Tools

qyvora/qyvora-anansi

Terminal-first attack surface intelligence engine. Built for speed, portability, and raw technical signal.

jankoboy88/higernes

a passive OSINT toolkit in python - usernames, emails, domains, ips, phones, hashes. no keys, no logins.

vqkro/higernes

a passive OSINT toolkit in python usernames, emails, domains, ips, phones, hashes. no keys, no logins.

ankhcorp/nuke.sh

Bash-based passive reconnaissance + attack surface mapping script using only public APIs + stock Linux tools (curl, dig, openssl, nmap, python3).

devcop95/bugbounty-lab101

A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated recon/vuln pipeline (400+ tools), report templates,…

0xshe/fuck-cdn

Automated CDN origin-IP discovery skill for Claude Code that runs 40+ prioritized OSINT methods, cross-validates candidates via SSL and HTTP…

karim852/kumo-domain-recon-tool

Domain OSINT and security reconnaissance framework running 26 parallel modules for DNS, ports, subdomains, leaked credentials, exposed endpoints,…

sakispat/simple-pentesting

An educational Python toolkit for authorized penetration testing: threaded port scanner, subdomain & directory enumeration, banner grabber and host…

r3fr4kt/devvortex

HackTheBox Devvortex walkthrough covering subdomain fuzzing, Joomla API enumeration, template-based web shell, bcrypt hash cracking, and Apport-CLI…

gmh5225/domain-enumeration-sicarius

Another tool for subdomain enumeration with some magics 🧙🏻‍♂️

yeee3642/edu-recon

Authorized education-sector recon & triage orchestrator (nmap/dirsearch/sqlmap/hydra + CVE-2024-4577, secret/API-key leak, XSS, wp2shell) with a web…

paulsec/api-dnsdumpster.com

Python client for dnsdumpster.com to retrieve DNS records, subdomains, and network maps for reconnaissance and security research.

sec-dan/wp2shell-scanner

Read-only CLI to check whether a WordPress site is exposed to WP2Shell (CVE-2026-63030 / CVE-2026-60137)

alephnullsk/dnsgen

Generates domain name permutations for subdomain enumeration and recon, supporting custom wordlists, cloud patterns, and fast mode for security…

dozermx/argus

Multi-phase reconnaissance and attack-surface scanner that maps domains, IPs, ASNs, cloud assets, and CVEs into a knowledge graph with CVSS scoring…

azmisyahrul/prismsec

Secure, modular MCP server wrapping nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap for AI-powered pentesting

cybertix-pvt-ltd/one-liner-collections

This Repositories contains list of One Liners with Descriptions and Installation requirements

daffainfo/oneliner-bugbounty

A collection oneliner scripts for bug bounty