68 results for “Recon”

GetSubDomains is an open-source tool by yogsec that enumerates subdomains by querying crt.sh certificate transparency logs. It is aimed at the reconnaissance step of penetration tests and bug bounty work. The source is a short tweet pointing to a GitHub repository, so usage details and options are not given.

x.comrepoAdded 21 Oct 2026, published 19 Oct 2026🛡️ Security

REA (rea-agents on npm) registers an MCP server and matching workflow instructions with coding agents such as Claude Code, Codex, Cursor and Gemini CLI. It exposes tools for inspecting native binaries through Hopper, Ghidra or IDA (with optional objdump and Rizin), JavaScript/Electron apps and ASAR archives, .NET assemblies and websites. Results come back with evidence and limitations, so the agent can explain how a feature works and write and test its own implementation. Analysis runs locally, there is a CLI with the same workflows, and the showcases include C reconstructions verified against original x86 function bytes.

github.comrepoAdded 14 Oct 2026🧠 AI

REA (rea-agents) is an MIT-licensed toolkit that exposes native-binary, JavaScript/Electron, .NET assembly and website analysis to AI agents via MCP, and also as a local CLI. It drives Hopper, Ghidra, IDA, objdump or Rizin for disassembly and pseudocode, recovers modules and Electron IPC boundaries from ASAR/JS apps, and returns findings with evidence and limitations. Showcases include reconstructing a x86 audio helper into byte-matching C and tracing an Electron clipboard API through preload and IPC; the README also carries lawful-use and licensing guidance.

github.comrepoAdded 14 Oct 2026🛡️ Security

Infoooze is an open-source command-line OSINT reconnaissance toolkit (github.com/devxprite/infoooze) that consolidates common footprinting tasks into one CLI: username enumeration across platforms, email discovery, subdomain enumeration, port scanning, WHOIS/DNS lookups, IP/HTTP header analysis, EXIF metadata extraction, GitHub recon, and URL scanning/expansion. It automatically saves results, making it a lightweight all-in-one alternative to running several separate recon tools.

x.comrepoPublished and added 8 Oct 2026🛡️ Security

Active-Directory-Simulation-Attack- is a purple team lab for the lab.local domain (192.168.100.0/24). It walks through an attack chain: BloodHound/SharpHound recon, Kerberoasting, hash cracking with John the Ripper or Hashcat, and lateral movement with Impacket. It then applies hardening (gMSA, tiering, LLMNR/NetBIOS disabling) and adds Sysmon, Wazuh SIEM and custom Kerberoasting rules (Event ID 4769, RC4).

github.comrepoAdded 23 Oct 2026, published 4 Oct 2026🛡️ Security

GitHub release notes for Sigma r2026-07-01, the open-source detection-rule repository, adding 20 new rules (e.g. LSASS crash via Netlogon buffer overflow CVE-2026-41089, TanStack supply-chain attack indicators for Windows/Linux, RedTail cryptominer user-agent detection, AF_ALG kernel crypto API exploit indicator) and updating/fixing dozens of existing rules for ARM64 binary variants, file-sharing domain IOCs, and WMI-based reconnaissance/persistence detection. It's a routine but substantive update to a widely-used blue-team detection content pack.

github.comrepoAdded 3 Oct 2026🛡️ Security

replica-skill is an MIT-licensed set of eleven Claude skills that run an app-cloning pipeline: recon, architect, design, build, backend, test, diff, entrepreneur, brand, launch and deploy. Six standard-library Python tools handle image diffing, parity scoring, review ranking, contrast checks, rebrand sweeps and store-listing lint. It installs as a Claude Code plugin or by copying folders, and states clean-room and rebranding limits.

github.comrepoAdded 29 Oct 2026, published 3 Oct 2026🧠 AI

goonfi-v2-decompiled holds byte-identical reconstructed Rust source for the GoonFi V2 Solana program goonuddtQRrWqqn5nFyczVKaie28f3kDkHWkHtURSLE, as deployed at slot 448984043. The on-chain program was upgraded on 6 October 2026 to fix reported bugs. VERIFY.sh builds with Solana platform-tools v1.48 and compares the result to the deploy transaction's loader buffer writes. The page does not describe the bugs.

github.comrepoAdded 22 Oct 2026, published 2 Oct 2026🛡️ Security

security-harness is an open-source Claude Code plugin (also packaged for Gemini CLI, Codex and opencode) that orchestrates subagents — sh-recon, sh-hunter, sh-chainer, sh-verifier, sh-reporter — through a static-analysis pipeline covering 15 vulnerability classes (IDOR/BOLA, SQLi, XSS, SSRF, injection, auth, deserialization, path traversal, secrets, CSRF, XXE, open redirect, crypto, race conditions, file upload), producing README/JSON/SARIF/HTML/PDF reports with PoCs, CVSS and CWE/OWASP mappings. It also ships sh-pr-review, a per-PR merge-gate skill that posts inline findings and a commit status scoped only to code the PR itself introduced or aggravated, with caching, dedup via fingerprints, and a scheduled GitHub Action that keeps its per-class knowledge bases fresh by having one AI agent draft updates from allowlisted sources (OWASP, PortSwigger Research, CWE/CAPEC, HackerOne) while a separate adversarial reviewer agent fails-closed against prompt injection before auto-merge.

github.comrepoAdded 2 Oct 2026, published 29 Sep 2026🛡️ Security

Agentic-Bug-Hunter is an open-source CLI (bughunter) and Claude Code plugin that automates the bug bounty pipeline end-to-end: recon, vulnerability hunting across 26 web2 and 10 web3/smart-contract bug classes, a "7-Question Gate" validation step to kill weak findings, and submission-ready report generation for HackerOne, Bugcrowd, Intigriti, and Immunefi. It orchestrates existing scanners (subfinder, httpx, nuclei, katana, ffuf, dalfox) behind a multi-provider LLM layer (Ollama, Groq, DeepSeek, Claude, OpenAI) and cross-session "hunt memory," and also ships an MCP server for use from Cursor, Codex, or OpenCode.

github.comrepoAdded 21 Sep 2026🛡️ Security

Outrider Recon is an open-source, Claude-native multi-agent OSINT and external attack-surface recon platform for authorized engagements, covering web/API, identity/SSO, cloud, secrets, and people/breach intelligence. It deliberately stops short of exploitation: active enumeration is approval-gated and intrusive validation is a human hand-off, with deterministic Python controls enforcing scope, evidence integrity, workflow state, and finding promotion around Claude skills and optional MCP-based enrichment. Output is ranked, evidence-backed finding cards (confidence/severity/handoff recommendations) meant to feed proxy-assisted testing or pen-testing rather than raw scanner dumps.

github.comrepoAdded 22 Sep 2026, published 19 Sep 2026🛡️ Security

security-audit-skill is a Cloudflare open-source coding-agent skill that turns an AI coding agent into a structured vulnerability hunter, running six phases: reconnaissance into architecture.md/coverage-ledger.json, coverage-led hunting by isolated sub-agent "hunters," adversarial candidate validation, structured findings.json output validated against a report-schema.json, independent re-verification of claims, and target-neutral report generation (REPORT.md, FINDINGS-DETAIL.md, NEEDS-VALIDATION.md). It is installed via the Skills CLI (`npx skills add`), uses Node.js validators (validate-coverage-ledger.cjs, validate-findings.cjs), requires a sandboxed environment for safely executing target code/tests/fuzzers, and is the single-repo seed for Cloudflare's larger fleet-wide vulnerability discovery harness described in a companion blog post.

github.comrepoAdded 22 Sep 2026, published 15 Sep 2026🛡️ Security

MassPIIFinder v2 is a Python recon tool that automates crawling a target's in-scope JavaScript (multi-hop HTML crawl, dynamic imports, chunk manifests, sourcemaps, plus optional passive CT-log subdomain discovery) and mines it for API keys, tokens, credentials, internal endpoints, and PII using ~90 named patterns plus a high-entropy freeform heuristic. Findings are validated offline (Luhn checks, JWT decode, AWS key-shape) and via scope-checked, rate-limited reachability probes, then triaged by severity and exported as JSON/HTML/SARIF/Markdown/CSV. It enforces authorization with a required --confirm-authorized flag and a ScopeGuard that blocks any out-of-scope requests, and explicitly avoids testing leaked keys against third-party providers or exploiting findings.

github.comrepoAdded 22 Sep 2026, published 15 Sep 2026🛡️ Security

Blitz Strike is an open-source Model Context Protocol server (TypeScript/Bun) that packages a structured 3-tier pentesting methodology — BLITZ (attack-surface recon), EAGLE-EYE (source-to-sink reachability tracing), and STRIKE (live validation before reporting) — into callable tools any MCP client (Claude Code, Cursor, Gemini, etc.) can drive with a single run_engagement call. It ships 130 self-written security tools, 317 indexed tool manuals, 58 data-driven escalation chains with negative-control checks, a Web3/Solidity audit module with Foundry proofs, and a regression/benchmark suite (453 checks, reported 1.0 detection / 0 false-positive rate) to make every finding verified rather than pattern-matched.

github.comrepoAdded 2 Oct 2026, published 12 Sep 2026🛡️ Security

GhostJS is an open-source Burp Suite extension by TrinetLayer that passively scans JavaScript, HTML, and JSON responses flowing through Burp for hardcoded secrets (AWS/GCP/Azure keys, Stripe/PayPal/GitHub tokens, JWTs, private keys, etc.) and hidden API endpoints, surfacing findings in a dedicated tab with severity, confidence scoring, remediation guidance, and Markdown export. It also actively fetches referenced <script> bundles using the tester's live session cookies and applies a false-positive filter to suppress doc-sample and placeholder keys, making it a practical recon aid during authorized web app pentests and bug bounty work.

github.comrepoPublished and added 7 Sep 2026🛡️ Security

pashov/skills is a set of Claude Code "skills" built by Pashov Audit Group that turn an AI coding agent into a Solidity security auditor: an "x-ray" command for quick codebase reconnaissance, a "solidity auditor" mode that runs multiple different agent personas over a codebase (or specified files) looking for vulnerabilities, and a "fizz" command for additional automated checks. It packages smart-contract audit tradecraft into reusable AI agent skills rather than a standalone scanner, letting developers or auditors invoke deep, multi-pass Solidity review directly inside their coding assistant.

github.comrepoPublished and added 7 Sep 2026🛡️ Security

Numbat is a Go-based, single-binary endpoint agent from Perplexity AI that gives visibility into AI coding-agent activity (Claude Code, Codex, OpenClaw, and other CLI/IDE/gateway agents) by capturing events through local hooks, OTLP/HTTP logs, and on-disk session artifacts. It normalizes activity into one event model, evaluates it with a local CEL rule engine (including multi-step sequence rules like secret-read-then-egress), and can optionally block matched actions via synchronous pre-action hooks (deny/monitor decisions), with case bundles and SHA-256 manifests for forensic reconstruction. Example built-in rules detect cloud-metadata SSRF requests (169.254.169.254) and credential-exfiltration chains, mapped to MITRE ATT&CK technique tags.

github.comrepoPublished and added 5 Sep 2026🛡️ Security

BugScanner is an asyncio/httpx Python framework for recon and automated web vulnerability scanning, with a React and FastAPI dashboard. It covers subdomain enumeration (crt.sh, DNS brute force), TCP port scanning, fingerprinting, and modules for XSS, SQLi, CORS, SSRF, open redirect, JWT, IDOR and business logic, plus a Nuclei wrapper. A 5-rule false-positive filter with SPA detection, adaptive rate limiting, WAF detection and SARIF export are included.

github.comrepoAdded 20 Oct 2026, published 5 Sep 2026🛡️ Security

subScraper is a self-contained, single-file (main.py) Python orchestrator that chains subdomain enumeration tools (Amass, Subfinder, Assetfinder, Findomain, Sublist3r) into httpx probing, screenshot capture, ffuf fuzzing, nuclei, and nikto scans, all driven from a live web UI with resumable job state, worker concurrency controls, and Docker packaging. It ships 34 custom nuclei templates for CVEs lacking official coverage and exposes a scoped, API-key-authenticated "bug bounty agent API" for programmatic recon and attack-surface queries against a target's scope.

github.comrepoPublished and added 27 Aug 2026🛡️ Security

Rekono is an open-source pentesting automation platform that chains 19 hacking tools (Nmap, Nuclei, Metasploit, OWASP ZAP, Nikto, Gitleaks, SearchSploit, etc.) so that output from one tool feeds the next, automatically covering recon, service enumeration, vulnerability scanning, and exploit correlation. It deduplicates findings into a single attack-surface inventory per host/port, enriches CVEs with community context for prioritization, tracks fixed/reopened vulnerabilities, and supports team collaboration, scheduled scans, Telegram/email alerts, and report generation for engagements.

github.comrepoAdded 3 Sep 2026, published 27 Aug 2026🛡️ Security

Cybermes is an open-source bug bounty and pentest automation framework that pairs a native Go MCP server (cybermes-mcp) with an autonomous Hermes CLI agent, orchestrating recon tools (subfinder, httpx, katana, ffuf, Nuclei, sqlmap), 200+ offensive playbooks covering IDOR/BOLA, JWT, SSRF, XSS, SQLi and cloud misconfig, and a validation-gate workflow that writes non-destructive PoC scripts before compiling findings into Markdown/HTML/PDF reports. It exposes its tools over JSON-RPC 2.0 to AI coding assistants (Claude Desktop, Cursor, Windsurf, Cline, Gemini/Antigravity) so an external LLM can drive scoped, evidence-backed security assessments.

github.comrepoPublished and added 23 Aug 2026🛡️ Security

BurpAPISecuritySuite is a Jython-based Burp Suite extension that consolidates API reconnaissance, intelligent fuzzing (108+ payloads across 15 attack types including BOLA, IDOR, JWT exploitation, GraphQL abuse, SSTI, and WAF bypass), and passive deep-logic checks (counterfactual differentials, sequence invariants, token lineage, cross-interface parity drift) into a single tool covering the OWASP API Top 10. It auto-captures and normalizes API traffic, exports attack campaigns to Burp Intruder/Turbo Intruder/Nuclei, and generates AI-ready bundles (ChatGPT/Claude/Ollama) for LLM-assisted triage, while orchestrating external tools like ApiHunter, Katana, httpx, FFUF, Kiterunner, sqlmap, and Dalfox for verification.

github.comrepoPublished and added 21 Aug 2026🛡️ Security

SKANF is a static and symbolic analysis tool that finds asset-management vulnerabilities in closed-source or obfuscated EVM smart contracts by fetching deployed bytecode from a JSON-RPC endpoint and locating attacker-reachable sensitive external calls (e.g. ERC-20 transfer/transferFrom/approve on tokens like USDT or WBTC). Beyond detection, it includes an exploit-generation phase that symbolically synthesizes calldata satisfying a verified vulnerability's preconditions and replays it against a forked EVM to confirm real balance changes. It builds on custom forks of the greed symbolic execution engine and the Gigahorse decompiler, and accompanies the ACM CCS 2026 paper "Insecurity Through Obscurity: Veiled Vulnerabilities in Closed-Source Contracts."

github.comrepoPublished and added 21 Aug 2026🛡️ Security

HyperGrok Trading Desk is an open-source "Agent Skills" pack (MIT licensed) that turns a Grok Bot, Claude Code or Cursor instance into a coordinated seven-agent trading desk for Hyperliquid perpetuals, using seventeen portable SKILL.md skills covering bootstrap/setup, exchange API access, and desk operating procedures. Each trade moves through a fixed pipeline — idea, evidence, risk sign-off, explicit human approval by ticket id, a single execution agent that sends the order, reconciliation, and a separate review agent — with read-only "opening bell" and "desk doctor" scripts for zero-key market snapshots and release/connectivity checks. The design choices worth noting for agent builders are the one-writer/many-readers pattern, sizing risk off the stressed (slipped) cost of a stop rather than its trigger price, and keeping the approval gate (Grok Bot's Require Approval rule) outside the chat the agent itself can write to.

github.comrepoAdded 5 Oct 2026, published 16 Aug 2026🧠 AI

Cariddi is a Go-based CLI tool that crawls a list of domains/URLs to discover endpoints, secrets, API keys, tokens, and juicy file extensions. It supports proxying through Burp Suite, custom headers, secret/endpoint regex files, JSON/HTML/TXT output, and configurable crawl depth and concurrency, making it a common recon tool in bug bounty and pentest workflows.

github.comrepoAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

r0crawl_skills is a Chinese-language skill library for Codex-style AI coding agents, organized as a router plus 196 specialized modules covering web reverse engineering, Android unpacking, Frida instrumentation, native binary analysis, protocol reconstruction, malware triage, firmware analysis and CTF workflows. Rather than dumping advanced terminology at once, it starts novices with four framing questions (what to analyze, what action matters most, what materials exist, what outcome is wanted) and routes them to deeper workflows via lightweight Python scripts (init_case.py, module_router.py, hash_artifact.py) and ten sanitized example playbooks. It's installed by copying the directory into Codex's skills folder, making it a practical illustration of the "router + many domain modules" pattern for packaging large skill collections for coding agents.

github.comrepoAdded 30 Sep 2026, published 6 Aug 2026🧠 AI

r0crawl_skills is a beginner-friendly Chinese-language skill library of 196 specialized reverse-engineering modules for Codex-style AI coding agents, with a router that asks scoping questions and directs the agent to the right workflow (web RE, Android unpacking, Frida instrumentation, native binary analysis, protocol reconstruction, malware triage, firmware analysis, CTF). It ships lightweight scripts (case init, module router, artifact hashing) and ten sanitized example playbooks covering DEX dump verification, WebCrypto hooking, native loader tracing, PCAP reconstruction, and selective emulation, plus dedicated modules for CAPTCHA/WAF/anti-bot systems, mini-programs, hybrid apps (Flutter/React Native/Electron), and IDA/Ghidra/Rizin automation.

github.comrepoAdded 30 Sep 2026, published 6 Aug 2026🛡️ Security

DarkMoon is a self-hosted, GPLv3 AI penetration testing platform that orchestrates 50 specialist agents over an MCP-gated toolbox (Nuclei, BloodHound, sqlmap, Impacket, Naabu, httpx, ffuf, etc.) to autonomously run recon-to-exploitation across web, API, Active Directory, Kubernetes, multi-cloud, CI/CD, databases, IoT firmware, and AI/LLM inference endpoints. It uses a Privacy Gateway that tokenizes real IPs/hosts/credentials into placeholders so raw infrastructure data never reaches the (optionally local, e.g. Ollama/llama.cpp) LLM, and can generate sandbox-validated, exploit-retested pull requests for findings. It also ships a dedicated LLM agent that probes OpenAI-compatible/Ollama/vLLM/TGI inference endpoints for the OWASP LLM Top 10 (prompt injection, jailbreaks, system-prompt leakage) using garak-backed probes.

github.comrepoPublished and added 5 Aug 2026🛡️ Security

UseOSINT/Skills is a GitHub repo of 28 SKILL.md files that let Cursor, Claude, and other coding agents run open-source-intelligence investigations — 10 end-to-end workflows (e.g. find-anyone, x-ray-a-company, recon-a-domain-passively) built on 18 reusable technique skills (WHOIS, certificate transparency, reverse image search, breach lookups, chronolocation). Each skill ships with reference material (query cookbooks, indicator guides, registry catalogues) and an install script that symlinks the whole set into ~/.cursor/skills, illustrating a chained, workflow-plus-technique pattern for structuring and routing large agent skill libraries. The repo also documents scope/authorization gating and passive-by-default behavior as part of the skill design.

github.comrepoAdded 30 Sep 2026, published 2 Aug 2026🧠 AI

OpenHack is an open-source, agentic vulnerability scanner CLI that runs a recon -> hunter -> validation -> verification pipeline over a codebase using open-source LLMs. It uses category- and feature-based hunter agents to find candidate vulnerabilities, validator agents to confirm them, and optional Docker-based sandbox plus headless-browser verification to actually exploit findings (e.g. XSS, SQLi, command exec) and confirm them with real HTTP/DOM execution, reporting CVSS-scored findings with fixes.

github.comrepoPublished and added 2 Aug 2026🛡️ Security

Desic Terminal is an open-source (MIT) Windows/macOS desktop app for OKX USDT perpetuals trading that bundles an AI trading assistant, AI-gated automated trading, and Python strategy backtesting on a shared real-time state and audit trail. Its notable AI-architecture contribution is a layered permission model where code, not prompts, decides what the agent can do: an AI Sidecar exposes only a scoped, often read-only tool set (e.g. radar.* tools reading a local SQLite market snapshot), delegated sub-agents are always read-only, risk-increasing actions fail closed on uncertain results, and executions use idempotent keys reconciled against exchange state before any retry. It also supports delegating requests to local Codex CLI or Claude Code instead of a hosted model API key, and ships a separate companion MCP server ("Desic OKX Agent") for giving coding agents direct OKX market/account/trading tool access.

github.comrepoAdded 8 Oct 2026, published 31 Jul 2026🧠 AI

FinalRecon is a Python-based OSINT/reconnaissance tool for web targets, gathering header info, whois data, SSL certificate details, crawling, DNS enumeration, subdomain discovery, port scanning, and directory search in a single utility. It's commonly used during the recon phase of web application pentests to consolidate multiple footprinting techniques into one CLI tool.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Flowsint is an open-source, self-hosted OSINT investigation platform that lets analysts visually explore relationships between entities (domains, IPs, ASNs, individuals, organizations, crypto wallets, emails, phones) via a graph interface backed by automated enrichers. It integrates recon modules like reverse/forward DNS resolution, WHOIS, subdomain discovery, ASN/CIDR mapping, breach-database checks, Maigret username search, and crypto wallet transaction/NFT lookups, storing all data locally for investigation privacy. The deployment docs also cover hardening steps for network exposure, including rotating AUTH_SECRET and MASTER_VAULT_KEY, binding backend services (PostgreSQL, Redis, Neo4j, API) to localhost, and a host-header allowlist to defend against DNS rebinding.

github.comrepoAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Clairvoyance is a Python tool that reconstructs a GraphQL API's schema even when introspection is disabled (e.g., Apollo Server in production mode) by brute-forcing field and type names against the API using wordlists. Output is JSON schema compatible with downstream tools like GraphQL Voyager, InQL, and graphql-path-enum, making it useful for API reconnaissance during bug bounty and pentest engagements.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

hackingtool is a console launcher that bundles 215 curated security tools across 21 categories (recon, OSINT, wireless, phishing, forensics, post-exploitation) so users can install and run them without hunting down individual Git repos. Its newer AI layer maps plain-English goals to the right tool and exact command, plans multi-step objectives with confirmation gates, and drafts engagement reports, while emphasizing safe installs (pinned/SHA-256-verified downloads, no curl|bash, list-form subprocess calls, signed releases with SBOM) and refusing out-of-scope asks like DoS or mass-targeting. It also ships a non-interactive orchestrator (`--engagement`/`--pipeline`) that normalizes tool output into findings.json for red team, blue team, OSINT, bug bounty, and DFIR workflows.

github.comrepoAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

OSINT Framework is a curated, categorized index of free (mostly) open-source intelligence tools and resources, organized by data type (username, domain, IP, email, social media, etc.) and rendered as an interactive tree at osintframework.com. Each entry in the underlying arf.json is tagged with metadata like whether it requires local install (T), a Google dork (D), registration (R), or manual URL editing (M), plus richer fields such as input/output type, pricing, and opsec notes. It's a long-standing community reference for recon and investigation tradecraft across infosec and other fields.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Sherlock is a command-line OSINT tool that checks over 400 social networks for the existence of a given username, outputting results to text, CSV, or XLSX files. It supports proxying, JSON-based site definitions, NSFW site inclusion, and browsing found accounts directly, making it a staple recon tool for investigators, red teamers, and social engineering research.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

An awesome-list repo that claims 753+ OSINT and security tools across 50 categories. Sections cover username, email, phone, domain/IP, geolocation, image, breach-search, dark web, web scanning and password-cracking tools, plus red team, blue team, DFIR, hardware and training sections. It ships multi-distro installer scripts (install.sh, osint.sh, redteam.sh, blueteam.sh, forensics.sh, hardware.sh, labs.sh, termux.sh) for Kali, Debian and Ubuntu, with partial Arch/Fedora support and a Termux subset. It also gives short usage walkthroughs such as a subfinder + amass + httpx recon chain. Some entries are dual-use (people search, face recognition, phone exploitation, IP camera dorking), and the README says the repo is for authorized research only.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

WebHackersWeapons is a GitHub-hosted, community-curated list of tools commonly used by web hackers and bug bounty hunters. As an 'awesome list' style repo it aggregates recon, scanning, exploitation, and other web-hacking utilities in one place for practitioners to discover and adopt.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Claude-OSINT is a library of 8 drop-in Claude Skills (SKILL.md files, ~10,000 lines) that turn Claude/Claude Code into a structured external-recon operator for authorized red-team and bug-bounty engagements. The core pair (osint-methodology, offensive-osint) covers a 6-stage recon pipeline, an 80-pattern secret scanner, 80+ dorks, and read-only credential validators, while six organization-grade skills add legal-entity-to-footprint mapping, SPF/email-spoofability analysis, FAIR-based dollar risk scoring, continuous exposure re-scan/diff monitoring, cloud/SaaS and dependency-confusion checks, and identity-provider tenant/user-enumeration with explicit hard scope boundaries (no password spraying, no active exploitation).

github.comrepoPublished and added 31 Jul 2026🛡️ Security

PentesterFlow is an open-source terminal AI agent for authorized offensive-security engagements, connecting to local or hosted LLMs (Ollama, LM Studio, Anthropic, Gemini, DeepSeek, Groq, OpenRouter, etc.) to plan and execute recon, enumeration, vulnerability validation, and evidence-backed reporting against a scoped target. It gates sensitive actions behind analyst approval, bridges with Burp Suite for traffic capture/finding import via a local listener and companion MCP server, and maintains persistent project/personal memory (redacting secrets) to carry lessons and coverage state across sessions. The demo walks through discovering and confirming an IDOR on an orders API and writing findings to a local markdown report.

github.comrepoPublished and added 29 Jul 2026🛡️ Security

Recon-Skills is a curated collection of SKILL.md playbooks for external web security assessments, organized into auth (SSO/OAuth/SAML/MFA), chains (multi-step attack-path analysis), infra, recon (subdomain/DNS/port/tech discovery, route/parameter/API mapping), and redteam (vulnerability-class and platform-specific validation) categories. Each skill documents prerequisites, procedure, pitfalls, and verification criteria, and the skills are designed to be followed manually or loaded as task context by an automation system for authorized penetration testing engagements. It includes a validator script (validate_skills.py) and style/contribution guides to maintain a consistent quality baseline across skills.

github.comrepoPublished and added 29 Jul 2026🛡️ Security

recons101x (shodan_reconsx) is a passive-by-default Python CLI that enumerates hostnames published to certificate transparency logs via ctl.shodan.io, requiring no Shodan API key. It supports optional active features — DNS resolution, TCP/HTTP reachability probing on ports 443/80, bounded live scans, and certificate metadata enrichment — with status states (DNS_ONLY, TCP_REACHABLE, HTTP_REACHABLE, STALE), JSON/TXT output, and safeguards like --max-time, --active-only, and explicit warnings to only scan authorized domains.

github.comrepoAdded 30 Sep 2026, published 29 Jul 2026🛡️ Security

Sn1per is an open-source Community Edition offensive-security platform that automates reconnaissance, vulnerability scanning, and exploitation by orchestrating 90+ third-party tools such as Nmap, Metasploit, Burp Suite, and Nessus into unified scan modes (normal, stealth, discover, airstrike, nuke). It ships with 600+ exploits and 10,000+ detections, supports Docker deployment, workspace-based loot management, and scheduled scans for external attack surface management. Paid Professional and Enterprise tiers add a web UI, reporting exports, and a JSON API on top of the same source-available CLI scanning engine.

github.comrepoPublished and added 26 Jul 2026🛡️ Security

Bug Bounty Lab101 is a workspace that structures the real HackerOne bug bounty workflow: document program scope, run scope-gated recon/vuln scanning via bugbounty-hunter.sh (backed by a 400+ tool arsenal spanning recon, DNS enumeration, web scanning, exploitation, and cloud/subdomain-takeover checks), then produce a triage-ready H1 report with Hacktivity dedup checks. It also integrates T3MP3ST, a separate multi-agent offensive framework that connects local AI coding agents (Claude Code, Codex) to automate target investigation, and ships a legacy-vm-practice lab (DVWA/Metasploitable-style) for safe skill-building outside real program scope.

github.comrepoPublished and added 25 Jul 2026🛡️ Security

Spectre is a free, open-source Android app (min API 31) for observing and interacting with the surrounding wireless environment, combining passive monitoring of Bluetooth LE, Wi-Fi, cellular (2G-5G), and GNSS with a growing set of pentesting tools. Notable features include a BLE GATT inspector that can read/write characteristics on connected devices, a local-network scanner (TCP-connect host discovery, SSDP/UPnP, mDNS/DNS-SD, banner grabbing, reverse DNS), iBeacon broadcast spoofing, and a computed aggregate RF-exposure figure derived by correctly summing per-emitter power in linear watts rather than dBm. It also documents Android platform limitations affecting wireless recon, such as invisible 5G NSA signal, Wi-Fi scan throttling, and single-carrier cell visibility.

github.comrepoPublished and added 23 Jul 2026🛡️ Security

gowitness is a Golang website screenshot utility that drives Chrome Headless to capture screenshots of web interfaces at scale from the command line, ingesting targets from URL lists, CIDRs, Nmap, or Nessus results. It can also capture request/console logs, headers, and cookies, writing results to SQLite, JSONL, or CSV, with a bundled web-based report viewer and API for triaging large recon datasets.

github.comrepoAdded 3 Sep 2026, published 23 Jul 2026🛡️ Security

A dual-track research lab reconstructing Fastjson RCE chains: a legacy JDK 8 direct-remote-class JSONType RCE for Fastjson 1.2.83, and a modern JDK 17 retained-JAR via proc-self-fd composition that works even with AutoType disabled and DTO binding in place, exploiting how ParserConfig.checkAutoType probes every type value via getResourceAsStream. It also reproduces an independent fastjson2 2.0.57/2.0.62 autoType bypass disclosed by Chaitin, where ObjectReaderSeeAlso hardcodes SupportAutoType, letting seeAlso/JsonSubTypes/sealed-type modeling trigger remote class loading even with autoType disabled. The repo ships dependency-free Python scanner tools for passive log detection, static artifact inventory, and safe active reachability probing via Burp Collaborator or interactsh.

github.comrepoAdded 2 Oct 2026, published 20 Jul 2026🛡️ Security

r0dump ports the FART active-invocation dumping technique into the Android 16 / ART runtime, hooking DEX registration, class loading and method dispatch directly inside ART to force packed apps to decrypt their code at runtime. It also captures DEX loaded via InMemoryDexClassLoader, reconstructs shifted ID tables back into standard DEX files, and recomputes Adler-32/SHA-1 checksums, with a companion "R0dump Manager" app (including an ADB-driven MCP bridge) for target selection, repair and ZIP export of dumped samples for inspection in JADX/dexdump. The reference build targets a OnePlus 9 running LineageOS 23.2 with test-keys, and the project ships git-format-patch sets for porting to other Android 16 devices.

github.comrepoAdded 2 Oct 2026, published 17 Jul 2026🛡️ Security

Strix is an open-source framework of autonomous AI pentesting agents that dynamically run target code, discover vulnerabilities across the OWASP Top 10 (SQLi, SSRF, XXE, IDOR, XSS, auth bypass, business-logic flaws) and validate them with working proof-of-concept exploits rather than static-analysis heuristics. It ships a CLI with a full offensive toolkit (Caido-based HTTP interception, browser exploitation, Python exploit sandbox, recon/OSINT, SAST/DAST), supports OpenAPI/Postman-driven black-box testing, integrates into GitHub Actions/CI pipelines to block vulnerable PRs, and can run against local or hosted LLMs via LiteLLM, with an optional cloud offering for autofix PRs and compliance reporting.

github.comrepoPublished and added 15 Jul 2026🛡️ Security

brain0 is an open-source (Apache-2.0) passive observer that builds a decision graph linking git commits to the AI-agent prompts/sessions that produced them, by reading git history alongside Claude Code and Codex transcripts on disk. It reconciles what agents claim they changed against what actually changed (drift detection), flags sessions that read secrets like .env files or private keys before pushing (DLP audit), and computes a two-dimensional risk score per artifact, exposed via a local GUI, CLI, and an MCP server for agent queries.

github.comrepoPublished and added 15 Jul 2026🛡️ Security

T3MP3ST is an open-source multi-agent offensive-security framework that turns an existing AI coding agent (Claude Code, Codex, Hermes, OpenCode, Oh My Pi, or a local Ollama/LM Studio/vLLM model) into an autonomous recon-to-exploit-to-report pipeline, with no separate API key required. It reports 90.1% pass@1 on XBOW's 104-challenge benchmark suite and claims 8/10 held-out post-cutoff CVEs identified down to file/line/CWE, with all headline numbers reproducible via a committed `npm run verify-claims` script. The 8-operator kill-chain design (Recon, Scanner, Exploiter, Infiltrator, Exfiltrator, Ghost, Coordinator, Analyst) maps to MITRE ATT&CK/Cyber Kill Chain phases, though only the Recon stage is described as fully live and the rest as scaffolded/experimental.

github.comrepoPublished and added 7 Jul 2026🛡️ Security

XORCISM is a self-hosted, open-source enterprise risk/exposure management platform (Node.js/TypeScript over SQLite/PostgreSQL/MySQL) that unifies asset inventory, vulnerability management, threat intel (STIX/TAXII), GRC (ISO 27001, NIST CSF/800-53, EBIOS Risk Manager, NIS2, DORA), incident management, and offensive/defensive testing into one continuously recomputed per-asset and enterprise risk score. It chains recon/exploitation tool connectors (nmap, nuclei, Metasploit, sqlmap) into attack-path/choke-point graphs weighted by fusion exploitability (EPSS+CVSS+KEV+public exploits), validates detection coverage via a purple-team loop against 3,750+ Sigma rules and MITRE ATT&CK/D3FEND, and quantifies ransomware impact in dollar terms via a FAIR-style model — with local-only Ollama AI assistants for triage, hunting, and reporting.

github.comrepoPublished and added 1 Jul 2026🛡️ Security

Pentest Swarm AI is an open-source (AGPL-3.0), self-hosted CLI tool that runs dozens of LLM agents concurrently against a target, coordinating through a shared "stigmergic" blackboard rather than a fixed recon→exploit→report pipeline, so findings propagate and wake relevant agents in real time. It supports any provider with tool-calling (Claude, OpenAI-compatible endpoints, Together AI-hosted Llama/Qwen/DeepSeek/GLM, or fully local Ollama/LM Studio), ships bundled vulnerable labs (crAPI, Juice Shop, VAmPI, DVGA) for safe testing, and positions itself against the closed SaaS bug-bounty bot XBOW. It currently automates verified attack playbooks (BOLA/IDOR, mass assignment, NoSQL injection) with evidence-backed reporting, with roadmap items for runtime object-reference mining, self-correcting attacks, and on-demand specialist sub-agents.

github.comrepoPublished and added 21 Jun 2026🛡️ Security

A reference implementation from Anthropic showing how to build a Claude-powered vulnerability discovery and remediation pipeline: interactive skills (/threat-model, /vuln-scan, /triage, /patch, /customize) for static scoping, scanning, triage and patch generation, plus an autonomous seven-stage recon-find-verify-dedupe-report-patch harness that builds targets with Docker/ASAN and runs each agent in a gVisor sandbox with restricted egress. It also ships a detection-and-response track (/dnr-hunt, /dnr-respond) for hunting an attacker already present in logs, scoping blast radius, and proposing a response, demoed against a planted attack campaign in synthetic logs.

github.comrepoAdded 3 Sep 2026, published 5 Jun 2026🛡️ Security

bb-huge is an open-source MCP server + agent skill ("/bb-huge") plus a Flask/SQLite portal that gives AI coding agents (Claude Code, Gemini CLI, Codex, etc.) persistent memory and a disciplined bug-bounty hunting methodology across web, mobile, binary, and source-code targets. It implements an observation → hypothesis → finding promotion pipeline with evidence provenance, ships 350+ curated community security skills, 35+ MCP tools for CRUD on findings/programs/recon/assets, and includes an install script for the ProjectDiscovery/tomnomnom recon toolkit (subfinder, httpx, nuclei, ffuf, etc.). It's aimed at bug bounty hunters wanting to solve the "context resets every session" problem when working with AI agents.

github.comrepoPublished and added 5 Jun 2026🛡️ Security

CyberStrike is an open-source (AGPL-3.0) terminal-based framework that turns any LLM subscription (Claude, GPT, Gemini, local models via Ollama/LM Studio, etc.) into an autonomous red-team agent, providing 13+ specialized agents, 7,600+ Ed25519-signed security skill files mapped to OWASP WSTG/CWE, a built-in Chromium proxy browser for role/credential discovery, and remote "Bolt" MCP tool servers for orchestrating tools like nmap, sqlmap, and Burp-style traffic interception. It targets pentesters and bug bounty hunters for automated reconnaissance, vulnerability discovery, exploitation, and post-exploitation, explicitly restricted to authorized testing.

github.comrepoPublished and added 23 May 2026🛡️ Security

Scanners-Box is a curated GitHub collection aggregating open-source security scanners self-developed by security practitioners, organized by category (web, host, port, weak-password, subdomain, SSRF, and more). It serves as a reference index for finding vulnerability scanners and reconnaissance tools built and shared by the security community.

github.comrepoPublished and added 23 May 2026🛡️ Security

CF-Hero is a Go-based recon tool that uncovers the real origin IP of Cloudflare-protected web applications by correlating current/historical DNS records (A, TXT/SPF), OSINT search engines (Shodan, Censys, ZoomEye), SecurityTrails historical DNS, and sub/related-domain host-header comparison. It validates candidate IPs by connecting directly over HTTP(S) and comparing HTML titles against the target, and supports custom JA3 fingerprints, proxies, and concurrent scanning to reduce false positives.

github.comrepoPublished and added 21 May 2026🛡️ Security

pentest-agents is an autonomous bug-bounty framework that wires Claude Code (and Codex, Gemini, Cursor, Windsurf, VS Code Copilot, OpenClaw) with 50 specialized agents, 26 slash commands, 19 CLI tools, 11 methodology skills, and two MCP servers — one for live bug-bounty platform integration (HackerOne, Bugcrowd, Intigriti, Immunefi, YesWeHack) and one for semantic writeup/payload search over a self-built FAISS index. It codifies a hunt workflow (recon → surface → hunt → validate via a 7-Question Gate → exploit-chain building → report → submit) with per-vuln-class hunter agents (XSS, SQLi, SSRF, SSTI, IDOR, XXE, RCE, CORS, subdomain takeover, etc.), a persistent "brain" for endpoint tracking, CVSS-version policy enforcement, and a scope-check hook that blocks out-of-scope Bash commands before execution.

github.comrepoPublished and added 18 May 2026🛡️ Security