Decepticon is an autonomous AI-powered red team agent platform for offensive security engagements. It orchestrates multiple LLM-based agents (recon, exploit, AD, cloud, etc.) via LangGraph to execute complex, realistic attack chains against targets, with strict Rules of Engagement (RoE) enforcement, sandboxed execution, and human-in-the-loop approval. The system provides a web dashboard (Next.js), CLI (Ink), and MCP server for control and monitoring, and includes a plugin system for extensibility. It also features comprehensive benchmark frameworks for evaluating agent performance on security challenges. The architecture is a multi-service Docker Compose deployment with Python backend services, a Go launcher, Neo4j knowledge graph, and high isolation between management and sandbox networks. This is primarily a software application (automated red team orchestrator) with strong data/research elements such as knowledge graph persistence, benchmarking pipelines, and telemetry collection. The codebase demonstrates high craftsmanship with protocol-based plugin contracts, a well-structured middleware stack, and thorough testing, though the polyglot nature and dual client maintenance add complexity.
HAITI (HAsh IdenTIfIer) is a Ruby library and CLI tool for identifying hash types from input strings. It matches against a comprehensive database of over 675 hash types (including modern algorithms like SHA3, Blake2, and VeraCrypt) using regex patterns. The library provides concise output with hashcat mode numbers, John the Ripper format names, and example hashes. Multiple CLI entry points exist: the main `haiti` command, `haiti-parsable` for script-friendly output, `haiti-fzf` for interactive selection, and `hashcat-haiti`/`john-haiti` for converting hashes into hashcat/JtR formats. The codebase is well-structured, with clean separation between the identification engine, data definitions, and CLI wrappers. It includes comprehensive documentation (man pages, YARD API docs, a docsify site) and is packaged for numerous Linux distributions and Homebrew. The identification logic is straightforward but effective: iterate over a JSON array of prototypes, apply each regex to the input, and return matching types. The data file (`prototypes.json`) is manually maintained and extended with each release.
Favicorn is a command-line OSINT tool that searches for websites by their favicon hashes. It accepts input via favicon URL, file, or domain, computes multiple cryptographic and perceptual hashes (MMH3, MD5, SHA256, etc.), and generates search URLs for 11 security/search platforms (Shodan, ZoomEye, Censys, etc.). Optionally, it fetches and displays preview results from Shodan, ZoomEye, and Netlas using API keys. The architecture features a modular design: the Favicon class handles hash computation and platform-specific URL generation, while specialized Fetcher classes (Shodan, ZoomEye, Netlas) encapsulate API interactions, caching, and response parsing. The CLI orchestrates workflow, parallel execution, and output formatting. Key dependencies include requests, mmh3, dnspython, and platform-specific SDKs.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
objection is a runtime mobile exploration toolkit powered by Frida, designed for security testing of iOS and Android applications without requiring jailbreak or root access. It provides an interactive REPL (objection explore) that lets security researchers bypass SSL pinning, dump keychain/keystore data, monitor cryptographic operations, inspect heap memory, hook methods, and bypass jailbreak/root detection — all by injecting a Frida agent into the target process. Architecture: The Python backend handles CLI commands, device state management, and patching (injecting Frida gadget into IPA/APK files). The TypeScript agent running inside the mobile app exports RPC methods for platform-specific features (Android: hooking, keystore, intents; iOS: keychain, crypto, biometrics). Communication happens over Frida's bi-directional transport. A Flask API server exposes RPC and script endpoints for remote control. The system uses a centralized state layer (connection, device, jobs) and a plugin system for extensibility. Key entry points: 'objection explore' (REPL), 'objection patchapk'/'objection patchipa' (binary patching), 'objection api' (API server), and the agent entry point in 'agent/src/index.ts'. External dependencies include frida, frida-tools, frida-fs, frida-screenshot, Flask, apktool, and GitHub API for gadget downloads. The codebase is well-structured for mobile security automation but shows some drift with deprecated CLI flags, Python 2 compatibility checks, and TODOs for advanced hooking targets.
OWTF (Offensive Web Testing Framework) is a full-stack web application for automated and manual penetration testing. The Python/Tornado backend exposes a JWT-protected REST API for managing targets, sessions, plugin worklists, workers, reports, and proxy history, while the React/Redux frontend provides dashboards, data tables, plugin marketplace, and proxy controls. The application also includes a customizable intercepting HTTP/HTTPS proxy with SSL certificate generation, an interceptor chain for header/body/URL/delay modification, transaction history, a repeater, and live interception - comparable in scope to a Burp Suite-style tool. Execution is plugin-driven: built-in Python plugins covering web, network, and auxiliary tests, plus wrappers around external tools like Nikto and Arachni, are run by multiprocessing workers. Community plugins can be uploaded after AST-based static validation that blocks dangerous imports and execution patterns. The system stores plugin outputs, deduplicates them via SHA-256 fingerprints, tracks execution metrics, and supports HTML reporting. User authentication includes JWT, email verification, OTP, and admin role management. Architecturally, this is a monolith with modular managers and a REST API, not microservices. Deployment targets Docker Compose, Kubernetes, and cloud Terraform. The codebase contains genuinely reusable components: AST-based plugin validation, cross-platform file locking, output fingerprint deduplication, structured logging, and SQLAlchemy query helpers. However, it also carries significant legacy debt: old frontend patterns (React 16 class components, Redux 3, Redux-Saga 0.16), Python 2 remnants in scripts, hardcoded secrets in compose files, and several stub or placeholder external plugins. The repository is fundamentally an application rather than a data research project; bundled dictionaries and execution metrics serve the security workflow but do not define its primary character.
This repository provides a collection of 52 specialized AI agent definitions for penetration testing and red team operations, designed to be used with Claude Code. It is distributed as a Claude Code plugin, with an interactive installer (install.sh), a SQLite findings database (db/findings.sh) for persisting engagement data, and a versioned migration system. The agents are defined as Markdown files with YAML frontmatter, each containing structured system prompts that enforce scope validation, OPSEC tagging, evidence handling, and MITRE ATT&CK mapping. The system includes a swarm orchestrator for multi-agent coordination, a scope guard for safety, and a two-tier safety model (advisory vs. Bash-capable agents). While primarily a configuration/instruction set rather than a traditional software application, it demonstrates strong engineering practices in prompt architecture, database schema design, and distribution automation. The repository is actively maintained with CI validation, shellcheck, and unit tests for the database scripts.
This repository is a curated list of over 150 red teaming tools and resources, organized by MITRE ATT&CK categories (Reconnaissance, Resource Development, Initial Access, etc.). It contains no original source code; instead, it provides descriptions, installation instructions, usage examples, and links to external tools. The README is the sole deliverable, serving as a comprehensive reference for red team operators. While not a software application itself, it functions as a catalog of applications. The backlog file contains a few additional URLs and notes for future additions. The repository is well-maintained with active issue triage and recent commits, but its value lies in curation rather than code craftsmanship.
SocialFish is a modern dynamic phishing toolkit designed for credential harvesting, session hijacking, and social engineering attacks. It provides a Flask-based web application with an admin dashboard for managing cloned login pages, capturing credentials, intercepting OTP/2FA codes, tracking victim sessions, and injecting post-capture attack payloads (e.g., keyloggers, clipboard stealers, tab jacking). The system supports browser automation via Playwright and Selenium to clone JavaScript-heavy and SPA login flows, and includes tunneling via ngrok/cloudflared for exposing phishing URLs remotely. The architecture is a monolithic Flask app with SQLite storage, WebSocket real-time updates, and a mobile API authenticated by QR tokens. External dependencies include Flask, Flask-SocketIO, Flask-Login, Playwright, Selenium, nmap, qrcode, and PyLaTeX. Despite its feature-rich surface, the codebase exhibits significant quality issues: broken async flows, missing database columns, incomplete routes, version mismatches between requirements files, and security concerns such as default credentials and insecure secret key generation. The project is actively maintained (last commit 2026-05-20) but the code is not production-ready as claimed in documentation.
This repository is an archived collection of interview preparation notes for penetration testing and cybersecurity positions. It contains three markdown files: HR interview tips, a comprehensive technical question bank covering topics like SQL injection, XSS, network security, cryptography, and system administration, and a log of actual interview questions from specific companies. The content is well-organized and detailed, providing both strategic advice and technical depth. The repository is not a software application but a knowledge resource. It is explicitly archived by the author, who has moved on from the security field, but remains a valuable reference for aspiring security professionals.
This repository contains only documentation and configuration files (README, CONTRIBUTING, issue templates, .gitignore) with no actual source code present. The README describes SpiderSuite as a cross-platform web crawler for security professionals, but the codebase itself is empty in this snapshot. No functional analysis is possible. The repository appears to be a stub or the source code is hosted elsewhere. Given the absence of any executable or library code, this repository provides no reusable software assets.