> cat /dev/github | grep security-tools

~/hackyfeed $

A cybersecurity tools aggregator — discover the latest pentesting, red team, and offensive security tools from GitHub.

sort: ( this page )

amazon-q-developer-cli

The Amazon Q Developer CLI is a command-line interface tool that facilitates interaction with the Amazon Q platform, primarily designed for developers working with AWS services. Although the project is no longer actively maintained and has transitioned to Kiro CLI, it allows users to perform operations like logging in and executing various subcommands. Notable features include a Rust-based architecture for ease of development and compatibility with major operating systems such as macOS and Linux.

aggroArgs

aggroArgs is a command-line tool designed for probing and exploiting buffer overflows through aggressive argument testing. It features cyclic pattern overflows with automatic offset calculation, segfault monitoring, and the ability to generate proof-of-concept exploits. The tool supports various probing modes, extensive command-line option parsing, and is tailored for ELF files marked as executable, making it suitable for security researchers and penetration testers assessing software vulnerabilities.

agent

Stakpak is an open-source autonomous agent designed to manage applications and infrastructure in a 24/7 runtime environment, mimicking Platform as a Service (PaaS) capabilities without vendor lock-in. Key features include secure secret substitution, network-level guardrails to prevent destructive operations, a library of curated DevOps playbooks, and simplified command aliases for easy setup and management. It enables developers to generate infrastructure code, debug Kubernetes, and automate CI/CD processes while maintaining strict control over production access rights.

ZODB

ZODB is a Python object-oriented database that offers seamless integration of database operations with Python code, eliminating the need for separate query languages or object-relational mapping. Its notable features include full ACID transactional support, minimal changes required for object persistence, and a high degree of transparency, allowing developers to work with data as native Python objects. The database is compatible with Python 3.7 and above as well as PyPy, making it versatile for various applications.

Zeus-Scanner

Zeus-Scanner is an advanced reconnaissance tool designed for simplifying web application reconnaissance, featuring a robust URL parsing engine, compatibility with multiple search engines, and the ability to bypass IP blocks. It supports various vulnerability assessments, including XSS and SQL injection, while offering proxy and Tor compatibility, making it versatile for stealthy web scraping and security testing. Notable features include the ability to extract URLs from cached pages, parse robots.txt files, and utilize tamper scripts for payload obfuscation.

xxh

xxh is a portable shell tool that enables users to access their preferred command-line environments, such as Xonsh, fish, or zsh, through SSH without the need for root access or installation on the remote system. Key features include a hermetic design that maintains a clean remote environment, support for easy customization and forking of shell configurations, and the ability to seamlessly switch between multiple shells based on task requirements, thereby enhancing usability and flexibility in terminal interactions.

XSStrike

XSStrike is an advanced Cross Site Scripting (XSS) detection suite that uses custom parsers and a sophisticated payload generator to analyze web responses and craft effective XSS payloads based on context analysis. Its primary use case is to identify and exploit reflected and DOM-based XSS vulnerabilities, complemented by capabilities such as multi-threaded crawling, WAF detection, and a powerful fuzzing engine. Notable features include a handmade HTML and JavaScript parser, intelligent payload crafting, and support for brute-forcing payloads, making it a comprehensive tool for web security assessments.

xonsh-cheatsheet

The xonsh-cheatsheet repository provides a comprehensive guidesheet for the Xonsh shell, designed to enhance productivity by offering easily copyable command examples. This tool serves as an accessible resource for users looking to leverage Xonsh's Python-powered shell capabilities across multiple platforms, combining features from both Bash and IPython. Notable features include a set of practical commands tailored for quick reference and an emphasis on fostering a collaborative environment within the Xonsh community.

XlsxWriter

XlsxWriter is a Python module designed for creating Excel 2007+ XLSX files, enabling users to write text, numbers, formulas, and hyperlinks across multiple worksheets. Its notable features include full Excel compatibility, comprehensive formatting capabilities, chart creation, defined names, and support for images and data validation, along with seamless integration with data manipulation libraries like Pandas and Polars. This tool is ideal for generating complex Excel reports and requires Python 3.8+ or PyPy3, utilizing standard libraries exclusively.

xgen

XGen is a family of 7 billion parameter large language models developed by Salesforce AI Research, specifically designed for long sequence modeling with support for input sequences of up to 8,000 tokens. The models offer various configurations, including a base model and an instruction-finetuned version for research purposes, and are built to function as auto-regressive samplers. Key features include implementation using the OpenAI Tiktoken tokenizer and integration with the Hugging Face Transformers library for ease of use.

xborder

xborders is a tool designed for dynamically replacing active window borders in various window managers, enhancing the visual layout for users. Its primary use case is to provide a customizable border experience in environments like i3, while ensuring compatibility with window compositors for effects such as transparency. Notable features include a configuration interface via command-line options and support for various dependencies like pycairo and libwnck, allowing for tailored aesthetics in window management.

WMIExec

WMIexec is a set of Python scripts designed for executing commands on remote Windows systems using the WMI protocol. It offers two primary execution methods: through Scheduled Tasks and the Win32_Process interface, allowing for versatile remote command execution capabilities. Notably, it includes a script for setting up a secure HTTPS server to exfiltrate command output, enhancing stealth during lateral movement operations.

wifi_taxonomy

Database of known signatures identified using the mechanism in "Passive Taxonomy of Wifi Clients using MLME Frame Contents" from research.google.com/pubs/pub45429.html

werkzeug

Werkzeug is a powerful WSGI web application library that provides essential utilities for building and managing web applications. It features an interactive debugger, comprehensive request and response objects, a flexible routing system, and a threaded development server, enabling developers to create various applications without imposing any dependencies. Werkzeug serves as the foundational layer for other frameworks, such as Flask, while allowing developers the freedom to choose additional components like template engines and database adapters.

WebhookListener

WebhookListener is a Python and Flask application designed to receive and log webhooks, specifically those from PoGo++ and iSpoofer, with the capability to decode them. It features simple installation, customizable settings via a configuration file, and integration options for use with NGINX, making it a versatile tool for developers needing to handle and analyze webhook data.

wayback-machine-scraper

The Wayback Machine Scraper is a command-line utility designed to scrape or download historical website data from the Wayback Machine at archive.org. Its primary use case is to capture snapshots of websites that may have implemented anti-scraping measures or to collect data as it appeared at specific points in the past, allowing for precise and configurable scraping capabilities. Notable features include the ability to specify time ranges, control concurrency levels, and utilize regular expressions for URL filtering, along with an interface that can be integrated with Scrapy for advanced data parsing tasks.

waitress

Waitress is a WSGI server implemented in pure Python designed for production environments, offering commendable performance with no external dependencies beyond the Python standard library. It supports both HTTP/1.0 and HTTP/1.1, operates on CPython and PyPy 3.9+ across Unix and Windows platforms, and is particularly suitable for applications needing a reliable, lightweight server. Notable features include its simplicity in installation and configuration, making it an accessible choice for developers.

wagtail

Wagtail is an open-source content management system (CMS) built on Django, designed for creating and managing dynamic websites with an emphasis on user experience and developer flexibility. Notable features include a powerful content API for headless setups, support for multi-site and multi-language deployments, a customizable interface for authors, and capabilities to handle millions of pages and thousands of users efficiently. Its extensibility embraces and enhances Django, making it a suitable choice for organizations like NASA and Google.

vscode-extension-splunk

The Visual Studio Code Extension for Splunk facilitates the development, testing, and debugging of Splunk Enterprise applications and configurations directly within the Visual Studio Code environment. Key features include syntax highlighting and IntelliSense for .conf files, semantic linting with best practice suggestions, integration for executing and viewing Splunk queries and reports, as well as robust debugging support for Python code utilized by Splunk. This extension aims to enhance productivity for Splunk developers and administrators by streamlining their workflow in a familiar coding platform.

vizier

Open Source Vizier is a Python-based tool designed for black-box optimization, facilitating hyperparameter tuning and research within scalable environments. It offers a robust client-server architecture, a user-friendly API for optimizing objectives, and advanced features for integrating with TensorFlow Probability and PyGlove to support Bayesian optimization and evolutionary algorithms. Notable functionalities include a multi-client setup for distributed optimization and a benchmarking API to evaluate different algorithms.

villoc

Villoc is a heap visualization tool written in Python that renders static HTML files from memory tracing data, primarily generated by ltrace or DynamoRIO. It allows users to analyze memory operations in applications by providing a visual representation of the heap's state and significant memory events, enhanced with annotation functionality for improved analysis. Notable features include compatibility with multiple tracers, the ability to inject annotations directly from C code, and configurable options to accommodate different memory allocation implementations.

urlscan-py

urlscan-py is a Python wrapper for the urlscan.io API, enabling automated scanning of URLs. Its primary use case is to facilitate the submission and retrieval of scan results, which can be managed using a local SQLite database for storing API keys and scan UUIDs. Notable features include the ability to scan multiple URLs simultaneously, search through previous scans, and retrieve detailed scan summaries, simplifying the analysis of web security.

untitledgoosetool

Untitled Goose Tool is a comprehensive hunt and incident response utility designed for investigations within Microsoft Entra ID, Azure, and M365 environments. It enhances traditional incident response by providing advanced authentication methods and collecting telemetry from Microsoft Defender for Endpoint and Defender for Internet of Things, enabling teams to export cloud artifacts effectively from environments lacking proper log ingestion into SIEMs. Notable features include a flexible GUI, CSV output capabilities, and recommended workflows for various incident handling scenarios.

undetected-chromedriver

undetected-chromedriver is an optimized Selenium Chromedriver patch designed to bypass anti-bot mechanisms from services such as Distill Network and Imperva. It automatically downloads the necessary driver binary, provides compatibility with Brave and other Chromium-based browsers, and includes advanced anti-detection features. Notably, it does not anonymize IP addresses, ensuring users must manage their IP reputation independently.

unblob

unblob is a comprehensive extraction suite designed for parsing and analyzing binary blobs, supporting over 78 archive, compression, and file system formats. Its key features include recursive extraction capabilities, precise chunk detection, unknown chunk carving, entropy analysis for unrecognized data, and multi-processing for enhanced performance. Ideal for reverse engineering firmware images, unblob allows for custom plugin integration and operates without requiring elevated privileges.