Security

The ultimate WinRM shell for hacking/pentesting

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

Modlishka. Reverse Proxy.

A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.

Ladon大型内网渗透扫描器，PowerShell、Cobalt Strike插件、内存加载、无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。网络资产探测32种协议(ICMP\NBT\DNS\MAC\SMB\WMI\SSH\HTTP\HTTPS\Exchange\mssql\FTP\RDP)或方法快速获取目标网络存活主机IP、计算机名、工作组、共享资源、网卡地址、操作系统版本、网站、子域名、中间件、开放服务、路由器、交换机、数据库、打印机等，大量高危漏洞检测模块MS17010、Zimbra、Exchange

Open Source Cloud Native Application Protection Platform (CNAPP)

The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.

Cameradar hacks its way into RTSP videosurveillance cameras

Automated Mass Exploiter

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

Dark Web OSINT Tool

Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.

Phishing Tool & Information Collector

Unlock an Android phone (or device) by bruteforcing the lockscreen PIN. Turn your Kali Nethunter phone into a bruteforce PIN cracker for Android devices! (no root, no adb)

agent runtime security - zero trust, zero setup, zero latency agent sandboxing

Cairn is a general-purpose AI state-space search engine, validated first on autonomous penetration testing. Sometimes misspelled as Carin.

IntelOwl: manage your Threat Intelligence at scale

🚗 A curated list of resources for learning about vehicle security and car hacking.

Red Teaming Tactics and Techniques

Open Source Deep Packet Inspection Software Toolkit

The Leading Security Assessment Framework for Android.

📡 Comprehensive collection of OSINT tools for cybersecurity professionals, researchers, and bug bounty hunters. Topics: information gathering, reverse search, red team, trust & safety, AI.

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

Wiki to collect Red Team infrastructure hardening resources

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share them among connected sibling servers (Villain instances running on different machines).

Applied offensive security with Rust - https://kerkour.com/black-hat-rust

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.

🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc.

Cybersecurity oriented awesome list

Free Windows, Mac and Linux cleaner, scanner, and more.

State-of-the-art native debugging tools

A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.

Malwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.

A high performance offensive security tool for reconnaissance and vulnerability scanning

Awesome hacking is an awesome collection of hacking tools.

Linux enumeration tool for pentesting and CTFs with verbosity levels

Git All the Payloads! A collection of web attack payloads.

Privilege Escalation Enumeration Script for Windows

有关burpsuite的插件(非商店),文章以及使用技巧的收集(此项目不再提供burpsuite破解文件,如需要请在博客mrxn.net下载)---Collection of burpsuite plugins (non-stores), articles and tips for using Burpsuite, no crack version file

Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Ubuntu. Limited support for Kali Linux.

Practical Ethical Hacking Labs 🗡🛡

Hide secrets with invisible characters in plain text securely using passwords 🧙🏻‍♂️⭐

💚🇺🇸🗽Secure remote browsing anywhere, any way you like it. Since 2018.

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

pocsuite3 is an open-sourced remote vulnerability testing framework developed by the Knownsec 404 Team.

OSCP Cheat Sheet

My simple Swiss Army knife for http/https troubleshooting and profiling.