Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
Decepticon is an autonomous AI-powered red team agent platform for offensive security engagements. It orchestrates multiple LLM-based agents (recon, exploit, AD, cloud, etc.) via LangGraph to execute complex, realistic attack chains against targets, with strict Rules of Engagement (RoE) enforcement, sandboxed execution, and human-in-the-loop approval. The system provides a web dashboard (Next.js), CLI (Ink), and MCP server for control and monitoring, and includes a plugin system for extensibility. It also features comprehensive benchmark frameworks for evaluating agent performance on security challenges. The architecture is a multi-service Docker Compose deployment with Python backend services, a Go launcher, Neo4j knowledge graph, and high isolation between management and sandbox networks. This is primarily a software application (automated red team orchestrator) with strong data/research elements such as knowledge graph persistence, benchmarking pipelines, and telemetry collection. The codebase demonstrates high craftsmanship with protocol-based plugin contracts, a well-structured middleware stack, and thorough testing, though the polyglot nature and dual client maintenance add complexity.
This repository is a comprehensive knowledge base for web security, covering vulnerability exploitation, penetration testing, and code audit techniques. It is organized into three main directories: 'exp/' for exploit techniques, 'vul/' for vulnerability principles, and 'penetration/' for penetration testing procedures. The content is detailed, well-structured, and includes practical payloads, detection methods, and defense strategies. It also features an AI/Wiki index for efficient retrieval. While not a software application, it serves as an invaluable reference for security professionals, CTF players, and red teamers. The only executable component is a Python script for log tampering.
Shannon is an autonomous, white-box AI penetration testing platform that orchestrates multi-agent workflows via Temporal to analyze source code, identify attack vectors, and execute real exploits against running web applications. The system is structured as a pnpm monorepo with two primary applications: a CLI (`apps/cli`) that provides the user-facing interface for launching scans, and a worker (`apps/worker`) that runs the actual pentest pipeline inside Docker containers. The architecture follows a multi-agent pipeline pattern with 13 specialized agents (pre-recon, recon, 5 vulnerability analyzers, 5 exploiters, and a report generator) coordinated through Temporal workflows for reliability and resumability. The codebase demonstrates strong software engineering practices with a clear separation of concerns between Temporal orchestration (activities/workflows), pure domain logic (services), and infrastructure concerns. The worker implements a sophisticated DI container pattern, comprehensive audit logging with crash-safe append-only streams, and a custom error classification system that maps errors to Temporal retry behavior. The system supports multiple LLM providers (Anthropic direct, AWS Bedrock, Google Vertex AI, custom proxies) and implements defense-in-depth billing detection, git checkpointing for workspace rollback, and parallel agent execution with mutex-protected shared state. Key architectural strengths include the deterministic renderer pattern (MCP tool calls → markdown without LLM in the loop), the injectable provider interfaces for extensibility, and the sophisticated session management that enables resumable workspaces. The codebase uses TypeScript with strict compiler options, implements a Result type for explicit error handling, and maintains comprehensive type definitions. The CI/CD pipeline includes semantic releases, Docker image signing with cosign, and multi-platform builds. The system processes vulnerability queues through Zod-validated structured outputs and maintains forensic audit trails of all agent executions with timing, cost, and model metadata.
Metasploit Framework is the world's most widely used penetration testing platform, with over 39,000 stars and 14,000 forks. It is a modular Ruby application that provides a comprehensive suite of exploit, auxiliary, post-exploitation, payload, encoder, and nop modules. The core architecture separates low-level networking and protocol handling (Rex library) from higher-level module logic, and includes a Rails-based web service layer offering REST and JSON-RPC APIs for remote control and automation. Key entry points include the console CLI (msfconsole), payload generator (msfvenom), and RPC daemon (msfrpcd). Production data flows involve user interaction via console or API, module execution against targets over protocols like HTTP, SMB, Kerberos, and LDAP, establishment of sessions (shell, meterpreter, etc.), and storage of results (credentials, loot, events) in a PostgreSQL database via ActiveRecord. External dependencies include Ruby 3.3.8, PostgreSQL, and optional tools like nmap, John the Ripper, and mingw-w64 for cross-compilation. The framework is actively maintained with daily commits, extensive CI/CD (GitHub Actions for lint, unit tests, acceptance tests), and a well-structured codebase with over 15,000 files.
Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
sqlmap is an automated penetration testing tool that detects and exploits SQL injection vulnerabilities in web applications. Its core functionality includes database fingerprinting, data extraction (tables, columns, users, passwords), file system read/write, OS command execution, and out-of-band exfiltration via DNS or ICMP. The architecture is a modular monolith: a central controller orchestrates DBMS-specific plugins (30+ databases), injection technique engines (boolean blind, error-based, UNION, time-based, stacked queries, DNS, OData, SPARQL, JWT, NoSQL, etc.), and tamper scripts for WAF bypass. The tool exposes both a CLI (sqlmap.py) and a REST API (sqlmapapi.py). External dependencies are minimal—most third-party libraries are vendored (chardet, colorama, beautifulsoup, pydes, fcrypt). The codebase demonstrates deep knowledge of SQL dialects, HTTP protocol handling, and security research, with extensive offline test suites and deterministic test harnesses. Notable technical strengths include pure-Python protocol clients (TDS, Kerberos, gRPC-Web), disk-spilling data structures (BigArray), and a safe JSON serializer that replaces pickle. Drift risks include remnants of Python 2 compatibility shims, bundled crypto implementations, and static fingerprinting data that may lag behind new DBMS versions.
AngryOxide is a production-grade 802.11 WiFi security auditing tool written in Rust. It captures and analyzes wireless frames in real time via raw AF_PACKET sockets, performs deauthentication, disassociation, PMKID, rogue M2, and other attacks, and outputs handshake data in hashcat-compatible hc22000 format, PCAPNG files with GPS metadata, and KismetDB SQLite databases. The application features a full terminal user interface built on ratatui with custom widgets (AdvTable, TabbedBlock) for monitoring access points, stations, and handshakes, as well as a headless mode for scripting. It integrates GPSD for geotagging and geofencing, and includes a standalone pcap/pcapng parsing library with fuzz testing and benchmarks. The architecture is a single binary monolith with clear module separation, background worker threads for I/O, and a state-machine attack engine. It is actively maintained, well-documented, and demonstrates strong Rust engineering practices.
WPScan is a Ruby-based CLI security scanner for WordPress sites. It detects vulnerabilities in WordPress core, plugins, and themes, enumerates users and misconfigurations, and supports password brute-force attacks. The architecture follows a controller/finder pattern: controllers orchestrate scan phases (version detection, enumeration, password attack), and finders implement passive/aggressive detection strategies for specific items (plugins, themes, users, backups, etc.). HTTP client is a singleton wrapping Typhoeus with caching, throttling, and proxy support. Vulnerability data is retrieved from the WPScan API or local enterprise database dumps. The codebase is well-structured with clear separation of concerns, extensive test coverage, and support for multiple output formats (CLI, JSON, SARIF). It is actively maintained and regularly updated to keep pace with WordPress ecosystem changes.
Liffy is a comprehensive Local File Inclusion (LFI) exploitation tool designed for security testing and penetration testing. It provides a modular command-line interface that supports multiple LFI techniques including data://, expect://, input://, filter:// wrappers, log poisoning, null byte attacks, ZIP wrapper exploitation, and blind LFI detection. The tool features advanced capabilities such as WAF bypass techniques, encoding layers, multi-threading with rate limiting, custom headers, POST request support, and rich terminal output. Architecture follows a modular design with core techniques isolated in separate modules, coordinated by a main orchestrator (liffy.py) that handles argument parsing, configuration loading, and execution management.
The OWASP Web Security Testing Guide (WSTG) is a comprehensive, community-maintained documentation project defining standard test cases for web application security assessments. It is primarily a structured knowledge base written in Markdown, organized by testing categories including Information Gathering, Authentication, Injection, and API Testing. The repository also serves as the source for multiple derived artifacts: a Jekyll static website (wstg.owasp.org), downloadable PDF/EPUB ebooks via a Pandoc+Typst pipeline, and machine-readable test checklists in JSON, XLSX, and Markdown formats. The build infrastructure includes Python scripts for site generation and navigation, GitHub Actions for CI/CD (linting, link checking, deployment), and a versioned release process that supports multiple channels (latest, stable, past versions). Although the primary content is documentation, the repository functions as a publication platform with significant automation and is actively maintained by a community of contributors. It is not a software application in the traditional sense, but the build tooling and CI/CD pipelines qualify it as an application-focused project with strong data engineering characteristics in its checklist generation and structured content management.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository is a comprehensive, modular Android application security auditing framework designed for AI agents and security engineers. It automates the entire assessment lifecycle, from APK ingestion and static analysis to dynamic instrumentation, RASP (Runtime Application Self-Protection) detection and bypass, and professional reporting aligned with OWASP MASTG and MASVS v2 standards. The architecture is a well-organized toolkit of Python, Bash, and JavaScript (Frida) scripts, orchestrated by shell entry points and sharing a common library (`scripts/lib/`). Key capabilities include a 37+ script Frida arsenal for runtime manipulation, a Semgrep rule set for static vulnerability detection, a DRY bypass profile system for countering RASP solutions, and a weighted scoring engine for MASVS compliance. The codebase emphasizes modularity, schema-driven findings, and CI/CD integration. While the codebase demonstrates strong engineering practices and contains several genuinely reusable components (findings pipeline, Frida script templates, compliance scoring models), its heavy reliance on the rapidly evolving Android and Frida ecosystems introduces a medium level of technical drift. The presence of speculative content on unreleased Android versions and deprecated API references are noted risks. Overall, it is a high-quality, production-grade security toolkit that effectively bridges the gap between manual pentesting and automated security pipelines.
This repository is a comprehensive, curated collection of cybersecurity references, scripts, tools, code, labs, and training resources, primarily authored by Omar Santos. It serves as supplemental material for his books, video courses, and live training, covering a vast range of domains including offensive security, defensive security, application security, cloud/container security, hardware/embedded security, AI/ML security, and certification preparation (Cisco, CompTIA, ISC2, etc.). The repo is hybrid in nature: while it contains hundreds of runnable scripts and tools (e.g., network scanners, exploit examples, API security testers, AI-powered log analyzers), its dominant character is that of an educational knowledge base and reference library rather than a deployable application. The content is organized into clear domain directories, with extensive READMEs acting as curated indexes of tools, papers, talks, and labs. The AI security section is particularly well-developed, including course materials on agentic AI, prompt engineering, and the Foundry Security Spec. The repository is actively maintained, with recent commits and automated CI workflows, though the breadth of content introduces risks of link rot and technology churn in fast-moving areas like AI frameworks and certification blueprints.
WebGoat is a deliberately insecure web application designed for security training, providing hands-on lessons for the OWASP Top 10 vulnerabilities. In production, it operates as a Spring Boot monolith with a modular lesson architecture; each lesson is a self-contained endpoint that simulates a real-world vulnerability (SQL injection, XSS, CSRF, JWT misuse, etc.) and validates the user's attack payload. A companion application, WebWolf, acts as attacker infrastructure (file hosting, JWT encoding/decoding, request logging). The system includes user registration, progress tracking via JPA/Flyway with per-user database schemas, and a Thymeleaf/Backbone.js frontend with multilingual support. External dependencies include H2/HSQLDB, Spring Security, AsciiDoc rendering, and intentionally outdated libraries (e.g., jQuery 2.1.4) to demonstrate specific weaknesses. The architecture is well-structured but carries intentional technical debt for educational purposes. The most reusable components are the WebAuthn support utilities (CBOR, COSE, attestation parsing) and the command execution service, both of which demonstrate non-obvious engineering skill and can be extracted independently.
DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.
SILENTCHAIN AIâ„¢ Community Edition is a Burp Suite extension that performs AI-powered passive vulnerability scanning of HTTP traffic. It intercepts requests/responses through Burp's proxy, sends them to configurable AI providers (Burp AI, Ollama, OpenAI, Claude, Gemini, Azure), and generates OWASP Top 10 vulnerability findings. The extension features a modular architecture with a thread pool for background AI processing, Swing-based UI integrated into Burp Suite, and persistence for settings via Burp's preferences API. Key capabilities include bidirectional data sanitization to prevent leaking secrets to AI providers, robust JSON parsing for handling LLM output inconsistencies, layered HTTP filtering (scope, content-type, rate limiting, URL deduplication), and real-time UI updates showing findings, task status, and statistics.
CyberStrikeAI is a full-stack, AI-native cybersecurity operations platform designed for autonomous penetration testing and red teaming. It orchestrates multiple AI agents using the CloudWeGo Eino ADK framework to plan and execute complex security assessments. The platform manages its own C2 (Command & Control) infrastructure with encrypted beacons and listeners, integrates with over 100 security tools via the Model Context Protocol (MCP), and maintains a persistent knowledge base and project fact graph. It features a comprehensive governance layer including Role-Based Access Control (RBAC), Human-in-the-Loop (HITL) approval workflows, tool execution guards, and detailed audit logging. The architecture is a monolithic Go-like backend serving a web SPA, with plugins for Burp Suite and Chrome. It supports multi-agent orchestration modes (single, deep, plan-execute, supervisor), a graph-based workflow engine, and integrations with various chat platforms (WeChat, Discord, Telegram). The codebase demonstrates high craftsmanship in its execution governance, process isolation, atomic update mechanism, and database schema reconciliation. A significant technical concern is the use of a non-standard Go dialect (featuring `func`, `type`, and `map` literals) tied to the Eino framework. This creates a hard dependency on a specific toolchain and represents a major drift risk from the standard Go ecosystem, limiting portability and the ability to use standard tooling. Despite this, the project is actively maintained with extensive test coverage and a clear focus on production-grade security automation.
WES-NG (Windows Exploit Suggester - Next Generation) is a monolithic CLI tool written in Python. Its core function is to read the output of the Windows `systeminfo` command and compare the detected operating system version and installed patches against a bundled database of known vulnerabilities (CVEs). It outputs a prioritized list of likely exploitable vulnerabilities, including links to public exploits. The architecture centers on `wes.py`, which handles input parsing, OS fingerprinting, patch matching, and output formatting. The vulnerability database is shipped as `definitions.zip`, a compressed CSV file. The tool employs a recursive graph traversal algorithm (`mark_superseeded_hotfix`) to filter out patches that have been superseded by newer updates, significantly reducing false positives. Optional companion scripts (`missingkbs.vbs`, `missingkbs.ps1`) can enumerate missing patches directly on a Windows host. The repository also contains a complete data collection pipeline (`collector/*.ps1`) used by the maintainers to regenerate the vulnerability database from sources like the MSRC API, NVD, and Exploit-DB. A large corpus of validation data (`validation/*.txt`) ensures the OS fingerprinting logic works across a wide range of Windows versions and locales. While the core logic is robust and well-tested, the codebase shows signs of technical drift, including remnants of Python 2 compatibility and reliance on hardcoded URLs for data updates. Overall, it is a highly effective and practical security auditing tool that accurately fulfills its stated purpose.