Global

WARNING] > Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only.

Paperless-ngx is a document management system that transforms your physical documents into a searchable online archive so you can keep, well, less paper.

Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows.

Nmap is released under a custom license, which is based on (but not compatible with) GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products.

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32

Detect It Easy (DiE) is a powerful tool for file type identification, popular among malware analysts, cybersecurity experts, and reverse engineers worldwide.

Community curated list of templates for the nuclei engine to find security vulnerabilities.

dirsearch is being actively developed by @maurosoria and @shelld3v.

Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies.

BBOT consistently finds 20-50% more subdomains than other tools. The bigger the domain, the bigger the difference. To learn how this is possible, see How It Works.

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

The Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting engine (Python, Lua, Shell supported).

This is an Internet-scale port scanner. It can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine.

More elaborate documentation that goes through many features with a lot of examples is available in the ffuf wiki at

Gobuster is a high-performance directory/file, DNS and virtual host brute-forcing tool written in Go. It's designed to be fast, reliable, and easy to use for security professionals and penetration testers.

Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.

ZXing ("Zebra Crossing") barcode scanning library for Java, Android

Run as a Docker container from Docker Hub: docker pull hackllc/nikto:latest

WireTapper is a wireless OSINT tool that passively detects and maps Wi-Fi, Bluetooth, CCTV cameras, vehicles, headphones, TVs, IoT devices, and cell towers, turning nearby radio signals into clear situational intelligence 📡

Update RouterSploit Framework often. The project is under heavy development and new modules are shipped almost every day.

轻量截屏扫码工具 · Lightweight screen-capture QR scanner (Tauri 2, 1.3MB installer)

A Geiger counter for AI agents — one read-only command that inventories every agent, MCP server, plugin, and AI extension on a machine