~/hackyfeed $

Agent Arena facilitates evidence-first multi-agent debates among AI coding agents such as Claude Code and OpenAI Codex to deliver independent analyses and critiques of code and architecture decisions. It is particularly suited for high-stakes scenarios, including architectural reviews, implementation plan assessments, and bug root-cause analysis, while ensuring that dissenting viewpoints and evidence verification are preserved. The tool supports diverse model backends, allowing cross-collaboration among differing AI models, though it functions as a protocol rather than a direct execution orchestrator.

ActiveBreach-Engine (ABE) is a Windows execution capability platform that enables secure and direct system call execution in heavily instrumented environments, mitigating risks from external attackers and process hooking. It offers a dynamic framework that avoids reliance on user-mode APIs or `ntdll.dll`, featuring built-in anti-debug and protection mechanisms to safeguard system calls. ABE is available in C, C++, and Rust adaptations, with the Rust version providing advanced features like build-time encrypted stubs and modular integration across various programming languages.

VisualSploit is a tool designed to weaponize MSBuild project files by injecting a loader for embedded shellcode, enabling execution without direct user interaction during project build or evaluation. It supports various MSBuild file formats and allows customization of shellcode input formats, XOR encryption rounds, and target platforms, thereby facilitating stealthy payload delivery through CI environments or developer machines. Notably, it exploits MSBuild's design-time evaluation feature to trigger code execution upon project operations.

TABPE is a structured dataset tool that catalogs all PE (Portable Executable) files, including executables and libraries, from clean installations of Windows 10 Pro and Windows 11 Pro. The primary use case is for security researchers and developers who require comprehensive information about each PE file, including metadata such as headers, sections, imports, exports, and checksums, along with detailed logs of the scanning process. Notable features include the generation of a JSON file containing complete PE file details, a text file listing all detected files, and a log of inaccessible files, providing a thorough overview of the executables on the system.

ScanCannon is a high-speed Bash script designed for efficient credentials-based attack surface enumeration and reconnaissance of large external networks, leveraging tools like `masscan` for rapid port detection and `nmap` for detailed service analysis. It outputs consolidated reports in HTML and CSV formats while enabling project-driven scanning that tracks changes over time, facilitating continuous monitoring of attack surfaces. Notable features include full ASN-based discovery, API detection, CVE hinting, and resilience through checkpointing and parallel scanning.

Omniscient V3 is a comprehensive reconnaissance and adversary simulation framework designed to enhance security assessments by consolidating over 130 best-in-class tools into a unified pipeline. Key features include AI-driven results augmentation, distributed execution across platforms such as Kubernetes and Docker, advanced stealth techniques for emulating sophisticated attacks, and immutable audit trails for compliance and reporting. This tool is primarily aimed at security professionals, providing a streamlined approach to identifying vulnerabilities in complex attack surfaces.

Payloader is a self-hosted knowledge workbench designed for authorized security testing, red teaming, and security research. It consolidates payloads, tool commands, and coding procedures into a searchable and maintainable system that can be distributed offline, featuring a dual workspace for payloads and commands, a management backend for content and navigation, and client generation capabilities for Windows, Linux, and macOS. Notable functionalities include seamless payload management, robust encoding/decoding support, and built-in version control for content updates.

The Cyber, InfoSec Events repository serves as a catalog of past and upcoming cybersecurity and information security-related events. Its primary use case is to provide a comprehensive list of events in the field, facilitating community engagement through contributions and updates. Notable features include an interactive calendar subscription option and a welcoming approach for community involvement via issues and pull requests.

The HTB Writeups repository is a comprehensive resource for Hack The Box enthusiasts, providing structured and searchable documentation for over 500 machines, 400 challenges, and various tools and methodologies useful for penetration testing and certification preparation. Notable features include an interactive machine finder, knowledge graph for technique exploration, and visual attack paths that illustrate complete exploitation processes. This repository serves as an essential hub for skill development aimed at OSCP, CPTS, and other security certifications.

GhostHound is a specialized tool designed as an OpenGraph extension for BloodHound, targeting the enumeration of deleted objects (tombstones) in Active Directory environments. Its primary use case is to facilitate security assessments by revealing who can restore these deleted objects, thereby potentially allowing an attacker to reclaim identities. Notable features include the ability to generate a JSON payload compatible with BloodHound, detailed analysis of reanimation rights, and flexible LDAP connection options for various environments.

Geiger is a read-only blast-radius triage tool designed for assessing the impact of leaked credentials by identifying what resources they can access. It excels in incident response and penetration testing scenarios by running dry-run recon against credentials to evaluate their reach without altering any systems. Notable features include the ability to process various input formats, integration with other security tools like TruffleHog and Nuclei, and the option for live testing to provide impact assessments while preserving a read-only modality.

Gato-X is an advanced scanning and attack toolkit specifically designed to identify vulnerabilities in GitHub Actions pipelines, including Pwn Requests, Actions Injection, and self-hosted runner takeovers. Notable features include fast scanning of thousands of repositories with a single API token, robust analysis of cross-repository workflows, and the capability for post-compromise secrets enumeration. Tailored for Red Teamers and security professionals, Gato-X emphasizes thorough vulnerability detection while adhering to ethical research practices.

Fluffy-Barnacle is a toolkit designed for creating disposable, ephemeral network infrastructure using GitHub Codespaces, enabling users to rapidly deploy services such as SOCKS5 proxies, HTTPS file hosting, and WireGuard tunnels. Notable features include an auto-reconnecting SOCKS5 proxy with circuit breaker support, instant public HTTPS file hosting capabilities, and a suite of CLI tools that integrate with common security testing utilities while managing fresh egress IPs upon each deployment. This tool serves primarily for educational, research, and authorized security testing purposes, adhering strictly to GitHub's usage policies.

Dorothy is a Python tool designed for security teams to assess their monitoring and detection capabilities within Okta environments. It offers modules that simulate potential attacker actions and facilitates auditing aligned with MITRE ATT&CK® tactics, including persistence, defense evasion, and discovery. Notably, it allows users to modify Okta configurations, making it essential for testing purposes in non-production environments.

Code Abyss is a sophisticated tool designed to enhance AI coding agents with personality, consistent execution, and security expertise across various engineering domains. It offers customizable personas and styles, allowing for a tailored interaction experience, while possessing a robust skill library for effective judgment in technical scenarios. Notable features include support for four native security domains and a disciplined kernel that minimizes context overhead, ensuring agents respond with depth and specificity in diverse situations.

C-Full-Offensive-Course is a bilingual educational resource designed to guide users through a comprehensive C programming curriculum focused on offensive security practices across Windows, Linux, and macOS platforms. The course comprises 216 progressive units with hands-on coding exercises, alongside a centralized codebase to facilitate learning. It emphasizes ethical usage by instructing users to conduct security labs only within authorized and isolated environments.

Browser Data Logger is a client-side JavaScript toolkit designed for authorized research and testing of browser telemetry and API capabilities. It modularly collects and aggregates data from various browser APIs, ensuring that failures in one area do not impact overall functionality, while providing real-time streaming of results via WebSocket and Telegram integration. The tool focuses on studying browser fingerprints, device metadata, and permissions, making it ideal for security research and educational purposes.

The bof-launcher is a versatile programming library designed for in-memory management and execution of Beacon Object Files (BOFs) across multiple platforms, including Windows and Linux. It supports various architectures and integrates seamlessly with languages such as C, Zig, and Rust, offering features like asynchronous execution, cross-platform compatibility, and advanced memory masking techniques. Additionally, the library facilitates the development of BOFs using Zig, leveraging a rich standard library for enhanced functionality during red team engagements.

XeraLdr is an advanced Windows loader engineered for executing payloads stealthily while evading modern Endpoint Detection and Response (EDR) systems, specifically tested against Microsoft Defender for Endpoint with no alerts triggered. Key features include techniques such as module stomping, IAT camouflage, and advanced anti-analysis measures, which significantly enhance its stealth capabilities and reduce detection risks. This tool is designed primarily for educational and research purposes, enabling users to understand sophisticated evasion tactics used in malware payload delivery.

WRAITH is a modern browser-hooking framework designed for red teams, security researchers, and educators, effectively merging the functionalities of traditional browser exploitation tools and blind-XSS frameworks into a single solution. It enables users to conduct authorized security testing by delivering both interactive post-exploitation capabilities and fire-and-forget blind-XSS callbacks in a manner suited for contemporary web applications, including those involving AI. Notable features include an operator console for session management, Docker support for deployment, and a generation of custom payloads for seamless integration into testing scenarios.

Red-Team AI is a white-box red teaming tool designed to identify security vulnerabilities in agentic AI applications by analyzing the source code for specific bugs related to the application's stack. Its notable features include a comprehensive dashboard for scan management, customized attack generation based on the application's architecture, and compliance tracking against industry standards like OWASP LLM Top 10. This tool is particularly useful for developers working with AI agents in sensitive environments such as finance or healthcare, where unique security risks can arise.

Violin is a Hermes-native pentesting profile designed for supervised penetration tests, guiding users through reconnaissance, exploit validation, and reporting while ensuring robust safety mechanisms. Notable features include 31 structured playbooks for various testing methodologies, a multi-layered safety system that validates every target interaction, and evidence-driven reporting to enhance reproducibility and documentation. It seamlessly integrates with existing Hermes configurations without introducing additional credential management, streamlining the pentesting workflow.

The ULTIMATE CYBERSECURITY MASTER GUIDE serves as a comprehensive knowledge base for cybersecurity practitioners, encompassing insights from over 70 expert books and 90 internal documents. It features detailed guides and playbooks for various roles, including Red Team, Blue Team, and Purple Team operations, along with a flat catalog system for easy access to all resources. Notable elements include an extensive collection of OSINT tools and custom scripts, making it an essential reference for both novice and experienced cybersecurity professionals.

Tung is a command-line tool designed for configuring and testing firewalls against various types of DoS attacks. Its primary use case is to assist security professionals in evaluating firewall resilience and understanding DoS attack vectors through a collection of common techniques across multiple network protocols, including implementations of attacks like Slowloris and BlueNurse. Notable features include support for ICMP, TCP, UDP, and IP, making it a versatile tool for both educational and practical security testing purposes.

Titus is a high-performance secrets scanner designed to detect credentials, API keys, and tokens within source code, files, and git history. Targeted at security engineers and DevSecOps teams, it features accelerated regex matching, live secret validation, broad coverage with 487 detection rules, and multiple scanning interfaces including CLI, Go library, and browser extensions. Notably, Titus also supports container image scanning and binary file extraction for enhanced security assessments.