~/hackyfeed $

Phantom is an autonomous AI-driven penetration testing platform designed to perform detailed reconnaissance and exploit vulnerabilities without human intervention. Integrating over 30 professional security tools within a secure Docker environment, it leverages a reasoning loop to adaptively select and execute multi-step attack vectors, producing verified findings complete with proof-of-concept scripts. Unlike traditional scanners that rely on static CVE signatures, Phantom delivers a comprehensive and accurate vulnerability assessment with real-time adaptability and detailed reporting aligned with the MITRE ATT&CK framework.

The PDF Prompt Injection Toolkit is a cybersecurity tool designed for red and blue teams to test and detect prompt injection attacks that may be concealed within PDF documents. It features two primary roles: a `pdf_injector.py` for creating hidden payloads and a `pdf_injection_detector.py` for scanning PDFs to identify such vulnerabilities. Notable detection techniques include scanning for invisible text, analyzing document metadata, and detecting off-page text, ensuring comprehensive coverage against potential injection tactics.

Payload Obfuscator is an advanced browser-based tool designed for Red Team operations, enabling users to obfuscate payloads in multiple programming languages, including PowerShell, Python, Bash, C#, and Go. Key features include a fully client-side operation with no data transmission, the ability to combine up to eight modular obfuscation layers for enhanced evasion tactics, and context-aware parsing for maintaining code syntax integrity. The tool prioritizes security, providing real-time analysis for detection probability and ensuring it remains completely free and open-source.

numasec is an AI-driven security agent that enhances terminal-based workflows by integrating existing tools and methodologies for security operations. It facilitates tracking findings, documenting evidence, and generating reports while adhering to security runbooks, making it well-suited for Application Security (AppSec) and penetration testing workflows. With numasec, security professionals can streamline their processes and maintain operational context within a familiar environment rather than depending on separate chatbots or scanners.

NullSec Pineapple Suite is a comprehensive payload collection for the Hak5 WiFi Pineapple Pager, featuring 125 payloads organized into 14 categories for various aspects of WiFi security testing, including reconnaissance, interception, exfiltration, and stealth operations. Notable features include an extensive range of attack and reconnaissance payloads, a fast boot optimizer, a user-friendly one-click installation process, and the option for active development support. This suite significantly expands the capabilities of the WiFi Pineapple Pager compared to official and other third-party offerings.

NullSec is an advanced penetration testing and red team operations framework that provides a custom ParrotSec-based distribution tailored for offensive security tasks. It features over 150 custom attack modules across multiple categories, full integration with the Metasploit Framework, an AI-powered security assistant, and a user-friendly TUI launcher for easy navigation and module management. The platform supports dual operation modes for safe demos and real attacks, and allows users to build custom ISOs for deployment.

nPassword is a lightweight password manager designed specifically for Windows Active Directory, enabling users to securely manage domain and local accounts within a purely front-end application. Key features include domain-specific account organization, one-click export/import functionality for JSON data, and the ability to attach notes and utilize command templates for common tools. The application ensures that all credentials remain on the user's device by leveraging the browser's local storage.

NOX Framework is a cyber threat intelligence engine designed for red teaming, digital forensics, and corporate exposure analysis, capable of executing massively parallel scans across 124 intelligence feeds without bottlenecks. Its notable features include an integrated operational security layer with automatic proxy rotation, a dynamic risk scoring system, and an autoscan pipeline that facilitates comprehensive scanning and data gathering through recursive scans and asset discovery. This plugin-driven platform emphasizes operational efficiency and security, catering to advanced cybersecurity operational needs.

NightCloak is a statically-linked Go binary designed for metadata steganography and string obfuscation, allowing users to embed encrypted payloads into various file formats through a sophisticated multi-layer pipeline involving obfuscation, authenticated encryption, and binary injection. It supports distributed resiliency via Reed-Solomon erasure coding and enables discovery through CRC64 algebraic beacons, making it highly effective for covert data storage and transmission. The tool modernizes and ports previous versions while preserving core functionalities and operational models.

NetCrawler is an AI-driven reconnaissance and vulnerability scanning tool that utilizes a local Ollama LLM to automate the scanning process. It intelligently selects and executes various reconnaissance modules such as subdomain enumeration, web fingerprinting, and vulnerability scanning, while generating structured reports in both Markdown and JSON formats. Notable features include a terminal-based user interface, iteration through an observation-think-act cycle, and the capability to integrate additional modules seamlessly.

NAC Bypass is a Linux-based tool designed to create a transparent Layer-2 bridge with two Ethernet interfaces that facilitates bypassing Network Access Control (NAC) mechanisms by inheriting an active authentication session from a legitimate workstation. Its primary use case centers on network penetration testing and security assessments, allowing attackers to forward traffic while maintaining authorized access. Notable features include customizable network interface assignment, built-in options for passive monitoring, and integration with tools like Responder for enhanced functionality.

Mythos Research Edition is an open-source tool designed for vulnerability discovery in software applications, utilizing the publicly available Claude Opus 4.7 model to replicate the eight-phase scaffold of Anthropic's Mythos Preview. It enables open-source maintainers, security researchers, and academics to conduct targeted scans at a low cost, facilitating coordinated vulnerability disclosure while avoiding unauthorized mass scanning. Key features include self-scanning capabilities for project audits and research, without requiring access to Anthropic's proprietary model.

ModuleStomped is a proof-of-concept tool designed to detect module-stomped DLLs by analyzing the pdata section of various processes, which remains unchanged and thus provides a more reliable detection mechanism than analyzing the .text section. It features two primary modes: a process scanner that inspects all accessible processes for anomalies, and an ETW mode that monitors image load events for specified DLLs. Notably, the tool emphasizes the correlation of stack frames with pdata as a potential detection strategy, while acknowledging potential evasion techniques.

MockSSH is a tool designed to emulate SSH server environments, enabling testing and automation of tasks without access to actual servers. It features a modern, type-safe architecture that supports threading for end-to-end unit tests, as well as integration with Python and HyLang for scripting commands. The tool includes comprehensive development utilities for linting, static type checking, and testing, alongside a DSL for simplified configuration and usage.

LLMtary is an AI-powered penetration testing platform designed for security professionals, facilitating an autonomous workflow from reconnaissance to exploit validation and report generation. It integrates large language model intelligence to conduct a comprehensive examination of targets, capable of operating entirely offline with local models or utilizing cloud-based AI for improved accuracy. Key features include a structured testing loop, multi-phase enrichment for targeted vulnerabilities, and native support across major operating systems, ensuring a streamlined and efficient penetration testing experience.

FORGEDAN is a report-first LLM security assessment framework designed to generate reproducible security assessment report packages for large language models (LLMs). Its primary use case centers on providing high-quality, evidence-rich reports that include YAML suites, deterministic scanners, and audit-ready bundles, ensuring traceability and verifiability of input and output artifacts. Notable features include the integration of an evolutionary jailbreaking algorithm, a web dashboard, and a comprehensive QA receipt system, all contributing to enhanced report integrity and usability.

LLAMATOR is a Python-based framework designed for Red Teaming, enabling security professionals to conduct penetration testing on chatbots and Generative AI systems. Its notable features include support for custom attacks, compatibility with multiple chat client configurations, and comprehensive reporting capabilities in various formats, making it suitable for assessing vulnerabilities such as prompt injection and misinformation.

LID (Linux Integrity Drift) is a tool designed to systematically identify kernel code paths that bypass Linux Security Module (LSM) hooks, thereby exposing visibility gaps in security policies without breaching the security guarantees of the LSM framework. It provides detailed insights into what security-sensitive operations are not evaluated by the LSM, affecting compliance and forensic capabilities. Notable features include distinguishing between visibility gaps and practical escalation paths, offering a nuanced understanding of potential security weaknesses in Linux environments.

Ledger is a Cobalt Strike aggressor script designed to log operational changes made during red team engagements, providing a structured audit trail of modifications such as service activations, account creations, and registry edits. Notable features include risk scoring for each entry, cleanup tracking, operator attribution, and the ability to export logs in JSON or plain text for after-action reports. This tool enhances operational awareness and ensures that all changes are documented and managed effectively throughout the engagement lifecycle.

KoviD is an open-source Loadable Kernel Module (LKM) designed for educational and defensive security research focused on rootkit techniques within Linux Kernel version 5 and later. It empowers security researchers and system administrators to analyze rootkit behavior, develop detection signatures, and enhance their understanding of kernel-level vulnerabilities through practical demonstrations of real-world threat capabilities. Notable features include support for investigating module concealment, process hiding, and log manipulation, enabling users to test and improve their security monitoring and incident response strategies.

Kali + OpenClaw Portable Pentest USB is a bootable USB solution that integrates Kali Linux Live with OpenClaw automation for streamlined, portable penetration testing. It addresses key challenges in traditional workflows by offering a pre-configured environment, automation capabilities, real-time documentation of findings, and forensically clean operation that leaves no trace on host systems. Notable features include persistent configurations, a selection of pre-configured templates for various testing scenarios, and support for deploying remote nodes on target networks.

k8s-enum.sh is a toolkit designed for penetration testing and red team operations in Kubernetes environments, featuring two primary scripts: k8s-enum.sh for external enumeration using kubeconfig files and k8s-pod-enum.sh for internal enumeration from compromised pods. It provides comprehensive security enumeration with color-coded output that highlights privilege escalation vectors, misconfigurations, and actionable recommendations, making it a valuable resource for security researchers assessing Kubernetes configurations. Noteworthy features include permission enumeration, namespace and service discovery, and detailed detection of potentially dangerous permissions and settings.

Juumla is a Python-based tool designed for identifying Joomla versions, scanning for vulnerabilities, and detecting sensitive files within Joomla installations. Key features include fast scanning capabilities with low resource utilization, the ability to find configuration and backup files, and vulnerability detection based on the identified Joomla version. Additionally, Juumla can be easily deployed via Docker for a streamlined setup process.

HVNC is a standalone client-server tool designed to create a hidden virtual desktop on the operator's side, allowing remote control over a target machine akin to the HVNC module of the TinyNuke banking trojan. Notable features include customizable process launching via a command menu, browser launchers for multiple web browsers, and a hidden client console. It serves primarily for educational and research purposes regarding remote access techniques.

Huntbot is a multi-model offensive security tool designed for bug bounty hunting, penetration testing, and red teaming, offering advanced capabilities for vulnerability detection and reporting. Notable features include contextual knowledge accumulation, human-like interaction with web applications, the ability to share live browser sessions, and meticulous false positive validation before report generation. It is extensible with multiple AI models and allows for dynamic steering during runs, enabling security professionals to efficiently explore and validate security vulnerabilities.