Security

Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

🎓 Because Education should be free. Contributions welcome! 🕵️

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — supports bug bounty, continuous monitoring, and CTF modes. Built with Go and 7+ native security tools.

This is a multi-use bash script for Linux systems to audit wireless networks.

List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

Tookie is a advanced OSINT information gathering tool that finds social media accounts based on inputs.

Community curated list of templates for the nuclei engine to find security vulnerabilities.

Free and Open Source Reverse Engineering Platform powered by rizin

An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

Fush Vue MCP —— Vue 前端逆向 + Web 安全测试工具（Chrome 扩展 + MCP 服务端，91 个工具）

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Open-source antivirus and firewall for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.

Nmap - the Network Mapper. Github mirror of official SVN repository.

The easiest, and most secure way to access and protect all of your infrastructure.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

Automated NoSQL database enumeration and web application exploitation tool.

Adversary Emulation Framework

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Amazing Sandbox - run third-party tools and AI agents securely on your machine

Local, evidence-based application security assessment engine and Claude Code plugin

ESP32-DIV HaleHound Edition for Cheap Yellow Display - Multi-protocol offensive security toolkit

404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目

HaGeZi DNS: Free, Non-Commercial EU Public DNS Servers

Catch risky npm dependency changes before they merge.

A modular, stack-agnostic toolkit for AI coding agents to autonomously find, reproduce, and patch vulnerabilities.

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

Project CodeGuard is an open-source, model-agnostic security framework that embeds secure-by-default practices into AI coding agent workflows. It provides comprehensive security rules that guide AI assistants to generate more secure code automatically.

Fast web fuzzer written in Go

Free hands-on digital forensics labs for students and faculty

Useful tool to track location or mobile number

Modlishka. Reverse Proxy.

Reusable prompts for a structured, evidence-first bug bounty hunting workflow

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more

🐶 A curated list of Web Security materials and resources.

Modern attack-surface reconnaissance & asset monitoring platform — rebuilt from classic ARL with async decoupled scheduling, enterprise asset correlation and native MCP support. Docker-ready.

Open-Source Phishing Toolkit

An evolving how-to guide for securing a Linux server.

OpenVPN is an open source VPN daemon

Database governance built for humans and agents — controlling changes and access across every major database.

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

Cybersecurity oriented awesome list

An ArchLinux based distribution for penetration testers and security researchers.

A secure, efficient TCP/UDP tunneling solution that delivers fast, reliable access across network restrictions using pre-established TCP/QUIC/WebSocket or HTTP/2 connections.

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.

Source code for Hacker101.com - a free online web and mobile security class.