#1Tools for identifying, assessing, and prioritizing security weaknesses in systems and applications.
Kitploit recommended
1n3/sn1perAutomated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
rsactftool/rsactftoolRSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
nahamsec/resources-for-beginner-bug-bounty-huntersA list of resources for those interested in getting started in bug bounties
simplifaisoul/osirisOpen Source Global Intelligence Platform - Real-Time OSINT Dashboard - A Palantir Alternative - …
smicallef/spiderfootAutomates OSINT data collection and analysis for threat intelligence, attack surface mapping, and reconnaissance. Integrates 200+ modules for DNS,…
future-architect/vulsAgent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
owasp-modsecurity/modsecurityModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based…
cisofy/lynisAgentless security auditing tool for Linux, macOS, and UNIX systems. Performs in-depth scans for vulnerabilities, configuration issues, and…
vavkamil/awesome-bugbounty-toolsCurated directory of bug bounty tools organized by category: reconnaissance, subdomain enumeration, port scanning, content discovery, exploitation,…
open-policy-agent/opaDeclarative policy engine that enables authorization and policy enforcement across services, Kubernetes, Terraform, Docker, and APIs using the Rego…
infoslack/awesome-web-hackingCurated list of web application security resources including books, tools, cheat sheets, labs, and courses for learning penetration testing and…
anchore/grypeA vulnerability scanner for container images and filesystems
vercel-labs/deepsecAgent-powered vulnerability scanner for large-scale codebases. Uses LLMs to find hard-to-detect security issues via regex matchers and AI…
phpstan/phpstanPHP Static Analysis Tool - discover bugs in your code without running it!
ffuf/ffufFast web fuzzer written in Go
kingofbugbounty/kingofbugbountytipsOur main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are…
owasp/wstgThe Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
