Open source offensive-security projects
Every project in the registry tagged offensive-security, ranked by real GitHub adoption.
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabi
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
Applied offensive security with Rust - https://kerkour.com/black-hat-rust
A high performance offensive security tool for reconnaissance and vulnerability scanning
Automated NoSQL database enumeration and web application exploitation tool.
Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — su
Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.
Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, r
ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军
Related tags
Frequently asked questions
How many open source offensive-security projects are there?
This registry tracks 9 projects tagged offensive-security, with 105,253 GitHub stars between them. The most-adopted is shannon at 50,964 stars.
Are these offensive-security projects free to use?
Yes — 9 of the 9 carry an explicit open-source licence across 3 distinct licences, so there is no licence fee. Where a project also sells a hosted or enterprise version, the self-hosted path remains free.
Which offensive-security project should I choose?
The list above is ranked by GitHub stars, but stars measure attention rather than fit. Check three things on each card: the licence (permissive versus copyleft), the language it is written in, and the last-push date — a high-star project that has not been pushed in a year is a liability.
Are these offensive-security projects still maintained?
7 of the 9 were pushed in the last 90 days, and every card shows its exact last-push date so you can see the rest. Sort your shortlist by that date before committing to a migration.