General Security

Hunt down social media accounts by username across social networks

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites

🕵️‍♂️ All-in-one OSINT tool for analysing any website

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]

An open source cybersecurity protocol for syncing decentralized graph data.

This repository contains a 90-day cybersecurity study plan, along with resources and materials for learning various cybersecurity concepts and technologies. The plan is organized into daily tasks, covering topics such as Network+, Security+, Linux, Python, Traffic Analysis, Git, ELK, AWS, Azure, and Hacking. The repository also includes a `LEARN.md

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Useful tool to track location or mobile number

Source code for Hacker101.com - a free online web and mobile security class.

A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

Low code web framework for real world applications, in Python and Javascript

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

Cybersecurity AI (CAI), the framework for AI Security

A curated list of tools for incident response

:octocat: Machine Learning for Cyber Security

A collection of several hundred online tools for OSINT

Web-based Traffic and Cybersecurity Network Traffic Monitoring

Everything about Web Application Firewalls (WAFs) from Security Standpoint! 🔥

An awesome list of awesome YouTubers that teach about technology. Tutorials about web development, computer science, machine learning, game development, cybersecurity, and more.

A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators.

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

Automated Adversary Emulation Platform

An OSINT tool to search for accounts by username and email in social networks.

Ultimate DevSecOps library

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。国内首个开源的代码漏洞挖掘多智能体系统。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

A curated list of GPT agents for cybersecurity

A collection of awesome security hardening guides, tools and other resources

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

CloudMapper helps you analyze your Amazon Web Services (AWS) environments.

GNU Radio – the Free and Open Software Radio Ecosystem

Cloud-native SIEM for intelligent security analytics for your entire enterprise.

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

ffffffff0x 团队维护的安全知识框架,内容包括不仅限于 web安全、工控安全、取证、应急、蓝队设施部署、后渗透、Linux安全、各类靶机writup

Study Notes For Web Hacking / Web安全学习笔记