attacker to bypass authentication and two-factor authentication in the Really Simple Security WordPress plugin to achieve remote command execution (RCE). The script automates the process of impersonating an administrator, uploading a malicious plugin, verifying interaction with the payload, and establishing an interactive remote shell. Notably, it operates pre-authentication, requiring only the target URL and a malicious plugin as input.

The Bug Bounty Beginner Roadmap serves as a comprehensive guide for newcomers interested in bug bounty hunting, providing essential knowledge on security vulnerabilities and effective learning paths. It emphasizes the importance of foundational skills in computer systems, networking, and operating systems, while also highlighting the potential rewards of participating in bug bounty programs. Notable features include curated resources and links to courses tailored for building the necessary expertise in this evolving field.

COLI (Command Orchestration & Logic Interface) is a command line tool designed to streamline workflow management by enabling users to visually create and connect tasks through a drag-and-drop interface. It offers features such as real-time scan monitoring, an interactive web terminal, and a built-in file explorer, making it ideal for those seeking a more efficient way to manage command line operations and enhance visualization. Additionally, COLI supports mobile access, allowing users to operate workflows from anywhere.

CryptoCat is a secure messaging tool designed for private communication via end-to-end encryption. Its primary use case is to enable users to chat in real-time while ensuring that messages remain confidential. Notable features include anonymous chat rooms and the ability to communicate securely without data logging.

CTF-to-Pentest is a guide that emphasizes the transition from a Capture the Flag (CTF) mindset to a penetration testing (pentest) approach, highlighting how common vulnerabilities like SQL injection and remote code execution must be handled with precision and discipline in real-world scenarios. It provides insights on translating CTF techniques into practical, low-impact strategies that prioritize thorough reporting over noise generation. Noteworthy features include personalized methods for vulnerability probing, safe proof-of-concept recommendations, and real-world case studies showcasing vulnerabilities found in high-value companies.

Hacker101 CTF Solutions is a comprehensive repository that provides detailed walkthroughs and solutions for challenges encountered in the Hacker101 Capture The Flag (CTF) platform, focusing on web application security vulnerabilities. Key features include a structured organization with solution documentation and supporting screenshots for each challenge, as well as coverage of various attack vectors such as XSS, SQL injection, and permission issues. This educational tool is aimed at both novices and experienced individuals seeking to improve their penetration testing skills through practical, hands-on experience.

IP-Vortex is an advanced IP rotation tool designed for security professionals, enabling anonymous security testing by frequently changing public IP addresses. Its primary use case is to facilitate fuzzing and vulnerability scanning while avoiding IP-based rate limiting, featuring automatic IP rotation, timed intervals, multi-interface support, and optional MAC address randomization. Notable features include comprehensive logging, network status monitoring, and seamless integration with security testing workflows.

The JWT Authentication Bypass tool demonstrates the exploitation of a vulnerability where the server fails to verify the signature of JSON Web Tokens (JWTs), allowing attackers to forge tokens and impersonate users, including administrators. Its primary use case is for bug bounty hunters and web security professionals to illustrate how improper JWT implementation can lead to unauthorized access to sensitive application areas, such as admin panels. Notable features include detailed step-by-step instructions for executing the exploit using tools like Burp Suite and JWT Inspector.

MongoBleed is a high-performance proof-of-concept scanner designed to identify vulnerable MongoDB instances affected by CVE-2025-14847, a pre-authentication heap memory disclosure vulnerability. Utilizing asynchronous I/O with Python's asyncio, the tool efficiently scans large network ranges, ensuring precise detection and minimal false positives by validating response lengths against the requested leak size, while automatically logging vulnerable targets. Additionally, it requires no external dependencies, making it straightforward to deploy in authorized security testing environments.

The Nuclei-MonaCodeScanner repository provides a set of custom Nuclei templates focused on source code security analysis, targeting vulnerabilities such as hardcoded secrets, configuration leaks, debug routes, and exposure of sensitive files. Designed for use in Static Application Security Testing (SAST) and CI/CD pipelines, these templates facilitate the identification of OWASP Top 10 vulnerability patterns within source code, enhancing security assessments and red team activities.

Pinakastra is an AI-powered penetration testing framework designed for automated reconnaissance and exploitation, specifically tailored for penetration testers and bug bounty hunters. It features extensive capabilities for subdomain discovery, live host probing, URL analysis, and active exploitation of vulnerabilities like XSS and SQL injection, enhanced by AI-driven vulnerability detection and smart payload generation to minimize false positives. The tool also generates customizable reports in various formats, thereby streamlining the assessment process and improving efficiency in security testing.

RedTiger is an automated XSS (Cross-Site Scripting) vulnerability testing tool that streamlines security assessments by performing subdomain enumeration, link filtering, endpoint extraction, and XSS scanning. Notable features include intelligent filtering of endpoints, a rich terminal UI with detailed reporting, and dependency checking to ensure all required tools are available. The tool is designed to enhance testing efficiency by focusing on parameters in URLs, improving the accuracy of vulnerability assessments.

Vasuki is an automation tool designed for security professionals that streamlines the process of subdomain enumeration and vulnerability scanning. It aggregates multiple reconnaissance tools to identify subdomains, check for subdomain takeover potential, and detect various injection parameters including XSS and SSRF. Notable features include integration with tools like Nuclei for vulnerability scanning, notification capabilities for scan results, and an organized output of findings in text files.

Web Scraper is a Python-based tool designed for web hacking and assessment, featuring a suite of 20 widely-used functionalities for executing various attacks and reconnaissance tasks with a single command. Its notable features include ASN lookups, HTTP header analysis, subdomain discovery, vulnerability scanning, and more, providing users with a comprehensive toolkit for bug bounty and data extraction efforts. It operates on Python 3.7 or higher and is optimized for Linux environments.

JWTLens is a comprehensive security scanner for JSON Web Tokens (JWTs) integrated with Burp Suite, designed to automatically detect and test for vulnerabilities across a wide array of JWT attack vectors. It incorporates 56 security checks, enabling both passive analysis and active exploitation tactics, including signature bypasses and algorithm confusion. Key features include a JWT Forge tab for live token editing, a built-in secret extractor to identify hardcoded secrets, and efficient request/response scanning capabilities for thorough JWT vulnerability assessments.

The Admin Control Panel Finder is a Perl-based tool designed to identify potential admin login paths on websites, catering primarily to developers and security professionals for authorized testing. It automatically checks common admin panel URLs across various web technologies, such as PHP and ASP, and employs keyword detection for typical login fields, making it a lightweight and beginner-friendly tool for ethical hacking and cybersecurity education.

BugBoard is an open-source web application that acts as a centralized dashboard for cybersecurity tools, enabling users to efficiently identify and report vulnerabilities such as SQL Injection, XSS, and CSRF. Its modular design allows users to focus on specific vulnerabilities while providing a user-friendly interface that caters to both novices and experienced professionals in the bug bounty process. Notable features include comprehensive vulnerability assessments and an intuitive layout for streamlined navigation.

Claude Security Research Skill enhances the Claude AI with structured security assessment workflows, enabling it to effectively manage and execute security research across multiple phases, including reconnaissance, vulnerability scanning, and reporting. Notable features include tool chaining, automated phase management based on target types, and the capability for Claude to interpret tool outputs, suggest subsequent actions, and compile professional assessment reports. This skill integrates seamlessly into Claude's environment, facilitating detailed and methodical security assessments without generating payloads or exploit code.

HuntTheBug is an advanced reconnaissance framework tailored for bug bounty hunters, combining over 30 security tools into a streamlined workflow to facilitate automated vulnerability discovery. Notable features include parallel execution for enhanced speed, live domain verification, real-time Telegram notifications for immediate alerts, and comprehensive scanning capabilities for subdomains, URLs, and directories. This toolkit is specifically optimized for use on Kali Linux, ensuring efficient and effective reconnaissance processes.

The iOS 26 Activation Lock repository documents 31 firmware-level vulnerabilities found in iOS 26.3, specifically targeting the activation lock subsystem. It serves primarily as a resource for the security research community, featuring self-contained writeups for each vulnerability, ranking from critical to less severe, along with proof-of-concept implementations and exploitation scripts. Notable features include detailed descriptions, reproduction steps, and evidence for each finding, aiding researchers in understanding and possibly mitigating the identified security issues.

OnlyVulns is a nonprofit, open-source platform designed for security researchers to publish vulnerability disclosures in a controlled and safe environment. It enables researchers to document their findings, including proof-of-concept submissions and technical write-ups, while allowing them to manage vendor communications and disclosure timelines autonomously. Key features include a non-corporate framework, an embargo process for pre-publication coordination, and options for community support and tipping, fostering a researcher-first approach to vulnerability disclosure.

The Pentest Agent Suite is an autonomous bug-bounty framework designed for use with Claude Code and six other AI coding tools, featuring a collection of 50 agents, 26 commands, and 19 CLI tools. It provides a comprehensive methodology for vulnerability hunting, including automated exploit chaining, endpoint tracking, semantic writeup searches, and installation compatibility across multiple development environments. Its core functionalities enable users to efficiently conduct security assessments and manage bounties via integration with live platforms and cost tracking mechanisms.

The Solana Security Standard (SOL-0XX) is a tool that integrates security rules into development environments to detect Solana-specific vulnerabilities in real time, based on insights from $514M worth of exploits. It features a comprehensive set of 52 rules covering various bug classes, with support for multiple IDEs and CI tools, and allows for easy installation through plugins for different platforms. This tool emphasizes immediate feedback on potential security issues as developers write code for Solana programs.

Argo is an LLM-native static vulnerability detection tool that analyzes source code to identify security vulnerabilities by simulating a human auditor's review process. It offers tailored auditing via archetype-driven prompts, adversarial validation, and multi-backend support while focusing on both general code audits and specialized bug-bounty triage modes. Notable features include threat-informed auditing, cross-checks against project documentation, opt-in remediation proposals, and a commitment to detection-only operations without executing the analyzed code.

Bug Bounty is a comprehensive knowledge base designed for security researchers, penetration testers, and bug bounty hunters, featuring methodologies, cheatsheets, automation tools, wordlists, and real-world write-ups. Its primary use case involves equipping users with the necessary resources for web penetration testing, API security, cloud exploitation, and modern vulnerability assessment techniques. Notable features include battle-tested methodologies and a focus on ethical hacking practices, underscoring the importance of authorized testing only.

dioterms is a CC0-licensed framework designed to serve as the canonical language for vulnerability disclosure, facilitating open modifications through community contributions. Its primary use case involves standardizing disclosure policies across various platforms while ensuring accountability and consistency via a single-source architecture. Notable features include multiple term templates for different disclosure scenarios, support for translations, and integration with tools like policymaker for generating and verifying policies.

Flounder is an autonomous white-hat security auditing tool designed to automate the process of preparing, auditing, exploiting, and verifying security vulnerabilities in software systems. Its primary use case involves leveraging coding agents to analyze public-source or authorized targets, enabling an end-to-end audit workflow that includes mapping attack surfaces, constructing exploit paths, and generating reports based on execution-backed findings. Notable features include framework-agnostic reasoning, an autonomous audit loop for streamlined processes, and execution-grounded findings that validate vulnerabilities through real-world testing.

Gerobug is an open-source, self-managed bug bounty platform designed for organizations to easily deploy their own bug bounty programs without incurring significant costs associated with third-party services. Key features include a streamlined installation process with a single command setup, robust security measures like email parsing and network segregation, and automated HTTPS configuration using NGINX and Let’s Encrypt. This solution facilitates efficient vulnerability reporting through an email parser and provides a dedicated dashboard for managing submissions.

HackerOne Disclosed Reports is a comprehensive, auto-updated database that aggregates publicly disclosed vulnerability reports from HackerOne, featuring nearly 10,000 entries categorized by severity, weakness, and bug bounty programs. Its notable features include statistical insights on bounties and vulnerabilities, structured metadata for individual reports, and various browsing options for easy access to specific data through categories and leaderboards. This tool serves as a valuable resource for security researchers and professionals seeking to analyze disclosure trends and vulnerabilities in the bug bounty landscape.

The "kali-dockerized" repository provides Docker images for Kali Linux and Ubuntu 26.04, tailored for bug bounty programs, penetration testing, security research, computer forensics, and reverse engineering. Key features include the use of the official Kali Linux Docker image with systemd support, compatibility with Docker's host network driver for enhanced performance, and tools for local deployment on Kubernetes clusters. The setup also includes installation instructions for utilities such as Dive for image exploration and Trivy for vulnerability scanning.

open·kritt is an open-source security research platform designed to orchestrate AI agents for the identification and validation of vulnerabilities in code repositories. It enables users to create custom workflows for security research, run scans on local or remote codebases, and prioritize findings with configurable severity rankings and automatic de-duplication. Notably, it supports integration with various AI model providers, allowing for flexible model access and requiring minimal setup for operation.

The orgs-data repository is designed to assist bug bounty hunters in identifying leaked secrets, vulnerabilities in GitHub Actions workflows, and conducting reconnaissance by gathering information from organizations' repositories. Notable features include scripts for listing GitHub organization names and tracking programs for potential vulnerabilities, along with a collaborative approach to maintain an up-to-date database of organizations and bug bounty programs.

Policymaker is an open-source tool that facilitates the rapid creation of vulnerability-disclosure policies, safe harbor clauses, and security.txt files without the need for legal assistance. It streamlines the process through a user-friendly wizard, producing defensible documents based on standardized, lawyer-reviewed language sourced from the dioterms framework. Key features include support for DNS Security TXT records and complete public domain output, ensuring compliance with current vulnerability disclosure standards.

SecureStack provides an all-in-one GitHub Action designed to enhance security across GitHub project workflows by integrating several security analyses into a single step. It performs sensitive data detection, software composition analysis for vulnerable dependencies, scans for cloud misconfigurations and web vulnerabilities, and generates a Software Bill of Materials (SBOM) for comprehensive security coverage. Notable features include customizable severity settings for different analyses and a user-friendly setup utilizing GitHub Secrets for API key management.

Alcide Kubernetes Advisor is an agentless tool designed for auditing and ensuring compliance of Kubernetes clusters, focusing on enhancing DevSecOps workflows by providing early security scans. Its notable features include vulnerability scanning of Kubernetes infrastructure, detection of misplaced secrets and excessive access permissions, workload hardening, and application of security best practices for Istio and Ingress Controllers. The tool seamlessly integrates into CI/CD pipelines and offers a baseline profiling capability to streamline issue detection pertinent to a specific cluster.

The Aqua Jenkins MicroScanner Plugin facilitates the scanning of Docker builds within Jenkins for OS package vulnerabilities, ensuring the security of containerized applications. It integrates seamlessly into both Freestyle and Pipeline jobs, allowing users to configure vulnerability scans as part of their build process. Notable features include customizable actions for handling high-severity vulnerabilities, detailed scanning output in both console and HTML formats, and ease of setup requiring only Docker installation and token configuration.

AVAIN is an automated vulnerability analysis framework designed for IP-based networks, leveraging a modular architecture to conduct comprehensive assessments of both networks and individual hosts. It features collaborative modules that facilitate reconnaissance, vulnerability correlation, and active detection of security issues, culminating in a vulnerability score to gauge overall security. Noteworthy capabilities include simple result sharing, extensive module configurability, and the ability to integrate various tools, making it a robust platform for penetration testing and security evaluation.

The "Awesome Software Supply Chain Security" repository provides a curated list of tools and resources aimed at enhancing security throughout the software supply chain lifecycle. It covers various aspects, including Software Bill of Materials (SBOM), Software Composition Analysis (SCA), Static Application Security Testing (SAST), and tools for secret detection and malware analysis. Notable features include extensive categorizations of tools for CI/CD practices, Kubernetes security, and risk management, offering a comprehensive landscape for professionals seeking to bolster supply chain integrity.

badmoodle is a community-driven vulnerability scanner designed specifically for Moodle platform instances, aimed at penetration testers and security researchers. It identifies both official and community-discovered vulnerabilities, allowing users to operate in check mode for detection or exploit mode to validate and leverage identified vulnerabilities. Notable features include its modular architecture for easy integration of community vulnerability modules, multiple testing levels, customizable output options, and capability to scrape the latest vulnerabilities from Moodle's security resources.

Burp Bounty is an extension for Burp Suite designed to enhance the capabilities of its scanning features by providing additional profiles for both active and passive scanning. Its primary use case is to facilitate vulnerability assessment by identifying misconfigurations and sensitive information exposure in various environments, particularly in Linux configurations. Notable features include predefined profile sets for scanning multiple common configurations and vulnerabilities, such as Apache2, MySQL, and JWT tokens.

clj-nvd is a Clojure tool designed to check dependencies specified in `deps.edn` against known security vulnerabilities from the National Vulnerability Database. It offers commands such as `check`, `update`, and `purge`, and generates detailed reports on vulnerabilities, with configuration options available through a dedicated `clj-nvd.edn` file. This tool acts as a wrapper around the existing lein-nvd, utilizing its functionality while adapting it for the Clojure tools.deps ecosystem.

Collector is an automated tool designed for identifying XSS vulnerable parameters across entire domains by leveraging the Wayback Machine. Key features include comprehensive crawling of websites and JavaScript files, advanced error handling, and the capability to collect GET parameters. This tool facilitates a systematic approach to vulnerability assessment in web applications.

Lacework Auto Scanner is a tool designed to automate vulnerability assessments for active containers in a Lacework account, streamlining the scanning process via its API or inline scanner capabilities. It efficiently utilizes a local cache to skip rescans of recently assessed containers, with flexible configuration options for scan frequency and targeted registries. Notably, it supports Inline Scanning for containers lacking registry integration, enhancing its versatility and effectiveness in diverse environments.

CORS-Scanner is a Go-based tool designed to identify CORS misconfiguration vulnerabilities in web applications. It allows users to specify origin headers and cookies for testing and processes line-delimited domains to check for vulnerabilities such as reflected origins with credentials and wildcard configurations. Notable features include customizable options for origin headers and cookie handling, as well as the capability to input multiple domains efficiently for scanning.

The "cybersecurity-dynamic-analysis" repository is a curated collection of dynamic application security testing (DAST) tools, libraries, and frameworks aimed at enhancing vulnerability scanning processes. It primarily assists developers and security professionals in identifying and debugging vulnerabilities that static analysis may overlook, by evaluating applications during runtime. Notable features include support for multiple programming languages and links to various tools like Microsoft IntelliTest, KLEE, and Valgrind for dynamic analysis tasks.

DorkScanner is a search engine dorking tool that allows users to scrape search engines for vulnerable URLs based on user-defined queries. It is primarily used by security auditors and researchers to uncover hidden information on public websites. Notable features include support for multiple search engines (Google and Bing), customizable query parameters, and the ability to specify the number of pages and processes for enhanced searching efficiency.

Erebus is a configurable parameter-based vulnerability scanner that utilizes YAML templates to identify vulnerabilities across multiple targets efficiently, ensuring zero false positives. Its notable features include an intercepting proxy that allows users to dynamically test parameters as they browse web applications, along with built-in support for updating and downloading community-contributed vulnerability templates. This tool is designed for rapid scanning of large networks, making it ideal for penetration testers and cybersecurity researchers.

FazScan is a versatile vulnerability scanning and penetration testing tool implemented in Perl, designed to assess various web vulnerabilities, including SQL injection and CMS-specific weaknesses. With 18 distinct options, it enables users to perform automated scans for common vulnerabilities, detect content management systems, bypass WAF protection, and even conduct denial of service attacks. Its cross-platform compatibility allows for deployment on Linux, Windows, and Android systems.

FireStorePwn (fsp) is a vulnerability scanner designed to analyze APK files for weaknesses in Firestore database security configurations, assessing both authenticated and unauthenticated access. Its primary use case is to identify insecure rules that could allow unauthorized data manipulation or access, potentially resulting in data theft and increased billing. Notable features include the ability to scan APKs with or without authentication using both user credentials and tokens.

The Frey-Rück Attack implementation allows for the extraction of the ECDSA secret key ("K") from vulnerable Bitcoin transactions. This tool is particularly useful for cryptocurrency analysts and researchers studying signature vulnerabilities in blockchain protocols, enabling them to restore Bitcoin wallets by solving the discrete logarithm problem through compromised signatures. Notable features include practical examples of vulnerable Bitcoin addresses and methodologies for conducting cryptanalysis efficiently.

Gopo is a proof-of-concept (PoC) framework designed for generating and executing multiple exploitation scripts compatible with XRAY V2's PoC functionality. It facilitates vulnerability scanning by allowing users to load and execute predefined or custom PoCs against specified targets, with options for proxy settings, threat management, and debugging features. Notable capabilities include the ability to handle rules with logical expressions, multi-threaded scanning, and customizable execution parameters to optimize performance and accuracy.

HexRays Toolbox (hxtb) is a versatile set of IDAPython scripts designed for identifying and analyzing code patterns in binaries across various processor architectures. Its primary use cases include vulnerability scanning, malware analysis, and proving code similarities, thus making it valuable for security analysts and reverse engineers. Notable features include a user-friendly GUI via hxtb_shell for query formulation, custom scripting capabilities, and batch processing scripts for enhanced automation.

htk-lite is a streamlined version of the hackers-tool-kit, maintaining essential hacking capabilities while being lightweight. Its primary use case is to facilitate various penetration testing tasks. Notable features include easy installation with a simple Git clone, user-friendly command execution, and an update script for keeping the tool current.

The Jaeles Signatures repository provides a collection of default signatures for the Jaeles project, a framework designed for security scanning and vulnerability detection. Its primary use case is to enhance the scanning capabilities of Jaeles by allowing users to implement custom and predefined signatures targeting specific vulnerabilities, misconfigurations, and sensitive information. Notable features include easy integration with Jaeles, the ability to configure and reload signatures, as well as support for active and passive detection methodologies.

The Enlightn Security Checker for Laravel is a tool designed to identify dependencies with known security vulnerabilities within Laravel applications. Utilizing an Artisan command, it allows developers to scan their composer.lock file for issues, with options to customize output format, exclude development dependencies, and manage caching directories for advisory databases. Notable features include flexibility in command parameters and integration with Composer for effective vulnerability management.

Log4J Detector is a scanning tool designed to identify vulnerable versions of the Log4J library, specifically addressing critical CVEs such as CVE-2021-44228 and related vulnerabilities. It meticulously analyzes the entire file system, including nested applications, to locate Log4J instances, even those obscured within complex structures like uber jars. Supporting multiple operating systems, this tool provides detailed reporting on the safety status of detected Log4J versions, facilitating comprehensive vulnerability assessments.

MiDas is a transformer-based tool designed for detecting vulnerability-fixing commits in software projects by utilizing a multi-granularity approach that examines commits at various levels (commit, file, hunk, line). Notable features include seven distinct feature extractors that leverage CodeBERT for contextual representation, enabling effective identification and extraction of relevant commit features. This tool facilitates improved vulnerability management and can be replicated using specific training processes and dataset requirements.

MyBBscan is a Python-based tool that scans the `/inc/plugins/` directory of MyBB 1.8 forums for known vulnerabilities in plugins. Its primary use case is to identify outdated or vulnerable plugins that could pose security risks, facilitating proactive remediation efforts. Notable features include simple command-line execution and clear user prompts for scanning specific forum URLs.

Nessusbeat is a Beat designed to monitor a local Nessus vulnerability scanner's reports directory, facilitating the export, parsing, and output of scan results to various supported Beat outputs. Its primary use case is to enhance vulnerability management workflows by automating the reporting process. Notable features include configurable report paths and potential future enhancements to support remote polling and API-based authentication.

OrgASM is a modular attack surface mapping tool designed for discovering and enumerating potential vulnerabilities within a target's ecosystem, such as subdomains, IPs, and services. It integrates seamlessly with other tools like nuclei for scanning and wappalyzer for service detection, offering features such as a customizable configuration file, pivoting to related FQDNs, and the ability to automate scans using community APIs. Users can extend its functionality by adding custom APIs and tools, making it highly adaptable for various cybersecurity needs.

The OWASP ZAP API scripts facilitate automated security testing for web applications by integrating with the OWASP ZAP penetration testing tool. Key features include scripts for API authentication and context management, allowing for streamlined attack simulations on platforms like Hackazon. These scripts are designed to be placed in specific directories within the ZAP framework for optimized functionality.

Packj is a GitHub Action that audits pull requests for malicious or risky open-source dependencies across NPM, PyPI, and RubyGems ecosystems. It employs static, metadata, and dynamic analysis to identify security vulnerabilities, flagging packages based on over 40 risky attributes derived from extensive research on supply chain attacks. Notable features include the ability to integrate seamlessly into GitHub workflows and provide feedback via comments on pull requests when risky dependencies are detected.

PathGro is a tool that enhances security testing by taking a brief list of path strings and generating extensive mappings through combinatorial growth, facilitating comprehensive path enumeration. It is primarily designed for dirbusting and forced browsing techniques to maximize attack surface coverage for software components handling pathnames. Notably, PathGro is implemented as a set of GNU Guile modules, providing command-line interface capabilities that allow for various combination generation methods.

R3CON is a multifunctional web reconnaissance and vulnerability scanning tool designed for rapid crawling and detailed vulnerability detection across various attack vectors, including XSS, SQL injection, and open redirections. It offers multi-threaded crawling capabilities and extensive reconnaissance features, such as DNS lookups, subdomain enumeration, and identification of vulnerable libraries. The tool allows users to perform both active and passive scans, providing a comprehensive solution for web application security assessments.

Repo Lookout is a large-scale security scanner designed to identify publicly exposed source code repositories that may contain sensitive information, which could lead to security incidents like data leakage and ransomware attacks. Its primary use case is to automatically detect such vulnerabilities and report them to the relevant domain's technical contact. Notable features include its focus on combating repository exposure and providing resources for mitigations related to various server software.

Scanvus is a credentialed authenticated vulnerability scanner designed for Linux hosts and Docker images, utilizing external vulnerability detection APIs such as Vulners and Vulns.io for comprehensive assessments. It supports various assessment types including localhost scans, remote SSH connections with key or password authentication, and scanning of Docker images. Notable features include detailed vulnerability reporting, interoperability with external APIs, and the ability to inventory target hosts.

Enlightn Security Checker is a command-line tool designed to identify dependencies in your application with known security vulnerabilities by leveraging the Security Advisories Database. Its primary use case is to enhance application security during development, allowing for checks against defined vulnerabilities through commands that can display results in various formats and exclude development dependencies. Key features include customizable output formats, the ability to exclude certain vulnerabilities, and an API for integration into other codebases.

SQLi-Hunter is an HTTP/HTTPS proxy server that serves as a wrapper for the SQLMAP API, designed to simplify the process of detecting SQL injection vulnerabilities. Its primary use case is to facilitate web application testing by providing tools for sending requests through a proxy, while also offering configurability for SQLMAP injection techniques, threading, and user-agent customization. Notable features include Docker support for easy deployment, the ability to persist output files, and various options to target specific hosts and adjust testing parameters.

sqlmap is an open-source penetration testing tool designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications. Its robust detection engine supports extensive capabilities such as database fingerprinting, data retrieval, and command execution on the underlying operating system, making it an essential tool for security professionals. Key features include a variety of switches for advanced testing, support for multiple databases, and the ability to access the file system via out-of-band connections.

SubDover is a multi-threaded subdomain takeover vulnerability scanner written in Python 3, featuring over 88 fingerprints of potentially vulnerable services. It incorporates a built-in subdomain enumeration method and utilizes CNAME records for verification, allowing for quick scanning of both individual targets and lists of subdomains. Notable features include configurable threading for performance optimization, result saving capabilities, and a clean output format, making it a versatile tool for security professionals.

TopScan is an automated web vulnerability scanner designed to quickly identify security weaknesses in web applications. Its primary use case includes subdomain enumeration, active subdomain verification, and vulnerability checks for XSS, information disclosure, and subdomain takeover, among other features. Notable functionalities include gathering WHOIS information, extracting URLs from sitemaps, and detecting hidden servers and admin panels.

Vulmap-Windows is a network vulnerability mapping tool designed for Windows environments that identifies potential security vulnerabilities across various network services. Its primary use case is to assist security professionals in assessing network risks by providing comprehensive views of exploitable vulnerabilities. Notable features include automated scanning, integration with various vulnerability databases, and customizable reporting options.

vuln-scanner-flask is a web application designed for scanning vulnerabilities within websites and performing network exploitation and reconnaissance. Its notable features include an intuitive user interface, fast scanning capabilities, and functionalities for scheduling assessments and generating reports. The tool aims to facilitate security assessments while ensuring user-friendliness and security.

vulnscan-parser is a Python tool designed to parse and normalize results from various security scanning tools such as Nessus, Nmap, and Metasploit into a consistent object-oriented structure. It supports multiple file formats, allowing for efficient parsing of large files without memory issues while accommodating various output formats and structures. Key features include the ability to handle overlapping files, retain unique host objects, and extract relevant security findings for further analysis.

VulScanPro is an automated web vulnerability scanner designed to identify security weaknesses in domains through over 100 attack vectors, including SQL injection and Cross-Site Scripting. It not only detects vulnerabilities but also provides detailed descriptions and potential solutions for each issue. The tool features command-line options for customizable scanning, including the ability to skip certain tools for faster results.

Web-Fuzzer is a robust web application fuzzing tool designed to automate the identification of vulnerabilities such as XSS, SQL injection, and command injection. Utilizing technologies like Selenium and BeautifulSoup, it crawls web applications to collect internal URLs, detects forms and input parameters for fuzzing, injects payloads, and analyzes responses for potential security flaws. Notably, it supports various injection types and can be used in testing environments like DVWA, with further enhancements planned for threading support and proxy usage.

WordPress_AutoExploiter is a cybersecurity tool designed for exploiting vulnerabilities in various versions of WordPress, including Stored XSS, XML-RPC DDoS, and SQL Injection. Its primary use case is for penetration testing and security assessments to identify weaknesses in WordPress installations. Notable features include targeting specific vulnerable versions and facilitating exploitation techniques through a user-friendly interface.

The OWASP ZAP project is a leading open-source web application security scanner designed to identify vulnerabilities in web applications during development and deployment. Its primary use case involves automated security testing, providing tools for both developers and security professionals to facilitate vulnerability detection and remediation. Notable features include a user-friendly interface, extensive API support, and a variety of plugins to enhance its scanning capabilities.

XAttacker is a web vulnerability scanner designed to automate the detection of security weaknesses in web applications. Its primary use case is to identify vulnerabilities such as SQL injection and cross-site scripting (XSS) through a user-friendly interface and customizable attack payloads. Notable features include multi-threaded scanning, a comprehensive report generator, and support for various web technologies.

XForwardy is a Host Header Injection scanning tool designed to identify potential misconfigurations that may allow for Host Header Injections, as well as checking for CORS misconfigurations in specified URLs. It is a lightweight tool requiring minimal dependencies and is straightforward to install and execute.

BeeXSS is an automated tool that identifies Blind XSS (Cross-Site Scripting) vulnerabilities in web applications by scanning URL parameters and injecting payloads. Its notable features include the use of customizable Blind XSS-specific payloads, headless browsing via Selenium WebDriver for efficient scanning, and detailed reporting of potential vulnerabilities. The tool is intended for educational and ethical penetration testing purposes, ensuring users have permission to test the targeted applications.

Bsqli is a customizable vulnerability scanner designed to identify SQL injection vulnerabilities using a targeted payload list, ensuring high accuracy with minimal false positives. It is optimized for rapid scanning across multiple hosts and supports multithreading for enhanced performance. Notable features include support for both single URL and file-based target inputs, as well as options for output management and SSL verification settings.

The Firmware Analysis Toolkit (FAT) is designed to assist security researchers in analyzing and identifying vulnerabilities within IoT and embedded device firmware by providing automated firmware emulation capabilities based on Firmadyne. Key features include the ability to run firmware images in a controlled environment without the need for a PostgreSQL database, as well as streamlined setup and interaction via Python scripts, enabling real-time testing and network interface configuration.

The Harbor Scanner Adapter for Aqua Enterprise serves as a bridge between the Harbor scanning API and Aqua Enterprise's scanning capabilities, enabling vulnerability scanning of container images stored in the Harbor registry. Notable features include its implementation of the Pluggable Scanners API, which allows for ad hoc scanning and the generation of vulnerability reports, while also requiring specific version dependencies and configurations to function properly. The adapter does not provide visibility or enforcement for Aqua's image assurance policies, which must be managed via the Aqua Management Console.

LMAP (Large Language Model Mapper) is an out-of-the-box evaluation tool for large language models (LLMs), aimed at aiding developers and compliance teams in assessing security and safety risks associated with LLM deployments. It includes features such as universal HTTP access for various LLMs, a user-friendly GUI for ease of use, multi-objective testing capabilities, automated and manual redteaming modules, and customizable datasets for specific applications. Additionally, LMAP streamlines the evaluation process by generating formatted reports compatible with CI/CD pipelines, ensuring comprehensive vulnerability assessment pre- and post-deployment.

The Cracked Nessus in Docker repository provides a Dockerized version of the Nessus vulnerability scanner, facilitating easy setup and deployment. Its primary use case is to enable security professionals to run Nessus scans in a contained environment, allowing for quick administration and updates via simple Docker commands. Notable features include automated installation through Docker, a straightforward user interface accessed via a web browser, and commands for migrating data between container versions.

The network-vulnerability-scanner is a tool designed to identify vulnerabilities within networked systems by analyzing hosts and services for known security flaws. Its primary use case is to enable network administrators and security professionals to assess the security posture of their network infrastructure. Notable features include support for various network protocols, customizable scanning options, and detailed reporting on discovered vulnerabilities and recommended mitigations.

This repository provides a structured introduction to offensive techniques that exploit neural networks, focusing on areas such as bug hunting, malware injection, and information extraction. Each technique is accompanied by practical exercises to facilitate hands-on learning. Notable features include detailed instructions for setting up a Python environment and using various ML tools, as well as a diverse range of attack scenarios aimed at enhancing understanding of security vulnerabilities in neural networks.

NextSploit is a command-line utility for detecting and exploiting the Next.js vulnerability identified as CVE-2025-29927. It automates the process of identifying vulnerable Next.js versions and attempts to exploit the flaw by bypassing middleware protections, potentially allowing unauthorized access to restricted content. Notable features include automated version detection using Wappalyzer, mass URL scanning capability, and an integrated Chrome browser launch for exploitation tests.

RevOK is a cybersecurity tool designed to simulate malicious targets for testing security scanners and software that processes attacker-controlled data. Its core feature, the "stub" component, allows users to listen for incoming requests and serve crafted attack responses based on customizable templates and substitution lists. Notably, RevOK has been utilized to identify critical vulnerabilities, including XSS to RCE bugs in Metasploit Pro, highlighting its effectiveness in researching and weaponizing security scanner vulnerabilities.

StealthNewSQL is an advanced command-line tool designed for detecting, exploiting, and securing NewSQL database vulnerabilities. It features capabilities such as DNS-based data exfiltration, advanced WAF evasion techniques, automated exploitation, and seamless integration with CI/CD pipelines, making it suitable for penetration testers, security researchers, and developers focused on database security. Notable functionalities include real-time monitoring, comprehensive reporting, and a modular plugin system for extending its capabilities.

The Vulnerability Scanner is a user-friendly tool designed for beginners in cybersecurity, capable of scanning systems for vulnerabilities and gathering information on potential targets. It includes features like DNS enumeration, OS detection, service/version detection, and integration with the OWASP ZAP for comprehensive security assessments. The tool is specifically built for Kali and Parrot Linux environments and requires minimal prior knowledge, making it an ideal starting point for aspiring security professionals.

wacat is an automated web application testing tool that simulates chaotic input by navigating through a web application's links and forms in a random manner, providing comprehensive testing coverage. It offers advanced features like AI-driven error detection and content generation, supports various configurations for authentication, and can run in headless mode suitable for Continuous Integration (CI) pipelines. Built on Playwright, wacat is designed for user-defined behaviors and can detect a range of issues, making it ideal for thorough application assessments in a controlled environment.

The Xray automation script is a Bash utility designed for scanning websites for vulnerabilities using the Xray tool. It provides functionalities to scan multiple URLs from a text file or a single URL, with the added capability to download and install Xray if it is not already present. Notable features include comprehensive help documentation and the ability to output scan results both to a file and the terminal.

A.S.E (Automated Security Evaluator) is a vulnerability management tool designed to automate the process of evaluating software security by integrating with OWASP Dependency-Track. Its primary use case is to assess vulnerabilities based on real-world exploitability and notify relevant teams via Slack, leveraging CVE scoring models such as CISA KEV and EPSS. Notable features include the automation of CycloneDX SBOM generation, tiered alerting for critical vulnerabilities, and configurable thresholds for alerts sent to teams.

ALNUR is an open-source end-to-end vulnerability scanner that evaluates application projects for security weaknesses, including CVEs in dependencies and potential risks in architecture, secret leaks, and agentic AI applications. Notable features include a comprehensive CVE scanner, in-depth architecture and standards compliance analysis, and support for various programming languages and frameworks, with customizable reporting options. The tool also offers optional LLM-enhanced analysis for generating executive summaries and remediation guidance.

OWASP ASST (Automated Software Security Toolkit) is an open-source, command-line web vulnerability scanner primarily focused on detecting security flaws in PHP and MySQL applications, while also capable of being extended to support additional programming languages. It provides detailed reports that not only identify vulnerabilities but also offer explanations and remediation strategies, thus educating developers on securing their code. ASST uniquely aligns its scanning approach with the OWASP Top 10 Web Application Security Risks, enhancing its effectiveness in comprehensive vulnerability assessment.

aur_checker is a command-line security analysis tool designed for inspecting Arch Linux AUR PKGBUILD files to detect potential vulnerabilities. It employs a context-aware static analysis methodology, optionally enhanced with AI inspection, resulting in detailed risk assessments that include trust signals and explainable scoring. Key features include a user-friendly output format, JSON integration for CI purposes, and the ability to analyze multiple packages or files simultaneously.

BRS-XSS is an advanced XSS vulnerability scanner designed for modern web applications, providing deterministic and auditable detection capabilities. It features context-aware scanning, WAF evasion techniques, and a comprehensive knowledge base for payload management, along with a user-friendly web interface that supports real-time monitoring, detailed reporting, and customizable scanning options. Notably, it includes a Pentesting Task Tree strategy engine for adaptive testing, A/B testing for strategy comparison, and multiple report formats for enhanced analysis.

BurpAPISecuritySuite is a professional-grade extension for Burp Suite that consolidates multiple functionalities for API reconnaissance, intelligent fuzzing, and AI-enhanced security testing into a single interface. It is designed to improve performance and usability by sharing resources across various tabs, thereby minimizing memory usage and CPU overhead while maintaining a stable and efficient testing environment. Notable features include support for REST, GraphQL, and SOAP APIs, as well as tools for passive discovery, fuzzing, and advanced security assessments based on the OWASP API Top 10 guidelines.

Cache Commander (ccmd) is a terminal UI tool designed for exploring, auditing, and managing developer cache directories on macOS and Linux. Its primary use case is to help developers identify and clean up accumulated cache data, scan for known CVEs, and manage outdated dependencies, all through an intuitive two-pane interface that supports multiple cache providers. Notable features include vulnerability scanning, reclaiming disk space from various cache types, and integration with AI for enhanced capabilities.

CloudDefense.AI is an automated web application security testing tool designed to identify vulnerabilities such as SQL injection and cross-site scripting, enhancing overall application security. It supports various security assessments including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and API scanning, facilitating a DevSecOps approach by integrating security assessments seamlessly into the development lifecycle. Notable features include its comprehensive application stack risk assessments and compatibility with multiple programming languages and integration points.

The cent-nuclei-templates repository provides a curated collection of 9,284 high-quality nuclei templates, generated and filtered through the cent tool for use with the Nuclei scanner. Its primary use case is to enhance vulnerability scanning by offering templates that are free from duplicates, noise, and outdated syntax, thereby improving accuracy and effectiveness in detecting vulnerabilities. Notable features include extensive deduplication processes, community-sourced additions, and ongoing maintenance scripts to ensure template quality and relevance.

Chaca is a native desktop web security scanner designed specifically for developers, providing fast and opinionated security audits of web applications through a user-friendly interface without requiring terminal use. It features both passive and active scanning capabilities, support for numerous content management systems and APIs, and generates detailed reports with filtering and export options. Additional highlights include a real-time progress dashboard, persistent scan history, and customizable scan presets, all built on a tech stack utilizing Rust, React, and Tauri.

Claude Cybersecurity is an AI-powered code security audit tool designed to enhance vulnerability detection and compliance verification through the integration of 8 parallel specialist agents. It stands out by addressing issues often overlooked by static analysis tools, such as business logic flaws and contextual authorization checks, while supporting a broader range of programming languages and providing in-depth threat intelligence. Notable features include seamless integration with Claude Code, zero configuration requirements, and extensive coverage of vulnerabilities including IaC and container security.

Claude Pentest Skills is a structured penetration testing skill pack designed for Claude Code that employs an OWASP-based methodology to streamline web application security assessments. It features a 6-gate validation process to filter out false positives, a series of interactive slash commands for efficient testing, and automated report generation in both markdown and PDF formats, ensuring compliance with verification and documentation standards. The tool improves the efficiency and reliability of pentesting workflows by maintaining consistent coverage tracking and enforcing scope before testing.

ClawSecure is an independent security scanning and auditing platform designed for the OpenClaw ecosystem, which focuses on ensuring the integrity and safety of AI agent skills and workflows. It features a proprietary 3-Layer Audit Protocol that has examined over 3,000 skills against all OWASP ASI Top 10 security vulnerabilities, revealing that 41% of audited skills contain security flaws. It also offers free developer tools to enhance functionality and user experience within the OpenClaw framework.

CloudVault is an enterprise-grade security scanner designed for multi-cloud storage environments, specifically targeting AWS S3, Google Cloud Storage, and Azure Blob. It offers advanced attack chain analysis, automated permission checking, and comprehensive risk scoring, facilitating real-time discovery of exposed cloud resources through certificate transparency monitoring. Notable features include interactive text user interface (TUI), alerts integration with communication platforms, compliance mapping, and various export formats for reporting and remediation.

CorsOne is a specialized security testing tool for detecting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It efficiently tests over 40 CORS bypass techniques, providing accurate results with low false positives and supporting advanced features such as customizable origin testing, proxy configurations, and multiple output formats for comprehensive reporting. The tool employs asynchronous operations for high performance and includes options for easy integration and flexible request handling.

Critikal is an autonomous security research agent specifically designed for smart contracts, capable of identifying exploitable vulnerabilities in blockchain protocols through a comprehensive analysis process. It ingests repository data, performs reconnaissance, maps the attack surface, and validates its findings, generating proof-of-concept tests using Foundry along with detailed audit reports in HTML and Markdown formats. Notable features include multi-model support for AI analysis, an integrated knowledge graph, and a user-friendly TUI demo for easy interaction.

The Flowise Dual CVE PoC is a proof-of-concept tool for exploiting two critical vulnerabilities (CVE-2025-58434 and CVE-2025-59528) in the Flowise platform, enabling an attacker to achieve unauthenticated account takeover followed by remote code execution in an automated manner. It leverages a flawed password reset mechanism and unsanitized user input in JavaScript execution to facilitate these exploits, making it particularly dangerous for both cloud and self-hosted deployments. The tool includes modular functionality for conducting attacks and is intended solely for authorized security research purposes.

DiscourseMap is an advanced security scanner designed specifically for Discourse forum platforms, offering over 25 specialized security modules for comprehensive assessments. It features capabilities such as CVE detection, plugin analysis, and API testing, all optimized for quick performance and reliability, delivering detailed reports in multiple formats. The tool is well-suited for vulnerability detection and compliance verification, making it essential for securing Discourse environments.

Docker Registry UI provides a modern web interface for managing Docker registries with enhanced features such as vulnerability scanning through Trivy, bulk operations, and multi-registry support. It facilitates repository and tag management while offering storage analytics and a responsive design. The tool is designed for both local and production setups, allowing users to quickly deploy and manage registries efficiently.

The HackerAI Framework (Project Sirra) is a modular security testing environment tailored for ethical hackers and security researchers, emphasizing cross-platform compatibility including mobile devices. It features a universal orchestrator for module management, built-in security scanning capabilities, advanced web scanning with asynchronous support, and the ability to export results in multiple formats like HTML and JSON.

FastCVE is a command-line tool designed for rapid and efficient querying of the Common Vulnerabilities and Exposures (CVE) database, enabling users to retrieve detailed information about security vulnerabilities, including descriptions, CVSS scores, and references to advisories. Notable features include its Docker containerization, automatic database management with PostgreSQL, and the ability to populate and incrementally update the local vulnerability database from multiple external sources, making it an effective solution for security professionals and developers aiming to monitor and assess vulnerabilities in their systems and applications.

Fathometer is a self-hosted CVE intelligence tool designed for administrators of plain root servers and VPSes, providing context-specific assessments of vulnerabilities. The tool leverages Trivy for scanning local hosts while utilizing a language model to evaluate the relevance of CVEs, ensuring that only pertinent findings are highlighted. Its streamlined interface features a fleet dashboard and triage workspaces tailored for individual operators, focusing on actionable insights without the complexity of extensive features common in enterprise solutions.

GVM-Docker is a containerized deployment of the Greenbone Vulnerability Manager and OpenVAS, designed for vulnerability scanning and management. It supports both AMD 64-bit and ARM 64-bit architectures, facilitating easy installation and upgrades through Docker on Linux systems and Windows with WSL 2. Notable features include compatibility with various systems, an upgrade-safe architecture, and guidance on maintaining PostgreSQL, ensuring a seamless user experience for security assessments.

hackbrowser-mcp is a specialized browser-based security testing tool that empowers AI agents to identify vulnerabilities within web applications. Unlike typical browser MCPs focused on automation tasks, hackbrowser-mcp utilizes the Model Context Protocol to facilitate in-depth security assessments, including injection testing and access control evaluations across multiple isolated user sessions. It features 39 integrated security tools, full traffic capture, and advanced reporting capabilities, enabling detailed vulnerability discovery through natural language instructions.

Honeyscanner is a vulnerability analyzer designed for honeypots, capable of automatically simulating various cyber attacks to assess the security posture of the honeypot. It employs a range of tactics, including exploitation of software vulnerabilities, denial of service, and fuzzing techniques, delivering comprehensive evaluation reports that provide security enhancement recommendations. Targeted at security enthusiasts and organizations, Honeyscanner serves as an essential tool for validating the robustness of honeypot implementations.

ICS Ninja Scanner is a specialized security assessment tool for industrial control systems (ICS) that supports comprehensive device discovery and testing across 11 protocols, including Modbus and S7. It features built-in CVE correlation, compliance mapping to frameworks like IEC 62443 and NIST 800-82, and offers functionalities such as scan diffing and industry-specific scan profiles, ensuring a thorough and tailored assessment for operational technology environments.

JitterBug is a reconnaissance tool designed to conduct passive information gathering by querying third-party databases for basic data, open ports, and potential CVEs associated with target IPs, all without direct interaction with the targets. Its stealthy operation ensures minimal detection risk, making it suitable for pre-attack reconnaissance and security assessments. Notable features include the ability to operate without direct engagement with targets and seamless integration within the DiaLog Project.

Libellux: Up & Running is a comprehensive guide for installing open-source security software from source, focusing on implementing a Zero Trust Network to bolster existing application security. The tool provides detailed documentation for notable security solutions including WireGuard for VPN, OSSEC for intrusion detection, Greenbone for vulnerability management, and ClamAV for antivirus. This resource is geared towards enhancing threat detection and prevention capabilities within various IT environments.

NextgeNmap is a security-focused automation GUI for Nmap designed for security operations and systems teams, enabling repeatable and efficient scans while minimizing noise in reporting. Key features include curated scan profiles, automated scheduling, integration with community scripts (like SearchSploit), and the generation of HTML reports for stakeholder presentation, all provided in a user-friendly cross-platform desktop application.

Nuclei is a fast tool for configurable targeted vulnerability scanning based on templates offering massive extensibility and ease of use.

Octofleet is an open-source endpoint management platform designed to facilitate the monitoring and management of a fleet of devices from a unified dashboard. Its primary use case involves deploying software, tracking vulnerabilities, managing patches, and controlling devices securely and efficiently. Notable features include a lightweight agent footprint, real-time hardware and software inventory, remote job execution capabilities, a comprehensive security center with vulnerability scanning, and extensive patch management tools.

Omnisci3nt is a unified web reconnaissance toolkit designed for cybersecurity professionals, ethical hackers, and security researchers, enabling automated analysis of critical domain-related data such as subdomains, SSL/TLS certificates, and exposed services. Its notable features include IP and WHOIS lookups, DNS enumeration, port scanning, and web crawling, all aimed at enhancing visibility into a domain's attack surface for security assessments and threat modeling. The tool is intended for authorized testing and provides a streamlined workflow for comprehensively analyzing the external exposure of web assets.

Pentester-MCP is an open-source penetration testing toolkit that integrates over 200 popular cybersecurity tools via the Model Context Protocol (MCP), enabling AI assistants to autonomously conduct penetration tests. Notable features include intelligent tool execution generated from cheat sheets, AI-optimized documentation for argument handling, and secure operation through Docker sandboxing, isolating tools from the host system to prevent dependency clutter. The toolkit covers various categories including reconnaissance, web exploitation, and network security, making it a comprehensive solution for automated penetration testing.

Pentesting Cyber MCP is a framework that provides standardized server implementations for 50 popular security tools via the Model Context Protocol (MCP), facilitating automation in pentesting and bug bounty tasks. Each MCP server encapsulates a security tool with a uniform interface, making it interoperable with any MCP-compatible client and allowing seamless integration into security assessments. Notable features include a wide range of tools covering reconnaissance, vulnerability scanning, and exploitation, all accessible through standard MCP interfaces.

Perseus is an interactive security assessment tool that enhances Claude Code's capabilities by facilitating autonomous penetration testing of your codebase. It supports multiple programming languages and frameworks, automatically detecting the project's environment and vulnerabilities across various dimensions, including API security and infrastructure. Notable features include smart auto-detection, engagement modes for different environments, and a structured four-phase assessment methodology to ensure comprehensive evaluation and reporting of security issues.

Public Skills Builder is a tool designed to generate Claude Code bug bounty skills by analyzing and extracting valuable data from over 500 public HackerOne reports and GitHub writeups. It produces 18 structured skill files, each targeting a different vulnerability class, complete with real-world techniques, payloads, and methodologies essential for enhancing bug hunting skills. Notable features include the ability to work exclusively with publicly available data and the generation of targeted skill files ready for integration with Claude Code.

`pwned-deps` is a multi-ecosystem CLI tool designed for quickly identifying compromised package versions in developer lockfiles, such as those used in npm, PyPI, Maven, Cargo, Go, and RubyGems. It provides rapid assessments—flagging risks like supply-chain malware and hijacked packages—by leveraging data from public APIs and curated feeds, with output options including terminal reports, JSON, and SARIF for integration into code scanning platforms. Key features include support for various lockfile formats, one-shot scans, and continuous monitoring modes.

Qryon is a security vulnerability scanning tool designed to rapidly identify issues within codebases, boasting scan times significantly faster than competing tools, capable of analyzing up to 1 million lines of code in under a minute. It supports 28 programming languages with a rich set of over 647 security rules covering various vulnerabilities, including SQL injection and hardcoded secrets, while offering features like interactive TUI for browsing findings, AI-powered triage, and integration with CI/CD pipelines via SARIF output. The tool leverages native Rust matchers for optimal performance and provides flexible installation options across various platforms.

RAG/LLM Security Scanner is a professional security testing tool designed to identify critical vulnerabilities in Retrieval-Augmented Generation (RAG) systems and large language model (LLM) applications, such as chatbots and knowledge retrieval systems. Notable features include advanced prompt injection detection, data leakage assessments, function abuse testing, and comprehensive reporting capabilities, making it suitable for both demo and production environments. The tool supports easy integration with popular AI systems and provides detailed JSON/HTML reports with actionable insights.

React2Shell Ultimate is a professional vulnerability scanner specifically designed for detecting the CVE-2025-66478 Remote Code Execution (RCE) vulnerability in Next.js applications utilizing React Server Components. Notable features include advanced exploitation capabilities, sophisticated techniques for WAF bypass, multiple scanning modes, and a full-featured web interface for interactive use and API access, making it suitable for authorized security testing and research.

RedTiger-Tools is a versatile automation tool designed for penetration testing (pentesting) and open-source intelligence (OSINT) that aims to consolidate multiple operations into a single, configurable platform. It features a plugin system for extending functionality, centralized configurations using JSON files, and dual operation modes (CLI and interactive interface), ensuring compatibility with both Windows and Linux environments while adhering strictly to legal and ethical standards for usage.

Safelog4j is an instrumentation-based security tool designed to help teams identify, verify, and mitigate the log4shell vulnerability (CVE-2021-45046) without the need for scanning or upgrading log4j. The tool utilizes interactive application security testing (IAST) to confirm exploitability and runtime application self-protection (RASP) to prevent exploitation by disabling the vulnerable JNDI lookup code dynamically. Unlike traditional scanning methods, Safelog4j provides greater accuracy and speed by operating from within the running application context.

SCOUT is an advanced firmware analysis platform designed for product security and internal red-team operations, transforming raw firmware blobs into evidence-backed exploitability chains and lab-bounded proof-of-vulnerability modules. It features a hybrid analysis engine capable of auditing both ELF binaries and shell scripts, emphasizing controlled weaponization and audit-ready reporting while reducing false positives. Notably, SCOUT prioritizes detailed evidence lineage and supports a structured approach to exploit development, favoring higher fidelity over traditional bulk scanning techniques.

SecGate is a lightweight, integrated security tool for Linux servers that combines gateway authentication, attack monitoring, vulnerability scanning, and AI assistance into a single package with minimal resource requirements. It offers one-command deployment, operates with around 120MB of memory, and includes unique features such as customizable TCP port authentication, multi-node management via SSH, and comprehensive security dashboards. Ideal for individual developers and multi-service deployments, SecGate provides a zero-configuration solution for rapid security enhancements.

Secrover is an open-source security auditing tool that generates comprehensive, human-readable security reports, focusing on vulnerabilities in dependencies, code, and domains. Its notable features include easy setup via YAML configuration, automation capabilities with scheduled scans and GitHub Actions, cross-platform compatibility, and flexible report exports to various remote destinations. The tool aims to provide actionable insights for users, making it accessible for both technical and non-technical audiences.

ShubhamWebScript is a Python-based website vulnerability checker designed for educational and ethical hacking purposes, allowing users to assess the security of web applications through automated scanning of parameter-based URLs. It detects common vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), and Remote Code Execution indicators, while also performing server header fingerprinting. The tool features both single and bulk URL scanning capabilities, making it beginner-friendly and suitable for learning basic web security practices.

SmartCode-Guard is an AI-powered static code analysis tool specifically designed to identify security vulnerabilities in Java source code. It integrates a modular architecture that includes a parser for extracting code structure, a rule engine for detecting common security anti-patterns, and an AI engine for deep semantic analysis, making it highly effective for enforcing secure coding practices and allowing for customization through extensible security rules. Notable features include static rule enforcement and intelligent analysis for preparing code snippets for LLM-based audits.

Vigil is an open-source, AI-powered security operations platform designed for comprehensive vulnerability management, incident response, and compliance tracking within a unified Express.js framework. Key features include six built-in scanners (Nmap, Nuclei, Trivy, Nikto, OpenSSL, DNS), 20 autonomous agents for parallel operations, and support for custom AI integrations, all while maintaining a lightweight architecture without external dependencies. The platform also offers advanced functionalities like role-based access control, two-factor authentication, and an encrypted credential vault for enhanced security.

VISTA (Vulnerability Insight & Strategic Test Assistant) is an AI-driven extension for Burp Suite that enhances security testing through real-time traffic analysis and intelligent vulnerability detection. It offers notable features such as an interactive AI advisor for context-aware testing suggestions, customizable analysis templates, and a comprehensive payload library, enabling pentesters to conduct faster and more systematic assessments. Additionally, VISTA supports multiple AI providers, including OpenAI and Azure, to tailor its guidance to user needs.

VulnScout is a security analysis tool designed for whitebox security reviews, offering offline quick scans and evidence-backed verification for identifying vulnerabilities within codebases. It provides features such as shared findings documentation, various output formats for reports, and support for multiple deep analyzers, making it suitable for integration into continuous integration workflows. Notably, it operates without requiring a remote service and includes capabilities for auditing, verifying findings, and generating structured reports.

VulnHawk is an AI-powered code security scanner designed to identify vulnerabilities that conventional SAST tools like Semgrep and CodeQL may overlook, particularly those related to business logic flaws where the absence of expected patterns is key. It employs contextual code analysis by comparing similar components across a codebase, facilitating the detection of security issues without the need for extensive configuration or custom rules. Notably, it supports various AI backends, integrates easily into CI/CD pipelines, and operates entirely locally or privately using options like Ollama.

Ward is a specialized security scanner for Laravel applications that performs targeted security checks by understanding the application's structure, including routes, models, and configuration files. Notable features include live vulnerability lookups against the Packagist advisory database, comprehensive checks for common misconfigurations, and the ability to generate detailed reports on security findings, making it a valuable tool for both development environments and CI/CD pipelines.

Wordfence CLI is a high-performance security scanner designed for detecting PHP malware and vulnerabilities in WordPress installations. Written in Python, it operates in a multi-process environment, allowing for parallel scans, scheduling, and integration with other commands via input and output piping. Notable features include the ability to scan directories for malware and vulnerabilities efficiently, as well as comprehensive installation and configuration documentation.

Worm GPT Core is an advanced adversarial prompt delivery framework designed for AI researchers and cybersecurity professionals to evaluate and exploit vulnerabilities in large language models (LLMs). It automates the delivery of jailbreak prompts and features innovative mechanisms for alignment evasion, multi-threaded prompt execution, and seamless integration with both commercial and local LLMs. The tool aims to enhance penetration testing capabilities within AI systems while ensuring zero telemetry and optimized performance.

wp-taint-scan is a specialized static analysis tool designed to detect genuine vulnerabilities in WordPress plugins using a native Go-based taint analysis engine. It enables users to scan multiple versions of plugins in parallel and offers features such as detailed source-to-sink dataflows, version diffs to track changes in vulnerabilities, and a thorough understanding of the WordPress security model, significantly reducing false positives. Notable vulnerability classes include SQL injections, XSS, path traversal, and missing authorization issues, making it an essential tool for enhancing WordPress security.

WPRecon is an advanced WordPress reconnaissance and vulnerability scanning tool designed for security engineers to identify vulnerabilities, misconfigurations, and information disclosure in WordPress installations. It utilizes a YAML-driven template architecture that facilitates easy extensibility, rapid deployment as a single binary, and features such as high-performance parallel scanning, a diverse library of over 150 templates, and multi-format output options. Notable capabilities include automatic retries for failed requests, comprehensive HTTP operations, and a variety of matchers and extractors for efficient data retrieval and analysis.

XSSniper is an advanced open-source XSS vulnerability scanner designed for professional security testing. It features asynchronous scanning for enhanced performance, a comprehensive payload library tailored to the latest CVEs, and sophisticated WAF bypass techniques. Notable capabilities include intelligent context-aware detection, smart parameter discovery, and detailed vulnerability reporting for effective analysis of web applications.

A lightweight active and passive scanner that combines the advantages of local and distributed models, supports dynamic external plugin import, and is dedicated to exploring web black-box vulnerabilities.

ZENVORA VulnScan v2.0 is a comprehensive vulnerability scanner designed for web applications, focusing on detecting various security issues such as SQL injection, cross-site scripting (XSS), and command injection. It includes features like anonymity levels through Tor and ProxyChains, automated report generation in TXT and JSON formats, and an extensive list of tests for common vulnerabilities. This tool is intended for authorized use only, highlighting the importance of ethical scanning practices.

AEM Dispatcher Security Scan is a command-line tool designed to perform security assessments on Adobe Experience Manager (AEM) Dispatcher configurations. It consolidates known security-sensitive URLs for AEM Dispatcher, allowing users to specify target websites and customize scan parameters while leveraging Docker for deployment. Notable features include configurable HTTP request timeouts, support for custom test paths, and an easy-to-use interface via command-line options.

Agent Audit is a security tool designed to identify vulnerabilities in AI agent code prior to production deployment. Its primary use case involves scanning for risks associated with unsafe inputs, command execution, and configuration errors, utilizing a framework of 72 rules aligned with the OWASP Agentic Top 10. Notable features include tool-boundary taint tracking, configuration auditing, and the ability to enforce security measures within continuous integration workflows.

The agent-security-scanner-mcp is a comprehensive security scanning tool designed for AI coding agents, providing functionalities to audit code, servers, prompts, and AI-generated packages for vulnerabilities. Key features include the ability to grade agent security, identify risks like SQL injection and package hallucinations, generate Software Bill of Materials (SBOMs), and facilitate semantic reviews using project context. The tool supports various AI platforms, ensuring robust integration and security checks before code execution.

AIROM is a tool designed for scanning filesystems, git repositories, container images, and Kubernetes workloads to identify and document AI components in software. It generates an AI Bill of Materials that includes models, datasets, and frameworks used in the code, providing line-by-line evidence for each entry. Notable features include support for various scan targets, output formats like CycloneDX and SPDX, and the ability to gate builds based on identified risks.

The Vulners Python SDK is a comprehensive client for accessing Vulners' vast vulnerability intelligence database, facilitating queries on CVEs, exploits, and advisories enriched with risk metrics like CVSS and EPSS. It enables users to assess vulnerabilities across various software and systems, stream data for integration into custom pipelines, and set alerts for new matching vulnerabilities, all while supporting asynchronous operations for enhanced performance. Notably, it incorporates features for tracking active exploits and provides an AI-ready infrastructure for real-time data processing.

ApiHunter is an asynchronous, modular API security scanner designed for baseline testing and regression detection in APIs. It facilitates both offensive and defensive use cases, enabling red-team activities like pentesting and exploit validation, as well as providing CI/CD regression gating and early misconfiguration detection. Notable features include adaptive concurrency, support for a variety of API security checks (such as CORS, CSP, GraphQL), and the ability to scan large numbers of targets rapidly with integrated threat intelligence capabilities.

APISCAN is an advanced API vulnerability scanner that systematically evaluates APIs against the OWASP API Security Top 10 (2023) by utilizing OpenAPI/Swagger specifications. Notable features include automatic form login detection, deep scan modes for comprehensive testing, real-world attack pattern detection, and a user-friendly cross-platform GUI for enhanced usability. The tool is designed to proactively identify and model security vulnerabilities, providing actionable insights with detailed evidence.

Artifact Keeper is an enterprise-grade open-source artifact registry designed to support over 45 package formats, including Maven, NPM, Docker, and more. It features a WASM plugin system for custom format handling, automated security scanning for vulnerabilities, and a robust architecture with multi-auth support, full-text search capabilities, and artifact signing functionalities. Built in Rust, it emphasizes security with hardened container images and advanced replication features for scalable deployment.

auditor-skill is an open-source AI-driven security audit tool designed for auditing Solana programs and applications. It leverages AI agents to evaluate codebases against 1,346 verification items across 20 security domains and 131 known attack vectors, producing detailed reports that include executable proofs of vulnerabilities and suggested fixes. Notable features include a comprehensive audit lifecycle, token efficiency through pre-scanning, and deep coverage of Solana-specific methodologies.

Awesome Security Pipeline is a comprehensive guide designed for selecting and implementing open-source security tools within CI/CD pipelines. It features a pre-configured baseline that integrates multiple tools such as Gitleaks, Semgrep, and Trivy, enabling continuous security validation and machine-readable evidence generation. The repository is actively maintained, with weekly status checks and regular updates to ensure the effectiveness of the security controls and methodologies provided.

BitrixProbe is a Python-based vulnerability assessment tool specifically designed for CMS 1C-Bitrix/Bitrix24 installations. It offers dual modes of operation: `pentest` for external HTTP/HTTPS scans and `audit` for authenticated SSH scans, enabling comprehensive evaluation of both public exposure and server configurations. Notable features include integration with vulnerability databases, enumeration modules, and the ability to generate standardized reports, thus facilitating effective security assessments and audits.

Cataam is an open-source security toolset that provides a variety of scripts and templates aimed at enhancing security and compliance practices for organizations. It features practical functionalities such as hardening scripts, CVE detection tools, and compliance documentation, making it suitable for security teams, DevOps, and compliance engineers. Notable offerings include a local-first prompt hygiene tool, CVE detection scripts updated promptly after disclosures, and a comprehensive collection of CIS Benchmark guides and compliance templates.

CERT-X-GEN is a polyglot execution engine designed for vulnerability detection, allowing users to write security checks in multiple programming languages including Python, Go, Rust, C, and Shell. It provides a unified execution layer that enables complex detection logic, such as multi-step protocol conversations and performance-critical operations, and is tailored for integration in CI/CD environments. Notable features include language-agnostic templates, sandboxing capabilities, and the ability to mix various programming languages within a single scan.

ChYing is an open-source penetration testing tool designed to provide an interactive platform for security professionals, facilitating the capture, modification, and replay of HTTP/HTTPS traffic. Its notable features include a lightweight UI, built-in scanning capabilities from the Jie tool, automated attack testing with multiple payload types, and an intuitive workflow for JWT parsing, which makes it an alternative to heavier tools like Burp Suite. The tool aims to offer a modern and customizable solution for active and passive web vulnerability assessments.

cloud-audit is an open-source AWS security scanning tool designed to identify attack paths, IAM escalation routes, and prioritize necessary fixes based on their impact on security. It operates in a read-only mode, ensuring no modifications are made to the user's AWS infrastructure while providing detailed reports on correlations between vulnerabilities and suggested remediation steps, including AWS CLI and Terraform fixes per finding. Key features include the identification of attack chains using MITRE ATT&CK methodology, root-cause analysis for prioritized fixes, and a simulation function to evaluate the potential impact of proposed changes.

CSCAN is an enterprise-level distributed network asset scanning platform designed for comprehensive asset management and vulnerability detection. Its notable features include a distributed architecture for flexible scalability, automated scanning pipelines, customizable password dictionaries, periodic task scheduling, and real-time notification subscriptions, supporting extensive data isolation across multiple workspaces. This tool is ideal for organizations seeking to efficiently monitor and secure their network infrastructure.

CVE Lite CLI is a terminal-based vulnerability scanning tool designed to analyze project lockfiles and provide actionable remediation commands. It focuses on delivering validated fix commands alongside parent-aware guidance for transitive dependencies, emphasizing a remediation-first approach while ensuring that no sensitive data leaves the user's machine. As an officially recognized OWASP Lab Project, it integrates seamlessly into CI workflows, promoting secure coding practices.

cwe_checker is a static analysis tool designed to identify common software vulnerabilities, specifically by detecting classes of bugs known as Common Weakness Enumerations (CWEs) in ELF binaries across multiple CPU architectures. It leverages Ghidra for disassembly and utilizes a plugin-based, extensible architecture that supports customizable analyses, making it a useful resource for firmware analysis on Linux and Unix systems. Notable features include easy setup via Docker, support for various architectures, and the ability to integrate with the FACT framework for enhanced analysis capabilities.

Cyber Neo is an open-source cybersecurity analysis agent designed to run within Claude Code, enabling developers to conduct comprehensive security audits on their projects effortlessly. The tool scans for vulnerabilities across 11 categories, including code security, authentication, cryptography, and dependency vulnerabilities, providing prioritized reports with concise remediation guidance. Notable features include no installation requirements, real-time operation, and the ability to run five parallel subagents for rapid assessments.

DeepSec is an AI-driven security platform that integrates code security auditing and authorized penetration testing into a unified CLI and terminal workbench. It features a three-layer detection architecture for real-time vulnerability scanning, leveraging regex, AST analysis, and LLM semantic evaluation, along with IDE plugins for seamless development integration. The platform is designed to enhance security efficiency by augmenting traditional methods with advanced AI capabilities.

DianXing (点星) is an AI-driven end-to-end code security auditing system that autonomously identifies and verifies vulnerabilities in source code without human intervention, offering a structured output of detected issues. Unlike traditional SAST tools, it employs semantic understanding to uncover deep vulnerabilities, such as authentication bypass and privilege escalation, which are often missed by conventional scanners. The system has demonstrated the ability to autonomously exploit zero-privilege remote code execution vulnerabilities, reinforcing the need for responsible disclosure of its capabilities.

DLL Hijacking Vulnerability Scanner is a specialized tool for identifying DLL hijacking vulnerabilities within signed Windows executable files. It features automated scanning, DLL dependency analysis, and comprehensive filtering options, enabling security professionals to test executables for hijacking susceptibility and analyze their DLL loading behaviors, as well as generating detailed vulnerability reports.

DockSec is an AI-powered Docker security scanner designed to translate complex security vulnerabilities into actionable insights for developers. It leverages popular security scanners like Trivy and Hadolint to provide prioritized vulnerability assessments and plain English explanations, while also suggesting specific fixes for Dockerfiles and generating interactive security reports. The tool ensures privacy by conducting scans locally, with options for local AI processing, minimizing external data exposure.

Drogonsec is an open-source security scanner designed to perform comprehensive security assessments through Static Application Security Testing (SAST), Software Composition Analysis (SCA), and secret detection, aligning with the OWASP Top 10:2025 framework. It supports over 20 programming languages and various deployment strategies, including local or cloud-based AI remediation for findings. Key features include the ability to scan for vulnerabilities, identify misconfigurations in Infrastructure as Code (IaC), and integrate with CI/CD pipelines for automated security reporting.

Eraser is a tool designed for Kubernetes administrators that facilitates the removal of non-running images from all nodes within a cluster. Its primary use case is to help optimize storage and resources by cleaning up unused images, thereby improving cluster efficiency. Notable features include easy integration with Kubernetes environments and a user-friendly quick start guide for rapid deployment.

The fleet-cve-scanner is an open-source, PowerShell 7-based CVE scanner designed for managing vulnerabilities in software across RMM-managed fleets, without the need for agents or appliances. It cross-references the software inventory of managed endpoints against multiple authoritative security feeds to determine if installed software versions are vulnerable and assess their urgency. Key features include the ability to generate per-device CSV reports, a SQLite history database for change tracking, and an HTML dashboard, making vulnerability assessment and management streamlined and efficient.

Foxguard is a comprehensive security scanning tool designed for local environments, offering fast analysis of code, secrets, dependencies, and post-quantum cryptographic risks. It boasts over 200 built-in rules across 12 programming languages, supports taint tracking, provides efficient CI integrations, and features output formats compatible with various tools such as SARIF and Semgrep. Key capabilities include secrets scanning, OSV-backed dependency checks, and the ability to pinpoint changes in code branches through diff mode scanning.

Observer is a command-line tool designed to analyze codebases and generate a comprehensive production health report, all from a single, offline binary with no dependencies or account requirements. It combines various analysis methods—such as static analysis, dependency checks, and runtime error detection—into a unified report that includes a security rating and suggested fixes for identified issues. The tool is aimed at developers seeking to efficiently identify and remediate production problems without navigating complex code and server logs.

Grummage is an interactive terminal frontend for the Grype vulnerability scanner, designed to simplify the analysis of Software Bill of Materials (SBOMs) by providing a user-friendly interface for navigating and viewing vulnerability details. Its notable features include real-time utilization of the Grype vulnerability database, customizable views by package name, vulnerability ID, package type, and severity, along with intuitive navigation controls. Grummage aims to streamline the process of vulnerability management for developers without the need to delve into complex query syntax.

The Harbor Scanner Adapter for Anchore Engine/Enterprise facilitates the integration of Harbor's scanning capabilities with the Anchore API, enabling vulnerability assessments on Docker images stored within Harbor. It offers TLS/HTTPS protection for API communications, supports authentication through Bearer tokens and Basic authentication, and can be configured via environment variables or configuration files. This tool is essential for users seeking to leverage Anchore's scanning features directly from Harbor, enhancing their image security posture.

honey is an automated supply-chain security tool that orchestrates multiple security scanners to assess vulnerabilities across a developer's machine. It integrates the findings from various scanners, such as bumblebee for compromised packages and osv-scanner for known CVEs, providing a unified verdict and optional daily reports through a messaging system. Key features include scheduling scans, customizable reporting policies, and the ability to suppress previously acknowledged findings.

isitsecure is an AI-powered security scanner designed for modern web applications, integrating Static Analysis (SAST), Dynamic Analysis (DAST), and AI-driven code review into a single scanning process. Its notable features include automatic generation of DAST tests based on SAST findings, AI-generated code patches for vulnerabilities, and support for multiple programming languages and frameworks. This tool targets developers aiming to improve code security without requiring deep security expertise, offering a comprehensive report along with actionable fixes for identified issues.

It-Depends is a tool designed for automatically generating dependency graphs and Software Bill of Materials (SBOM) for various programming packages and source code repositories, supporting languages such as Go, JavaScript, Rust, Python, and C/C++. Key features include complete dependency version resolution, C/C++ support without the need to build projects, automated mapping of native library dependencies through dynamic analysis, and integration with vulnerability scanning from the OSV database.

L0p4Map is a robust network monitoring and visualization tool that enhances the capabilities of Nmap, providing security researchers and network administrators with detailed insights into their network infrastructure through an intuitive interface. Key features include continuous monitoring of network traffic, real-time alerting for unauthorized devices, extensive device fingerprinting, and the ability to generate a real-time graphical representation of network topology. The tool supports multiple platforms (Linux, Windows, macOS) and integrates seamlessly with existing Nmap functionalities to deliver a comprehensive view of network security.

MEDUSA is an AI-first security scanner designed to detect vulnerabilities in AI/ML applications, offering over 40,000 detection patterns and built-in rules for identifying threats such as API key leaks and AI supply chain attacks. Notable features include no setup required for usage, the ability to scan GitHub repositories for potential repo poisoning, and interactive tools for purging leaked information. The tool supports parallel processing for speed, integrates with various IDEs, and provides multiple reporting formats for versatility in usage.

NSAuditor AI is a modular, AI-assisted network security audit platform designed to assess and prioritize vulnerabilities without data exposure, operating entirely within your infrastructure. It utilizes 27 specialized scanning plugins to generate AI-powered vulnerability reports while ensuring zero data exfiltration, as all processes including analysis and monitoring are conducted offline and any external API calls are opt-in. This tool emphasizes privacy and security by ensuring that sensitive scan data never leaves the user's environment.

Nuclei is a high-performance vulnerability scanner that utilizes YAML-based templates for customizable vulnerability detection, aiming to reduce false positives by mimicking real-world attack scenarios. Its notable features include ultra-fast parallel scan processing, support for multiple protocols such as HTTP and DNS, and seamless integration into CI/CD pipelines as well as various issue tracking and logging systems. The tool is designed for security professionals to stay ahead of trending vulnerabilities while conducting thorough regression testing.

Nyx is a local-first security scanner designed for cross-language taint analysis of code repositories, providing a sandboxed dynamic verification environment. Its notable features include a user-friendly React-based UI for real-time results, a detailed flow visualizer for tracking data paths, and the ability to persist triage states alongside code commits, ensuring collaboration within teams. Additionally, Nyx can be seamlessly integrated into CI pipelines, generating SARIF reports for GitHub Code Scanning.

OmniStrike is a state-aware security scanning tool for Burp Suite that enables precise and customizable security testing by allowing users to target individual parameters within requests. It features 14 active scanning engines, 10 technology-aware scanners, and session automation capabilities, alongside optional AI analysis for focused vulnerability testing. This tool is designed to facilitate detailed assessments of modern web technologies while maintaining user control over scanning processes and findings management.

OpenA2A CLI is a unified command-line interface designed for the OpenA2A security toolchain, enabling users to identify and rectify security vulnerabilities such as credential leaks, shadow AI, and unsigned configurations with a single command. Notable features include automated security reviews and remediation capabilities, Apache 2.0 licensing, and integration with various security-focused sister packages.

PenHunter is a modular web vulnerability scanner designed for penetration testers, bug bounty hunters, and security researchers, focused on identifying a wide range of web vulnerabilities, including XSS, SQL Injection, and RCE. It features advanced detection methods, such as boolean and time-based techniques, as well as built-in WAF evasion capabilities, and can integrate with external tools like sqlmap and dalfox. The tool supports concurrent scanning, interactive CLI usage, and provides organized output in multiple formats, enhancing workflow efficiency in security assessments.

Pentest Skill is a comprehensive black-box web penetration testing toolkit designed to streamline the bug bounty workflow through a structured five-phase approach: Intake, Recon, Enum, Hunt, and Report. Notable features include a workflow controller with checkpoints for phase progression, a collection of 48 Python scripts for various testing phases, and an extensive library of attack playbooks and payloads, facilitating targeted vulnerability assessment and reporting.

BitDefender Total Security Ultimate Protection is a comprehensive cybersecurity suite that functions as a modular framework for fortifying network defenses against a wide array of cyber threats. Its primary use case revolves around system hardening, employing features such as vulnerability scanning, real-time threat correlation, and sandbox-based execution to protect various environments from evolving threats. Notable capabilities include automated policy enforcement, advanced heuristic analysis, and deep kernel inspection for rootkit remediation, all integrated within a responsive interface supporting multilingual operations and continuous 24/7 support.

pi-codex-security is a tool that integrates OpenAI Codex Security functionality into pi agent sessions, enabling users to scan repositories for vulnerabilities, review findings by severity, and automatically fix issues. Notable features include customizable scanning options, detailed artifact generation in various formats (e.g., SARIF and JSON), and a user-friendly command interface for initiating scans and managing authentication. This tool is particularly useful for developers who want to enhance their code security seamlessly within their development environment.

Plankton is a command-line web vulnerability scanner designed to conduct checks against the OWASP Top 10 (2021) vulnerabilities on specified URLs. It generates colorful terminal outputs and supports multiple report formats, including a styled HTML report, JSON, and plain text, enabling users to customize scan parameters with ease. Key features include 12 specific vulnerability checks, configurable options such as timeout and user-agent, and an accessible single-file script for quick deployment.

The presidio-hardened-vuln-scanner is a web application vulnerability scanner designed to analyze both a deliberately vulnerable Flask application and its hardened version. It facilitates a comprehensive security assessment through static analysis, dynamic scanning, and manual exploitation, highlighting various vulnerabilities such as SQL injection and XSS, with a structured approach to measure and verify fixes. Notable features include integration with tools like Bandit and pip-audit for static analysis, as well as a custom scanner to dynamically check for vulnerabilities.

Quodeq is an open-source AI-powered tool designed for scanning codebases to detect security vulnerabilities and design flaws, aligning with the ISO 25010 quality dimensions. It provides detailed findings such as grades, violations with line numbers, and fix plans, with every issue mapped to a corresponding CWE identifier. Notably, it operates locally without telemetry, runs on various platforms, and offers both cloud and local model configurations for flexibility and privacy.

Refuse is a self-hostable HTTP service that supports the refuse-cli tool, designed to block the installation of vulnerable packages by querying a local SQLite database populated with public vulnerability feeds. It features a REST API for package checks, a built-in admin UI, and frequent updates from various sources, allowing users to verify package safety and enforce security policies during package management operations.

RepoMind is an AI-powered tool designed to facilitate the understanding of public GitHub repositories and developer profiles through advanced code reasoning and architecture visualization. It offers zero-setup access for public repositories, context-aware analysis to provide relevant files, security scanning with verification reporting, and real-time feedback during the analysis process. Notable features include automated architecture mapping, a streamlined user interface for discovering trending repositories, and a robust cleaning mechanism through its Agentic Context-Augmented Generation architecture for reliable query responses.

RouteVulScan is a passive recursive path probing extension for Burp Suite that leverages the Montoya API to perform low-noise vulnerability detection during web security testing. It automatically scans traffic for hidden endpoints and sensitive files using customizable YAML-based detection rules, allowing users to quickly identify high-value vulnerabilities without the need for manual dictionary management. Key features include automatic path recursion, support for active scanning of individual requests, and a comprehensive rules engine for effective vulnerability assessment.

Bawbel Scanner is an open-source tool designed to assess MCP servers and skill files for vulnerabilities, specifically providing OWASP AIVSS scores without executing any code. Its primary use case includes detecting AVE vulnerabilities and ensuring compliance with the MCP specification, while notable features encompass a variety of focused scans, conformance grading, and vulnerability management functionalities. The tool supports formats for reporting, a public vulnerability database, and provides guidance for remediation, making it a comprehensive solution for security assessments of MCP environments.

SEC-AF is an AI-native security auditing tool that confirms exploitability of vulnerabilities in codebases by providing a detailed data flow trace and verifiable evidence for each finding. It allows users to initiate audits via a single API call or command line interface, returning comprehensive reports that include severity, exact location, and a verdict on each vulnerability. Notably, SEC-AF offers a cost-effective solution for thorough security assessments, typically costing about $1.40 per full audit.

The Shai-Hulud 2.0 Detector is a cybersecurity tool designed to protect projects from the Shai-Hulud 2.0 npm supply chain attack, a significant threat that compromised numerous packages in the npm ecosystem. Its primary use case involves detecting vulnerable packages and facilitating community reporting of compromised software, enhancing the security posture of development environments. Notable features include automated daily updates of an affected packages database, advanced configuration options for tailored scanning, and support for various integration methods including GitHub Actions and local CLI usage.

ShieldEye Core is a desktop network security scanner designed for Linux, primarily aimed at security researchers, pentesters, and system administrators. It utilizes Nmap for comprehensive port and service discovery, identifies vulnerabilities in common CMS platforms by cross-referencing with the CIRCL CVE database, and evaluates HTTP security headers, all presented through a GTK 4 GUI with intuitive reporting features. Key functionalities include customizable scanning profiles, a detailed analysis of web security, and robust safety measures against unauthorized access and disruption.

ShieldEye ComplianceScan is a web compliance and vulnerability scanner that assesses web targets against key security standards including GDPR, PCI-DSS, and ISO 27001. It features a GTK4 desktop interface, a CLI for automated scanning, and a REST API for integration, while providing detailed reports that include CVSS v3.1 scoring and export options in various formats. The tool evaluates critical aspects like TLS configuration, security headers, and cookie settings, making it suitable for regular compliance checks and configuration sanity evaluations.

Sighthound is a Tree-sitter based static vulnerability scanner designed for identifying security vulnerabilities in source code through AST-aware rules and taint-flow analysis. It supports multiple programming languages, executes scans in parallel, and offers output in various formats including JSON, CSV, and SARIF for integration with GitHub Code Scanning. Notably, Sighthound allows for custom rule packs and provides both pattern and taint mode analysis, catering to complex multi-file projects.

SILENTCHAIN AI™ - Community Edition is a Burp Suite extension designed for AI-powered passive vulnerability analysis, providing intelligent detection of OWASP Top 10 vulnerabilities and security misconfigurations in real-time HTTP traffic. Notable features include context-aware detection using various AI models, detailed reporting with CWE and OWASP mapping, and robust data privacy measures through automatic sensitive data redaction. The tool enhances traditional security scanning by focusing on real vulnerabilities with zero false positives, making it a significant addition to web application security testing.

`still_active` is a dependency auditing tool that evaluates the maintenance status of packages across multiple ecosystems, including Ruby, npm, PyPI, Cargo, and more, by identifying archived repositories, lack of recent releases, and vulnerabilities that remain unpatched. Its notable features include last-commit activity checks, OpenSSF scorecard evaluations, and detection of “poison-pill” dependencies that may hinder security updates. This tool serves as a complementary addition to existing package management solutions by proactively highlighting risks associated with outdated or abandoned dependencies.

Symfony Security Auditor is an AI-driven security auditing tool designed for Symfony applications, focusing on identifying application-level flaws that traditional static analysis tools may overlook. It features an adversarial Attacker and Reviewer loop to validate vulnerabilities and produces reports in multiple formats, including JSON and HTML. The auditor can operate in two modes: as a standalone CLI tool or integrated into Symfony applications, providing flexibility for different auditing needs.

Synapse is a governed control plane designed for comprehensive software composition analysis, vulnerability detection, and reporting, facilitating security assessments in a controlled environment. Its primary use case revolves around automating security workflows, ensuring tamper-evident evidence collection, and allowing for deterministic scanning across various ecosystems with multiple built-in scanners. Notable features include a robust SBOM generation, risk-based prioritization of findings, and strict adherence to authorization and scope constraints before tool execution.

Terraview is an open-source security analysis tool designed for Terraform plans that integrates static scanners like Checkov, Trivy, and Terrascan with AI contextual analysis, executing these processes in parallel. It inspects infrastructure provisioned with Terraform to identify security misconfigurations and compliance issues while enriching results through multi-provider contextual insights. Notable features include built-in security scanner capabilities, seamless configuration management, and native policy-as-code support, all without external dependencies.

trawld is a package vulnerability monitoring tool designed for developer fleets, enabling continuous oversight of project dependencies across enrolled machines. It features a real-time dashboard for vulnerability tracking using a Cloud Brain and a global npm agent that automates project discovery, scheduled rescans, and maintains live status updates. With seamless onboarding and no code modifications required, trawld enhances security management for development environments.

Vigolium is a high-fidelity vulnerability scanner that offers two distinct scanning modes: Native Scan for fast and flexible multi-phase assessments, and Agentic Scan for autonomous, AI-driven code auditing. It features 317 scanner modules covering a wide array of vulnerabilities, including OWASP Top 10, and employs out-of-band testing to enhance accuracy. The tool is designed for both manual and automated security assessments, enabling comprehensive coverage of web applications and codebases.

Vuls is an agent-less vulnerability scanner designed for Linux, FreeBSD, and macOS systems, written in Go, that automates the detection of vulnerabilities by continuously monitoring installed software against a variety of vulnerability databases. It generates regular reports that inform users about affected systems and related vulnerabilities, mitigating the risks of human oversight in the management of software updates. Notable features include high-quality scanning capabilities across major operating systems and integration with multiple security advisories and vulnerability databases.

WebScan is an automated web security auditing tool designed to crawl, discover, and audit web applications. It features a robust plugin architecture with 41 plugins, offers multiple report formats, and is tailored for both site owners and bug hunters, providing user-friendly options like safe mode and detailed explanations of findings, as well as advanced stealth capabilities for more experienced users. Notable capabilities include request rate limiting, user-agent rotation, and proxy support to maintain the user's anonymity.

wscan is a comprehensive web security scanner designed for active, passive, and AI-driven penetration testing, addressing a wide range of vulnerabilities from the OWASP web vulnerability landscape. Key features include a browser-based WebUI for scan management, support for multiple scanning modes, an extensive library of built-in detection plugins, and integration with external POC engines like Nuclei, Xray, and Goby. Additionally, it offers an AI agent mode for automated testing and a reverse-connect platform for exploiting blind vulnerabilities.

WSHawk is an open-source toolkit designed for WebSocket security testing and web application penetration testing, integrating a CLI scanner, web dashboard, and desktop application. Notable features include stateful WebSocket testing, context-aware payload evolution, browser-assisted evidence collection using Playwright, and a comprehensive suite of web pentesting tools such as fuzzers and interceptors, all under the AGPL-3.0 license. The toolkit also supports project-backed workflows and offers various integrations and reporting formats for efficient security assessment.

Xalgorix is an open-source AI-driven penetration testing platform that autonomously conducts comprehensive pentesting methodologies and verifies each finding through an independent verification process, ensuring the delivery of proven vulnerabilities rather than uncertain results. It is designed for self-hosting and supports a "bring-your-own-LLM" model, allowing integration with user-defined language models, while catering to both Linux environments and containerized implementations through Docker. Notable features include its autonomous execution, independent verification of findings, and the ability to run in a secured Docker container.

Awesome Hacking & Cybersecurity Learning Path is a comprehensive resource designed to guide individuals from beginner to advanced levels in ethical hacking, penetration testing, and cybersecurity. It features curated materials on bug bounty hunting, OSINT tools, CTF challenges, and practical exercises for real-world scenarios, alongside essential concepts in networking and web application security. Notable features include detailed roadmaps for penetration testing, hands-on labs from platforms like TryHackMe and HackTheBox, and extensive coverage of privilege escalation techniques across multiple operating systems.

Security Suite is an open-source toolkit designed for comprehensive OSINT reconnaissance, web security testing, API security assessments, and compliance checks, all enhanced with AI-powered analysis capabilities. It features 11 OSINT modules, six web scanners, and four API security tools, along with integration for SIEM systems, scheduled scans, and a REST API for programmatic access. The tool simplifies setup across multiple operating systems and allows for customization of AI models and tool options during installation.

The AI OSINT Security Analyzer is a Streamlit-based web application that leverages AI technology, specifically Cohere's Command A model, to conduct comprehensive threat assessments for websites, IP addresses, and software vulnerabilities. It integrates multiple data sources such as Shodan, VirusTotal, AbuseIPDB, and CVE databases, providing users with actionable insights into security risks. The tool features a user-friendly interface and is open source, inviting community contributions to enhance its capabilities.

BannerGrapV2 is an advanced network reconnaissance and vulnerability discovery tool designed for both offensive and defensive security operations, making it suitable for Red and Blue Teams, bug bounty hunters, and security auditors. Notable features include multi-threaded banner grabbing, extensive service fingerprinting, a robust vulnerability detection engine, and flexible reporting options in multiple formats, all powered by a performance-focused architecture enabling concurrent scans of up to 10,000 hosts.

The LeakIX Python client provides a programmatic interface for interacting with the LeakIX platform, primarily utilized for retrieving and handling data related to internet leaks, subdomains, and other events in a structured manner. It supports both synchronous and asynchronous API calls, with responses encoded in a defined format, allowing users to leverage built-in methods for response handling and data transformation. This client is compatible with Python versions 3.11 through 3.14 and facilitates easy integration into Python applications through its straightforward installation and documentation.

The VAPT Toolkit provides a comprehensive environment for vulnerability assessment and penetration testing, integrating over 50 third-party security tools and custom automation frameworks on an Ubuntu 22 platform. Notable features include a deterministic network exploitation orchestrator that automates host discovery and vulnerability verification using nmap and Metasploit, as well as a MITM browser autopwn orchestrator combining tools like bettercap and Responder for streamlined exploitation. The toolkit supports extensive automation in reporting, deliverable generation, and a wireless attack framework for versatile testing capabilities.

ContrastAPI is a comprehensive security intelligence tool designed for AI agents, providing grounded answers regarding vulnerabilities, threats, and attack surfaces by aggregating data from authoritative sources like the NVD and CISA KEV. It features a robust REST API with over 60 endpoints for CVE/KEV/CWE lookups, exploit probability scoring, domain and IP investigations, IOC enrichment, and code-security checks, while also facilitating seamless integration through SDKs for Python and Node.js. Notably, it is free to use without requiring API keys or signups, offering 55 tools and 7 resources for effective security analysis.

DogeRat is a premium Android RAT (Remote Access Trojan) designed for comprehensive control over target devices, specifically within an educational context. Key features include real-time screen capture, advanced keylogging, and the ability to manage files and applications remotely, alongside a powerful admin dashboard that supports simultaneous control of multiple devices. The tool also offers undetectability by antivirus software and persistent functionality, ensuring uninterrupted access even after device restarts.

Pinkcord is a Python-based remote administration tool that uses Discord bots for command and control (C2) communication, allowing users to manage remote systems in a manner analogous to traditional RATs. Notable features include executing remote shell commands, file transfers, screen capture, and system interaction capabilities, while leveraging Discord's infrastructure for seamless communication. It is important to note that Pinkcord is designed strictly for educational purposes and its misuse can lead to legal repercussions.

VulnScan is a vulnerability scanning tool designed to assist website owners in identifying and addressing security threats by leveraging the OpenAI ChatGPT AI model to analyze JavaScript code for vulnerabilities. Although no longer actively maintained, it offers features aimed at detecting and fixing security flaws, with potential future enhancements planned, including support for various vulnerability types and improved user interface options. The tool is intended for educational use, emphasizing the importance of compliance with legal standards.

awacs-scanner is an automated vulnerability scanning tool designed to gather extensive information about systems and identify potential exploits using multiple sources, including Vulners API and SearchSploit. Its primary use case involves scanning for vulnerabilities across multiple targets specified in files, streamlining the reconnaissance process without the need for manual searches. Notable features include various scan modes such as stealth_flight, vuln_scan, and battering_ram, as well as capabilities for S3 bucket discovery.

Google Hacking Assistant is a Chrome extension designed to enhance security research by automating the injection of predefined and customizable hacking syntax into search engine results from platforms such as Google, Baidu, and Bing. It features an intelligent sidebar that facilitates advanced searches with over 11 built-in query types, custom syntax management, and bulk URL extraction capabilities, while ensuring user privacy through local data storage and no tracking. This tool aims to streamline the process of conducting legitimate security assessments and penetration testing.

Quze is an advanced penetration testing framework that employs quantum-inspired techniques, such as probabilistic optimization and adaptive payload mutation, to evade high-level security defenses without utilizing actual quantum computing. Its notable features include AI-driven payload mutation for dynamic attack vector generation, autonomous reconnaissance for vulnerability identification, and advanced obfuscation methods to disguise malicious traffic and execute commands stealthily. Designed for authorized penetration testing, it focuses on maximizing exploitation success while maintaining stealth against signature and behavior-based detection systems.

uCVE is a cybersecurity tool developed in Go that facilitates the extraction of Common Vulnerabilities and Exposures (CVE) associated with specific software and version numbers. It generates reports in HTML format and supports exporting data in various formats, including text, JSON, and CSV, offering customizable search parameters such as risk levels and vendor inclusion/exclusion. The tool is designed for penetration testing and vulnerability management, streamlining the process of identifying security risks in software dependencies.

The Windows Post-Exploitation repository provides a comprehensive resource for post-exploitation techniques specifically tailored for Windows systems. It includes an extensive catalog of commands, tools, and guides for executing post-exploitation tasks, especially in scenarios where traditional frameworks like Meterpreter are unavailable. Notable features include curated lists of PowerShell scripts, privilege escalation tools, and various post-exploitation techniques, making it an invaluable tool for penetration testers and security professionals.

AndroidHack_BackDoor is a Python and shell script designed to facilitate the integration of a backdoor into Android APK files while leveraging the Android Debug Bridge (ADB) for remote device access. It is primarily intended for educational use and requires a solid understanding of various technical tools such as Metasploit, Apktool, and the Android SDK. Notable features include a simplified process for backdoor insertion and remote accessibility of Android devices.

DorkGen is a script designed to generate keyword combinations for web page URLs, serving primarily for web scraping, testing, and security-related applications. It enables rapid creation of dork lists based on user-defined variables and features persistent configurations through external config files for enhanced usability. Additionally, recent updates have expanded the range of available dorks, improving the tool's functionality.

Exploit is an offensive hacking tool designed to assist cybersecurity professionals and ethical hackers in executing exploits and conducting penetration testing. Its primary use case is to facilitate hacking activities, enabling users to automate various exploitation tasks. Notable features include ease of installation on any Linux distribution and comprehensive support for dependency management through a requirements file.

reveng_rtkit is a Linux Loadable Kernel Module (LKM) rootkit specifically designed for the 5.11.0-49-generic Linux kernel, primarily used for post-exploitation stealth techniques. Its key features include syscall table address retrieval, function hooking, and the capability to hide itself and other processes from system monitoring tools, making it difficult to detect. Additionally, it implements an IOCTL for interactive control and can bypass known rootkit detection tools like rkhunter.

Worm-AI CLI is a command-line interface that provides access to Grok models via an unofficial reverse-engineered API wrapper. It is designed for flexible interaction with large language models, featuring a built-in jailbreak system for unrestricted responses and a fully customizable terminal UI. Its modular architecture allows for easy modifications and enhancements, making it suitable for research and educational purposes.

Brutus is a Python-based tool designed for learning and experimentation in cybersecurity environments. It offers a sandbox feature for testing functionality in isolated, no-network containers, making it suitable for safe experimentation. Notable features include a development setup with linting and formatting tools, as well as a defined structure for module organization.

NetRaze is an offensive network-execution toolkit developed in Rust, providing a memory-safe, single-binary alternative to traditional Python-based tools like NetExec and CrackMapExec. It maintains a similar workflow for network post-exploitation but enhances performance with async I/O and offers a desktop GUI for visual workflow composition. Currently in alpha, it focuses on core functionality with a goal of expanding its protocol coverage across various operating systems.

PHP-Web-Security is a tool designed to enhance the security of PHP web applications by implementing best practices for preventing common vulnerabilities such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). It provides features for secure password hashing, session management, and includes a compilation of tools for web framework hardening, static code analysis, and security advisories. Notable components include security modules, static analysis tools, and resources aimed at both developers and educational content for improving overall web security.

s1c0n is a reconnaissance tool designed to simplify the vulnerability assessment process for web servers. Its primary use case includes automated scanning for WAFs, ports, subdomains, web directories, and content management systems, with the capability to customize user-agent strings and scan through proxies. Notable features include comprehensive auto-detection of server technologies, WordPress plugin enumeration, and an easy installation process, catering to various Linux distributions.

emp3r0r is an advanced, zero-trust post-exploitation framework and command & control (C2) system designed for secure operations on both Linux and Windows environments. Its notable features include autonomous gossip mesh networking, fileless memory execution of Starlark-scripted agents, and robust cryptographic identity pinning, ensuring high levels of stealth, operational control, and security against impersonation attacks. The framework facilitates seamless integration and execution without relying on host-based interpreters, making it highly suitable for high-security scenarios.

Linemadpeas is a comprehensive Linux privilege escalation enumeration tool implemented in Bash, designed to thoroughly scan Linux systems for potential privilege escalation vulnerabilities. It offers a user-friendly interface, automatic detection of over 25 vulnerability categories, and detailed exploit methods with executable examples while generating two separate output files for enumeration reports and exploit strategies. This tool is particularly valuable for penetration testing, security auditing, and educational purposes in understanding escalation techniques.

Nucleimonst3r is a high-speed vulnerability scanner tailored for Red Teams and Bug Bounty Hunters, enabling rapid identification of potential attack targets by fetching and filtering URLs from a specified domain. It leverages the httpx tool for scanning and provides dynamic template generation, real-time scan statistics, and comprehensive report generation, allowing users to customize scans effectively and integrate with other security tools for enhanced testing capabilities.

DARKSTAR v2.1 is a command-line penetration testing framework designed for security professionals, featuring 57 modular tools across various categories. Its key features include a plug-and-play plugin system, automatic plugin discovery, a matrix-inspired color-coded terminal UI, and support for threading and async operations, making it highly customizable and efficient for diverse security assessments. The toolkit is compatible with multiple platforms, including Kali Linux, Termux, Windows (WSL), and macOS, and requires only standard Python dependencies.

Web-Security is a comprehensive resource designed to educate users on web security practices, particularly focusing on the OWASP Top 10 vulnerabilities including XSS, SQL injection, and CSRF. It provides a collection of materials, tools, and hands-on labs, aimed at enhancing secure coding practices for developers. Notable features include detailed explanations of various vulnerability classes, their exploitation techniques, and links to relevant communities and learning resources.

Awesome-Hacking is a comprehensive resource hub designed for hacking, pentesting, and security research, providing a curated collection of tools and materials beneficial for System and Network Administrators, DevOps professionals, and security researchers. Notable features include its repository of daily use tools, practical navigation through a simple Table of Contents, and an open-source nature that encourages contributions from users. The repository serves as a valuable reference point for anyone interested in cybersecurity.

INtrack is a multi-threaded internet crawler and security scanner focused on network reconnaissance and vulnerability detection. It supports various scanning types, including the detection of web applications, IoT devices, and exposures, while offering flexible target selection, customizable settings, and real-time progress visualization. Notable features include support for multiple scanner types based on CVEs, the ability to scan either specific IPs or subnets, and a customizable thread count for efficient scanning.

ShinobiShell is a specialized penetration testing tool designed for file exfiltration and exploit injection, facilitating remote shell interactions between the attacking and victim machines. Its notable features include encrypted tunnel creation, a command for seamless reverse shell connections, and capabilities for managing machine information and various payload delivery methods through a user-friendly shell interface. The tool is particularly geared toward enhancing operational efficiency during pentesting activities.

VivisectION is an emulation-driven toolset designed as a plugin for the Vivisect reverse engineering framework, enhancing GUI capabilities with functions for function emulation and reconnaissance. It enables users to emplace an emulator for specific functions easily, offering features such as an interactive console for dynamic analysis, and streamlined integration with other Vivisect tools. Noteworthy functionalities include function emulation via context menu operations and an interactive Python shell for advanced analyses, fostering a comprehensive environment for vulnerability research and reverse engineering.

The asm-payloads-loaders tool provides a series of assembly-written payload loaders for x86-64 Linux, utilizing only native syscalls without external dependencies. It features various loading mechanisms, including file-based, HTTP, and DNS payload loading, with options for dynamic memory allocation and checksum verification for integrity checks. This tool is designed to facilitate the development and understanding of payload loading techniques through detailed examples and documentation.

ARTC2 is an advanced execution framework designed to help security teams efficiently execute attack scenarios across multiple breach points, primarily focusing on Windows OS environments. Its notable features include rapid deployment, modern command and control capabilities utilizing encrypted communications, and dynamic attack formations that enable execution without recompilation. The tool supports extensive logging for evidence collection and analysis, facilitating rapid evaluation of endpoint detection and response (EDR) solutions against MITRE ATT&CK frameworks.

Blexploit is a comprehensive offensive Bluetooth Low Energy (BLE) security framework designed for red teams and security researchers, facilitating passive scanning, exploitation, and replay attacks with advanced anomaly detection. Its modular architecture includes features such as GATT enumeration, customizable attack simulations, and offline sandbox environments, while automatically generating risk assessments and attack module suggestions based on detected device UUIDs. Key functionalities, including real packet injection and an Isolation Forest-based detection mechanism, make it versatile for both testing and education in Bluetooth security contexts.

claude-code-pentest automates the penetration testing lifecycle using six specialized skills that range from reconnaissance to exploit chaining and report generation. Its notable features include subdomain enumeration, vulnerability discovery across web applications and APIs, cloud infrastructure analysis, and the capability to compose findings into comprehensive bug bounty reports—all implemented via 43 standalone Python scripts that require no external dependencies. The tool is designed for authorized security testing only and is integrated with Claude Code for user-friendly command execution.

CS-EDR-Enumeration is a Cobalt Strike Aggressor Script designed to enumerate antivirus (AV), endpoint protection platform (EPP), endpoint detection and response (EDR), and telemetry/SIEM products on Windows hosts post-compromise. It features six commands with varying noise levels to suit different operational risk tolerances, and includes a comprehensive signature database for major security vendors, enabling silent enumeration techniques that minimize detection. Notable capabilities include kernel driver enumeration, automatic threat level assessment, and color-coded output for quick identification of security products.

DRAKBEN is an AI-powered autonomous penetration testing framework that utilizes natural language processing to perform comprehensive security assessments, allowing users to issue commands in plain language. Its notable features include a self-evolving engine for dynamic tool synthesis, a multi-language interface supporting Turkish and English, and advanced memory systems for context-aware decision-making and persistent learning. This framework streamlines the penetration testing process from reconnaissance to reporting with minimal user intervention.

EmpireCTF is a comprehensive repository of Capture The Flag (CTF) write-ups that chronologically documents solutions and methodologies applied in various CTF competitions from 2018 to 2025. The primary use case of this tool is to serve as a reference for cybersecurity enthusiasts and professionals seeking to enhance their skills in solving CTF challenges. Notable features include categorized write-ups by year and challenge type, facilitating easy navigation and study of different techniques and tools utilized in the CTF landscape.

find-cve-agent is an open-source tool designed for discovering real CVEs in open-source packages using a structured multi-agent approach. It features a comprehensive workflow encompassing target discovery, vulnerability validation, and responsible disclosure, equipped with a six-gate verification process to minimize false positives. This tool is particularly aimed at enhancing the effectiveness of security researchers by leveraging a coordinated team of agents specializing in different aspects of the vulnerability hunting process.

GhostPack Binaries is a repository offering precompiled binaries and scripts for various security and red team tools compatible with Windows, Linux, and macOS. Its primary use case is to facilitate authorized security testing and educational purposes, providing streamlined access to essential utilities while emphasizing the importance of ethical usage. Notable features include cross-platform support and a focus on prebuilt security tools, enabling users to conduct red teaming activities efficiently.

HTTPWorker is a Flask-based command and control (C2) framework designed for security competitions, utilizing custom Windows implants written in C++. Its primary use case involves coordinating and managing remote Windows clients with capabilities such as command execution, file management, system information retrieval, and user interface access through an authentication-protected web app. Notable features include Docker support for deployment, integration with Pwnboard for beacon tracking, and customizable implant configurations to evade detection.

MCPScan is an offensive security auditing tool specifically designed for MCP servers to identify vulnerabilities and misconfigurations. It conducts comprehensive checks across eight categories, including tool poisoning, credential leakage, remote code execution, and supply chain issues, allowing developers to mitigate security risks in AI-connected environments effectively. Notable features include detailed vulnerability reporting, CVE references for known issues, and the ability to detect common attack vectors and exposed sensitive data.

The Nightmare Exploitation Roadmap is a structured educational resource designed to advance users' binary exploitation skills through a layered curriculum that emphasizes theoretical understanding and practical application. It focuses on building capabilities to analyze unknown binaries, identify exploit primitives, and develop automated exploitation techniques while navigating real-world security mitigations. Notable features include a non-linear approach to learning, preservation of module names for clarity, and a comprehensive progression from foundational knowledge to advanced exploitation strategies.

Pentest Toolkit is an advanced penetration testing framework designed for rapid and efficient security assessments, integrating over 100 industry-standard tools into both a Python suite for automation and a Bash interface for hands-on operations. Its primary use case includes comprehensive testing phases, from reconnaissance and web security to SSL/TLS analysis and network assessment, all culminating in professional report generation. Notable features encompass automated reporting in multiple formats, robust web application vulnerability testing, and streamlined reconnaissance processes.

The Periodic Table of Offensive Security serves as a visual reference for 118 essential tools, frameworks, and standards utilized in offensive security and red teaming. Its primary use case includes aiding penetration testing, red team training, and providing a comprehensive overview of tools for OSINT, exploitation, and post-exploitation phases. Notable features include downloadable print-friendly PDFs and an interactive clickable version that links directly to resources for each tool represented.

Proxy_Bypass is a post-exploitation tool designed to identify user agents capable of circumventing proxy restrictions. It offers batch processing, the ability to test various user agents against specific domains, and includes a predefined library of user agents for immediate use. Notable features include verbose output, support for custom user agents, and future enhancements such as multi-threading and additional language support.

RevEng.AI Radare2 Plugin enhances the Radare2 framework with AI-driven reverse engineering functionalities, including decompilation, function analysis, and binary similarity detection. It seamlessly integrates with existing Radare2 workflows, providing automated setup scripts across multiple platforms and the capability to utilize an external API for advanced analysis tasks. Noteworthy features include a straightforward installation process, automatic library path configuration, and the generation of necessary configuration files directly through Radare2 commands.

Reait is a toolkit designed for the analysis of compiled executable binaries utilizing the RevEng.AI API, primarily aimed at identifying similar components, vulnerabilities, and generating advanced YARA++ REAI signatures for binary files. Notable features include the ability to extract symbol embeddings, conduct similarity searches among executable programs, and support for stripped ELF and PE binaries in both GNU/Linux and Windows environments. The tool facilitates in-depth binary analysis through commands that submit executables, retrieve analysis results, and query a database for similar symbols.

`ropfilter` is an advanced tool designed for filtering, ranking, and chaining ROP gadgets derived from `rp++` dumps, specifically for 32-bit x86 architectures. Its notable features include smart gadget filtering based on register transfers and memory operations, automated multi-gadget chain synthesis, and a constraint solver that utilizes YAML/JSON specifications, enhancing the robustness and efficiency of ROP chain construction.

SecuSploitX is an advanced, modular, open-source penetration testing and cybersecurity toolkit designed for offensive security operations. It features a comprehensive suite of tools including web and network security modules, AI-driven automation for tasks like phishing simulations, and both GUI and CLI interfaces for user flexibility across multiple platforms. Notable capabilities include automated vulnerability scanning, advanced brute force tactics, and extensive documentation, making it suitable for both educational and professional use.

The Potato Garden repository compiles various Windows privilege escalation tools, referred to as "Potatoes," each sourced from different open-source projects. Its primary use case is to provide security professionals with readily accessible binaries for testing and exploiting vulnerabilities within Windows environments. Notable features include the aggregation of multiple tools into a single collection, enabling streamlined access and use for penetration testing and security assessments.

TibaneC2 is a modular Command & Control (C2) framework designed for offensive security research and red teaming, featuring a C/C++ core server, a PHP-based web panel, and a CLI console. Its notable characteristics include cross-platform implants, multi-language stagers, and scripting tools for enhanced automation and emulation, facilitating extensive customization without altering core functionality. The framework is intended strictly for educational and authorized testing purposes.

Vigilo is an autonomous smart contract security auditing tool designed to identify vulnerabilities within Web3 applications. Utilizing specialized agents within a structured pipeline, it facilitates an automated auditing process by handling tasks such as reconnaissance, deep analysis, and report generation across multiple programming languages including Solidity and Rust. Notably, Vigilo features a modular architecture with dedicated auditors for various vulnerability types and integrates seamlessly with existing development workflows like Foundry.

w4af is an open-source web application security scanner designed for developers and penetration testers to identify and exploit over 200 vulnerabilities, such as Cross-Site Scripting and SQL Injection. Built on Python 3.11 and currently in an alpha development phase, it features integrations for unit and integration testing alongside comprehensive documentation for user guidance.

The MottaSec White Papers repository is a centralized collection of technical and cybersecurity white papers published by MottaSec, providing insights into various topics such as military drone security and IoT device boot integrity. Notable features include a clear organizational structure for easy navigation, self-contained papers with supporting materials, and multiple access formats including GitHub markdown and professionally formatted PDFs. This repository serves as a vital knowledge base reflecting the expertise and research of MottaSec in the cybersecurity domain.

BugHunter AI is an autonomous bug bounty hunting framework that leverages Claude Code and the Personal AI Infrastructure (PAI) to conduct vulnerability assessments without human intervention. Its notable features include 28 specialized AI agents and 51 skills that operate in parallel through hypothesis-driven attacks, real-time reporting, and automatic generation of professional bug bounty reports. This tool significantly accelerates the reconnaissance and exploitation phases of security testing, offering enhanced capabilities such as cross-session learning and encrypted credential management.

EVA is an AI-driven penetration testing tool designed to aid users throughout the pentesting lifecycle with intelligent analysis, automated enumeration, and real-time vulnerability assessment. It features support for multiple AI backends, session management for persistent interactions, and an interactive interface for executing commands and analyzing results, thereby enhancing the efficiency of penetration testing efforts. This tool aims to assist, rather than replace, cybersecurity professionals by providing strategic guidance and quicker outcomes during engagements.

GadgetExplorer is a command-line tool designed for discovering potential deserialization gadget chains within .NET applications. It analyzes one or more assemblies, constructing reachability graphs to identify when a deserialization entrypoint can lead to various vulnerabilities, including file writes and command execution. The tool comes pre-configured with a comprehensive set of sinks across different vulnerability categories, making it valuable for researchers and exploit developers in the .NET community.

Ligolo-MP is a sophisticated pentesting tool that facilitates collaborative pivoting through a client-server architecture, allowing multiple concurrent tunnels with automated TUN management. Its notable features include SOCKS and HTTP proxy support, cross-platform compatibility, and dynamic mTLS-enabled agent generation, all while providing a user-friendly terminal-based GUI for efficient monitoring and management.

LogHound is a post-exploitation tool designed for analyzing Windows Security Event Logs (.evtx) to facilitate BloodHound mapping, aiding Red Teams in tracking lateral movement targets and deciphering active user sessions. Notable features include a chunk-based streaming parser that minimizes memory usage, support for Pass-The-Hash and Kerberos authentication methods, and the ability to generate detailed reports in various formats, ensuring effective operational security during network penetration testing.

Machine Learning CTF Challenges provides a collection of capture-the-flag (CTF) challenges focused on exploiting vulnerabilities in AI agents, machine learning pipelines, and large language models. Users can engage in practical scenarios such as manipulating training data, prompting model injections, and breaching autonomous systems to capture flags. The repository includes nine challenges that vary in difficulty and are aligned with OWASP and MITRE attack vectors, thus addressing contemporary security concerns in AI applications.

Malware APK is a testing and exploitation tool designed for security engineers and bug hunters to create malicious Proof of Concept (PoC) applications for vulnerability testing in Android environments. Notable features include a variety of testing modules for intent injection, task hijacking, and accessibility monitoring, without requiring device rooting. It also supports advanced options like caching intercepted intents and compiling native code for arbitrary code execution, making it a comprehensive utility for penetration testing.

MCP Security Hub provides a collection of production-ready, Dockerized Model Context Protocol (MCP) servers tailored for offensive security applications, enabling AI-assisted security assessments and vulnerability scanning. With 38 MCP servers covering various domains like reconnaissance, web security, and binary analysis, it integrates over 300 security tools accessible through natural language commands via AI clients like Claude. Noteworthy features include a CI/CD-ready setup with GitHub Actions, minimal Docker images, and orchestration capabilities with Docker Compose for streamlined multi-tool workflows.

The Microsoft SQL TDS Downgrade Attack tool performs a Man-in-the-Middle attack by intercepting Tabular Data Stream (TDS) packets between a client and MSSQL server, enabling the downgrading of encryption for TDS login packets. Its primary use case is to extract sensitive login credentials (username and password) by manipulating traffic through ARP spoofing and modifying intercepted packets. Notable features include automatic cleanup of the ARP spoofing and iptables rules upon stopping the script, and requirements for running include a Linux host with root privileges and necessary dependencies like arpspoof and iptables.

Offensive Claude is a spec-driven offensive security framework designed for Claude Code that implements structured engagement workflows following the Cyber Kill Chain methodology. It features a comprehensive set of 31 kill-chain skills, collaborative agents, and a shared vulnerability library, facilitating automated penetration testing, reconnaissance, exploit development, and reporting through a series of orchestrated commands. This tool is particularly useful for security researchers and practitioners to streamline their offensive security operations while maintaining high quality and traceability throughout the engagement process.

Rustsploit is a modular offensive security tool written in Rust, designed for targeting embedded systems such as routers and cameras. It features a unified interface that provides an interactive shell, command-line execution, and a post-quantum encrypted REST/WebSocket API, along with built-in fingerprinting using Recog and JARM/JA3 methods. Notable aspects include self-registering modules, a credential management system, and extensive support for various network protocols and services, making it a versatile tool for penetration testing and vulnerability assessment.

SUASS is a comprehensive repository designed to provide cybersecurity professionals and learners with a wide array of study materials, covering essential topics such as penetration testing, cloud security, mobile application security, network security, and more. This resource serves as a centralized hub for enhancing knowledge and skills in cybersecurity, offering practical learning pathways through Capture the Flag (CTF) challenges and recommendations for certifications. Notable features include categorized content for various security domains and links to external learning platforms and communities.

The LLM Red Teamer's Playbook provides a systematic methodology for assessing and bypassing various defense layers in Large Language Models (LLMs), such as input filters and alignment mechanisms. It emphasizes a diagnostic approach to identify and understand the specific defenses in place before selecting appropriate attack techniques, mapped to the Adversarial AI Threat Modeling Framework (AATMF) v3. This guide is intended for AI red teamers, security engineers, and researchers, enabling them to conduct unauthorized testing responsibly while improving the security of AI systems.

WebStrike is an automated web penetration testing framework designed to orchestrate various Kali tools through a structured phase-based pipeline, enhancing the workflow of web pentesting. It links tools together, utilizing outputs from one as inputs for the next while providing deduplication and comprehensive reporting. The framework allows for both manual and automated modes of operation, enabling users to manage the level of intrusion and control over testing processes efficiently.

frameseven is a CLI-oriented offensive web security scanner designed for authorized security testing, capable of mapping a target's attack surface while executing active checks for prevalent web vulnerabilities and misconfigurations. Key features include extensive reconnaissance capabilities, support for authenticated scans, and structured reporting options, along with a dedicated MCP server for AI agents to utilize the same framework tooling. The tool emphasizes a standard-library-centric Go codebase, enhancing readability and extendability.

KHAØS C2 is a sophisticated post-exploitation command and control framework designed for stealth and evasion against endpoint detection systems. It features five covert communication channels, including Microsoft Teams and GitHub Gist, ensuring that the traffic blends with normal operations. The framework includes extensive post-exploitation capabilities, such as token theft, process injection, and lateral movement, along with a user-friendly React-based UI for real-time monitoring and payload management.

LVRP (Local Vuln Research Pipeline) is an exhaustive LLM-driven vulnerability research tool designed to identify vulnerabilities across various source code files in up to 16 programming languages. It constructs a complete call graph of the codebase, enumerates all source-to-sink paths, and validates these paths for exploitability using a hybrid approach that combines static analysis and LLM insights. The tool is capable of analyzing extensive projects such as the Linux Kernel and VSCode, while ensuring deterministic path enumeration and comprehensive coverage, including blind spot reviews.

OpenTaint is an open-source taint analysis engine designed for application security, effectively identifying vulnerabilities that abstract syntax tree (AST) pattern matchers may overlook. Its primary use case involves enhancing security measures for applications, particularly those built with technologies like Java, Kotlin, and Spring, by allowing large language model (LLM) agents to execute vulnerability rules while offering scalable performance. Notable features include formal taint analysis capabilities and extensive integration support for various programming languages and platforms.

Pentest Swarm AI is an open-source penetration testing tool that leverages a swarm architecture for coordinated multi-agent operations, enabling efficient vulnerability assessment. Its primary use case is facilitating authorized security testing through live integration with popular offensive tools like nmap, sqlmap, and Metasploit, while incorporating AI models for advanced analysis. Notable features include a stigmergic blackboard for agent coordination, automated evidence capture, and the ability to generate submission-ready reports.

Vulnify is a CVE ingestion and enrichment pipeline that consolidates vulnerability data from various sources into a normalized SQLite database, facilitating easier access and exploration of this information. Its notable features include a comprehensive CVE repository, integration with various vulnerability databases, and a Streamlit-based explorer that provides approximately 70 pre-built views for data analysis. The tool also supports resume-safe pipeline states, enabling seamless data ingestion even after interruptions.

WindowsShell-Injector is a shellcode execution framework designed for security research and penetration testing on Windows systems. It features encrypted payloads, anti-debugging mechanisms, and an intuitive Qt-based GUI, allowing for seamless loading and execution of shellcode. Notable capabilities include asynchronous execution via separate threads, dynamic memory protection, and runtime API resolution to enhance evasion of static analysis tools.

x64dbg is an open-source binary debugger designed specifically for Windows, facilitating malware analysis and reverse engineering of executables without source code access. Key features include a comprehensive plugin system for extensibility, support for both 32-bit and 64-bit debugging, and a user-friendly interface that offers various tools such as memory mapping and graph visualization to enhance the debugging process.

yublueflower is a security workflow designed to identify real-world threats by integrating multiple open-source tools, such as urlfinder, katana, and nuclei, to analyze web assets and vulnerabilities. It supports functionalities like session management, web archiving, and extended workflows for optimizing bug bounty results, while mapping findings to known vulnerabilities (CWE/CVE). This tool specifically operates within a Kali Linux environment and is ideal for penetration testers and security professionals looking to enhance their threat discovery processes.

WAE (Windows Admin Exploit) is a tool designed to gain administrative rights on outdated Windows systems by utilizing a bootable USB drive to execute a batch script. The primary use case is for unauthorized access in environments like schools or workplaces, but it is only effective on very old Windows builds as modern security measures have rendered it obsolete. Notable features include a straightforward installation process and the ability to manipulate user accounts through command line inputs, though the repository is maintained purely for historical and educational reference.

ADMmutate is a polymorphic shellcode mutation engine designed to evade Network Intrusion Detection Systems (NIDS) by generating unique but functionally equivalent code fragments that resist signature-based detection. Its notable features include XOR-based polymorphic encoding, sliding key mechanisms, and multiple code paths, enhancing its ability to obfuscate shellcode in various architectures such as IA32, SPARC, and MIPS. The tool specifically targets signature analysis weaknesses in NIDS, employing advanced techniques to adapt and randomize its output dynamically.

AmongUsMenu is a cheat menu designed for the game Among Us, intended for educational purposes to demonstrate how cheating software operates. It offers two versions, a normal DLL for injection and a proxy version that integrates directly with the game, featuring a set of hotkeys for various functionalities such as showing a menu, radar, or console. The project has been archived and is no longer actively maintained.

Antivirus Engines is a comprehensive exploration of antivirus engine technologies, focusing on their development to combat the evolving cyber threat landscape. It provides in-depth technical insights into various detection methodologies, including signature-based, heuristic, and behavioral approaches, complemented by algorithmic implementations of notable techniques such as the Aho-Corasick algorithm and Bloom filters. The resource serves as both a reference for advanced malware analysis and a practical guide for implementing cutting-edge antivirus technologies.

The "Awesome UEFI Security" repository compiles an extensive array of resources related to UEFI and BIOS security, serving as a centralized reference for researchers and developers in the field. It features categorized materials including CTF challenges, documentation, tools, notable vulnerabilities, and training resources, making it an invaluable asset for anyone looking to enhance their understanding of UEFI security threats and defenses. Noteworthy sections include links to various bootkits and development projects, further enriching the repository's utility for comprehensive UEFI security exploration.

Bl0ck is a specialized attack tool designed to exploit vulnerabilities in Wi-Fi 5 (802.11ac) and Wi-Fi 6 (802.11ax) networks by utilizing Block Ack (BA) frame attacks. Its primary use case is to disrupt the transmission of Quality of Service (QoS) Data traffic, effectively cutting off internet access for connected devices without disconnecting them from the access point. Notable features include its capability to execute three distinct attack scenarios that can halt data transmission from the AP to the target device and facilitate further attacks, such as Deauthentication and Evil Twin assaults.

BlackOut is an addon for the Meteor client that enhances gameplay by introducing advanced features such as an upgraded CrystalAura, BedAura, and PacketFly, among others. Its primary use case is to improve user performance and competitiveness in Meteor client-based environments. Notable features include enhanced functionality and ease of installation when integrated with Fabric and Meteor, along with community support via Discord.

Bluekit is an extensible engine and command-line interface (CLI) tool designed to enhance the functionality of the BlueToolkit. Its primary use case is to provide an adaptable framework for developers aiming to integrate and extend tools within the BlueToolkit ecosystem. Notable features include its extensibility and robust CLI capabilities for efficient tool management.

BluetoothExploits is a directory containing various Bluetooth exploits intended for use with the BlueToolkit framework. Its primary use case is to provide security professionals and researchers with a set of tools to assess and exploit vulnerabilities in Bluetooth implementations. Notable features include a curated collection of exploits specifically designed to enhance Bluetooth security testing capabilities.

Brash is a tool designed to exploit a critical vulnerability in the Blink rendering engine of Chromium-based browsers, allowing for a denial of service (DoS) attack through rapid updates of the `document.title` property. By circumventing rate limiting, it can generate millions of DOM mutations per second, causing browsers like Chrome and Edge to crash within seconds and significantly degrade system performance. The tool showcases an impactful attack vector that affects over 3 billion users, highlighting the need for vigilance against architectural flaws in web rendering engines.

CloakQuest3r is a Python-based security research tool designed to assess potential origin IP exposure of websites utilizing Cloudflare and similar reverse proxy or CDN services. Its primary use case involves subdomain enumeration and passive analysis techniques to identify misconfigurations that could lead to the disclosure of sensitive server infrastructure. Notable features include its capability for real IP detection, making it essential for security professionals, penetration testers, and web administrators focusing on authorized security testing and infrastructure hardening.

This repository presents a proof-of-concept for exploiting a CORS (Cross-Origin Resource Sharing) vulnerability characterized by a misconfigured policy that allows arbitrary `Origin` headers and sets `Access-Control-Allow-Credentials: true`. The primary use case involves demonstrating how such vulnerabilities can be detected and exploited to exfiltrate sensitive data, such as an API key, from a victim's browser. Notable features include detailed steps for testing the vulnerability using tools like Burp Suite and a lab walkthrough that guides users through the detection and exploitation processes.

The CORS vulnerability tool demonstrates the exploitation of a null origin CORS misconfiguration in a web application, enabling attackers to exfiltrate sensitive API keys. This GitHub repository provides a comprehensive walkthrough of a proof-of-concept (PoC) attack on a sample lab site, detailing the steps and methods used to identify and exploit the vulnerability, along with suggested mitigation techniques to enhance security. Notable features include a structured guide with practical examples and screenshots to aid in understanding the exploit and its implications.

The CS2 Real-time Demo Radar Visualizer is a tool designed to visualize player activities and game dynamics in real-time for Counter-Strike 2 demos. Notable features include automatic game path detection, detailed player statistics, real-time updates every 50ms, customizable display settings, and a mini radar interface for secondary monitors. This tool is intended for educational and personal use, and it requires specific commands to function properly in a game environment.

This repository addresses the critical CVE-2025-10585 type-confusion vulnerability in the Chrome V8 JavaScript engine, emphasizing the urgent need for patching due to confirmed active exploits in the wild. It provides an overview of the vulnerability’s mechanics, highlighting how it allows attackers to leverage arbitrary read and write primitives for executing code and bypassing security measures. Notably, it also discusses the exploit chain necessary for achieving full system compromise through crafted web content.

The tool showcases a proof-of-concept (PoC) for exploiting the NTLM hash leak vulnerability identified as CVE-2025-24054 through malicious `.library-ms` files. Its primary use case is for educational and research purposes, allowing security professionals to demonstrate how NTLMv2 hashes can be extracted by triggering SMB authentication requests on unpatched Windows systems. Notable features include a script for generating the malicious file, instructions for setting up a fake SMB server using Responder, and a sample file configured to facilitate the attack.

The CVE-2025-31702 repository provides a collection of tools, exploits, and research artifacts aimed at analyzing and addressing vulnerabilities associated with CVE-2025-31702, particularly in relation to P2P/Easy4IP exposure and auto-update inconsistencies. Its primary use case is to equip defenders with auditable utilities for validating deployments, while also offering detection strategies and mitigation guidance for SOC and IR teams. Notable features include lab scripts, parsers, and comprehensive documentation of research and proof-of-concept efforts for enhanced operational transparency.

CVE-2025-32463 is a privilege escalation exploit targeting vulnerable versions of sudo (1.9.14 to 1.9.17) that allows attackers to gain root access without requiring gcc to be installed on the target system. The tool includes pre-compiled payloads for various architectures, directly executing an exploit via scripts, making it notably convenient for users who may lack compilation tools. This exploit is intended solely for educational and authorized testing purposes.

The CVE-2025-32463_chwoot repository provides a proof-of-concept implementation to demonstrate the privilege-escalation vulnerability in the chroot feature of vulnerable versions of `sudo`. It includes a Docker environment to build and run an exploit that showcases how to gain root access in affected systems. Notable features include a Dockerfile for setting up the environment and a script that facilitates the execution of the exploit inside a container.

The CVE-2025-40634 tool serves to exploit a stack-based buffer overflow vulnerability in the TP-Link Archer AX50 router, specifically in its firmware version 1.0.14 Build 20240108 rel.42655(4555). The primary use case is to enable remote code execution capabilities both from the local network (LAN) and the wider internet (WAN) by manipulating DNS response packets. Notably, the tool revisits a vulnerability with a similar root cause to CVE-2020-10881, requiring a custom exploit due to differing exploitation processes.

CVE-2025-54253 is a critical vulnerability affecting Adobe Experience Manager (AEM) Forms on JEE versions ≤ 6.5.23.0, enabling unauthenticated remote code execution through misconfigured Struts/OGNL endpoints. This tool primarily assists penetration testers and defenders in identifying and mitigating risks associated with this vulnerability, emphasizing proactive patching, threat hunting, and implementing hardened configurations. Notable features include a structured testing checklist for AEM environments, methods for validating configurations, and logging techniques for identifying exploitation attempts.

The CVE-2025-55182 Scanner & Exploiter tool is designed to detect and exploit a critical remote code execution vulnerability in specific versions of React Server Components. It features detection capabilities for scanning single or multiple targets, as well as an exploitation mode that provides an interactive shell and options for reverse shell execution. The tool supports proxy usage and allows for multi-threaded scanning to enhance performance.

The CVE-2025-59287 tool is an automated exploit designed to target a critical unauthenticated remote code execution vulnerability in Windows Server Update Services (WSUS). Its primary use case is to facilitate the exploitation of this vulnerability with minimal user intervention, offering features such as payload generation, built-in reverse shell capabilities, cross-platform compatibility, and AES encryption. The tool also includes dependencies auto-management and can be run across multiple operating systems, ensuring ease of use for penetration testers and security researchers.

The CVE-2025-59287-PoC tool serves as a proof-of-concept for exploiting vulnerabilities in Windows Server Update Services (WSUS), specifically targeting CVE-2025-59287 and CVE-2023-35317. Its primary use case is academic research and defense technique development, allowing users to initiate Remote Code Execution (RCE) by sending crafted SOAP requests to vulnerable WSUS servers. Notable features include customizable payloads, the ability to generate random client DNS names, and verbose debug logging for detailed operation insights.

CVE-2025-59287 refers to a critical unauthenticated remote code execution vulnerability in Windows Server Update Services (WSUS) that can be exploited through unsafe deserialization of attacker-controlled data. The tool illustrates how attackers can leverage this vulnerability via crafted `AuthorizationCookie` payloads to gain SYSTEM-level access on the server, enabling them to deploy malicious updates and pivot within corporate networks. Immediate patching is emphasized, along with recommendations for temporary isolation and detection measures against exploitation attempts.

The CVE-2025-66516-Writeup-POC repository provides a detailed analysis and proof of concept for a critical XML External Entity (XXE) injection vulnerability in Apache Tika, with a CVSS score of 10.0. This vulnerability enables remote attackers to exploit specially crafted PDF documents to read arbitrary files and exfiltrate sensitive information. Notable features include specific details on affected versions, the technical breakdown of the vulnerability, and instructions for testing in a controlled environment.

CVE-2025-68613-POC is a Python-based proof-of-concept tool designed to demonstrate a critical Remote Code Execution (RCE) vulnerability in the n8n workflow automation platform. It includes a scanner for non-destructive detection of vulnerable instances and a Nuclei template for automated testing of expression injection capabilities, both facilitating the assessment of affected versions and helping security professionals identify potential exploits safely. Notably, it emphasizes the ability to interact with Node.js global contexts to validate vulnerability exploitation scenarios.

The CVE-2025-8088 WinRAR path traversal tool is a Python script designed to exploit a path traversal vulnerability found in WinRAR, facilitating the creation of malicious archives that deploy payloads to the Windows startup folder. Notable features include the ability to create customizable decoy files, employ alternate data streams (ADS) for payload concealment, and modify archive structures to ensure reliable execution. This tool serves primarily as an educational resource for cybersecurity testing within controlled environments.

The pwnfuzz/cve-pocs repository provides a collection of proof-of-concept (PoC) exploits for various CVEs, intended for educational and security testing purposes. Each exploit is organized by vulnerability, featuring specific scripts or research artifacts aimed at demonstrating the security flaws. Notably, the repository includes detailed links to individual exploits for different vulnerabilities, offering structured access for security professionals.

The illusionsec Archive is a comprehensive collection of Distributed Denial of Service (DDoS) tools, scanners, and botnet resources tailored for cybersecurity professionals and researchers. It features multiple versions of notable botnets, such as Mirai and QBot, alongside vulnerability exploits, various attack methods (Layer 4, Layer 7, UDP, TCP), and additional utilities for bot compilation and command/control management. This archive serves as an extensive toolkit for testing and analyzing DDoS attack methodologies and their defensive countermeasures.

DEDSEC_CLICKFIX2 is a Linux-based social engineering tool that employs the ClickFix attack to deploy malware through a deceptive software activation interface. It features customizable malicious payload links, a realistic URL masking system, and integrated tunneling for remote access, while also attempting to disable security measures to ensure stealthy execution of its payload. The tool is designed for penetration testing and educational purposes, leveraging user trust to facilitate the delivery of malicious software effectively.

Defcon Arsenal Tools (DArT) is a curated repository designed to provide security professionals with a comprehensive collection of tools, scripts, and resources for various cybersecurity tasks, including network scanning, vulnerability assessment, and exploit development. Notable features include organized categories for tools based on specific functions, such as credential scanning, network attacks, and malware research, facilitating quick access to relevant resources for users within the DEFCON community. The project emphasizes educational use and knowledge sharing, promoting responsible application in security practices.

Domaineer is a semi-automated bot designed to extract data from domains, facilitating domain analysis and intelligence gathering. It supports multiple platforms, including Linux, Windows, and Android, and can be easily installed via Python dependencies. The tool is currently under maintenance for enhancements, with plans to transition to a desktop application using PyQT and Golang.

This tool is an exploit for the vulnerable Windows kernel driver eneio64.sys, enabling the mapping of physical memory read/write operations to virtual memory read/write. It demonstrates how to leverage this vulnerability for privilege escalation via token theft, targeting Windows 11 versions, specifically builds 22H2, 23H2, and 24H2. The exploit also outlines the necessary offsets for different Windows versions and serves as an educational resource.

The tool exploits a command injection vulnerability in the pdfkit Ruby gem, specifically in versions prior to 0.8.7.2, allowing attackers to execute arbitrary commands through specially crafted URLs. Key features include custom command generation and reverse shell capabilities, providing flexibility for targeting vulnerable web applications. The exploit serves solely for educational and authorized security research purposes.

ExploitAddr is a reconnaissance tool primarily designed to uncover the real IP addresses of websites obscured by Cloudflare, as well as identifying any associated domains and server details. Key features include multi-IP detection, sorting by software vendor, fast searching with threading, and status code checks for domains. Users must provide a Censys API key for functionality.

The googlephotos-filestorage tool is a Java application that enables the steganographic encoding of files into image data for upload to Google Photos. Its primary use case is to allow users to exploit Google Photos' former unlimited storage policy by converting files into images, thus facilitating file storage and retrieval. Notable features include encoding file data into the RGB channels of pixels, with the ability to expand storage capacity by utilizing the alpha channel.

grafanaExp is a tool designed to exploit the CVE-2021-43798 vulnerability in Grafana, enabling automated detection of vulnerable instances, extraction of keys, and decryption of server database files. Its primary use case is to assist in the security assessment of Grafana installations by providing the capability to reveal sensitive configuration data and datasource information. Notable features include an 'exp' command for vulnerability detection and information retrieval, and a 'decode' command for local decryption of large database files.

HackingAllTheThings is a curated repository of cybersecurity tools and notes, aimed at supporting the archiving and study of various IT security certifications. It includes both original tools developed by the author and additional resources collected from diverse sources, thereby providing a structured approach to cybersecurity learning and practice.

iOS Shortcuts Exploits is a repository that catalogs a variety of exploits and unusual behaviors associated with iOS shortcuts, emphasizing vulnerabilities that can be used for memory overloading and crashing applications. Key features include detailed explanations and proofs of concept for various exploits, such as the wallpaper switching action that can overload memory, alongside methods to trigger system-level issues and manipulate functionality like dark/light mode transitions. It serves as a unique resource for understanding and leveraging specific weaknesses within the iOS shortcuts framework.

The KSMBD-CVE-2025-37947 repository provides a proof-of-concept exploit targeting the out-of-bounds write vulnerability identified as CVE-2025-37947 in the ksmbd kernel server. Its primary use case is to demonstrate the exploitation of the vulnerability through various provided scripts and configuration files, including a BPF tracer and a minimal trigger. Notable features include a ready-to-use build system and a script to launch a testing environment using QEMU.

The Laravel RCE Exploitation Toolkit is a set of Python scripts designed for identifying and exploiting Remote Code Execution (RCE) vulnerabilities in Laravel applications via exposed .env files and compromised APP_KEYs. The first script, rce.py, generates a malicious payload to execute arbitrary code on the target server by writing a backdoor, while the second script, envtobase64.py, scans for .env files to extract APP_KEYs for reconnaissance purposes. Notable features include automated backdoor creation, result logging, and easy integration with target lists.

Litefuzz is a multi-platform fuzzer designed to identify security-related bugs in userland binaries, clients, and servers across Linux, Mac, and Windows operating systems. Notable features include easy setup, support for both CLI and GUI applications, and capabilities for handling network communication, making it suitable for a wide range of testing scenarios. It emphasizes simplicity in discovering vulnerabilities rather than high performance or academic accolades.

Mirage is an Android application designed to facilitate the auto-injection of shared objects into target processes using the hxo framework. Its primary use case is to enhance the functionality of applications, specifically within the context of Android environments, while supporting versions from Android 9 onwards. Key features include easy installation via an APK, developer support for customization, and a community-driven approach for real-time assistance and feedback.

Misanthro.py is a multi-threaded injection framework designed for aggressive testing of HTTP headers, cookies, and GET/POST parameters, specifically targeting blind injection vulnerabilities such as blind XSS. It features high-throughput payload delivery, authenticated session support, and customizable attack vectors, while not interpreting application responses. The tool is optimized for speed and scalability, allowing users to perform extensive injection testing with minimal configuration.

Multi-Client Reverse Shell is a tool designed for establishing multiple concurrent reverse shell connections from target machines to a listener, allowing for remote access and control. Notable features include an automatic persistence mechanism on Windows that disguises the backdoor as a regular file, as well as capabilities for file upload and download between the target and the hacker's listening server. The tool supports usage on both Linux and Windows platforms and is specifically designed to provide notifications for incoming connection requests from the targets.

The n8n-CVE-2025-68613-exploit tool demonstrates a critical Arbitrary Code Execution vulnerability in n8n's workflow expression evaluation system for versions prior to v1.122.0. This exploit allows authenticated users to execute arbitrary commands by manipulating user-defined expressions in workflows, exposing the underlying runtime to system-level access. Notable features include injectible payloads for executing commands and a step-by-step reproduction process for testing the vulnerability.

Padre is an advanced tool designed for conducting Padding Oracle attacks against CBC mode encryption, enabling the decryption of tokens and encryption of arbitrary data. It features automatic fingerprinting of padding oracles, detection of cipher block lengths, and provides hints for overcoming failures during operations, all while supporting various encoding rules for enhanced flexibility. Particularly useful for security researchers and penetration testers, Padre can effectively exploit vulnerabilities to disclose encrypted session information or bypass authentication mechanisms.

The PoCs-and-Exploits repository offers a collection of exploits authored by the creator, categorized into three main directories: personal CVEs, their own exploits for external vulnerabilities, and third-party exploits for quick reference. The tool is primarily used for sharing research findings in cybersecurity, with an emphasis on privacy and documentation quality. Notable features include the organization of exploits by authorship and a commitment to including comprehensive README files for each exploit to elucidate their mechanics and root causes.

PoE (Proof-of-Exploit) is a domain-specific language tailored for exploit development, offering an intuitive syntax that facilitates the writing of exploits. It features static typing, inline assembly integration, and the ability to manipulate bit-vectors, while supporting local, remote, and SSH modes for interacting with target systems. The tool is built on a .NET interpreter and includes automated patching functionalities, enhancing usability for cybersecurity practitioners.

PwnPasi is a professional automated binary exploitation framework tailored for CTF competitions and security research, streamlining the complex process of binary exploitation. It features smart vulnerability detection, advanced exploitation techniques like ROP chain construction and syscall exploitation, and supports multiple architectures with options for local and remote exploitation. Additionally, it offers flexible deployment modes and integrates various technical tools for thorough binary analysis.

pyFUD is a cross-platform, fully undetectable (FUD) remote access tool (RAT) designed for multi-client handling, allowing persistent shell access and additional functionality such as file upload and download capabilities. The tool supports both Windows and Linux, with features including auto-reconnect and client executable conversion using PyInstaller, aimed primarily at educational use. Users are cautioned against uploading payloads to VirusTotal to maintain its effectiveness.

R2SAE is a command-line tool designed to exploit prototype pollution vulnerabilities in React Server Actions, facilitating remote command execution on affected servers. Key features include command execution on single or multiple hosts, an interactive shell for streamlined command input, and a vulnerability scanning capability with both passive and active methods. This tool is intended solely for authorized security testing and educational purposes.

React2Shell is an advanced exploitation toolkit specifically designed to target the React2Shell vulnerability (CVE-2025-55182) in Next.js applications. It offers an interactive shell experience with features such as command history, automated privilege escalation through pipe injection, and secure file transfer capabilities using base64 encoding. The tool consolidates its exploit logic into a single executable file, making it portable and easy to deploy for ethical penetration testing and security research.

React2Shell is an exploit tool designed to leverage a critical remote code execution (RCE) vulnerability in React Server Components (CVE-2025-55182), featuring multiple techniques to bypass Web Application Firewalls (WAFs). Its primary use case includes executing arbitrary JavaScript commands via HTTP requests while providing options for non-destructive vulnerability detection and sophisticated WAF evasion strategies, such as charset manipulation and junk data padding. The tool supports a variety of customization flags to enhance exploitation efficacy and evade detection mechanisms effectively.

Red Team Rising is a comprehensive resource repository designed for red and purple team professionals, encompassing topics like Penetration Testing, Digital Forensics, Exploit Development, and Malware Analysis. It provides curated study materials, reference links to training platforms and notable YouTube channels, as well as practical commands and tools for various OS distributions suited for cybersecurity tasks. Notable features include a wide array of recommended resources for self-study and a focus on both offensive and defensive security strategies.

ronin-exploits is a Ruby micro-framework designed for the creation and execution of exploit code, allowing exploits to be implemented as Ruby classes. Its primary use case is to simplify the process of writing exploits while providing a modular structure similar to Metasploit, featuring support for various exploit types such as stack overflows, command injections, and cross-site scripting. Notable features include a succinct API, the ability to load exploits from Ruby files or external git repositories, and a minimal memory footprint, making it efficient for security research and development.

PDB2JSON is an Azure Functions-based application designed for secure authentication of running memory in Windows systems through its extensive SHA256 hash database. The tool provides a JSON-based interface for remote interactions with a Code+PDB analysis server, enabling functionalities like symbol resolution and hash verification without uploading binary data. Its notable features include a just-in-time hashing methodology for integrity protection and automation support for memory dump analysis through various scripting examples.

SettingContent-MS-File-Execution is a proof-of-concept tool that exploits the SettingContent-MS file execution vulnerability in Windows 10. It facilitates the automatic launch of Internet Explorer to load a specified website, which can be utilized to exploit existing vulnerabilities within the browser or to execute online payloads. Notable features include the ability to maximize the browser window and target specific online resources.

SeTcbPrivilege Local Privilege Escalation (LPE) is a tool implemented in Go that leverages the SeTcbPrivilege privilege escalation technique to allow users to execute arbitrary commands with elevated permissions on Windows systems. Its primary use case is for gaining administrative access by manipulating service configurations, and it features automatic service deletion post-execution, with a manual clean-up option available. This tool provides a streamlined method for executing commands that would normally require higher privileges.

testbuild_exploit is a tool designed to achieve elevated privileges (UID 1000) on vulnerable Android devices running test-signed ROMs by patching system apps to inject a backdoor. This allows users to execute commands with nearly root-level access, although functionality may be limited by SELinux configurations. Key features include the ability to modify any app, not just system ones, and integration with ADB for command execution.

TI-MultiView-data-recovery is a tool designed to recover entries from the TI-30XS MultiView™ and TI-30XB MultiView™ scientific calculators after they have been reset. The procedure allows users to restore inputs and answers displayed on the home screen, leveraging specific key sequences, while noting that it does not recover settings or statistical data. The tool highlights the persistence of memory even after a reset, providing a workaround for users to retrieve valuable calculations.

TokenElevation is a Windows utility that facilitates privilege escalation by enabling the SeImpersonatePrivilege, allowing the user to impersonate a logged-on user and duplicate the token of a specified target process. This tool is primarily used in administrative and debugging scenarios, enabling users with local Administrator access to execute new processes under the context of a target process to perform elevated tasks. Notable features include process token manipulation and the capability to spawn a new command prompt with the privileges of the target process specified by its PID.

The tool "Tor-0day-JavaScript-Exploit" serves as a comprehensive educational resource and demonstration of the CVE-2024-9680 vulnerability, a critical use-after-free exploit in the Tor Browser's animation handling. It includes both the original exploit code used in the wild and a modified version with detailed analyses, showcasing the exploitation process through various stages such as initialization, DOM crafting, and trigger mechanisms. This repository is intended primarily for security education, defensive research, and authorized vulnerability assessments, emphasizing ethical and legal usage.

udbg is a cross-platform Rust library designed for binary debugging and memory manipulation, providing uniform interfaces across various operating systems. Its primary use case is to facilitate the inspection and control of multiple debug targets without invasive attachment, supporting comprehensive target information retrieval and debugging functionalities. Notable features include support for multiple architectures, non-invasive operation modes, and capabilities for breakpoint and watchpoint management.

Valthrun an open source external CS2 read only kernel gameplay enhancer.

The 'vulnerability' tool catalogs known vulnerabilities for various software, with a current focus on Microsoft Internet Explorer and Apple OSX, listing specific Common Vulnerabilities and Exposures (CVEs) associated with each platform. The primary use case is to provide a reference for security professionals looking to understand and track reported vulnerabilities. Notable features include the organization of vulnerabilities by vendor and product, enabling easier identification of security concerns.

WaSonar is a command-line interface tool designed for educational research and security assessments focused on the WhatsApp protocol. It facilitates real-time device tracking, device discovery, and profile extraction from linked devices, while also offering a resource exhaustion feature that can stress test the target by sending oversized payloads. Notably, WaSonar employs silent probes to determine online status without alerting the user and allows users to initiate rapid, high-frequency message deliveries to gauge system resilience.

The WP CTF 2025 repository offers a collection of cybersecurity challenges created for the WP Capture the Flag event, aimed at enhancing skills among young cybersecurity enthusiasts. It features a diverse range of challenges across multiple categories such as Crypto, OSINT, PWN, and Reversing, with varying difficulty levels, and includes source code, solutions, and walkthroughs for each challenge. Notable features include the ability to exploit vulnerabilities, reverse engineer to understand systems, and perform forensic analysis, making it a comprehensive resource for hands-on learning in cybersecurity.

WSUS-CVE-2025-59287-RCE is a proof-of-concept exploitation tool for a critical remote code execution vulnerability (CVE-2025-59287) in Microsoft Windows Server Update Services. The tool automates the generation and transmission of a malicious payload that exploits insecure deserialization in the WSUS GetCookie() endpoint, enabling unauthorized execution of arbitrary code with system privileges. Key features include payload generation, AES encryption, and SOAP request construction, facilitating a straightforward reverse shell setup through user input for target and listener configurations.

XWorm RCE is a proof of concept tool that demonstrates a zero-click vulnerability within the XWorm plugin for RDP connections. It exploits a flaw where the server fails to validate client responses, allowing an attacker to execute commands on the victim's machine without user interaction. Notable features include the ability to exploit the vulnerability without initiating a connection command, showcasing its potential for remote code execution.

0xKern3lCrush is an educational repository designed to understand Bring-Your-Own-Vulnerable-Driver (BYOVD) techniques and document key artifacts related to recent vulnerabilities like CVE-2026-0828. It provides safe user-mode reconnaissance code for process enumeration, alongside static analysis on identified vulnerable drivers, aimed at assisting security professionals in recognizing patterns in malicious behavior and improving detection capabilities. Notable features include an emphasis on ethical usage, detailed research notes, and a lack of any exploitative code to prevent misuse.

The botnet-exploits repository is a collection of network vulnerability scanners designed to identify security weaknesses across various devices for educational and authorized testing purposes. It includes tools specifically for testing DVRs, ZHONE routers, Fiber routers, and performing telnet brute force attacks, featuring capabilities like multi-threaded scanning, real-time status updates, and automated credential testing. Users are required to configure payload URLs for legitimate testing environments, reinforcing the ethical use of these tools.

CVE-2023-23752-EXPLOIT is a proof of concept tool designed to demonstrate an improper access check vulnerability in Joomla versions 4.0.0 to 4.2.7, allowing unauthorized access to sensitive web service endpoints. Its primary use case is for educational and ethical security research, emphasizing responsible usage and compliance with legal standards. The repository includes a PoC to illustrate the exploit, highlighting the potential severity of the vulnerability.

CVE-2025-27237 is a local privilege escalation vulnerability affecting the Zabbix Agent for Windows, which arises from OpenSSL configuration file hijacking due to hardcoded paths accessible to low-privileged users. This tool provides scripts and proof-of-concept (PoC) implementations to analyze affected Zabbix binaries, compile malicious DLLs, and facilitate exploitation in vulnerable systems, while also offering methods for detection and remediation. Key features include binary analysis tools and detailed documentation for ensuring system security against this identified vulnerability.

DEDSEC_BKIF is a keystroke injection tool that exploits CVE-2023-45866, enabling attackers to manipulate Bluetooth-enabled devices across Android, Linux, and iOS platforms. Its primary use case is remote keystroke injection and unauthorized command execution through a zero-click Bluetooth vulnerability, allowing devices to be compromised without user interaction. Notable features include support for rubber ducky payloads and the capability to bypass authentication, making it a versatile threat in the realm of Bluetooth security.

This repository serves as a comprehensive resource for ethical hacking and penetration testing, offering a collection of articles, scripts, tutorials, and multimedia content focused on various platforms including Linux, Windows, and cloud services. It aims to share the author's expertise and provide guidance on security practices while emphasizing the importance of legal compliance. Regular updates are planned to enhance the repository's educational value for the cybersecurity community.

ForceAdmin is a malicious tool designed to create an infinite loop of User Account Control (UAC) prompts, compelling users to grant administrative privileges by overwhelming them with requests. It provides various script templates in formats such as batch, PowerShell, AutoHotkey, AutoIt, HTA, and VBScript, facilitating execution via PowerShell and bypassing antivirus protections. Notable features include no dependencies, dual architecture support for x86 and x64 systems, and a fileless execution method.

The "Proof-of-Concept (PoC) Research Papers" repository aggregates recent academic papers focused on exploit generation, empirical analysis, and applications of Proof-of-Concept methodologies in cybersecurity. Its primary use case is to serve as a comprehensive resource for researchers and practitioners to access and contribute to the latest findings and developments in PoC research. Notable features include a well-organized categorization of papers by year and topic, making it easier to navigate the content and identify relevant studies.

RE_Mal_Exploit_Tutorials serves as a comprehensive resource hub focused on reverse engineering, malware analysis, and exploit development. It aggregates various tutorials, guides, and tools, facilitating knowledge acquisition for security professionals and enthusiasts interested in understanding and mitigating software vulnerabilities. Noteworthy features include curated links to both beginner and advanced learning materials across multiple platforms, encompassing both theoretical and practical aspects of cybersecurity topics.

tx2hax is a repository that provides exploit implementations for vulnerabilities in the Tegra X2 and Magic Leap One devices, primarily focusing on achieving code execution in the BootROM of the Tegra X2 through USB Recovery Mode. Notable features include specific exploits such as `rcmhax`, `sparsehax`, and `dtbhax`, along with detailed writeups that document the exploitation techniques and methodologies employed.

This repository provides a proof-of-concept for a Windows local privilege escalation exploit that combines a User Account Control (UAC) bypass with token duplication to elevate a process to SYSTEM-level privileges. It serves primarily for educational purposes, demonstrating key concepts of Windows security, such as token mechanics and process elevation, while employing techniques like registry manipulation and access token duplication to illustrate vulnerabilities in privilege management. Notably, the tool employs specific Windows APIs for process creation and token handling, highlighting potential attack vectors in a controlled environment.

AiGPT is an automated exploitation framework designed for rapidly discovering and compromising vulnerable WordPress sites, leveraging a multi-vector engine to exploit thirteen unauthenticated CVEs. Key features include intelligent plugin fingerprinting, the ability to create unauthorized WordPress admin accounts, direct access through SQL injection, and a multi-threaded scanning capability for efficiency across networks. This tool is intended for authorized penetration testing and security research purposes.

AKILT is an open-source botnet framework designed for security enthusiasts and malware analysts to facilitate the study of botnet operations. Written in Go, it supports both client and server functionalities with advanced features such as screen capture, remote command execution, DDOS attacks, and a keylogger, while aiming to remain undetectable. The tool provides a valuable resource for understanding the implementation and behavior of botnets in a controlled environment.

AntiDarkSword is an iOS jailbreak tweak and a TrollStore dylib designed to enhance the security of vulnerable iOS devices against WebKit RCE and iMessage zero-click exploits. Its notable features include the ability to selectively disable Just-In-Time (JIT) compilation, spoof user agents, block risky attachments, and isolate system daemons, effectively mitigating various types of attacks. Additionally, the tool can deploy a Corellium honeypot to disrupt advanced payloads.

Atomic-Mirai is an educational tool modeled after the Condi-Mirai botnet family, aimed at facilitating research on IoT security vulnerabilities and DDoS attack methodologies. It features a flexible compilation process for various architectures and includes a command and control (C&C) server setup, allowing users to simulate and analyze attack vectors in a controlled environment. Notably, this tool is strictly intended for educational and research purposes, with a clear disclaimer against illegal usage.

AttackMate is an automation tool designed to execute cyber attack scenarios across all phases of the Cyber Kill Chain, integrating seamlessly with penetration testing frameworks like Metasploit and Sliver Framework. It allows users to script commands, generate payloads, schedule and chain attack steps using configuration files, and perform background operations, including file transfers and HTTP interactions. Noteworthy features include automation of shell or SSH commands, comprehensive support for Metasploit and Sliver commands, and a user-friendly interface for managing complex attack scenarios.

Autorun-ng is a versatile tool designed for launching applications with a streamlined user interface, supporting both Linux and Windows environments. Its notable features include a sandboxed filesystem leveraging cap-std for enhanced security, ergonomic Lua API bindings for seamless integration, and a zero-dependency library for accessing source engine interfaces. This tool eliminates the need for menu plugins or manual injections, making application execution efficient and user-friendly.

Awesome MCP Security is a comprehensive resource focusing on the security aspects of the Model Context Protocol (MCP), providing guidance on best practices, potential vulnerabilities, and mitigation strategies. It includes a variety of materials such as academic papers, articles, tools, and security considerations aimed at enhancing the security of applications utilizing MCP. Notable features include detailed security guidelines for both clients and servers, highlighting the importance of human oversight and proper input validation.

The "awesome-vm-escape" repository is a comprehensive collection of write-ups, exploits, and resources focused on virtual machine escape and container breakout vulnerabilities. It includes categorized information on various platforms such as VMware, VirtualBox, QEMU, and Docker, providing valuable insights for security researchers and practitioners looking to understand and exploit VM-related security flaws. Notable features of the repository include curated lists of exploits and case studies relevant to each virtualization technology, which facilitate knowledge sharing and advancement in the field of cybersecurity.

Bluebox is a collection of exploits tailored for various VoIP products, primarily designed for penetration testing and the exploitation phase of VoIP environments. It utilizes the Go Exploit Framework and features a Docker Compose file that includes an Asterisk server for testing purposes, facilitating a streamlined approach for security professionals to assess vulnerabilities in VoIP systems.

BlueToolkit is an extensible, black-box framework designed for testing Bluetooth vulnerabilities in both Bluetooth Classic (BR/EDR) and Bluetooth Low Energy (BLE) systems. Its primary use case includes semi-automated testing through its three main modules: Recon for capability gathering, Exploit for executing a range of 43 public exploits, and Report for generating comprehensive JSON reports. Additionally, the framework has been evaluated against multiple automotive brands, revealing significant security vulnerabilities in their Bluetooth implementations.

Bolt Unblocker is a Node.js-based proxy tool designed to bypass content restrictions, offering support for various popular platforms, including GeForce NOW and Discord. Its notable features include a user-friendly OS GUI, two high-speed proxy options, flexible cloaking capabilities, and robust site support, leveraging the latest Ultraviolet V3 proxy service for improved performance compared to outdated alternatives. Users can deploy Bolt on multiple platforms but must avoid certain static hosting services to ensure full functionality.

C-hacks is a social media gathering tool designed for educational purposes, featuring WhatsApp, Facebook, and Instagram hacking capabilities, along with information gathering functionalities. Notable features include IP location tracking and phishing scripts, as well as modified WhatsApp for enhanced functionality. Installation is straightforward, requiring basic Linux commands to set up and execute the tool.

CentralizedPotatoes is a repository that aggregates various privilege escalation exploits in the Windows operating system, known as "potato" exploits, which leverage impersonation privileges to elevate access from service accounts to system level. The tool categorizes and documents these exploits, ranging from Hot Potato to God Potato, thereby providing a comprehensive reference for cybersecurity professionals and penetration testers. Notable features include a chronological list of exploits with links to their respective implementations and guidance on prioritizing their use based on effectiveness.

ClickFix Builder is a dual-mode social engineering toolkit designed for red teamers, pentesters, and security researchers, enabling the generation of realistic fake captcha techniques for executing malware commands on Windows targets. Its notable features include the generation of portable files such as HTML and JS stubs, as well as a VPS deployment mode that provides real-time logging, IP blocking, and bot detection. The tool also offers a dark-mode GUI for enhanced usability and customizable payloads, making it versatile for various security testing scenarios.

clpzcode is an automated penetration testing tool that orchestrates a full pipeline of security assessments, including subdomain enumeration, vulnerability detection, exploitation, and privilege escalation. Notably, it employs an AI agent that intelligently adapts its actions based on tool responses, supports multi-agent parallelism for concurrent tasks, and features 29 built-in escalation chains for efficient threat exploitation. The tool’s command-driven interface allows users to initiate complex assessments with minimal input, streamlining the penetration testing process.

The "Vault de Conocimiento" is a personal repository designed for self-directed learning and documentation across various fields, including Cybersecurity, Computer Science, and Programming. It primarily serves as an organized collection of notes for ethical hacking, pentesting, cryptography, and more, structured for optimal use with the Obsidian note-taking app, which facilitates idea connections and navigation. Notable features include internal linking, graphical visualization, and a comprehensive index that covers foundational to advanced topics in multiple domains.

Copy Fail is a cybersecurity tool designed to exploit CVE-2026-31431, a vulnerability affecting specific Linux distributions. Its primary use case is for security researchers and penetration testers to demonstrate and assess the impact of this flaw across various operating systems, including Ubuntu, Amazon Linux, RHEL, and SUSE. Notable features include compatibility with multiple Linux kernel versions and a comprehensive technical writeup for understanding the vulnerability's implications.

Copy Fail is a proof-of-concept tool designed to demonstrate a method for fully unprivileged containers to achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel vulnerability. It leverages the shared image layers in container runtimes, allowing an unprivileged pod to corrupt binaries in a shared layer that are later executed by privileged DaemonSets, thereby achieving container escape. Notable features include validation on multiple cloud platforms (Alibaba Cloud, Amazon EKS, and Google GKE) and a comprehensive breakdown of the attack chain, which includes page-cache corruption, cross-container propagation, and privileged execution.

CopyFail is a Python-based exploit tool targeting the CVE-2026-31431 vulnerability, which allows local privilege escalation on vulnerable Linux kernels (4.11 to <6.18). It utilizes the AF_ALG socket interface bug to enable unprivileged users to overwrite setuid binaries, bypassing race conditions and kernel-specific offsets, making it applicable across various distributions. Key features include the ability to check system vulnerability status, a simple execution process, and container escape capabilities, all while being an educational tool intended for authorized testing only.

CopyFail is a Python library designed to perform the splice system call between file descriptors for Python versions earlier than 3.10, utilizing ctypes for syscall implementation. Its primary use case is to facilitate efficient data copying between file descriptors in environments where the splice() function is not natively available. Notable features include compatibility with both legacy and current Python versions, enhancing its versatility in various applications.

The "Cracking OSCP" repository offers a comprehensive roadmap for aspiring ethical hackers pursuing the OSCP certification. It features a structured playlist of video tutorials and supplementary notes across various topics, including computer networks fundamentals and practical examples, aimed at providing a solid foundation for ethical hacking methodologies. Notable aspects include detailed guidance on note-taking, network concepts, and the OSI model, making it a valuable resource for both beginners and those preparing for the OSCP exam.

CVE-2020-10558 is a tool that documents a critical Denial of Service vulnerability in Tesla Model S, 3, and X vehicles prior to software version 2020.4.10, which allows remote attackers to crash the vehicle's Infotainment system by exploiting improper web instruction handling. The tool provides insights into the attack vector, impact on vehicle functionality, and remediation details following responsible disclosure protocols. Notably, the findings led to a fleet-wide OTA update from Tesla to mitigate the vulnerability, highlighting its significance in automotive cybersecurity.

This tool serves as a proof of concept (PoC) exploit for the Apache HTTP Server vulnerabilities CVE-2021-41773 and CVE-2021-42013, which allow for path traversal and remote code execution (RCE) in versions 2.4.49 and 2.4.50. Its primary use case is to demonstrate these exploits against specified targets, facilitating security assessments and vulnerability testing. Notable features include the ability to read sensitive files and execute arbitrary commands on the server via customizable input parameters.

The CVE-2022-0847 tool exploits a vulnerability known as "Dirty Pipe" to achieve container escape, allowing an attacker to overwrite read-only files on the host system from within a container. Its primary use case is for demonstrating the potential risks associated with granting the `CAP_DAC_READ_SEARCH` capability to containers. Notable features include the ability to bypass file permission checks and use the `splice()` system call to overwrite files directly on the host filesystem.

CVE-2023-43208-EXPLOIT is a Proof-of-Concept (PoC) tool designed to exploit a remote code execution vulnerability in Mirth Connect versions prior to 4.4.1. The tool utilizes specially crafted HTTP requests to execute arbitrary OS commands on vulnerable systems, offering features such as single and batch target exploitation, customizable listening options for reverse connections, and multi-threaded scanning capabilities.

CVE-2024-6387_Check is a specialized tool for detecting servers vulnerable to the newly identified `regreSSHion` vulnerability in OpenSSH (CVE-2024-6387). It supports rapid scanning of IP addresses, domain names, and CIDR ranges, incorporates features such as multi-threading for efficiency, SSH banner retrieval, and options for assessing LoginGraceTime settings, all while providing detailed and easily interpretable output. Notably, the tool also includes IPv6 support and recognizes patched OpenSSH versions to enhance the accuracy of vulnerability assessments.

CVE-2025-14558 is an exploit tool designed to demonstrate a command injection vulnerability in the `rtsold` service on FreeBSD systems, which allows remote code execution due to improper validation of DNSSL domain names. It requires Layer 2 adjacency to the target and enables attackers to execute arbitrary commands with root privileges by leveraging shell metacharacters. The tool is intended for defensive security research and authorized testing only.

The CVE-2025-25198-PoC tool serves as a proof-of-concept exploit targeting a host header poisoning vulnerability in Mailcow's password reset mechanism. It automatically sets up a local HTTPS listener, retrieves a CSRF token, and initiates a password reset request with a manipulated Host header to capture valid reset links from the target system's responses or callbacks. Notable features include automatic CSRF token handling, customizable attack parameters, and the ability to retry until a reset link is successfully captured.

CVE-2025-60787 is a proof-of-concept tool that exploits an authenticated remote code execution vulnerability in motionEye versions up to 0.43.1b4. It features two main commands: `revshell` for establishing a reverse shell connection and `command` for executing arbitrary commands on the target system, facilitating exploitation of the vulnerability. Users must provide the target's URL and authentication credentials to utilize the tool effectively.

The CVE-2026-0073 tool exploits a critical authentication bypass vulnerability in the Android ADB daemon (`adbd`), enabling an attacker on the same local network to gain unauthorized shell access to the target device. It leverages a type confusion issue in the TLS client certificate validation process, allowing for full control without user consent. Notable features include the capability to execute single commands, use different key types, and support for verbose output to trace the exploitation process.

This tool is a proof-of-concept exploit for the double-free vulnerability (CVE-2026-23918) in Apache's `mod_http2`, capable of inducing a denial-of-service (DoS) by repeatedly crashing server workers through a race condition in stream cleanup. It allows users to demonstrate this vulnerability's impact via various modes, including aggressive DoS and passive vulnerability detection, by manipulating how Apache handles early stream resets. While remote code execution (RCE) is theoretically possible, it requires multiple specific conditions, making reliable exploitation complex and unlikely for most attackers.

CVE-2026-27771 is a proof-of-concept tool that exploits an authentication bypass vulnerability in Gitea's OCI container registry, allowing unauthorized remote attackers to retrieve private container images from affected instances. Designed primarily for educational and authorized security research, it can scan for vulnerable Gitea setups and facilitate the pulling of container images without authentication. Notable features include scanning for instances, pulling all images or specific repositories, and the ability to operate with a personal access token when sign-in is required.

CVE-2026-31431-CopyFail is a local privilege escalation exploit targeting a vulnerability in the Linux kernel's AF_ALG crypto subsystem, allowing an unprivileged user to perform a 4-byte arbitrary write in the kernel's page cache. The tool offers multiple exploitation methods, including dynamic ELF entry point overwrites and full binary replacements, with compatibility for both Python 2 and 3. Notable features include determinism without race conditions, operation within default Docker containers, and independence from kernel version, making it applicable across all kernels since 2017.

The CVE-2026-31431-Linux-Copy-Fail tool is a Rust-based local privilege escalation exploit that leverages an arbitrary page cache write vulnerability in Linux systems. It facilitates the execution of customizable shellcode, including a Meterpreter payload, and offers functions for testing vulnerability and executing exploits. Notable features include support for direct payload substitution and detailed usage instructions for compiling and executing the tool on affected Linux distributions.

CVE-2026-41089 is a proof-of-concept (PoC) tool that exploits a stack-based buffer overflow vulnerability in Windows Domain Controllers' LSASS service via crafted UDP packets to port 389, potentially causing a denial of service (DoS) by crashing and rebooting the Domain Controller with no authentication required. It features a straightforward three-phase operation, confirming the target's liveness, executing the overflow, and checking if the DC is still operational, while being designed to work with Python 3.8 and later without external dependencies. Notably, it highlights the inherent risk of stack corruption leading to remote code execution (RCE) possibilities.

The CVE-2026-41940 Exploit PoC tool is designed to exploit a vulnerability for bypassing authentication in specific web applications. Its primary use case involves running an exploit script that captures session tokens, which can then be manipulated in Burp Suite to gain unauthorized access. Notable features include straightforward exploitation commands and session hijacking techniques for effective testing of web application security.

CVE-2026-48908-PoC is a proof-of-concept exploit for a critical unauthenticated remote code execution vulnerability in the SP Page Builder component for Joomla. This tool leverages the improper access control in the asset.uploadCustomIcon task to upload malicious files to a publicly accessible directory, ultimately enabling an attacker to execute arbitrary code on the target server. Notable features include an adaptive payload mechanism that tests various file extensions and .htaccess file injections to bypass server restrictions, as well as cleanup functionality to remove uploaded artifacts after exploitation.

CVE Mapper is a tool designed to correlate Nmap scan results with relevant CVEs specific to the discovered product versions, minimizing false positives. It utilizes the Vulners API to provide version-accurate vulnerability mappings while re-validating the affected version ranges and generating confidence levels for each finding. The tool supports multiple output formats including JSON, CSV, and HTML, making it versatile for reporting and further analysis.

CVE Scores is a tool designed to aggregate and analyze vulnerability scores from various sources, specifically the Exploit Prediction Scoring System (EPSS) and the Vulnerability & Exploit Data Aggregation System (VEDAS). Its primary use case is to predict future exploitation of vulnerabilities and estimate the prevalence and exploit maturity of identified vulnerabilities. Notable features include real-time data updates, integration of proprietary and open source intelligence, and the ability to assess vulnerabilities across multiple identifiers.

Dirty Frag is a proof-of-concept tool that demonstrates how an unprivileged Kubernetes Pod can exploit the Dirty Frag vulnerability (CVE-2026-43284) to achieve node-level code execution on Amazon EKS by corrupting in-memory cached pages of shared container image layers. Its primary use case is to illustrate the risks associated with privileged DaemonSets in Kubernetes clusters that share image layers, as it allows for direct execution of compromised binaries by these privileged workloads. Notable features include the ability to target any privileged DaemonSet, leveraging kernel page-cache corruption alongside the sharing of image layers, thereby exposing a significant security vulnerability in Kubernetes environments.

dirtyfrag-arm64 is an ARM64/AARCH64 exploit tool adapted from the original x86_64 dirtyfrag PoC, targeting vulnerabilities CVE-2026-43284 and CVE-2026-43500. Its primary use case is for privilege escalation by corrupting system binaries, specifically employing an ESP path for exploitation due to limitations on the ARM64 architecture. Notable features include detailed analysis of AppArmor bypass methods and architecture-specific payload adaptations, allowing it to interact with existing user and network namespaces on vulnerable systems.

End-To-End-SOC-Home-Lab is a comprehensive project designed to construct a Security Operations Center (SOC) lab on a personal computer, utilizing Splunk for monitoring and detection of cybersecurity threats. It enables users to simulate various attack scenarios, analyze the resultant logs and telemetry, and develop effective detection mechanisms, thereby fostering skills pertinent to both red team attack simulations and blue team defensive strategies. Notable features include detailed guidance on setting up infrastructure, practical use cases for threat detection, and a focus on hands-on learning through real-world attack techniques.

SourApple is a ported exploit targeting iOS 17 devices that uses BLE pairing requests to induce crashes on vulnerable iPhones. It specifically operates on ESP32 and Raspberry Pi platforms, allowing users to evaluate the security of their devices under controlled conditions. Notable features include a focus on educational use, testing on multiple iOS models, and the provision of troubleshooting guidance for common compilation errors.

PwnLand is an open-source resource designed for security researchers and CTF participants, focusing on binary exploitation techniques. It provides an extensive collection of practical examples, tutorials, and research materials on various vulnerabilities, including buffer overflows, format string vulnerabilities, heap exploitation, and kernel exploits. Notable features include structured directories for different exploitation methods, debugging guides, and challenges for hands-on practice.

Express Honeypot is a honeypot tool designed to detect and log remote file inclusion (RFI) and local file inclusion (LFI) attacks against web applications. It functions by serving fake URLs generated from a list of known vulnerable paths, dynamically logging any malicious requests, and downloading the attempted remote files for analysis. Key features include a lightweight log viewer and the ability to customize monitored URLs, making it an effective solution for catching and studying automated scanning bots.

EXT-REMOVER is a curated collection of exploits designed specifically for ChromeOS, facilitating various forms of system modifications and enhancements, such as unenrollment from management systems and disabling or freezing browser extensions. It includes notable capabilities like bypassing security measures, tampering with policies, and modifying system configurations, though users are cautioned against misuse that can cause significant damage. The repository serves as a resource for those seeking to explore the security aspects of ChromeOS within legal boundaries.

The external-process framework provides mechanisms for interacting with external Win32 processes, enabling operations such as reading and writing process memory, allocating memory, calling functions with various calling conventions, and performing code injection. It is primarily used for creating trainers or utilities that modify the behavior of running applications. Notable features include the ability to search for byte sequences in memory and a built-in external process simulator for testing purposes.

GEF (GDB Enhanced Features) is a powerful tool designed to enhance the functionality of GDB (GNU Debugger) for exploit development and reverse engineering across multiple architectures such as x86/64, ARM, and MIPS. Notable features include architecture agnosticism, a single installation script, full Python 3 support, and a variety of commands that optimize the debugging experience while facilitating dynamic analysis. The tool is designed to reduce cognitive load on developers by offering a more intuitive interface and extensive community contributions.

HatSploit is a modular penetration testing framework designed for writing, testing, and executing exploit code. Its primary use case is to facilitate security assessments and vulnerability exploitation in a structured manner. Notable features include its extensibility through modules and a user-friendly interface for deploying exploits.

Isolation Alloc (IsoAlloc) is a secure, C11-based memory allocator designed as a drop-in replacement for `malloc` on 64-bit Linux and MacOS systems, emphasizing memory allocation isolation to enhance security by spatially separating objects of various sizes and types. Key features include the management of memory through distinct zones for specific sizes, comprehensive debugging support for memory leaks and usage, and built-in compatibility with Address Sanitizer and similar tools. IsoAlloc is particularly suitable for applications where security and performance of memory management are crucial.

The k8gege.org repository hosts a website that serves as a centralized platform for Kubernetes-related resources and tools. Its primary use case is to provide educational content, documentation, and best practices for Kubernetes users and developers. Notable features include curated links to tutorials, articles, and other valuable resources in the Kubernetes ecosystem.

The Linux-Exploitation repository provides a comprehensive set of tools and techniques for performing privilege escalation on Linux systems. Its primary use case is to assist security professionals in identifying vulnerabilities that can be exploited to gain higher access levels, featuring sections on manual enumeration, automated tools, password mining, misconfiguration exploitation, and maintaining access through SSH key uploads. Notable features include detailed guides on various escalation methods, scripts for automated enumeration, and an exhaustive list of potential exploits tailored for Linux environments.

Lost-NDS-TV is a project aimed at restoring the hidden television composite video output feature of the Nintendo DS Lite's SoC through custom hardware designs and software solutions. Its primary use case is to enable video output from the DS Lite for enhanced viewing experiences, supported by comprehensive schematics, production files, and installation tutorials. Notable features include detailed documentation and video tutorials for installation, making it accessible for users interested in retro gaming modifications.

Magento PolyShell is an advanced exploitation toolkit designed for unauthenticated remote code execution (RCE) on Magento 2.x through polyglot file uploads via the REST API. It tests over 45 PHP extension variants while utilizing multi-header support, server fingerprinting, and advanced WAF bypass techniques to maximize exploitation success across a wide range of environments. Key features include interactive and CLI modes, categorization of results by target, and extensive post-exploitation capabilities for system information retrieval.

The "Malware" repository offers a collection of malware samples and resources for cybersecurity professionals. Its primary use case is to facilitate testing and analysis of malware, including the ability to download various samples using proxy tools like proxychains. Notable features include the inclusion of the EICAR test file for antivirus testing and the ability to aggregate IP addresses from logs for streamlined malware acquisition.

Mephisto is a WordPress vulnerability scanner and exploitation framework designed for authorized penetration testing, enabling security professionals to assess multiple WordPress installations for security weaknesses. Key features include multi-CVE support, mass scanning capabilities, automatic detection of vulnerable plugins and themes, and the ability to upload web shells for post-exploitation access, all while ensuring anonymity through proxy support and anti-detection measures.

MS-RPC Fuzzer is a PowerShell module designed for automated vulnerability research in Microsoft Remote Procedure Call (MS-RPC) implementations. Its primary use case involves dynamically building RPC clients to fuzz various RPC procedures using random inputs, aiming to identify potential vulnerabilities in RPC services efficiently. Notable features include a structured three-phase process for inventorying RPC interfaces, performing fuzzing based on gathered data, and analyzing results with options for visualization in a Neo4j database.

Neospring is a tool designed to facilitate the respring process in LiveContainer environments, addressing limitations found in existing solutions like InstaSpring and respringapp. By leveraging a method originally developed by neon and ported to Swift by skadz, it offers a streamlined and effective approach for developers and users working with iOS customization. Notable features include enhanced compatibility with LiveContainer, enabling efficient system refresh without typical constraints.

The NmiCallbackBlocker is a driver concept that modifies kernel memory to prevent Non-Maskable Interrupts (NMIs) from executing by altering processor affinity masks. Its primary use case is to aid in bypassing anti-cheat mechanisms within gaming environments, leveraging techniques like signature scanning and structure manipulation for stealth operations. Notable features include the ability to evade detection through spoofing techniques and encrypted signatures, though it is important to note that the project includes no built-in anti-cheat protections.

NTRGhidra is a plugin for Ghidra that serves as a Nintendo DS loader, enabling users to analyze and debug DS software within the Ghidra environment. It supports Ghidra version 12.0.4 and allows for dynamic loading and unloading of overlays, enhancing the tool's functionality for developers working with Nintendo DS applications. Notable features include extension installation for Ghidra and comprehensive build instructions for developers interested in modifying the loader.

Octoscan is a static vulnerability scanner designed for GitHub action workflows, enabling users to identify potential security issues within their CI/CD pipelines. Its primary use case is analyzing workflows for various vulnerabilities, including dangerous actions, credentials exposure, and expression injection. Notable features include the ability to download workflows from remote repositories, customizable rule sets for scanning, and support for multiple output formats, ensuring flexibility in vulnerability reporting.

OnlyShell is a Go-based reverse shell handler designed for penetration testers and security researchers, enabling the management of multiple reverse shell connections concurrently. Key features include automatic shell type detection, background shell management, command broadcasting across active shells, and the option for encrypted communications with TLS support. The tool offers an intuitive command-line interface and allows for real-time interaction and status monitoring of all connected sessions.

Padoracle is a Node.js tool designed to perform Padding Oracle Attacks, allowing users to crack plaintext from encrypted data using a known initialization vector (IV) and ciphertext. Its notable features include a user-friendly command-line interface (CLI), robust API support, the ability to generate IV and ciphertext with modified plaintext, and an ultra-fast cracking capability with unlimited concurrency. This tool is particularly useful for security researchers and professionals looking to exploit vulnerabilities in web applications utilizing padding oracle patterns.

Pentagram-exploit-tester is a utility designed to assess whether a device running iOS 15.0 to 15.1.1 and 15.2 BETA 1 is vulnerable to CVE-2021-30955, facilitating compatibility with jailbreak exploits. The tool informs users of their device's status regarding this vulnerability, advising against updates if the device is vulnerable. Notably, the tool allows for multiple testing attempts in case of transient errors during execution.

This repository provides a proof-of-concept for CVE-2025-55182, a critical pre-authentication remote code execution vulnerability found in specific versions of React Server Components. The vulnerability enables unauthenticated attackers to execute arbitrary JavaScript code on the server by exploiting unsafe deserialization through prototype chain traversal in the Flight protocol. Notably, the tool facilitates demonstration of the exploit process, requiring a vulnerable React setup and tools like Burp Suite for payload delivery and testing.

The postexploitation-toolbox-android is a specialized toolkit for executing post-exploitation techniques on Android devices, particularly designed for Android 14 on the Samsung S21 Ultra. It leverages CVE-2024-34740 to allow code injection into system processes, enabling features such as temporary app debuggability, system-wide permission bypassing, and dynamic resource editing, while providing a user-friendly interface for manipulating system service internals through Java reflection.

Prober is a pentesting framework designed to simplify the management of GitHub repositories by eliminating the complexities of git submodules. Its primary use case is to allow penetration testers to easily download and clone necessary tools with straightforward commands, enhancing usability in security assessments. Notable features include a clean execution script and a focus on user-friendly setup processes.

The `pub` repository contains a collection of proof-of-concept (PoC) exploits and tools designed to demonstrate vulnerabilities disclosed by the author, tintinweb. Its primary use case is to aid security researchers and developers in understanding and testing these vulnerabilities. Notable features include a structured directory of PoCs and integrated GPG public key for secure communications.

pwnkit is an exploitation toolkit designed for pwn CTFs and Linux binary exploitation research. It provides a suite of features including exploit templates, I/O helpers, ROP gadget mappers, and various utilities for crafting and executing exploits, making it ideal for both novice and experienced exploit developers. Notable features include customizable templates, integration with gdb helper scripts, and the ability to operate as a CLI tool or Python API.

ropcatalog is a Python tool designed for parsing, classifying, and browsing ROP (Return-Oriented Programming) gadgets from rp++ output files, primarily aiding in Windows exploit development. It features an interactive REPL with extensive search options, ASLR support for dynamic address adjustments, bad character filtering to enhance exploit reliability, and multiple output formats for easy integration into exploit code. The tool is tailored for users engaged in ROP chain construction and binary exploitation tasks.

The Samsung S25 Vulnerability Research repository provides tools and scripts for exploiting vulnerabilities in the Samsung Galaxy S25, specifically focusing on a one-click remote code execution (RCE) exploit and a method for arbitrary APK installation. Notable features include the `1click-rce` tool for RCE exploitation and the `local-apk-install` script for generating APK signatures, accompanied by detailed instructions for each. This resource is primarily aimed at cybersecurity researchers and enthusiasts investigating mobile device security.

scap-rs is a Rust library designed for interacting with the National Vulnerability Database, encompassing various modules such as CVSS, CVE, CPE, and CWE, which facilitate vulnerability scoring, disclosure, platform enumeration, and weakness classification. Its primary use case provides developers with tools to access and manipulate vulnerability data, enabling better security posture management. Notable features include support for multiple vulnerability-related standards and well-documented APIs for ease of integration.

The SNEK Blue War Hammer is a research tool that facilitates the exploration of Windows Defender's update mechanisms and potential vulnerabilities through sophisticated Windows API interactions. It is primarily aimed at security researchers and system administrators for educational purposes, implementing advanced features such as RPC communication, COM interfaces, VSS manipulation, and kernel-level file system operations. Notably, it allows for the extraction and analysis of Defender update packages directly from Microsoft, highlighting attack vectors associated with file access controls during the update process.

Sni5Gect is a comprehensive framework designed for sniffing unencrypted 5G NR messages and injecting custom packets during over-the-air communication between base stations and User Equipment (UE). It is primarily used for security research to conduct various attacks, such as crashing UE modems, downgrading network technologies, and implementing device fingerprinting and authentication bypass tactics. Notable features include the ability to capture MAC-NR messages and send arbitrary messages to target devices during specific communication states, enabling detailed exploitation of 5G networks.

SQLMap Skynet is an AI-assisted tool that enhances the SQLMap functionality by providing a structured, autonomous workflow for SQL injection testing, complemented by a real-time dashboard and MCP tool server for agent automation. Notable features include operational phases for detecting, bypassing, enumerating, and dumping vulnerabilities, as well as autonomous AI tuning and a memory system that learns from past successes to improve future scans. This tool is optimized for both Windows and Linux servers, operating in a headless mode without a GUI, making it suitable for automated security testing environments.

Sub-Ringan Framework is an automated bug hunting tool tailored for identifying vulnerabilities in web applications, primarily aimed at bug bounty hunters and cybersecurity professionals. Its notable features include comprehensive subdomain discovery, live URL scanning, detection of XSS, SSRF, SQL injection, and LFI vulnerabilities, along with the ability to efficiently organize target files for enhanced workflow.

sysnc is a bash wrapper around netcat designed for simplified remote command execution and interactive shell access, particularly on Android devices running Termux. Notably, it can exploit zygote injection (CVE-2024-31317) to establish a system-level shell, allowing for configurable command execution and interaction with a remote server. Key features include an interactive mode with a colored prompt, support for streaming scripts via stdin, and configurable options for host, port, and UID through command-line flags or environment variables.

The Wagon Site is a versatile web application that aggregates a variety of tools, including exploits, bookmarklets, games, and proxies. It serves as a centralized platform for users seeking easy access to these resources, emphasizing functionality through a bookmarklet for streamlined launching. Notable features include a diverse array of tools and a community-driven approach with a dedicated Discord channel for user engagement.

TowerOfFlaws is a proof-of-concept tool that demonstrates vulnerabilities in the anti-cheat driver (`GameDriverX64.sys`) of the game Tower of Fantasy, specifically related to arbitrary process protection and termination. The tool allows users to bypass protections and terminate processes like `notepad.exe`, showcasing the vulnerabilities in a controlled environment. It requires a C++20 compiler and CMake for building, and emphasizes responsible usage in authorized contexts.

VulnParse-Pin is a post-scan intelligence and decision support engine designed to transform vulnerability scan findings into a prioritized and explainable remediation plan, focusing on real-world exploitability rather than just severity scores. It reduces vulnerability noise by up to 94% by incorporating factors such as Known-Exploited Risk (CISA KEV), real-world exploitation probability (EPSS), and exploit availability from public databases, thereby enabling more effective risk management. Notable features include normalization of data, enriched scoring models, and customizable prioritization based on actual threat signals.

Vulristics is an extensible framework designed to analyze publicly available information on vulnerabilities, enabling classification and prioritization of CVEs using data sources such as Vulners.com, Microsoft, NVD, and AttackerKB. Initially developed for Microsoft Patch Tuesday reporting, it allows users to generate comprehensive reports for arbitrary CVE lists, custom profiles, and specific Microsoft Patch Tuesday events. Notable features include customizable report generation and integration of multiple vulnerability databases to facilitate a structured analysis process.

WordPress Malware is a collection of malware samples sourced from compromised WordPress websites, organized by the date they were discovered. The repository includes custom PHP functions commonly used for malicious actions, such as file modification and execution of PHP code. This tool serves as a resource for developing malware detection solutions and is utilized by associated cPanel plugins for scanning and mitigating malware threats.

WPAxFuzz is a comprehensive Wi-Fi fuzzing tool designed to test vulnerabilities in the 802.11 protocol's management, control, and data frames, as well as the SAE exchange for WPA3 networks. It features different operating modes for frame size manipulation, the ability to execute fuzz tests against any access point supporting WPA2 or WPA3, and includes a Denial of Service (DoS) attack module that leverages the results of fuzzing. The tool can be executed via a simple command line and requires pre-installed dependencies like Scapy and aircrack-ng for optimal functionality.

wphunter is a Python CLI tool designed for scanning WordPress plugins, themes, and core files for known CVE vulnerabilities, as well as detecting gambling spam injections (judol) and looking up public exploits. It operates both offline, using exported lists, and remotely via a URL, providing AI-powered analysis through Claude, including intelligent threat assessments and actionable remediation steps. Notable features include support for multiple vulnerability sources, comprehensive judol detection mechanisms, and version-aware matching to report relevant vulnerabilities based on the installed versions.

XNU Image Fuzzer is a tool designed for fuzz testing Apple image decoding and re-encoding processes within CoreGraphics and ImageIO. It leverages multiple input modes to generate and parse images through various consumers, providing features such as bitmap-context permutations, ICC profile manipulation, and detailed metrics logging. The framework supports both native execution and deployment within Xcode for comprehensive testing and analysis of image handling on macOS and iOS platforms.

Zenith-Basic-RAT is a remote access tool (RAT) that operates through Discord, facilitating a range of post-exploitation actions with over 20 modules including system information retrieval, file management, and user monitoring. It is designed for educational purposes and features customizable executable names and session management to enhance stealth and functionality. Notable capabilities include password extraction, screen blocking, and the ability to execute commands remotely on the victim's machine.

Bash is a collection of Bash scripts designed primarily for use by Red Teamers to facilitate offensive security tasks and simplify common operations in a Linux environment. Key features include various exploit scripts targeting vulnerabilities such as CVE-2014-6271 (ShellShock) and CVE-2006-3392 for remote file disclosure, as well as utility scripts for obtaining system information and performing network reconnaissance. The toolset is easily installable via standard Linux practices, promoting accessibility and efficiency for cybersecurity professionals.

BlueSploit is a comprehensive Bluetooth framework targeting both Classic BR/EDR and BLE communication, featuring 160 modules for various purposes including exploits, denial of service, and reconnaissance. Its notable capabilities include persistent state storage, advanced scanning for Bluetooth devices and key exchange mechanisms, as well as support for AES-128 cryptography and mesh networking protocols. The tool is designed for authorized testing and enables users to engage interactively through a REPL interface, managing attacks and reconnaissance tasks efficiently.

BrowserSnatch is an offensive-security tool designed for authorized penetration testing that extracts and decrypts sensitive data from over 40 web browsers, including both Chromium and Gecko-based platforms. Notable features include the ability to retrieve stored passwords, cookies, bookmarks, and browsing history, as well as support for app-bound encrypted data, all optimized for high performance with minimal dependencies. The tool serves red teams in demonstrating the impact of endpoint compromise and aids blue teams in improving detection tactics against browser data theft.

BUSted is a repository designed for conducting microarchitectural side-channel attacks on MCU bus interconnects, specifically targeting the Smart Lock application as a proof of concept. It consolidates tools and scripts for measuring covert-channel capacities, along with the firmware and hardware configurations necessary for replicating the attack on STM32 devices. Notable features include a script for automated measurement of channel capacity and tools for visualizing the channel matrix.

Bypass Url Parser is a specialized tool designed to test various URL bypass techniques against 40X protected pages, utilizing `curl` as its backend for raw request handling. It allows users to send unencoded URLs and includes features such as custom header support, proxy integration, and configurable output options, making it suitable for security assessments and web application testing. The tool can be used as a standalone application or integrated as a library, providing flexibility for different user needs.

camera-hack is a tool designed for gaining control over Yoosee/Jortan IP cameras using a UART serial connection facilitated by an Arduino device. The primary use case involves leveraging the tool to access and manage camera features via Telnet after establishing a connection. Notable features include straightforward setup instructions, compatibility with multiple operating systems, and community support for troubleshooting and contributions.

This repository provides a suite of custom tools and research materials focused on vulnerability assessment of Wansview Wi-Fi cameras and the AJCloud IoT device management platform. The primary use case is to facilitate security research and exploit development for these devices. Notable features include collected data, research notes, and insights shared from presentations at DEF CON 32.

Copy Fail is a cross-platform implementation in C of the Copy Fail Linux Local Privilege Escalation (LPE) exploit (CVE-2026-31431), designed to demonstrate the vulnerability on various architectures without relying on per-architecture hex blobs or inline assembly. The tool includes multiple variants for payload delivery, such as a binary-mutation dropper and a variant that modifies the `/etc/passwd` file, as well as a non-destructive vulnerability checker. It requires no additional libraries and supports extensive architecture compatibility through the included nolibc.

CR4SH3R is a vulnerability scanner specifically engineered to identify Arbitrary File Download flaws in WordPress plugins by scanning for sensitive data exposure through common file paths. It features multi-threaded scanning for efficiency, smart data extraction capabilities, and provides organized reports in XLSX format, all presented through a user-friendly GUI. Notably, the tool allows users to extend its payloads for enhanced detection and supports customized scanning configurations.

Cryptolocker is an open-source encryption tool developed in Visual C++ that employs a robust 256-bit AES encryption algorithm to secure files, rendering them unreadable without a password. Its primary use case involves encrypting files across system drives while providing features such as a multi-threaded encryption process for efficiency, lockdown functionality to restrict system access, and a web admin interface for management. This tool is intended solely for educational purposes and emphasizes user responsibility regarding legal usage.

CVE-2022-23093 is a cybersecurity tool designed to exploit a stack-based buffer overflow vulnerability in the FreeBSD ping utility, which results from improper handling of IP option headers during ICMP response processing. Its primary use case is to demonstrate the ability to execute arbitrary shellcode through crafted ICMP packets that trigger the overflow. Notable features include the ability to customize the shellcode as well as the detailed technical analysis of the vulnerability's mechanics and its impact on system integrity.

CVE-2022-26265 is a Python-based tool designed to exploit a Remote Code Execution vulnerability in Contao CMS version 1.5.0. Users can specify target servers from a list file and execute arbitrary commands, making it useful for security assessments and penetration testing of affected installations. Notable features include the ability to handle multiple targets and customizable command execution through a straightforward command-line interface.

CVE-2023-32315-EXPLOIT is a proof-of-concept tool designed to exploit a severe authentication bypass vulnerability in the Openfire real-time collaboration server's administrative console. It demonstrates how an attacker can leverage a path traversal flaw coupled with improper URL encoding handling to gain unauthorized access to admin-only pages. Notably, the exploit addresses a critical security issue affecting Openfire versions released after April 2015, specifically exploiting weaknesses in URL wildcards and path traversal protections.

CVE-2025-32463 is a Go-based exploit tool designed to exploit a critical local privilege escalation vulnerability in sudo versions 1.9.14 to 1.9.17. The tool manipulates the `--chroot` option to load a malicious shared library, allowing unauthorized users to gain root access. Notable features include the ability to run the exploit in both normal and silent modes, and it supports building from source or using a pre-built binary.

CVE-2026-24061-PoC is a proof-of-concept tool designed to demonstrate the exploitation of a critical vulnerability in telnetd from GNU Inetutils, enabling remote attackers to bypass authentication and achieve root access. This tool requires Python 3.4+ and can target hosts by specifying an address through a text file or command line interface. It exploits improper handling of the USER environment variable, injecting command-line options to gain unauthorized access.

The CVE-2026-48909 tool identifies and exploits a critical Remote Code Execution vulnerability via PHP Object Injection in the JoomShaper SP LMS extension for Joomla versions ≤ 4.1.3. Notable features include a proof of concept script for detecting the vulnerability and an exploit script that allows an attacker to write PHP code to the server, requiring no authentication. The tool also details the underlying mechanics of the vulnerability and provides mitigation advice for affected systems.

CVE-2026-57827 is a high-severity vulnerability within the RSFiles! component for Joomla, allowing unauthenticated arbitrary file uploads due to a split-controller design flaw. The vulnerability permits attackers to bypass critical security checks and directly write malicious files to the server, resulting in remote code execution without any authentication or CSRF protections. Notably, the exploit allows attackers to upload any file type and store it in a default web-accessible directory, significantly compromising the security of affected Joomla installations.

CVE-2026-PoCs is a curated repository providing a centralized collection of verified proof-of-concept exploits for vulnerabilities disclosed in the year 2026. Its primary use case is to serve security researchers and practitioners by offering a well-organized index of CVEs, complete with consistent metadata and a clear contribution process. Notable features include detailed listings of specific CVEs, affected products, and statuses of exploits, addressing the common issue of fragmented information across various platforms.

CVE-Intel is a vulnerability intelligence platform that aggregates and correlates data from GitHub CVE-tagged repositories, the National Vulnerability Database (NVD), and cybersecurity news feeds. It is aimed at security researchers, blue teams, and integrators, providing a public API and frontend to access and analyze enriched CVE information. Notable features include a robust data ingestion pipeline, real-time news updates, and an interface for querying vulnerability details with pagination and filtering capabilities.

The CVEs repository catalogs vulnerabilities reported by the author, each assigned a CVE identifier. It provides detailed write-ups and proof-of-concept (PoC) exploits for various software vulnerabilities, facilitating research and reproduction. Noteworthy features include the inclusion of vulnerable software copies in certain folders for in-depth analysis.

The Cyber Threat Intelligence tool provides comprehensive analysis of ongoing activities and research by advanced persistent threat (APT) actors, leveraging broad monitoring of exploit markets, social media, and vulnerability discussions. Its key features include geopolitical analysis, a wide array of indicators such as IOCs and TTPs, and predictive capabilities powered by an AI-based system to forecast potential attacks. This enables organizations to proactively prepare for and mitigate cybersecurity threats.

Darknet-mcp-server is a comprehensive tool designed for aggregating dark web and threat intelligence specifically for AI agents. It consolidates data from multiple sources, including HIBP, ThreatFox, ransomware tracking, and blockchain intelligence, into a unified server that allows for on-demand access to a wide array of threat data. Notable features include support for .onion access, malware analysis capabilities, and an array of tools and data sources to streamline dark web intelligence gathering and analysis.

The DEFCON-33 repository provides insights and resources on exploiting vulnerabilities found in Tuoshi and Kuwfi 5G & LTE routers, detailing CVE discoveries and offering practical exploitation demonstrations. Its primary use case is to educate security professionals and researchers on the security weaknesses of these devices, while notable features include comprehensive vendor analysis and connections to related works in the field of cybersecurity.

Duolingo Max is a browser extension designed to modify the Duolingo website to provide unlimited hearts for users, thereby enhancing the learning experience without the limitations imposed by the platform. It supports both Chrome and Firefox, offering a straightforward installation process alongside a userscript option for mobile Safari, allowing for broad accessibility. Key features include access to specific domains for patching the Duolingo site, storage for user settings, and version synchronization capabilities for updates.

The EAC Bypass + CR3 Ready IOCTL tool is a specialized driver designed to facilitate undetected communication and callback handling through IOCTL, primarily aimed at circumventing anti-cheat mechanisms. It serves as a foundational framework, allowing users to control CR3 and IOCTL communication between driver and user mode, while leaving advanced functionalities, such as handle randomization and user mode hiding, to the user's discretion. Notable features include a basis for EPROCESS bypass and miscellaneous system manipulations, emphasizing the need for user customization to complete the implementation.

Erebos-Zero is a personal arsenal for malware development featuring sophisticated techniques for evasion and injection. It includes a variety of exploitation methods such as shellcode injection, DLL injection, and process manipulation, along with advanced anti-forensics and evasion techniques tailored for bypassing endpoint detection and response systems. This tool is primarily intended for research and educational purposes, focusing on the creation and deployment of stealthy malicious payloads.

EVM Hack Analyzer is a static, in-browser tool designed for debugging EVM exploits by replaying specific transactions and analyzing their behavior within a forked chain state. Users can visualize opcode execution, keep track of storage and memory changes, and annotate vulnerabilities step-by-step, providing a comprehensive mapping from bytecode to source lines. The tool also allows users to share findings through download options or decentralized IPFS links, facilitating collaboration and community contributions through organized proof-of-concept archives.

The EVM Hack Registry is a comprehensive archive of hundreds of DeFi/EVM exploit proof-of-concepts (PoCs) designed for offline execution across multiple blockchain networks from 2017 to 2026. Each exploit is encapsulated within a standalone Foundry project, complete with on-chain contract source code, a local block-state snapshot, and detailed AI-generated documentation, enabling reproducibility without reliance on external RPC nodes. This tool aims to simplify the study and analysis of blockchain vulnerabilities, addressing common accessibility issues found in existing DeFi hack resources.

The Exim RCE (CVE-2018-6789) Learning Environment provides a structured setup for users to investigate and debug the Exim mail transfer agent, focusing on the Remote Code Execution vulnerability. Primarily intended for academic purposes, this tool includes a Vagrant configuration that enables users to deploy a Fedora VM pre-configured for testing, along with Docker integration to run Exim in a controlled environment. Notable features include the ability to customize the VM's resource allocation, disable ASLR for consistent debugging, and access to scripts that facilitate the setup of the environment and execution of exploits.

ExploitDB-Hunter is a command-line tool designed to streamline the process of searching for and downloading exploits from the Exploit-DB website. Its primary use case is to facilitate quicker access to relevant exploits by allowing users to search via CVE IDs or titles, adjust result parameters, and choose exploit types and platforms interactively, thus reducing the need for manual browsing. Notable features include customizable search options, downloading capabilities, and an intuitive terminal interface.

ExploitFlow (EF) is a modular library designed to create cybersecurity exploitation routes, known as exploit flows, by combining and composing exploits from various sources and frameworks. Its primary use case is to facilitate research in Game Theory and AI within the cybersecurity domain through a structured representation of actions and system states. Notable features include its extensibility with adapters for other exploitation frameworks and a design syntax inspired by TensorFlow, allowing for seamless integration and experimentation.

The Fuzz Corpus repository provides a comprehensive collection of curated malicious-input samples for security testing, focusing on various injection types and CVE proof-of-concepts (PoCs). Notable features include support for ICC profiles, malformed graphics, and web injection signatures, which can be integrated into fuzzing workflows for validating security tools. The repository also categorizes inputs by purpose, facilitating targeted testing against specific vulnerabilities in different environments and platforms.

GEF-Extras is an augmentation of the GDB Enhanced Features (GEF) framework, providing users with additional scripts and structures to enhance their debugging experience in GDB. It facilitates easy installation and integration with GEF, and is accompanied by comprehensive documentation to assist users in utilizing its capabilities effectively. Notable features include seamless installation via a simple command and ongoing community support through Discord.

The h4cker repository is a meticulously curated collection of cybersecurity resources, tools, scripts, and training materials, aimed at supporting various aspects of cybersecurity, including offensive and defensive strategies, cloud security, and AI security. Notable features include a structured taxonomy for easy navigation across different cybersecurity domains, dedicated sections for certifications and lab-building, and organized training references and resources. This repository serves as a valuable supplemental resource for professionals seeking to enhance their knowledge and skills in cybersecurity.

HashDump-BypassEDR is a tool designed to circumvent Endpoint Detection and Response (EDR) solutions by utilizing the `reg.exe` command to export critical registry information, enabling the dumping of password hashes from Windows systems. Its notable features include the ability to operate with minimal permissions on certain Windows versions, alongside an effective method for retrieving the BootKey necessary for the process without detection by most antivirus software. The tool's practicality is underscored by its testing across various Windows environments, showcasing its robustness in real-world applications.

The haval-app-tool-multimidia project is an unofficial educational tool designed for reverse engineering the Haval GWM multimedia system. Its primary use case is to facilitate learning and exploration of the system's architecture and functionality without any commercial intent. Notable features include detailed documentation for understanding the inner workings and guidance on extending the tool's capabilities.

Hell's Hollow is a rootkit technique specifically designed for Windows 11 that enables effective SSDT hooking by exploiting an undocumented Alternate Syscall handler mechanism. This tool allows users to manipulate system calls at the kernel level, enabling alteration of return values and system call arguments while bypassing existing defense mechanisms like HVCI. Notable features include its compatibility with Rust for driver development and the ability to hook and modify any specified system service number (SSN), making it a versatile tool for advanced kernel manipulation techniques.

IrisC2 is a command and control (C2) framework designed for authorized security testing, red team exercises, and internal research. It features a modular architecture comprising a Client for user interaction, a Server for managing communication and tasks, Beacons for executing commands within target environments, and a Stager for handling staged payloads. Notable capabilities include multi-platform support, advanced task scheduling, plugin integration for extended actions, and comprehensive event synchronization.

KittySploit is a modular offensive security framework and C2 platform designed for penetration testers, researchers, and red teams. It consolidates security workflows into a single console, featuring capabilities for target scanning, engagement organization, module execution, and AI-assisted testing plan generation, alongside built-in command and control functionalities. Notable features include an extensible architecture, automation readiness, and an array of integrated tools for reconnaissance, exploitation, and traffic analysis.

The Linux LPE Toolkit is a multi-architecture privilege escalation tool designed to identify and exploit vulnerabilities to gain root access on Linux systems. It includes 24 pre-built exploits for various architectures, automatically detects kernel versions, filters out patched exploits, and attempts each exploit until root access is achieved. Notable features include a dry-run mode for planning, command execution upon successful exploitation, and options for verbose or silent output during exploitation.

The malleable-signatures repository provides a proof of concept (PoC) that demonstrates signature malleability attacks using compact signatures within the Ethereum ecosystem. It highlights vulnerabilities in OpenZeppelin’s ECDSA library version 4.6 that are exploitable through signature malleability, emphasizing the necessity to avoid using signatures as unique identifiers due to their inherent non-uniqueness. Key features include showcasing the vulnerability and its remediation in later library versions, along with a detailed explanation of the underlying cryptographic principles involved.

MikrotikAPI-BF is a comprehensive RouterOS attack and exploitation framework designed for conducting automated security audits, brute-force credential attacks, and exploiting vulnerabilities in Mikrotik routers. Its notable features include a robust exploit engine with coverage for over 100 CVEs, multiple attack vectors such as REST API, SSH, and MAC-Telnet, as well as threading capabilities for multi-target scans. The tool also supports offline credential decoding and unique capabilities like MAC-Server Layer-2 discovery for devices without IP addresses.

Osiris-Jailbreak is an experimental jailbreak tool for iOS devices running versions 11.2 to 11.3.1, intended solely for developers to explore the jailbreaking process. Key features include the execution of the multi_path exploit (CVE-2018-4241), granting kernel task permissions, enabling remote terminal access, and bypassing certain security measures like the Sandbox and AMFI. However, the tool is still in development, lacks essential features like Cydia support, and is not recommended for general users due to its potential instability and incomplete functionality.

PatrowlHearsData is an open-source data repository and scraping tool designed for the collection of vulnerability intelligence, including CVE, CPE, CWE, and exploit references. It facilitates security operations by providing real-time updates and orchestrating threat intelligence feeds, making it suitable for organizations looking to enhance their cybersecurity posture with comprehensive vulnerability insights. Notable features include scalability, a user-friendly installation process, and the option for professional support through a paid Pro Edition.

The poc-archive is a structured repository for security research proof-of-concepts (POCs), organized by categories such as web, network, binary, and more. It features detailed metadata, reproduction steps, and references for each POC, facilitating knowledge sharing and education within authorized security research contexts. Notable features include automated indexing, interactive POC scaffolding scripts, and a template system for contributing new entries.

The "PoC in GitHub" repository offers proof-of-concept (PoC) exploits for multiple Common Vulnerabilities and Exposures (CVEs) identified in various software components, highlighting potential local and remote privilege escalation vulnerabilities. Each listed CVE includes a brief description of the vulnerability's nature, links to associated exploits, and demonstrates the ease of exploitation without requiring user interaction. This repository serves as a resource for security researchers and developers to understand vulnerabilities and test their systems against known exploits.

Puncia is a command-line interface (CLI) tool designed for comprehensive subdomain mapping and vulnerability monitoring through its integration with the Subdomain Center and Exploit Observer APIs. Its primary use case includes assessing external attack surfaces, enabling advanced vulnerability research, and facilitating automated intelligence gathering for CI/CD pipelines. Notable features include contextual enrichment of vulnerability data, bulk processing capabilities, and stealthy reconnaissance for red teams, making it an essential utility for cybersecurity professionals.

pwn.hs is a Haskell library designed for exploitation development and reverse engineering tasks. Its primary use case is to facilitate the creation and manipulation of data structures commonly encountered in security research. Notable features include comprehensive examples demonstrating its functionality and customization for various exploit scenarios.

pwninit.py is a specialized tool for configuring Capture The Flag (CTF) pwn challenges by automating the setup of binaries with their required runtime environments. It features downloading appropriate interpreters and glibc libraries, applying patches for compatibility, generating customizable solve scripts, and fetching glibc source code for enhanced debugging. The tool supports manual patching by default to avoid potential issues during exploitation, making it particularly useful for cybersecurity practitioners working on binary exploitation challenges.

Pwntools is a robust CTF framework and exploit development library written in Python, designed to facilitate rapid prototyping and ease of exploit creation. Notable features include support for various architectures, seamless interaction with remote services, and a set of built-in tools that streamline both exploitation and challenge solving. The library caters primarily to Capture The Flag (CTF) competitions, simplifying the process of developing and executing exploits.

The Qualcomm GBL Exploit PoC tool facilitates the unlocking of bootloaders on Qualcomm devices through a specific exploit. Its primary use case is to enable users to install custom software, recover locked devices, or troubleshoot advanced issues, all without requiring programming knowledge. Notable features include a straightforward graphical interface for running the unlocking process and compatibility with various Qualcomm devices, operational on Windows systems.

Red Devils Rat Premium is an advanced remote administration tool (RAT) designed for comprehensive device management and surveillance. Its primary use case is to facilitate remote access and control over Android devices, offering features such as call and SMS monitoring, live screen streaming, location tracking, and remote control functionalities. Notable features include an admin panel for easy management, an APK crypter for secure app distribution, and the ability to execute commands remotely, providing a robust solution for unauthorized monitoring.

Awesome Security & Hacking is a comprehensive resource for ethical hacking, focusing on penetration testing, vulnerability scanning, and exploit development. The repository offers a collection of tools, scripts, and hands-on labs categorized across various domains such as network security, web application security, and cryptography, making it suitable for both beginners and advanced practitioners. Notable features include structured content on specialized areas like bug bounty and wargames, as well as community engagement through contributions and feedback channels.

SideInstaller is an open-source iOS application designed to facilitate the installation of SideStore and LiveContainer directly on iPhones without the need for a PC. It simplifies the sideloading process by handling pairing, provisioning, and installation on-device, allowing users to easily sideload applications while ensuring their Apple credentials remain private and secure. Notable features include a user-friendly interface, local data handling with no online transmission, and transparency through its open-source code, providing full auditability.

SkillArch is a customizable installation tool designed for setting up an i3 window manager environment atop KDE Plasma, targeting both lightweight and full-feature installations. Its primary use case is to streamline the setup process for users by providing straightforward commands for installing various components, including CLI tools, security applications, and GUI utilities. Notable features include automatic updates, an interactive merging process for upstream changes, and extensive documentation with video tutorials.

SlopBro is a proof-of-concept exploit designed to leverage the jsserver vulnerability in LG TVs running webOS versions 5 to 10. It operates by starting an HTTP server to deliver an exploit page and payloads, establishing an SSAP connection with the target TV, and executing a rogue package with root privileges, allowing for potential persistence and the installation of additional software like the Homebrew Channel. Notable features include compatibility across Python 2.7 and 3.x, minimal dependency requirements, and options for debugging and asset source specification.

PySlowLoris is a Python-based tool designed for testing a web server's vulnerability to slow request attacks by maintaining numerous open connections and sending malformed headers. It utilizes asynchronous I/O for efficient connection handling, offers user-friendly command line and Python API interfaces, and is packaged for easy installation via PyPI or Docker. Notably, users can specify the number of connections and run the tool in a silent mode to focus on attack simulation without cluttering the output.

Spellbook is a micro-framework designed for the rapid development of reusable security tools using a flow-based programming (FBP) paradigm. It allows users to create and utilize various security modules, such as exploit testing and advisory lookups, through a command-line interface that supports operations like module searching and execution. Notable features include its ability to handle multiple exploit modules and a Docker integration for containerized deployment.

SploitTest is a testing application designed to determine if iOS devices running versions 15.0 to 15.4 beta 3 are vulnerable to a specific kernel vulnerability exploited for local privilege escalation. By executing the proof of concept (PoC), users can identify if their device can be subjected to jailbreaking, with the indication of vulnerability shown by a device reboot after running the application. The tool is notable for its straightforward usage and direct applicability to iOS security assessments.

Termius Exporter is a tool designed to extract user data from the Termius SSH client, which has restricted export capabilities. Its primary use case is to liberate hosts, credentials, and keys, particularly for post-exploitation scenarios, by retrieving information such as saved SSH hosts, private keys, and command snippets. Notable features include its reliance on XSalsa20-Poly1305 encryption for data handling and the ability to output extracted data in structured CSV files.

TGtoJSON-2026 is a tool designed for converting Telegram's native session tdata files to JSON format, enabling compatibility with Telegram Prime and similar clients. Its notable features include the ability to convert JSON back to tdata format, with support specifically for the Pyrogram library.

tinf0il is a high-performance proxy portal that facilitates private browsing, streaming, and gaming through a combination of Scramjet proxy technology and libcurl transport. Its notable features include tab cloaking, stealth routing, a game and app catalog, and a comprehensive streaming interface for movies and TV shows with real-time sports event tracking. The platform also emphasizes privacy, with zero logs and customizable user preferences.

ttyinject-rs is a tool that exploits the `TIOCSTI` ioctl in the Linux kernel to inject keystrokes into a terminal, allowing a non-privileged user to gain root privileges when the root user executes `su - user`. Notable features include its easy integration with a user's `~/.bashrc`, its self-deleting behavior post-execution, and compatibility with specific Linux kernel configurations. It serves primarily as a demonstration of an exploit for educational purposes.

WP-Scanner is an advanced vulnerability scanner and exploitation framework specifically designed for WordPress, capable of identifying 75 CVEs across core, plugins, and themes. Its notable features include comprehensive fingerprinting, active exploitation capabilities with 36 exploit handlers, and mass scanning with thread-safe execution. The tool supports HTML and Markdown report generation and includes automatic updates for both the tool and its vulnerability database.

AgentSeal is a comprehensive security toolkit designed for AI agents, providing robust capabilities such as detection of malicious configurations, tracing toxic data flows, and scanning for potential supply chain vulnerabilities across various agents. It features an extensive pipeline for local scanning, real-time monitoring, and auditing of machine configurations without the need for API keys, alongside the ability to test against 225+ adversarial prompts. Notable functionalities include the `guard` command for scanning and assessing the security of agent configurations and the option to create organization-specific policies through custom rule sets.

Awesome Offensive MCP is a curated collection of Model Context Protocol servers designed for Red Teaming, Pentesting, and Vulnerability Research, enabling users to seamlessly integrate Agentic AI into their offensive security workflows. The tool supports various tasks such as running Nmap scans, analyzing Ghidra decompilations, and querying Shodan—all through natural language commands within a unified conversation context. It emphasizes safety and compliance, encouraging users to audit the code of the MCP servers before deployment.

Awesomenmap is a comprehensive knowledge base dedicated to Nmap, providing a centralized repository for essential Nmap NSE scripts, CVE search tools, and automated reconnaissance pipelines. It streamlines access for security analysts, pentesters, and blue teams, featuring organized references and integration of third-party scripts to ensure they are current. Notable features include post-scan reporting capabilities and visualizations for enhanced security assessments.

Basilisk is an open-source AI red teaming framework designed for automated adversarial prompt testing against various large language models (LLMs) such as Claude and GPT-family models. It features evolutionary prompt search, structured attack modules, and a real-time scan dashboard, enabling security researchers and penetration testers to conduct repeatable and comprehensive security assessments of LLM applications. Notable capabilities include differential mode comparisons across multiple model providers, guardrail posture scanning, and the ability to export test results in various formats.

BenchJack is a vulnerability scanner designed to assess whether AI benchmarks can be manipulated, highlighting weaknesses before adversarial agents can exploit them. It employs a multi-phase audit process that combines static analysis tools with AI-driven deep inspection, categorizing vulnerabilities into eight distinct classes and providing real-time results via a web dashboard. Notable features include proof-of-concept exploit code generation and future integration of Docker sandboxing for enhanced security during analysis.

Bulwark is an organizational asset and vulnerability management tool that integrates with Jira for generating application security reports. Its notable features include multi-client vulnerability management, security report generation, team-based roles authorization, and API key management. Designed for early-stage development, it offers a user-friendly interface for managing security tasks and facilitating team collaboration.

Cervantes is an open-source, collaborative platform tailored for penetration testers and red teams, serving as a comprehensive management tool for organizing projects, vulnerabilities, and reports in a centralized location. It enhances operational efficiency by providing features such as team collaboration, OWASP compliance reports, built-in dashboards, and one-click report generation. Designed to be multiplatform and multilanguage, Cervantes streamlines penetration testing activities, significantly reducing coordination time and effort.

LongLogon is a non-destructive precondition checker for the CVE-2026-41089 vulnerability, which is a stack buffer overflow affecting the Windows Netlogon service. It operates without authentication and does not exploit the vulnerability; instead, it sends benign CLDAP pings to determine if a domain controller's DNS domain name is sufficiently long to trigger a crash. This tool provides a reliable mechanism for security assessments by validating the conditions necessary for the vulnerability without the risks associated with executing an exploit.

CyberMind CLI v6.0 is a powerful AI-driven offensive security tool designed for a diverse range of users including bug bounty hunters, red teamers, penetration testers, and security researchers. It offers 22 autonomous attack modes, a unique OMEGA brain orchestration feature, and support for exploiting Web3, mobile, and cloud environments, while integrating seamlessly with Kali tools. Key features include manual and automated execution options, real-time alerting via Telegram, and a VSCode extension for enhanced usability.

The Educational Cybersecurity Tools repository serves as a comprehensive catalog of over 150 tools aimed at ethical hacking, penetration testing, and cybersecurity education. It encompasses various categories including network scanning, vulnerability assessment, and malware analysis, while emphasizing that all tools are intended for educational purposes only and may not be used for unauthorized access to systems. Noteworthy features include detailed tool descriptions, an extensive list of categories, and a focus on promoting ethical standards in cybersecurity practices.

The EternalHush Framework is an advanced command and control (C&C) platform designed specifically for Windows systems, enabling users to extend its functionality through a Python API for plugin development. Notable features include an intuitive GUI, integration capabilities for external modules, and a variety of built-in implant functionalities such as TCP/HTTP(S) connections and reflective DLL loading, all aimed at facilitating data collection and interaction with infected systems. This open-source project is currently in early development and seeks community collaboration for enhancements.

The "exploits" repository serves as a comprehensive security research and exploit development toolkit, focusing on browser vulnerabilities, post-exploitation techniques, and cloud identity attacks. It features organized content around CVE reproductions, offensive tooling with detection guidance, and written assessment deliverables, all designed for educational use and authorized security testing. Notably, it includes a contained Docker lab environment for safe execution and testing of exploit scenarios without internet access, ensuring a secure and isolated workspace for enterprise assessments.

GhostLock is a research tool designed to demonstrate the potential for ransomware-equivalent availability impacts on SMB shares by utilizing file-level and directory-level locking techniques without writing or encrypting data. It enables low-privileged Windows domain users to effectively lock files or entire directories, rendering them operationally invisible while maintaining read access at known paths, thus bypassing traditional security measures with no detectable writes or anomalies. Notable features include a 32-thread parallel scanner for file locking and a single handle directory lock method, making it a significant concern for SMB-based environments.

Harpoon is an autonomous black-box penetration testing tool designed for web applications, optimized for use on Kali Linux but capable of running on other Debian-based distributions and WSL. It orchestrates and integrates various existing security scanners, streamlining the process of vulnerability discovery by normalizing outputs into a relational SQLite model and providing comprehensive reporting, including HTML reports and PoC artifacts. Notable features include asynchronous execution, WAF-awareness, and extensive automated phases covering everything from DNS reconnaissance to validation of findings.

Huntbot is a multi-model offensive security tool designed for bug bounty hunting, penetration testing, and red teaming, offering advanced capabilities for vulnerability detection and reporting. Notable features include contextual knowledge accumulation, human-like interaction with web applications, the ability to share live browser sessions, and meticulous false positive validation before report generation. It is extensible with multiple AI models and allows for dynamic steering during runs, enabling security professionals to efficiently explore and validate security vulnerabilities.

LLAMATOR is a Python-based framework designed for Red Teaming, enabling security professionals to conduct penetration testing on chatbots and Generative AI systems. Its notable features include support for custom attacks, compatibility with multiple chat client configurations, and comprehensive reporting capabilities in various formats, making it suitable for assessing vulnerabilities such as prompt injection and misinformation.

LLMtary is an AI-powered penetration testing platform designed for security professionals, facilitating an autonomous workflow from reconnaissance to exploit validation and report generation. It integrates large language model intelligence to conduct a comprehensive examination of targets, capable of operating entirely offline with local models or utilizing cloud-based AI for improved accuracy. Key features include a structured testing loop, multi-phase enrichment for targeted vulnerabilities, and native support across major operating systems, ensuring a streamlined and efficient penetration testing experience.

Mythos Research Edition is an open-source tool designed for vulnerability discovery in software applications, utilizing the publicly available Claude Opus 4.7 model to replicate the eight-phase scaffold of Anthropic's Mythos Preview. It enables open-source maintainers, security researchers, and academics to conduct targeted scans at a low cost, facilitating coordinated vulnerability disclosure while avoiding unauthorized mass scanning. Key features include self-scanning capabilities for project audits and research, without requiring access to Anthropic's proprietary model.

NetCrawler is an AI-driven reconnaissance and vulnerability scanning tool that utilizes a local Ollama LLM to automate the scanning process. It intelligently selects and executes various reconnaissance modules such as subdomain enumeration, web fingerprinting, and vulnerability scanning, while generating structured reports in both Markdown and JSON formats. Notable features include a terminal-based user interface, iteration through an observation-think-act cycle, and the capability to integrate additional modules seamlessly.

numasec is an AI-driven security agent that enhances terminal-based workflows by integrating existing tools and methodologies for security operations. It facilitates tracking findings, documenting evidence, and generating reports while adhering to security runbooks, making it well-suited for Application Security (AppSec) and penetration testing workflows. With numasec, security professionals can streamline their processes and maintain operational context within a familiar environment rather than depending on separate chatbots or scanners.

Phantom is an autonomous AI-driven penetration testing platform designed to perform detailed reconnaissance and exploit vulnerabilities without human intervention. Integrating over 30 professional security tools within a secure Docker environment, it leverages a reasoning loop to adaptively select and execute multi-step attack vectors, producing verified findings complete with proof-of-concept scripts. Unlike traditional scanners that rely on static CVE signatures, Phantom delivers a comprehensive and accurate vulnerability assessment with real-time adaptability and detailed reporting aligned with the MITRE ATT&CK framework.

ThreatSwarm is a comprehensive penetration testing tool that utilizes 27 AI agents to execute the entire kill chain—from reconnaissance to exploitation, post-exploitation, digital forensics, and reporting—streamlined into a single command interface. It enforces strict scope limitations via `scope_check.py`, ensuring compliance with authorized testing parameters, while leveraging a library of 754 MITRE-mapped skills to guide its operations. Notably, it operates as a Claude Code plugin, eliminating the need for additional infrastructure like Docker or cloud accounts, and outputs detailed vulnerability reports with CVSS scoring.

Akira is an AI-powered penetration testing tool designed to operate natively within various environments, including Claude Code and Gemini CLI. It specializes in identifying vulnerabilities that traditional scanners may overlook, such as logic flaws and cryptographic weaknesses, by integrating a structured reasoning system that demands reproducible evidence for each finding. Notable features include a robust technique library, a Bayesian hypothesis engine, and the ability to handle complex attack vectors through a systematic engagement and reporting workflow.

Beatrix Suite is a command-line bug bounty hunting framework designed to streamline the entire pentesting workflow by integrating 32 scanner modules and 22 external tools. It features a 7-phase Kill Chain methodology, automated login and session management, and an AI-assisted pentester (GHOST) for advanced analysis, making it suitable for scanning domains, URLs, and IP addresses efficiently in headless environments. This tool aims to eliminate the fragmentation of traditional bug bounty tools by providing a single-command interface that orchestrates multiple tools throughout the assessment process.

CatchClaw v5.3.0 is a multi-platform AI Agent security assessment tool that supports nine different AI platforms including OpenClaw and Dify. It features 78 DAG attack chains and exploit modules that cover a full range of attack vectors from reconnaissance to data leakage, utilizing an asynchronous Tokio engine for concurrent execution while offering visual attack graph exports and customizable reporting options. The tool is designed to facilitate automated vulnerability verification and threat modeling within complex multi-agent environments, restricted to non-commercial use only.

The Cloud Security Toolkit is a comprehensive resource designed for offensive security practitioners focused on cloud environments, facilitating the exploitation of vulnerabilities and simulating advanced attacks specifically within platforms like Azure, AWS, and Microsoft 365. Notable features include a collection of weaponized exploits, deep-dive vulnerability research, threat intelligence insights, and evasion techniques targeted at cloud defense systems, all aimed at enhancing red team operations and improving cloud security assessments. This toolkit provides practical, battle-tested resources essential for sophisticated penetration testing and incident response in cloud ecosystems.

Cyber Agent is an AI-driven penetration testing tool utilizing Claude Code agents to automate the entire penetration testing process, making it particularly suitable for HackTheBox challenges and authorized security assessments. Notable features include automated attack execution which encompasses reconnaissance, exploitation, and privilege escalation, as well as professional report generation adhering to the Penetration Testing Execution Standard (PTES) and mapping to the MITRE ATT&CK framework.

CyberInject is a professional browser extension toolkit focused on authorized security testing and penetration testing activities. It offers quick access to a diverse range of security payloads categorized into vulnerabilities such as XSS, SQL Injection, SSRF, and LFI, alongside features like one-click copying and an organized, user-friendly interface. Designed for compliance with legal standards, it ensures that users can efficiently execute their testing tasks while promoting responsible usage.

DLLHijackHunter is an automated detection tool designed for identifying, validating, and confirming DLL hijacking opportunities on Windows systems. It employs a multi-phase approach that includes discovery of exploitable binaries, filtration of false positives, and the deployment of a harmless canary DLL for verification, providing a comprehensive scoring and reporting mechanism. Notable features include extensive coverage of various hijack types, UAC bypass discovery, and a focus on corroborating potential attack paths with actionable intelligence.

Gideon is an autonomous cybersecurity operations agent designed for intelligent threat analysis and red teaming. It automates the process of gathering intelligence and conducting thorough security research by breaking down complex questions into actionable tasks, utilizing real-time data from various sources. Notable features include dual-mode operation for both defensive and offensive engagements, goal-directed autonomy, and an evidence-based approach to generating actionable security insights.

Pentest-ai is an AI-powered penetration testing tool designed to enhance the verification of security findings by re-running exploits to confirm their validity, ensuring that each piece of evidence is backed by reproducible results. It streamlines the verification process by generating multi-step attack paths and providing a reporting mechanism that only includes findings validated by its oracle system, achieving 100% precision with zero false positives across multiple vulnerability classes. The tool operates offline without cloud reliance, making it ideal for authorized testing in a controlled environment.

pentest-ai-agents is a suite of 50 subagents designed to enhance penetration testing by utilizing Claude Code as an offensive security research assistant. Each agent specializes in areas such as reconnaissance, web applications, Active Directory, and cloud security, offering streamlined automation for various tasks without the need for extensive setup. Notable features include the ability to route tasks to specific experts, support for easy installation as a Claude Code plugin, and a robust validation process to ensure secure and efficient operation of each agent.

PrecompiledBinaries is a curated repository of precompiled binaries designed for use in authorized security testing, including penetration testing, red teaming, and exploit validation. It facilitates rapid access to essential tools across various scenarios such as privilege escalation, Active Directory assessments, and tunneling, eliminating the need for time-consuming compilation from source. Notable features include an organized layout of binaries by tool and platform, covering a wide range of use cases in security assessments.

ReconNinja is an autonomous multi-phase security reconnaissance framework that conducts comprehensive security assessments through a single command. It supports a myriad of functionalities including passive OSINT, port scanning, web discovery, vulnerability scanning, and Active Directory enumeration, producing reports in multiple formats like HTML, JSON, and Markdown. Notable features include an adaptive agent mode for dynamic decision-making, a user-friendly GUI, and enhanced reliability for complex scans with a uniform `PhaseContext` adapter layer.

Shells-X is a modular web shell framework designed for authorized penetration testing and security research, allowing users to deploy a single-file shell that incorporates various tools for executing commands, interacting with databases, and scanning ports. Its notable features include customizable builds with unique SHA256 fingerprints, an interactive environment for PHP and SQL commands, robust system diagnostics, and encrypted traffic handling. The framework also supports automatic detection of CMS/frameworks and provides a one-click export option for recon data to Faraday.

Tengu is a multi-command platform (MCP) server that functions as an AI-assisted penetration testing copilot, integrating with various security tools such as Nmap and Metasploit. It automates reconnaissance and scanning processes while allowing users to maintain control over exploit actions, featuring advanced safety controls like allowlisting and audit logging. Notable features include its orchestration of 80 tools, automated report generation, and pre-built workflows for diverse pentesting scenarios.

WinPrivEsc is a Windows enumeration and privilege escalation discovery toolkit designed for authorized testing. It offers two script variants—one using cmd for stealth on monitored hosts and another using PowerShell for more comprehensive analysis, allowing users to assess escalation vectors while maintaining a read-only operation. Notable features include customizable noise levels for the script output and extensive reporting on system configurations, user accounts, and permissions, ensuring flexibility and adaptability to various security environments.

Zscan is a fast and customizable service detection tool designed to identify services, APIs, and network configurations within infrastructure using a flexible fingerprint system. Key features include high-performance concurrent port scanning, intelligent service detection capabilities (such as MAC vendor identification and OS fingerprinting), precise proof of concept (POC) targeting, and versatile output formats including JSON and human-readable options. This tool enhances scanning accuracy and speed compared to traditional methods, making it valuable for network security assessments.

The bof-launcher is a versatile programming library designed for in-memory management and execution of Beacon Object Files (BOFs) across multiple platforms, including Windows and Linux. It supports various architectures and integrates seamlessly with languages such as C, Zig, and Rust, offering features like asynchronous execution, cross-platform compatibility, and advanced memory masking techniques. Additionally, the library facilitates the development of BOFs using Zig, leveraging a rich standard library for enhanced functionality during red team engagements.

C-Full-Offensive-Course is a bilingual educational resource designed to guide users through a comprehensive C programming curriculum focused on offensive security practices across Windows, Linux, and macOS platforms. The course comprises 216 progressive units with hands-on coding exercises, alongside a centralized codebase to facilitate learning. It emphasizes ethical usage by instructing users to conduct security labs only within authorized and isolated environments.

Gato-X is an advanced scanning and attack toolkit specifically designed to identify vulnerabilities in GitHub Actions pipelines, including Pwn Requests, Actions Injection, and self-hosted runner takeovers. Notable features include fast scanning of thousands of repositories with a single API token, robust analysis of cross-repository workflows, and the capability for post-compromise secrets enumeration. Tailored for Red Teamers and security professionals, Gato-X emphasizes thorough vulnerability detection while adhering to ethical research practices.

Omniscient V3 is a comprehensive reconnaissance and adversary simulation framework designed to enhance security assessments by consolidating over 130 best-in-class tools into a unified pipeline. Key features include AI-driven results augmentation, distributed execution across platforms such as Kubernetes and Docker, advanced stealth techniques for emulating sophisticated attacks, and immutable audit trails for compliance and reporting. This tool is primarily aimed at security professionals, providing a streamlined approach to identifying vulnerabilities in complex attack surfaces.

ScanCannon is a high-speed Bash script designed for efficient credentials-based attack surface enumeration and reconnaissance of large external networks, leveraging tools like `masscan` for rapid port detection and `nmap` for detailed service analysis. It outputs consolidated reports in HTML and CSV formats while enabling project-driven scanning that tracks changes over time, facilitating continuous monitoring of attack surfaces. Notable features include full ASN-based discovery, API detection, CVE hinting, and resilience through checkpointing and parallel scanning.