WARNING] > Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only.
Global
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet.
#1291 · +25 · 1d ·GitHub
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
#1326 · +24 · 1d ·GitHub
Your local copy of HackTricks will be available at after <5 minutes (it needs to build the book, be patient).
#1738 · +17 · 1d ·GitHub
0) — built to > run on any agent harness, not just Claude Code. This fork's focus: > harness portability, sandboxed (containerized) exploit validation, > and measured-impact PoCs. See > Why the changes · > What this fork changes · > The numbers.
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.
#1933 · +14 · 1d ·GitHub
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
The Zed Attack Proxy (ZAP) by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to.
dirsearch is being actively developed by @maurosoria and @shelld3v.
#3235 · +6 · 1d ·GitHub
Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage of engineers' security skills, etc.
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering.
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
#5337 · +2 · 1d ·GitHub
Most tools tell you what's wrong. CVE Lite CLI tells you what to run.
Security testing that runs inside the coding agent you already use. Source-available, not open source.