security-tools

🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

Bandit is a tool designed to find common security issues in Python code.

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

Gather and update all available and newest CVEs with their PoC.

🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻

A static analysis security vulnerability scanner for Ruby on Rails applications

:arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

Infection Monkey - An open-source adversary emulation platform

Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data

Next generation web scanner

Linux privilege escalation auditing tool

A collection of awesome security hardening guides, tools and other resources

A Modern Orchestration Engine for Security

Static analysis for GitHub Actions

syzkaller is an unsupervised coverage-guided kernel fuzzer

Bjorn is a powerful network scanning and offensive security tool for the Raspberry Pi with a 2.13-inch e-Paper HAT. It discovers network targets, identifies open ports, exposed services, and potential vulnerabilities. Bjorn can perform brute force attacks, file stealing, host zombification, and supports custom attack scripts.

A curated list of various bug bounty tools

Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

Open-source tool to enforce privacy & security best-practices on Windows, macOS and Linux, because privacy is sexy

The Official USB Rubber Ducky Payload Repository

The Network Execution Tool

a secure dotenv–from the creator of `dotenv`

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Modlishka. Reverse Proxy.

Ladon大型内网渗透扫描器，PowerShell、Cobalt Strike插件、内存加载、无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。网络资产探测32种协议(ICMP\NBT\DNS\MAC\SMB\WMI\SSH\HTTP\HTTPS\Exchange\mssql\FTP\RDP)或方法快速获取目标网络存活主机IP、计算机名、工作组、共享资源、网卡地址、操作系统版本、网站、子域名、中间件、开放服务、路由器、交换机、数据库、打印机等，大量高危漏洞检测模块MS17010、Zimbra、Exchange

Open Source Cloud Native Application Protection Platform (CNAPP)

Cameradar hacks its way into RTSP videosurveillance cameras