~/hackyfeed $

GarudRecon is a bash-based reconnaissance automation framework designed for security professionals and bug bounty hunters, facilitating asset discovery and vulnerability assessment through the integration of over 80 open-source security tools. It offers multiple operational modes, such as SmallScope, MediumScope, and LargeScope, to tailor the reconnaissance process according to different engagement scopes, alongside advanced capabilities for automated monitoring and vulnerability detection including subdomain enumeration, port scanning, and exploitation checks. Noteworthy features include a workflow mode for tool chaining, fleet mode for distributed scans, and cron job scheduling for recurring tasks.

The EvilCrowRF_v2-el_Cheapo_version is a DIY radio frequency device designed for penetration testing and Red Team operations, capable of operating within the 300MHz to 928MHz bands. It utilizes easily sourced components and offers an accessible building experience, featuring support for various firmware options to enhance its functionality. Key components include the TI CC1101 module, ESP32 DevKit, and a MicroSD card, making it a versatile and affordable tool for RF experimentation and security assessments.

dotdotslash is a Python tool designed to automate the testing for Directory Traversal vulnerabilities in web applications. It allows users to specify a target URL and an attack string, with options for depth of traversal and cookie handling, making it suitable for security assessments against platforms like DVWA and bWAPP. Notable features include detailed command-line help and a focus on efficient vulnerability detection in a variety of web architectures.

dnsspider is an asynchronous, multithreaded tool designed for brute-forcing subdomains using either a specified wordlist or character permutations. Its primary use case is to discover subdomains of a target domain quickly, allowing for various attack types, including dictionary-based or brute-force methods. Notable features include customizable character sets, the ability to query multiple DNS record types, and options for logging results in different formats, making it versatile for reconnaissance purposes in cybersecurity assessments.

Dirble is a directory scanning tool designed for both Windows and Linux environments, enabling rapid enumeration of web directories and files. Its primary use case is for security assessments to identify accessible resources on web servers, with notable features including support for custom headers, HTTP authentication, multithreading, and options for saving output in various formats. It also effectively detects both listable directories and responds to various HTTP status codes, enhancing its utility in penetration testing scenarios.

Deluder is a dynamic instrumentation tool designed for intercepting traffic from proxy unaware applications by leveraging Frida. It supports a variety of networking libraries, including WinSock, OpenSSL, and GnuTLS, and allows users to customize interception scripts using JavaScript. Primarily intended for integration with the PETEP penetration testing proxy, Deluder can also function autonomously for broader traffic interception tasks.

Cyber-X is a comprehensive cybersecurity toolkit designed for penetration testing and server defense against hacker attacks. It features various tools for vulnerability scanning, exploitation, server hardening, and anti-DDoS protection, catering to multiple user needs through its modular structure, including X-pentest for offensive operations and X-defence for defensive measures. The toolset emphasizes ease of installation and usage, making it suitable for educational and practical applications in cybersecurity.

CTFEnum is a Python-based network penetration testing tool specifically tailored for Capture The Flag (CTF) challenges. It conducts reconnaissance by scanning open TCP and UDP ports on a specified IP address, employing a modular design to probe various services and leveraging multiprocessing for efficiency. Notable features include automatic Nmap scanning, service-specific handlers for tasks like brute-forcing credentials, and detailed recommendations for exploiting identified vulnerabilities.

CrossInjector is a Python-based tool designed for scanning multiple URLs to detect Cross-Site Scripting (XSS) vulnerabilities. It utilizes Selenium WebDriver and ChromeDriver to execute JavaScript payloads, determining if each URL is susceptible to XSS attacks. Notable features include customizable payloads and support for batch URL scanning, making it an efficient solution for security assessment.

certinfo is an SSL certificate scraping tool designed to extract domain names from SSL certificates across multiple hosts. Its primary use case includes both basic certificate data extraction and recursive enumeration of subdomains through Certificate Subject Alternative Names (SANs), offering features like multi-threaded processing, support for varied input formats, and real-time output. Users can choose from multiple output formats, including JSON and CSV, and customize the number of concurrent workers for efficiency.

BurpSuite-Config is a tool designed to enhance the Burp Suite's functionality by providing customizable "Match and Replace" and "TLS Pass Through" rules. Its primary use case is to streamline the interception and modification of web traffic for security assessments. Notable features include intuitive rule configuration for efficient traffic manipulation and the ability to handle encrypted traffic seamlessly.

BugHunter-AI is an automated penetration testing agent designed with a cyberpunk-themed GUI that facilitates resource-aware task scheduling and AI-assisted analysis. Its primary use case is for authorized security testing in controlled environments, allowing users to enqueue tools while managing CPU and RAM limits for safe execution. Notable features include per-round report generation, automated CVE extraction, and integration with external AI services for enhanced command suggestions based on analysis results.

BugBountyData is a repository that compiles a list of public bug bounty programs and responsible disclosure initiatives, accessible through a user-friendly web interface. Its primary use case is to facilitate easy exploration of various bug bounty opportunities for cybersecurity researchers. Notable features include an unfiltered list of subdomains with guidelines on how to filter domains based on organizational policies, enhancing clarity and usability for participants.

Bug-Bounty-Agents provides a collection of specialized AI agent prompts designed for enhancing bug bounty hunting, penetration testing, and offensive security workflows. This tool enables users to deploy focused, production-ready agent personas into various agent-capable LLM clients such as Claude Code, GitHub Copilot Chat, and Cursor, facilitating tasks like reconnaissance, web application testing, and exploit planning without any additional framework dependencies. Notable features include strict scope enforcement and a diverse catalog of 43 agents tailored for different engagement phases, enabling efficient and targeted security assessments.

AutorizePro is a Burp Suite plugin designed for detecting authorization vulnerabilities using an integrated AI analysis module. Its primary use case is to automate the testing of authorization issues, markedly reducing false positive rates from 95% to 5% by leveraging AI for improved accuracy in complex scenarios. Notable features include support for customizable API endpoints, local model deployment, and the ability to exclude non-API resources, alongside comprehensive reporting capabilities.

Auth Analyzer is a Burp Suite extension designed to identify authorization vulnerabilities within web applications by automating the process of request manipulation and parameter handling. It features advanced capabilities for auto-extracting and replacing session parameters, such as CSRF tokens and cookies, while analyzing the responses for bypass status, enabling users to effectively test various user roles and sessions. The tool streamlines authorization testing through GUI-driven session management, simultaneous role testing, and custom parameter definitions, thus enhancing the efficiency of security assessments.

AtilKurt is a read-only Active Directory security assessment tool designed for comprehensive directory hygiene analysis and security evaluations through LDAP. It efficiently collects and analyzes identity, group, computer, GPO, and ACL data to identify misconfigurations and potential vulnerabilities, and generates detailed HTML and JSON reports for offline review. Notable features include a severity-based risk scoring system, support for large environments with paging and parallel collection, and compliance reporting for various security frameworks.

AndroSecTest is a security auditing tool designed for static analysis of Android applications to identify vulnerabilities and insecure behaviors. It utilizes a Docker container for easy setup and includes functionalities such as unpackaging APK files, examining application signatures, and checking for sensitive data within the application's file system. Notably, the tool facilitates interaction with connected Android devices via ADB commands, though results are currently not persisted outside the Docker environment.

Amnesiac is a post-exploitation framework developed in PowerShell that facilitates lateral movement within Active Directory environments without the need for installation, as it operates entirely in memory. It features command execution over Named Pipes for discreet operations, a user-friendly interface, and a variety of integrated modules for tasks such as keylogging and Kerberos ticket dumping. The tool is designed for research and authorized testing, emphasizing user responsibility in compliance with legal regulations.

Air Script is an automated Wi-Fi network penetration testing tool that simplifies the process of network scanning, handshake capturing, and brute-force password cracking. It features automated attacks on nearby networks, email notifications for successful handshake captures, and compatibility with devices like Raspberry Pi for discreet operation. Users can enhance their workflows by selecting from a variety of additional tools provided within the script.

The 3num-tool is a versatile enumeration utility designed for authorized security testing, enabling users to gather information about various services such as SSH, FTP, HTTP, DNS, and SMB. Its notable features include support for credentialed enumeration, anonymous access testing for FTP, and integration with tools like Gobuster and Hydra for more comprehensive assessments. The tool emphasizes compliance with legal and ethical guidelines, catering to security professionals conducting vulnerability assessments.

Zypheron CLI is an AI-native command-line interface designed for offensive security operations, offering integrated workflows for reconnaissance, scanning, and task automation. Notable features include a Go-based CLI, AI model integration from both local and hosted sources, and robust local storage for session data, making it suitable for authorized security testing and operator workflows. This open-source tool emphasizes terminal agility, maintaining practicality over disconnected scripts or raw outputs.

XSSRecon is an automated tool designed for the discovery of reflected XSS vulnerabilities in web applications by testing URL parameters for reflection of a specified payload. It features a dual detection method for assessing input reflection in both HTTP responses and DOM, as well as support for concurrent processing and customizable testing of special characters. Additional capabilities include smart optimizations for testing efficiency, flexible output formats, and integration with external tools like `pvreplace` for precise parameter injection.

JWT Security Checker is a comprehensive web-based platform designed for testing and analyzing JSON Web Token (JWT) security, aimed at penetration testers, security researchers, and developers. Key features include real-time JWT decoding and encoding, signature verification, a built-in dictionary for brute-forcing weak secrets, automated vulnerability scanning, and integration with various pentesting tools. The tool provides a modern user interface with support for multiple themes and real-time updates, enhancing the overall user experience during security assessments.

WordList is a comprehensive tool for generating custom wordlists intended for web application fuzzing and reconnaissance tasks. It supports the creation of various specialized wordlists, including those for DNS enumeration, default credentials, and parameters extracted from URLs, while also offering integrations for use with the Nuclei vulnerability scanner. Notable features include the ability to aggregate wordlists from multiple sources, classifies output by size, and efficiently prepares tailored wordlists based on specific URL patterns and application technologies.