[!WARNING]
For authorized security testing and education only. Every tool listed here must be used only against systems you own or have explicit written permission to test. Unauthorized access is illegal. See the Disclaimer.
📑 Table of Contents
🔴 Offensive Security (Red Team)
Reconnaissance — Subdomain / DNS / ASN
| Tool |
Description |
| subfinder |
Fast passive subdomain enumeration. |
| Amass |
In-depth attack-surface mapping and asset discovery (OWASP). |
| Sublist3r |
Subdomain enumeration using search engines. |
| OneForAll |
Powerful all-in-one subdomain collection tool. |
| findomain |
Cross-platform subdomain finder. |
| puredns |
Fast DNS resolver + subdomain bruteforce with wildcard filtering. |
| shuffledns |
massdns wrapper for bruteforce/resolve subdomains. |
| dnsx |
Fast, multi-purpose DNS toolkit. |
| zdns |
Fast CLI DNS lookup at scale. |
| altdns |
Subdomain permutation / alteration generator. |
| shosubgo |
Grab subdomains from the Shodan API. |
| knock |
Subdomain enumeration via wordlist. |
| Sudomy |
Subdomain enumeration & analysis framework. |
| scilla |
Information-gathering (DNS/subdomain/port/dir) tool. |
| hakrevdns |
Reverse DNS lookups from a list of IPs. |
| asnmap |
Map network ranges using ASN information. |
| DNSDumpster |
Online DNS recon & research service. |
| tlsx |
TLS grabber for gathering data from certificates. |
| HostHunter |
Discover hostnames from IP addresses. |
| subjack |
Subdomain takeover detection. |
| can-i-take-over-xyz |
Reference of services vulnerable to subdomain takeover. |
| bbot |
Recursive OSINT/recon "BEE-bot" scanner. |
| reconftw |
End-to-end automated recon framework. |
| reNgine |
Web recon engine with a UI and pipelines. |
| Chaos |
Public DNS/subdomain dataset by ProjectDiscovery. |
| cloudlist |
List assets/hostnames from cloud providers. |
| uncover |
Query Shodan/Censys/Fofa for exposed hosts. |
| csprecon |
Discover domains from Content-Security-Policy headers. |
| favirecon |
Fingerprint tech via favicon hashes. |
| CloudFox |
Cloud enumeration and attack-path discovery tool. |
Port Scanning & Network
| Tool |
Description |
| naabu |
Fast SYN/CONNECT port scanner. |
| masscan |
Internet-scale TCP port scanner. |
| RustScan |
Ultra-fast port scanner that pipes into Nmap. |
| Smap |
Nmap-compatible scanner powered by Shodan (no packets sent). |
| proxify |
Swiss-army-knife HTTP/HTTPS proxy for capture & tampering. |
| axiom |
Dynamic distributed-scanning infrastructure ("attack fleet"). |
| ax |
Maintained fork/evolution of Axiom for distributed scanning. |
| nmap |
Network Discovery, Scanning, and Security Auditing. |
| Netcat |
The classic TCP/IP "swiss-army knife" for reading/writing across connections. |
HTTP Probing / Crawling / Content Discovery
| Tool |
Description |
| httpx |
Fast, multi-purpose HTTP toolkit / prober. |
| httprobe |
Probe a list of hosts for working HTTP/HTTPS. |
| meg |
Fetch many paths from many hosts without hammering them. |
| gowitness |
Screenshot websites at scale. |
| crawlergo |
Headless-Chrome crawler that collects URLs & forms. |
| cariddi |
Crawl + extract endpoints/params/secrets from JS in one shot. |
| Photon |
Fast crawler with parameter & data extraction. |
| katana |
Next-gen crawler built for offensive security. |
| dirsearch |
Web path/content brute-forcer. |
| feroxbuster |
Fast recursive content discovery (Rust). |
| DirDar |
Directory brute-force & hidden-path discovery. |
| gau |
Fetch known URLs from Wayback/OTX/Common Crawl. |
| waymore |
More URLs from more archive sources than gau. |
| xurlfind3r |
Passive URL discovery from online archives. |
| uro |
De-duplicate and clean lists of near-duplicate URLs. |
| qsreplace |
Replace query-string values (great for payload injection). |
| VHostScan |
Virtual-host discovery scanner. |
| hakrawler |
Simple, fast web crawler for quick scoping. |
| gospider |
Fast web spider written in Go. |
JavaScript Analysis & Parameter Discovery
| Tool |
Description |
| LinkFinder |
Discover endpoints inside JavaScript files. |
| xnLinkFinder |
Extract endpoints/links from JS, files & burp exports. |
| getJS |
Extract all JavaScript file URLs from a page. |
| subjs |
Fetch JavaScript file references from a list of URLs. |
| jsluice |
Extract URLs, paths & secrets from JavaScript (BishopFox). |
| Arjun |
HTTP hidden-parameter discovery. |
| ParamSpider |
Mine parameters from web archives. |
| x8 |
Blazing-fast hidden parameter discovery (Rust). |
| apkleaks |
Scan APKs for URIs, endpoints & secrets. |
Fuzzing
| Tool |
Description |
| ffuf |
Fast web fuzzer (dir, param, vhost, more). |
| wfuzz |
Flexible web application fuzzer. |
| REcollapse |
Generate payloads to fuzz normalization/validation logic. |
Vulnerability Scanners (Web / App)
| Tool |
Description |
| nuclei |
Template-based, fast, community-driven vulnerability scanner. |
| nuclei-templates |
Official community templates for Nuclei. |
| nuclei-wordfence-cve |
Nuclei templates generated from Wordfence CVEs. |
| cent |
Aggregate community Nuclei templates. |
| jaeles |
Powerful, flexible web-app scanning framework. |
| nikto |
Classic web-server scanner. |
| wapiti |
Black-box web-app vulnerability scanner. |
| scan4all |
All-in-one scanning framework (recon + vuln). |
| V3n0M-Scanner |
Pentest scanner (Dorks/SQLi/XSS/LFI…). |
| VULNX |
CVE-focused vulnerability intelligence/scanner. |
| ZAP |
OWASP Zed Attack Proxy — full web-app scanner. |
| Nettacker |
Automated pentest & information-gathering framework (OWASP). |
| Artemis |
Modular scanner that assesses many hosts (CERT-PL). |
| Sn1per |
Automated recon & attack-surface scanner. |
| BugBountyScanner |
Recon/scan automation designed to run over multiple days. |
| webanalyze |
Technology detection (Wappalyzer-style) at scale. |
| WAD |
Web application detector (fingerprinting). |
| RedTeam-Tools |
Curated set of red-team tools & resources. |
| Aghast |
OWASP scanner for common web issues. |
| Caido |
A web security platform for auditing and testing web applications efficiently. |
| PlayWright |
A framework for automating and testing web applications across all major browsers. |
Injection — SQL / NoSQL / Command / SSTI / LFI
| Tool |
Description |
| sqlmap |
Automatic SQL-injection detection & exploitation. |
| ghauri |
Fast, smart SQL-injection tool. |
| DSSS |
Damn Small SQLi Scanner (<100 lines). |
| NoSQLMap |
Automated NoSQL / MongoDB injection. |
| commix |
Automated command-injection exploitation. |
| SSTImap |
Server-Side Template Injection detection & exploitation. |
| tplmap |
Classic SSTI / code-injection exploitation. |
| LFISuite |
Local File Inclusion scanner & exploiter. |
XSS
| Tool |
Description |
| dalfox |
Fast, powerful XSS scanner & param analyzer. |
| XSStrike |
Advanced XSS detection with payload generation. |
| xsser |
Automated framework to detect & exploit XSS. |
| xsssniper |
Automatic XSS discovery tool. |
| XssPy |
Python XSS scanner that walks subdomains & params. |
| toxssin |
XSS exploitation command-and-control server. |
| ezXSS |
Easy blind-XSS testing & payload management. |
| LOXS |
Multi-vuln scanner (LFI/OR/SQLi/XSS/CRLF). |
| DOMLogger++ |
Browser ext to monitor DOM sinks for XSS research. |
| postMessage-tracker |
Track postMessage usage for client-side bugs. |
| weaponised-XSS-payloads |
Collection of impactful XSS payloads. |
Prototype Pollution / Open Redirect / CRLF
| Tool |
Description |
| pphack |
Client-side prototype-pollution scanner. |
| ppmap |
Automated prototype-pollution scanner. |
| OpenRedireX |
Fuzzer for open-redirect vulnerabilities. |
| crlfuzz |
Fast CRLF-injection scanner. |
SSRF / Request Smuggling / Web Cache
GraphQL / API
| Tool |
Description |
| graphw00f |
GraphQL server fingerprinting. |
| GraphQLmap |
Interactive GraphQL pentest / exploitation. |
| graphql-cop |
Security auditor for GraphQL endpoints. |
| graphql-voyager |
Visualize a GraphQL API as an interactive graph. |
| Clairvoyance |
Recover GraphQL schema even with introspection off. |
| CrackQL |
GraphQL password/brute-force & fuzzing. |
| noir |
Attack-surface detector from source code (API endpoints). |
CMS / WordPress
| Tool |
Description |
| wpscan |
WordPress vulnerability scanner. |
| CMSmap |
Multi-CMS scanner (WP/Joomla/Drupal). |
Auth / JWT / Password Cracking
| Tool |
Description |
| jwt-hack |
JWT attack toolkit (crack, tamper, encode). |
| jwt-cracker |
Brute-force HS256 JWT secrets. |
| jwt_tool |
Analyze, tamper & attack JSON Web Tokens. |
| hashcat |
World's fastest GPU password cracker. |
| thc-hydra |
Fast network login brute-forcer. |
Deserialization / RMI / XXE
| Tool |
Description |
| ysoserial |
Generate Java deserialization payloads. |
| ysoserial.net |
.NET deserialization payload generator. |
| SerializationDumper |
Dump Java serialization streams in human-readable form. |
| BaRMIe |
Java RMI enumeration & attack tool. |
| xxeserv |
Mini web server for XXE OOB exfiltration. |
403 / 401 Bypass
| Tool |
Description |
| dontgo403 |
Bypass 40x access-control restrictions. |
C2 / Exploitation / Post-Exploitation
| Tool |
Description |
| NetExec |
Network/AD swiss-army knife (successor to CrackMapExec). |
| BeEF |
Browser Exploitation Framework. |
| pwncat |
Post-exploitation platform / reverse-shell handler. |
| CALDERA |
Automated adversary-emulation platform (MITRE). |
| evilginx2 |
MITM phishing framework for 2FA session hijacking. |
| reverse-shell-generator |
Generate reverse-shell one-liners quickly. |
| PowerSploit |
PowerShell post-exploitation modules. |
| Findsploit |
Instantly find exploits locally & online. |
| PoC-in-GitHub |
Auto-collected CVE proof-of-concepts from GitHub. |
Out-of-Band (OOB) Interaction
| Tool |
Description |
| interactsh |
OOB interaction-gathering server & client. |
| dnsobserver |
Helper DNS server to detect OOB/DNS interactions. |
Phishing
| Tool |
Description |
| SET |
Social-engineering attack simulation toolkit. |
🔵 Defensive Security (Blue Team / DevSecOps)
SAST / Code Analysis
| Tool |
Description |
| semgrep |
Fast, multi-language static analysis with custom rules. |
Dependency / Container / Supply-Chain Scanning
| Tool |
Description |
| trivy |
All-in-one scanner for containers, IaC, deps & secrets. |
| osv-scanner |
Match dependencies against the OSV vulnerability DB (Google). |
Secrets Detection
| Tool |
Description |
| trufflehog |
Find & verify leaked credentials in code/history. |
| gitleaks |
Detect hardcoded secrets in git repos. |
| S3Scanner |
Find open/misconfigured S3 buckets. |
Network Vulnerability Management
| Tool |
Description |
| openvas-scanner |
Full-featured network vulnerability scanner (Greenbone). |
TLS / SSL Testing
| Tool |
Description |
| testssl.sh |
Check a server's TLS/SSL config, ciphers & flaws. |
| DeepViolet |
TLS/SSL scanning API & tool (Java). |
Hardening / Sanitization
| Tool |
Description |
| DOMPurify |
XSS sanitizer for HTML/DOM (defensive). |
Adversary Emulation / Purple Team
| Tool |
Description |
| CALDERA |
Automated adversary-emulation to validate detections (MITRE). |
| PowerSploit |
Useful for building & testing blue-team detections. |
🤖 AI / LLM Security
The core reason this repo exists: security tooling powered by (and targeting) AI/LLMs. Split into offensive agents, LLM red teaming, defensive guardrails, local models and knowledge.
AI-Powered Offensive Agents
| Tool |
Description |
| strix |
Autonomous AI agents that pentest your apps. |
| PentestGPT |
LLM-driven reasoning layer that guides pentests. |
| CAI (Cybersecurity AI) |
Framework for building AI agents for offensive/defensive security. |
| hackingBuddyGPT |
Research framework for LLM-powered autonomous hacking. |
| Nebula |
AI-assisted pentest assistant that suggests & runs commands. |
| hermes-agent |
Function-calling agent scaffolding (Nous Research). |
| Colibri |
Lightweight AI security agent. |
| Page Index |
RAG system that analyzes documents without chunks or vector databases |
| Lite LLM |
A unified AI gateway for accessing and managing 100+ LLM providers through one API. |
| Anthropic-cybersecurity-skills |
Cybersecurity skills for Claude and other AI agents. |
LLM Red Teaming & Vulnerability Scanning
| Tool |
Description |
| garak |
LLM vulnerability scanner (prompt injection, jailbreaks, leakage) — NVIDIA. |
| PyRIT |
Python Risk Identification Toolkit for generative AI (Microsoft). |
| promptfoo |
Test, red-team & evaluate LLM apps (50+ vuln types). |
| deepteam |
LLM red-teaming framework mapped to OWASP LLM Top 10. |
| agentic_security |
Open-source LLM/agent vulnerability scanner. |
| agentic-radar |
Static analysis of agent workflows for excessive-agency risk. |
| Garak probes / MITRE ATLAS |
Adversarial-threat landscape for AI systems. |
| Claude-bughunter |
Red-Team skills for Claude and other AI agents to perform in Bug Bounty |
LLM Defense / Guardrails
| Tool |
Description |
| LLM Guard |
Security toolkit for LLM interactions (input/output filtering). |
| Rebuff |
Prompt-injection detector with multi-layer defense. |
| Vigil |
Detect prompt injections, jailbreaks & risky inputs. |
| Giskard |
Test & scan ML/LLM models for vulnerabilities & bias. |
Uncensored / Local Models
For offline/private research where cloud models refuse security tasks. Use responsibly and legally.
| Resource |
Description |
| heretic |
Automatic "decensoring" of transformer models. |
| Huihui-GLM abliterated |
Abliterated / uncensored GLM model weights (GGUF). |
AI Security Frameworks & Knowledge
🕵️ OSINT
| Tool |
Description |
| SpiderFoot |
Automated OSINT collection & attack-surface mapping. |
| recon-ng |
Full-featured web recon framework (Metasploit-style). |
| OSINT-Mapping-Tool |
Map & visualize OSINT relationships. |
| IntelOwl |
Threat-intelligence data at scale via one API. |
| pagodo |
Passive Google-dorking automation. |
| ditto |
Detect typosquatting / lookalike domains. |
| Maigret |
Collect a person's accounts across thousands of sites. |
| Osintgram |
OSINT toolkit for Instagram. |
| GhostTrack |
Track location / phone / username info. |
| TraceLabs OSINT VM |
Preconfigured OSINT investigation environment. |
| Metabigor |
OSINT without API keys (ASN, IP, org). |
| gitGraber |
Monitor GitHub for leaked secrets/tokens. |
| Maltego |
Link-analysis & graph OSINT platform. |
| Hunchly |
Web-capture tool for OSINT investigations. |
| IntelX |
Search engine & data archive for OSINT. |
| BrixHub |
Search engine for finding public information quickly. |
| seeKnow |
Powerful OSINT tool for searching breach data and online information. |
🧰 Utilities / Proxies / HTTP Clients
| Tool |
Description |
| mitmproxy |
Interactive HTTPS intercepting proxy. |
| hetty |
Open-source HTTP toolkit / Burp alternative. |
| CyberChef |
The "cyber swiss-army knife" for encoding/crypto/data (GCHQ). |
| curl |
The universal command-line HTTP client. |
| httpie |
Human-friendly CLI HTTP client. |
| hurl |
Run & test HTTP requests in plain text. |
| Atlas |
Quick SQLmap tamper-script suggester. |
| fzf |
Command-line fuzzy finder. |
| pet |
Simple command-line snippet manager. |
| pentest-tools |
Collection of handy pentest scripts (gwen001). |
| Hack-Tools |
All-in-one red-team browser extension. |
| Redcloud |
Deploy a full red-team attack infrastructure via UI. |
| grex |
Generate regexes from example inputs. |
📚 Wordlists & Payloads
| Resource |
Description |
| SecLists |
The go-to collection of wordlists for security testing. |
| Assetnote Wordlists |
High-quality wordlists built from internet-wide data. |
| PayloadsAllTheThings |
Payloads & bypasses for every web vuln class. |
| IntruderPayloads |
Burp Intruder payloads, fuzz lists & wordlists. |
| CeWL |
Generate custom wordlists by spidering a target. |
| COOK |
Powerful wordlist generator & permutation engine. |
| jsfuck |
Write JS using only 6 characters (filter bypass). |
| OCD Mindmaps |
Pentest / Active Directory attack mindmaps. |
📖 Frameworks, References & Learning
🤝 Contributing
Contributions are welcome! Please read CONTRIBUTING.md first.
In short: open a Pull Request that adds the tool to the correct category, keep the one-line description factual, make sure the link works, and keep entries alphabetical-ish within a section. New categories are fine when something genuinely doesn't fit.
⚠️ Disclaimer
This repository is provided for educational purposes and authorized security testing only. The tools listed are created and maintained by their respective authors. Using any of these tools against systems, networks, or applications without explicit prior authorization is illegal and may result in criminal and civil liability. The maintainers of this list assume no responsibility for misuse. Always act ethically and within the law.
📄 License
Distributed under the MIT License. The listed tools remain the property of their respective owners and are governed by their own licenses.
# ⚔️ Awesome Cyber & AI Arsenal
**A curated, battle‑tested collection of offensive, defensive and AI‑powered security tools.**
Everything is split into **🔴 Offensive (Red Team)**, **🔵 Defensive (Blue Team)** and **🤖 AI / LLM Security**, with sane sub‑categories so you can find the right tool in seconds.
