Tools

aorozco-sys/cve-2026-90907

Python CLI that detects and exploits CVE-2026-90907, a Joomla! com_users authorization bypass enabling unauthenticated account creation;…

kostas-pa/lfitester

Python3 tool that detects and exploits Local File Inclusion vulnerabilities, with crawling, path traversal and filter bypass payloads, and automated…

naimkowshik/lbfh

About All in one tool for Information Gathering, Vulnerability Scanning and Crawling. A must have tool for all penetration testers

assetnote/node2shell-scanner

High fidelity detection mechanism for node2shell (CVE-2026-111497)

foxcornlab/thc-bloodmiami

AI chat-box pentesting tool in C: fires language (SQLi/NoSQL/XSS/SSTI) and prompt injection payloads at chat interfaces and flags the ones that bite

owasp/agentic-vulnerability-discovery-and-validation-harness

Agentic harness that automates vulnerability discovery and validation, orchestrating AI-driven analysis workflows to confirm exploitable findings.

opengrep/opengrep

🔎 Static code analysis engine to find security issues in code.

owasp/xpsd

Reachability triage for vulnerability scans. Feeds scanner findings to an LLM agent that reads your source and decides which CVEs are actually…

capture0x/aws-pentest

Automated AWS security assessment CLI with 30 modules covering IAM privilege escalation, S3 exposure, compute, network, logging and misconfiguration…

edtrackai/nextjs-supabase-stripe-security-checker

Local static security scanner for Next.js, Supabase and Stripe apps: 24 AST-based checks for leaked keys, missing RLS and grants, unsafe webhooks.…

g4bri-3l3/hostbadger

Windows host hardening auditor and remediation tool in PowerShell: CIS, DISA STIG, Essential Eight checks, reversible fixes, optional AI analysis

affolter-engineering/xssearch

Rust-based XSS scanner with context-aware payload selection, WAF detection and bypass, crawling, blind XSS callbacks, and static DOM sink analysis.

tegal1337/pocketpentester

Offline-first Android offensive security toolkit with 21 modules for recon, port scanning, subdomain enumeration, SQLi/XSS/JWT exploitation, payload…

mongodb/kingfisher

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

buybitart/cyclepatrol

Bash tool for on-foot Wi-Fi security checks in a loop, with evidence reports. (re-invented wifi WarDriving)

sleepingbag945/dddd

Batch asset collection and vulnerability scanning tool for red teams. Pulls targets from Hunter, Fofa, and Quake, performs fingerprinting, subdomain…

vulncheck-oss/cli

VulnCheck's official command line tool