Security

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.

Community curated list of templates for the nuclei engine to find security vulnerabilities.

Exploitation Framework for Embedded Devices

A vulnerability scanner for container images and filesystems

Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.

Free cross-platform password manager compatible with KeePass

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

OSS-Fuzz - continuous fuzzing for open source software.

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Scapy: the Python-based interactive packet manipulation program & library.

An HTTP toolkit for security research.

hydra

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

Adversary Emulation Framework

Command-line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages.

A curated list of CTF frameworks, libraries, resources and softwares

A collection of Linux Sysadmin Test Questions and Answers. Test your knowledge and skills in different fields with these Q/A.

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目

A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more

Main Sigma Rule Repository

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

The recursive internet scanner for hackers. 🧡

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

Open Cyber Threat Intelligence Platform

The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.

Tools and Techniques for Red Team / Penetration Testing

An OSINT tool to search for accounts by username and email in social networks.

A curated list of tools for incident response

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Berty is a secure peer-to-peer messaging app that works with or without internet access, cellular data or trust in the network

Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Owned by my cybersecurity company 👇

A collection of several hundred online tools for OSINT

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

Go security checker

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

The ESP32-BlueJammer (Bluetooth jammer, BLE jammer, WiFi jammer, RC jammer) disrupts 2.4GHz communications. Using an ESP32 and nRF24 modules, it generates noise and unnecessary packets, causing interference between the devices communicating, making them unable to work as intended. Ideal for controlled disruption and security testing.

You Know, For WEB Fuzzing !

Bandit is a tool designed to find common security issues in Python code.

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

Web-based Traffic and Cybersecurity Network Traffic Monitoring

Gather and update all available and newest CVEs with their PoC.