77,852 visible repositories in the index
1–11 of 11 · Most stars
TranslatedA comprehensive security assessment tool developed in-house by Chaitin (长亭), supporting scanning for common web security issues and custom PoCs | Be sure to read the documentation before use
Ladon大型内网渗透扫描器，PowerShell、Cobalt Strike插件、内存加载、无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。网络资产探测32种协议(ICMP\NBT\DNS\MAC\SMB\WMI\SSH\HTTP\HTTPS\Exchange\mssql\FTP\RDP)或方法快速获取目标网络存活主机IP、计算机名、工作组、共享资源、网卡地址、操作系统版本、网站、子域名、中间件、开放服务、路由器、交换机、数据库、打印机等，大量高危漏洞检测模块MS17010、Zimbra、Exchange
w3af: web application attack and audit framework, the open source web vulnerability scanner.
All in one tool for Information Gathering, Vulnerability Scanning and Crawling. A must have tool for all penetration testers
溯光 (TrackRay) 3 beta⚡渗透测试框架（资产扫描|指纹识别|暴力破解|网页爬虫|端口扫描|漏洞扫描|代码审计|AWVS|NMAP|Metasploit|SQLMap）
NucleiFuzzer is a robust automation tool that efficiently detects web application vulnerabilities, including XSS, SQLi, SSRF, and Open Redirects, leveraging advanced scanning and URL enumeration techniques
A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.
Security Auditor Utility for GraphQL APIs
Sectiv is a skill-driven AI security review for Burp Suite. Pick captured traffic and a review goal (IDOR, XSS, SQLi, SSRF…), and get a severity dashboard with description, steps to reproduce, impact, PoC, CWE/CVE and HTML/MD/JSON export. Built with Kotlin + Swing on the Montoya API.
A plugin based GraphQL vulnerability assessment tool.
Open-source PocketBase security auditor: detects empty rules, the @request.auth.id != trap, true literals. Active probe confirms leaks live.