#1Static and dynamic code analysis, SAST, DAST, and code review tools.
Kitploit recommended
byt3bl33d3r/offensivedlrToolbox containing research notes & PoC code for weaponizing .NET's DLR
adshao/flounderAutonomous white-hat security auditor for AI-driven code review, bug bounty research, exploit construction, and execution-grounded verification.
sektioneins/pccAutomated PHP configuration auditor that scans php.ini for security misconfigurations, supports CLI and web modes, and outputs results in text, HTML,…
newrelic/rusty-hogMulti-source secret scanner detecting API keys, passwords, and PII across Git repos, S3 buckets, filesystems, Confluence, JIRA, Slack, and Google…
trailofbits/semgrep-rulesCollection of Semgrep rules for static code analysis, detecting security vulnerabilities, and enforcing secure coding practices across multiple…
doyensec/electronegativityElectronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications.
whgojp/javaseclabComprehensive Java vulnerability lab with vulnerable and fixed code, attack scenarios, source/sink audit notes, and secure coding guidance for…
ejfkdev/ddcAndroid DEX → Java decompiler in Rust, built for speed — full apps in seconds, queries in milliseconds. Progressive analysis, javac-verified output,…
trailofbits/trailmarkBuild and query a graph database representation of source code
martian56/redcellAI red-team platform. Autonomous LLM agents run a penetration test end to end inside a Kali container and write the report. LangGraph plan/act…
mcgill-dmas/kam1n0-communityScalable assembly analysis platform for indexing, clone search, and executable classification using static, dynamic, and machine-learning techniques…
mrphrazer/msynthCode deobfuscation framework to simplify Mixed Boolean-Arithmetic (MBA) expressions
rhboot/shim-reviewReviews of shim
thesp0nge/dawnscannerDawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
david-a-wheeler/flawfindera static analysis tool for finding vulnerabilities in C/C++ source code
opsxcq/exploit-cve-2016-10033PHPMailer < 5.2.18 Remote Code Execution exploit and vulnerable container
ajinabraham/njsscanSemantic-aware SAST scanner for Node.js applications that detects insecure code patterns using libsast pattern matching and semgrep syntax-aware…
mahaloz/dailaA decompiler-agnostic plugin for interacting with AI in your decompiler. GPT, Claude, and local models supported!
