Global

Hunt down social media accounts by username across social networks

"Another AI hacker? Let us guess — it runs nmap and writes a report."

IPcook provides reliable residential proxies for online research, username discovery, and public data collection workflows. 2/GB.

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

claude-red is a curated library of offensive security skills designed for the Claude skills system. md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32

Built and maintained by AwareXone · Website · X · GitHub

theHarvester gathers open-source intelligence about a domain or organization from search engines, certificate transparency logs, DNS datasets, code repositories, threat-intelligence platforms, and other public sources.

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

autonomous red teaming platform; multi-agent offensive-security meta-harness

These tools search for possible local privilege escalation paths that you could exploit and print them to you with nice colors so you can recognize the misconfigurations easily.

bettercap is a powerful, easily extensible and portable framework written in Go which aims to offer to security researchers, red teamers and reverse engineers an easy to use, all-in-one solution with all the features they might possibly need for performing reconnaissance and…

A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more

dirsearch is being actively developed by @maurosoria and @shelld3v.

GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

This repository contains prompts adapted from a private hunting workflow. It does not contain the original helpers, browser fleet, proxy or email services, dashboard, proof-of-concept runtime, credentials, private operating rules, or reference corpus.

Run as a Docker container from Docker Hub: docker pull hackllc/nikto:latest

Description ---- The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. ). This tool has been developed for the purpose of finding these passwords for the most commonly-used software.

This is a webshell open source project

8. In all cases, the function name is same as the script name.

BEAR-C2 is an adversary simulation and emulation framework built around real-world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups.

> A web canvas where you build infrastructure as a topology, then export a > complete, runnable working directory of Terraform and Ansible. You run it from > your own machine. redStackPRO never holds your cloud credentials.

Gitbook

Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code

Skills, agents and commands that give Claude the playbook for an internal Active Directory assessment: the phase order, the environment constraints that break your tooling, the telemetry each technique leaves behind, and how a finding maps to a compliance control.

Pre-auth RCE on Microsoft Exchange Server. No credentials needed.