Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
- devops
- penetration-testing
- vulnerability
- vulnerability-scanners
Repository Index
59,621 visible repositories in the index
49–72 of 186 · Most stars
Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.
syzkaller is an unsupervised coverage-guided kernel fuzzer
Bjorn is a powerful network scanning and offensive security tool for the Raspberry Pi with a 2.13-inch e-Paper HAT. It discovers network targets, identifies open ports, exposed services, and potential vulnerabilities. Bjorn can perform brute force attacks, file stealing, host zombification, and supports custom attack scripts.
- automated-pentesting
- bruteforce
- cybersecurity
- e-paper
Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...
- attack
- auto
- golang
- hacker
SpringBoot 相关漏洞学习资料，利用方法和技巧合集，黑盒安全评估 check list
- springboot
- springboot-actuator-rce
- rce
- spring-boot-vulnerability
Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀
- kubernetes
- vulnerable-app
- security
- hacking
A curated list of fuzzing resources ( Books, courses - free and paid, videos, tools, tutorials and vulnerable applications to practice on ) for learning Fuzzing and initial phases of Exploit Development like root cause analysis.
- awesome-list
- awesome
- fuzzing
- fuzzing-framework
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
- static-analysis
- php
- type-inference
- security-analysis
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
A professional, high-fidelity de-anonymization and vulnerability diagnostic framework. Features a zero-coupling modular architecture for browser-based intelligence gathering, hardware fingerprinting, and security research.
- browser-security
- cybersecurity
- de-anonymization
- ethical-hacking
AI-powered bug bounty hunting toolkit that works with or without subscription.
- ai-security
- bug-bounty
- bugcrowd
- claude-ai
Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
- python
- penetration-testing
- penetration-testing-framework
- owasp
Snyk CLI scans and monitors your projects for security vulnerabilities.
- security
- monitor
- snyk
- vulnerabilities
Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet
Scalable fuzzing infrastructure.
A Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.
- ai-security
- anthropic
- application-security
- bug-bounty
Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀
Open Source Cloud Native Application Protection Platform (CNAPP)
- cloud-native
- vulnerability-management
- threat-analysis
- devsecops
TranslatedA knowledge base for vulnerability PoCs(Proof of Concept), with 1k+ vulnerabilities.
- poc
A phone number can reveal whether a device is active, in standby or offline (and more). This PoC demonstrates how delivery receipts + RTT timing leak sensitive device-activity patterns. (WhatsApp / Signal)
- phone-number
- signal
- tracking
Open-Source Unified Vulnerability Management, DevSecOps & ASPM
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way.