AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration.
- ai
- attack-surface-management
- bbot
- cybersecurity
Repository Index
47,133 repositories indexed
49–72 of 76 · Most stars
Custom apps for the BMW MGU / iDrive 7 head unit (shift lights, virtual dyno, brake and drag timers, G-meter, fault scanner) plus an SDK kit to build and install your own.
- automotive
- bmw
- car-hacking
- head-unit
Discover internet-wide misconfigurations while drinking coffee
- cybersecurity
- scanner
- golang
- osint
A tool for bug hunting or pentesting for targeting websites that have open .git repositories available in public
- hacking-tools
- bash
- git-dumper
- pentesting
Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.
🕸️ Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce. 🕸️
Protect your SIP Servers from bad actors at https://sentrypeer.org
- sip
- voip
- security-tools
- honeypot
Read-only, local-first cloud security scanner for AWS, Azure and GCP. Your scan data stays on your machine.
simple YARA-based IOC scanner
- yara
- ioc
- security
- incident-response
TranslatedA domain searcher named GoogleSSLdomainFinder - a subdomain lookup tool based on Google SSL certificate transparency
- domain-scanner
- subdomain
Let's be scanned. A low-interaction honeypot focused on network scanners and bots. It integrates very well with IVRE to build a self-hosted alternative to GreyNoise.
- networking
- udp
- ipv6
- ipv4
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
- exploit
- php
- php2shell
- php2shell-cve
Scan your computer for applications that are either susceptible to dylib hijacking or have been hijacked.
TranslatedCyclops is a browser with XSS detection capabilities
- security
- xss
- taint-tracking
- vulnerability
A simple script which implements different Cognito attacks such as Account Oracle or Priviledge Escalation
- audit
- cognito
- cybersecurity
- scanner
Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.
- crtsh
- cve
- cve-2026-109618
- cve-2026-109619
An ICAP Server with yara scanner for URL and content.
- python
- icap-server
- yara
- malware-analysis
Statically compiled, zero-dependency Git pre-commit secret scanner and credentials detector written in Go. An alternative to Gitleaks and git-secrets.
- aho-corasick
- cybersecurity
- devops
- git-hook
A simple many-rules to many-files YARA scanner for incident response or malware zoos.
- yara
- yara-scanner
- incident-response
- dfir
Prompt-injection firewall for LLM applications — 33 input detectors, 9 output scanners, federated ed25519-signed threat-intel feed. Apache 2.0, 1040 tests, F1 96.0% with 0% false positives. Docker, GitHub Action, LangChain/LlamaIndex/CrewAI integrations.
- agentic-ai
- ai-safety
- fastapi
- langchain
CalmAV wrapper for elixir
- clamav
- elixir
- antivirus
- malware-detection
🛡️ Static security scanner (SAST) for Ansible playbooks, roles, and collections. 1,000+ rules across 30+ categories detecting malicious code, RCE, hardcoded credentials, and supply-chain risk. Outputs SARIF, CycloneDX SBOM, and GitLab SAST. SLSA Build Level 3, Sigstore-signed.
- ansible
- ansible-playbook
- devsecops
- infrastructure-as-code
Crystal shard wrapping the rbsec/sslscan utility
Detect the Shai Hulud 2.0 npm supply chain attack (796+ packages). Scans for malicious files, hashes, and compromised ecosystems. Fast, accurate scanner.
- cdn
- cve
- polyfill
- polyfill-io