Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
WebHackersWeapons is a curated, YAML-driven knowledge base and static documentation generator for web hacking and bug bounty tools, rather than a runnable application. Its core truth layer is 530+ weapons/*.yaml files, each defining a tool's name, URL, description, category, type, platform, language, and tags. These files are transformed by Ruby ERB scripts into a generated README and categorized pages by language and vulnerability tag, with schema validation enforced by scripts/validate_weapons.rb and CI via GitHub Actions. The repository behaves as a structured dataset with a small ETL pipeline: YAML metadata -> validated catalog -> Markdown cross-reference pages.
SILENTCHAIN AIâ„¢ Community Edition is a Burp Suite extension that performs AI-powered passive vulnerability scanning of HTTP traffic. It intercepts requests/responses through Burp's proxy, sends them to configurable AI providers (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure), and generates OWASP Top 10 vulnerability findings. The extension features a modular architecture with a thread pool for background AI processing, Swing-based UI integrated into Burp Suite, and persistence for settings via Burp's preferences API. Key capabilities include bidirectional data sanitization to prevent leaking secrets to AI providers, robust JSON parsing for handling LLM output inconsistencies, layered HTTP filtering (scope, content-type, rate limiting, URL deduplication), and real-time UI updates showing findings, task status, and statistics.
Pentest-Swarm-AI is an open-source autonomous penetration testing tool built on a stigmergic swarm architecture. It coordinates multiple LLM-driven specialist agents (recon, classifier, exploit, report) via a shared blackboard with pheromone decay, enabling emergent attack paths without a central planner. The system integrates 30+ external security tools (nmap, nuclei, sqlmap, etc.), multiple LLM providers (Claude, OpenAI, Ollama, Gemini, LM Studio), and bug bounty platforms (HackerOne, Bugcrowd, Intigriti) for automated scope import and report submission. The architecture is a multi-agent system with a scheduler that dispatches agents based on blackboard predicates and pheromone levels. Key entry points include a CLI (Cobra commands: scan, init, playbook, submit, etc.), an API server (Fiber), a WebSocket hub for live streaming, a Next.js web dashboard, and an MCP server for IDE integration. Data flows: agents write findings to the blackboard with pheromone weights; the scheduler reads the blackboard and triggers agents whose predicates match; agents read findings, process them, and write new findings, creating a stigmergic feedback loop. External dependencies include PostgreSQL with pgvector for durable blackboard storage, LLM API endpoints, and the installed security tool binaries. The codebase demonstrates high craftsmanship with clean abstractions (tool adapter pattern, LLM provider interface, blackboard interface), extensive testing (unit, integration, e2e, benchmarks, LLM eval), and safety features (scope enforcement, provenance signing, rate limiting, false-positive caching). It is actively maintained with recent commits, CI/CD pipelines, and community engagement.
This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.
This repository is an AI skill/prompt library for coding assistants (Claude, Cursor, GitHub Copilot, etc.). It contains a comprehensive security-focused markdown guide (SKILL.md) that AI assistants reference when generating code to ensure secure coding practices. The skill covers 60+ security vulnerabilities including IDOR, XSS, CSRF, SSRF, SQL injection, JWT misconfigurations, and more. It's designed to be installed in AI assistant skill directories to provide real-time security guidance during code generation. The repository has minimal structure - just three files (LICENSE, README.md, SKILL.md) with no traditional software components like tests, CI/CD, or package management. This is appropriate for its purpose as a static documentation resource for AI assistants. The security guidance is comprehensive and well-organized, covering both prevention strategies and common bypass techniques attackers use. Note: The last commit date (2026-02-17) appears to be in the future, which is unusual. The repository has 0 open issues and 94 forks, suggesting active adoption despite the odd timestamp.
This repository is a curated collection of wordlists for bug bounty hunting and web application security testing. It aggregates URL paths, payloads, and vulnerability probes from multiple public sources (SecLists, OneListForAll, dirsearch, nuclei-templates, etc.) into a unified, organized dataset. The wordlists are categorized by technology (e.g., Apache, WordPress, Nginx) and severity (info, low, medium, high, critical), making them directly usable with tools like Nuclei, ffuf, and dirsearch. The repository includes two automation scripts: a shell script that fetches and deduplicates wordlists from external URLs, and a Go program that parses nuclei-templates YAML files to generate technology-specific wordlists. These scripts are run weekly via GitHub Actions to keep the dataset current. The repository is purely a data asset; it contains no application code, APIs, or services. Its primary value is as a ready-to-use, aggregated wordlist source for security researchers and penetration testers.
reNgine is a Django-based automated security reconnaissance and attack-surface management platform. It orchestrates 20+ external security tools (Subfinder, Amass, Naabu, Nuclei, FFUF, GoSpider, Dalfox, WAFW00f, EyeWitness, theHarvester, h8mail) via Celery task chains to perform subdomain discovery, port scanning, HTTP crawling, directory fuzzing, OSINT gathering, technology fingerprinting, WAF detection, and vulnerability scanning. Results are parsed from tool outputs (nmap XML, nuclei JSON, dalfox JSON, ffuf JSON), persisted in PostgreSQL, and exposed through a Django REST Framework API plus a jQuery/Bootstrap frontend with server-side DataTables, dashboards, and WeasyPrint PDF reports. The system supports multi-project tenancy, role-based access control (sys_admin, penetration_tester, auditor), scheduled scans via Celery Beat, and deep HackerOne bug-bounty integration for program import, bookmarking, and vulnerability report submission. It also integrates LLMs (OpenAI and local Ollama) for vulnerability description enrichment and attack-surface suggestions. Architecturally it is a monolithic Django application with four feature apps (dashboard, scanEngine, startScan, targetApp, recon_note) and a Docker deployment composed of web, celery, celery-beat, redis, postgres, nginx, and ollama services. The orchestration core, web/reNgine/tasks.py (~3000 lines), composes Celery groups/chords/chains, executes shell commands against external tools, parses their structured output, and persists scan results. The frontend is server-rendered Django templates with heavy inline JavaScript and a supplementary DRF API layer in web/api/views.py. Although it collects and aggregates large volumes of scan-derived data, this is fundamentally an operational security application, not a data-research project. The codebase is actively patched (recent CVE fixes for command injection and XSS) and feature-rich, but carries notable technical debt: an end-of-life Django 3.2 base, old vendored JS plugins (DataTables 1.10.16, Lightbox from 2018), hardcoded container filesystem paths, a monolithic task module mixing orchestration/parsing/persistence, and dead or commented code. The strongest reusable pieces are the RengineTask Celery base class (standardized task logging, caching, and notifications), the dual-provider LLM abstraction with OpenAI/Ollama backends, and a custom server-side datatable filtering language applying operators (=, >, <, !, &, |) across subdomain, endpoint, and vulnerability views. It is best characterized as effective, pragmatic, security-tool engineering rather than clean, academically elegant architecture.
The exifLooter is a command-line application written in Go that extracts EXIF metadata, particularly GPS coordinates, from image files. It relies on the external exiftool command-line utility to perform the actual metadata extraction and provides a user-friendly interface for analyzing single images, directories of images, or images downloaded from URLs via stdin. The tool also offers functionality to remove all metadata from images and to generate OpenStreetMap URLs from GPS coordinates found in images. The architecture is a standard CLI tool built using the Cobra library for command parsing and the fatih/color library for colored terminal output. The main entry point is in main.go, which delegates to the command defined in cmd/root.go. The core functionality involves invoking exiftool via os/exec, parsing its output to detect GPS-related tags, and presenting the results with color-coded warnings when geolocation data is detected. Additional features include downloading images from URLs (with validation of content type) for batch processing in a pipe mode. While the tool fulfills its intended purpose, the codebase exhibits some areas for improvement: the pipe mode's image validation step is inefficient (rescanning the entire directory for each download), the OpenStreetMap URL generation function incorrectly handles southern and western hemisphere coordinates, and there is a lack of automated tests. Despite these issues, the project is actively maintained with recent commits and uses dependency management via Go modules.
This repository is a curated cheat sheet for web application security testing, penetration testing, and bug bounty hunting. It aggregates a vast collection of tools, commands, URLs, and references organized by phases: discovering, enumerating, scanning, monitoring, attacking, manual exploitation, and AI-related security. The repo contains no application code; it is a markdown document only. It is a valuable reference for security professionals but lacks any executable software components or data pipelines. The information is comprehensive and well-structured, but the repository itself is not a functional system and does not demonstrate software architecture or engineering craftsmanship beyond content curation.
This repository is a curated 'awesome list' of security and hacking resources, aggregating links to other GitHub repositories, tools, and references. It functions as a meta-index rather than a software application or data pipeline. The codebase consists solely of a README.md table, a contributing guide, and a GitHub Actions workflow for thread locking. There is no executable code, no data transformations, and no analytical models. The primary content is a manually maintained list of links organized by topic (e.g., Android Security, Bug Bounty, OSINT). While useful as a navigation aid for security professionals, the repository has zero software craftsmanship or reusability beyond its nature as a link collection. The hybrid classification of 'data_research' reflects its role as a curated dataset of resource metadata, though it lacks any actual data processing or research methodology.