Scanner

NetSentinel is a comprehensive network management tool designed for discovering devices, diagnosing connectivity issues, and monitoring network health. It features rogue device detection, detailed device inventory, bandwidth monitoring, a root cause correlator, and automated reporting capabilities, all while ensuring complete data privacy with a fully local, open-source architecture. With its extensive functionality, NetSentinel serves as a powerful aide for network administrators and users seeking to enhance both security and reliability in their network environments.

cwv-scanner is a Python-based tool designed to identify common web application vulnerabilities by scanning specified URLs or IP addresses. It checks for 36 types of vulnerabilities including SQL Injection, Cross-Site Scripting (XSS), and Remote Code Execution, facilitating website owners and security researchers in enhancing their application's security posture. Notable features include a straightforward installation and usage process, allowing for quick deployment in vulnerability assessments.

Simple-Async-Port-Scanner is a Python 3-based asynchronous TCP port scanner that utilizes the asyncio framework to efficiently connect to multiple ports on specified IP addresses within a user-defined timeout. It features a straightforward command-line interface for scanning specified ports, supports both IP addresses and domain names, and can filter results to display only open ports. This tool is particularly notable for its speed, capable of scanning the first 1000 TCP ports on a target in under two seconds, while maintaining minimal dependencies.

Subdosec is a specialized scanner for identifying potential subdomain takeovers, designed to deliver fast and accurate results with zero false positives. Its primary use case involves scanning subdomains for vulnerabilities and providing detailed reconnaissance data, including relevant metadata such as IP addresses and CNAME records. Notable features include a public database of vulnerable subdomains, support for both public and private scanning modes, and an option for local result saving alongside AI analysis capabilities for undetected subdomains.

AQW-Sequence Weaver is a bioinformatics-inspired toolkit designed to visualize and extract patterns from network telemetry specifically for AQW private server research. It enables users to map packet transactions, identify variable fields through heuristic analysis, and interactively explore session flows, while also supporting export to standard formats and multilingual interfaces. Notably, it offers a protocol diff engine for comparing captures across versions and a community research log for collaborative annotation of packet sequences.

CredStalker is a Python-based credential and sensitive data scanner that automatically crawls websites to identify exposed credentials, API keys, and other sensitive information. It features multi-type detection capabilities, deep content analysis of HTML and JavaScript, and customizable crawling with detailed reporting and export functionality for further analysis. Ideal for security audits and penetration testing, it also includes options for verbose logging and same-domain crawling to ensure scope compliance.

0sec is an open and extensible AI-driven cybersecurity tool that automates vulnerability discovery, exploitation, and remediation across various layers, including web applications, APIs, source code, and network infrastructure. It supports multi-model and multi-agent capabilities to address complex security challenges, emphasizes continuous security over point-in-time assessments, and includes a command-line interface for streamlined interactions and automation of pentesting workflows. Notable features include the ability to find a wide range of vulnerabilities, integration with various environments and systems, and a focus on supply chain security and other emerging threat vectors.

inspect-scanner is a command-line interface tool that audits public GitHub repositories or organizations, generating structured JSON and HTML reports focused on health, maintainability, quality, security, and dependency signals. It exclusively utilizes public GitHub API data and raw manifest files for analysis, ensuring no code is executed or cloned, and incorporates customizable scan configurations to enable or disable specific metrics or categories. Notably, it integrates with OpenSSF Scorecard for security assessment, emphasizing broad security practices over vendor-specific configurations.

Patternsleuth is a testing suite designed to identify robust patterns for locating common functions and global variables within Unreal Engine games, specifically tailored for use with the UE4SS framework. Users can easily integrate game executables into the designated directory and run tests to analyze function recognition and isolation. Notable features include support for multiple game titles and a collection of established patterns that enhance the accuracy of symbol resolution.

r3ngine v3.7.4 is an advanced web reconnaissance and vulnerability scanning tool that facilitates comprehensive security assessments through its Target Report Generation feature, allowing users to generate detailed multi-scan PDF reports with historical vulnerability tracking. Key features include an Attack Path Modeling Engine aligned with MITRE ATT&CK, integration with WPScan/WPTaint for static analysis, and enhanced infrastructure for scalability and reliability using Django and PostgreSQL. This enterprise-grade platform is designed for thorough and efficient security analysis while ensuring operational security and ease of use.

VeltCLI is a terminal-based OSINT and defensive security research toolkit that consolidates multiple reconnaissance and analysis tasks into a single interface. Its primary use case includes vulnerability assessment, DNS checks, web security analysis, and various research workflows across social media, emails, IP intelligence, and more, all while supporting data export in formats such as JSON, CSV, and Markdown. Notable features include comprehensive vulnerability scanning, domain and cloud analysis, and detailed reporting capabilities, streamlining the security research process for users.

YAPP (Yet Another Pentest Parser) is a robust Python library and CLI tool designed to parse and process outputs from multiple penetration testing tools, including Nessus, Nmap, and BloodHound, into actionable results. Notable features include comprehensive multi-tool support, an extensible framework for adding new parsers, dual interface options (CLI and TUI), in-memory processing, and advanced Active Directory analysis capabilities without the need for a Neo4j server. This allows for efficient vulnerability management and streamlined workflows, aiding penetration testers in reducing processing time and improving overall productivity.

Red Clippy is an open-source penetration testing management tool designed to integrate with AI agents for streamlined test engagements. It retains detailed records of assets, observations, and findings, ensuring that testing sessions can progress smoothly without loss of information, while enforcing protocols for data verification and reporting. Notable features include a web-based interface for managing test data, customizable engagement rules, and the ability to connect to AI agents for enhanced testing efficiency.

ClusterImageScanner is a Kubernetes-native tool designed to identify vulnerabilities and misconfigurations in container images within production environments. It automates the analysis process by utilizing an image collector and orchestrator to periodically scan images with multiple security scanners, consolidating findings through a vulnerability management system like OWASP DefectDojo while providing real-time feedback to developers through communication channels. Notable features include its integration with Argo Workflows, flexible deployment options, and support for various scanning methods, ensuring comprehensive security monitoring for containerized applications.

JScanner2 is an AI-powered JavaScript security analysis tool that utilizes AST parsing for detecting vulnerabilities and sensitive information in JavaScript files. Unlike traditional regex-based scanners, it intelligently extracts API parameters, provides context-aware analysis for hardcoded secrets, and offers exploit suggestions, enabling more accurate and efficient vulnerability assessments. Notable features include resumable scanning and automatic parameter discovery, making it suitable for red team and blue team exercises.

Network Analyzer is a comprehensive network scanning tool designed to help users monitor Wi-Fi connections, evaluate network security, and troubleshoot performance issues across home and office environments. It features detailed analysis of connected devices, real-time internet speed metrics, various network tools for performance and security assessments, and full IPv6 support. The tool also provides insights into Wi-Fi signal quality, channel usage, and the ability to discover local services on the network.

BugTraceAI is an open-source, self-hosted framework designed for autonomous bug bounty hunting and penetration testing. Utilizing AI agents, it intelligently discovers, analyzes, exploits, and validates vulnerabilities without requiring manual intervention, ensuring a privacy-first approach with no telemetric data collection. The platform allows modular component use, easy deployment via Docker, and emphasizes educating users on its tools for authorized security testing.

Acunetix Premium Web Scanner - Practical Windows release with complete modules and an easy first launch.

Fluere is a comprehensive network monitoring and analysis tool that captures network packets in pcap format and converts them into NetFlow data, enabling users to analyze traffic dynamics effectively. It supports both live and offline data capture across multiple platforms (Windows, macOS, Linux) and features a Terminal User Interface (TUI) for real-time feedback during live captures. Notable functionalities include integration with AWS Traffic Mirroring, active firewall implementation using plugins, and customizable command-line arguments for enhanced user experience.

Patchbot is a comprehensive vulnerability scanning tool that integrates with existing scanners and threat feeds to automate the patching process in software repositories. It specializes in inventorying packages, identifying vulnerabilities, and applying fixes—either through version bumps or more complex code changes—while ensuring that each change is verified and re-scanned prior to the creation of pull requests. Notable features include the ability to utilize custom threat feeds and scanners, as well as the capability to operate independently of CI environments, thereby providing flexibility in deployment and usage.

Ingram-Pro is an enhanced network camera vulnerability scanner that builds upon the original Ingram framework, providing extensive coverage of over 40 proof of concept (POC) exploits for CVEs from 2017 to 2024, alongside brand-specific weak-password detection for more than 15 camera brands. Key features include authenticated and unauthenticated remote code execution (RCE), high concurrency scanning using gevent, and the ability to capture live snapshots from vulnerable devices. The tool is designed for authorized security assessments and facilitates rapid vulnerability detection across large IP ranges.

Deep Focus is a high-performance asynchronous network reconnaissance tool designed for security researchers and network administrators to discover and fingerprint services across IP ranges. It features intelligent probing of common network services, detailed authentication detection, and structured export of actionable intelligence, all while managing system resources to prevent overheating on passively-cooled devices. Its notable capabilities include comprehensive scanning for services like HTTP, FTP, SSH, and more, along with robust thermal management to ensure optimal performance.

RedAgent is an offensive security tool designed for authorized security teams to conduct adversary-grade testing across various surfaces, including web, API, cloud, and identity. It operates within strict authorization boundaries, enabling controlled and precise engagements while leveraging supervised AI to enhance expert workflows. Notable features include comprehensive auditing of operations, policy-gated engagements, and a focus on ensuring all actions remain within authorized scopes.

Network Scanner is an open-source security tool designed for vulnerability assessments and penetration testing, enhancing traditional methodologies with AI capabilities for intelligent analysis and detailed reporting. Tailored for a diverse user base including beginners and professionals, it offers functionalities such as automated reconnaissance, various scan types (subdomain, port, DNS), and an AI assistant for context-sensitive support. Notable features include report generation in PDF/HTML formats, an educational learning mode, and API readiness for seamless integration.

PrestaScan Security is a PrestaShop module designed to scan PrestaShop websites for malware and known vulnerabilities in both the core and its modules. It features an intuitive installation process, regular vulnerability alerts, and is compatible with multiple PrestaShop versions, ensuring comprehensive security for e-commerce sites. This free and open-source tool is supported by a dedicated team of security experts who continually monitor and audit for potential threats.

Bex Security is an open-source tool designed to facilitate security workflows for coding agents and models, maintaining compatibility with OpenAI's Codex Security. This tool enables users to run consistent, evidence-driven security scans while supporting multiple coding agents through the Agent Client Protocol (ACP). Notable features include a CLI that integrates with various inference providers, a repeatable upstream merge workflow, and an emphasis on security outcomes from discovery to remediation.

Public Skills Builder is a tool designed to generate Claude Code bug bounty skills from publicly available HackerOne reports and GitHub writeups, specifically without requiring access to private reports. It processes over 500 disclosed reports to create 18 structured skill files for various vulnerability classes, each containing real-world techniques, payloads, and bypass patterns, thereby providing users with resourceful training data for vulnerability hunting. Notable features include support for multiple sources, including public feeds, and the ability to customize output based on specified vulnerability types.

Web Security Analyzer Pro is an advanced web security analysis tool designed for system administrators, developers, and security professionals to audit their websites efficiently. It conducts comprehensive assessments of HTTP headers, cookies, and SSL/TLS configurations, as well as identifying common vulnerabilities and generating a security score with remediation recommendations. Notable features include offline CVE searches using the FKIE-CAD database, interactive visual reporting, and detailed cookie analysis for security flags.

Ruoyi-Scan is a specialized vulnerability scanning tool designed for RuoYi applications, featuring a plugin-based architecture and three-state assessment (CONFIRMED / SAFE / UNKNOWN) for vulnerability status. It supports bulk scanning, multiple report formats, WAF bypass techniques, and offers enterprise-level functionalities such as API integration and a robust plugin ecosystem for various common vulnerabilities. Noteworthy capabilities include automated AI-based POC generation, extensive reporting options, and compatibility with various operating environments.

BugHunter is an AI-powered bug bounty toolkit designed for effective vulnerability assessment and reporting directly from the terminal. It automates the processes from reconnaissance to reporting, generating submission-ready documents for various platforms while utilizing an intelligent session management feature that retains discovered patterns across targets. This tool can operate independently without a subscription, enhancing accessibility for users in the cybersecurity domain.

Vex8s is a tool that generates VEX documents by analyzing container vulnerabilities and correlating them with Kubernetes security settings to assess the exploitability of CVEs within workloads. It utilizes machine learning models to classify vulnerabilities and determine mitigable conditions based on Kubernetes configurations, offering both passive and active scanning modes for versatility. Notable features include integration with existing vulnerability scanners like Trivy and Grype, facilitating the suppression of reported vulnerabilities based on real-time assessments.

x64dbg-MCP Server is a native plugin for x64dbg that enables programmatic control of the debugger over HTTP, utilizing the Model Context Protocol (MCP). Its primary use case is for enhanced reverse engineering, allowing users to manage breakpoints, step through code, and access memory and registers via any MCP-compatible AI assistant. Notable features include zero dependencies, dual transport methods (streamable HTTP and SSE), and comprehensive debugger control with 71 available tools and 22 event callbacks.

The Camera Scanner is a Python command-line tool that facilitates the discovery and assessment of publicly accessible or vulnerable cameras via integration with Shodan and Nmap scanning. Key features include command-line options to initiate searches, check a database of cameras, and perform scans over specified IP ranges, with user-configurable settings for API keys and credential wordlists. This tool is intended for educational purposes, emphasizing responsible use in cybersecurity assessments.

Stackray is a self-hosted site intelligence application designed to scan domains and URLs to identify and record the technologies powering websites over time. It features multi-phase scanning capabilities, including HTTP probing, browser rendering, and cloud resource integration, allowing users to gather comprehensive technology stacks, monitor changes, and collaborate effectively within teams. Notable functionalities include the ability to enrich targets with public signals, run templated checks, and support for API integrations and recurring scans.

HTLogin is a security testing tool designed to inspect and identify vulnerabilities in login forms and authentication APIs across web applications. It comprehensively tests for common weaknesses, including default credentials, injection vulnerabilities, and rate-limiting issues, while supporting HTML forms, JSON/GraphQL APIs, and JavaScript-rendered SPAs. Notable features include confidence-based detection with detailed reporting, a CLI interface for streamlined usage, safe operational modes, and extensive integration support with proxies and testing frameworks.

TraceTree is an advanced autonomous security tool designed to enhance development workflows with robust detection and protection capabilities. Its primary use case revolves around analyzing packages for malicious intent through sandbox isolation, syscall parsing, and machine learning-based anomaly detection, enabling developers to maintain security before package installations. Notable features include a multi-agent coordination server, a web dashboard for monitoring, and a behavioral receipt export for summarizing observed behaviors without compromising syscall logs.

The Ansible Security Scanner is a static analysis tool designed for evaluating Ansible playbooks, roles, and related files to identify security vulnerabilities including malicious code and unauthorized access risks. It features a comprehensive reporting mechanism that generates outputs in various formats such as SARIF and CycloneDX SBOM, while providing remediation guidance and mapping findings to established security frameworks like OWASP and MITRE ATT&CK.

The "Python for Security Professionals" course equips learners with practical skills in Python programming specifically tailored to security tasks, ranging from language fundamentals to the development of security tools. It features hands-on labs that culminate in building applications like port scanners and log analyzers, all while emphasizing clean coding practices and error handling. This lab-driven, self-paced curriculum is suitable for beginners and progresses through advanced concepts, ensuring students learn to write maintainable security software effectively.

OXIDE is a precision-forged vulnerability scanner developed in Rust, designed primarily for authorized penetration testing and security research. It features a unique combination of traditional scanning methods and machine learning-based anomaly detection, along with integrations for tools like Burp Suite, and offers a modular architecture for extensibility. Notable features include a headless DOM, WAF evasion capabilities, and enhanced security with an embedded TLS certificate, making it suitable for use in both lab environments and real-world assessments.

IndustrialXPL-Forge (IXF) is an extensive Python-based security assessment and exploitation framework designed specifically for Operational Technology (OT), Industrial Control Systems (ICS), and related environments. It encompasses the entire attack lifecycle from reconnaissance to reporting, and it features over 1,190 modular tools, support for more than 50 protocols, and extensive integration with the MITRE ATT&CK for ICS framework, along with a significant library of vulnerabilities, offering a comprehensive resource for cybersecurity professionals in the industrial sector.

The ANY.RUN SDK is a Python client library designed to interact with the ANY.RUN REST API, facilitating automated malware analysis and threat intelligence workflows. It provides features for file and URL submissions to an interactive sandbox, real-time monitoring of analysis progress, and access to comprehensive threat intelligence, including IOC searches and feeds. Notable functionalities include support for both synchronous and asynchronous operations, along with built-in exception handling and detailed reporting capabilities.

NEO-Radar is a lightweight network scanner designed for Linux and Termux, aimed at simplifying network scanning for users without extensive networking or cybersecurity knowledge. Its primary use case is to provide essential scanning functionalities akin to more complex tools like Nmap, while also including a command reference for learning purposes. Notable features include ease of installation via a single command, compatibility with mobile devices, and a focus on user-friendly operations, making it accessible for a wider audience.

Meta Scan is an OSINT tool designed to extract comprehensive public profile data from Facebook pages, leveraging the RapidAPI Facebook Pages Scraper. Key features include the ability to retrieve detailed information such as profile and business details, transparency data, and generate JSON reports, all while ensuring secure API key handling and a user-friendly CLI interface. The tool is intended for educational purposes and supports batch processing of usernames, enhancing its usability for researchers.

Core Net Scanner is a cross-platform Python tool designed for network discovery and open port detection on local IPv4 subnets, applicable for both personal and organizational purposes. Notable features include LAN detection, custom scanning of specific IPs or ranges, HTTP service scanning, real-time traffic inspection, and a comprehensive logging system for detailed output. This tool is specifically intended for lawful use with explicit permission from network owners, ensuring ethical and responsible operation.

Cybermes is an advanced autonomous security research framework designed for offensive security tasks, including bug bounty hunting and red teaming. It features over 50 specialized modules for in-depth reconnaissance, attack surface analysis, and vulnerability validation, leveraging a unique integration of modern LLM reasoning and automated workflows. Notable capabilities include dynamic attack planning, multi-source knowledge retrieval, and programmatic validation of findings to ensure zero false positives.

The Roblox Robux Hack Script 2026 is a tool designed to exploit the developer exchange API of Roblox, enabling users to transfer Robux from compromised developer accounts. Its primary use case is the automated scanning for vulnerable accounts and facilitating stealthy transfers of Robux in small increments to avoid detection. Notable features include the ability to export scanned account lists to CSV, support for accounts with at least 10,000 Robux, and an operational stealth mode to minimize the risk of detection by Roblox.

Yaramail is a Python tool designed for scanning emails using YARA rules, primarily aimed at automating the triage process of phishing reports. It offers comprehensive functionality that allows users to analyze all components of an email, including headers, body content in various formats (Markdown conversion), and various attachment types, while also providing customizable password options for encrypted ZIP files. Notably, Yaramail categorizes emails systematically and parses authentication results for enhanced analysis.

WPRecon is a WordPress reconnaissance and vulnerability scanning tool that leverages a YAML-driven template architecture for efficient vulnerability detection and configuration assessment in WordPress installations. Notable features include parallel scanning with configurable worker pools, a library of over 150 templates for comprehensive coverage, and dynamic variable resolution, offering flexibility for security engineers to extend capabilities without recompilation. The tool supports both command-line and API interfaces, allowing for versatile integration into security workflows.

nmap-vulners is a set of Nmap scripts designed to enhance network vulnerability assessments by converting service scan results into a detailed list of known Common Vulnerabilities and Exposures (CVEs) along with their respective CVSS scores and exploits. Notable features include three independent scripts that can perform various vulnerability lookups—one leveraging the public Vulners database, another utilizing the Vulners API for advanced scoring, and a regex-based script that identifies web software through HTTP headers. This tool aims to streamline the process of gathering security-related information during Nmap scans, improving the effectiveness of vulnerability management.

ZeroDroid is a comprehensive Android hardware security toolkit designed to transform smartphones into portable RF labs, network analyzers, and security auditing tools, featuring 29 specialized utilities. Its primary use case includes analyzing various radio frequencies and sensors, as well as conducting detailed network assessments. Notable features include the ability to access WiFi, Bluetooth, NFC, GPS, and other device sensors, all presented through a terminal-hacker user interface.

Aqua Helm is a tool for deploying Aqua Security's enterprise solutions within a Kubernetes cluster using Helm charts. It provides a range of deployment options for individual components such as the Console, Enforcer, Scanner, and KubeEnforcer, allowing for flexible and secure management of containerized applications. Key features include a quick-start deployment for testing and comprehensive charts for various service components, facilitating robust security measures in a cloud-native environment.

CodeScanAI is a security analysis tool that leverages AI models to scan codebases for vulnerabilities and offers actionable remediation suggestions. It supports multiple AI providers, including OpenAI and Google Gemini, and integrates seamlessly into CI/CD pipelines, allowing for full directory scans, targeted scans on changed files, and inline PR review comments. Notable features include diff-aware analysis for pull requests and flexible scanning options to enhance security throughout the development process.

OSV.NET is a .NET library designed to interact with the Open Source Vulnerabilities (OSV) API and schema, specifically supporting version 1.7.0. Its primary use case is to facilitate querying for vulnerabilities in open source packages, and it provides flexible integration options through manual instantiation or dependency injection, making it straightforward to incorporate into .NET applications. Notable features include asynchronous querying capabilities and customizable HTTP client settings for enhanced configurability.

url.vet is an open-source phishing detection engine designed to analyze URLs and domains, providing users with a trust score, detailed verdicts, and comprehensive security reports in real time. Key features include instant live scanning using 18 concurrent analyzers and 33 individual signals, an explainable scoring system devoid of black-box machine learning, as well as integrations for a REST API, web UI, and a Chrome extension, making it a developer-friendly alternative to existing services like VirusTotal.

AobscanFast is a high-performance, cross-platform memory pattern scanner designed for locating Array-of-Bytes (AOB) signatures in live process memory, primarily used in game modding and reverse engineering. It features SIMD acceleration for efficient scanning, parallel processing capabilities, and zero-allocation paths to optimize performance, making it suitable for both Windows and Linux environments. Additionally, it offers configurable options for chunk size and parallelism, along with a dependency injection-ready architecture for flexible integration.

HEAVEN is an autonomous penetration-testing framework designed to streamline and automate various stages of the penetration testing process, including reconnaissance, vulnerability detection, exploitation, risk scoring via machine learning, and reporting. It features a robust interface with 55 CLI commands, 77 API routes, and multiple scan modes, facilitating comprehensive assessments while allowing users to focus on critical decision-making tasks. Notably, it incorporates a CVSS machine learning predictor with a high correlation score, ensuring accurate risk evaluation.

ExploiterX 3.0 is an enterprise-grade web vulnerability scanner designed for security professionals and developers, capable of detecting a wide range of vulnerabilities including XSS, SQL Injection, and CSRF. Its notable features include advanced scanning capabilities with over 20 XSS payload variants, concurrency support for parallel scanning, intelligent HTML form parsing, and comprehensive reporting in multiple formats. Additionally, the tool emphasizes resilience with built-in retry mechanisms, robust error handling, and secure reporting to prevent common security vulnerabilities in output.

MAPG is an automated reconnaissance tool designed for penetration testing, CTFs, and security assessments, facilitating organized and efficient service enumeration. It features a modular framework that executes service detection and enumeration tools in parallel, generating structured reports while minimizing manual effort. Notable capabilities include support for various scanning modes, extensive service checks, and automatic report generation, all aimed at streamlining the initial phases of security assessments.

The Scan-broken-owner tool is a PowerShell script designed to audit Active Directory for vulnerabilities related to object ownership, specifically targeting "broken owners" which pose a security risk. Its primary use case is to help organizations identify and mitigate control-takeover vulnerabilities by ensuring that Active Directory objects are owned by appropriate, legitimate users, thereby preventing potential attacks such as Kerberos Resource-Based Constrained Delegation abuse. Notable features include the generation of a detailed HTML report, the ability to skip specific users or groups during scans, and operation without requiring administrative privileges.

opencode-pentester is an AI-powered penetration testing and security audit framework designed to automate bug bounty hunting and vulnerability assessments. It orchestrates 12 specialized AI agents across 69 attack categories and 17 OWASP security audits, enabling comprehensive offensive and defensive testing. Notable features include the ability to run automated tests, generate professional reports, and integrate a wide array of security tools, making it suitable for security researchers, penetration testers, and DevSecOps engineers.

Bjorn Manager is a desktop application designed to facilitate the discovery and management of Bjorn devices across various network interfaces, including LAN, USB, and Bluetooth. It allows users to install, update, and control these devices from a single user interface, featuring multilingual support, smart device naming, and real-time terminal logs for installations. Key functionalities include auto-discovery, SSH installation capabilities, and configurable settings, making it a comprehensive tool for managing Bjorn devices efficiently.

`agentgg` is an agentic static application security testing (SAST) scanner designed for CI environments that leverages advanced reasoning capabilities over traditional pattern-matching methods. It intelligently navigates codebases by following imports and analyzing the call graph, allowing users to run scans on entire repositories or specific git diffs for pull request assessments. Key features include the ability to auto-download a catalog of agents, resume interrupted scans, and create reusable agents from past security reports, enhancing the overall efficiency and effectiveness of code security analysis.

Pentestkit is a sophisticated, multi-agent penetration testing framework that utilizes the Claude Agent SDK to orchestrate a team of specialized agents. The tool excels in automating the penetration testing process by exploiting vulnerabilities, scoring them using CVSS v3.1, and generating comprehensive client-ready reports, all while accumulating knowledge in a shared database. Notable features include its ability to perform real exploitation of findings and a robust scoring system that achieved a perfect 104/104 on the XBOW benchmark suite.

HunterX is an AI-assisted offensive security engine designed for conducting authorized security assessments, integrating tools for reconnaissance, hypothesis-driven investigation, vulnerability validation, and professional reporting into a unified workflow. Unlike traditional vulnerability scanners, HunterX emphasizes thorough investigation and validation, ensuring that findings are evidence-based and report-ready. Notable features include AI-assisted reasoning, proof of concept engineering, and capabilities for reproducibility and impact assessment, enhancing the reliability of security assessments.

Bulwark is a comprehensive security tool for Linux systems, providing configuration validation, antivirus scanning with ClamAV, and specialized monitoring for AI coding assistants to prevent sensitive data leaks. Its framework includes 65 rules across multiple categories, plain-language findings, and one-click reversible fixes, ensuring users can easily address security issues. Additionally, Bulwark features a CLI interface (`bulwarkctl`), provides continuous monitoring, and employs a log analysis pipeline to detect security events.

TerraSecure is an ML-powered Infrastructure as Code (IaC) security scanner designed to identify cloud misconfigurations in Terraform and HCL files at build time, effectively preventing potential breaches. It employs a pre-trained XGBoost model that delivers 92.45% accuracy with a significantly lower false positive rate of 10.71%, offering context and remediation guidance based on real-world breach data. Notable features include a hybrid detection approach that integrates a rules engine, machine learning, and AI analysis to provide actionable insights for developers.

findcdn is a Python-based tool designed to scan domains to identify the Content Distribution Network (CDN) they utilize. Its primary use case includes providing actionable insights regarding CDN usage for security assessments or operational purposes, with features that allow output to files, invocation as a module, and customizable processing options such as threading and user-agent specification. The tool supports multiple domains and offers verbose output for enhanced monitoring and analysis.

njsscan is a static application security testing (SAST) tool designed to detect insecure code patterns in Node.js applications utilizing both simple pattern matching from libsast and semantic analysis via semgrep. Its primary use case is to enhance the security posture of Node.js applications by identifying vulnerabilities, with notable features including multiple output formats (such as JSON, SARIF, and HTML) and customizable configurations.

CVE-2023-51467 Scanner is a Python-based command-line tool designed to identify a specific vulnerability in the Apache OfBiz ERP system that allows unauthorized access due to an authentication bypass flaw. It enables users to scan individual URLs or lists of URLs for the vulnerability, supporting multiple concurrent threads for efficient scanning and providing output files for vulnerable targets. Notable features include customizable thread counts and flexible input options for URL scanning.

Threat-Patrol is a lightweight Python script designed for web application security testing, enabling users to scan websites for vulnerabilities such as SQL injection, XSS, CSRF, SSRF, LFI, and RCE. Its notable features include an easy-to-use command line interface, automatic scanning capabilities, and instant results, making it suitable for quick vulnerability detection.

The Learning Grade AI Web Vulnerability Scanner is a non-destructive tool designed for identifying common web security issues such as unauthorized security headers, insecure cookie flags, and potential SQL injection vulnerabilities. It features a queue-based crawling mechanism for polite scanning, an AI-assisted report viewer for enhanced analysis, and requires explicit user confirmation for ethical scanning practices. This tool is particularly suited for educational purposes and authorized security assessments.

Reconner is a self-hosted reconnaissance tool designed for bug bounty hunters and security researchers, facilitating comprehensive web and network scanning from a single dashboard. It offers a full pipeline of discovery, vulnerability assessment, and continuous monitoring without relying on third-party services, ensuring that all data remains on the user's system. Notable features include real-time logging, native context-aware DAST for multiple vulnerabilities, and seamless integration with Nuclei for enhanced scanning capabilities.

The Nmap Scanning Tool is an interactive wrapper for Nmap that simplifies the execution of common scans and enhances readability of results. It supports multiple scan profiles, including SYN, aggressive, and vulnerability scans, along with an optional output filter to highlight open ports. The tool requires Python and Nmap to be installed on the user's system and aids in providing helpful error messages regarding user permissions and installation checks.

XSScan is a Playwright-based automated tool designed for bug bounty hunters and security researchers to detect executed cross-site scripting (XSS) vulnerabilities. Key features include real browser execution using Chromium, intelligent form submission, recursive crawling, and auto-generated reports of confirmed XSS findings, ensuring focus on vulnerabilities that are genuinely executed rather than merely reflected.

Red-Team AI is a white-box red teaming tool designed specifically for agentic AI applications, capable of reading source code to identify vulnerabilities that are unique to a particular technology stack. Its primary use case involves generating tailored attacks based on an application's specific implementation, rather than relying on generic adversarial prompts. Notable features include a modern React dashboard for scan management and compliance tracking, as well as integrations with popular agent frameworks, facilitating extensive security assessments and risk assessments for AI systems.

The Penetration Testing Roadmap is a comprehensive, self-paced 60-week curriculum aimed at developing expertise in penetration testing, ethical hacking, and network security. It features structured learning paths, hands-on practice through over 500 free labs, and an extensive tools directory, enabling learners to transition from novices to market-ready professionals. Additionally, it encompasses crucial topics such as web application vulnerabilities and emerging cybersecurity trends.

CamSniff is an automated reconnaissance toolkit designed for discovering and profiling IP cameras and network video streams within local networks. It employs both active and passive scanning methods to generate structured and auditable datasets, while enabling users to acquire snapshots and streams from various protocols, including RTSP and ONVIF. Notable features include its mode-aware scanning capabilities, multi-protocol support, and the ability to produce comprehensive output formats such as structured JSON files and logs.

BugTraceAI-CLI is an autonomous offensive security framework designed specifically for bug bounty hunting, effectively integrating LLM-driven analysis with real-world exploitation tools. Its key features include active exploitation of vulnerabilities using SQLMap, browser-based validation, and a focus on actionable outcomes, all while utilizing AI for hypothesis generation and traditional tools for verification. The framework emphasizes a robust methodology that allows users to think analytically, exploit dynamically, and validate thoroughly.

CloudGPT is an AWS vulnerability scanner that assesses customer-managed AWS policies for potential vulnerabilities using ChatGPT. It automatically redacts sensitive information such as account numbers to ensure privacy while querying OpenAI, and primarily focuses on parsing responses to identify vulnerabilities in policies. Users are advised to manually review the outputs for context, as the tool provides initial assessments based on a simplified response format.

Skill Scanner is a security detection tool designed to identify threats in AI Agent Skills, focusing on prompt injection, data exfiltration, and malicious code patterns through a combination of static and behavioral analysis, as well as LLM-based semantic evaluation. Key features include multi-engine detection for enhanced coverage, a meta-analyzer to filter false positives, CI/CD readiness with SARIF output and pre-commit hook support, and an extensible architecture for custom analysis plugins. It is particularly targeted at OpenAI Codex and Cursor Agent Skills, ensuring compatibility with defined specifications while enabling scanning of non-standard formats.

Sh00t is a dynamic task manager designed for manual security testers, facilitating the organization and execution of security assessments. It features customizable checklists for security test cases, the ability to manage bug templates for generating reports, and supports multiple assessments and projects. With a focus on enhancing the testing workflow, it offers automatic saving, export options to Markdown, and upcoming integration with tools like JIRA and ServiceNow.

Grype is a vulnerability scanner designed for container images and filesystems, allowing users to detect known security issues across various OS package ecosystems and language-specific packages. Notable features include support for multiple image formats such as Docker and OCI, threat prioritization mechanisms like EPSS and KEV, and enhanced scanning capabilities through OpenVEX integration. It streamlines the vulnerability assessment process for developers and security teams by enabling quick scans of container images and SBOMs.

Educational dependency scanner built in pure Go—parse go.mod and go.sum, inspect direct and indirect modules, query OSV for vulnerabilities, and summarize licenses.

AuditSentry is an AI-powered smart contract auditor designed for analyzing Solidity and Vyper contracts across EVM chains. It leverages 23 specialized AI agents to conduct in-depth security assessments, providing detection of critical vulnerabilities, working exploit proof-of-concepts, and gas profiling, all formatted into professional audit reports within minutes. Notable features include mainnet-fork simulations and on-chain certificates, enhancing both accuracy and trust in the audit process.

The Trivy Operator Dashboard is a security management tool designed for Kubernetes environments, offering comprehensive insights into security posture through detailed reporting on vulnerabilities, policy validation, and compliance assessments. Notable features include user-friendly dashboards for various security reports, including vulnerability and cluster assessments, with capabilities for data export and inspection. The tool aims to streamline security monitoring and response, prioritizing simplicity in its core functionality while considering future enhancements based on community demand.

IDOR-Auto is an advanced testing tool designed specifically to identify Broken Object-Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities by employing differential access testing rather than relying on simple HTTP status codes. It distinguishes itself by utilizing multiple identity responses to determine if one user can access another user's data, while effectively minimizing false positives through robust response comparison, identifier analysis, and support for various input formats. Key features include canary detection, injection point flexibility, identification of encoded IDs, method tampering, and direct raw request importation, making it suitable for authorized security testing in penetration tests and bug bounties.

Credential-Detector is a command-line tool designed to scan project files for hard-coded credentials, including passwords, API keys, and private keys that may have been inadvertently embedded in source code. It supports multiple file types, such as Go, JSON, YAML, and various others, and offers highly configurable scanning options to identify suspicious patterns and variable names while excluding obvious test data. Additionally, it features a web application for enhanced usability and can be integrated as a library within other Go applications.

VulnAPI is an open-source dynamic application security testing (DAST) tool tailored for scanning APIs to identify common security vulnerabilities. It features a command-line interface (CLI) that allows users to discover API details and execute scans using either a curl-like syntax or OpenAPI contracts, delivering comprehensive reports on detected vulnerabilities. Notable functionalities include detailed output reports, integration with OpenAPI specifications for scanning, and the ability to leverage the discover command for gaining insights into target APIs.

malsnitch is a command-line tool designed to assist malware reverse engineering by scanning various artifact formats for embedded secrets within binaries. Its notable features include the ability to detect hardcoded credentials, C2 infrastructure, and crypto keys in binary files, with support for multiple input formats such as raw strings dumps, FLOSS JSON output, and Binary Ninja exports. The tool also offers structured JSON output, automatic deduplication, and the capability to scan memory dumps, making it an efficient resource in identifying obscured sensitive information utilized by malware authors.

Atomdrift Scan is a machine learning-based malware scanner designed for detecting 0-day attacks in the software supply chain. Its primary use case revolves around scanning files, URLs, and processes with support for over 100 file formats and more than 100,000 detection rules, delivering an 82% detection rate. Notable features include advanced static analysis with reinforcement learning for frequent rule updates, automated binary reverse engineering, and flexible integration into existing workflows.

OwlTrack is a multifaceted tracking tool designed for investigation purposes, capable of gathering detailed information about phone numbers, email addresses, and IP addresses using various scanning methods. Key features include phone number identification with location data, email validation and finding capabilities, and a DDoS attack option for stress testing websites. Built with Python, Bash, and JavaScript, it operates on platforms including Android and Linux, catering to diverse cybersecurity needs.

The HCL AppScan SAST GitHub Action facilitates static analysis security testing (SAST) and software composition analysis (SCA) for code repositories, identifying vulnerabilities within both the source code and its dependencies. Notable features include customizable scan parameters, the ability to conduct incremental scans, and options to focus solely on specific types of analysis, along with integration with HCL AppScan on Cloud or AppScan 360 for result storage.

Wallarm Docker Aio is a comprehensive Docker image designed for API security, integrating Nginx with Wallarm's security modules to safeguard applications against a range of cyber threats. Its notable features include a minimal Alpine Linux base, support for multiple architectures, non-root user execution for enhanced security, and customizable configurations via environment variables. The tool facilitates seamless deployment and operation of a Wallarm Node for effective monitoring and protection in diverse environments.

The NPM Supply Chain Security Scanner is a robust tool designed to identify vulnerabilities in NPM and PyPI dependencies, specifically targeting known compromised packages associated with significant supply chain attacks from 2025 to 2026. Key features include comprehensive detection of transitive dependencies, integration with multiple programming ecosystems, and careful analysis of installation scripts and entangled dependencies for malicious patterns, alongside automated script options for continuous security monitoring and reporting.

url.vet is an open-source phishing detection engine that evaluates URLs and domains in real-time, providing a trust score, verdict, and comprehensive security report with live page previews. Notable features include 18 concurrent analyzers, 33 signals analyzed for trustworthiness, detailed explanations for each verdict, and integration capabilities with a REST API and Chrome extension. This tool serves as a self-hostable alternative to established platforms like VirusTotal, offering detailed insights without relying on opaque machine learning processes.

Ameen's Morphe Patches is a collection of bytecode-level modifications designed for enhancing the functionality of various Android applications using the Morphe framework. The tool primarily serves to unlock premium features in apps like Foodvisor and PhotoGrid, allowing users to bypass limitations and watermarks. Key features include ease of use through the Morphe Manager or CLI, as well as the ability to apply custom logic to APKs without requiring the original source code.

ONUS is a locally-hosted vulnerability assessment and penetration testing tool designed for conducting comprehensive scans on authorized target domains. It features eight parallel scanning modules that assess various security aspects, employs deterministic CVSS v3.1 scoring for findings, and optionally utilizes AI for generating user-friendly remediation instructions, delivering results in both a PDF report and an interactive web dashboard. This air-gapped solution prioritizes simplicity and security, requiring no external dependencies or user accounts for self-hosted deployments.

SentinelDeck is a passive attack-surface assessment tool designed for small businesses, agencies, and security consultants, which evaluates the public-facing posture of a specified domain or IP without intrusive scanning. It generates a risk score, provides an A to F grade, and offers prioritized findings along with actionable remediation steps. Key features include easy installation via pip, command-line scanning, and an interactive web dashboard for visualizing results.

Inkog is a static analysis tool designed to perform pre-flight checks on AI agents, identifying vulnerabilities unique to agent code, such as token bombing, prompt injection, and compliance gaps. It generates detailed reports that align with standards like the EU AI Act and OWASP guidelines, offering insights into critical security flaws and oversight issues. Notable features include easy integration with CI/CD processes, a no-install command-line option, and compatibility with multiple platforms.

Xpsd is a vulnerability reachability analysis tool that leverages LLMs to determine if reported vulnerabilities are actually exploitable within a specified codebase. By ingesting CVE descriptions or vulnerability scan reports, it employs structural code navigation and other tools to generate structured verdicts and detailed markdown reports compatible with GitHub code scanning. Noteworthy features include GitHub CI integration, support for multiple vulnerability scanners, and flexible model switching for tailored analysis.

SentryPeer is a fraud detection tool designed to protect SIP servers from malicious activity by tracking and logging attempts to make phone calls from bad actors. Its primary use case involves monitoring outbound calls from VoIP PBXs to notify users of potentially harmful interactions based on an extensive database of probing phone numbers. Notable features include a RESTful API for easy integration, real-time notifications to service providers, and support for Syslog and Fail2ban for enhanced security logging and management.

Plecost is a professional security scanner specifically designed for WordPress installations, capable of detecting vulnerabilities in the core, plugins, and themes while referencing a daily-updated local CVE database. It offers various scanning modes, such as deep and fast scanning, along with features like asynchronous scanning, extensive configuration options, and compatibility with task queues like Celery, making it suitable for automated security assessments without any external API dependencies or data sharing.

SkillSpector is a security scanner designed for evaluating AI agent skills, identifying vulnerabilities and malicious patterns prior to their installation. It features multi-format input support, a two-stage analysis combining static and semantic evaluations, and live vulnerability lookups with real-time CVE data. The tool generates comprehensive reports and risk scores, making it integral to ensuring the safety of AI skill deployments.

ExploitBot is an AI-powered penetration testing toolkit designed for autonomous operation on Apple Silicon, enabling users to conduct comprehensive pentests without cloud dependency. Notable features include local LLM inference, three distinct interaction modes (Autopilot, Copilot, Manual), integration with major penetration testing tools, and automatic report generation in multiple formats. Additionally, it supports cross-engagement artifact sharing, a local CVE database, and multilingual interfaces, enhancing efficiency in vulnerability discovery and reporting.

Osv-detector is an open-source auditing tool designed to identify vulnerabilities in software dependencies by leveraging advisory databases that comply with the OSV specification. Its primary use case is to analyze various package lockfiles across multiple ecosystems, including npm, Python, Ruby, and more, enabling developers to efficiently pinpoint security risks in their projects. Notable features include support for a wide range of lockfile formats and the ability to automatically determine the appropriate parser based on the filename.

Secret-scan is a high-performance secret detection tool designed for scanning codebases to identify and remediate exposed credentials, API keys, and sensitive information, thereby helping to prevent security vulnerabilities. Key features include parallel scanning for enhanced speed, support for over 30 secret types through advanced entropy analysis and regex pattern matching, customization options for detection rules, and multiple output formats. The tool operates with zero configuration by default, respects `.gitignore` files, and ensures production readiness with 100% test coverage.

CollapseScanner is a static security analysis tool specializing in the inspection of Java JARs, class files, and nested archives without executing them. It detects high-risk elements such as hardcoded secrets, suspicious APIs, and obfuscation techniques, allowing for customizable scans through various detection modes and options for detailed reporting. Notable features include support for configuration via TOML files, multi-threading for enhanced performance, and output in machine-readable JSON format for easier integration into automated workflows.

Mr.SIP is a console-based SIP security framework designed for auditing and penetration testing of SIP-based systems. It includes three primary modules for network scanning, user enumeration, and Denial of Service (DoS) attack simulations, all leveraging high-performance multithreading and IP spoofing. The tool serves both as a research platform for SIP DDoS attacks and as a practical utility for assessing the security of VoIP infrastructures.

Axiom is a dynamic infrastructure framework designed for managing multi-cloud environments, facilitating the rapid deployment of repeatable infrastructures for offensive and defensive security purposes. It allows users to pre-install security tools on base images, enabling the quick spin-up of disposable instances for distributed scans of various targets across cloud platforms like AWS, Azure, and DigitalOcean. Notable features include support for multiple cloud providers, the ability to execute extensive scans across numerous instances simultaneously, and a focus on immutable infrastructure to enhance operational efficiency for penetration testing and bug hunting.

BTLEmap is a Bluetooth Low Energy (BLE) scanning tool designed for iOS and macOS, facilitating the discovery and analysis of nearby BLE devices. It features a comprehensive interface divided into sections for listing devices, displaying proximity data on a circular plane based on RSSI values, and generating real-time RSSI graphs. Notably, it supports PCAP export for further analysis in tools such as Wireshark, as well as integration with external scanning hardware like Raspberry Pi for enhanced data collection.

Dalfox is an advanced open-source tool designed for automated scanning and analysis of XSS vulnerabilities in web applications. The tool features a robust testing engine capable of reflecting, storing, and DOM-based XSS detection, while also providing extensive options for parameter analysis, WAF fingerprinting, and customizable HTTP requests. It supports various output formats and integrations, offering users flexibility in vulnerability detection and reporting workflows.

FinDOM-XSS is a specialized tool designed for detecting potential DOM-based XSS vulnerabilities in web applications rapidly. Its primary use case involves scanning specified URLs or lists of URLs to identify any security weaknesses, with the capability of outputting results to a designated file. Key features include its straightforward command-line interface and flexibility in handling multiple URLs through piping, complemented by dependency on LinkFinder for enhanced functionality.

MAVS (Mobile Application Vulnerability Scanner) is a shell script designed for static analysis of Android APK files, focusing on identifying and demonstrating vulnerabilities. Its primary use case is to not only highlight potential security flaws but also provide actionable exploitation techniques, thereby enabling users to understand and mitigate risks effectively. Notable features include verbose output for detailed analysis and direct commands for exploiting vulnerabilities, enhancing the practical applicability of its findings.

PhoneInfoga is an advanced OSINT reconnaissance tool designed for gathering information on phone numbers using publicly available resources. It accurately retrieves data such as country, carrier, and line type, while also leveraging search engines and APIs for footprinting to identify the number's provider or owner. Notable features include the ability to check number validity, scan multiple numbers simultaneously, and employ custom formatting for efficient data collection.

XRCross is a reconnaissance and penetration testing tool designed for identifying various web vulnerabilities including XSS, SSRF, CORS, SSTI, IDOR, RCE, LFI, and SQLI. Notable features include URL and subdomain enumeration, AWS bucket enumeration, and support for various test parameters, such as command injection and redirection checks. The tool is implemented in Bash and offers a flexible command-line interface with numerous options for detailed vulnerability assessment.

Arachni is a comprehensive web application security scanning framework designed for penetration testers and administrators. It features advanced capabilities for intelligently assessing the security of dynamic web applications, including an integrated browser environment for auditing client-side code and the ability to learn from application behavior to reduce false positives. Though primarily focused on web security, it can also be adapted for general-purpose scraping and data mining with custom components.

CMSScanner is a Ruby gem designed as a framework for developing CMS and website scanners, facilitating the rapid creation of scanning tools. Its primary use case is to analyze target websites for various content management systems by executing a command-line interface with customizable options. Notable features include its modular architecture that allows for easy extension, along with built-in classes and formatters to streamline the scanning process.

Dawnscanner is a security scanning tool designed for Ruby web applications, enabling developers to examine their code for vulnerabilities. It supports popular MVC frameworks such as Ruby on Rails, Sinatra, and Padrino and incorporates over 680 security checks updated weekly from the National Vulnerability Database. Notable features include the ability to parse Gemfiles, detect MVC frameworks, analyze code for security risks like cross-site scripting and SQL injections, and provide actionable mitigation suggestions based on scan results.

WhatWeb is a robust web scanner designed to identify the technologies behind websites, including CMS, servers, programming languages, and frameworks, utilizing a vast library of over 1800 plugins. Its primary use case is for web technology reconnaissance, offering features such as adjustable aggression levels for balancing speed and thoroughness, multiple logging formats, and support for proxy connections. Notable functionalities include custom plugin creation, support for both HTTP and HTTPS scanning, and detailed output options tailored for various analysis needs.

Win7Blue is a penetration testing tool designed to scan and exploit vulnerabilities related to the EternalBlue exploit (CVE-2017-0143) specifically for Windows 7 systems. It features a vulnerability scanner that utilizes Nmap to detect susceptible targets and includes an architecture identification module to ascertain system architecture. The tool requires several dependencies including Python and Msfvenom for effective exploitation and is primarily tested on the Kali Linux platform.

ExtAnalysis is a comprehensive tool for downloading, analyzing, and scanning browser extensions from sources like the Chrome Web Store and Firefox Addons. Notable features include a manifest viewer, in-depth permission analysis, integration with VirusTotal for malware scanning, and various reconnaissance tools for extracted URLs. Additionally, it supports the editing of common web file types and enhances user experience with a dark mode and a chiptune player.

GCP Scanner is a tool designed for assessing the access levels associated with various GCP resources, enabling security engineers to evaluate the implications of compromised credentials such as VM/container access or OAuth2 token leaks. It supports an extensive list of GCP resources and offers multiple credential extraction methods, including VM instance metadata and service account keys, without relying on third-party tools like the GCP SDK. Notably, it can run as a standalone application on Linux and includes advanced options for credential handling and project scanning.

The nmap-converter is a Python script designed to convert Nmap XML reports into XLSX format, streamlining the process of data analysis and reporting for network scans. Its primary use case is for cybersecurity professionals who need to generate easily accessible reports from Nmap scan results. Notable features include support for custom output file paths and a straightforward command-line interface for ease of use.

SCodeScanner is a command-line Python tool designed to identify critical vulnerabilities in source code before deployment, specifically supporting PHP and YAML languages. Its notable features include the ability to eliminate false positives through custom rules, fast scanning capabilities, easy integration with JIRA and Slack for visibility, and outputting results in a user-friendly JSON format. Additionally, SCodeScanner tracks user input variables across files, enhancing its effectiveness in vulnerability detection.

XSStrike is an advanced Cross Site Scripting (XSS) detection suite that uses custom parsers and a sophisticated payload generator to analyze web responses and craft effective XSS payloads based on context analysis. Its primary use case is to identify and exploit reflected and DOM-based XSS vulnerabilities, complemented by capabilities such as multi-threaded crawling, WAF detection, and a powerful fuzzing engine. Notable features include a handmade HTML and JavaScript parser, intelligent payload crafting, and support for brute-forcing payloads, making it a comprehensive tool for web security assessments.

Zeus-Scanner is an advanced reconnaissance tool designed for simplifying web application reconnaissance, featuring a robust URL parsing engine, compatibility with multiple search engines, and the ability to bypass IP blocks. It supports various vulnerability assessments, including XSS and SQL injection, while offering proxy and Tor compatibility, making it versatile for stealthy web scraping and security testing. Notable features include the ability to extract URLs from cached pages, parse robots.txt files, and utilize tamper scripts for payload obfuscation.

CanaryTokenScanner is a static analysis tool designed to detect embedded suspicious URLs, including CanaryTokens and HoneyTokens, within Microsoft Office documents, PDFs, and ZIP files. It efficiently performs in-memory scans without requiring the documents to be opened or making network requests, and it features improved performance and reduced false positives by ignoring common schema domains. The tool outputs findings directly, indicating whether a file contains potentially malicious URLs.

Paperless-ngx is a document management system that digitizes physical documents into a searchable online archive, facilitating reduced paper use. Its primary use case is to enhance document organization by providing features like document retrieval and management in a collaborative environment. Notable features include Docker-based deployment, a user-friendly web interface, and an active community contributing to its ongoing development.

The Pentest Tools Framework is a versatile Python-based platform designed for penetration testing, featuring modules for exploits, scanners, and password management. Its notable capabilities include an intuitive command interface to manage various tools, execute modules, and update the framework easily. This comprehensive toolset is geared towards enhancing security assessments by providing a centralized solution for diverse pen-testing tasks.

XSS-LOADER is a comprehensive tool designed for generating and scanning XSS (Cross-Site Scripting) payloads, as well as finding vulnerable websites using XSS dorks. It features a user-friendly interface that allows customization of payloads across various HTML tags, encoding options, and pre-defined payload types to facilitate effective XSS attacks and testing. Notable capabilities include an extensive library of payload forms, encoding mechanisms, and automated scanning for XSS vulnerabilities in web applications.

The Google Maps API Scanner is a tool designed to assess the vulnerability of Google Maps API keys against unauthorized access by external applications. It provides functionality to check multiple API endpoints for potential exploitation and can be run directly or within a Docker environment. Notable features include customizable scanning options, a semi-automated check for JavaScript APIs, and detailed output including specific vulnerabilities identified with proof-of-concept links.

FestIn is a comprehensive tool designed for discovering open S3 buckets associated with specified domains by utilizing multiple techniques, including DNS analysis, web crawling, and S3 response evaluation. Its notable features include proxy support, compatibility with any S3-compatible provider, the ability to save discovered domains for further analysis, and an integrated HTTP crawler that recursively searches based on results from previous queries. Additionally, FestIn operates without requiring AWS credentials and supports real-time monitoring for new domains.

FwHunt Scan is a tool designed for analyzing UEFI firmware and checking UEFI modules against predefined FwHunt rules. It supports functionalities for analyzing specific modules or scanning entire firmware images, either through a Python interface or via Docker for dependency management. Notable features include the ability to customize scanning with user-defined rules, automated workflows for module analysis, and support for multiple output formats, enhancing its versatility in firmware security assessments.

S3cret Scanner is a security tool designed to proactively detect sensitive secrets that may have been inadvertently uploaded to public Amazon S3 buckets, enhancing compliance with AWS security best practices. It automates the process of listing public buckets, identifying sensitive files, and scanning them for secrets using TruffleHog3, while maintaining logs for review. The tool supports both scheduled and on-demand execution, requiring specific AWS role permissions and prerequisites for setup.

S3Scanner is a tool designed to identify unsecured Amazon S3 buckets and extract their contents. It consists of two main components: `s3finder.py`, which checks a list of domain names for S3 hosting and outputs the discovered domains with their regions, and `s3dumper.sh`, which dumps contents from publicly readable buckets based on the previous output. Notable features include compatibility with Python 2.7 and 3.6, along with the requirement of the AWS CLI for the dumping process.

APIDetector is a sophisticated tool designed for the testing of exposed Swagger endpoints across multiple subdomains, focusing on robust detection of vulnerabilities and minimizing false positives. It features a modern web interface, real-time results, support for bulk domain scanning, and advanced capabilities like automated XSS detection and visual proof of concept generation. The tool is tailored for security professionals and developers aiming to enhance their API security assessment workflows.

CVE-2025-55182 is a tool designed to exploit a critical prototype pollution vulnerability in React and Next.js Server Actions, allowing for Remote Code Execution (RCE). It features an automated scanning capability via a Nuclei template and a manual exploitation script in Python, enabling the execution of arbitrary commands on vulnerable servers while extracting output effectively from response headers. This tool aims to assist security professionals in assessing the impact of this vulnerability on affected versions of React and Next.js.

Angular Client-Side Template Injection Scanner (ACSTIS) is a tool designed for identifying AngularJS Client-Side Template Injection vulnerabilities within web applications. It offers capabilities to scan individual URLs or crawl entire domains, with options for verifying payload execution and logging vulnerable requests, enhancing its efficacy in detecting security flaws in AngularJS implementations. Notable features include customizable scanning options such as the ability to halt scans upon finding vulnerabilities and support for specifying the Angular version in use.

HUNT Suite is a collection of extensions for Burp Suite and OWASP ZAP that assists security testers in identifying common parameters susceptible to various vulnerability classes such as SQL Injection and OS Command Injection. Its primary functionality includes alerting users to these parameters for manual testing and providing a testing methodology organization tool within Burp Suite. Notable features include support for multiple vulnerability classes, a dedicated methodology organization tab, and curated resources for further manual analysis.

PwnXSS is a Python-based XSS scanner designed to identify cross-site scripting vulnerabilities in web applications. Its primary use case involves crawling websites to detect potential XSS weaknesses in both GET and POST forms through customizable settings and advanced error handling. Notable features include multiprocessing support, the ability to handle various HTTP methods, and the option to configure proxies and user agents for more thorough testing.

XSSCon is a Python-based tool designed for scanning websites for Cross-Site Scripting (XSS) vulnerabilities. It features a web crawler that traverses all links, supports both GET and POST forms, allows advanced customization through command-line options, and implements multiprocessing for enhanced performance. Notable functionalities include comprehensive error handling and the ability to manage cookies, making it a versatile choice for penetration testers.

ATSCAN is an advanced mass scanning tool designed for automated vulnerability assessment, allowing users to perform extensive searches for exploits and issues across multiple search engines, including Google, Bing, and Shodan. It boasts features like mass dork searching, exploitation capabilities, automated command execution, and the ability to detect various web vulnerabilities such as XSS, SQL injection, and file inclusion. The tool is written in Perl, supports proxy usage, and provides options for random user agents and engines to enhance anonymity during scans.

Local Semgrep UI is a Next.js application designed for triaging JSON output from Semgrep CLI scans, providing an interface to load results into MongoDB for persistence and management. It allows users to manage and navigate issues using GitLab URLs based on the output file's name, with configuration options for ignored check IDs and paths. Future enhancements may include support for GitHub links and transitioning from MongoDB to local file storage for easier execution.

The Android BLE Scanner Compat Library provides a unified scanning API for Bluetooth Low Energy devices across multiple Android versions, ensuring backward compatibility with older devices while integrating modern features. Notable functionalities include emulating unsupported Bluetooth features, handling background scanning effectively, and allowing developers to utilize legacy and new advertising packets based on the device's Android version. The library simplifies the implementation process for developers targeting diverse Android platforms, ensuring extended support for Bluetooth interactions in various use cases.

GitRecon is an OSINT tool designed for comprehensive reconnaissance on GitHub and GitLab profiles, extracting sensitive information such as exposed email addresses, SSH keys, and organizational data. It features smart scanning to optimize API usage and prioritize active repositories, deep analysis capabilities for thorough investigation, and network mapping to visualize connections between users. The tool supports multiple output formats and is rate limit aware, ensuring effective performance during scans.

Hidden Char Scanner is a tool designed to detect and classify hidden characters in text, including zero-width and control characters, using `Intl.Segmenter` for grapheme segmentation. Its primary use case is to identify suspicious code points that could facilitate confusables, bidirectional spoofing, or obfuscation in code reviews. Notable features include a per-grapheme risk assessment, an annotated preview interface with tooltips, and the ability to export findings as structured JSON for further analysis.

ScanScore is an open-source optical music recognition (OMR) tool designed to convert scanned sheet music into editable formats like MusicXML and MIDI. It incorporates enhanced OCR capabilities with RapidOCR for multilingual support and utilizes a local LLM for instrument identification, offering features such as an interactive editor for error correction, multi-page score handling, and cross-platform compatibility.

Tsunami is a versatile network security scanner designed to identify high severity vulnerabilities with high accuracy through its extensible plugin architecture. Its primary use case involves leveraging a wide array of plugins to enhance scanning capabilities, with all available plugins hosted separately. This tool provides a robust solution for organizations seeking to bolster their security posture by detecting vulnerabilities in their network infrastructure.

DockerScan is a comprehensive security scanner designed for Docker containers and images, utilizing advanced techniques based on the latest industry research and standards to identify vulnerabilities. Its notable features include support for the CIS Docker Benchmark, supply chain attack detection, and an extensible plugin architecture, enabling users to conduct thorough compliance checks and automate security assessments in CI/CD pipelines. Written in Go for improved performance, DockerScan offers real-time insights into potential security flaws across container environments.

UDPX is a lightweight, single-packet UDP scanner written in Go, capable of discovering over 45 protocols with options for custom services. It operates across multiple platforms (Linux, Mac OS, Windows) and can scan entire /16 networks in approximately 20 seconds. Key features include customizable probes, JSONL output for results, and a concurrent connection setting to balance speed and stability.

xmlrpc-scan is a specialized tool designed for identifying and testing vulnerabilities in the XML-RPC interface of WordPress sites. Its primary use case involves scanning URLs to determine if the XML-RPC interface is open and to test for Server-Side Request Forgery (SSRF) vulnerabilities using various methods. Notable features include generating unique URLs for each SSRF attempt and the ability to work with a list of URLs or a single URL input for targeted assessments.

QLC+ is an open-source lighting control software designed for managing lighting fixtures in live shows, theatre, architectural installations, and various venues. It supports multiple protocols such as DMX, Art-Net, and sACN, ensuring compatibility with a wide range of hardware while offering a user-friendly interface suitable for both novice and professional users. Notable features include functionality on multiple operating systems (Linux, Windows, macOS, Raspberry Pi) and extensive hardware support.

Nmap is a powerful network scanning tool primarily used for network discovery and security auditing. It provides features such as host discovery, port scanning, and service/version detection, making it essential for assessing the security posture of networked devices. Users can interact with it via command-line or utilize its graphical interface, Zenmap, for a more visual representation of scan results.

AuthInspector is a Golang-based tool designed for efficient authorization and authentication testing, specifically for extracting request details from BurpSuite exports. It utilizes Goroutines to conduct comprehensive checks based on user-defined headers and outputs results in a structured CSV format. Notable features include customizable request options, support for proxy configurations, and the ability to include request/response bodies in results.

Payloads All The Things is a comprehensive repository offering a curated list of payloads and techniques specifically designed for web application security testing. It includes detailed documentation on various vulnerabilities and how to exploit them, alongside resources for tools like Burp Intruder. Notable features include structured chapters with vulnerability descriptions, applicable payloads, and a collection of methodologies for diverse security scenarios, making it an essential toolkit for penetration testers and security professionals.

AIO-Pentesting is a comprehensive resource for penetration testers, encapsulating various methodologies, tools, and commands necessary for conducting thorough security assessments. It categorizes content into phases, covering pre-intrusion and intrusion techniques for both Linux and Windows environments, along with additional materials such as notes for certifications like OSCP and OSWE. Notable features include organized documentation on common pentesting stages, forensics, and various exploitation techniques, as well as links to essential vulnerability databases and binary libraries.

Kosty is a comprehensive CLI tool designed for AWS cost optimization and security auditing, capable of scanning over 30 AWS services. Its key features include external attack surface mapping, IAM privilege escalation detection, and specific audits for GenAI workloads like Bedrock and SageMaker, alongside actionable insights on cost savings and security gaps. The tool facilitates organization-wide scanning with parallel processing and offers an interactive visual dashboard for in-depth report analysis.

SecOps-CLI Guides is a curated repository providing PDF command-line cheat sheets and how-to guides tailored for security professionals, facilitating offline reference for key cybersecurity tools and techniques. Notable topics include Metasploit, Nmap, SQLMap, and Active Directory attacks, making it a valuable resource for penetration testing and security operations. The repository invites contributions to expand its collection, enhancing its utility for the security community.

Enumy is a high-performance enumeration tool designed for penetration testing and Capture The Flag (CTF) challenges, facilitating the identification of common security vulnerabilities on target Linux machines. Its features include configurable scan options, the ability to output results in various formats, and support for multithreaded operations to optimize scan speed and efficiency. Suitable for both professional pentesters and hobbyists, Enumy assists users in uncovering security issues during post-exploitation phases.

Rogue is a bash script that automates penetration testing workflows by integrating tools such as Nmap, Metasploit, and John the Ripper. It streamlines the scanning, exploiting, and reporting phases of pentesting, providing a modular and customizable experience for security professionals. Notable features include automated scans, exploitation configuration, credential harvesting, and structured report generation, all initiated with a simple input of a target IP address.

compose-lint is a security-focused linter designed to analyze Docker Compose files for dangerous misconfigurations and enforce best practices. It conducts static analysis to identify issues such as privilege flaws, network exposure, and supply chain vulnerabilities, and can automatically fix unambiguous findings. Grounded in OWASP guidelines and the CIS Docker Benchmark, it serves as a pre-merge gate for infrastructure-as-code, making it essential for production environments and CI/CD workflows.

CryptoLyzer is a comprehensive security auditing tool that analyzes various cryptographic protocols, including TLS, SSL, SSH, IKE, and DNSSEC. It uniquely identifies over 400 cipher suites and cryptographic algorithms using a custom implementation that operates independently of OpenSSL, enabling the detection of vulnerabilities often missed by traditional tools. With both command-line and API interfaces, CryptoLyzer offers versatile output formats and a unified approach, making it an essential solution for security assessments across multiple cryptographic attack surfaces.

ExtensionShield is a Chrome extension security scanner and governance platform that audits browser extensions, producing comprehensive, evidence-linked reports focusing on security, privacy, and governance. It operates in an open-source mode using SQLite, allowing scans of extensions from the Chrome Web Store or local files, with features such as manifest and permission reviews, SAST findings, entropy checks, and integration with VirusTotal for enhanced analysis. Notably, it offers a customizable scoring system to evaluate extensions across critical security and governance dimensions.

Layerleak is an OCI image secret scanner that leverages OCI image internals to analyze public images from various OCI-compliant registries without relying on a local Docker daemon. It offers read-only scanning capabilities, detecting over 60 types of secrets while deduplicating findings by secret fingerprint and collapsing duplicate context snippets. Notable features include support for scanning image layers, config metadata, and history, as well as a built-in HTTP API for integration.

Masscan as a Service is a Python-based tool designed to facilitate rapid port scanning across whole IPv4 ranges using the high-speed masscan utility, allowing users to quickly identify open TCP or UDP ports on their servers. Its primary use case is for security monitoring, alerting users when previously unseen ports become active, thus helping to mitigate the risk of unauthorized access or malicious activity. Notable features include seamless integration into deployment pipelines via scheduling systems, easy installation as a Python package, and upcoming support for nmap to enhance its scanning capabilities for IPv6.

npm-scan is an advanced supply chain threat detection tool designed to identify sophisticated attacks that typical tools like npm audit, Snyk, and Socket often overlook. It excels at detecting obfuscated payloads, credential theft, eBPF kernel rootkits, and various AI-targeted attacks, boasting over 95% confidence in real-world threat scenarios. Key features include comprehensive behavioral pattern recognition and a dual detection approach that enhances compliance and reduces financial liability associated with data breaches.

OpenShield is an open-source Cloud Security Posture Management (CSPM) tool designed specifically for Azure environments, enabling users to detect misconfigurations and improve security compliance by mapping issues to frameworks like CIS, NIST, and ISO 27001. Notable features include a comprehensive misconfiguration scanner, which evaluates over fifty security rules across various Azure services, and the ability to identify classical cryptographic assets that require migration to quantum-safe alternatives. The tool facilitates remediation through a single command, providing a user-friendly approach to enhancing cloud security for startups and small to medium-sized enterprises.

PySentry is a robust vulnerability scanning tool for Python dependencies, designed to audit projects against known security issues by analyzing lock files or manifests and resolving the full dependency tree. Its notable features include support for various dependency formats, integration with multiple vulnerability databases for comprehensive reporting, and capabilities for continuous integration (CI) environments, allowing detailed output formats and customizable failure thresholds. The tool is optimized for speed, utilizing a Rust core for efficient processing and local caching.

TrivySummary is a reporting tool designed to interpret and summarize JSON outputs from Trivy vulnerability scans, facilitating visual and comparative reports for package vulnerabilities. It consolidates vulnerabilities by CVE and provides functionality for generating PDF or JSON reports, comparing scan results over time, and integrating with CI/CD pipelines to enforce security thresholds. Notable features include customizable report generation, integration of EPSS scores for exploitability assessment, and whitelisting capabilities for specific CVEs.

BaseSec is a Static Application Security Testing (SAST) CLI tool specifically designed for JavaScript and TypeScript applications, including Node.js backends and various frontend frameworks. It features 65 security rules across multiple categories, automated framework detection, and advanced capabilities such as taint analysis, dependency checking, and support for AI-powered insights. With zero configuration required for initial use, BaseSec offers multiple output formats and optimized performance through caching and multi-core processing.

Humble is a fast and security-oriented HTTP headers analyzer designed to assess the presence and efficacy of security headers in web applications. Its primary use case is to enhance security by identifying missing or misconfigured headers, making it a valuable tool for cybersecurity professionals and web developers. Notable features include compatibility with Python 3.11 or higher, integration with the DefectDojo platform for result parsing, and inclusion in Kali Linux, making it readily accessible for penetration testing workflows.

Nim Packages Security Audit is a fully automated tool designed to perform security audits on Nim packages and the Nim installation process. Utilizing GitHub Actions and PTrace, it conducts daily audits categorized by package type, allowing users to identify security vulnerabilities efficiently. Notable features include a structured categorization system and automation integrated with cron jobs, enhancing ease of use and continuous monitoring.

The TMAS Scan Action is a GitHub Action that integrates the TMAS (TrendAI™ Artifact Scanner) CLI tool to scan artifacts in the GitHub workspace for open-source vulnerabilities, malware, or sensitive secrets. Notable features include detailed scan results displayed in action logs, summary reports in job summaries, and automated comments on related pull requests, enhancing CI/CD pipelines with security assessments for files, directories, and container images.

ferret-scan is a command-line tool that enables the detection and redaction of sensitive data, such as personally identifiable information (PII) and secrets, from files and streams. Its features include context-aware confidence scoring for detected data, format-preserving redaction, and an intuitive web UI, all while ensuring no data leaves the host machine. The tool is designed for seamless integration into CI/CD pipelines and provides multiple installation methods, being lightweight with no runtime dependencies.

JS-X-Ray is a static application security testing (SAST) tool designed for JavaScript and TypeScript, focusing on detecting malicious patterns, security vulnerabilities, and code anomalies. It leverages an Abstract Syntax Tree (AST) approach for variable tracing and dynamic import resolution, enabling the identification of sophisticated obfuscation and malicious constructs such as data exfiltration and vulnerable coding practices. Notable features include the ability to detect various forms of obfuscated code, flag weak cryptographic algorithms, and provide configurable sensitivity modes for tailored analysis.

Ship Safe is an AI-driven security scanner designed for modern software teams, operating locally within projects to identify vulnerabilities in application code, AI agents, configuration files, and supply chains. Its notable features include offline scanning capabilities, an interactive REPL for real-time scanning and fixing, and comprehensive audits that cover secrets, dependencies, and CI/CD configurations. Moreover, it allows for configuration of AI-backed red-team modes for deeper analysis, all without requiring user signups or API keys.

Bearer is a static application security testing (SAST) tool that scans source code for security and privacy risks by analyzing data flows. It supports a wide range of programming languages and offers features like detection of vulnerabilities in line with OWASP Top 10 and CWE Top 25, as well as identifying sensitive data flows for privacy compliance reporting. Bearer is available in both an open-source CLI version and a comprehensive commercial version, providing advanced analysis capabilities.

OXO is a security scanning framework designed for modularity and scalability, enabling users to efficiently combine various specialized agents to conduct comprehensive vulnerability assessments across a wide range of assets, including IPs, domains, mobile applications, and APIs. Key features include an extensible agent store for community and official tools, a Python-based framework for creating custom agents, and an API-first design that facilitates integration into CI/CD workflows. The tool supports Docker for containerized execution, simplifying deployment and management of security scans.

Prismor is a runtime security tool designed for AI coding agents like Claude Code and Codex, providing features to block dangerous commands, prevent prompt injections, and avoid secret leaks. It also recommends safe supply chain packages and offers an observe mode to monitor agent session activities through a growing self-serve dashboard. Its primary use case is enhancing the security and reliability of AI coding interactions by addressing potential vulnerabilities.

Repo Forensics is a security tool designed to audit untrusted repositories before their integration with AI-agent plugins, skills, and MCP servers. It features a fully local and self-updating detection mechanism with zero dependencies and telemetry, ensuring a secure audit process. The tool supports live scanning against CVEs, incorporates over 800 patterns and 41 correlation rules, and operates effectively in offline environments.

SecObserve is an open source vulnerability and license management tool designed for software development teams and cloud environments, enabling efficient assessment and reporting of vulnerabilities across multiple scanning tools. It features a centralized dashboard for viewing and filtering scan results, as well as easy integration into CI/CD pipelines through pre-defined GitLab CI templates and GitHub Actions for streamlined vulnerability scanning. This tool aims to simplify the vulnerability management process, allowing teams to focus on addressing significant security issues.

Stave is an open-source cloud configuration verifier designed to validate AWS configurations offline and without credentials. Its primary use case is for cybersecurity assessments, allowing users to discover vulnerabilities and attack chains through intuitive commands and built-in templates. Notable features include automated assessment templates for various security jobs, a skill-based onboarding process, and the ability to evaluate snapshots and generate reports based on specified severity thresholds.

Trivy is a versatile security scanner designed for identifying vulnerabilities and misconfigurations across various targets, including container images, filesystems, Git repositories, virtual machine images, and Kubernetes environments. It can detect OS packages, known vulnerabilities, infrastructure as code (IaC) issues, sensitive data, and software licenses. Trivy is easily integrable with popular tools and platforms, supporting a wide range of programming languages and systems, making it a comprehensive choice for security assessments.

VulnerableCode is an open-source database designed to catalog software package vulnerabilities, accessible through a Web UI and a comprehensive API. Its primary use case is to provide detailed information on vulnerabilities affecting software packages, including upstream and downstream impact analysis, thereby facilitating better vulnerability management. Notable features include its focus on Package URLs (PURLs) for easy identification of packages, along with the ability to build custom instances of the database.

Lenspect is a lightweight security threat scanner that utilizes VirusTotal to analyze potential threats. Its primary use case is to provide users with quick and efficient scans for security vulnerabilities within their systems. Notable features include support for installation via Flatpak and AppImage, providing accessibility across various Linux distributions, as well as a user-friendly interface for enhanced usability.

SussyFinder is a PHP web application designed to scan directories for files with specific extensions, particularly PHP scripts, and identify potential malicious content through token and pattern analysis. It features a token-based comparison method that accounts for obfuscation techniques, allows for MD5 hash-based whitelisting and blacklisting, and presents results with color highlights for easy identification. The tool is particularly useful for web server environments but requires cautious use due to the potential for false positives and file deletion capabilities.

Xiaomi MTK Bootloader Unlock is a tool designed to bypass the Dual-Layer Lock Verification for Xiaomi MTK devices running HyperOS or MIUI14+. It enables the unlocking of the bootloader by erasing a specific magic string stored in the Replay Protected Memory Block (RPMB), thus allowing the device to revert to the seccfg unlock state. The tool requires specific hardware conditions and careful execution to prevent common pitfalls associated with USB connections during the unlocking process.

Detect It Easy (DiE) is a versatile file type identification tool designed for malware analysts and cybersecurity experts, employing both signature-based and heuristic analysis to deliver accurate file inspections across Windows, Linux, and MacOS platforms. Its key features include flexible signature management for customizable detection rules, a JavaScript-like scripting capability for tailored analysis, and a comprehensive support for various executable and archive formats. The tool aims to minimize false positives, making it an essential resource for digital forensics and malware detection.

CheatSheet is a comprehensive resource for penetration testers and bug bounty hunters, providing a collection of tools, scripts, and guidelines to streamline various phases of security assessments. It features an extensive list of useful utilities for tasks such as network scanning, web application testing, reverse shell creation, and data encoding, along with guidelines for setting up local web servers. The repository also includes planned features aimed at automating repetitive tasks and enhancing the efficiency of reconnaissance activities in cybersecurity engagements.

FTP Scanner is a lightweight tool designed for penetration testing and Capture The Flag (CTF) challenges, capable of detecting anonymous logins, listing files, and performing banner grabbing. It features heuristic software and version extraction, alongside a local exploit database lookup for identifying potential vulnerabilities based on the FTP server's banner. This portable tool operates as a single Python script, requiring minimal dependencies and offering customizable usage options, including the ability to specify custom ports and vulnerability database paths.

goLoL is a Windows host scanner that specializes in detecting living-off-the-land binaries (LOLBAS) and vulnerable drivers (LOLDrivers) by leveraging a live catalog of techniques and hashes. It provides privilege-aware filtering based on the user's access level and includes features like MITRE ATT&CK mapping, flexible result sorting, and both LOLBAS and driver scanning modes. The tool is designed for security professionals to enhance their understanding of potential attack vectors within a Windows environment.

nmap-reference serves as a comprehensive reference guide for the nmap tool, aimed at both CTF participants and security professionals. It includes a variety of predefined scan combinations, practical flag references, and complementary tools, facilitating efficient network discovery and vulnerability assessment. Key features encompass easy navigation through common nmap commands, scan types, and detailed explanations of scan parameters to streamline penetration testing workflows.

The github-scanner-local tool enables users to locally scan all repositories of a specified GitHub organization. Its primary use case is to identify and analyze URLs within the repositories, facilitating the detection of broken links and dependency management. Notable features include repository cloning, URL extraction, and status code validation for the identified links, along with the capability to search for specific strings across all cloned repositories.

MongoBleed is a high-performance proof-of-concept scanner designed to identify vulnerable MongoDB instances affected by CVE-2025-14847, a pre-authentication heap memory disclosure vulnerability. Utilizing asynchronous I/O with Python's asyncio, the tool efficiently scans large network ranges, ensuring precise detection and minimal false positives by validating response lengths against the requested leak size, while automatically logging vulnerable targets. Additionally, it requires no external dependencies, making it straightforward to deploy in authorized security testing environments.

The Nuclei-MonaCodeScanner repository provides a set of custom Nuclei templates focused on source code security analysis, targeting vulnerabilities such as hardcoded secrets, configuration leaks, debug routes, and exposure of sensitive files. Designed for use in Static Application Security Testing (SAST) and CI/CD pipelines, these templates facilitate the identification of OWASP Top 10 vulnerability patterns within source code, enhancing security assessments and red team activities.

SCADA Scanner and Fingerprinter is a high-performance tool designed for asynchronous scanning and fingerprinting of industrial control systems (ICS) across networks. Its primary use case focuses on detecting vulnerabilities, identifying vendor and product information, and generating detailed risk reports, supporting a variety of protocols such as Modbus and DNP3. Notable features include fast scanning capabilities, protocol detection, vulnerability correlation with CVEs, and detailed logging, ensuring comprehensive risk assessments for authorized security assessments.

Subscan is a high-performance CLI tool designed for subdomain enumeration tailored for bug bounty hunters and security professionals. It offers both passive reconnaissance by leveraging public sources and active DNS resolution capabilities through customizable wordlists, alongside features for subdomain scoring, misconfiguration detection, and diverse output formats. Additionally, it supports concurrency for increased scanning speed and plans to introduce extensibility for plugins in the future.

Vasuki is an automation tool designed for security professionals that streamlines the process of subdomain enumeration and vulnerability scanning. It aggregates multiple reconnaissance tools to identify subdomains, check for subdomain takeover potential, and detect various injection parameters including XSS and SSRF. Notable features include integration with tools like Nuclei for vulnerability scanning, notification capabilities for scan results, and an organized output of findings in text files.

Web Scraper is a Python-based tool designed for web hacking and assessment, featuring a suite of 20 widely-used functionalities for executing various attacks and reconnaissance tasks with a single command. Its notable features include ASN lookups, HTTP header analysis, subdomain discovery, vulnerability scanning, and more, providing users with a comprehensive toolkit for bug bounty and data extraction efforts. It operates on Python 3.7 or higher and is optimized for Linux environments.

CHOMTE.SH is an advanced automation framework designed for reconnaissance tasks in penetration testing, primarily serving bug bounty hunters and security professionals. Its notable features include subdomain discovery, DNS brute-forcing, quick port scanning, HTTP probing, and detailed reporting capabilities, allowing users to identify vulnerabilities and misconfigurations effectively. The tool is customizable through a flags.conf file and supports deep internet reconnaissance and JavaScript analysis to enhance security assessments.

JWTLens is a comprehensive security scanner for JSON Web Tokens (JWTs) integrated with Burp Suite, designed to automatically detect and test for vulnerabilities across a wide array of JWT attack vectors. It incorporates 56 security checks, enabling both passive analysis and active exploitation tactics, including signature bypasses and algorithm confusion. Key features include a JWT Forge tab for live token editing, a built-in secret extractor to identify hardcoded secrets, and efficient request/response scanning capabilities for thorough JWT vulnerability assessments.

The Admin Control Panel Finder is a Perl-based tool designed to identify potential admin login paths on websites, catering primarily to developers and security professionals for authorized testing. It automatically checks common admin panel URLs across various web technologies, such as PHP and ASP, and employs keyword detection for typical login fields, making it a lightweight and beginner-friendly tool for ethical hacking and cybersecurity education.

AdwanceSNI is a command-line tool designed for subdomain discovery and vulnerability scanning on Termux and Linux platforms. Leveraging the capabilities of subfinder for subdomain enumeration and bughunter-go for vulnerability analysis, it features a user-friendly colorful terminal UI, progress indicators, and supports batch processing for multiple domains. This tool is primarily intended for educational and ethical hacking purposes, emphasizing user responsibility for permissions when scanning targets.

JSReconRadar is a robust Burp Suite extension designed for passive reconnaissance of JavaScript files, enabling the detection of secrets, API keys, endpoints, and security misconfigurations in real-time. It features over 1,600 detection patterns, customizable UI elements, advanced filtering options, and supports both Burp Suite Community and Professional editions, making it essential for identifying vulnerabilities in web applications. Noteworthy functionalities include a custom results tab, severity color coding, and the capability to save or export findings for further analysis.

BurpMCP-Ultra is a powerful Kotlin extension for Burp Suite Professional that integrates an MCP server, enabling programmatic control of Burp functionalities via AI agents. It supports 149 structured tools for tasks such as proxy history analysis, scan management, fuzzing, and guided exploitation, all secured through token-based local transport. Notable features include custom scan checks, an extensive real-time dashboard, and hardened localhost security controls.

Claude CyberSecurity Skills integrates Claude Code to assist bug bounty hunters on platforms like HackerOne and Bugcrowd through an automated end-to-end workflow encompassing reconnaissance, vulnerability hunting, validation, and reporting. The tool offers 30 production-grade skills that utilize real tools and custom payloads, allowing users to efficiently execute tasks by simply describing their objectives. Notable features include tailored report templates and a systematic approach to vulnerability identification across multiple phases including pre-hunt, reconnaissance, and vulnerability validation.

Claude Security Research Skill enhances the Claude AI with structured security assessment workflows, enabling it to effectively manage and execute security research across multiple phases, including reconnaissance, vulnerability scanning, and reporting. Notable features include tool chaining, automated phase management based on target types, and the capability for Claude to interpret tool outputs, suggest subsequent actions, and compile professional assessment reports. This skill integrates seamlessly into Claude's environment, facilitating detailed and methodical security assessments without generating payloads or exploit code.

ExplorerPy is an information-gathering reconnaissance toolkit that enables users to perform subdomain enumeration, directory brute-forcing, and port scanning on a specified domain. It features multithreaded execution for enhanced performance, customizable options for wordlists and timeouts, as well as capabilities for User-Agent and HTTP header spoofing to simulate legitimate requests. This tool is designed for both educational and testing purposes, ensuring a comprehensive approach to domain analysis.

gitghost is a tool designed to scan public GitHub repositories for exposed secrets, including those that may have been committed in the past and then deleted. It thoroughly searches through git history to identify vulnerabilities and presents findings in an HTML report complete with direct links to the locations of the secrets, as well as a guide on how to remediate the issues. Notable features include the ability to generate an exposure score, scan for various types of sensitive information, and run local scans without installation.

Hgrab is a lightweight framework designed for scanning various web-based software applications over specified ports using minimal bandwidth. It supports a diverse set of applications, including VMware vCenter and Apache NiFi, enabling users to easily identify and interact with these services via simple command-line inputs. Notable features include the ability to list available software for scanning and the integration with external tools like ZMap for efficient scanning operations.

Monitoring Monster (MonMon) is an automation tool designed for bug bounty hunters that facilitates real-time monitoring of target systems for changes, such as new subdomains or scope expansions. Key features include a smart diff engine for tracking modifications across multiple endpoints, support for alerts via platforms like Slack and Discord, and a user-friendly dashboard that allows for comprehensive task management and historical data reviews. The tool is built in Go and supports easy deployment via Docker, enabling seamless integration into security workflows.

ps.sh is a Bash script designed for automated port scanning on specified target hosts, enhancing scan efficiency and reducing time. It offers features such as service discovery through various workflows using Nmap and Masscan, as well as support for scanning multiple targets simultaneously. Notably, users can customize target ports and output directories, making it a versatile tool for network exploration.

Subfind3r is an advanced subdomain enumeration tool designed to enhance and address limitations found in the original Sublist3r project. It supports various features, including brute force enumeration, port scanning of discovered subdomains, and the ability to specify different passive DNS API sources, making it highly customizable for security researchers performing domain reconnaissance. The tool can be easily installed via pip, facilitating a user-friendly setup process.

X-POSURE v4.0 is an autonomous credential intelligence platform designed for discovering, extracting, correlating, verifying, and reporting exposed secrets across an organization's entire attack surface. Its primary use case is to enhance security by identifying vulnerabilities related to exposed credentials, further augmented with features like recursive crawling, Shodan integration, AI-powered contextual analysis, and deep secrets scanning via TruffleHog. This tool is engineered for advanced users who recognize the significance of credential exposure as a substantial security threat.

Bug Bounty is a comprehensive knowledge base designed for security researchers, penetration testers, and bug bounty hunters, featuring methodologies, cheatsheets, automation tools, wordlists, and real-world write-ups. Its primary use case involves equipping users with the necessary resources for web penetration testing, API security, cloud exploitation, and modern vulnerability assessment techniques. Notable features include battle-tested methodologies and a focus on ethical hacking practices, underscoring the importance of authorized testing only.

The "kali-dockerized" repository provides Docker images for Kali Linux and Ubuntu 26.04, tailored for bug bounty programs, penetration testing, security research, computer forensics, and reverse engineering. Key features include the use of the official Kali Linux Docker image with systemd support, compatibility with Docker's host network driver for enhanced performance, and tools for local deployment on Kubernetes clusters. The setup also includes installation instructions for utilities such as Dive for image exploration and Trivy for vulnerability scanning.

open·kritt is an open-source security research platform designed to orchestrate AI agents for the identification and validation of vulnerabilities in code repositories. It enables users to create custom workflows for security research, run scans on local or remote codebases, and prioritize findings with configurable severity rankings and automatic de-duplication. Notably, it supports integration with various AI model providers, allowing for flexible model access and requiring minimal setup for operation.

ReconFusionAI is an AI-powered web asset scanner designed to detect exposed secrets, credentials, PII, and vulnerabilities across web applications with high accuracy through a comprehensive library of over 1,183 detection patterns. Its notable features include advanced contextual analysis using Ollama for improved understanding of data context, a modular architecture allowing for easy updates, and dual output formats that provide detailed findings and reconnaissance intelligence. Additionally, it incorporates intelligent caching mechanisms and production-hardened capabilities for efficient and robust operation.

SecureStack provides an all-in-one GitHub Action designed to enhance security across GitHub project workflows by integrating several security analyses into a single step. It performs sensitive data detection, software composition analysis for vulnerable dependencies, scans for cloud misconfigurations and web vulnerabilities, and generates a Software Bill of Materials (SBOM) for comprehensive security coverage. Notable features include customizable severity settings for different analyses and a user-friendly setup utilizing GitHub Secrets for API key management.

Alcide Kubernetes Advisor is an agentless tool designed for auditing and ensuring compliance of Kubernetes clusters, focusing on enhancing DevSecOps workflows by providing early security scans. Its notable features include vulnerability scanning of Kubernetes infrastructure, detection of misplaced secrets and excessive access permissions, workload hardening, and application of security best practices for Istio and Ingress Controllers. The tool seamlessly integrates into CI/CD pipelines and offers a baseline profiling capability to streamline issue detection pertinent to a specific cluster.

The Aqua Jenkins MicroScanner Plugin facilitates the scanning of Docker builds within Jenkins for OS package vulnerabilities, ensuring the security of containerized applications. It integrates seamlessly into both Freestyle and Pipeline jobs, allowing users to configure vulnerability scans as part of their build process. Notable features include customizable actions for handling high-severity vulnerabilities, detailed scanning output in both console and HTML formats, and ease of setup requiring only Docker installation and token configuration.

AVAIN is an automated vulnerability analysis framework designed for IP-based networks, leveraging a modular architecture to conduct comprehensive assessments of both networks and individual hosts. It features collaborative modules that facilitate reconnaissance, vulnerability correlation, and active detection of security issues, culminating in a vulnerability score to gauge overall security. Noteworthy capabilities include simple result sharing, extensive module configurability, and the ability to integrate various tools, making it a robust platform for penetration testing and security evaluation.

The "Awesome Software Supply Chain Security" repository provides a curated list of tools and resources aimed at enhancing security throughout the software supply chain lifecycle. It covers various aspects, including Software Bill of Materials (SBOM), Software Composition Analysis (SCA), Static Application Security Testing (SAST), and tools for secret detection and malware analysis. Notable features include extensive categorizations of tools for CI/CD practices, Kubernetes security, and risk management, offering a comprehensive landscape for professionals seeking to bolster supply chain integrity.

badmoodle is a community-driven vulnerability scanner designed specifically for Moodle platform instances, aimed at penetration testers and security researchers. It identifies both official and community-discovered vulnerabilities, allowing users to operate in check mode for detection or exploit mode to validate and leverage identified vulnerabilities. Notable features include its modular architecture for easy integration of community vulnerability modules, multiple testing levels, customizable output options, and capability to scrape the latest vulnerabilities from Moodle's security resources.

Burp Bounty is an extension for Burp Suite designed to enhance the capabilities of its scanning features by providing additional profiles for both active and passive scanning. Its primary use case is to facilitate vulnerability assessment by identifying misconfigurations and sensitive information exposure in various environments, particularly in Linux configurations. Notable features include predefined profile sets for scanning multiple common configurations and vulnerabilities, such as Apache2, MySQL, and JWT tokens.

clj-nvd is a Clojure tool designed to check dependencies specified in `deps.edn` against known security vulnerabilities from the National Vulnerability Database. It offers commands such as `check`, `update`, and `purge`, and generates detailed reports on vulnerabilities, with configuration options available through a dedicated `clj-nvd.edn` file. This tool acts as a wrapper around the existing lein-nvd, utilizing its functionality while adapting it for the Clojure tools.deps ecosystem.

Collector is an automated tool designed for identifying XSS vulnerable parameters across entire domains by leveraging the Wayback Machine. Key features include comprehensive crawling of websites and JavaScript files, advanced error handling, and the capability to collect GET parameters. This tool facilitates a systematic approach to vulnerability assessment in web applications.

Lacework Auto Scanner is a tool designed to automate vulnerability assessments for active containers in a Lacework account, streamlining the scanning process via its API or inline scanner capabilities. It efficiently utilizes a local cache to skip rescans of recently assessed containers, with flexible configuration options for scan frequency and targeted registries. Notably, it supports Inline Scanning for containers lacking registry integration, enhancing its versatility and effectiveness in diverse environments.

CORS-Scanner is a Go-based tool designed to identify CORS misconfiguration vulnerabilities in web applications. It allows users to specify origin headers and cookies for testing and processes line-delimited domains to check for vulnerabilities such as reflected origins with credentials and wildcard configurations. Notable features include customizable options for origin headers and cookie handling, as well as the capability to input multiple domains efficiently for scanning.

The "cybersecurity-dynamic-analysis" repository is a curated collection of dynamic application security testing (DAST) tools, libraries, and frameworks aimed at enhancing vulnerability scanning processes. It primarily assists developers and security professionals in identifying and debugging vulnerabilities that static analysis may overlook, by evaluating applications during runtime. Notable features include support for multiple programming languages and links to various tools like Microsoft IntelliTest, KLEE, and Valgrind for dynamic analysis tasks.

DorkScanner is a search engine dorking tool that allows users to scrape search engines for vulnerable URLs based on user-defined queries. It is primarily used by security auditors and researchers to uncover hidden information on public websites. Notable features include support for multiple search engines (Google and Bing), customizable query parameters, and the ability to specify the number of pages and processes for enhanced searching efficiency.

Erebus is a configurable parameter-based vulnerability scanner that utilizes YAML templates to identify vulnerabilities across multiple targets efficiently, ensuring zero false positives. Its notable features include an intercepting proxy that allows users to dynamically test parameters as they browse web applications, along with built-in support for updating and downloading community-contributed vulnerability templates. This tool is designed for rapid scanning of large networks, making it ideal for penetration testers and cybersecurity researchers.

FazScan is a versatile vulnerability scanning and penetration testing tool implemented in Perl, designed to assess various web vulnerabilities, including SQL injection and CMS-specific weaknesses. With 18 distinct options, it enables users to perform automated scans for common vulnerabilities, detect content management systems, bypass WAF protection, and even conduct denial of service attacks. Its cross-platform compatibility allows for deployment on Linux, Windows, and Android systems.

FireStorePwn (fsp) is a vulnerability scanner designed to analyze APK files for weaknesses in Firestore database security configurations, assessing both authenticated and unauthenticated access. Its primary use case is to identify insecure rules that could allow unauthorized data manipulation or access, potentially resulting in data theft and increased billing. Notable features include the ability to scan APKs with or without authentication using both user credentials and tokens.

The Frey-Rück Attack implementation allows for the extraction of the ECDSA secret key ("K") from vulnerable Bitcoin transactions. This tool is particularly useful for cryptocurrency analysts and researchers studying signature vulnerabilities in blockchain protocols, enabling them to restore Bitcoin wallets by solving the discrete logarithm problem through compromised signatures. Notable features include practical examples of vulnerable Bitcoin addresses and methodologies for conducting cryptanalysis efficiently.

Gopo is a proof-of-concept (PoC) framework designed for generating and executing multiple exploitation scripts compatible with XRAY V2's PoC functionality. It facilitates vulnerability scanning by allowing users to load and execute predefined or custom PoCs against specified targets, with options for proxy settings, threat management, and debugging features. Notable capabilities include the ability to handle rules with logical expressions, multi-threaded scanning, and customizable execution parameters to optimize performance and accuracy.

HexRays Toolbox (hxtb) is a versatile set of IDAPython scripts designed for identifying and analyzing code patterns in binaries across various processor architectures. Its primary use cases include vulnerability scanning, malware analysis, and proving code similarities, thus making it valuable for security analysts and reverse engineers. Notable features include a user-friendly GUI via hxtb_shell for query formulation, custom scripting capabilities, and batch processing scripts for enhanced automation.

htk-lite is a streamlined version of the hackers-tool-kit, maintaining essential hacking capabilities while being lightweight. Its primary use case is to facilitate various penetration testing tasks. Notable features include easy installation with a simple Git clone, user-friendly command execution, and an update script for keeping the tool current.

The Jaeles Signatures repository provides a collection of default signatures for the Jaeles project, a framework designed for security scanning and vulnerability detection. Its primary use case is to enhance the scanning capabilities of Jaeles by allowing users to implement custom and predefined signatures targeting specific vulnerabilities, misconfigurations, and sensitive information. Notable features include easy integration with Jaeles, the ability to configure and reload signatures, as well as support for active and passive detection methodologies.

The Enlightn Security Checker for Laravel is a tool designed to identify dependencies with known security vulnerabilities within Laravel applications. Utilizing an Artisan command, it allows developers to scan their composer.lock file for issues, with options to customize output format, exclude development dependencies, and manage caching directories for advisory databases. Notable features include flexibility in command parameters and integration with Composer for effective vulnerability management.

Log4J Detector is a scanning tool designed to identify vulnerable versions of the Log4J library, specifically addressing critical CVEs such as CVE-2021-44228 and related vulnerabilities. It meticulously analyzes the entire file system, including nested applications, to locate Log4J instances, even those obscured within complex structures like uber jars. Supporting multiple operating systems, this tool provides detailed reporting on the safety status of detected Log4J versions, facilitating comprehensive vulnerability assessments.

MiDas is a transformer-based tool designed for detecting vulnerability-fixing commits in software projects by utilizing a multi-granularity approach that examines commits at various levels (commit, file, hunk, line). Notable features include seven distinct feature extractors that leverage CodeBERT for contextual representation, enabling effective identification and extraction of relevant commit features. This tool facilitates improved vulnerability management and can be replicated using specific training processes and dataset requirements.

MyBBscan is a Python-based tool that scans the `/inc/plugins/` directory of MyBB 1.8 forums for known vulnerabilities in plugins. Its primary use case is to identify outdated or vulnerable plugins that could pose security risks, facilitating proactive remediation efforts. Notable features include simple command-line execution and clear user prompts for scanning specific forum URLs.

Nessusbeat is a Beat designed to monitor a local Nessus vulnerability scanner's reports directory, facilitating the export, parsing, and output of scan results to various supported Beat outputs. Its primary use case is to enhance vulnerability management workflows by automating the reporting process. Notable features include configurable report paths and potential future enhancements to support remote polling and API-based authentication.

OrgASM is a modular attack surface mapping tool designed for discovering and enumerating potential vulnerabilities within a target's ecosystem, such as subdomains, IPs, and services. It integrates seamlessly with other tools like nuclei for scanning and wappalyzer for service detection, offering features such as a customizable configuration file, pivoting to related FQDNs, and the ability to automate scans using community APIs. Users can extend its functionality by adding custom APIs and tools, making it highly adaptable for various cybersecurity needs.

The OWASP ZAP API scripts facilitate automated security testing for web applications by integrating with the OWASP ZAP penetration testing tool. Key features include scripts for API authentication and context management, allowing for streamlined attack simulations on platforms like Hackazon. These scripts are designed to be placed in specific directories within the ZAP framework for optimized functionality.

Packj is a GitHub Action that audits pull requests for malicious or risky open-source dependencies across NPM, PyPI, and RubyGems ecosystems. It employs static, metadata, and dynamic analysis to identify security vulnerabilities, flagging packages based on over 40 risky attributes derived from extensive research on supply chain attacks. Notable features include the ability to integrate seamlessly into GitHub workflows and provide feedback via comments on pull requests when risky dependencies are detected.

PathGro is a tool that enhances security testing by taking a brief list of path strings and generating extensive mappings through combinatorial growth, facilitating comprehensive path enumeration. It is primarily designed for dirbusting and forced browsing techniques to maximize attack surface coverage for software components handling pathnames. Notably, PathGro is implemented as a set of GNU Guile modules, providing command-line interface capabilities that allow for various combination generation methods.

R3CON is a multifunctional web reconnaissance and vulnerability scanning tool designed for rapid crawling and detailed vulnerability detection across various attack vectors, including XSS, SQL injection, and open redirections. It offers multi-threaded crawling capabilities and extensive reconnaissance features, such as DNS lookups, subdomain enumeration, and identification of vulnerable libraries. The tool allows users to perform both active and passive scans, providing a comprehensive solution for web application security assessments.

Repo Lookout is a large-scale security scanner designed to identify publicly exposed source code repositories that may contain sensitive information, which could lead to security incidents like data leakage and ransomware attacks. Its primary use case is to automatically detect such vulnerabilities and report them to the relevant domain's technical contact. Notable features include its focus on combating repository exposure and providing resources for mitigations related to various server software.

Scanvus is a credentialed authenticated vulnerability scanner designed for Linux hosts and Docker images, utilizing external vulnerability detection APIs such as Vulners and Vulns.io for comprehensive assessments. It supports various assessment types including localhost scans, remote SSH connections with key or password authentication, and scanning of Docker images. Notable features include detailed vulnerability reporting, interoperability with external APIs, and the ability to inventory target hosts.

Enlightn Security Checker is a command-line tool designed to identify dependencies in your application with known security vulnerabilities by leveraging the Security Advisories Database. Its primary use case is to enhance application security during development, allowing for checks against defined vulnerabilities through commands that can display results in various formats and exclude development dependencies. Key features include customizable output formats, the ability to exclude certain vulnerabilities, and an API for integration into other codebases.

SQLi-Hunter is an HTTP/HTTPS proxy server that serves as a wrapper for the SQLMAP API, designed to simplify the process of detecting SQL injection vulnerabilities. Its primary use case is to facilitate web application testing by providing tools for sending requests through a proxy, while also offering configurability for SQLMAP injection techniques, threading, and user-agent customization. Notable features include Docker support for easy deployment, the ability to persist output files, and various options to target specific hosts and adjust testing parameters.

sqlmap is an open-source penetration testing tool designed to automate the detection and exploitation of SQL injection vulnerabilities in web applications. Its robust detection engine supports extensive capabilities such as database fingerprinting, data retrieval, and command execution on the underlying operating system, making it an essential tool for security professionals. Key features include a variety of switches for advanced testing, support for multiple databases, and the ability to access the file system via out-of-band connections.

SubDover is a multi-threaded subdomain takeover vulnerability scanner written in Python 3, featuring over 88 fingerprints of potentially vulnerable services. It incorporates a built-in subdomain enumeration method and utilizes CNAME records for verification, allowing for quick scanning of both individual targets and lists of subdomains. Notable features include configurable threading for performance optimization, result saving capabilities, and a clean output format, making it a versatile tool for security professionals.

TopScan is an automated web vulnerability scanner designed to quickly identify security weaknesses in web applications. Its primary use case includes subdomain enumeration, active subdomain verification, and vulnerability checks for XSS, information disclosure, and subdomain takeover, among other features. Notable functionalities include gathering WHOIS information, extracting URLs from sitemaps, and detecting hidden servers and admin panels.

Vulmap-Windows is a network vulnerability mapping tool designed for Windows environments that identifies potential security vulnerabilities across various network services. Its primary use case is to assist security professionals in assessing network risks by providing comprehensive views of exploitable vulnerabilities. Notable features include automated scanning, integration with various vulnerability databases, and customizable reporting options.

vuln-scanner-flask is a web application designed for scanning vulnerabilities within websites and performing network exploitation and reconnaissance. Its notable features include an intuitive user interface, fast scanning capabilities, and functionalities for scheduling assessments and generating reports. The tool aims to facilitate security assessments while ensuring user-friendliness and security.

vulnscan-parser is a Python tool designed to parse and normalize results from various security scanning tools such as Nessus, Nmap, and Metasploit into a consistent object-oriented structure. It supports multiple file formats, allowing for efficient parsing of large files without memory issues while accommodating various output formats and structures. Key features include the ability to handle overlapping files, retain unique host objects, and extract relevant security findings for further analysis.

VulScanPro is an automated web vulnerability scanner designed to identify security weaknesses in domains through over 100 attack vectors, including SQL injection and Cross-Site Scripting. It not only detects vulnerabilities but also provides detailed descriptions and potential solutions for each issue. The tool features command-line options for customizable scanning, including the ability to skip certain tools for faster results.

Web-Fuzzer is a robust web application fuzzing tool designed to automate the identification of vulnerabilities such as XSS, SQL injection, and command injection. Utilizing technologies like Selenium and BeautifulSoup, it crawls web applications to collect internal URLs, detects forms and input parameters for fuzzing, injects payloads, and analyzes responses for potential security flaws. Notably, it supports various injection types and can be used in testing environments like DVWA, with further enhancements planned for threading support and proxy usage.

WordPress_AutoExploiter is a cybersecurity tool designed for exploiting vulnerabilities in various versions of WordPress, including Stored XSS, XML-RPC DDoS, and SQL Injection. Its primary use case is for penetration testing and security assessments to identify weaknesses in WordPress installations. Notable features include targeting specific vulnerable versions and facilitating exploitation techniques through a user-friendly interface.

The OWASP ZAP project is a leading open-source web application security scanner designed to identify vulnerabilities in web applications during development and deployment. Its primary use case involves automated security testing, providing tools for both developers and security professionals to facilitate vulnerability detection and remediation. Notable features include a user-friendly interface, extensive API support, and a variety of plugins to enhance its scanning capabilities.

XAttacker is a web vulnerability scanner designed to automate the detection of security weaknesses in web applications. Its primary use case is to identify vulnerabilities such as SQL injection and cross-site scripting (XSS) through a user-friendly interface and customizable attack payloads. Notable features include multi-threaded scanning, a comprehensive report generator, and support for various web technologies.

XForwardy is a Host Header Injection scanning tool designed to identify potential misconfigurations that may allow for Host Header Injections, as well as checking for CORS misconfigurations in specified URLs. It is a lightweight tool requiring minimal dependencies and is straightforward to install and execute.

BeeXSS is an automated tool that identifies Blind XSS (Cross-Site Scripting) vulnerabilities in web applications by scanning URL parameters and injecting payloads. Its notable features include the use of customizable Blind XSS-specific payloads, headless browsing via Selenium WebDriver for efficient scanning, and detailed reporting of potential vulnerabilities. The tool is intended for educational and ethical penetration testing purposes, ensuring users have permission to test the targeted applications.

Bsqli is a customizable vulnerability scanner designed to identify SQL injection vulnerabilities using a targeted payload list, ensuring high accuracy with minimal false positives. It is optimized for rapid scanning across multiple hosts and supports multithreading for enhanced performance. Notable features include support for both single URL and file-based target inputs, as well as options for output management and SSL verification settings.

The Firmware Analysis Toolkit (FAT) is designed to assist security researchers in analyzing and identifying vulnerabilities within IoT and embedded device firmware by providing automated firmware emulation capabilities based on Firmadyne. Key features include the ability to run firmware images in a controlled environment without the need for a PostgreSQL database, as well as streamlined setup and interaction via Python scripts, enabling real-time testing and network interface configuration.

The Harbor Scanner Adapter for Aqua Enterprise serves as a bridge between the Harbor scanning API and Aqua Enterprise's scanning capabilities, enabling vulnerability scanning of container images stored in the Harbor registry. Notable features include its implementation of the Pluggable Scanners API, which allows for ad hoc scanning and the generation of vulnerability reports, while also requiring specific version dependencies and configurations to function properly. The adapter does not provide visibility or enforcement for Aqua's image assurance policies, which must be managed via the Aqua Management Console.

LMAP (Large Language Model Mapper) is an out-of-the-box evaluation tool for large language models (LLMs), aimed at aiding developers and compliance teams in assessing security and safety risks associated with LLM deployments. It includes features such as universal HTTP access for various LLMs, a user-friendly GUI for ease of use, multi-objective testing capabilities, automated and manual redteaming modules, and customizable datasets for specific applications. Additionally, LMAP streamlines the evaluation process by generating formatted reports compatible with CI/CD pipelines, ensuring comprehensive vulnerability assessment pre- and post-deployment.

The Cracked Nessus in Docker repository provides a Dockerized version of the Nessus vulnerability scanner, facilitating easy setup and deployment. Its primary use case is to enable security professionals to run Nessus scans in a contained environment, allowing for quick administration and updates via simple Docker commands. Notable features include automated installation through Docker, a straightforward user interface accessed via a web browser, and commands for migrating data between container versions.

The network-vulnerability-scanner is a tool designed to identify vulnerabilities within networked systems by analyzing hosts and services for known security flaws. Its primary use case is to enable network administrators and security professionals to assess the security posture of their network infrastructure. Notable features include support for various network protocols, customizable scanning options, and detailed reporting on discovered vulnerabilities and recommended mitigations.

This repository provides a structured introduction to offensive techniques that exploit neural networks, focusing on areas such as bug hunting, malware injection, and information extraction. Each technique is accompanied by practical exercises to facilitate hands-on learning. Notable features include detailed instructions for setting up a Python environment and using various ML tools, as well as a diverse range of attack scenarios aimed at enhancing understanding of security vulnerabilities in neural networks.

NextSploit is a command-line utility for detecting and exploiting the Next.js vulnerability identified as CVE-2025-29927. It automates the process of identifying vulnerable Next.js versions and attempts to exploit the flaw by bypassing middleware protections, potentially allowing unauthorized access to restricted content. Notable features include automated version detection using Wappalyzer, mass URL scanning capability, and an integrated Chrome browser launch for exploitation tests.

RevOK is a cybersecurity tool designed to simulate malicious targets for testing security scanners and software that processes attacker-controlled data. Its core feature, the "stub" component, allows users to listen for incoming requests and serve crafted attack responses based on customizable templates and substitution lists. Notably, RevOK has been utilized to identify critical vulnerabilities, including XSS to RCE bugs in Metasploit Pro, highlighting its effectiveness in researching and weaponizing security scanner vulnerabilities.

StealthNewSQL is an advanced command-line tool designed for detecting, exploiting, and securing NewSQL database vulnerabilities. It features capabilities such as DNS-based data exfiltration, advanced WAF evasion techniques, automated exploitation, and seamless integration with CI/CD pipelines, making it suitable for penetration testers, security researchers, and developers focused on database security. Notable functionalities include real-time monitoring, comprehensive reporting, and a modular plugin system for extending its capabilities.

The Vulnerability Scanner is a user-friendly tool designed for beginners in cybersecurity, capable of scanning systems for vulnerabilities and gathering information on potential targets. It includes features like DNS enumeration, OS detection, service/version detection, and integration with the OWASP ZAP for comprehensive security assessments. The tool is specifically built for Kali and Parrot Linux environments and requires minimal prior knowledge, making it an ideal starting point for aspiring security professionals.

wacat is an automated web application testing tool that simulates chaotic input by navigating through a web application's links and forms in a random manner, providing comprehensive testing coverage. It offers advanced features like AI-driven error detection and content generation, supports various configurations for authentication, and can run in headless mode suitable for Continuous Integration (CI) pipelines. Built on Playwright, wacat is designed for user-defined behaviors and can detect a range of issues, making it ideal for thorough application assessments in a controlled environment.

The Xray automation script is a Bash utility designed for scanning websites for vulnerabilities using the Xray tool. It provides functionalities to scan multiple URLs from a text file or a single URL, with the added capability to download and install Xray if it is not already present. Notable features include comprehensive help documentation and the ability to output scan results both to a file and the terminal.

A.S.E (Automated Security Evaluator) is a vulnerability management tool designed to automate the process of evaluating software security by integrating with OWASP Dependency-Track. Its primary use case is to assess vulnerabilities based on real-world exploitability and notify relevant teams via Slack, leveraging CVE scoring models such as CISA KEV and EPSS. Notable features include the automation of CycloneDX SBOM generation, tiered alerting for critical vulnerabilities, and configurable thresholds for alerts sent to teams.

ALNUR is an open-source end-to-end vulnerability scanner that evaluates application projects for security weaknesses, including CVEs in dependencies and potential risks in architecture, secret leaks, and agentic AI applications. Notable features include a comprehensive CVE scanner, in-depth architecture and standards compliance analysis, and support for various programming languages and frameworks, with customizable reporting options. The tool also offers optional LLM-enhanced analysis for generating executive summaries and remediation guidance.

OWASP ASST (Automated Software Security Toolkit) is an open-source, command-line web vulnerability scanner primarily focused on detecting security flaws in PHP and MySQL applications, while also capable of being extended to support additional programming languages. It provides detailed reports that not only identify vulnerabilities but also offer explanations and remediation strategies, thus educating developers on securing their code. ASST uniquely aligns its scanning approach with the OWASP Top 10 Web Application Security Risks, enhancing its effectiveness in comprehensive vulnerability assessment.

aur_checker is a command-line security analysis tool designed for inspecting Arch Linux AUR PKGBUILD files to detect potential vulnerabilities. It employs a context-aware static analysis methodology, optionally enhanced with AI inspection, resulting in detailed risk assessments that include trust signals and explainable scoring. Key features include a user-friendly output format, JSON integration for CI purposes, and the ability to analyze multiple packages or files simultaneously.

BRS-XSS is an advanced XSS vulnerability scanner designed for modern web applications, providing deterministic and auditable detection capabilities. It features context-aware scanning, WAF evasion techniques, and a comprehensive knowledge base for payload management, along with a user-friendly web interface that supports real-time monitoring, detailed reporting, and customizable scanning options. Notably, it includes a Pentesting Task Tree strategy engine for adaptive testing, A/B testing for strategy comparison, and multiple report formats for enhanced analysis.

BurpAPISecuritySuite is a professional-grade extension for Burp Suite that consolidates multiple functionalities for API reconnaissance, intelligent fuzzing, and AI-enhanced security testing into a single interface. It is designed to improve performance and usability by sharing resources across various tabs, thereby minimizing memory usage and CPU overhead while maintaining a stable and efficient testing environment. Notable features include support for REST, GraphQL, and SOAP APIs, as well as tools for passive discovery, fuzzing, and advanced security assessments based on the OWASP API Top 10 guidelines.

Cache Commander (ccmd) is a terminal UI tool designed for exploring, auditing, and managing developer cache directories on macOS and Linux. Its primary use case is to help developers identify and clean up accumulated cache data, scan for known CVEs, and manage outdated dependencies, all through an intuitive two-pane interface that supports multiple cache providers. Notable features include vulnerability scanning, reclaiming disk space from various cache types, and integration with AI for enhanced capabilities.

CloudDefense.AI is an automated web application security testing tool designed to identify vulnerabilities such as SQL injection and cross-site scripting, enhancing overall application security. It supports various security assessments including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and API scanning, facilitating a DevSecOps approach by integrating security assessments seamlessly into the development lifecycle. Notable features include its comprehensive application stack risk assessments and compatibility with multiple programming languages and integration points.

The cent-nuclei-templates repository provides a curated collection of 9,284 high-quality nuclei templates, generated and filtered through the cent tool for use with the Nuclei scanner. Its primary use case is to enhance vulnerability scanning by offering templates that are free from duplicates, noise, and outdated syntax, thereby improving accuracy and effectiveness in detecting vulnerabilities. Notable features include extensive deduplication processes, community-sourced additions, and ongoing maintenance scripts to ensure template quality and relevance.

Chaca is a native desktop web security scanner designed specifically for developers, providing fast and opinionated security audits of web applications through a user-friendly interface without requiring terminal use. It features both passive and active scanning capabilities, support for numerous content management systems and APIs, and generates detailed reports with filtering and export options. Additional highlights include a real-time progress dashboard, persistent scan history, and customizable scan presets, all built on a tech stack utilizing Rust, React, and Tauri.

Claude Cybersecurity is an AI-powered code security audit tool designed to enhance vulnerability detection and compliance verification through the integration of 8 parallel specialist agents. It stands out by addressing issues often overlooked by static analysis tools, such as business logic flaws and contextual authorization checks, while supporting a broader range of programming languages and providing in-depth threat intelligence. Notable features include seamless integration with Claude Code, zero configuration requirements, and extensive coverage of vulnerabilities including IaC and container security.

Claude Pentest Skills is a structured penetration testing skill pack designed for Claude Code that employs an OWASP-based methodology to streamline web application security assessments. It features a 6-gate validation process to filter out false positives, a series of interactive slash commands for efficient testing, and automated report generation in both markdown and PDF formats, ensuring compliance with verification and documentation standards. The tool improves the efficiency and reliability of pentesting workflows by maintaining consistent coverage tracking and enforcing scope before testing.

ClawSecure is an independent security scanning and auditing platform designed for the OpenClaw ecosystem, which focuses on ensuring the integrity and safety of AI agent skills and workflows. It features a proprietary 3-Layer Audit Protocol that has examined over 3,000 skills against all OWASP ASI Top 10 security vulnerabilities, revealing that 41% of audited skills contain security flaws. It also offers free developer tools to enhance functionality and user experience within the OpenClaw framework.

CloudVault is an enterprise-grade security scanner designed for multi-cloud storage environments, specifically targeting AWS S3, Google Cloud Storage, and Azure Blob. It offers advanced attack chain analysis, automated permission checking, and comprehensive risk scoring, facilitating real-time discovery of exposed cloud resources through certificate transparency monitoring. Notable features include interactive text user interface (TUI), alerts integration with communication platforms, compliance mapping, and various export formats for reporting and remediation.

CorsOne is a specialized security testing tool for detecting Cross-Origin Resource Sharing (CORS) misconfigurations in web applications. It efficiently tests over 40 CORS bypass techniques, providing accurate results with low false positives and supporting advanced features such as customizable origin testing, proxy configurations, and multiple output formats for comprehensive reporting. The tool employs asynchronous operations for high performance and includes options for easy integration and flexible request handling.

Critikal is an autonomous security research agent specifically designed for smart contracts, capable of identifying exploitable vulnerabilities in blockchain protocols through a comprehensive analysis process. It ingests repository data, performs reconnaissance, maps the attack surface, and validates its findings, generating proof-of-concept tests using Foundry along with detailed audit reports in HTML and Markdown formats. Notable features include multi-model support for AI analysis, an integrated knowledge graph, and a user-friendly TUI demo for easy interaction.

The Flowise Dual CVE PoC is a proof-of-concept tool for exploiting two critical vulnerabilities (CVE-2025-58434 and CVE-2025-59528) in the Flowise platform, enabling an attacker to achieve unauthenticated account takeover followed by remote code execution in an automated manner. It leverages a flawed password reset mechanism and unsanitized user input in JavaScript execution to facilitate these exploits, making it particularly dangerous for both cloud and self-hosted deployments. The tool includes modular functionality for conducting attacks and is intended solely for authorized security research purposes.

DiscourseMap is an advanced security scanner designed specifically for Discourse forum platforms, offering over 25 specialized security modules for comprehensive assessments. It features capabilities such as CVE detection, plugin analysis, and API testing, all optimized for quick performance and reliability, delivering detailed reports in multiple formats. The tool is well-suited for vulnerability detection and compliance verification, making it essential for securing Discourse environments.

Docker Registry UI provides a modern web interface for managing Docker registries with enhanced features such as vulnerability scanning through Trivy, bulk operations, and multi-registry support. It facilitates repository and tag management while offering storage analytics and a responsive design. The tool is designed for both local and production setups, allowing users to quickly deploy and manage registries efficiently.

The HackerAI Framework (Project Sirra) is a modular security testing environment tailored for ethical hackers and security researchers, emphasizing cross-platform compatibility including mobile devices. It features a universal orchestrator for module management, built-in security scanning capabilities, advanced web scanning with asynchronous support, and the ability to export results in multiple formats like HTML and JSON.

FastCVE is a command-line tool designed for rapid and efficient querying of the Common Vulnerabilities and Exposures (CVE) database, enabling users to retrieve detailed information about security vulnerabilities, including descriptions, CVSS scores, and references to advisories. Notable features include its Docker containerization, automatic database management with PostgreSQL, and the ability to populate and incrementally update the local vulnerability database from multiple external sources, making it an effective solution for security professionals and developers aiming to monitor and assess vulnerabilities in their systems and applications.

Fathometer is a self-hosted CVE intelligence tool designed for administrators of plain root servers and VPSes, providing context-specific assessments of vulnerabilities. The tool leverages Trivy for scanning local hosts while utilizing a language model to evaluate the relevance of CVEs, ensuring that only pertinent findings are highlighted. Its streamlined interface features a fleet dashboard and triage workspaces tailored for individual operators, focusing on actionable insights without the complexity of extensive features common in enterprise solutions.

GVM-Docker is a containerized deployment of the Greenbone Vulnerability Manager and OpenVAS, designed for vulnerability scanning and management. It supports both AMD 64-bit and ARM 64-bit architectures, facilitating easy installation and upgrades through Docker on Linux systems and Windows with WSL 2. Notable features include compatibility with various systems, an upgrade-safe architecture, and guidance on maintaining PostgreSQL, ensuring a seamless user experience for security assessments.

hackbrowser-mcp is a specialized browser-based security testing tool that empowers AI agents to identify vulnerabilities within web applications. Unlike typical browser MCPs focused on automation tasks, hackbrowser-mcp utilizes the Model Context Protocol to facilitate in-depth security assessments, including injection testing and access control evaluations across multiple isolated user sessions. It features 39 integrated security tools, full traffic capture, and advanced reporting capabilities, enabling detailed vulnerability discovery through natural language instructions.

Honeyscanner is a vulnerability analyzer designed for honeypots, capable of automatically simulating various cyber attacks to assess the security posture of the honeypot. It employs a range of tactics, including exploitation of software vulnerabilities, denial of service, and fuzzing techniques, delivering comprehensive evaluation reports that provide security enhancement recommendations. Targeted at security enthusiasts and organizations, Honeyscanner serves as an essential tool for validating the robustness of honeypot implementations.

ICS Ninja Scanner is a specialized security assessment tool for industrial control systems (ICS) that supports comprehensive device discovery and testing across 11 protocols, including Modbus and S7. It features built-in CVE correlation, compliance mapping to frameworks like IEC 62443 and NIST 800-82, and offers functionalities such as scan diffing and industry-specific scan profiles, ensuring a thorough and tailored assessment for operational technology environments.

JitterBug is a reconnaissance tool designed to conduct passive information gathering by querying third-party databases for basic data, open ports, and potential CVEs associated with target IPs, all without direct interaction with the targets. Its stealthy operation ensures minimal detection risk, making it suitable for pre-attack reconnaissance and security assessments. Notable features include the ability to operate without direct engagement with targets and seamless integration within the DiaLog Project.

Libellux: Up & Running is a comprehensive guide for installing open-source security software from source, focusing on implementing a Zero Trust Network to bolster existing application security. The tool provides detailed documentation for notable security solutions including WireGuard for VPN, OSSEC for intrusion detection, Greenbone for vulnerability management, and ClamAV for antivirus. This resource is geared towards enhancing threat detection and prevention capabilities within various IT environments.

NextgeNmap is a security-focused automation GUI for Nmap designed for security operations and systems teams, enabling repeatable and efficient scans while minimizing noise in reporting. Key features include curated scan profiles, automated scheduling, integration with community scripts (like SearchSploit), and the generation of HTML reports for stakeholder presentation, all provided in a user-friendly cross-platform desktop application.

Nuclei is a fast tool for configurable targeted vulnerability scanning based on templates offering massive extensibility and ease of use.

Octofleet is an open-source endpoint management platform designed to facilitate the monitoring and management of a fleet of devices from a unified dashboard. Its primary use case involves deploying software, tracking vulnerabilities, managing patches, and controlling devices securely and efficiently. Notable features include a lightweight agent footprint, real-time hardware and software inventory, remote job execution capabilities, a comprehensive security center with vulnerability scanning, and extensive patch management tools.

Omnisci3nt is a unified web reconnaissance toolkit designed for cybersecurity professionals, ethical hackers, and security researchers, enabling automated analysis of critical domain-related data such as subdomains, SSL/TLS certificates, and exposed services. Its notable features include IP and WHOIS lookups, DNS enumeration, port scanning, and web crawling, all aimed at enhancing visibility into a domain's attack surface for security assessments and threat modeling. The tool is intended for authorized testing and provides a streamlined workflow for comprehensively analyzing the external exposure of web assets.

Pentester-MCP is an open-source penetration testing toolkit that integrates over 200 popular cybersecurity tools via the Model Context Protocol (MCP), enabling AI assistants to autonomously conduct penetration tests. Notable features include intelligent tool execution generated from cheat sheets, AI-optimized documentation for argument handling, and secure operation through Docker sandboxing, isolating tools from the host system to prevent dependency clutter. The toolkit covers various categories including reconnaissance, web exploitation, and network security, making it a comprehensive solution for automated penetration testing.

Pentesting Cyber MCP is a framework that provides standardized server implementations for 50 popular security tools via the Model Context Protocol (MCP), facilitating automation in pentesting and bug bounty tasks. Each MCP server encapsulates a security tool with a uniform interface, making it interoperable with any MCP-compatible client and allowing seamless integration into security assessments. Notable features include a wide range of tools covering reconnaissance, vulnerability scanning, and exploitation, all accessible through standard MCP interfaces.

Perseus is an interactive security assessment tool that enhances Claude Code's capabilities by facilitating autonomous penetration testing of your codebase. It supports multiple programming languages and frameworks, automatically detecting the project's environment and vulnerabilities across various dimensions, including API security and infrastructure. Notable features include smart auto-detection, engagement modes for different environments, and a structured four-phase assessment methodology to ensure comprehensive evaluation and reporting of security issues.

Public Skills Builder is a tool designed to generate Claude Code bug bounty skills by analyzing and extracting valuable data from over 500 public HackerOne reports and GitHub writeups. It produces 18 structured skill files, each targeting a different vulnerability class, complete with real-world techniques, payloads, and methodologies essential for enhancing bug hunting skills. Notable features include the ability to work exclusively with publicly available data and the generation of targeted skill files ready for integration with Claude Code.

`pwned-deps` is a multi-ecosystem CLI tool designed for quickly identifying compromised package versions in developer lockfiles, such as those used in npm, PyPI, Maven, Cargo, Go, and RubyGems. It provides rapid assessments—flagging risks like supply-chain malware and hijacked packages—by leveraging data from public APIs and curated feeds, with output options including terminal reports, JSON, and SARIF for integration into code scanning platforms. Key features include support for various lockfile formats, one-shot scans, and continuous monitoring modes.

Qryon is a security vulnerability scanning tool designed to rapidly identify issues within codebases, boasting scan times significantly faster than competing tools, capable of analyzing up to 1 million lines of code in under a minute. It supports 28 programming languages with a rich set of over 647 security rules covering various vulnerabilities, including SQL injection and hardcoded secrets, while offering features like interactive TUI for browsing findings, AI-powered triage, and integration with CI/CD pipelines via SARIF output. The tool leverages native Rust matchers for optimal performance and provides flexible installation options across various platforms.

RAG/LLM Security Scanner is a professional security testing tool designed to identify critical vulnerabilities in Retrieval-Augmented Generation (RAG) systems and large language model (LLM) applications, such as chatbots and knowledge retrieval systems. Notable features include advanced prompt injection detection, data leakage assessments, function abuse testing, and comprehensive reporting capabilities, making it suitable for both demo and production environments. The tool supports easy integration with popular AI systems and provides detailed JSON/HTML reports with actionable insights.

React2Shell Ultimate is a professional vulnerability scanner specifically designed for detecting the CVE-2025-66478 Remote Code Execution (RCE) vulnerability in Next.js applications utilizing React Server Components. Notable features include advanced exploitation capabilities, sophisticated techniques for WAF bypass, multiple scanning modes, and a full-featured web interface for interactive use and API access, making it suitable for authorized security testing and research.

RedTiger-Tools is a versatile automation tool designed for penetration testing (pentesting) and open-source intelligence (OSINT) that aims to consolidate multiple operations into a single, configurable platform. It features a plugin system for extending functionality, centralized configurations using JSON files, and dual operation modes (CLI and interactive interface), ensuring compatibility with both Windows and Linux environments while adhering strictly to legal and ethical standards for usage.

Safelog4j is an instrumentation-based security tool designed to help teams identify, verify, and mitigate the log4shell vulnerability (CVE-2021-45046) without the need for scanning or upgrading log4j. The tool utilizes interactive application security testing (IAST) to confirm exploitability and runtime application self-protection (RASP) to prevent exploitation by disabling the vulnerable JNDI lookup code dynamically. Unlike traditional scanning methods, Safelog4j provides greater accuracy and speed by operating from within the running application context.

SCOUT is an advanced firmware analysis platform designed for product security and internal red-team operations, transforming raw firmware blobs into evidence-backed exploitability chains and lab-bounded proof-of-vulnerability modules. It features a hybrid analysis engine capable of auditing both ELF binaries and shell scripts, emphasizing controlled weaponization and audit-ready reporting while reducing false positives. Notably, SCOUT prioritizes detailed evidence lineage and supports a structured approach to exploit development, favoring higher fidelity over traditional bulk scanning techniques.

SecGate is a lightweight, integrated security tool for Linux servers that combines gateway authentication, attack monitoring, vulnerability scanning, and AI assistance into a single package with minimal resource requirements. It offers one-command deployment, operates with around 120MB of memory, and includes unique features such as customizable TCP port authentication, multi-node management via SSH, and comprehensive security dashboards. Ideal for individual developers and multi-service deployments, SecGate provides a zero-configuration solution for rapid security enhancements.

Secrover is an open-source security auditing tool that generates comprehensive, human-readable security reports, focusing on vulnerabilities in dependencies, code, and domains. Its notable features include easy setup via YAML configuration, automation capabilities with scheduled scans and GitHub Actions, cross-platform compatibility, and flexible report exports to various remote destinations. The tool aims to provide actionable insights for users, making it accessible for both technical and non-technical audiences.

ShubhamWebScript is a Python-based website vulnerability checker designed for educational and ethical hacking purposes, allowing users to assess the security of web applications through automated scanning of parameter-based URLs. It detects common vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), and Remote Code Execution indicators, while also performing server header fingerprinting. The tool features both single and bulk URL scanning capabilities, making it beginner-friendly and suitable for learning basic web security practices.

SmartCode-Guard is an AI-powered static code analysis tool specifically designed to identify security vulnerabilities in Java source code. It integrates a modular architecture that includes a parser for extracting code structure, a rule engine for detecting common security anti-patterns, and an AI engine for deep semantic analysis, making it highly effective for enforcing secure coding practices and allowing for customization through extensible security rules. Notable features include static rule enforcement and intelligent analysis for preparing code snippets for LLM-based audits.

Vigil is an open-source, AI-powered security operations platform designed for comprehensive vulnerability management, incident response, and compliance tracking within a unified Express.js framework. Key features include six built-in scanners (Nmap, Nuclei, Trivy, Nikto, OpenSSL, DNS), 20 autonomous agents for parallel operations, and support for custom AI integrations, all while maintaining a lightweight architecture without external dependencies. The platform also offers advanced functionalities like role-based access control, two-factor authentication, and an encrypted credential vault for enhanced security.

VISTA (Vulnerability Insight & Strategic Test Assistant) is an AI-driven extension for Burp Suite that enhances security testing through real-time traffic analysis and intelligent vulnerability detection. It offers notable features such as an interactive AI advisor for context-aware testing suggestions, customizable analysis templates, and a comprehensive payload library, enabling pentesters to conduct faster and more systematic assessments. Additionally, VISTA supports multiple AI providers, including OpenAI and Azure, to tailor its guidance to user needs.

VulnScout is a security analysis tool designed for whitebox security reviews, offering offline quick scans and evidence-backed verification for identifying vulnerabilities within codebases. It provides features such as shared findings documentation, various output formats for reports, and support for multiple deep analyzers, making it suitable for integration into continuous integration workflows. Notably, it operates without requiring a remote service and includes capabilities for auditing, verifying findings, and generating structured reports.

VulnHawk is an AI-powered code security scanner designed to identify vulnerabilities that conventional SAST tools like Semgrep and CodeQL may overlook, particularly those related to business logic flaws where the absence of expected patterns is key. It employs contextual code analysis by comparing similar components across a codebase, facilitating the detection of security issues without the need for extensive configuration or custom rules. Notably, it supports various AI backends, integrates easily into CI/CD pipelines, and operates entirely locally or privately using options like Ollama.

Ward is a specialized security scanner for Laravel applications that performs targeted security checks by understanding the application's structure, including routes, models, and configuration files. Notable features include live vulnerability lookups against the Packagist advisory database, comprehensive checks for common misconfigurations, and the ability to generate detailed reports on security findings, making it a valuable tool for both development environments and CI/CD pipelines.

Wordfence CLI is a high-performance security scanner designed for detecting PHP malware and vulnerabilities in WordPress installations. Written in Python, it operates in a multi-process environment, allowing for parallel scans, scheduling, and integration with other commands via input and output piping. Notable features include the ability to scan directories for malware and vulnerabilities efficiently, as well as comprehensive installation and configuration documentation.

Worm GPT Core is an advanced adversarial prompt delivery framework designed for AI researchers and cybersecurity professionals to evaluate and exploit vulnerabilities in large language models (LLMs). It automates the delivery of jailbreak prompts and features innovative mechanisms for alignment evasion, multi-threaded prompt execution, and seamless integration with both commercial and local LLMs. The tool aims to enhance penetration testing capabilities within AI systems while ensuring zero telemetry and optimized performance.

wp-taint-scan is a specialized static analysis tool designed to detect genuine vulnerabilities in WordPress plugins using a native Go-based taint analysis engine. It enables users to scan multiple versions of plugins in parallel and offers features such as detailed source-to-sink dataflows, version diffs to track changes in vulnerabilities, and a thorough understanding of the WordPress security model, significantly reducing false positives. Notable vulnerability classes include SQL injections, XSS, path traversal, and missing authorization issues, making it an essential tool for enhancing WordPress security.

WPRecon is an advanced WordPress reconnaissance and vulnerability scanning tool designed for security engineers to identify vulnerabilities, misconfigurations, and information disclosure in WordPress installations. It utilizes a YAML-driven template architecture that facilitates easy extensibility, rapid deployment as a single binary, and features such as high-performance parallel scanning, a diverse library of over 150 templates, and multi-format output options. Notable capabilities include automatic retries for failed requests, comprehensive HTTP operations, and a variety of matchers and extractors for efficient data retrieval and analysis.

XSSniper is an advanced open-source XSS vulnerability scanner designed for professional security testing. It features asynchronous scanning for enhanced performance, a comprehensive payload library tailored to the latest CVEs, and sophisticated WAF bypass techniques. Notable capabilities include intelligent context-aware detection, smart parameter discovery, and detailed vulnerability reporting for effective analysis of web applications.

A lightweight active and passive scanner that combines the advantages of local and distributed models, supports dynamic external plugin import, and is dedicated to exploring web black-box vulnerabilities.

ZENVORA VulnScan v2.0 is a comprehensive vulnerability scanner designed for web applications, focusing on detecting various security issues such as SQL injection, cross-site scripting (XSS), and command injection. It includes features like anonymity levels through Tor and ProxyChains, automated report generation in TXT and JSON formats, and an extensive list of tests for common vulnerabilities. This tool is intended for authorized use only, highlighting the importance of ethical scanning practices.

AEM Dispatcher Security Scan is a command-line tool designed to perform security assessments on Adobe Experience Manager (AEM) Dispatcher configurations. It consolidates known security-sensitive URLs for AEM Dispatcher, allowing users to specify target websites and customize scan parameters while leveraging Docker for deployment. Notable features include configurable HTTP request timeouts, support for custom test paths, and an easy-to-use interface via command-line options.

Agent Audit is a security tool designed to identify vulnerabilities in AI agent code prior to production deployment. Its primary use case involves scanning for risks associated with unsafe inputs, command execution, and configuration errors, utilizing a framework of 72 rules aligned with the OWASP Agentic Top 10. Notable features include tool-boundary taint tracking, configuration auditing, and the ability to enforce security measures within continuous integration workflows.

The agent-security-scanner-mcp is a comprehensive security scanning tool designed for AI coding agents, providing functionalities to audit code, servers, prompts, and AI-generated packages for vulnerabilities. Key features include the ability to grade agent security, identify risks like SQL injection and package hallucinations, generate Software Bill of Materials (SBOMs), and facilitate semantic reviews using project context. The tool supports various AI platforms, ensuring robust integration and security checks before code execution.

AIROM is a tool designed for scanning filesystems, git repositories, container images, and Kubernetes workloads to identify and document AI components in software. It generates an AI Bill of Materials that includes models, datasets, and frameworks used in the code, providing line-by-line evidence for each entry. Notable features include support for various scan targets, output formats like CycloneDX and SPDX, and the ability to gate builds based on identified risks.

The Vulners Python SDK is a comprehensive client for accessing Vulners' vast vulnerability intelligence database, facilitating queries on CVEs, exploits, and advisories enriched with risk metrics like CVSS and EPSS. It enables users to assess vulnerabilities across various software and systems, stream data for integration into custom pipelines, and set alerts for new matching vulnerabilities, all while supporting asynchronous operations for enhanced performance. Notably, it incorporates features for tracking active exploits and provides an AI-ready infrastructure for real-time data processing.

ApiHunter is an asynchronous, modular API security scanner designed for baseline testing and regression detection in APIs. It facilitates both offensive and defensive use cases, enabling red-team activities like pentesting and exploit validation, as well as providing CI/CD regression gating and early misconfiguration detection. Notable features include adaptive concurrency, support for a variety of API security checks (such as CORS, CSP, GraphQL), and the ability to scan large numbers of targets rapidly with integrated threat intelligence capabilities.

APISCAN is an advanced API vulnerability scanner that systematically evaluates APIs against the OWASP API Security Top 10 (2023) by utilizing OpenAPI/Swagger specifications. Notable features include automatic form login detection, deep scan modes for comprehensive testing, real-world attack pattern detection, and a user-friendly cross-platform GUI for enhanced usability. The tool is designed to proactively identify and model security vulnerabilities, providing actionable insights with detailed evidence.

Artifact Keeper is an enterprise-grade open-source artifact registry designed to support over 45 package formats, including Maven, NPM, Docker, and more. It features a WASM plugin system for custom format handling, automated security scanning for vulnerabilities, and a robust architecture with multi-auth support, full-text search capabilities, and artifact signing functionalities. Built in Rust, it emphasizes security with hardened container images and advanced replication features for scalable deployment.

auditor-skill is an open-source AI-driven security audit tool designed for auditing Solana programs and applications. It leverages AI agents to evaluate codebases against 1,346 verification items across 20 security domains and 131 known attack vectors, producing detailed reports that include executable proofs of vulnerabilities and suggested fixes. Notable features include a comprehensive audit lifecycle, token efficiency through pre-scanning, and deep coverage of Solana-specific methodologies.

Awesome Security Pipeline is a comprehensive guide designed for selecting and implementing open-source security tools within CI/CD pipelines. It features a pre-configured baseline that integrates multiple tools such as Gitleaks, Semgrep, and Trivy, enabling continuous security validation and machine-readable evidence generation. The repository is actively maintained, with weekly status checks and regular updates to ensure the effectiveness of the security controls and methodologies provided.

BitrixProbe is a Python-based vulnerability assessment tool specifically designed for CMS 1C-Bitrix/Bitrix24 installations. It offers dual modes of operation: `pentest` for external HTTP/HTTPS scans and `audit` for authenticated SSH scans, enabling comprehensive evaluation of both public exposure and server configurations. Notable features include integration with vulnerability databases, enumeration modules, and the ability to generate standardized reports, thus facilitating effective security assessments and audits.

Cataam is an open-source security toolset that provides a variety of scripts and templates aimed at enhancing security and compliance practices for organizations. It features practical functionalities such as hardening scripts, CVE detection tools, and compliance documentation, making it suitable for security teams, DevOps, and compliance engineers. Notable offerings include a local-first prompt hygiene tool, CVE detection scripts updated promptly after disclosures, and a comprehensive collection of CIS Benchmark guides and compliance templates.

CERT-X-GEN is a polyglot execution engine designed for vulnerability detection, allowing users to write security checks in multiple programming languages including Python, Go, Rust, C, and Shell. It provides a unified execution layer that enables complex detection logic, such as multi-step protocol conversations and performance-critical operations, and is tailored for integration in CI/CD environments. Notable features include language-agnostic templates, sandboxing capabilities, and the ability to mix various programming languages within a single scan.

ChYing is an open-source penetration testing tool designed to provide an interactive platform for security professionals, facilitating the capture, modification, and replay of HTTP/HTTPS traffic. Its notable features include a lightweight UI, built-in scanning capabilities from the Jie tool, automated attack testing with multiple payload types, and an intuitive workflow for JWT parsing, which makes it an alternative to heavier tools like Burp Suite. The tool aims to offer a modern and customizable solution for active and passive web vulnerability assessments.

cloud-audit is an open-source AWS security scanning tool designed to identify attack paths, IAM escalation routes, and prioritize necessary fixes based on their impact on security. It operates in a read-only mode, ensuring no modifications are made to the user's AWS infrastructure while providing detailed reports on correlations between vulnerabilities and suggested remediation steps, including AWS CLI and Terraform fixes per finding. Key features include the identification of attack chains using MITRE ATT&CK methodology, root-cause analysis for prioritized fixes, and a simulation function to evaluate the potential impact of proposed changes.

CSCAN is an enterprise-level distributed network asset scanning platform designed for comprehensive asset management and vulnerability detection. Its notable features include a distributed architecture for flexible scalability, automated scanning pipelines, customizable password dictionaries, periodic task scheduling, and real-time notification subscriptions, supporting extensive data isolation across multiple workspaces. This tool is ideal for organizations seeking to efficiently monitor and secure their network infrastructure.

CVE Lite CLI is a terminal-based vulnerability scanning tool designed to analyze project lockfiles and provide actionable remediation commands. It focuses on delivering validated fix commands alongside parent-aware guidance for transitive dependencies, emphasizing a remediation-first approach while ensuring that no sensitive data leaves the user's machine. As an officially recognized OWASP Lab Project, it integrates seamlessly into CI workflows, promoting secure coding practices.

cwe_checker is a static analysis tool designed to identify common software vulnerabilities, specifically by detecting classes of bugs known as Common Weakness Enumerations (CWEs) in ELF binaries across multiple CPU architectures. It leverages Ghidra for disassembly and utilizes a plugin-based, extensible architecture that supports customizable analyses, making it a useful resource for firmware analysis on Linux and Unix systems. Notable features include easy setup via Docker, support for various architectures, and the ability to integrate with the FACT framework for enhanced analysis capabilities.

Cyber Neo is an open-source cybersecurity analysis agent designed to run within Claude Code, enabling developers to conduct comprehensive security audits on their projects effortlessly. The tool scans for vulnerabilities across 11 categories, including code security, authentication, cryptography, and dependency vulnerabilities, providing prioritized reports with concise remediation guidance. Notable features include no installation requirements, real-time operation, and the ability to run five parallel subagents for rapid assessments.

DeepSec is an AI-driven security platform that integrates code security auditing and authorized penetration testing into a unified CLI and terminal workbench. It features a three-layer detection architecture for real-time vulnerability scanning, leveraging regex, AST analysis, and LLM semantic evaluation, along with IDE plugins for seamless development integration. The platform is designed to enhance security efficiency by augmenting traditional methods with advanced AI capabilities.

DianXing (点星) is an AI-driven end-to-end code security auditing system that autonomously identifies and verifies vulnerabilities in source code without human intervention, offering a structured output of detected issues. Unlike traditional SAST tools, it employs semantic understanding to uncover deep vulnerabilities, such as authentication bypass and privilege escalation, which are often missed by conventional scanners. The system has demonstrated the ability to autonomously exploit zero-privilege remote code execution vulnerabilities, reinforcing the need for responsible disclosure of its capabilities.

DLL Hijacking Vulnerability Scanner is a specialized tool for identifying DLL hijacking vulnerabilities within signed Windows executable files. It features automated scanning, DLL dependency analysis, and comprehensive filtering options, enabling security professionals to test executables for hijacking susceptibility and analyze their DLL loading behaviors, as well as generating detailed vulnerability reports.

DockSec is an AI-powered Docker security scanner designed to translate complex security vulnerabilities into actionable insights for developers. It leverages popular security scanners like Trivy and Hadolint to provide prioritized vulnerability assessments and plain English explanations, while also suggesting specific fixes for Dockerfiles and generating interactive security reports. The tool ensures privacy by conducting scans locally, with options for local AI processing, minimizing external data exposure.

Drogonsec is an open-source security scanner designed to perform comprehensive security assessments through Static Application Security Testing (SAST), Software Composition Analysis (SCA), and secret detection, aligning with the OWASP Top 10:2025 framework. It supports over 20 programming languages and various deployment strategies, including local or cloud-based AI remediation for findings. Key features include the ability to scan for vulnerabilities, identify misconfigurations in Infrastructure as Code (IaC), and integrate with CI/CD pipelines for automated security reporting.

Eraser is a tool designed for Kubernetes administrators that facilitates the removal of non-running images from all nodes within a cluster. Its primary use case is to help optimize storage and resources by cleaning up unused images, thereby improving cluster efficiency. Notable features include easy integration with Kubernetes environments and a user-friendly quick start guide for rapid deployment.

The fleet-cve-scanner is an open-source, PowerShell 7-based CVE scanner designed for managing vulnerabilities in software across RMM-managed fleets, without the need for agents or appliances. It cross-references the software inventory of managed endpoints against multiple authoritative security feeds to determine if installed software versions are vulnerable and assess their urgency. Key features include the ability to generate per-device CSV reports, a SQLite history database for change tracking, and an HTML dashboard, making vulnerability assessment and management streamlined and efficient.

Foxguard is a comprehensive security scanning tool designed for local environments, offering fast analysis of code, secrets, dependencies, and post-quantum cryptographic risks. It boasts over 200 built-in rules across 12 programming languages, supports taint tracking, provides efficient CI integrations, and features output formats compatible with various tools such as SARIF and Semgrep. Key capabilities include secrets scanning, OSV-backed dependency checks, and the ability to pinpoint changes in code branches through diff mode scanning.

Observer is a command-line tool designed to analyze codebases and generate a comprehensive production health report, all from a single, offline binary with no dependencies or account requirements. It combines various analysis methods—such as static analysis, dependency checks, and runtime error detection—into a unified report that includes a security rating and suggested fixes for identified issues. The tool is aimed at developers seeking to efficiently identify and remediate production problems without navigating complex code and server logs.

Grummage is an interactive terminal frontend for the Grype vulnerability scanner, designed to simplify the analysis of Software Bill of Materials (SBOMs) by providing a user-friendly interface for navigating and viewing vulnerability details. Its notable features include real-time utilization of the Grype vulnerability database, customizable views by package name, vulnerability ID, package type, and severity, along with intuitive navigation controls. Grummage aims to streamline the process of vulnerability management for developers without the need to delve into complex query syntax.

The Harbor Scanner Adapter for Anchore Engine/Enterprise facilitates the integration of Harbor's scanning capabilities with the Anchore API, enabling vulnerability assessments on Docker images stored within Harbor. It offers TLS/HTTPS protection for API communications, supports authentication through Bearer tokens and Basic authentication, and can be configured via environment variables or configuration files. This tool is essential for users seeking to leverage Anchore's scanning features directly from Harbor, enhancing their image security posture.

honey is an automated supply-chain security tool that orchestrates multiple security scanners to assess vulnerabilities across a developer's machine. It integrates the findings from various scanners, such as bumblebee for compromised packages and osv-scanner for known CVEs, providing a unified verdict and optional daily reports through a messaging system. Key features include scheduling scans, customizable reporting policies, and the ability to suppress previously acknowledged findings.

isitsecure is an AI-powered security scanner designed for modern web applications, integrating Static Analysis (SAST), Dynamic Analysis (DAST), and AI-driven code review into a single scanning process. Its notable features include automatic generation of DAST tests based on SAST findings, AI-generated code patches for vulnerabilities, and support for multiple programming languages and frameworks. This tool targets developers aiming to improve code security without requiring deep security expertise, offering a comprehensive report along with actionable fixes for identified issues.

It-Depends is a tool designed for automatically generating dependency graphs and Software Bill of Materials (SBOM) for various programming packages and source code repositories, supporting languages such as Go, JavaScript, Rust, Python, and C/C++. Key features include complete dependency version resolution, C/C++ support without the need to build projects, automated mapping of native library dependencies through dynamic analysis, and integration with vulnerability scanning from the OSV database.

L0p4Map is a robust network monitoring and visualization tool that enhances the capabilities of Nmap, providing security researchers and network administrators with detailed insights into their network infrastructure through an intuitive interface. Key features include continuous monitoring of network traffic, real-time alerting for unauthorized devices, extensive device fingerprinting, and the ability to generate a real-time graphical representation of network topology. The tool supports multiple platforms (Linux, Windows, macOS) and integrates seamlessly with existing Nmap functionalities to deliver a comprehensive view of network security.

MEDUSA is an AI-first security scanner designed to detect vulnerabilities in AI/ML applications, offering over 40,000 detection patterns and built-in rules for identifying threats such as API key leaks and AI supply chain attacks. Notable features include no setup required for usage, the ability to scan GitHub repositories for potential repo poisoning, and interactive tools for purging leaked information. The tool supports parallel processing for speed, integrates with various IDEs, and provides multiple reporting formats for versatility in usage.

NSAuditor AI is a modular, AI-assisted network security audit platform designed to assess and prioritize vulnerabilities without data exposure, operating entirely within your infrastructure. It utilizes 27 specialized scanning plugins to generate AI-powered vulnerability reports while ensuring zero data exfiltration, as all processes including analysis and monitoring are conducted offline and any external API calls are opt-in. This tool emphasizes privacy and security by ensuring that sensitive scan data never leaves the user's environment.

Nuclei is a high-performance vulnerability scanner that utilizes YAML-based templates for customizable vulnerability detection, aiming to reduce false positives by mimicking real-world attack scenarios. Its notable features include ultra-fast parallel scan processing, support for multiple protocols such as HTTP and DNS, and seamless integration into CI/CD pipelines as well as various issue tracking and logging systems. The tool is designed for security professionals to stay ahead of trending vulnerabilities while conducting thorough regression testing.

Nyx is a local-first security scanner designed for cross-language taint analysis of code repositories, providing a sandboxed dynamic verification environment. Its notable features include a user-friendly React-based UI for real-time results, a detailed flow visualizer for tracking data paths, and the ability to persist triage states alongside code commits, ensuring collaboration within teams. Additionally, Nyx can be seamlessly integrated into CI pipelines, generating SARIF reports for GitHub Code Scanning.

OmniStrike is a state-aware security scanning tool for Burp Suite that enables precise and customizable security testing by allowing users to target individual parameters within requests. It features 14 active scanning engines, 10 technology-aware scanners, and session automation capabilities, alongside optional AI analysis for focused vulnerability testing. This tool is designed to facilitate detailed assessments of modern web technologies while maintaining user control over scanning processes and findings management.

OpenA2A CLI is a unified command-line interface designed for the OpenA2A security toolchain, enabling users to identify and rectify security vulnerabilities such as credential leaks, shadow AI, and unsigned configurations with a single command. Notable features include automated security reviews and remediation capabilities, Apache 2.0 licensing, and integration with various security-focused sister packages.

PenHunter is a modular web vulnerability scanner designed for penetration testers, bug bounty hunters, and security researchers, focused on identifying a wide range of web vulnerabilities, including XSS, SQL Injection, and RCE. It features advanced detection methods, such as boolean and time-based techniques, as well as built-in WAF evasion capabilities, and can integrate with external tools like sqlmap and dalfox. The tool supports concurrent scanning, interactive CLI usage, and provides organized output in multiple formats, enhancing workflow efficiency in security assessments.

Pentest Skill is a comprehensive black-box web penetration testing toolkit designed to streamline the bug bounty workflow through a structured five-phase approach: Intake, Recon, Enum, Hunt, and Report. Notable features include a workflow controller with checkpoints for phase progression, a collection of 48 Python scripts for various testing phases, and an extensive library of attack playbooks and payloads, facilitating targeted vulnerability assessment and reporting.

BitDefender Total Security Ultimate Protection is a comprehensive cybersecurity suite that functions as a modular framework for fortifying network defenses against a wide array of cyber threats. Its primary use case revolves around system hardening, employing features such as vulnerability scanning, real-time threat correlation, and sandbox-based execution to protect various environments from evolving threats. Notable capabilities include automated policy enforcement, advanced heuristic analysis, and deep kernel inspection for rootkit remediation, all integrated within a responsive interface supporting multilingual operations and continuous 24/7 support.

pi-codex-security is a tool that integrates OpenAI Codex Security functionality into pi agent sessions, enabling users to scan repositories for vulnerabilities, review findings by severity, and automatically fix issues. Notable features include customizable scanning options, detailed artifact generation in various formats (e.g., SARIF and JSON), and a user-friendly command interface for initiating scans and managing authentication. This tool is particularly useful for developers who want to enhance their code security seamlessly within their development environment.

Plankton is a command-line web vulnerability scanner designed to conduct checks against the OWASP Top 10 (2021) vulnerabilities on specified URLs. It generates colorful terminal outputs and supports multiple report formats, including a styled HTML report, JSON, and plain text, enabling users to customize scan parameters with ease. Key features include 12 specific vulnerability checks, configurable options such as timeout and user-agent, and an accessible single-file script for quick deployment.

The presidio-hardened-vuln-scanner is a web application vulnerability scanner designed to analyze both a deliberately vulnerable Flask application and its hardened version. It facilitates a comprehensive security assessment through static analysis, dynamic scanning, and manual exploitation, highlighting various vulnerabilities such as SQL injection and XSS, with a structured approach to measure and verify fixes. Notable features include integration with tools like Bandit and pip-audit for static analysis, as well as a custom scanner to dynamically check for vulnerabilities.

Quodeq is an open-source AI-powered tool designed for scanning codebases to detect security vulnerabilities and design flaws, aligning with the ISO 25010 quality dimensions. It provides detailed findings such as grades, violations with line numbers, and fix plans, with every issue mapped to a corresponding CWE identifier. Notably, it operates locally without telemetry, runs on various platforms, and offers both cloud and local model configurations for flexibility and privacy.

Refuse is a self-hostable HTTP service that supports the refuse-cli tool, designed to block the installation of vulnerable packages by querying a local SQLite database populated with public vulnerability feeds. It features a REST API for package checks, a built-in admin UI, and frequent updates from various sources, allowing users to verify package safety and enforce security policies during package management operations.

RepoMind is an AI-powered tool designed to facilitate the understanding of public GitHub repositories and developer profiles through advanced code reasoning and architecture visualization. It offers zero-setup access for public repositories, context-aware analysis to provide relevant files, security scanning with verification reporting, and real-time feedback during the analysis process. Notable features include automated architecture mapping, a streamlined user interface for discovering trending repositories, and a robust cleaning mechanism through its Agentic Context-Augmented Generation architecture for reliable query responses.

RouteVulScan is a passive recursive path probing extension for Burp Suite that leverages the Montoya API to perform low-noise vulnerability detection during web security testing. It automatically scans traffic for hidden endpoints and sensitive files using customizable YAML-based detection rules, allowing users to quickly identify high-value vulnerabilities without the need for manual dictionary management. Key features include automatic path recursion, support for active scanning of individual requests, and a comprehensive rules engine for effective vulnerability assessment.

Bawbel Scanner is an open-source tool designed to assess MCP servers and skill files for vulnerabilities, specifically providing OWASP AIVSS scores without executing any code. Its primary use case includes detecting AVE vulnerabilities and ensuring compliance with the MCP specification, while notable features encompass a variety of focused scans, conformance grading, and vulnerability management functionalities. The tool supports formats for reporting, a public vulnerability database, and provides guidance for remediation, making it a comprehensive solution for security assessments of MCP environments.

SEC-AF is an AI-native security auditing tool that confirms exploitability of vulnerabilities in codebases by providing a detailed data flow trace and verifiable evidence for each finding. It allows users to initiate audits via a single API call or command line interface, returning comprehensive reports that include severity, exact location, and a verdict on each vulnerability. Notably, SEC-AF offers a cost-effective solution for thorough security assessments, typically costing about $1.40 per full audit.

The Shai-Hulud 2.0 Detector is a cybersecurity tool designed to protect projects from the Shai-Hulud 2.0 npm supply chain attack, a significant threat that compromised numerous packages in the npm ecosystem. Its primary use case involves detecting vulnerable packages and facilitating community reporting of compromised software, enhancing the security posture of development environments. Notable features include automated daily updates of an affected packages database, advanced configuration options for tailored scanning, and support for various integration methods including GitHub Actions and local CLI usage.

ShieldEye Core is a desktop network security scanner designed for Linux, primarily aimed at security researchers, pentesters, and system administrators. It utilizes Nmap for comprehensive port and service discovery, identifies vulnerabilities in common CMS platforms by cross-referencing with the CIRCL CVE database, and evaluates HTTP security headers, all presented through a GTK 4 GUI with intuitive reporting features. Key functionalities include customizable scanning profiles, a detailed analysis of web security, and robust safety measures against unauthorized access and disruption.

ShieldEye ComplianceScan is a web compliance and vulnerability scanner that assesses web targets against key security standards including GDPR, PCI-DSS, and ISO 27001. It features a GTK4 desktop interface, a CLI for automated scanning, and a REST API for integration, while providing detailed reports that include CVSS v3.1 scoring and export options in various formats. The tool evaluates critical aspects like TLS configuration, security headers, and cookie settings, making it suitable for regular compliance checks and configuration sanity evaluations.

Sighthound is a Tree-sitter based static vulnerability scanner designed for identifying security vulnerabilities in source code through AST-aware rules and taint-flow analysis. It supports multiple programming languages, executes scans in parallel, and offers output in various formats including JSON, CSV, and SARIF for integration with GitHub Code Scanning. Notably, Sighthound allows for custom rule packs and provides both pattern and taint mode analysis, catering to complex multi-file projects.

SILENTCHAIN AI™ - Community Edition is a Burp Suite extension designed for AI-powered passive vulnerability analysis, providing intelligent detection of OWASP Top 10 vulnerabilities and security misconfigurations in real-time HTTP traffic. Notable features include context-aware detection using various AI models, detailed reporting with CWE and OWASP mapping, and robust data privacy measures through automatic sensitive data redaction. The tool enhances traditional security scanning by focusing on real vulnerabilities with zero false positives, making it a significant addition to web application security testing.

`still_active` is a dependency auditing tool that evaluates the maintenance status of packages across multiple ecosystems, including Ruby, npm, PyPI, Cargo, and more, by identifying archived repositories, lack of recent releases, and vulnerabilities that remain unpatched. Its notable features include last-commit activity checks, OpenSSF scorecard evaluations, and detection of “poison-pill” dependencies that may hinder security updates. This tool serves as a complementary addition to existing package management solutions by proactively highlighting risks associated with outdated or abandoned dependencies.

Symfony Security Auditor is an AI-driven security auditing tool designed for Symfony applications, focusing on identifying application-level flaws that traditional static analysis tools may overlook. It features an adversarial Attacker and Reviewer loop to validate vulnerabilities and produces reports in multiple formats, including JSON and HTML. The auditor can operate in two modes: as a standalone CLI tool or integrated into Symfony applications, providing flexibility for different auditing needs.

Synapse is a governed control plane designed for comprehensive software composition analysis, vulnerability detection, and reporting, facilitating security assessments in a controlled environment. Its primary use case revolves around automating security workflows, ensuring tamper-evident evidence collection, and allowing for deterministic scanning across various ecosystems with multiple built-in scanners. Notable features include a robust SBOM generation, risk-based prioritization of findings, and strict adherence to authorization and scope constraints before tool execution.

Terraview is an open-source security analysis tool designed for Terraform plans that integrates static scanners like Checkov, Trivy, and Terrascan with AI contextual analysis, executing these processes in parallel. It inspects infrastructure provisioned with Terraform to identify security misconfigurations and compliance issues while enriching results through multi-provider contextual insights. Notable features include built-in security scanner capabilities, seamless configuration management, and native policy-as-code support, all without external dependencies.

trawld is a package vulnerability monitoring tool designed for developer fleets, enabling continuous oversight of project dependencies across enrolled machines. It features a real-time dashboard for vulnerability tracking using a Cloud Brain and a global npm agent that automates project discovery, scheduled rescans, and maintains live status updates. With seamless onboarding and no code modifications required, trawld enhances security management for development environments.

Vigolium is a high-fidelity vulnerability scanner that offers two distinct scanning modes: Native Scan for fast and flexible multi-phase assessments, and Agentic Scan for autonomous, AI-driven code auditing. It features 317 scanner modules covering a wide array of vulnerabilities, including OWASP Top 10, and employs out-of-band testing to enhance accuracy. The tool is designed for both manual and automated security assessments, enabling comprehensive coverage of web applications and codebases.

Vuls is an agent-less vulnerability scanner designed for Linux, FreeBSD, and macOS systems, written in Go, that automates the detection of vulnerabilities by continuously monitoring installed software against a variety of vulnerability databases. It generates regular reports that inform users about affected systems and related vulnerabilities, mitigating the risks of human oversight in the management of software updates. Notable features include high-quality scanning capabilities across major operating systems and integration with multiple security advisories and vulnerability databases.

WebScan is an automated web security auditing tool designed to crawl, discover, and audit web applications. It features a robust plugin architecture with 41 plugins, offers multiple report formats, and is tailored for both site owners and bug hunters, providing user-friendly options like safe mode and detailed explanations of findings, as well as advanced stealth capabilities for more experienced users. Notable capabilities include request rate limiting, user-agent rotation, and proxy support to maintain the user's anonymity.

wscan is a comprehensive web security scanner designed for active, passive, and AI-driven penetration testing, addressing a wide range of vulnerabilities from the OWASP web vulnerability landscape. Key features include a browser-based WebUI for scan management, support for multiple scanning modes, an extensive library of built-in detection plugins, and integration with external POC engines like Nuclei, Xray, and Goby. Additionally, it offers an AI agent mode for automated testing and a reverse-connect platform for exploiting blind vulnerabilities.

WSHawk is an open-source toolkit designed for WebSocket security testing and web application penetration testing, integrating a CLI scanner, web dashboard, and desktop application. Notable features include stateful WebSocket testing, context-aware payload evolution, browser-assisted evidence collection using Playwright, and a comprehensive suite of web pentesting tools such as fuzzers and interceptors, all under the AGPL-3.0 license. The toolkit also supports project-backed workflows and offers various integrations and reporting formats for efficient security assessment.

Xalgorix is an open-source AI-driven penetration testing platform that autonomously conducts comprehensive pentesting methodologies and verifies each finding through an independent verification process, ensuring the delivery of proven vulnerabilities rather than uncertain results. It is designed for self-hosting and supports a "bring-your-own-LLM" model, allowing integration with user-defined language models, while catering to both Linux environments and containerized implementations through Docker. Notable features include its autonomous execution, independent verification of findings, and the ability to run in a secured Docker container.

Cloud Data is a repository designed to collect and parse cloud-related data from multiple supported cloud providers, including AWS and GCP, to extract useful information about specified targets. Users can define their targets in a `targets.txt` file, and the tool automates data fetching every seven days using GitHub Actions, with outputs saved for easy access. Notable features include customizable scheduling through cron jobs and integration with multiple data sources for comprehensive analysis.

Aarya is an advanced OSINT tool designed to validate email addresses and extract detailed digital footprints across various platforms, including social media and e-commerce sites. Notable features include a deep analytical capability that retrieves extensive metadata such as Google Maps reviews and account creation dates, as well as dynamic user-agent management to enhance stealth during scans. Aarya focuses on delivering high-quality identity intelligence rather than merely confirming existence, offering a sophisticated user interface and explicit reporting on scan results.

BannerGrapV2 is an advanced network reconnaissance and vulnerability discovery tool designed for both offensive and defensive security operations, making it suitable for Red and Blue Teams, bug bounty hunters, and security auditors. Notable features include multi-threaded banner grabbing, extensive service fingerprinting, a robust vulnerability detection engine, and flexible reporting options in multiple formats, all powered by a performance-focused architecture enabling concurrent scans of up to 10,000 hosts.

H4X-Tools is a modular, terminal-based toolkit designed for open-source intelligence (OSINT) gathering, reconnaissance, and web scraping, developed in Python to operate on both Linux and Windows. Its primary use case includes advanced data extraction and analysis from platforms like Instagram, as well as comprehensive searches for usernames, emails, and phone numbers across various databases and services. Notable features include support for multiple data formats for export, configurable queries with customizable parameters, and integration with external libraries for enhanced functionality.

Advanced Secret Finder is a high-performance API key scanner developed in Rust, capable of detecting over 70 API key patterns while employing concurrent scanning of GitHub repositories. It features live validation of keys against major platforms, intelligent false positive filtering, and separation of public and private findings to enhance security during analysis. Additionally, it offers a user-friendly interactive mode and integration with GitHub Actions for seamless automation in continuous integration workflows.

The Excalibra cybersecurity repository serves as a comprehensive educational resource designed to enhance skills in ethical hacking, penetration testing, and cybersecurity fundamentals. Key features include detailed sections on Open Source Intelligence (OSINT), the use of Nmap for network discovery and security auditing, insights into social engineering tactics, and guidance on employing Kali Linux, making it a valuable tool for individuals seeking a structured learning path in cybersecurity.

OSINT NET Auditor is a desktop IP and port scanner application developed using Tauri, primarily for scientific and educational purposes. Key features include a user-friendly installation process, customizability through building from source using Node.js and Rust, and the capability to detect potential security vulnerabilities in network configurations. The app aims to provide an accessible tool for users interested in network auditing and security assessment.

URLInsane is a command-line tool designed for detecting domain typosquatting and facilitating OSINT (Open Source Intelligence) investigations across multilingual target domains. It generates and scans for potential typosquatting variants of a specified domain, allowing users to identify threats such as phishing and brandjacking, with features that include customizable variant generation, reporting options in various formats, and a focus on multiple target types beyond just domains.

AutoShell is a web scanner tool designed to identify vulnerabilities and potential file upload points on websites. Its primary use case is to exploit such vulnerabilities by uploading files using various evasion techniques, including modifying file extensions, employing steganography, and using polyglot files to bypass security measures. Notable features include automated vulnerability detection, an array of file manipulation techniques to conceal uploaded scripts, and a user-friendly interface for initiating scans.

SubFors is a modular subdomain discovery tool designed for rapid enumeration of subdomains, integrating various techniques for comprehensive attack surface analysis. Notable features include multi-engine enumeration, API support for services like VirusTotal and GitHub, certificate transparency monitoring, and bulk domain processing with customizable wordlists. This tool is particularly beneficial for security professionals seeking to enhance their reconnaissance capabilities and automate the discovery process.

VulnScan is a vulnerability scanning tool designed to assist website owners in identifying and addressing security threats by leveraging the OpenAI ChatGPT AI model to analyze JavaScript code for vulnerabilities. Although no longer actively maintained, it offers features aimed at detecting and fixing security flaws, with potential future enhancements planned, including support for various vulnerability types and improved user interface options. The tool is intended for educational use, emphasizing the importance of compliance with legal standards.

AdminDirectoryFinder is a Python tool designed to scan for and identify sensitive directories, specifically under admin paths, within web applications. It is primarily used by penetration testers and developers to enhance security by detecting hidden admin panels and ensuring proper access controls. Notable features include its straightforward installation process and focus on security testing.

The Automated Bug Bounty Scanner is a comprehensive reconnaissance and vulnerability scanning tool designed specifically for bug bounty hunters and penetration testers. It automates web application security testing by efficiently crawling and analyzing websites for vulnerabilities such as hidden admin panels, CMS weaknesses, and sensitive file exposures, while offering features like intelligent recursive crawling, prioritized vulnerability results, and built-in brute force capabilities through an intuitive GUI.

awacs-scanner is an automated vulnerability scanning tool designed to gather extensive information about systems and identify potential exploits using multiple sources, including Vulners API and SearchSploit. Its primary use case involves scanning for vulnerabilities across multiple targets specified in files, streamlining the reconnaissance process without the need for manual searches. Notable features include various scan modes such as stealth_flight, vuln_scan, and battering_ram, as well as capabilities for S3 bucket discovery.

The "Hacking Tools" repository offers a collection of cybersecurity utilities designed for various network reconnaissance and penetration testing tasks. Key features include ARP cache poisoning, subdomain enumeration via HTTPS certificate history, Google dorking for file discovery, and multiple implementations of network scanning and port scanning. These tools serve as essential resources for security professionals conducting assessments and vulnerability analysis.

The Unbekannt Framework is a specialized hacking and penetration testing tool designed for Windows environments, emphasizing ease of use with a modular command system. Notable features include support for various attack modules, options configuration for each module, and the ability to import custom Python modules. The framework facilitates the execution of penetration tests while encouraging community contributions through shared module development.

LinuxDroid is a tool that provides a Linux Command Line Interface (CLI) and Graphical User Interface (GUI) for Android, enabling users to run various Linux distributions on their Android devices. It features a one-click installation script for easy setup, supports multiple distributions like Kali and Ubuntu, and includes essential security tools such as Nmap and Wireshark, making it suitable for tasks like penetration testing and server management. Additionally, it offers multiple desktop environments and window managers, enhancing the user experience across diverse use cases.

SourceLeakHacker is a multi-threaded web directory scanner designed to identify potential source file leaks on specified URLs. It supports scanning individual URLs or batches from a provided file, offering customizable options such as dictionary scale, threading, and output configurations. Notable features include logging capabilities, results saved in CSV format, and the ability to adjust parameters for timeout and verbosity levels.

Xtreme Nmap Parser (XNP) is a Python utility that parses XML files generated by Nmap and converts them into various formats, including CSV, XLSX, and JSON. Its primary use case is to facilitate data analysis and reporting in network security assessments, with notable features such as file and directory handling, configurable output formats, and advanced filtering options for focusing on specific services or vulnerabilities. Additionally, XNP allows users to maintain pentesting records and provides easy documentation and data sharing capabilities.

Yaralyzer is a tool designed for the visual inspection of regex and YARA matches within binary and text files, allowing users to view the actual bytes matched along with their surrounding context. It supports scanning with customizable regex patterns or YARA rules, detecting potential character encodings of matched bytes, and can display results in various formats such as SVG and HTML. Notable features include the ability to force different character encodings on matched regions and export findings in a visually appealing format, facilitating deeper analysis of patterns within data.

AirJack is a macOS tool designed for scanning Wi-Fi networks and capturing WPA/WPA2/WPA3 handshakes using CoreWLAN. It orchestrates the use of external tools such as AirSnare and hcxpcapngtool for data capture and facilitates the conversion of captures into hashcat format, providing users with options for dictionary or brute-force cracking workflows. Notable features include detailed logging, command line configurability, and a user-friendly launcher for streamlined operation.

Host Scan is a professional network reconnaissance tool written in Python 3 that allows for high-speed scanning of open TCP/UDP ports on remote hosts, leveraging optimized concurrency for rapid results. It provides service identification for open ports, features a modular architecture for clean code separation, and incorporates CI/CD processes with automated testing and security analysis to ensure code quality. The tool is designed explicitly for ethical cybersecurity purposes and must be used only with explicit authorization.

sshprank is a versatile tool designed for SSH reconnaissance and exploitation, offering functionality for mass scanning, login cracking, banner grabbing, and assessing password authentication support. It leverages the python-masscan and Shodan modules to efficiently identify vulnerable SSH services, enabling users to experiment with various configurations and options for effective password cracking. Notable features include support for random IP address generation, multiple credential combinations, customizable thread management, and output logging for successful logins.

Buildware-Tools is a versatile cybersecurity multitool designed for tasks such as Discord automation, OSINT reconnaissance, network diagnostics, and cryptographic utilities, all accessible via a single terminal interface. It operates natively on both Windows and Linux, requires only Python for setup, and features an array of tools, including an IP port scanner, DNS lookup, and a website vulnerability scanner, with some functionalities accessible only after contributing to the project. Regular updates ensure continuous enhancements and the introduction of new features, while a plugin manager allows the integration of community-made plugins.

Linemadpeas is a comprehensive Linux privilege escalation enumeration tool implemented in Bash, designed to thoroughly scan Linux systems for potential privilege escalation vulnerabilities. It offers a user-friendly interface, automatic detection of over 25 vulnerability categories, and detailed exploit methods with executable examples while generating two separate output files for enumeration reports and exploit strategies. This tool is particularly valuable for penetration testing, security auditing, and educational purposes in understanding escalation techniques.

Lulzbuster is a high-speed, multithreaded HTTP(S) directory and file brute-forcing tool designed for penetration testing and security assessments. It leverages concurrent HTTP requests to efficiently enumerate valid file paths and directories, while offering customizable options such as status code filtering, proxy support, and client certificate usage. Notable features include the ability to minimize false positives through smart mode options and support for extensive wordlists to ensure comprehensive scan results.

Nucleimonst3r is a high-speed vulnerability scanner tailored for Red Teams and Bug Bounty Hunters, enabling rapid identification of potential attack targets by fetching and filtering URLs from a specified domain. It leverages the httpx tool for scanning and provides dynamic template generation, real-time scan statistics, and comprehensive report generation, allowing users to customize scans effectively and integrate with other security tools for enhanced testing capabilities.

OpenDoorSim is an open-source tool designed to simulate Physical Access Control Systems (PACS) for hands-on experimentation and research. It supports integration with both Wiegand and OSDP readers, featuring a web UI, on-device menu, and various operating modes for enhanced functionality. The tool is highly portable, powered via USB-C, and optimized for creating engaging demos and workshops in the field of RFID security.

PROTECT-KIT appears to be an unmaintained cybersecurity tool with no functional capabilities, as indicated by the warning of being "USELESS Code." Due to its lack of maintenance and features, it is not suitable for any practical use case in the cybersecurity domain.

PyHTools is a comprehensive collection of Python-based hacking tools designed for network security assessments, including functionalities such as network scanning, ARP spoofing, DNS spoofing, and credential harvesting. It features a user interface for accessibility while allowing command-line usage for advanced users, with an emphasis on ethical use, as all malicious components are stored in a separate repository. The toolkit facilitates a wide range of cybersecurity practices, from reconnaissance to exploitation, but users are warned against any illegal applications.

INtrack is a multi-threaded internet crawler and security scanner focused on network reconnaissance and vulnerability detection. It supports various scanning types, including the detection of web applications, IoT devices, and exposures, while offering flexible target selection, customizable settings, and real-time progress visualization. Notable features include support for multiple scanner types based on CVEs, the ability to scan either specific IPs or subnets, and a customizable thread count for efficient scanning.

Logicytics is a forensic data collection tool designed for Windows systems, developed in Python to systematically retrieve and package extensive system data into a ZIP file for analysis. Its primary use case is to assist cybersecurity professionals in gathering sensitive information for forensic investigations. Notable features include its active development status and straightforward installation process, ensuring comprehensive data harvesting capabilities.

Blexploit is a comprehensive offensive Bluetooth Low Energy (BLE) security framework designed for red teams and security researchers, facilitating passive scanning, exploitation, and replay attacks with advanced anomaly detection. Its modular architecture includes features such as GATT enumeration, customizable attack simulations, and offline sandbox environments, while automatically generating risk assessments and attack module suggestions based on detected device UUIDs. Key functionalities, including real packet injection and an Isolation Forest-based detection mechanism, make it versatile for both testing and education in Bluetooth security contexts.

claude-code-pentest automates the penetration testing lifecycle using six specialized skills that range from reconnaissance to exploit chaining and report generation. Its notable features include subdomain enumeration, vulnerability discovery across web applications and APIs, cloud infrastructure analysis, and the capability to compose findings into comprehensive bug bounty reports—all implemented via 43 standalone Python scripts that require no external dependencies. The tool is designed for authorized security testing only and is integrated with Claude Code for user-friendly command execution.

DRAKBEN is an AI-powered autonomous penetration testing framework that utilizes natural language processing to perform comprehensive security assessments, allowing users to issue commands in plain language. Its notable features include a self-evolving engine for dynamic tool synthesis, a multi-language interface supporting Turkish and English, and advanced memory systems for context-aware decision-making and persistent learning. This framework streamlines the penetration testing process from reconnaissance to reporting with minimal user intervention.

MCPScan is an offensive security auditing tool specifically designed for MCP servers to identify vulnerabilities and misconfigurations. It conducts comprehensive checks across eight categories, including tool poisoning, credential leakage, remote code execution, and supply chain issues, allowing developers to mitigate security risks in AI-connected environments effectively. Notable features include detailed vulnerability reporting, CVE references for known issues, and the ability to detect common attack vectors and exposed sensitive data.

Pentest Toolkit is an advanced penetration testing framework designed for rapid and efficient security assessments, integrating over 100 industry-standard tools into both a Python suite for automation and a Bash interface for hands-on operations. Its primary use case includes comprehensive testing phases, from reconnaissance and web security to SSL/TLS analysis and network assessment, all culminating in professional report generation. Notable features encompass automated reporting in multiple formats, robust web application vulnerability testing, and streamlined reconnaissance processes.

SLAP (Secret Locator and Package-Analyzer) is a tool designed to streamline the discovery of sensitive information in SCCM deployment points by searching for secrets within files and downloading entire packages for analysis. Key features include the ability to report on secrets found using customizable regex patterns, inventory files in CSV format, and bypass secured datalibs for comprehensive scanning. SLAP enhances the efficiency of threat detection in SCCM environments by automating the retrieval and examination of data stored across application packages.

The ThreatHunting-Keywords-yara-rules repository provides a collection of YARA rules tailored for threat hunting sessions, enabling users to identify potential threats based on specific keywords associated with offensive and greyware tools. It features two main ruleset folders: one prioritizing broader detection coverage at the cost of performance, and another optimized for higher fidelity and efficiency, along with a Python script for cross-platform scanning capabilities. The rules are systematically organized and include specialized sets for different tool types while allowing for the identification of potential threats in various file formats.

w4af is an open-source web application security scanner designed for developers and penetration testers to identify and exploit over 200 vulnerabilities, such as Cross-Site Scripting and SQL Injection. Built on Python 3.11 and currently in an alpha development phase, it features integrations for unit and integration testing alongside comprehensive documentation for user guidance.

AIHound is an AI credential and secrets scanner designed to identify exposed API keys, OAuth tokens, and other sensitive credentials across 29 AI tools on multiple platforms, including Windows, macOS, and Linux. It features a robust watch mode for continuous monitoring and real-time alerts on credential changes, alongside integration capabilities with BloodHound for visualizing attack paths and conducting security analysis. The tool promotes safe reporting by redacting credentials by default, making it a crucial asset for security assessments in environments utilizing AI technologies.

BugHunter AI is an autonomous bug bounty hunting framework that leverages Claude Code and the Personal AI Infrastructure (PAI) to conduct vulnerability assessments without human intervention. Its notable features include 28 specialized AI agents and 51 skills that operate in parallel through hypothesis-driven attacks, real-time reporting, and automatic generation of professional bug bounty reports. This tool significantly accelerates the reconnaissance and exploitation phases of security testing, offering enhanced capabilities such as cross-session learning and encrypted credential management.

MCP Security Hub provides a collection of production-ready, Dockerized Model Context Protocol (MCP) servers tailored for offensive security applications, enabling AI-assisted security assessments and vulnerability scanning. With 38 MCP servers covering various domains like reconnaissance, web security, and binary analysis, it integrates over 300 security tools accessible through natural language commands via AI clients like Claude. Noteworthy features include a CI/CD-ready setup with GitHub Actions, minimal Docker images, and orchestration capabilities with Docker Compose for streamlined multi-tool workflows.

recon-deck is a self-hosted reconnaissance tool that transforms nmap output into an actionable, port-aware checklist in under 30 seconds. It features an AI co-pilot to explain scan results and suggest next steps, supports cross-host attack planning, and provides detailed export options for penetration testers and OSCP students, all while maintaining offline functionality. Notable capabilities include usage analytics and integration with HackTricks for enhanced documentation.

SubSurfer is a high-performance tool designed for subdomain enumeration and web property identification, ideal for red team operations and bug bounty hunting. It features fast asynchronous scanning, customizable port scanning, and web service identification capabilities, with a modular design that allows integration with other tools or use as a Python module. Continuous updates and the ability to tailor scans make it a versatile choice for cybersecurity professionals.

WebXray is an offensive web scanner developed in Python that facilitates comprehensive security assessments by combining features such as crawling, XSS and SQL injection detection, security header analysis, and WAF detection. Its notable capabilities include reflected XSS detection, support for various output formats, and ease of integration into existing bug bounty workflows or pipelines. Designed primarily for security professionals, it helps identify potential vulnerabilities in web applications during reconnaissance.

Bjorn Detector is a Python tool designed for detecting the Bjorn device on a local network, displaying its IP address, and facilitating the initiation of an SSH session with a single click on the Bjorn icon. Key features include continuous network detection, an interactive SSH launcher, and seamless installation support for the Bjorn device. It requires Python 3.9+ and utilizes a PyQt6 interface to enhance user interaction.

frameseven is a CLI-oriented offensive web security scanner designed for authorized security testing, capable of mapping a target's attack surface while executing active checks for prevalent web vulnerabilities and misconfigurations. Key features include extensive reconnaissance capabilities, support for authenticated scans, and structured reporting options, along with a dedicated MCP server for AI agents to utilize the same framework tooling. The tool emphasizes a standard-library-centric Go codebase, enhancing readability and extendability.

OpenTaint is an open-source taint analysis engine designed for application security, effectively identifying vulnerabilities that abstract syntax tree (AST) pattern matchers may overlook. Its primary use case involves enhancing security measures for applications, particularly those built with technologies like Java, Kotlin, and Spring, by allowing large language model (LLM) agents to execute vulnerability rules while offering scalable performance. Notable features include formal taint analysis capabilities and extensive integration support for various programming languages and platforms.

OXIDE is a precision-forged Rust-based vulnerability scanner designed for offensive security applications, particularly penetration testing and security research. Key features include an async concurrent architecture, a WAF evasion suite, an AI/ML-driven zero-day detection engine, and a modular framework with 14 detection modules. This tool is optimized for Kali Linux and emphasizes responsible use, strictly prohibiting unauthorized access or malicious applications.

ADMmutate is a polymorphic shellcode mutation engine designed to evade Network Intrusion Detection Systems (NIDS) by generating unique but functionally equivalent code fragments that resist signature-based detection. Its notable features include XOR-based polymorphic encoding, sliding key mechanisms, and multiple code paths, enhancing its ability to obfuscate shellcode in various architectures such as IA32, SPARC, and MIPS. The tool specifically targets signature analysis weaknesses in NIDS, employing advanced techniques to adapt and randomize its output dynamically.

CloakQuest3r is a Python-based security research tool designed to assess potential origin IP exposure of websites utilizing Cloudflare and similar reverse proxy or CDN services. Its primary use case involves subdomain enumeration and passive analysis techniques to identify misconfigurations that could lead to the disclosure of sensitive server infrastructure. Notable features include its capability for real IP detection, making it essential for security professionals, penetration testers, and web administrators focusing on authorized security testing and infrastructure hardening.

The CVE-2025-32463_chwoot repository provides a proof-of-concept implementation to demonstrate the privilege-escalation vulnerability in the chroot feature of vulnerable versions of `sudo`. It includes a Docker environment to build and run an exploit that showcases how to gain root access in affected systems. Notable features include a Dockerfile for setting up the environment and a script that facilitates the execution of the exploit inside a container.

The CVE-2025-55182 Scanner & Exploiter tool is designed to detect and exploit a critical remote code execution vulnerability in specific versions of React Server Components. It features detection capabilities for scanning single or multiple targets, as well as an exploitation mode that provides an interactive shell and options for reverse shell execution. The tool supports proxy usage and allows for multi-threaded scanning to enhance performance.

The CVE-2025-66516-Writeup-POC repository provides a detailed analysis and proof of concept for a critical XML External Entity (XXE) injection vulnerability in Apache Tika, with a CVSS score of 10.0. This vulnerability enables remote attackers to exploit specially crafted PDF documents to read arbitrary files and exfiltrate sensitive information. Notable features include specific details on affected versions, the technical breakdown of the vulnerability, and instructions for testing in a controlled environment.

CVE-2025-68613-POC is a Python-based proof-of-concept tool designed to demonstrate a critical Remote Code Execution (RCE) vulnerability in the n8n workflow automation platform. It includes a scanner for non-destructive detection of vulnerable instances and a Nuclei template for automated testing of expression injection capabilities, both facilitating the assessment of affected versions and helping security professionals identify potential exploits safely. Notably, it emphasizes the ability to interact with Node.js global contexts to validate vulnerability exploitation scenarios.

The illusionsec Archive is a comprehensive collection of Distributed Denial of Service (DDoS) tools, scanners, and botnet resources tailored for cybersecurity professionals and researchers. It features multiple versions of notable botnets, such as Mirai and QBot, alongside vulnerability exploits, various attack methods (Layer 4, Layer 7, UDP, TCP), and additional utilities for bot compilation and command/control management. This archive serves as an extensive toolkit for testing and analyzing DDoS attack methodologies and their defensive countermeasures.

R2SAE is a command-line tool designed to exploit prototype pollution vulnerabilities in React Server Actions, facilitating remote command execution on affected servers. Key features include command execution on single or multiple hosts, an interactive shell for streamlined command input, and a vulnerability scanning capability with both passive and active methods. This tool is intended solely for authorized security testing and educational purposes.

The botnet-exploits repository is a collection of network vulnerability scanners designed to identify security weaknesses across various devices for educational and authorized testing purposes. It includes tools specifically for testing DVRs, ZHONE routers, Fiber routers, and performing telnet brute force attacks, featuring capabilities like multi-threaded scanning, real-time status updates, and automated credential testing. Users are required to configure payload URLs for legitimate testing environments, reinforcing the ethical use of these tools.

Mephisto is a WordPress vulnerability scanner and exploitation framework designed for authorized penetration testing, enabling security professionals to assess multiple WordPress installations for security weaknesses. Key features include multi-CVE support, mass scanning capabilities, automatic detection of vulnerable plugins and themes, and the ability to upload web shells for post-exploitation access, all while ensuring anonymity through proxy support and anti-detection measures.

Octoscan is a static vulnerability scanner designed for GitHub action workflows, enabling users to identify potential security issues within their CI/CD pipelines. Its primary use case is analyzing workflows for various vulnerabilities, including dangerous actions, credentials exposure, and expression injection. Notable features include the ability to download workflows from remote repositories, customizable rule sets for scanning, and support for multiple output formats, ensuring flexibility in vulnerability reporting.

This repository provides a proof-of-concept for CVE-2025-55182, a critical pre-authentication remote code execution vulnerability found in specific versions of React Server Components. The vulnerability enables unauthenticated attackers to execute arbitrary JavaScript code on the server by exploiting unsafe deserialization through prototype chain traversal in the Flight protocol. Notably, the tool facilitates demonstration of the exploit process, requiring a vulnerable React setup and tools like Burp Suite for payload delivery and testing.

wphunter is a Python CLI tool designed for scanning WordPress plugins, themes, and core files for known CVE vulnerabilities, as well as detecting gambling spam injections (judol) and looking up public exploits. It operates both offline, using exported lists, and remotely via a URL, providing AI-powered analysis through Claude, including intelligent threat assessments and actionable remediation steps. Notable features include support for multiple vulnerability sources, comprehensive judol detection mechanisms, and version-aware matching to report relevant vulnerabilities based on the installed versions.

CR4SH3R is a vulnerability scanner specifically engineered to identify Arbitrary File Download flaws in WordPress plugins by scanning for sensitive data exposure through common file paths. It features multi-threaded scanning for efficiency, smart data extraction capabilities, and provides organized reports in XLSX format, all presented through a user-friendly GUI. Notably, the tool allows users to extend its payloads for enhanced detection and supports customized scanning configurations.

MikrotikAPI-BF is a comprehensive RouterOS attack and exploitation framework designed for conducting automated security audits, brute-force credential attacks, and exploiting vulnerabilities in Mikrotik routers. Its notable features include a robust exploit engine with coverage for over 100 CVEs, multiple attack vectors such as REST API, SSH, and MAC-Telnet, as well as threading capabilities for multi-target scans. The tool also supports offline credential decoding and unique capabilities like MAC-Server Layer-2 discovery for devices without IP addresses.

Awesome Security & Hacking is a comprehensive resource for ethical hacking, focusing on penetration testing, vulnerability scanning, and exploit development. The repository offers a collection of tools, scripts, and hands-on labs categorized across various domains such as network security, web application security, and cryptography, making it suitable for both beginners and advanced practitioners. Notable features include structured content on specialized areas like bug bounty and wargames, as well as community engagement through contributions and feedback channels.

WP-Scanner is an advanced vulnerability scanner and exploitation framework specifically designed for WordPress, capable of identifying 75 CVEs across core, plugins, and themes. Its notable features include comprehensive fingerprinting, active exploitation capabilities with 36 exploit handlers, and mass scanning with thread-safe execution. The tool supports HTML and Markdown report generation and includes automatic updates for both the tool and its vulnerability database.

AgentSeal is a comprehensive security toolkit designed for AI agents, providing robust capabilities such as detection of malicious configurations, tracing toxic data flows, and scanning for potential supply chain vulnerabilities across various agents. It features an extensive pipeline for local scanning, real-time monitoring, and auditing of machine configurations without the need for API keys, alongside the ability to test against 225+ adversarial prompts. Notable functionalities include the `guard` command for scanning and assessing the security of agent configurations and the option to create organization-specific policies through custom rule sets.

Awesomenmap is a comprehensive knowledge base dedicated to Nmap, providing a centralized repository for essential Nmap NSE scripts, CVE search tools, and automated reconnaissance pipelines. It streamlines access for security analysts, pentesters, and blue teams, featuring organized references and integration of third-party scripts to ensure they are current. Notable features include post-scan reporting capabilities and visualizations for enhanced security assessments.

Basilisk is an open-source AI red teaming framework designed for automated adversarial prompt testing against various large language models (LLMs) such as Claude and GPT-family models. It features evolutionary prompt search, structured attack modules, and a real-time scan dashboard, enabling security researchers and penetration testers to conduct repeatable and comprehensive security assessments of LLM applications. Notable capabilities include differential mode comparisons across multiple model providers, guardrail posture scanning, and the ability to export test results in various formats.

BenchJack is a vulnerability scanner designed to assess whether AI benchmarks can be manipulated, highlighting weaknesses before adversarial agents can exploit them. It employs a multi-phase audit process that combines static analysis tools with AI-driven deep inspection, categorizing vulnerabilities into eight distinct classes and providing real-time results via a web dashboard. Notable features include proof-of-concept exploit code generation and future integration of Docker sandboxing for enhanced security during analysis.

Capsaicin is a next-generation web directory and asset discovery engine designed for red teamers, bug bounty hunters, and DevSecOps. It employs advanced evasion techniques, including TLS fingerprint spoofing and human-like delay simulations, to bypass modern web application firewalls and effectively uncover hidden paths, secrets, and misconfigurations. Notable features include smart auto-calibration to eliminate false positives, stateful fuzzing for misconfigured APIs, and the ability to detect over 16 different WAFs.

Cervantes is an open-source, collaborative platform tailored for penetration testers and red teams, serving as a comprehensive management tool for organizing projects, vulnerabilities, and reports in a centralized location. It enhances operational efficiency by providing features such as team collaboration, OWASP compliance reports, built-in dashboards, and one-click report generation. Designed to be multiplatform and multilanguage, Cervantes streamlines penetration testing activities, significantly reducing coordination time and effort.

LongLogon is a non-destructive precondition checker for the CVE-2026-41089 vulnerability, which is a stack buffer overflow affecting the Windows Netlogon service. It operates without authentication and does not exploit the vulnerability; instead, it sends benign CLDAP pings to determine if a domain controller's DNS domain name is sufficiently long to trigger a crash. This tool provides a reliable mechanism for security assessments by validating the conditions necessary for the vulnerability without the risks associated with executing an exploit.

Harpoon is an autonomous black-box penetration testing tool designed for web applications, optimized for use on Kali Linux but capable of running on other Debian-based distributions and WSL. It orchestrates and integrates various existing security scanners, streamlining the process of vulnerability discovery by normalizing outputs into a relational SQLite model and providing comprehensive reporting, including HTML reports and PoC artifacts. Notable features include asynchronous execution, WAF-awareness, and extensive automated phases covering everything from DNS reconnaissance to validation of findings.

Huntbot is a multi-model offensive security tool designed for bug bounty hunting, penetration testing, and red teaming, offering advanced capabilities for vulnerability detection and reporting. Notable features include contextual knowledge accumulation, human-like interaction with web applications, the ability to share live browser sessions, and meticulous false positive validation before report generation. It is extensible with multiple AI models and allows for dynamic steering during runs, enabling security professionals to efficiently explore and validate security vulnerabilities.

Juumla is a Python-based tool designed for identifying Joomla versions, scanning for vulnerabilities, and detecting sensitive files within Joomla installations. Key features include fast scanning capabilities with low resource utilization, the ability to find configuration and backup files, and vulnerability detection based on the identified Joomla version. Additionally, Juumla can be easily deployed via Docker for a streamlined setup process.

LLMtary is an AI-powered penetration testing platform designed for security professionals, facilitating an autonomous workflow from reconnaissance to exploit validation and report generation. It integrates large language model intelligence to conduct a comprehensive examination of targets, capable of operating entirely offline with local models or utilizing cloud-based AI for improved accuracy. Key features include a structured testing loop, multi-phase enrichment for targeted vulnerabilities, and native support across major operating systems, ensuring a streamlined and efficient penetration testing experience.

Mythos Research Edition is an open-source tool designed for vulnerability discovery in software applications, utilizing the publicly available Claude Opus 4.7 model to replicate the eight-phase scaffold of Anthropic's Mythos Preview. It enables open-source maintainers, security researchers, and academics to conduct targeted scans at a low cost, facilitating coordinated vulnerability disclosure while avoiding unauthorized mass scanning. Key features include self-scanning capabilities for project audits and research, without requiring access to Anthropic's proprietary model.

NetCrawler is an AI-driven reconnaissance and vulnerability scanning tool that utilizes a local Ollama LLM to automate the scanning process. It intelligently selects and executes various reconnaissance modules such as subdomain enumeration, web fingerprinting, and vulnerability scanning, while generating structured reports in both Markdown and JSON formats. Notable features include a terminal-based user interface, iteration through an observation-think-act cycle, and the capability to integrate additional modules seamlessly.

numasec is an AI-driven security agent that enhances terminal-based workflows by integrating existing tools and methodologies for security operations. It facilitates tracking findings, documenting evidence, and generating reports while adhering to security runbooks, making it well-suited for Application Security (AppSec) and penetration testing workflows. With numasec, security professionals can streamline their processes and maintain operational context within a familiar environment rather than depending on separate chatbots or scanners.

Phantom is an autonomous AI-driven penetration testing platform designed to perform detailed reconnaissance and exploit vulnerabilities without human intervention. Integrating over 30 professional security tools within a secure Docker environment, it leverages a reasoning loop to adaptively select and execute multi-step attack vectors, producing verified findings complete with proof-of-concept scripts. Unlike traditional scanners that rely on static CVE signatures, Phantom delivers a comprehensive and accurate vulnerability assessment with real-time adaptability and detailed reporting aligned with the MITRE ATT&CK framework.

ReconMind is an AI-powered bug bounty agent designed to emulate the decision-making process of a senior penetration tester, automating the entire vulnerability assessment workflow from reconnaissance through to reporting. Key features include an LLM-driven approach that intelligently selects targets and scans, filters false positives, and generates platform-ready reports for services like HackerOne and Bugcrowd. Its streamlined pipeline ensures comprehensive coverage, while being free to use, and provides flexibility with local and cloud-based LLM integrations.

AI OSINT is a comprehensive toolkit designed for identifying exposed artificial intelligence infrastructure on the internet through curated OSINT resources, including Google dorks, Shodan, and GitHub queries. It serves Red Team operators, penetration testers, and OSINT researchers by providing specific detection methods for various AI entities, such as LLM endpoints, AI agent gateways, and leaked API keys, while addressing emerging threats such as systemic supply chain vulnerabilities and credential leaks. Notable features include a keyword substitution convention to tailor searches to specific needs, enhancing its utility in real-world cybersecurity assessments.

Akira is an AI-powered penetration testing tool designed to operate natively within various environments, including Claude Code and Gemini CLI. It specializes in identifying vulnerabilities that traditional scanners may overlook, such as logic flaws and cryptographic weaknesses, by integrating a structured reasoning system that demands reproducible evidence for each finding. Notable features include a robust technique library, a Bayesian hypothesis engine, and the ability to handle complex attack vectors through a systematic engagement and reporting workflow.

Beatrix Suite is a command-line bug bounty hunting framework designed to streamline the entire pentesting workflow by integrating 32 scanner modules and 22 external tools. It features a 7-phase Kill Chain methodology, automated login and session management, and an AI-assisted pentester (GHOST) for advanced analysis, making it suitable for scanning domains, URLs, and IP addresses efficiently in headless environments. This tool aims to eliminate the fragmentation of traditional bug bounty tools by providing a single-command interface that orchestrates multiple tools throughout the assessment process.

CatchClaw v5.3.0 is a multi-platform AI Agent security assessment tool that supports nine different AI platforms including OpenClaw and Dify. It features 78 DAG attack chains and exploit modules that cover a full range of attack vectors from reconnaissance to data leakage, utilizing an asynchronous Tokio engine for concurrent execution while offering visual attack graph exports and customizable reporting options. The tool is designed to facilitate automated vulnerability verification and threat modeling within complex multi-agent environments, restricted to non-commercial use only.

Claude Security Skills is a collection of tools designed to enhance the security analysis of software projects, specifically through the Claude Code platform. It enables users to perform various tasks such as scanning for leaked secrets, conducting static code analysis on Python, testing for prompt injection in language models, and auditing HTTP headers and security configurations. With no external dependencies and the ability to run analyses offline, the tool provides a secure and efficient approach to identifying vulnerabilities in various project components.

DLLHijackHunter is an automated detection tool designed for identifying, validating, and confirming DLL hijacking opportunities on Windows systems. It employs a multi-phase approach that includes discovery of exploitable binaries, filtration of false positives, and the deployment of a harmless canary DLL for verification, providing a comprehensive scoring and reporting mechanism. Notable features include extensive coverage of various hijack types, UAC bypass discovery, and a focus on corroborating potential attack paths with actionable intelligence.

Lain C2 is a command-and-control framework designed to facilitate secure communication between compromised hosts and operators across multiple platforms including Windows, Linux, macOS, and Android. It supports various communication protocols such as HTTP/1, 2, and 3, and integrates third-party libraries for enhanced functionality, making it a versatile tool for conducting remote management and operations. Notable features include cross-platform compatibility and efficient handling of system metrics and processes.

Pentest-ai is an AI-powered penetration testing tool designed to enhance the verification of security findings by re-running exploits to confirm their validity, ensuring that each piece of evidence is backed by reproducible results. It streamlines the verification process by generating multi-step attack paths and providing a reporting mechanism that only includes findings validated by its oracle system, achieving 100% precision with zero false positives across multiple vulnerability classes. The tool operates offline without cloud reliance, making it ideal for authorized testing in a controlled environment.

ReconNinja is an autonomous multi-phase security reconnaissance framework that conducts comprehensive security assessments through a single command. It supports a myriad of functionalities including passive OSINT, port scanning, web discovery, vulnerability scanning, and Active Directory enumeration, producing reports in multiple formats like HTML, JSON, and Markdown. Notable features include an adaptive agent mode for dynamic decision-making, a user-friendly GUI, and enhanced reliability for complex scans with a uniform `PhaseContext` adapter layer.

Tengu is a multi-command platform (MCP) server that functions as an AI-assisted penetration testing copilot, integrating with various security tools such as Nmap and Metasploit. It automates reconnaissance and scanning processes while allowing users to maintain control over exploit actions, featuring advanced safety controls like allowlisting and audit logging. Notable features include its orchestration of 80 tools, automated report generation, and pre-built workflows for diverse pentesting scenarios.

Zscan is a fast and customizable service detection tool designed to identify services, APIs, and network configurations within infrastructure using a flexible fingerprint system. Key features include high-performance concurrent port scanning, intelligent service detection capabilities (such as MAC vendor identification and OS fingerprinting), precise proof of concept (POC) targeting, and versatile output formats including JSON and human-readable options. This tool enhances scanning accuracy and speed compared to traditional methods, making it valuable for network security assessments.

Omniscient V3 is a comprehensive reconnaissance and adversary simulation framework designed to enhance security assessments by consolidating over 130 best-in-class tools into a unified pipeline. Key features include AI-driven results augmentation, distributed execution across platforms such as Kubernetes and Docker, advanced stealth techniques for emulating sophisticated attacks, and immutable audit trails for compliance and reporting. This tool is primarily aimed at security professionals, providing a streamlined approach to identifying vulnerabilities in complex attack surfaces.

ScanCannon is a high-speed Bash script designed for efficient credentials-based attack surface enumeration and reconnaissance of large external networks, leveraging tools like `masscan` for rapid port detection and `nmap` for detailed service analysis. It outputs consolidated reports in HTML and CSV formats while enabling project-driven scanning that tracks changes over time, facilitating continuous monitoring of attack surfaces. Notable features include full ASN-based discovery, API detection, CVE hinting, and resilience through checkpointing and parallel scanning.

AutoRedTeam-Orchestrator is a local-first, MCP-native automation platform designed for authorized testing and AI/MCP attack surface auditing. It features a modular security capability set accessible via an MCP Server, Python SDK, and Typer CLI, enabling static code audits, reconnaissance, and vulnerability detection primarily for research and training purposes. Notable capabilities include AI-assisted audits, configurable scanning profiles, and different export formats for audit reports, each tailored for secure and compliant usage scenarios.

HackMyAgent is a security scanning and behavioral simulation toolkit designed specifically for AI agents, providing red-team capabilities to identify vulnerabilities across various categories. It features comprehensive static and semantic checks, including a NanoMind semantic layer, which evaluates agent configurations and evaluates vulnerabilities like credential exposure and context manipulation. The tool also supports deep behavioral simulations and self-securing mechanisms to ensure the integrity of its binaries.

HydraSoft is an advanced open-source tool designed for detecting DLL hijacking vulnerabilities within Windows environments, facilitating privilege escalation. It automates the analysis of executable files and their associated DLLs by scanning directory structures and import tables, thus identifying specific hijacking opportunities. Notable features include a real-time graphical user interface for centralized endpoint management and a color-coded rating system to prioritize targets based on the complexity of crafting proxy DLLs.

kcwarden is a Python tool designed to audit Keycloak configurations, identifying common misconfigurations and security vulnerabilities. Its primary use case is to enhance the security posture of Keycloak implementations by enabling users to download their configuration and perform detailed audits. Notable features include ease of installation via pip, straightforward usage commands for downloading configurations, and auditing, complemented by comprehensive documentation.

Miner In The Middle is a Python-based tool that facilitates the injection of JavaScript cryptocurrency miners into HTTP responses of targets on a local network via ARP spoofing. It features configurable options for injection scripts and IP constraints to ensure targeted use, along with an easy setup process that automates iptables configuration and packet forwarding. Users can also implement custom JavaScript for injection and execute various attack modes, including standard miner attacks and popunder techniques.

pphack is an advanced client-side prototype pollution scanner designed to identify vulnerabilities in web applications. It offers a variety of features including the ability to scan single or multiple URLs, configure concurrency levels, set timeouts, and conduct automatic exploitation. The tool utilizes Chrome or Chromium for its operations, allowing for custom JavaScript execution and flexible output options such as JSON format.

The prompt-injection-auditor is an agent skill designed to enhance the security of AI prompts by auditing them for potential prompt-injection vulnerabilities. Its primary use case is to identify weaknesses using a static scanning approach, complemented by an attack catalog and a defense checklist, particularly in light of real-world incidents. Notably, the tool improves differentiation between hardened and vulnerable prompts while maintaining a zero false-positive rate, enabling developers to proactively address security flaws in their AI systems.

Storm-Framework is an offensive security tool suite designed for reconnaissance, vulnerability assessment, and exploitation, catering to cybersecurity professionals, penetration testers, and bug bounty hunters. Built with a user experience similar to Metasploit, it streamlines security testing workflows and supports multiple platforms including Kali Linux, Ubuntu, and Windows. Notable features include a comprehensive framework flow, detailed documentation, and a structure visualizer that aids in navigating the tool's components.

SubdomainX is an advanced subdomain discovery and security reconnaissance tool that integrates over twelve enumeration tools and six API services into a single command-line interface (CLI). Its primary use case is to facilitate comprehensive subdomain enumeration, vulnerability detection, and monitoring, featuring capabilities such as HTTP probing, technology fingerprinting, subdomain takeover detection, and notifications via various platforms. Notable features include the ability to generate detailed reports in multiple formats, an interactive terminal user interface (TUI), and support for resuming interrupted scans, making it a robust solution for security assessments.

Titus is a high-performance secrets scanner designed to detect credentials, API keys, and tokens within source code, files, and git history. Targeted at security engineers and DevSecOps teams, it features accelerated regex matching, live secret validation, broad coverage with 487 detection rules, and multiple scanning interfaces including CLI, Go library, and browser extensions. Notably, Titus also supports container image scanning and binary file extraction for enhanced security assessments.

Red-Team AI is a white-box red teaming tool designed to identify security vulnerabilities in agentic AI applications by analyzing the source code for specific bugs related to the application's stack. Its notable features include a comprehensive dashboard for scan management, customized attack generation based on the application's architecture, and compliance tracking against industry standards like OWASP LLM Top 10. This tool is particularly useful for developers working with AI agents in sensitive environments such as finance or healthcare, where unique security risks can arise.

Awesome Attack Surface Monitoring is a curated repository of open-source and commercial Attack Surface Monitoring (ASM) tools designed to enhance an organization's security posture by identifying and managing vulnerabilities across their digital assets. This resource categorizes tools in an accessible format, highlighting editor's choices and providing visual overviews of key tools. Notable features include a comprehensive list of ASM solutions and visual representations, aiding in the selection of appropriate tools for various use cases.

BeeScan is a modular IT infrastructure security auditing platform that facilitates comprehensive penetration testing and infrastructure assessments through the integration of external tools as plugins. Its notable features include automated result collection and multi-format report generation (TERMINAL, HTML, PDF), PostgreSQL database support for centralized result management, and Docker isolation for environment containerization, making it suitable for DevSecOps workflows and large-scale security audits.

CloudFlair is a cybersecurity tool designed to identify the origin servers of websites that utilize CloudFlare or CloudFront while exposing them publicly. Its primary use case involves leveraging Censys's internet-wide scan data to locate IPv4 hosts that present SSL certificates linked to the specified domain, thereby highlighting potential misconfigurations. Notable features include API integration with Censys, a user-friendly command-line interface for domain scanning, and the capability to differentiate between CloudFlare and CloudFront services.

DisHost is a command-line IP range scanner that performs configurable health checks, including ICMP, TCP, and HTTP/HTTPS tests. Its notable features include multiple ways to specify IP ranges, comprehensive health check configurations, multi-threaded performance for efficiency, and diverse output options such as JSON and CSV formats. This tool is designed for network administrators and cybersecurity professionals to assess the availability and responsiveness of hosts within specified IP ranges.

dnsmap is a tool designed for scanning domains to identify subdomains through brute-forcing techniques, utilizing a built-in wordlist of approximately 1000 English and Spanish terms. It is primarily used by penetration testers during the information gathering phase of security assessments to uncover hidden servers and resources that may not be easily discoverable through standard enumeration methods. Notable features include the ability to save results in CSV and human-readable formats, and it operates without requiring root privileges to enhance security.

DomXssFinder is a tool designed to identify potential sources and sinks within JavaScript code that can lead to DOM-based cross-site scripting (XSS) vulnerabilities. It features two primary commands, `fsource` for locating user-controlled data inputs and `fsink` for spotting dangerous JavaScript functions or DOM objects, aiding developers in securing their web applications against XSS attacks. Notably, it provides context enhancement for findings and integrates with JSextractor for comprehensive JavaScript code retrieval from URLs.

`jwtcat` is a Python-based tool designed for detecting and exploiting vulnerabilities in JSON Web Tokens (JWTs), particularly the signature bypass flaw associated with the `alg=none` algorithm and guessing attacks against HS256 private keys. It supports brute-force and wordlist attacks, allowing users to efficiently test JWTs for security weaknesses. The tool is fully implemented in Python 3 and features options for detailed attack parameters and reporting.

Kaboom is an automated penetration testing tool focused on information gathering and vulnerability assessment. It integrates multiple utilities such as Nmap, Dirb, Nikto, and Hydra to conduct comprehensive scans and assessments, with results organized in an easily navigable directory. Notable features include support for both interactive and non-interactive modes, extensive customization options, multi-target scanning, and automatic identification of relevant Metasploit modules for vulnerabilities found.

PowerLadon is a modular penetration testing tool designed for network reconnaissance, vulnerability scanning, and exploitation, offering capabilities for batch processing across various IP segments. It features extensive support for different protocols, built-in modules for high-risk vulnerabilities, password auditing, and remote command execution, while allowing users to customize and develop their own plugins. Its ease of use and compatibility with PowerShell and Cobalt Strike enhance its versatility in both internal and external network penetration tasks.

r3conwhal3 is a multifunctional reconnaissance tool designed for web application data collection and analysis, employing a concurrency-based approach to enhance performance and resource efficiency. Its primary use case includes performing both passive and active reconnaissance, with capabilities to enumerate subdomains, conduct vulnerability scans, and manage custom configurations through an environment file. Notable features include a comprehensive execution chain, support for Docker deployment, and the ability to save output results for future reference.

SBSCAN is a penetration testing tool specifically designed for the Spring framework, capable of conducting unauthorized scans and sensitive information detection on Spring Boot applications, as well as identifying and validating related vulnerabilities. Notable features include an extensive dictionary for sensitive paths, fingerprint detection capabilities to optimize resource usage, modular architecture for user-defined extensions, and comprehensive support for various types of vulnerability checks, including the latest CVEs. The tool also implements functionality for noise reduction in results, allowing users to focus on successful detections, and supports various scanning configurations such as URL or file-based targets, proxy settings, and multithreading.

SmuggleFuzz is a configurable HTTP downgrade smuggling scanner designed to identify overlooked smuggling vulnerabilities in web applications. Its notable features include customizable gadget lists, multiple scanning options with support for various HTTP methods and headers, and the ability to filter responses by specific criteria. The tool enables deeper insights into failed attacks, making it a powerful resource for security professionals aiming to enhance their vulnerability assessments.

sqlscan is a web scanning tool designed to detect SQL injection vulnerabilities in websites quickly. Its primary use case is for security testing and penetration testing, enabling users to scan individual URLs or lists of URLs for potential security flaws. Notable features include multi-platform support, speed, and the ability to utilize sitemaps for enhanced scanning results.

Vide.sh is a versatile tool designed for probing and crawling targets to enumerate their attack surface through various scanning engines, such as nmap, httpx, and whatweb. It can process input from various sources, including XML files, lists of targets, standard input, and direct strings, while offering a range of configurable scanning options to tailor the attack surface enumeration according to user needs. Notable features include the ability to skip probing and crawling, run multiple types of scans, and generate organized output, including screenshots and detailed logs of the scanning results.

ftpknocker is a multi-threaded scanner designed to identify anonymous FTP servers across various target networks. Its primary use case includes scanning individual IP addresses or entire IP blocks, with customizable options for threading, port specification, and timeout settings. Notable features include support for input via piping from other programs and a flexible usage syntax similar to nmap, enhancing its functionality for security assessments.

The 3num-tool is a versatile enumeration utility designed for authorized security testing, enabling users to gather information about various services such as SSH, FTP, HTTP, DNS, and SMB. Its notable features include support for credentialed enumeration, anonymous access testing for FTP, and integration with tools like Gobuster and Hydra for more comprehensive assessments. The tool emphasizes compliance with legal and ethical guidelines, catering to security professionals conducting vulnerability assessments.

BugHunter-AI is an automated penetration testing agent designed with a cyberpunk-themed GUI that facilitates resource-aware task scheduling and AI-assisted analysis. Its primary use case is for authorized security testing in controlled environments, allowing users to enqueue tools while managing CPU and RAM limits for safe execution. Notable features include per-round report generation, automated CVE extraction, and integration with external AI services for enhanced command suggestions based on analysis results.

dnsspider is an asynchronous, multithreaded tool designed for brute-forcing subdomains using either a specified wordlist or character permutations. Its primary use case is to discover subdomains of a target domain quickly, allowing for various attack types, including dictionary-based or brute-force methods. Notable features include customizable character sets, the ability to query multiple DNS record types, and options for logging results in different formats, making it versatile for reconnaissance purposes in cybersecurity assessments.

HunterA is an advanced mobile penetration testing framework designed for Android devices operating without root access, functioning within the Termux environment. It consolidates a diverse array of powerful tools for tasks such as port scanning, WHOIS/DNS reconnaissance, CVE vulnerability searches, and traffic sniffing, along with features like a fully asynchronous engine and integration with Termux:API for enhanced capabilities. Its modular design supports a range of functionalities, from OSINT to vulnerability exploitation, making it a comprehensive solution for mobile pentesting.

NetRaptor is a GUI-based ARP poisoning tool designed for educational use and authorized network security testing, allowing users to scan networks, select targets, and perform Man-in-the-Middle (MITM) attacks. Key features include easy network scanning, ARP poisoning capabilities, packet analysis integration with Wireshark, and a user-friendly interface built with Tkinter. The tool is compatible with various Linux distributions and emphasizes ethical usage in controlled environments.

portmap is a high-speed port scanning tool that leverages Shodan's public data to identify open ports associated with specified IP addresses or CIDR ranges. Its primary use case is to quickly ascertain accessible services on remote hosts using Shodan's APIs, featuring commands for basic port scans and enhanced details retrieval, including ASNs and organization details. Notable functionalities include JSON output options, support for multiple IP inputs, and a user-friendly command-line interface.

ronin-vulns is a Ruby library designed for blind vulnerability testing, specifically targeting various web application vulnerabilities such as Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL Injection (SQLi), reflective Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects. Its notable features include support for testing multiple parameter types (query parameters, HTTP headers, cookies, and form parameters), along with high documentation and test coverage metrics, making it a robust tool for security researchers and developers within the ronin-rb project framework.

ScanPro is a menu-driven tool that enhances the functionality of Nmap for network scanning purposes. Its primary use case involves simplifying the scanning process by allowing users to select target IPs, ports, and scan types through an interactive menu, while also facilitating service detection and output formatting. Notable features include support for NSE scripting and HTTP information gathering, making it a versatile utility for penetration testing and network analysis.

scans2any is a tool designed to convert infrastructure scan outputs into various formats like Markdown, YAML, HTML, and CSV, while also facilitating the creation of launch scripts and configuration files for different scanners. Its primary use case focuses on merging and processing multiple scan results to enhance security assessments and reporting. Notable features include support for numerous input formats, conflict resolution options, and the ability to run in a Docker container for simplified deployment.

tldscan is a high-performance domain scanner designed to identify active domains by testing various Top-Level Domains (TLDs) against user-specified domain names. It features customizable concurrency levels, wordlist options for domain generation, and the ability to output results to a specified file, making it suitable for domain reconnaissance tasks in cybersecurity. Notably, users can choose between small and large wordlists and utilize silent or verbose modes for streamlined operation or detailed debugging.

The Venera Framework is a Lua-based tool designed for automating customizable tests and attacks across various protocols. Its primary use case lies in vulnerability scanning and exploitation, allowing users to create and manage scripts that target specific vulnerabilities or conduct general verification tasks. Notable features include a built-in package manager, the ability to import and export scripts, and a flexible scripting environment that supports user-defined modules for tailored security testing.

WebCap is a lightweight web screenshot tool that captures fully-rendered DOMs and detailed HTTP request/response logs without the need for browser automation frameworks. Its primary use case is to provide comprehensive insights into web pages, with unique features including JSON output, JavaScript extraction, and OCR text extraction. Users can operate it via a command line interface or a web server, allowing for automated scanning of multiple URLs and capturing of detailed web elements efficiently.

Windfire is a high-performance, Rust-based tool designed for URL liveness detection, enabling fast and lightweight asset availability checks for domains, IPs, and URLs. Its notable features include support for HTTP/SOCKS proxies, HTTP status code filtering, customizable paths, and the ability to choose between liveness-only and full fingerprinting scan modes, all while maintaining high concurrency and asynchronous execution. Additionally, users can control the scan rate and export results in CSV or JSON formats.

BugBounty Arsenal is a comprehensive, full-stack security scanning platform designed for bug bounty hunters and security researchers. It features over 50 detectors for various vulnerabilities across multiple categories, continuous monitoring with scheduled scans, findings triage to manage results over time, and CI/CD integration to automate security checks in development pipelines. Unique capabilities include attack surface management, tailored AI-driven remediation advice, and extensive reporting options, all from a centralized dashboard.

Cokmap is a high-speed network scanner developed in Go that detects services and products on open ports using probes formatted according to the nmap-service-probes schema. Notable features include rapid product detection through a plugin architecture, support for flexible configuration, and the ability to generate detailed statistics. It is compatible with both Linux and macOS systems and offers a straightforward command-line interface for input and output handling.

This tool exploits the Remote Code Execution vulnerability (CVE-2021-3129) found in specific Laravel versions, enabling users to execute commands on vulnerable instances with "APP_DEBUG" set to true. Key features include the ability to write and execute commands remotely, as well as several patch options to secure the application against the exploit. The tool is intended for educational and research purposes, emphasizing the importance of responsible usage.

Dark Nexus is a modular and multi-threaded C++17 framework designed for comprehensive network reconnaissance and infrastructure analysis. It consolidates various tools into a single executable, offering powerful features including subdomain scanning, OSINT gathering, and advanced asset mapping through a user-friendly hybrid CLI. Its aggressive multi-threading capabilities and intuitive architecture ensure efficient operations across 12 distinct modules, catering to a wide range of reconnaissance needs without the burden of complex setups.

JSpider is an advanced JavaScript-based crawler and endpoint discovery tool designed for security researchers, facilitating the extraction of hidden API routes, sensitive parameters, and hardcoded secrets directly from websites. Notable features include automated checks for over 500 critical paths, parameter discovery, recursive crawling, high-fidelity secret detection for 40 patterns, and seamless authentication header handling to access secured endpoints. The tool operates entirely client-side, offering real-time tracking and analysis of extracted data in a straightforward dashboard.

**reconFTW** is an automated reconnaissance tool aimed at security researchers and penetration testers, streamlining the information-gathering process. It integrates a variety of scanning and enumeration techniques, allowing users to gather extensive details on target domains through an intuitive interface. Notable features include support for multiple platforms, Docker compatibility, and an array of built-in reconnaissance modules that enhance operational efficiency.

RedTeam Agent is an autonomous AI-powered simulation tool designed for red teaming and penetration testing, streamlining the process of security assessments across multi-platform environments. It features 8 specialized AI agents that facilitate a comprehensive 5-phase attack methodology, alongside containerized Kali tools and a web-based GUI for managing projects and operations with minimal user interaction. Notable functionalities include an intelligent case collection pipeline and robust reporting mechanisms, allowing users to efficiently conduct security evaluations and automate repetitive tasks.

SpectreWeb AI is an advanced MCP server facilitating AI-assisted manual web penetration testing, which enables operators to leverage AI tools for reconnaissance, payload generation, and response analysis while maintaining direct control over testing strategies. Its notable features include context-aware payload creation, built-in WAF bypass capabilities, and session persistence for findings across multiple targets. This tool is designed to overcome challenges presented by traditional blind scanning techniques, optimizing the testing process for bug bounty hunters and security professionals.

ABSpider Recon is a web reconnaissance tool designed for authorized passive intelligence gathering and active vulnerability assessments, targeted primarily at bug bounty hunters, security engineers, and auditors. It features a unified dashboard and command-line interface (CLI) that simplifies key reconnaissance tasks, including DNS lookups, port scans, and payload checks into a streamlined workflow. Notably, it offers a live demo environment and can be run locally via npm, making it accessible for both professionals and educational purposes.

Bjorn is an autonomous network scanning and vulnerability assessment tool optimized for Raspberry Pi, featuring a unique e-Paper HAT display. Its modular architecture allows for flexible configuration and operations like network scanning, vulnerability detection using Nmap, brute-force attacks, and data extraction from compromised services. With a real-time interface for monitoring and interaction, Bjorn supports extensive customization for diverse security testing requirements.

Cariddi is a domain crawling and scanning tool designed to identify sensitive information such as endpoints, secrets, API keys, and various file extensions from a list of provided URLs. Notable features include intensive crawling of subdomains, options for hunting specific secrets and errors, and customizable scanning parameters, making it particularly useful for penetration testing and bug bounty hunting. The tool can be easily installed across various platforms, supporting both single-target and bulk scanning configurations.

CommiPiste is a tool designed for precise identification of open-source web software versions and associated CVEs by analyzing public static files. Its primary use case is authorized security testing and inventory management, leveraging a signature database that allows users to match files against specific Git commits. Notable features include automatic database updates, support for various output formats, and the capability to autoindex unknown software repositories for future scans.

DeepBug is an automated reconnaissance and bug bounty hunting platform that integrates various open-source tools to facilitate subdomain enumeration, port scanning, JavaScript analysis, and vulnerability scanning within an intuitive user interface. Its primary use case is to streamline bug bounty workflows, allowing users to manage projects, perform discovery scans, and generate comprehensive reports on findings. Notable features include customizable project management, a robust dashboard for tracking scan progress, and integration with popular vulnerability scanning tools like Nuclei.

EmbedXPL-Forge is an open-source exploitation and scanning framework designed for security assessments of embedded and perimeter devices including routers, switches, IoT devices, and printers. It features over 2800 modules encompassing various attack vectors such as credential testing, vulnerability exploitation, and firmware manipulation, alongside an extensive library of 700+ mapped CVEs across 114+ vendors, along with an APT Group Attack Engine for simulating real-world cyber attack scenarios.

ExaAiAgent is an advanced AI-powered cybersecurity tool designed for comprehensive penetration testing, providing enhanced functionalities for various security assessments. Key features include a K8s scanner tool registration, smart fuzzing capabilities, response analysis for SQL errors, and automated installation processes, all aimed at integrating seamlessly into agent-driven workflows. The tool focuses on improving runtime reliability, error handling, and multi-tool coordination to facilitate efficient cybersecurity operations.

Faraday Plugins is a command-line tool designed to work seamlessly with Faraday, enabling users to manage and process security-related plugins. Its primary use case includes detecting and processing commands or reports generated by various security tools like Nmap and ping, offering features such as custom plugin support, JSON output formatting, and detailed command tracking. Notably, it allows for easy integration of custom plugins and includes logging capabilities for debugging purposes.

httpgrep is a high-performance asynchronous Python tool designed to scan HTTP(S) servers and search for specific strings or regex patterns within HTTP response bodies and headers. It supports a variety of input formats for target hosts, parallel scanning of multiple ports, and advanced features, including live match streaming, log file outputs in multiple formats, and the ability to resume interrupted scans, making it suitable for extensive network assessments. The tool is built for efficiency with an async core capable of handling thousands of concurrent connections while implementing intelligent timeout and port preflight mechanisms.

KeyFinder is a browser extension designed for Chrome and Firefox that passively scans web pages for leaked API keys, tokens, and secrets. With over 80 detection patterns across multiple categories such as cloud services, payments, and databases, it operates silently in the background, leveraging techniques like entropy analysis and monitoring various attack surfaces to identify sensitive information. Notable features include zero dependencies, compatibility with modern web standards (Manifest V3), and the ability to alert users via tab badges when potential exposures are detected.

KeyLeak Detector is a runtime security tool designed to identify and validate exposed API keys and misconfigurations in Backend-as-a-Service (BaaS) implementations, specifically targeting frameworks like Supabase and Firebase. Its notable features include a Chrome extension for real-time detection of secrets in web applications, a full site scanning capability that reports on potential vulnerabilities across subdomains, and the ability to validate active status of found keys. Unlike traditional static scanners, KeyLeak assesses the exploitability of keys at runtime, offering a comprehensive audit for web applications.

Kumo is an OSINT and security reconnaissance framework that enables the analysis of a target domain via a single command, leveraging 26 parallel modules to deliver comprehensive results in real-time. Key features include extensive checks on DNS records, email security, open ports, leaked credentials, and malware associations, as well as a user-friendly web interface and fast scanning options. This tool is ideal for security professionals conducting thorough assessments of domain-related vulnerabilities and exposures without the need for API keys.

mcpsec is a security scanner and protocol fuzzer specifically designed for MCP (Model Context Protocol) servers, allowing real-time connection and exploitation testing against live services. Its primary use case is to identify vulnerabilities in AI development tools that utilize MCP, enabling users to discover and report security issues effectively. Notable features include support for 800+ fuzzing cases, detailed vulnerability reporting, and dynamic testing capabilities that surpass traditional static analysis methods.

NetWatch is an all-in-one network security dashboard designed to convert any Linux machine into a comprehensive security sensor. It features real-time deployment of honeypots, traffic sniffing, OSINT tools, and threat management capabilities, all accessible via a single command and user interface. Key functionalities include automatic threat scoring, detailed traffic analysis, and the ability to block attackers, making it suitable for security professionals and home users alike.

The Offensive Pentesting Scripts repository offers a suite of automation scripts designed to enhance the efficiency of penetration testing and bug hunting. Key features include the simultaneous installation of over 40 essential Go tools, generation of a comprehensive wordlist for subdomain brute forcing with over 66 million entries, and automated identification of live hosts and open ports using Nmap. Additionally, the toolset provides capabilities for thorough subdomain discovery through multiple techniques, streamlining the reconnaissance process for cybersecurity professionals.

OpenFirebase is an automated security scanning tool designed to extract Firebase configurations from Android APKs and iOS IPAs, enabling unauthenticated and authenticated scanning of Firebase services, such as Realtime Database, Firestore, and Storage. Notably, it detects accidentally embedded service account credentials and supports multiple input formats, providing comprehensive analysis for both mobile and web applications. The tool also includes built-in wordlists and example payloads for effective fuzz testing and vulnerability assessment.

OpenRediWrecked is a sophisticated tool designed for security professionals to detect and exploit open redirect vulnerabilities by automating the injection of carefully crafted payloads using the sed utility. Its notable features include parameter cleaning, support for various encoding techniques to bypass filters, and an intuitive output format that highlights vulnerable URLs in a color-coded manner. This makes it an essential asset for Red Teams and Bug Bounty Hunters seeking to improve their testing methodologies.

`pwneye` is an offensive security tool designed for interacting with IP cameras that support ONVIF and RTSP protocols, streamlining various tasks such as discovery, authentication testing, metadata collection, and stream validation through a single command-line interface. Notable features include multithreaded bruteforce attacks for credential guessing, ONVIF device enumeration, RTSP stream handling, and a dedicated live preview client, all aimed at facilitating security assessments of surveillance systems.

SSRF-Scanner is an advanced tool designed to identify Server-Side Request Forgery (SSRF) vulnerabilities through 14 comprehensive attack phases, emphasizing speed and accuracy. Leveraging asynchronous processing for up to 200 concurrent requests and featuring real confirmation via a self-hosted callback listener, it effectively distinguishes genuine vulnerabilities from false positives. The tool also provides extensive reporting capabilities in various formats and supports custom payloads and CVE probes, making it a versatile asset for security assessments.

XSSRocket is a cybersecurity tool designed for conducting offensive security assessments, primarily focusing on Cross-Site Scripting (XSS) vulnerabilities. It leverages the Wayback Machine to retrieve and filter URLs, uses httpx for live URL verification, and employs a remote XSS payload list to perform GET requests, potentially exposing vulnerabilities. Notable features include stealth mode scanning, automated result storage, customizable payload lists for other injection types, and a user-friendly interface that enriches the output with random security quotes.

Cascavel is an autonomous Continuous Threat Exposure Management (CTEM) engine designed to streamline Red Team operations and validate adversarial exposures. It automates the process of scoping and discovery, prioritizes vulnerabilities with real-time threat intelligence, and employs a robust validation engine to minimize false positives while generating actionable remediation recommendations. Notable features include dynamic mapping of infrastructure, integration with threat databases, and support for various output formats, all engineered to enhance operational efficiency in cybersecurity.

dirsearch is an advanced web path discovery tool designed for brute-forcing directories and files on web servers. Its primary use case is assisting cybersecurity professionals in identifying hidden resources within a web application, supporting features such as customizable wordlists, recursion, and a Python API for automation. The tool requires Python 3.11 or higher and offers various installation options, including native Rust backend support and pre-built binaries.

EMBArk is a web-based platform designed for centralized firmware security analysis, utilizing the EMBA scanner as its backend. It offers features such as scanning, tracking, reporting, and presents results through an aggregated management dashboard to enhance accessibility and usability. Currently, it supports only Ubuntu LTS (version 24) and provides an intuitive setup and management interface for enterprise environments.

MasscanGUI provides a comprehensive graphical user interface for the Masscan port scanner, enabling users to easily configure and execute scans without requiring command line interaction. Notable features include support for all Masscan parameters, real-time output display, country-based scanning, multiple output formats, and advanced functionalities like intelligent rate adjustment and sharding for distributed scans. This tool is designed for ease of use on Windows with included executables, making it accessible for both novice and experienced users in network scanning tasks.

Packémon is a terminal user interface (TUI) tool designed for packet generation and monitoring across any network interface, with compatibility for Windows, macOS, and Linux. It enables users to create arbitrary packets, including DNS queries, and observe real-time responses, whilst offering features like detailed packet inspection and filtering options. The tool is developed from scratch utilizing raw sockets, providing flexibility but also carries a warning for potential bugs.

The Physical Penetration Testing Tools repository provides a comprehensive set of methods and tools for conducting physical security assessments by simulating real-world attacks. Notable techniques include badge cloning using devices like Proxmark and Flipper Zero, tailgating with various access tools, and social engineering tactics aimed at exploiting human factors. This collection aids security professionals in identifying vulnerabilities in physical security controls through practical tools and methodologies.

Rekono automates the penetration testing process by integrating multiple hacking tools to streamline tasks such as OSINT, host discovery, and vulnerability scanning. Its notable features include email and Telegram notifications for findings, integration with Defect-Dojo for advanced vulnerability management, and a dedicated Telegram bot to execute tests from any device. This tool aims to enhance a pentester's efficiency by allowing them to focus on analysis rather than repetitive testing tasks.

ScanT3r is a fast command-line interface (CLI) tool for dynamic application security testing (DAST), developed in Rust, designed to identify vulnerabilities such as Cross-Site Scripting (XSS) and Server-Side Template Injection (SSTI) through various testing modules. It supports concurrent scanning with customizable options, including target lists, module selection, and output formats like JSON reports. Notable features include context-aware payload delivery, the ability to integrate with Burp Suite, and an extensible module framework for developing additional testing capabilities.

secator is a comprehensive task and workflow runner tailored for security assessments, enhancing the efficiency of penetration testers and security researchers. It features a curated list of commands with unified input and output options, CLI and library support, and the ability to run distributed tasks via Celery, making it suitable for both simple and complex security workflows. Notably, secator integrates numerous well-established security tools to streamline the assessment process.

sif is a comprehensive recon and exploitation scanner that integrates various scanning capabilities—including subdomain enumeration, port scanning, crawling, vulnerability detection, and more—into a single binary. It leverages a shared connection-pool architecture for efficiency, allowing seamless execution of over 25 scan types from one command, while eliminating the need for external dependencies. Notable features include support for continuous monitoring with change detection, scanning configuration through command-line flags, and integration with notification services like Slack and Discord.

Spectre is an Android application designed for monitoring and interacting with various wireless signals, including Bluetooth, Wi-Fi, cellular, and GNSS. Its primary use case revolves around RF exposure measurement and pen-testing, featuring tools for detailed analysis of signal strength, local network discovery, and BLE device interaction. Notable features include comprehensive support for multiple network technologies, advanced filtering capabilities, and a GATT inspector for Bluetooth devices, all while adhering to Android's security restrictions.

SQL-Injector is a specialized tool designed for performing SQL injection testing on web applications, facilitating the identification of vulnerabilities in various database systems such as MySQL, PostgreSQL, MSSQL, and Oracle. Notable features include automated vulnerability detection, custom payload generation for bypassing WAFs, multi-threaded scanning for efficiency, and the ability to operate anonymously via Tor integration. Advanced capabilities support complex testing scenarios, including boolean-based blind SQL injection and detailed schema enumeration.

TriLane is an autonomous gray-box security auditing tool designed for authorized penetration testing on local labs, internal codebases, and bug-bounty targets. It features a staged audit process that includes the construction of an attack-surface graph, a six-lane semantic audit covering various security aspects, and a deduplication mechanism for findings, allowing for a thorough and organized assessment of security vulnerabilities. Notable features include a desktop GUI for tracking the audit process, two operational modes (Safe and Lab), and efficient evidence management for generating comprehensive reports.

WonderSuite is a desktop-native offensive security research engine designed for comprehensive web application security testing, network reconnaissance, and exploit development, harnessing AI capabilities via Model Context Protocol (MCP) integration. It features an extensive toolkit of 91 security tools, enhanced by a full MITM proxy with advanced fingerprinting for obfuscation, facilitating efficient vulnerability research and response automation. The platform aims to streamline the process of identifying and addressing security issues, making it a powerful asset for security professionals.

ZIRAN is a comprehensive security testing framework designed to identify vulnerabilities in AI agents, including those with complex capabilities such as tool usage and memory. By modeling agents as graphs of capabilities, it effectively discovers dangerous tool chains, detects execution-level side effects, and conducts adaptive multi-phase campaigns, surpassing the capabilities of single-prompt scanners. Notable features include graph-based analysis, tool-chain discovery, and thorough coverage of established security benchmarks like OWASP and MITRE.

5Ghost WiFi Lab is a dual-band Wi-Fi research and security testing tool designed for the Flipper Zero, utilizing the Realtek RTL8720DN chipset to enable comprehensive 2.4 and 5 GHz scanning. It features capabilities such as WPA/WPA2 handshake capture, clientless PMKID capture, and BLE reconnaissance, making it suitable for advanced security testing and educational purposes. The tool operates through a user-friendly app with multiple firmware support and connects seamlessly to the Flipper Zero without the need for additional wiring or flashing.

Cywise is a cybersecurity solution designed for both on-premises and SaaS environments, enabling users to scan and secure their web-facing and internal infrastructures. It features a robust vulnerability scanner that monitors for over 50,000 vulnerabilities with automated remediation, alongside active data leak monitoring and intelligent honeypots to detect and analyze potential threats. This tool is particularly suitable for small to medium-sized enterprises looking to enforce comprehensive security measures while maintaining control over their data and infrastructure.

The "missing-cve-nuclei-templates" tool automates the identification and cataloging of missing CVEs in the official Nuclei templates repository, analyzing over 164,000 CVEs to produce a comprehensive list of 65,840 missing entries. It categorizes vulnerabilities by type and year, offering detailed data files for specific threats such as XSS, RCE, SQL Injection, and more, enhancing vulnerability management and template development for cybersecurity professionals. This tool facilitates better detection capabilities by flagging gaps in existing Nuclei templates.

Nerva is a high-performance command-line interface (CLI) tool for fast service fingerprinting, capable of identifying over 170 network protocols across various transport layers including TCP, UDP, and SCTP. It is designed for use in network reconnaissance, providing features such as rich metadata extraction, security misconfiguration detection, and support for various output formats. Notably, Nerva integrates seamlessly with other security tools like Naabu, enabling automated workflows and robust scanning capabilities.

OpenDoor is an open-source CLI platform designed for authorized web reconnaissance, focusing on directory discovery and subdomain enumeration. It includes features such as WAF detection, bypass probing, and detailed reporting tools, making it ideal for security researchers and penetration testers to identify exposed resources and vulnerabilities on web servers. The tool emphasizes ethical usage, requiring explicit permission for testing.

PRISM is a self-hosted Open Source Intelligence (OSINT) platform that provides comprehensive scanning of domains, IPs, emails, phone numbers, and usernames across over 22 modules, delivering insights such as WHOIS data, threat intelligence, and OPSEC scoring. Notable features include real-time web dashboards, AI-driven summary analyses, and detailed report generation in HTML/PDF formats, making it an effective tool for risk assessment and threat investigation.

pSlip is a comprehensive security scanning tool for Android applications, designed to detect cryptographic vulnerabilities, OAuth implementations, and manifest issues using a streamlined HTML reporting engine. Its notable features include a powerful searchable HTML report leveraging a field-scoped query language, structured extraction and export of recovered key material and secrets, and a user-friendly interface that supports rapid identification of findings without requiring Java dependencies. The tool optimizes scanning performance and minimizes false positives, enhancing the efficiency of mobile application security assessments.

SecTools is a comprehensive repository of curated open-source and public tools designed for various cybersecurity applications, including OSINT, vulnerability analysis, and application security testing (SAST/DAST). It offers a user-friendly table that categorizes tools with their descriptions, licenses, and activity indicators, facilitating streamlined access to resources for security workflows. Notable features include a focus on UNIX compatibility and an organized structure that enhances usability across multiple security domains.

VULNRΞPO is a client-side vulnerability report manager designed for security professionals, enabling users to generate, store, and manage vulnerability reports locally with a focus on privacy. The tool features client-side encryption, customizable issue templates for various security frameworks, and supports imports from multiple scanners, along with diverse export formats such as PDF and DOCX. Notable capabilities include integrated methodology tools, automated versioning, and optional backend storage via API for enhanced reporting functionalities.

Zen-AI-Pentest is an AI-powered penetration testing framework designed for security professionals and red teams, leveraging advanced language models alongside over 72 integrated security tools. Its notable features include a user-friendly dashboard, REST API, and modular agent system for tasks like reconnaissance, exploitation, and reporting, as well as compliance mapping and risk scoring functionalities for thorough assessments.

bgscan is a high-performance, modular multi-protocol network scanner implemented in Go, designed for host discovery and validation across various protocols including ICMP, TCP, HTTP, and DNS. Notable features include a fully keyboard-driven terminal user interface (TUI) for real-time monitoring, the ability to chain scan stages into pipelines for efficient scanning workflows, and robust data handling capabilities with options for output to CSV and integration with existing IP lists.

EMBA is a comprehensive security analyzer specifically designed for the firmware of embedded devices, catering to penetration testers, product security teams, and developers. The tool facilitates the entire security analysis workflow, including firmware extraction, static and dynamic analysis through emulation, SBOM generation, and the creation of web-based vulnerability reports, effectively identifying potential weaknesses such as insecure components or hard-coded passwords. Its command-line interface and ability to present findings in an accessible web format enhance usability and streamline the security assessment process.

OpenEASD is an open-source external attack surface discovery (EASD) tool designed for red teamers and defenders, enabling users to rapidly map and assess external surfaces of authorized targets without the expense of commercial solutions. It integrates multiple recon tools—such as `subfinder`, `amass`, and `nmap`—into a single web interface, offering features like scheduling, alerts, and findings tracking, while ensuring results remain local to the user's infrastructure. This self-hosted platform emphasizes transparency and security through careful sourcing of its components and is aimed at small security teams, consultancies, and individual security learners.

Promptfoo is a command-line interface (CLI) and library designed for evaluating and red-teaming large language model (LLM) applications. Its primary use case involves automated testing of prompts, vulnerability scanning, and model comparison, enabling developers to enhance security and reliability in their AI applications while running evaluations locally without exposing data. Notable features include integration with CI/CD workflows, comprehensive security reporting, and support for multiple LLM providers, allowing for a developer-centric, flexible, and data-driven approach to AI application development.

Shodan Dorks is a specialized query catalog for Shodan that enhances the search experience by providing categorized and frequently updated dork lists, specifically for discovering various internet-connected devices such as cameras, industrial control systems, and network infrastructure. It features real-time updates every six hours to reflect current results and automatically purges queries that return zero results, making it a valuable tool for security professionals and researchers. The repository includes a wide array of search filters and exploitation details, enabling users to efficiently locate and assess vulnerable devices.

Subscan is a Rust-based tool designed for monitoring and analyzing blockchain data, primarily focusing on Polkadot and its ecosystem. Its notable features include automated testing workflows, extensive documentation, and container support via Docker, enabling seamless integration into development pipelines. Subscan aims to enhance visibility and insight into blockchain activity, providing developers with essential tools for data analysis and monitoring.

KillShot is a comprehensive penetration testing framework designed for information gathering and website vulnerability scanning. Its primary use case involves automating data collection through integrated tools such as WhatWeb and Nmap, while offering features like a CMS Exploit Scanner and web application vulnerability assessments, including XSS and SQL injection detection. The framework also facilitates backdoor generation and includes a fuzzer, making it a versatile tool for security professionals.

Krane is a Kubernetes RBAC static analysis tool designed to identify security risks within K8s RBAC configurations and provide mitigation suggestions. Key features include a customizable set of built-in and user-defined risk rules, a user-friendly dashboard for visualizing RBAC posture, continuous analysis capabilities within clusters, and integration with Slack for alerting on significant risks. Additionally, Krane offers reporting in machine-readable formats and can be deployed locally, within CI/CD pipelines, or as a standalone service.

NMAP-Formatter is a versatile tool designed to convert NMAP XML output into various formats such as HTML, CSV, JSON, Excel, and more, facilitating the analysis and reporting of network scan results. Notable features include support for output via stdin, the ability to generate diagrams using Graphviz, and options to skip down hosts, enhancing usability for security professionals and network administrators. This tool can also be utilized as a library in Golang for integration into other applications.

PHP Antimalware Scanner is a PHP-based tool designed to scan projects for malicious code embedded within PHP files. Its primary use case is to detect potential malware through an interactive console interface or in a reporting mode that generates results in HTML or text. Notable features include customizable scanning options for file paths, action prompts upon detection of malware, and compatibility with various PHP configurations.

ReconPi is a lightweight reconnaissance tool designed for extensive domain analysis and asset discovery using a Raspberry Pi or a VPS. Its primary functionality includes resolving domain names, subdomain enumeration, vulnerability scanning using Nmap, and integrating tools like Nuclei for template-based security assessments. Notable features include automated reporting, Slack notifications, and easy installation through a straightforward script, making it accessible for cyber reconnaissance tasks.

Spoilerwall is a network hardening tool that obscures open ports by serving movie spoilers whenever a scan is performed, effectively misleading potential attackers. Its primary use case is to create a deceptive environment that appears vulnerable but instead provides mundane content, deterring unwanted attention and scans. Notable features include customizable spoiler content, easy server setup, and the ability to redirect all TCP traffic to the Spoilerwall service, enhancing security through obfuscation.

WitnessMe is a versatile web inventory tool designed for efficient scanning and data gathering, primarily utilizing headless Chromium via the Pyppeteer library. It excels in processing large Nessus and NMap XML files, generates CSV and HTML reports, and features a RESTful API for remote scanning and extensibility to accommodate custom functionalities. With additional capabilities like HTTP proxy support, signature scanning through YAML files, and terminal screenshot previews, WitnessMe stands out for providing a comprehensive workflow without significant installation challenges.

RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.

A Security Tool for Bug Bounty, Pentest and Red Teaming.

A security scanner for your LLM agentic workflows

A full-stack AI Red Teaming platform securing AI ecosystems via OpenClaw Security Scan, Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

A flexible scanner

Scanning APK file for URIs, endpoints & secrets.

一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.

ASOC, ASPM, DevSecOps, Vulnerability Management Using ArcherySec.

ARL 资产侦察灯塔系统（可运行，添加指纹，提高并发，升级工具及系统，无限制修改版） | ARL(Asset Reconnaissance Lighthouse)资产侦察灯塔系统旨在快速侦察与目标关联的互联网资产，构建基础资产信息库。 协助甲方安全团队或者渗透测试人员有效侦察和检索资产，发现存在的薄弱点和攻击面。

A modular vulnerability scanner with automatic report generation capabilities.

AutoPentestX – Automated Pentesting & Vulnerability Reporting Tool

AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.

🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻

A list of web application security

A curated list of awesome YARA rules, tools, and people.

Bandit is a tool designed to find common security issues in Python code.

The recursive internet scanner for hackers. 🧡

BinAbsInspector: Vulnerability Scanner for Binaries

Applied offensive security with Rust - https://kerkour.com/black-hat-rust

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

An intelligence gathering tool for hacking Bluetooth

A static analysis security vulnerability scanner for Ruby on Rails applications

Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 28 protocols.

Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

A Burp Suite extension that integrates OpenAI's GPT to perform an additional passive scan for discovering highly bespoke vulnerabilities and enables running traffic-based analysis of any type.

⚡ Perform subdomain enumeration using the certificate transparency logs from Censys.

A default credential scanner.

Claude Code skill for AI-assisted bug bounty hunting - recon, IDOR, XSS, SSRF, OAuth, GraphQL, LLM injection, and report generation

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

Automated All-in-One OS Command Injection Exploitation Tool

CORS Misconfiguration Scanner

A powerful browser crawler for web vulnerability scanners

A fast tool to scan CRLF vulnerability written in Go

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

Explore RootSec's DDOS Archive, featuring top-tier scanners, powerful botnets (Mirai & QBot) and other variants, high-impact exploits, advanced methods, and efficient sniffers. Ideal for cybersecurity professionals and researchers.

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。国内首个开源的代码漏洞挖掘多智能体系统。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

Find web directories without bruteforce

An advanced web directory & file scanning tool that will be more powerful than DirBuster, Dirsearch, cansina, and Yu Jian.一个高级web目录、文件扫描工具，功能将会强于DirBuster、Dirsearch、cansina、御剑。

Custom bash scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux.

Asset discovery and identification tools 快速识别 Web 指纹信息，定位资产类型。辅助红队快速定位目标资产信息，辅助蓝队发现疑似脆弱点

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.

一款信息泄漏利用工具，适用于.git/.svn/.DS_Store泄漏和目录列出

一款基于各大企业信息API的工具，解决在遇到的各种针对国内企业信息收集难题。一键收集控股公司ICP备案、APP、小程序、微信公众号等信息聚合导出。支持MCP接入

Open Source Vulnerability Management Platform

All In One Web Recon

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

fsociety Hacking Tools Pack – A Penetration Testing Framework

File upload vulnerability scanner and exploitation tool.

An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically.

the fastest and most powerful android decompiler(native tool working without Java VM) for the APK, DEX, ODEX, OAT, JAR, AAR, and CLASS file. which supports malicious behavior detection, privacy leaking detection, vulnerability detection, path solving, packer identification, variable tracking, deobfuscation, python&java scripts, device memory extraction, data decryption, and encryption, etc.

Fast GitHub recon tool. Scans for leaked secrets across all of GitHub, not just known repos and orgs. Support for GitHub dorks.

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

Attack surface mapping

面向红队的, 高性能高度自由可拓展的自动化扫描引擎 | A highly controllable and extensionable automated scanning engine for red teams

Simple Golang HTTPS/TLS Examples

Interactive Network Scanner

🔍 Search anyone's digital footprint across 300+ websites

被动式漏洞扫描系统

本程序旨在为安全应急响应人员对Linux主机排查时提供便利，实现主机侧Checklist的自动全面化检测，根据检测结果自动数据聚合，进行黑客攻击路径溯源。

hack tools

All in One Hacking Tool for Linux & Android (Termux). Make your linux environment into a Hacking Machine. Hackers are welcome in our blog

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

My simple Swiss Army knife for http/https troubleshooting and profiling.

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.

Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.

The Swiss Army knife for automated Web Application Testing

Jok3r v3 BETA 2 - Network and Web Pentest Automation Framework

OWASP Joomla Vulnerability Scanner Project https://www.secologist.com/

K8Ladon大型内网渗透自定义插件化扫描神器，包含信息收集、网络资产、漏洞扫描、密码爆破、漏洞利用，程序采用多线程批量扫描大型内网多个IP段C段主机，目前插件包含: C段旁注扫描、子域名扫描、Ftp密码爆破、Mysql密码爆破、Oracle密码爆破、MSSQL密码爆破、Windows/Linux系统密码爆破、存活主机扫描、端口扫描、Web信息探测、操作系统版本探测、Cisco思科设备扫描等,支持调用任意外部程序或脚本，支持Cobalt Strike联动

K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹20000+，暴力破解协议10余种。

Ladon大型内网渗透扫描器，PowerShell、Cobalt Strike插件、内存加载、无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。网络资产探测32种协议(ICMP\NBT\DNS\MAC\SMB\WMI\SSH\HTTP\HTTPS\Exchange\mssql\FTP\RDP)或方法快速获取目标网络存活主机IP、计算机名、工作组、共享资源、网卡地址、操作系统版本、网站、子域名、中间件、开放服务、路由器、交换机、数据库、打印机等，大量高危漏洞检测模块MS17010、Zimbra、Exchange

Ladon for Kali 全平台开源内网渗透扫描器,Windows/Linux/Mac/路由器内网渗透，使用它可轻松一键批量探测C段、B段、A段存活主机、高危漏洞检测MS17010、SmbGhost，远程执行SSH/Winrm，密码爆破SMB/SSH/FTP/Mysql/Mssql/Oracle/Winrm/HttpBasic/Redis，端口扫描服务识别PortScan指纹识别/HttpBanner/HttpTitle/TcpBanner/Weblogic/Oxid多网卡主机，端口扫描服务识别PortScan。

A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

Mantis is a security framework that automates the workflow of discovery, reconnaissance, and vulnerability scanning.

A tool for BLE environment monitoring. Find and track Bluetooth devices around, and get notified when the target device is detected.

Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Microsoft Entra ID security configuration reviews.

An extremely effective subdomain enumeration wordlist of 3,000,000 lines, crafted by harvesting SSL certs from the entire IPv4 space.

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Idiomatic nmap library for go developers

Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.

Automated NoSQL database enumeration and web application exploitation tool.

safely install npm packages by auditing them pre-install stage

Nuclei POC，每2小时更新 | 自动整合全网Nuclei的漏洞POC，实时同步更新最新POC，保存已被删除的POC。通过批量克隆Github项目，获取Nuclei POC，并将POC按类别分类存放，使用Github Action实现。已有41w+POC，其中3.5w+高质量POC

70k+ WordPress Nuclei templates, updated daily from Wordfence intel—filter by severity/tags/CVE and scan in one line. 🚀🔒

一个开源的、开箱即用的漏洞批量验证框架

OneForAll是一款功能强大的子域收集工具

The openSquat is an open-source tool for detecting domain look-alikes by searching for newly registered domains that might be impersonating legit domains and brands.

Open-Source Security Architecture | 开源安全架构

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

Open source vulnerability DB and triage service.

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

A collection of custom security tools for quick needs.

Awesome Pentest Tools Collection

Perun是一款主要适用于乙方安服、渗透测试人员和甲方RedTeam红队人员的网络资产漏洞扫描器/扫描框架

利用大量高威胁poc/exp快速获取目标权限，用于渗透和红队快速打点

渗透测试插件化并发框架 / Open-sourced remote vulnerability PoC/EXP framework

pentest framework

A high performance offensive security tool for reconnaissance and vulnerability scanning

:new: The Multi-Tool Web Vulnerability Scanner.

A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.

Java RMI Vulnerability Scanner

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

🤖 The Modern Port Scanner 🤖

Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles.

红队综合渗透框架

Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...

A powerful and open-source toolkit for hackers and security automation - 安全行业从业者自研开源扫描器合辑

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

ScopeSentry-Cyberspace mapping, subdomain enumeration, port scanning, sensitive information discovery, vulnerability scanning, distributed nodes

🍉一款基于Python-Django的多功能Web安全渗透测试工具，包含漏洞扫描，端口扫描，指纹识别，目录扫描，旁站扫描，域名扫描等功能。

:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty.

ServerScan一款使用Golang开发的高并发网络扫描、服务探测工具。

An IIS short filename enumeration tool

Mass scan IPs for vulnerable services

SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.

Dangerously fast DNS/network/port scanner

Semi-automatic OSINT framework and package manager

Attack Surface Management Platform

Snoop — инструмент разведки на основе открытых данных (OSINT world)

针对SpringBoot的开源渗透框架，以及Spring相关高危漏洞利用工具

A tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github.

Subdomain and target enumeration tool built for offensive security testing

Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting

Next generation RedTeam heuristic intranet scanning | 下一代RedTeam启发式内网扫描

This repository contains a simple vulnerability scanner for the Terrapin attack present in the paper "Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation".

The Offensive Manual Web Application Penetration Testing Framework.

Kubernetes-native security toolkit

🕵️🫆 (2-in-1) Emaill and Username OSINT tool that analyzes username and email presence across multiple platforms, intended for security research, investigations, legitimate analysis

Popular Pentesting scanner in Python3.6 for SQLi/XSS/LFI/RFI and other Vulns

Reverse engineering of Validity/Synaptics 138a:0090, 138a:0094, 138a:0097, 06cb:0081, 06cb:009a fingerprint readers protocol

A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞验证功能

vulnx 🕷️ an intelligent Bot, Shell can achieve automatic injection, and help researchers detect security vulnerabilities CMS system. It can perform a quick CMS security detection, information collection (including sub-domain name, ip address, country information, organizational information and time zone, etc.) and vulnerability scanning.

Advanced vulnerability scanning with Nmap NSE

python3写的综合扫描工具，主要用来存活验证，敏感文件探测(目录扫描/js泄露接口/html注释泄露)，WAF/CDN识别，端口扫描，指纹/服务识别，操作系统识别，POC扫描，SQL注入，绕过CDN，查询旁站等功能，主要用来甲方自测或乙方授权测试，请勿用来搞破坏。

Passive Security Scanner (被动式安全扫描器)

Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).

An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com

X Attacker Tool ☣ Website Vulnerability Scanner & Auto Exploiter

一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。

Cyber Security ALL-IN-ONE Platform

Zero-attacker is an multipurpose hacking tool with over 15+ multifunction tools