The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
Repository Index
47,133 repositories indexed
25–48 of 58 · Most stars
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
- graphql
- security-scanner
- graphql-security
- api-documentation-tool
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
cwe_checker finds vulnerable patterns in binary executables
- cwe
- binary-analysis
- static-analyzer
- vulnerability-scanner
A DNS rebinding attack framework.
- dns-rebinding
- dns
- vulnerability
- attack
A modular vulnerability scanner with automatic report generation capabilities.
- artemis
- pentesting
- security
- security-scanner
Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.
- cve-scanning
- pentesting-tools
- rust
- vulnerability-scanners
Android Vulnerability Test Suite - In the spirit of open data collection, and with the help of the community, let's take a pulse on the state of Android security. NowSecure presents an on-device app to test for recent device vulnerabilities.
RockYou2021.txt is a MASSIVE WORDLIST compiled of various other wordlists. RockYou2021.txt DOES NOT CONTAIN USER:PASS logins!
- wordlist
- rockyou
- rockyou2021
- wordlists
The AI Agent for Cyber Security.
- ai-agent
- ai-security
- appsec
- bug-bounty
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
- application-security
- appsec
- bug-bounty
- burp-alternative
AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration.
- ai
- attack-surface-management
- bbot
- cybersecurity
Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
- cve-2026-109618
- cve-2026-109619
- exploit
- mod-php
Aggregates security advisories from 10 international CERTs daily and provides an AI skill that cross-references alerts against your project's tech stack.
- cve
- security
- security-alerts
- vulnerability
Open Source SIEM (Security Information and Event Management system).
- siem
- risk-management
- risk-assessment
- vulnerability-management
List of Magento extensions with known security issues.
- magento
- extensions
- vulnerability
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
- ai-agents
- attack-surface-management
- docker
- penetration-testing
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
- exploit
- php
- php2shell
- php2shell-cve
A free, public vulnerability feed: CVE, GHSA, OSV, CISA KEV and EPSS merged into one entry per vulnerability. RSS, JSON API and MCP. Docs and issues only.
TranslatedCyclops is a browser with XSS detection capabilities
- security
- xss
- taint-tracking
- vulnerability
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
- crtsh
- cve
- cve-2026-109618
- cve-2026-109619
A honeypot for the Log4Shell vulnerability (CVE-2021-44228).
Awesome Splunk SPL hunt queries that can be used to detect the latest vulnerability exploitation attempts & subsequent compromise
- detection
- splunk
- bpfdoor
- vulnerability