Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
Decepticon is an autonomous AI-powered red team agent platform for offensive security engagements. It orchestrates multiple LLM-based agents (recon, exploit, AD, cloud, etc.) via LangGraph to execute complex, realistic attack chains against targets, with strict Rules of Engagement (RoE) enforcement, sandboxed execution, and human-in-the-loop approval. The system provides a web dashboard (Next.js), CLI (Ink), and MCP server for control and monitoring, and includes a plugin system for extensibility. It also features comprehensive benchmark frameworks for evaluating agent performance on security challenges. The architecture is a multi-service Docker Compose deployment with Python backend services, a Go launcher, Neo4j knowledge graph, and high isolation between management and sandbox networks. This is primarily a software application (automated red team orchestrator) with strong data/research elements such as knowledge graph persistence, benchmarking pipelines, and telemetry collection. The codebase demonstrates high craftsmanship with protocol-based plugin contracts, a well-structured middleware stack, and thorough testing, though the polyglot nature and dual client maintenance add complexity.
Maigret is a username-based OSINT reconnaissance tool that checks across thousands of websites for accounts associated with a given username, extracts profile information via the socid_extractor library, and generates multi-format reports (HTML, PDF, CSV, JSON, Markdown, XMind, Neo4j, etc.). It operates as a CLI tool, an embeddable Python library, a Flask web application with live scan streaming, and a Docker image. The architecture is a monolith with a clean separation between site database management (MaigretDatabase/MaigretSite models), asynchronous checking engine (AsyncioQueueGeneratorExecutor, checkers for aiohttp, curl_cffi, Cloudflare bypass), extraction enrichment, and report generation. External dependencies include aiohttp, socid_extractor, curl_cffi, aiodns, and potentially FlareSolverr and OpenAI-compatible APIs (optional). The tool supports proxy/Tor/I2P routing, self-validation of site configurations, and auto-update of its site database. It is actively maintained, with frequent releases and a large community, and is used by professionals in OSINT, academic research, cryptocurrency investigations, and privacy analysis.
Nebula is a local-first security assessment workbench designed for penetration testing and red teaming operations. It functions as a desktop application built with a Tauri shell (Rust) wrapping a React/TypeScript frontend and a Python FastAPI backend sidecar. The system manages security engagements, scope policies, evidence collection, and AI-assisted analysis, emphasizing operator control, auditability, and data privacy through local-first execution and content-addressed artifact storage. The architecture follows a sidecar pattern where the Python Core service handles database operations (SQLite with Alembic), containerized command execution (Kali Linux via Docker/Podman), and AI provider integration. The frontend manages the UI state and terminal sessions via WebSocket. Key data flows involve user actions triggering API calls that validate against scope policies before executing commands in isolated containers, with all outputs stored as immutable artifacts for evidence integrity. The codebase demonstrates strong engineering practices with extensive test coverage (Pytest, Vitest, Playwright), a robust diagnostic system with secret redaction, and a policy engine for deterministic scope enforcement. It supports multiple AI providers and includes features for knowledge indexing, mission orchestration, and report generation. The project is actively maintained with recent commits and zero security alerts, though it is currently in alpha release.
IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
nDPI is a production-grade open-source deep packet inspection (DPI) library written in C, developed primarily by ntop.org. It identifies hundreds of network protocols by inspecting packet payloads using static signatures, heuristics, state machines, and machine learning classifiers. The library extracts rich metadata (TLS fingerprints, DNS queries, HTTP headers, etc.), computes flow risks (malware, DGA, obfuscation, anomalies), and supports output serialization in JSON, CSV, or TLV formats. It is designed to be embedded into network monitoring applications such as ntopng, nProbe, and Wireshark (via a Lua extcap plugin), and also ships as a standalone CLI tool (ndpiReader) and Python bindings. The codebase is well-structured with a modular dissector pattern, extensive fuzzing infrastructure, and a comprehensive test suite. While the primary focus is on library reuse, it also contains research-grade components like DGA detection models (scikit-learn/TensorFlow) and time-series anomaly detection, giving it a hybrid character leaning heavily toward a software library.
x64dbg is an open-source binary debugger for Windows targeting malware analysis and reverse engineering. The architecture is a three-layer system: a GUI layer (Qt-based Windows application), a bridge layer (C API for communication), and a debugger core layer (TitanEngine/GleeBug/StaticEngine backends). The debugger supports x86 and x64 processes with comprehensive features including conditional breakpoints, memory analysis, symbol handling, and an extensive plugin SDK. The codebase demonstrates strong engineering in several areas. The analysis engine implements multiple analysis passes (linear, recursive, control flow, xrefs) with a clean pass-based architecture. The command system uses a flexible registration pattern with consistent error handling. The bridge layer provides a well-defined C API surface for plugins with careful attention to thread safety and marshaling between GUI and debugger threads. Recent development shows active work on Linux support (ElfBug debugger), cross-platform tools (hex viewer, minidump analyzer, remote table), and a comprehensive test framework with headless testing infrastructure. The test system uses convention-based test discovery with script-driven scenarios and plugin-based assertions. Technical debt includes some outdated documentation (docs reference Python 2.7 for CHM generation), mixed use of Qt versions (5.12+ required but some paths reference older configurations), and the inherent complexity of maintaining both Windows debugger and cross-platform analysis tools in one repository. The dependency on precompiled libraries (TitanEngine, Zydis, XEDParse) creates build complexity but is managed through CMake.
EmailAnalyzer is a command-line application for analyzing suspicious email files (.eml). It extracts headers, links, attachments, digests (hashes), and authentication results (SPF/DKIM/DMARC) from email messages. The tool provides investigation features that generate links to threat intelligence services (VirusTotal, AbuseIPDB, URLScan) for indicators of compromise found in emails. Output can be displayed in the terminal or saved as JSON or HTML reports. The architecture is modular with separate functions for each analysis component, all depending only on the Python standard library, making them highly reusable.
ImHex is a cross-platform hex editor and binary analysis tool designed for reverse engineers, programmers, and digital forensics. It provides a rich GUI built on Dear ImGui and GLFW, with a modular plugin architecture that allows extending functionality through dynamically loaded plugins. The core library (libimhex) implements a provider abstraction for various data sources (files, disks, process memory, GDB, SSH, UDP, etc.), an event-driven communication system, a content registry for registering views, tools, settings, and data inspectors, and a pattern language engine for declarative binary parsing. The application includes built-in plugins for hex editing, data inspection, disassembly (Capstone), diffing, YARA rule matching, hashing, decompression, visualizations (3D, plots, images), scripting (C and .NET), and a Model Context Protocol (MCP) server for AI-assisted analysis. It supports undo/redo, bookmarks, patches, projects, themes, layouts, achievements, tutorials, and a command palette. The codebase is well-structured with clear separation between core library, plugins, and platform-specific code, though some components are tightly coupled to ImGui internals and the custom pattern language.
HAITI (HAsh IdenTIfIer) is a Ruby library and CLI tool for identifying hash types from input strings. It matches against a comprehensive database of over 675 hash types (including modern algorithms like SHA3, Blake2, and VeraCrypt) using regex patterns. The library provides concise output with hashcat mode numbers, John the Ripper format names, and example hashes. Multiple CLI entry points exist: the main `haiti` command, `haiti-parsable` for script-friendly output, `haiti-fzf` for interactive selection, and `hashcat-haiti`/`john-haiti` for converting hashes into hashcat/JtR formats. The codebase is well-structured, with clean separation between the identification engine, data definitions, and CLI wrappers. It includes comprehensive documentation (man pages, YARD API docs, a docsify site) and is packaged for numerous Linux distributions and Homebrew. The identification logic is straightforward but effective: iterate over a JSON array of prototypes, apply each regex to the input, and return matching types. The data file (`prototypes.json`) is manually maintained and extended with each release.
DeepZero is an automated vulnerability research pipeline engine, primarily targeting Windows kernel driver (BYOVD) analysis. It provides a highly concurrent, resumable orchestration framework where pipelines are defined declaratively in YAML. The engine supports stages: ingest, map (parallel analysis), reduce (aggregation), and bulk_map, with built-in fault tolerance, atomic state persistence, and live progress dashboards. It integrates external tools like Ghidra (headless decompilation), Semgrep (static analysis), LIEF (PE parsing), and LLM backends (LiteLLM, Claude Code) for exploitability assessment. The repository includes a full reference pipeline (loldrivers) and multiple language documentation sites. While primarily an application framework, it has strong data research characteristics due to its focus on binary corpus analysis and heuristic/AI assessment.
Sniffnet is a cross-platform desktop GUI application for real-time network traffic monitoring and analysis, written in Rust using the Iced framework. It captures packets via pcap (live or from PCAP files) and also supports IPFIX flow collection over UDP. The application parses Ethernet, IP, TCP/UDP, ICMP, IGMP, ARP, and VLAN headers using a dedicated packet-parser library. It enriches captured traffic with geolocation (MaxMind GeoLite2 and IPinfo MMDB databases), ASN lookups, service identification (from a port-to-service map derived from nmap-services), and local process identification (via the listeners crate). The GUI provides multiple pages: an overview with live traffic charts and donut charts, an inspect page with a filterable and sortable connection table, a notifications page for alerts (thresholds, favorites, IP blacklists), and settings pages for themes, filters, and export. The application supports 25 languages, custom themes, and thumbnail mode for minimal monitoring. It is packaged for Linux (deb, rpm, AppImage), macOS (dmg), and Windows (msi), with CI/CD pipelines for cross-compilation and code signing.
OpenCTI is an open-source cyber threat intelligence platform that ingests, manages, and analyzes threat data using the STIX 2.0/2.1 standard. The system is a monorepo containing a Node.js/TypeScript GraphQL backend (opencti-graphql), a React/Relay frontend (opencti-front), a Python client library (client-python), and a Python worker service (opencti-worker). The backend uses Elasticsearch/OpenSearch as its primary data store, Redis for caching and pub/sub, RabbitMQ for connector queues, and PostgreSQL for migrations. The frontend provides full CRUD UIs, dashboards, workspaces, playbook automation, and workflow management. Key entry points include the GraphQL API (resolvers per entity type), the frontend React app with Relay data fetching, and the Python client for programmatic access. Data flows involve ingestion via CSV/JSON/TAXII/RSS feeds, manual creation, connector enrichment, and inference rules that automatically derive relationships. External dependencies include Elasticsearch, Redis, RabbitMQ, MinIO/S3 for file storage, and optional AI services. The platform supports enterprise features (playbooks, PIR, XTM Hub) gated by license checks.
Favicorn is a command-line OSINT tool that searches for websites by their favicon hashes. It accepts input via favicon URL, file, or domain, computes multiple cryptographic and perceptual hashes (MMH3, MD5, SHA256, etc.), and generates search URLs for 11 security/search platforms (Shodan, ZoomEye, Censys, etc.). Optionally, it fetches and displays preview results from Shodan, ZoomEye, and Netlas using API keys. The architecture features a modular design: the Favicon class handles hash computation and platform-specific URL generation, while specialized Fetcher classes (Shodan, ZoomEye, Netlas) encapsulate API interactions, caching, and response parsing. The CLI orchestrates workflow, parallel execution, and output formatting. Key dependencies include requests, mmh3, dnspython, and platform-specific SDKs.
JA4+ is a multi-protocol passive network fingerprinting suite that generates deterministic fingerprints for TLS, HTTP, SSH, TCP, DHCP, X.509, and latency characteristics. The repository provides four independent implementations: a Python reference library, a Rust CLI tool and library, a Wireshark post-dissector plugin, and a Zeek plugin (C++ BiF + Zeek scripts). All implementations share the same fingerprinting algorithm, test pcap files, and expected output snapshots, enabling cross-validation. The system processes raw packet captures (PCAP/PCAPNG) via tshark or direct packet parsing, extracts protocol handshake parameters (cipher suites, extensions, HTTP headers, SSH key exchange algorithms, TCP flags, DHCP options), normalizes them (GREASE removal, sorting, hashing), and outputs structured JA4+ fingerprints. External dependencies include tshark (for PCAP parsing in Python and Rust), Wireshark/Zeek APIs for plugins, and the ja4db.com database for fingerprint-to-software mapping. The architecture is a collection of standalone tools rather than a unified service, with each implementation optimized for its target environment (CLI, packet analyzer, network monitor). While primarily an application toolkit, the repository also includes research-oriented assets such as a fingerprint-to-software mapping CSV, technical documentation with diagrams, and a large corpus of real-world test traffic, making it a hybrid of production tooling and security research.
This repository is a comprehensive, curated collection of cybersecurity references, scripts, tools, code, labs, and training resources, primarily authored by Omar Santos. It serves as supplemental material for his books, video courses, and live training, covering a vast range of domains including offensive security, defensive security, application security, cloud/container security, hardware/embedded security, AI/ML security, and certification preparation (Cisco, CompTIA, ISC2, etc.). The repo is hybrid in nature: while it contains hundreds of runnable scripts and tools (e.g., network scanners, exploit examples, API security testers, AI-powered log analyzers), its dominant character is that of an educational knowledge base and reference library rather than a deployable application. The content is organized into clear domain directories, with extensive READMEs acting as curated indexes of tools, papers, talks, and labs. The AI security section is particularly well-developed, including course materials on agentic AI, prompt engineering, and the Foundry Security Spec. The repository is actively maintained, with recent commits and automated CI workflows, though the breadth of content introduces risks of link rot and technology churn in fast-moving areas like AI frameworks and certification blueprints.
openSquat is a CLI tool for detecting domain squatting threats including phishing, typosquatting, IDN homograph attacks, doppelgänger domains, and bitsquatting. It operates in three modes: Community (free NRD feed), Premium Feed (paid NRD feed with local Levenshtein detection), and Premium API (server-side lookalike API queries). The tool processes keywords against domain feeds using optimized Levenshtein distance with early exit, integrates with VirusTotal, Quad9 DNS, Certificate Transparency, and phishing databases, and outputs results in TXT, JSON, or CSV formats. Architecture features modular components for feed management, DNS validation, squatting detection, API client, and output handling, with parallel processing for performance.
GreedyBear is a threat intelligence platform that consumes honeypot logs from T-Pot clusters (Cowrie, Heralding, Tanner, etc.), extracts Indicators of Compromise (IOCs), enriches them with external threat feeds (ThreatFox, AbuseIPDB, FireHol, Spamhaus, MalwareBazaar), and applies machine learning scoring (Random Forest) to predict recurrence probability and expected interactions. The system exposes public and authenticated APIs in multiple formats (JSON, NDJSON, CSV, TXT, STIX 2.1) for threat researchers and supports event ingestion from external sensors. The backend is built with Django/DRF, PostgreSQL, and Elasticsearch, orchestrated via Django-Q cronjobs for scheduled extraction, enrichment, and cleanup. A React SPA frontend provides a customizable dashboard with attack maps, trending attackers, and feed browsing. The architecture uses repository, strategy, and factory patterns, with a clean separation between extraction pipelines, scoring, and API layers. While primarily an application, it has strong data engineering components—ETL pipelines, ML scoring, clustering (MinHash LSH for command sequences), and data enrichment—making it a hybrid that leans application.
Sherlock is a monolithic Python CLI for username enumeration across social networks. For a given username it fans out concurrent HTTP probes to roughly 400 external sites (defined declaratively in sherlock_project/resources/data.json), then classifies each response as Claimed / Available / Unknown / Illegal / WAF using three detection modes: HTTP status code, presence/absence of a site-specific error message in the response body, or redirect behavior (redirects disabled, 2xx/3xx means claimed). Requests run in parallel via a requests-futures session capped at 20 workers; an optional per-site regex short-circuits illegal usernames without sending a request, and hardcoded fingerprint strings detect Cloudflare / PerimeterX / AWS WAF blocks. The CLI accepts one or more usernames, supports {?} wildcard expansion into `_`, `-`, `.` variants, and reports results to the terminal via a QueryNotify observer, with optional .txt, .csv, and .xlsx export. The system is fully data-driven: no per-site code exists. Each manifest entry declares the probe URL, error detection method, error signatures, optional headers/request method/JSON payload, and NSFW flag; a JSON Schema (data.schema.json) enforces conditional consistency (e.g., errorMsg required when errorType includes 'message'). By default the manifest is fetched live from https://data.sherlockproject.xyz, with an ephemeral false-positive exclusion list pulled from a dedicated GitHub branch; --local, --json, and --site flags override this behavior. Entry points are the `sherlock` console script, `python -m sherlock_project`, a Docker image entrypoint, and an Apify Actor (.actor/) that wraps the Docker image and pushes JSON results into an Apify dataset. Engineering strengths include the declarative manifest/schema design, a genuinely useful test suite (schema validation, live-target probe tests, randomized false-positive fuzzing, a Unicode regression test for issue #2730), and CI that runs a tox matrix across Python 3.10-3.14t on three OSes, validates only manifest entries modified by a PR, comments the validation summary back on the PR, and updates the exclusions list daily. Weaknesses: nearly all orchestration and output-format logic lives in a ~1,200-line sherlock.py; notify.py uses a module-global result counter; sites.py has mutable default arguments and a dead username_unclaimed parameter; the --print-found flag is always True (store_true combined with default=True); stem is an unused declared dependency; and the request layer relies on requests-futures, an effectively unmaintained library. The project is actively maintained and extremely popular (93k+ stars), and its health depends on hundreds of external sites remaining stable, hence the extensive removed-sites documentation and dedicated false-positive/false-negative issue templates. Technical drift is moderate rather than severe: the Python ^3.9 floor is now EOL, requests-futures is unmaintained, the WAF fingerprint catalog has not been extended since late 2024, and the PyPI readme still documents removed --tor flags.
OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.