Infosec Open Source Projects

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

Fast web fuzzer written in Go

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Web path scanner

Damn Vulnerable Web Application (DVWA)

Exploitation Framework for Embedded Devices

An HTTP toolkit for security research.

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

Gather and update all available and newest CVEs with their PoC.

🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻

Everything about Web Application Firewalls (WAFs) from Security Standpoint! 🔥

:arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

All about bug bounty (bypasses, payloads, and etc)

One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

Open Source Vulnerability Management Platform

A curated list of GPT agents for cybersecurity

A list of interesting payloads, tips and tricks for bug bounty hunters.

A collection of awesome security hardening guides, tools and other resources

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

A curated list of awesome infosec courses and training resources.

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

The Network Execution Tool

:computer:🛡️ A curated collection of awesome resources, tools, and other shiny things for cybersecurity blue teams.

Cameradar hacks its way into RTSP videosurveillance cameras

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

A python script that finds endpoints in JavaScript files

Applied offensive security with Rust - https://kerkour.com/black-hat-rust

All the deals for InfoSec related software/tools this Black Friday

A collected list of awesome security talks

A curated list of awesome social engineering resources.

Snoop — инструмент разведки на основе открытых данных (OSINT world)

A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.

A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.

Hide secrets with invisible characters in plain text securely using passwords 🧙🏻‍♂️⭐

巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。

EMBA - The firmware security analyzer

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

A collection of all the data i could extract from 1 billion leaked credentials from internet.

KeyDecoder app lets you use your smartphone or tablet to decode your mechanical keys in seconds.

Scan for misconfigured S3 buckets across S3-compatible APIs!

Awesome Node.js Security resources

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily

Pentest Report Generator

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

List of Awesome Asset Discovery Resources

🕵️ OSINT Tools for gathering information and actions forensics 🕵️

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.

Maintained collection of OSINT related resources. (All Free & Actionable)

The Swiss Army knife for automated Web Application Testing

A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.

This challenge is Inon Shkedy's 31 days API Security Tips.

Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?

DNS Takeover tool written in Go

Your Everyday Threat Intelligence

A fully configurable and extendable Bash obfuscation framework. This tool is intended to help both red team and blue team.

A proposed standard that allows websites to define security policies.