Tools

alufers/mitmproxy2swagger

Automagically reverse-engineer REST APIs via capturing traffic

cipher387/api-s-for-osint

List of API's for gathering information about phone numbers, addresses, domains etc

onecli/onecli

Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.

nilsteampassnet/teampass

Collaborative Passwords Manager

owasp/threat-dragon

An open source threat modeling tool from OWASP

ustayready/fireprox

AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation

sowarma/wp2shell-poc

CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept

harsh-bothra/learn365

This repository is about @harshbothra_'s 365 days of Learning Tweets & Mindmaps collection.

owasp-noir/noir

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

emadshanab/nuclei-templates-collection

Nuclei Templates Collection

harishsg993010/damn-vulnerable-mcp-server

Damn Vulnerable MCP Server

owasp/apts

OWASP Autonomous Penetration Testing Standard

p0pr0ck5/lua-resty-waf

High-performance WAF built on the OpenResty stack

roottusk/vapi

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

joysafety/joysafety

JoySafety

elastic/agent-skills

Official Elastic Skills

redsiege/graphstrike

Cobalt Strike HTTPS beaconing over Microsoft Graph API

xtraceai/xtrace-sdk

open source version xtrace sdk