Decepticon is an autonomous AI-powered red team agent platform for offensive security engagements. It orchestrates multiple LLM-based agents (recon, exploit, AD, cloud, etc.) via LangGraph to execute complex, realistic attack chains against targets, with strict Rules of Engagement (RoE) enforcement, sandboxed execution, and human-in-the-loop approval. The system provides a web dashboard (Next.js), CLI (Ink), and MCP server for control and monitoring, and includes a plugin system for extensibility. It also features comprehensive benchmark frameworks for evaluating agent performance on security challenges. The architecture is a multi-service Docker Compose deployment with Python backend services, a Go launcher, Neo4j knowledge graph, and high isolation between management and sandbox networks. This is primarily a software application (automated red team orchestrator) with strong data/research elements such as knowledge graph persistence, benchmarking pipelines, and telemetry collection. The codebase demonstrates high craftsmanship with protocol-based plugin contracts, a well-structured middleware stack, and thorough testing, though the polyglot nature and dual client maintenance add complexity.
Shannon is an autonomous, white-box AI penetration testing platform that orchestrates multi-agent workflows via Temporal to analyze source code, identify attack vectors, and execute real exploits against running web applications. The system is structured as a pnpm monorepo with two primary applications: a CLI (`apps/cli`) that provides the user-facing interface for launching scans, and a worker (`apps/worker`) that runs the actual pentest pipeline inside Docker containers. The architecture follows a multi-agent pipeline pattern with 13 specialized agents (pre-recon, recon, 5 vulnerability analyzers, 5 exploiters, and a report generator) coordinated through Temporal workflows for reliability and resumability. The codebase demonstrates strong software engineering practices with a clear separation of concerns between Temporal orchestration (activities/workflows), pure domain logic (services), and infrastructure concerns. The worker implements a sophisticated DI container pattern, comprehensive audit logging with crash-safe append-only streams, and a custom error classification system that maps errors to Temporal retry behavior. The system supports multiple LLM providers (Anthropic direct, AWS Bedrock, Google Vertex AI, custom proxies) and implements defense-in-depth billing detection, git checkpointing for workspace rollback, and parallel agent execution with mutex-protected shared state. Key architectural strengths include the deterministic renderer pattern (MCP tool calls → markdown without LLM in the loop), the injectable provider interfaces for extensibility, and the sophisticated session management that enables resumable workspaces. The codebase uses TypeScript with strict compiler options, implements a Result type for explicit error handling, and maintains comprehensive type definitions. The CI/CD pipeline includes semantic releases, Docker image signing with cosign, and multi-platform builds. The system processes vulnerability queues through Zod-validated structured outputs and maintains forensic audit trails of all agent executions with timing, cost, and model metadata.
Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
Maigret is a username-based OSINT reconnaissance tool that checks across thousands of websites for accounts associated with a given username, extracts profile information via the socid_extractor library, and generates multi-format reports (HTML, PDF, CSV, JSON, Markdown, XMind, Neo4j, etc.). It operates as a CLI tool, an embeddable Python library, a Flask web application with live scan streaming, and a Docker image. The architecture is a monolith with a clean separation between site database management (MaigretDatabase/MaigretSite models), asynchronous checking engine (AsyncioQueueGeneratorExecutor, checkers for aiohttp, curl_cffi, Cloudflare bypass), extraction enrichment, and report generation. External dependencies include aiohttp, socid_extractor, curl_cffi, aiodns, and potentially FlareSolverr and OpenAI-compatible APIs (optional). The tool supports proxy/Tor/I2P routing, self-validation of site configurations, and auto-update of its site database. It is actively maintained, with frequent releases and a large community, and is used by professionals in OSINT, academic research, cryptocurrency investigations, and privacy analysis.
Nebula is a local-first security assessment workbench designed for penetration testing and red teaming operations. It functions as a desktop application built with a Tauri shell (Rust) wrapping a React/TypeScript frontend and a Python FastAPI backend sidecar. The system manages security engagements, scope policies, evidence collection, and AI-assisted analysis, emphasizing operator control, auditability, and data privacy through local-first execution and content-addressed artifact storage. The architecture follows a sidecar pattern where the Python Core service handles database operations (SQLite with Alembic), containerized command execution (Kali Linux via Docker/Podman), and AI provider integration. The frontend manages the UI state and terminal sessions via WebSocket. Key data flows involve user actions triggering API calls that validate against scope policies before executing commands in isolated containers, with all outputs stored as immutable artifacts for evidence integrity. The codebase demonstrates strong engineering practices with extensive test coverage (Pytest, Vitest, Playwright), a robust diagnostic system with secret redaction, and a policy engine for deterministic scope enforcement. It supports multiple AI providers and includes features for knowledge indexing, mission orchestration, and report generation. The project is actively maintained with recent commits and zero security alerts, though it is currently in alpha release.
This repository provides an all-in-one CLI/TUI application for launching and managing security testing tools. It features a curated catalog of 215+ tools across 21 categories, defined declaratively in YAML files and loaded into Python tool classes. The interactive REPL supports commands like /run, /search, /tags, /ai, /goal, and /find, with a rich console interface using prompt_toolkit and Rich. A headless engagement mode runs YAML-defined pipelines (e.g., subfinder → httpx → nuclei) and generates structured findings and Markdown reports. AI features are opt-in and use OpenAI-compatible endpoints or local Ollama, with built-in safety guardrails (charter injection, sanitization, anti-fabrication checks) and graceful degradation to offline behavior. The architecture is monolithic but modular, with clear separation between the tool catalog, execution engine, AI integration, and discovery module. The codebase demonstrates strong engineering practices: safe subprocess execution (list-form, cwd, skip if present), declarative YAML overlays, a fixed tag taxonomy enforced by tests, and extensive test coverage including monkeypatching of subprocess and AI transport. While the catalog inherently drifts as upstream tools become archived, the project includes audit scripts to manage this. Overall, it is a well-crafted, production-quality application for authorized security testing.
sqlmap is an automated penetration testing tool that detects and exploits SQL injection vulnerabilities in web applications. Its core functionality includes database fingerprinting, data extraction (tables, columns, users, passwords), file system read/write, OS command execution, and out-of-band exfiltration via DNS or ICMP. The architecture is a modular monolith: a central controller orchestrates DBMS-specific plugins (30+ databases), injection technique engines (boolean blind, error-based, UNION, time-based, stacked queries, DNS, OData, SPARQL, JWT, NoSQL, etc.), and tamper scripts for WAF bypass. The tool exposes both a CLI (sqlmap.py) and a REST API (sqlmapapi.py). External dependencies are minimal—most third-party libraries are vendored (chardet, colorama, beautifulsoup, pydes, fcrypt). The codebase demonstrates deep knowledge of SQL dialects, HTTP protocol handling, and security research, with extensive offline test suites and deterministic test harnesses. Notable technical strengths include pure-Python protocol clients (TDS, Kerberos, gRPC-Web), disk-spilling data structures (BigArray), and a safe JSON serializer that replaces pickle. Drift risks include remnants of Python 2 compatibility shims, bundled crypto implementations, and static fingerprinting data that may lag behind new DBMS versions.
AngryOxide is a production-grade 802.11 WiFi security auditing tool written in Rust. It captures and analyzes wireless frames in real time via raw AF_PACKET sockets, performs deauthentication, disassociation, PMKID, rogue M2, and other attacks, and outputs handshake data in hashcat-compatible hc22000 format, PCAPNG files with GPS metadata, and KismetDB SQLite databases. The application features a full terminal user interface built on ratatui with custom widgets (AdvTable, TabbedBlock) for monitoring access points, stations, and handshakes, as well as a headless mode for scripting. It integrates GPSD for geotagging and geofencing, and includes a standalone pcap/pcapng parsing library with fuzz testing and benchmarks. The architecture is a single binary monolith with clear module separation, background worker threads for I/O, and a state-machine attack engine. It is actively maintained, well-documented, and demonstrates strong Rust engineering practices.
HAITI (HAsh IdenTIfIer) is a Ruby library and CLI tool for identifying hash types from input strings. It matches against a comprehensive database of over 675 hash types (including modern algorithms like SHA3, Blake2, and VeraCrypt) using regex patterns. The library provides concise output with hashcat mode numbers, John the Ripper format names, and example hashes. Multiple CLI entry points exist: the main `haiti` command, `haiti-parsable` for script-friendly output, `haiti-fzf` for interactive selection, and `hashcat-haiti`/`john-haiti` for converting hashes into hashcat/JtR formats. The codebase is well-structured, with clean separation between the identification engine, data definitions, and CLI wrappers. It includes comprehensive documentation (man pages, YARD API docs, a docsify site) and is packaged for numerous Linux distributions and Homebrew. The identification logic is straightforward but effective: iterate over a JSON array of prototypes, apply each regex to the input, and return matching types. The data file (`prototypes.json`) is manually maintained and extended with each release.
The OWASP Web Security Testing Guide (WSTG) is a comprehensive, community-maintained documentation project defining standard test cases for web application security assessments. It is primarily a structured knowledge base written in Markdown, organized by testing categories including Information Gathering, Authentication, Injection, and API Testing. The repository also serves as the source for multiple derived artifacts: a Jekyll static website (wstg.owasp.org), downloadable PDF/EPUB ebooks via a Pandoc+Typst pipeline, and machine-readable test checklists in JSON, XLSX, and Markdown formats. The build infrastructure includes Python scripts for site generation and navigation, GitHub Actions for CI/CD (linting, link checking, deployment), and a versioned release process that supports multiple channels (latest, stable, past versions). Although the primary content is documentation, the repository functions as a publication platform with significant automation and is actively maintained by a community of contributors. It is not a software application in the traditional sense, but the build tooling and CI/CD pipelines qualify it as an application-focused project with strong data engineering characteristics in its checklist generation and structured content management.
Linkook is a Python CLI tool for OSINT-driven discovery of linked social media accounts and associated emails across multiple platforms. It takes a single username as input, scans a configurable set of websites (defined in a provider.json file), and recursively extracts linked accounts, usernames, and emails from discovered profiles. The tool supports breach checking via HudsonRock's database or Have I Been Pwned, and can export results to a Neo4j-compatible JSON format for graph visualization. The architecture is modular: a Provider class handles URL templates and regex extraction, a SiteScanner performs HTTP requests and keyword-based existence checks, and a ScannerManager manages concurrent scanning via a thread pool with a queue. The code is well-structured, includes unit tests, and demonstrates solid engineering practices with clean separation of concerns, error handling, and logging.
Legba is a production-grade multi-protocol credential bruteforcer, password sprayer, and enumerator written in Rust. It operates as a CLI tool with a plugin-based architecture supporting 30+ protocols (HTTP, SSH, SMB, LDAP, Kerberos, SQL variants, NoSQL, message queues, SNMP, etc.). The core system uses an async runtime (Tokio) and a global plugin inventory managed via a `register_plugin!` macro and the `Plugin` trait. Credential sources are generated by a flexible expression parser that supports wordlists, globs, permutations, ranges, and combinations. Sessions can be saved and restored in JSON format, and output supports text, CSV, and JSONL. In addition to CLI, Legba exposes a REST API and an MCP (Model Context Protocol) server, enabling AI agents to drive credential testing programmatically. A YAML recipe system allows reusable attack configurations with variable substitution.
OpenDoor is an advanced CLI security reconnaissance platform for directory discovery, subdomain enumeration, WAF detection, and content fingerprinting. It employs a modular architecture with a plugin-based analysis pipeline (sniffers), network transport abstraction (direct, proxy, VPN), and extensive output formatting (JSON, CSV, SQLite, SARIF). Its core scanning engine, state machine, and plugin systems demonstrate sophisticated engineering, featuring auto-calibration, semantic soft-404 diffing, and a clean exception hierarchy.
Sherlock is a monolithic Python CLI for username enumeration across social networks. For a given username it fans out concurrent HTTP probes to roughly 400 external sites (defined declaratively in sherlock_project/resources/data.json), then classifies each response as Claimed / Available / Unknown / Illegal / WAF using three detection modes: HTTP status code, presence/absence of a site-specific error message in the response body, or redirect behavior (redirects disabled, 2xx/3xx means claimed). Requests run in parallel via a requests-futures session capped at 20 workers; an optional per-site regex short-circuits illegal usernames without sending a request, and hardcoded fingerprint strings detect Cloudflare / PerimeterX / AWS WAF blocks. The CLI accepts one or more usernames, supports {?} wildcard expansion into `_`, `-`, `.` variants, and reports results to the terminal via a QueryNotify observer, with optional .txt, .csv, and .xlsx export. The system is fully data-driven: no per-site code exists. Each manifest entry declares the probe URL, error detection method, error signatures, optional headers/request method/JSON payload, and NSFW flag; a JSON Schema (data.schema.json) enforces conditional consistency (e.g., errorMsg required when errorType includes 'message'). By default the manifest is fetched live from https://data.sherlockproject.xyz, with an ephemeral false-positive exclusion list pulled from a dedicated GitHub branch; --local, --json, and --site flags override this behavior. Entry points are the `sherlock` console script, `python -m sherlock_project`, a Docker image entrypoint, and an Apify Actor (.actor/) that wraps the Docker image and pushes JSON results into an Apify dataset. Engineering strengths include the declarative manifest/schema design, a genuinely useful test suite (schema validation, live-target probe tests, randomized false-positive fuzzing, a Unicode regression test for issue #2730), and CI that runs a tox matrix across Python 3.10-3.14t on three OSes, validates only manifest entries modified by a PR, comments the validation summary back on the PR, and updates the exclusions list daily. Weaknesses: nearly all orchestration and output-format logic lives in a ~1,200-line sherlock.py; notify.py uses a module-global result counter; sites.py has mutable default arguments and a dead username_unclaimed parameter; the --print-found flag is always True (store_true combined with default=True); stem is an unused declared dependency; and the request layer relies on requests-futures, an effectively unmaintained library. The project is actively maintained and extremely popular (93k+ stars), and its health depends on hundreds of external sites remaining stable, hence the extensive removed-sites documentation and dedicated false-positive/false-negative issue templates. Technical drift is moderate rather than severe: the Python ^3.9 floor is now EOL, requests-futures is unmaintained, the WAF fingerprint catalog has not been extended since late 2024, and the PyPI readme still documents removed --tor flags.
objection is a runtime mobile exploration toolkit powered by Frida, designed for security testing of iOS and Android applications without requiring jailbreak or root access. It provides an interactive REPL (objection explore) that lets security researchers bypass SSL pinning, dump keychain/keystore data, monitor cryptographic operations, inspect heap memory, hook methods, and bypass jailbreak/root detection — all by injecting a Frida agent into the target process. Architecture: The Python backend handles CLI commands, device state management, and patching (injecting Frida gadget into IPA/APK files). The TypeScript agent running inside the mobile app exports RPC methods for platform-specific features (Android: hooking, keystore, intents; iOS: keychain, crypto, biometrics). Communication happens over Frida's bi-directional transport. A Flask API server exposes RPC and script endpoints for remote control. The system uses a centralized state layer (connection, device, jobs) and a plugin system for extensibility. Key entry points: 'objection explore' (REPL), 'objection patchapk'/'objection patchipa' (binary patching), 'objection api' (API server), and the agent entry point in 'agent/src/index.ts'. External dependencies include frida, frida-tools, frida-fs, frida-screenshot, Flask, apktool, and GitHub API for gadget downloads. The codebase is well-structured for mobile security automation but shows some drift with deprecated CLI flags, Python 2 compatibility checks, and TODOs for advanced hooking targets.
Pentest-Swarm-AI is an open-source autonomous penetration testing tool built on a stigmergic swarm architecture. It coordinates multiple LLM-driven specialist agents (recon, classifier, exploit, report) via a shared blackboard with pheromone decay, enabling emergent attack paths without a central planner. The system integrates 30+ external security tools (nmap, nuclei, sqlmap, etc.), multiple LLM providers (Claude, OpenAI, Ollama, Gemini, LM Studio), and bug bounty platforms (HackerOne, Bugcrowd, Intigriti) for automated scope import and report submission. The architecture is a multi-agent system with a scheduler that dispatches agents based on blackboard predicates and pheromone levels. Key entry points include a CLI (Cobra commands: scan, init, playbook, submit, etc.), an API server (Fiber), a WebSocket hub for live streaming, a Next.js web dashboard, and an MCP server for IDE integration. Data flows: agents write findings to the blackboard with pheromone weights; the scheduler reads the blackboard and triggers agents whose predicates match; agents read findings, process them, and write new findings, creating a stigmergic feedback loop. External dependencies include PostgreSQL with pgvector for durable blackboard storage, LLM API endpoints, and the installed security tool binaries. The codebase demonstrates high craftsmanship with clean abstractions (tool adapter pattern, LLM provider interface, blackboard interface), extensive testing (unit, integration, e2e, benchmarks, LLM eval), and safety features (scope enforcement, provenance signing, rate limiting, false-positive caching). It is actively maintained with recent commits, CI/CD pipelines, and community engagement.
This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.
testssl.sh is a mature, command-line Bash tool for comprehensive TLS/SSL security auditing of network services. It tests cipher support, protocol versions (SSLv2 through TLS 1.3), cryptographic vulnerabilities (Heartbleed, CCS, ROBOT, BEAST, POODLE, LOGJAM, FREAK, and many others), certificate validation, HTTP security headers, and STARTTLS on a wide range of protocols. The tool works by performing socket-level TLS handshakes and comparing results against embedded data files. It also includes a client simulation feature that replays ClientHellos from over 100 real-world browsers and libraries to detect server behavior differences. The architecture is a single large Bash script (testssl.sh) with supporting data files under etc/ and utility scripts in utils/. It is driven by command-line options and environment variables, producing output in terminal color, JSON, CSV, HTML, and log formats. The project has active maintenance with a thorough test suite and CI pipelines, though some data sources (e.g., SSL Labs API) are deprecated, and the client simulation data requires manual updates.
reNgine is a Django-based automated security reconnaissance and attack-surface management platform. It orchestrates 20+ external security tools (Subfinder, Amass, Naabu, Nuclei, FFUF, GoSpider, Dalfox, WAFW00f, EyeWitness, theHarvester, h8mail) via Celery task chains to perform subdomain discovery, port scanning, HTTP crawling, directory fuzzing, OSINT gathering, technology fingerprinting, WAF detection, and vulnerability scanning. Results are parsed from tool outputs (nmap XML, nuclei JSON, dalfox JSON, ffuf JSON), persisted in PostgreSQL, and exposed through a Django REST Framework API plus a jQuery/Bootstrap frontend with server-side DataTables, dashboards, and WeasyPrint PDF reports. The system supports multi-project tenancy, role-based access control (sys_admin, penetration_tester, auditor), scheduled scans via Celery Beat, and deep HackerOne bug-bounty integration for program import, bookmarking, and vulnerability report submission. It also integrates LLMs (OpenAI and local Ollama) for vulnerability description enrichment and attack-surface suggestions. Architecturally it is a monolithic Django application with four feature apps (dashboard, scanEngine, startScan, targetApp, recon_note) and a Docker deployment composed of web, celery, celery-beat, redis, postgres, nginx, and ollama services. The orchestration core, web/reNgine/tasks.py (~3000 lines), composes Celery groups/chords/chains, executes shell commands against external tools, parses their structured output, and persists scan results. The frontend is server-rendered Django templates with heavy inline JavaScript and a supplementary DRF API layer in web/api/views.py. Although it collects and aggregates large volumes of scan-derived data, this is fundamentally an operational security application, not a data-research project. The codebase is actively patched (recent CVE fixes for command injection and XSS) and feature-rich, but carries notable technical debt: an end-of-life Django 3.2 base, old vendored JS plugins (DataTables 1.10.16, Lightbox from 2018), hardcoded container filesystem paths, a monolithic task module mixing orchestration/parsing/persistence, and dead or commented code. The strongest reusable pieces are the RengineTask Celery base class (standardized task logging, caching, and notifications), the dual-provider LLM abstraction with OpenAI/Ollama backends, and a custom server-side datatable filtering language applying operators (=, >, <, !, &, |) across subdomain, endpoint, and vulnerability views. It is best characterized as effective, pragmatic, security-tool engineering rather than clean, academically elegant architecture.
drozer is a comprehensive Android security testing framework that operates as a Python CLI application with a Twisted-based server and an on-device agent. Its primary function is to assess the security posture of Android applications and devices by enumerating components (activities, services, content providers, broadcast receivers), scanning for vulnerabilities (SQL injection, path traversal, world-writable files), and delivering exploitation payloads (reverse shells, privilege escalation). The architecture follows a client-server model: the drozer console connects to a remote server (port 31415) that communicates with an agent running on the Android device via a custom protocol defined by Protocol Buffers. The agent exposes a remote Java reflection API (pysolar) that allows the console to invoke arbitrary methods, instantiate objects, and interact with the Android runtime.