Security

🔍 Search anyone's digital footprint across 300+ websites

A comprehensive, step-by-step guide to mastering cybersecurity from beginner to expert level with curated resources, tools, and career guidance

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

🎓 Because Education should be free. Contributions welcome! 🕵️

EMBA - The firmware security analyzer

Automation for internal Windows Penetrationtest / AD-Security

OSINT & recon toolkit // 100+ tools, one-command installer, SOCMINT, GEOINT, network recon, dark web, forensics & more.

Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.

Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more

⚔️Windows11 Penetration Suite Toolkit 🔰 The First Windows Penetration Testing Environment on Mac M Chips

巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。

一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。

An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.

An ArchLinux based distribution for penetration testers and security researchers.

A curated list of awesome OSCP resources

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞验证功能

Nmap NSE scripts that turn a service scan into CVEs, CVSS scores and known exploits — fingerprints software from HTTP responses and checks every detected CPE against the Vulners database.

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

👻Stowaway -- Multi-hop Proxy Tool for pentesters

:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

Open-source AI-powered offensive security harness for automated penetration testing.

Automated NoSQL database enumeration and web application exploitation tool.

A collection of custom security tools for quick needs.

File upload vulnerability scanner and exploitation tool.

Platform Security Assessment Framework

The cross-harness, self-improving memory layer for AI agents. Join our community: https://discord.com/invite/zdNChS2fBu

Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

Rockyou for web fuzzing

Packer Fuzzer is a fast and efficient scanner for security detection of websites constructed by javascript module bundler such as Webpack.

lightweight, dependency-free bash script for security, performance auditing and infrastructure monitoring of Linux servers.

🔐 Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audit logs.

The cheat sheet about Java Deserialization vulnerabilities

A repository of sysmon configuration modules

Tookie is a advanced OSINT information gathering tool that finds social media accounts based on inputs.

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — supports bug bounty, continuous monitoring, and CTF modes. Built with Go and 7+ native security tools.

Interesting APT Report Collection And Some Special IOCs

Fully featured and community-driven hacking environment

ContainerSSH: Launch containers on demand

Awesome Node.js Security resources

Free hands-on digital forensics labs for students and faculty

All In One Web Recon

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

Open source vulnerability DB and triage service.

Community-maintained dataset of 700+ websites for finding accounts by username — powers OSINT and digital footprint tools.

Plugin for JADX to integrate MCP server

The Official Bash Bunny Payload Repository

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.

Vulnerability Intelligence Platform

Single-file PHP shell