Tools for testing, exploiting, and securing web applications and APIs.
carterperez-dev/cybersecurity-projectsBuilding 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified…
zhaoxuya520/reverse-skillAI-powered skill router pack for reverse engineering, penetration testing, and security research. Routes AI agents to correct methodologies and…
megafart1/cve-2026-2472-vertex-ai-sdk-google-cloudExpose and detail an unauthenticated stored XSS vulnerability in the Google Cloud Vertex AI Python SDK affecting versions 1.98.0 to 1.130.9.
hamzamalik3461/cve-2026-20841🛠 Demonstrate remote code execution in Windows Notepad via markdown links exploiting unsecured URL protocols.
saied25/fix-react2shell-next🔧 Fix vulnerable versions in Next.js and React RSC apps with one command to secure against CVE-2025-66478. Improve your app's safety effortlessly.
runanywhereai/on-device-browser-agentOn-device AI browser automation using WebLLM. No cloud, no API keys, fully private.
flythenimbus/brambleOffline-first password manager with direct device-to-device sync
s0md3v/wappalyzer-nextdetect technologies with wappalyzer alternative
keygraphhq/shannonShannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…
leebaird/discoverCustom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload…
spectolabs/hoverflyLightweight service virtualization/ API simulation / API mocking tool for developers and testers
stamparm/dsssDamn Small SQLi Scanner
seqra/opentaintFormal inter-procedural taint analysis engine for application security. Tracks untrusted data across function boundaries, persistence layers, and…
xalgord/xalgorixAutonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
datadog/security-labs-pocsProof of concept code for Datadog Security Labs referenced exploits.
usmannasir/cyberpanelCyber Panel - The hosting control panel for OpenLiteSpeed
nu11secur1ty/payload-lists
k3ystr0k3r/cve-2026-39987Proof-of-concept exploit for Marimo pre-authentication RCE. Uses the unauthenticated /terminal/ws WebSocket endpoint to spawn a PTY and establish a…
