Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Repository Index
47,133 repositories indexed
1–24 of 48 · Most stars
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Community curated list of templates for the nuclei engine to find security vulnerabilities.
A vulnerability scanner for container images and filesystems
OSS-Fuzz - continuous fuzzing for open source software.
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
Vulnerability Static Analysis for Containers
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
A list of web application security
A static analysis security vulnerability scanner for Ruby on Rails applications
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
An step by step fuzzing tutorial. A GitHub Security Lab initiative
Tool to look for several security related Android application vulnerabilities
:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.
The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.