Open source penetration-testing projects

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

Automated Penetration Testing Agentic Framework Powered by Large Language Models

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

hydra

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data corr

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

Gather and update all available and newest CVEs with their PoC.

Next generation web scanner

A Modern Orchestration Engine for Security

All-in-One Hacking Tools For Hackers! And more hacking tools! For termux.

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

Cameradar hacks its way into RTSP videosurveillance cameras

A AI general-purpose state-space search engine, validated first on autonomous penetration testing.

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and w

A Security Tool for Bug Bounty, Pentest and Red Teaming.

Knock Subdomain Scan

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

EMBA - The firmware security analyzer

PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — su

Pentest Report Generator

ARTEX 한국어판 · AI 자율 침투 테스트 프레임워크(upstream: Autumn-27/ARTEX, AGPL-3.0)

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

linWinPwn is a bash script that streamlines the use of a number of Active Directory tools

Tool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access

802.11 Attack Tool

Directory Services Internals (DSInternals) PowerShell Module and Framework

The SpecterOps project management and reporting engine

OSINT Tool: Generate username lists for companies on LinkedIn

A Modular Penetration Testing Framework

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Bu

Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess

Automatic SSTI detection tool with interactive interface

GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the

Obtain GraphQL API schema even if the introspection is disabled

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hac

SSH-MITM - ssh audits made simple

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance throu

A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features com

Dradis Framework: Collaboration and reporting for IT Security teams

HydraSoft: dependency-free Windows DLL hijack scanner with centralized remote management — HydraAgent, PHP API, and a web console for endpoint security checks a

Pen Test Report Generation and Assessment Collaboration

🛡⚔️AI-Powered Penetration Testing Framework with automated vulnerability scanning, multi-agent system, and compliance reporting🛡⚔️