hacking

Z4nzu/hackingtool

An AI layer now picks the right tool from 219 curated hacking tools — hackingtool bundles 219 tools across 21 categories (recon, OSINT, web, wireless, phishing, forensics, post-exploitation) and adds an AI layer that translates plain-English requests into the correct tool and exact command. Aimed at pentesters, red/blue teamers, OSINT researchers, bug-bounty hunters and CTF players working on authorized systems.

usestrix/strix

Autonomous AI agents that hack and patch your app like a red team — Strix deploys autonomous AI agents that act like real attackers, running actual exploits to find and validate vulnerabilities in your application, then help fix them. It targets developers, security teams, and bug bounty hunters who want automated, agent-driven pentesting instead of manual testing.

smicallef/spiderfoot

Automated OSINT recon with 200+ modules and built-in correlation — SpiderFoot automates OSINT gathering across 200+ modules, with a YAML-configurable correlation engine and 37 pre-defined rules to surface findings. It offers both a web UI and CLI, TOR integration, Docker support, and integrates external tools like Nmap and DNSTwist—useful for pentesters and threat intel analysts mapping attack surfaces.

HunxByts/GhostTrack

OSINT toolkit for tracking IPs, phone numbers, and usernames — GhostTrack (v2.2) is a Python OSINT tool with three menus: IP tracking (can combo with Seeker), phone number lookups, and username search across social media. Built for Linux and Termux, it suits pentesters and hobbyist OSINT researchers who want a lightweight, free info-gathering utility.

bettercap/bettercap

A multi-protocol recon and MITM toolkit spanning WiFi to CAN-bus — Bettercap combines 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 reconnaissance and man-in-the-middle attacks in one modular tool. It suits pentesters and red teamers who need a single framework for spoofing, sniffing, deauth attacks and proxying across very different network types, with active cross-platform CI and Docker support.

blacklanternsecurity/bbot

BBOT 3.0: a recursive OSINT scanner with breaking CLI changes — BBOT is a Spiderfoot-inspired recursive scanner for recon, bug bounties, and attack surface management, chaining passive APIs with DNS brute-force and mutations. Version 3.0 brings breaking changes to CLI, presets, modules, and events, plus a faster multithreaded DNS resolver (blastdns) for quicker scans.

CarterPerez-dev/Cybersecurity-Projects

70 Hands-On Cybersecurity Projects From Beginner to Advanced — A growing collection aiming for 70 cybersecurity projects (42 with full source code so far), paired with certification roadmaps and resources. Built for learners who want real code to study, build upon, or copy directly rather than just theory, spanning pentesting, GRC, cloud security, and more.

BitterSecurity/Decepticon

An autonomous agent framework for red team pentesting — Decepticon is an open-source autonomous agent built on LangChain/LangGraph that performs red team tasks beyond running nmap and writing reports. Trending on Trendshift, it targets security researchers and pentesters wanting LLM-driven, agentic exploit testing rather than scripted scanners.

alpkeskin/mosint

An automated e-mail OSINT tool

khast3x/h8mail

Email OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related email

Ullaakut/cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

h5i-dev/h5i

Rust web framework that proves its own code and attacks itself — h5i combines an axum-based Rust web framework with Lean 4 formal verification and built-in red-teaming CLI tools. Developers can extract app logic into Lean proofs, mutation-test them, and separately run framework-independent recon, crawling and request-replay tools against any website for automated vulnerability discovery.