Top #sec Tools & Software

oryx

github

🕵️‍♂️ TUI for sniffing network traffic using eBPF on Linux

fibratus

github

Adversary tradecraft detection, protection, and hunting

smart-contract-vulnerabilities

github

A collection of smart contract vulnerabilities along with prevention methods

u2f-zero

github

U2F USB token optimized for physical security, affordability, and style

wifipumpkin3

github

Powerful framework for rogue access point attack.

find-sec-bugs

github

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

winscript

github

Open-source tool to build your Windows script from scratch. It includes debloat, privacy, performance & app installing scripts.

brutespray

github

Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.

awesome-cloud-security

github

🛡️ Awesome Cloud Security Resources ⚔️

awesome-iot-hacks

github

A Collection of Hacks in IoT Space so that we can address them (hopefully).

Malcolm

github

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.

solo1

github

Solo 1 firmware in C

cloudfox

github

Automating situational awareness for cloud penetration tests.

creepjs

github

Creepy device and browser fingerprinting

agent-scan

github

Security scanner for AI agents, MCP servers and agent skills.

secure

github

HTTP middleware for Go that facilitates some quick security wins.

noseyparker

github

Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.

boofuzz

github

A fork and successor of the Sulley Fuzzing Framework

caido

github

🚀 Caido releases, wiki and roadmap

awesome-embedded-and-iot-security

github

A curated list of awesome embedded and IoT security resources.

cargo-crev

github

A cryptographically verifiable code review system for the cargo (Rust) package manager.

tirith

github

Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.

accesscontrol

github

Role and Attribute based Access Control for Node.js

android-inline-hook

github

:fire: ShadowHook is an Android inline hook library which supports thumb, arm32 and arm64.