Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
Repository Index
47,133 repositories indexed
25–48 of 111 · Most stars
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
The FLARE team's open-source tool to identify capabilities in executable files.
- malware-analysis
- reverse-engineering
- binary-analysis
- threat-intelligence
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
Open Source Cloud Native Application Protection Platform (CNAPP)
- cloud-native
- vulnerability-management
- threat-analysis
- devsecops
eBPF-based Security Observability and Runtime Enforcement
w3af: web application attack and audit framework, the open source web vulnerability scanner.
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
- vulnerabilities
- scanner
- firefox-extension
- grunt-plugins
A high performance offensive security tool for reconnaissance and vulnerability scanning
- reconnaissance
- scanner
- vulnerability-assessment
- vulnerability-scanner
A simple, secure and modern file encryption tool (and Rust library) with small explicit keys, no config options, and UNIX-style composability.
- cli
- encryption
- zero-configuration
- secure-by-default
Laravel Eloquent roles and abilities.
- laravel
- authorization
- eloquent
- php
Potentially dangerous files
- list
- web
- vulnerability
- files
Tool to look for several security related Android application vulnerabilities
:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:
- scanning-tool
- secret-keys
- secrets-management
- infosectools
Chrome extension and Express server that exploits keylogging abilities of CSS.
Create randomly insecure VMs
- security
- security-vulnerability
- virtualization
- randomization
A collection of JavaScript engine CVEs with PoCs
- javascript
- cve
- vulnerability
Reverse Shell as a Service
- reverse-shell
- exploit
- vulnerability
- pentesting
Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.
- malloc
- security
- memory-allocation
- malloc-library
finds publicly known security vulnerabilities in a website's frontend JavaScript libraries
- security-vulnerabilities
- security
- vulnerabilities
- lighthouse
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
- cve-2026-109618
- cve-2026-109619
- detection-rules
- exploit
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
- graphql
- security-scanner
- graphql-security
- api-documentation-tool