Tools

owasp/zsc

OWASP ZSC - Shellcode/Obfuscate Code Generator https://www.secologist.com/

pathakabhi24/llm-mcp-security-field-guide

The most comprehensive LLM + MCP security guide i.e. OWASP aligned, real CVEs, actionable checklists

hakaioffsec/cve-2026-16764

Python exploit for CVE-2026-16764, a privilege escalation in OWASP DefectDojo where an is_staff REST API bypass lets a low-privileged user gain…

dhotrey/awesome-cybersec

A collection of awesome platforms, blogs, documents, books, resources and cool stuff about security

owasp/basileak

Intentionally vulnerable LLM

dipakpanchal05/cve-2022-23808

Proof-of-concept exploit for CVE-2022-23808, a stored XSS vulnerability in phpMyAdmin 5.1.1 setup script, with payload and reproduction steps for…

knavesec/credmaster

Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

mrturvey/flareprox

Use Cloudflare to create HTTP pass-through proxies for unique IP rotation, similar to fireprox

horizon3ai/cve-2023-27532

Proof-of-concept exploit for CVE-2023-27532 in Veeam Backup and Replication that abuses an unsecured API endpoint to extract credentials from the…

hunt-benito/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-cowork

PoC exploit for CVE-2026-73678: unauthenticated RCE in MindsDB Cowork via attacker-supplied LLM key and unsandboxed scratchpad exec to run OS…

boku7/cve-2020-23839

Public PoC Disclosure for CVE-2020-23839 - GetSimple CMS v3.3.16 suffers from a Reflected XSS on the Admin Login Portal

owasp/redteamtoolkit

The WASM Based Security Toolkit for the Web First Paradigm

keyvaluesoftwaresystems/agent-opfor

Open-source adversary emulation for AI agents and MCP servers.

crucible-security/crucible

pytest for AI agents - Autonomous red-teaming, behavioral monitoring & security testing for LLM agents

kryptsec/oasis

Open-source AI security benchmarking CLI. Measure how AI models perform offensive security tasks with MITRE ATT&CK analysis and KSM scoring.

pie-script/llm-agent-testbed

An empirical security testbed evaluating prompt injection, confused-deputy vulnerabilities, and tool-calling defenses in LLM agents.

sonuoffsec/dvap

An OWASP-aligned intentionally vulnerable platform for learning and testing AI, LLM, RAG, MCP, and Agentic AI security.

fallen-angel-systems/fas-judgement-oss

Open-source prompt injection attack console. Test AI security by firing categorized attacks at any endpoint.