~/hackyfeed $

Machine Learning CTF Challenges provides a collection of capture-the-flag (CTF) challenges focused on exploiting vulnerabilities in AI agents, machine learning pipelines, and large language models. Users can engage in practical scenarios such as manipulating training data, prompting model injections, and breaching autonomous systems to capture flags. The repository includes nine challenges that vary in difficulty and are aligned with OWASP and MITRE attack vectors, thus addressing contemporary security concerns in AI applications.

Lurker is a cross-platform implant designed to function as a companion tool for Cobalt Strike, implemented in Go. It facilitates various commands such as file upload, download, and remote shell execution, enabling comprehensive control over target systems across multiple operating systems including Windows and Linux. Notably, it emphasizes security research and authorized penetration testing, providing a flexible and customizable platform for security assessments.

LOLFSaaS is a comprehensive directory of 127 Software as a Service (SaaS) platforms equipped with free tiers, focusing on their abuse potential in security contexts. It offers extensive operational intelligence, detailing abuse surface, operational security profiles, detection mechanisms, and links to Command and Control (C2) frameworks, enabling security researchers and red teamers to effectively strategize their approaches. Notably, the tool categorizes services based on various attributes, such as zero-signup services, custom domain support, and detection logics, and provides cross-references to other threat intelligence resources for enriched context.

LogHound is a post-exploitation tool designed for analyzing Windows Security Event Logs (.evtx) to facilitate BloodHound mapping, aiding Red Teams in tracking lateral movement targets and deciphering active user sessions. Notable features include a chunk-based streaming parser that minimizes memory usage, support for Pass-The-Hash and Kerberos authentication methods, and the ability to generate detailed reports in various formats, ensuring effective operational security during network penetration testing.

The LLM Security Guide is a comprehensive resource aimed at addressing the offensive and defensive security concerns related to Large Language Models (LLMs) and Agentic AI Systems, updated for 2026. It includes critical corrections to the OWASP Top 10 for both LLMs and Agentic applications, an overview of recent AI security incidents, and introduces new security tools and strategies. Notable features include in-depth case studies, detailed vulnerability assessments, and coverage of emerging regulatory frameworks affecting AI systems.

Ligolo-MP is a sophisticated pentesting tool that facilitates collaborative pivoting through a client-server architecture, allowing multiple concurrent tunnels with automated TUN management. Its notable features include SOCKS and HTTP proxy support, cross-platform compatibility, and dynamic mTLS-enabled agent generation, all while providing a user-friendly terminal-based GUI for efficient monitoring and management.

KslDump is a cybersecurity tool designed to extract credentials from the Protected Process Light (PPL)-protected Local Security Authority Subsystem Service (LSASS) using only components signed by Microsoft, without deploying any additional exploits or drivers. Its primary use case revolves around leveraging a forgotten vulnerable kernel driver (KslD.sys) within Microsoft Defender, which allows unrestricted access to kernel and physical memory. Notably, it utilizes a vulnerable IOCTL command to perform memory reads, exploiting easily editable access controls that lack adequate validation mechanisms.

JusotLabs is a curated toolkit designed for ethical hacking, penetration testing, and security research. It offers a diverse range of Linux-compatible scripts for tasks such as DNS reconnaissance, port scanning, DDoS simulation, and network threat detection, alongside educational resources like CTF writeups and a reading list. Users are encouraged to leverage these tools within authorized environments to enhance their hacking skills and deepen their cybersecurity knowledge.

Impacket-IoCs is a reference repository providing indicators of compromise (IoCs) for detecting activities driven by the Impacket toolkit, aimed at both blue and red team professionals. It features 73 detailed IoCs categorized by protocols such as Kerberos, SMB, NTLM, and LDAP, focusing on deeper, protocol-level signals rather than surface-level artifacts. The project serves to enhance the operational security of offensive tools and improve defensive strategies by offering practical detection methodologies for smaller teams without access to commercial solutions.

Halberd is an open-source, multi-cloud attack emulation tool designed to help cybersecurity professionals validate their cloud security defenses across major platforms such as Azure, AWS, GCP, Entra ID, and M365. It offers over 120 pre-built attack techniques mapped to MITRE ATT&CK and Azure TRM frameworks, an AI-powered intelligence mechanism for discovering and executing attack paths, and a user-friendly web interface that eliminates the need for command-line expertise, facilitating automation, orchestration, and reporting for cloud security testing.

Hack The Box Reporting using SysReptor is a user-friendly and customizable pentest reporting tool designed to streamline the creation of reports for various certifications such as CPTS, CWES, and CDSA. It allows users to write reports in Markdown format, which can then be rendered to PDF without the hassle of local software issues, making it ideal for security professionals focused on reporting efficiency. Notable features include free access, easy self-hosting options, and a collection of pre-built templates specifically tailored for Hack The Box certifications.

HackingGPT is an advanced terminal tool designed for penetration testing and bug bounty hunters, leveraging the ChatGPT and DeepSeek APIs to provide dynamic command suggestions and interactive execution. Notable features include the ability to run commands in a terminal or interactive shell, aggregate output for analysis, and a continuously integrated workflow that supports multiple API models while emphasizing offensive security practices. The tool is user-friendly, with a colored interface for enhanced readability and environment variable configuration for secure API key management.

GadgetExplorer is a command-line tool designed for discovering potential deserialization gadget chains within .NET applications. It analyzes one or more assemblies, constructing reachability graphs to identify when a deserialization entrypoint can lead to various vulnerabilities, including file writes and command execution. The tool comes pre-configured with a comprehensive set of sinks across different vulnerability categories, making it valuable for researchers and exploit developers in the .NET community.

Freedom Fighting Mode (FFM) is a hacking harness specifically designed for post-exploitation tasks during red-teaming engagements, enabling automation of common actions while minimizing user errors. This tool provides a modular command structure for various tasks, including enumeration, stealth, and data transfer, facilitated through a user-friendly command interface. Notable features include enhanced security through a Docker-based installation approach and a comprehensive command management system that categorizes available functionalities for ease of use.

FBps (Forbidden Bypass) is a fast HTTP fuzzer specifically designed for identifying access control bypass vulnerabilities (401/403) in web applications by generating varied HTTP requests across methods, URLs, and headers. Notable features include level-based scanning, URL and query parameter fuzzing, header manipulation, API version downgrades, and customizable output options, making it a robust tool for security testing and vulnerability discovery. This tool is accompanied by FBpsLab for local payload tuning and reproducible testing environments.

EVA is an AI-driven penetration testing tool designed to aid users throughout the pentesting lifecycle with intelligent analysis, automated enumeration, and real-time vulnerability assessment. It features support for multiple AI backends, session management for persistent interactions, and an interactive interface for executing commands and analyzing results, thereby enhancing the efficiency of penetration testing efforts. This tool aims to assist, rather than replace, cybersecurity professionals by providing strategic guidance and quicker outcomes during engagements.

DFMI (Don't Fool My Installer) is a toolkit designed for fileless code execution and covert payload delivery via Windows Installer (.msi) files, exploiting the CustomAction mechanism to execute arbitrary payloads silently during installation. Notable features include the ability to inject backdoors into both signed and unsigned MSI packages without altering their signatures, support for cross-platform payload generation, and functionalities for SSL encryption and IPv6. This tool is intended for authorized red team engagements and penetration testing only.

Deadend CLI is an autonomous web application penetration testing tool that utilizes a feedback-driven iteration approach to adapt its exploitation strategies. It boasts a model-agnostic architecture capable of generating custom Python payloads, executing fully local operations without cloud dependencies, and achieving approximately 80% success on the XBOW validation benchmark. Key features include a supervisor-subagent hierarchy for task delegation, confidence-based decision-making, and custom sandboxed tools like Playwright and Docker for enhanced pentesting capabilities.

CTF-Notes is a comprehensive resource repository designed for cybersecurity enthusiasts and professionals engaging in Capture The Flag (CTF) competitions. It hosts a collection of notes, code snippets, and recommended tools, along with guidance on essential skills such as reconnaissance, vulnerability identification, and effective note-taking methods. Notable features include structured checklists, various tool recommendations, and training resources to facilitate skill development in cybersecurity contexts.

Chad is a tool designed to search for Google Dorks, allowing users to find indexed information on the web efficiently, utilizing Playwright's headless browser for bypassing common security measures. Its notable features include the Chad Extractor for data extraction and validation, file download capabilities, and options to handle Google’s frequently changing cookies. Additionally, it offers a broken link hijacking feature and is primarily intended for educational use in cybersecurity research.

BugHunter AI is an autonomous bug bounty hunting framework that leverages Claude Code and the Personal AI Infrastructure (PAI) to conduct vulnerability assessments without human intervention. Its notable features include 28 specialized AI agents and 51 skills that operate in parallel through hypothesis-driven attacks, real-time reporting, and automatic generation of professional bug bounty reports. This tool significantly accelerates the reconnaissance and exploitation phases of security testing, offering enhanced capabilities such as cross-session learning and encrypted credential management.

The Browser & Identity Attacks Matrix repository compiles a wide range of attack techniques targeting browser-based and identity-related vulnerabilities in SaaS applications. It serves as a comprehensive resource for security researchers, red/blue teams, and penetration testers to enhance their understanding and sharing of these attack methodologies. Notable features include a focus on browser extension attacks and identity-layer exploits, with an appeal for community contributions to fill in knowledge gaps.

The Awesome CI/CD Attacks repository provides a comprehensive collection of offensive research techniques targeting Continuous Integration and Continuous Deployment (CI/CD) systems. It features curated lists of attack methodologies, tools, and case studies focused on exposing sensitive data and identifying vulnerabilities within development pipelines, emphasizing notable trends such as publicly exposed secrets and initial code execution exploits.

The "Awesome Black Hat Arsenal" repository is a curated collection of advanced cybersecurity tools presented at Black Hat Arsenal events, aimed at practitioners in red teaming, blue teaming, application security, and OSINT. It organizes tools by geographical location, year, and category, providing detailed descriptions, authorship, and GitHub links for each tool, facilitating easy access to cutting-edge security utilities. This resource serves as an invaluable reference for security professionals seeking to enhance their toolkit with the latest innovations in the field.

AutoProber is a hardware automation tool designed for probing individual pins on electronic components, facilitating hardware hacking processes. Its primary use case involves ingesting projects, identifying probe targets using a combination of a microscope and CNC-controlled hardware, and enabling users to approve or deny targets for probing, all managed through a web dashboard or Python scripts. Notable features include real-time calibration, frame stitching to create annotated maps of targets, and a robust safety model for hardware control.