#1Tools for identifying, assessing, and prioritizing security weaknesses in systems and applications.
Kitploit recommended
lanjelot/patatorPatator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
salesforce/cloudsplainingCloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.
tmylla/awesome-llm4cybersecurityCurated systematic literature review of 756+ papers on LLM applications in cybersecurity, covering threat intelligence, vulnerability detection,…
owasp/threat-dragonAn open source threat modeling tool from OWASP
botesjuan/burp-suite-certified-practitioner-exam-studyPractical study notes and walkthroughs for PortSwigger Academy labs, covering web vulnerabilities, payloads, enumeration, and BSCP exam strategies.
hfiref0x/kduWindows kernel driver utility that abuses vulnerable signed drivers (BYOVD) to bypass DSE, load unsigned drivers, hijack protected processes, and…
aquasecurity/trivy-operatorKubernetes-native security operator that automates vulnerability scanning, configuration auditing, secret detection, RBAC analysis, and compliance…
ly4k/certipyTool for Active Directory Certificate Services enumeration and abuse
epinna/tplmapServer-Side Template Injection and Code Injection Detection and Exploitation Tool
decalage2/oletoolsPython toolkit for analyzing MS OLE2 and Office documents, extracting VBA macros, detecting exploits, and performing forensic analysis of structured…
hslatman/awesome-industrial-control-system-securityA curated list of resources related to Industrial Control System (ICS) security.
protectai/vulnhuntrZero shot vulnerability discovery using LLMs
kadenzipfel/smart-contract-vulnerabilitiesA collection of smart contract vulnerabilities along with prevention methods
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
haccer/subjackConcurrent DNS takeover scanner detecting CNAME, NS, AXFR, SPF, MX, SRV, and stale A record vulnerabilities across cloud providers, with multi-level…
amlweems/xzbotnotes, honeypot, and exploit demo for the xz backdoor (CVE-2024-3094)
owasp/api-securityOWASP-maintained Top 10 API security risks document and documentation portal with best practices for building, breaking, and defending APIs.
