Awesome GitHub RepositoriesSecurity Testing

يعمل هذا المشروع كمستودع مركزي يقوده المجتمع للمعرفة التقنية والموارد الإدارية. يوفر تصنيفاً هيكلياً يجمع المعلومات المتباينة في إطار عمل قابل للبحث، مما يدعم التعلم المستمر وحل المشكلات السريع لمسؤولي النظام وممارسي الأمن السيبراني. من خلال تعيين الموارد عبر الأمن الهجومي، وإدارة البنية التحتية، وتطوير البرمجيات، فإنه يوفر مساراً موحداً لاكتساب المهارات والمرجع المهني. يتم تعريف المشروع بفلسفة تصميم تعتمد على سطر الأوامر أولاً، مع إعطاء الأولوية للأدوات القائمة على الطرفية والواجهات القابلة للبرمجة لتسهيل إدارة النظام بكفاءة وسير عمل أمني قابل للتكرار. يتميز بنهج مستقل عن المنصة، حيث يحتفظ بالتوثيق والأدلة التشغيلية التي تظل قابلة للتطبيق عبر بيئات Unix المتنوعة والبيئات القائمة على السحابة. يسمح تكامل مجموعة الأدوات المعيارية هذا للمستخدمين بتكوين بيئات مخصصة مصممة لمهام إدارية أو أمنية محددة. يغطي المستودع نطاقاً واسعاً من القدرات، بما في ذلك مجموعات أدوات شاملة لتدقيق النظام، وإدارة الشبكة، وتقوية البنية التحتية. ويوفر مسارات تعليمية منظمة لتطوير مهارات الأمن السيبراني، تتراوح من مختبرات الاختراق الأخلاقي ومعايير اختبار الاختراق إلى تقييم الثغرات وأفضل ممارسات تكوين النظام. تشمل المجموعة أيضاً مجموعة واسعة من أدوات الإنتاجية، وأدوات التشخيص، والمواد التعليمية المصممة لتبسيط الصيانة الروتينية وتعزيز الوضع الأمني العام.

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

hacker-scripts is a multi-purpose toolkit comprising a security vulnerability testing suite, a keyword-driven email automator, and a TCP remote hardware controller. It provides a collection of scripts for identifying security weaknesses and conducting controlled hacking experiments across multiple programming language environments. The system automates email workflows by scanning headers and bodies for specific strings to trigger server responses and sends randomized text and email alerts based on system activity. It also enables remote hardware control by sending binary commands over network

This project is a standardized repository of malicious and malformed character sequences designed to stress-test data parsing and sanitization routines. It serves as a security testing corpus and a language-neutral reference for auditing software robustness against injection flaws and unexpected data handling errors across diverse platforms. The dataset functions as a benchmark for input validation, providing a curated collection of edge-case strings that allow developers to identify potential crashes and security vulnerabilities. By decoupling these test vectors from application logic, the r

Hashcat is a high-performance hash cracking software and OpenCL compute application used to recover plain-text passwords from hashed data. It functions as a GPU-accelerated recovery tool and distributed password cracker, leveraging CPUs and GPUs to perform intensive cryptographic computations. The system differentiates itself through a distributed cracking workflow that coordinates tasks across multiple machines via an overlay network to share computational load. It further optimizes recovery speed using Markov chain keyspace optimization to prioritize the most likely password candidates. Th

Mobile Security Framework is an automated security testing platform designed for the analysis of Android, iOS, and Windows mobile application binaries. It functions as a comprehensive suite for identifying security vulnerabilities, privacy risks, and malicious code within mobile software packages. The framework distinguishes itself by combining static and dynamic analysis techniques to evaluate application behavior. It performs static inspection of source code and binaries to detect insecure patterns, while simultaneously utilizing dynamic instrumentation and containerized sandboxing to monit

Strix is an automated security research and vulnerability scanning platform that leverages language models to orchestrate complex security analysis tasks. It functions as a comprehensive framework for penetration testing and continuous security integration, allowing users to embed automated vulnerability research directly into development pipelines or execute it within isolated, containerized environments. The platform distinguishes itself through a multi-agent orchestration engine that coordinates specialized autonomous agents to perform parallel security assessments. By integrating LLM-agno

Micro8 is a security auditing knowledge base and penetration testing resource library. It serves as a curated collection of guides and documentation focused on vulnerability assessment. The project provides educational content and study guides for manual source code review, domain escalation, and internal network auditing. It includes a toolkit of reference materials for analyzing network traffic logs and identifying brute-force patterns. The library covers technical domains including web penetration testing and privilege escalation. It organizes these materials through PDF-based knowledge r

MHDDoS is a command-line utility designed for volumetric stress testing and infrastructure resilience assessment. It functions as a comprehensive framework for simulating high-volume network and application layer traffic to evaluate the capacity and stability of web services and network infrastructure. The tool distinguishes itself through its ability to generate complex, protocol-specific traffic patterns and raw packet structures. By employing dynamic header randomization and specialized payload injection, it simulates diverse request behaviors intended to test the effectiveness of security

This tool is a command-line utility designed for automated web resource discovery, fuzzing, and application structure mapping. It functions as a security-focused scanner that identifies hidden files, directories, parameters, and virtual hosts by injecting payloads into HTTP requests. By systematically testing how servers handle various inputs, it assists in mapping the architecture of web applications and uncovering potential security vulnerabilities. The tool distinguishes itself through a highly concurrent engine that manages asynchronous request execution and recursive job orchestration. I

Semgrep is a static analysis security testing tool designed to identify vulnerabilities and logic errors by matching source code against declarative patterns. It functions as an automated scanner that integrates into development workflows to detect insecure code patterns and enforce coding standards before deployment. The engine utilizes a language-agnostic intermediate representation and a modular parser architecture to normalize diverse programming languages into a unified format. This allows for consistent rule execution across different codebases, enabling users to perform custom structur

This project provides an open-source firmware platform and complete build environment for portable multi-tool hardware. It functions as an embedded operating system designed to manage radio, infrared, and physical interface components, enabling users to develop custom applications and system logic for specialized hardware devices. The firmware distinguishes itself through a modular architecture that organizes system functionality into isolated units, allowing for the development of custom user interfaces and logic. It includes a comprehensive collection of low-level drivers and applications s

Zphisher is a security testing framework designed for conducting authorized social engineering assessments and penetration testing. It functions as a credential harvesting simulator that enables security professionals to evaluate organizational defenses and user awareness by deploying deceptive login interfaces. The platform automates the creation of realistic web pages through dynamic template rendering and provides tools to mask destination addresses. It integrates reverse proxy tunneling to expose local testing services to the public internet, allowing for remote access during security aud

OWASP ZAP is a dynamic application security testing tool and intercepting HTTP proxy used to find vulnerabilities in web applications. It functions as a penetration testing framework that enables both automated security scanning and manual security testing of running web services. The tool provides a suite of capabilities for analyzing web applications from the outside in, including the ability to capture and modify traffic between a browser and a target application. It is designed to integrate into DevSecOps pipelines to provide consistent security checks across different environments.

XSStrike is a security tool designed to detect cross-site scripting vulnerabilities through parameter fuzzing and web response analysis. It functions as a web application fuzzer and vulnerability scanner that identifies injection points and security flaws. The project includes a specialized utility for detecting blind XSS, where payloads execute asynchronously or on separate pages. It also features a JavaScript library auditor to identify outdated libraries with known vulnerabilities and a dedicated tool for identifying and bypassing web application firewalls using various evasion techniques.

Hacker Roadmap is a community-driven repository that functions as a structured learning path and resource directory for cybersecurity and ethical hacking. It organizes complex security concepts into sequential modules, guiding users from fundamental knowledge to advanced technical exploitation skills through a curated collection of educational materials and professional development resources. The project distinguishes itself by acting as a centralized index that maps specialized third-party security software and isolated training environments to specific operational use cases. By aggregating

Hermes-webui is a self-hosted AI orchestrator and web interface for managing autonomous agents. It serves as a multi-provider gateway that connects cloud and local large language models, providing a central hub to execute scheduled background jobs, run shell commands, and manage agent memory on private hardware. The system distinguishes itself through a persistent memory manager that utilizes knowledge graphs and markdown files for long-term context across sessions. It features a model context protocol host for extending agent capabilities with standardized tools and supports the orchestratio

Amass is a network attack surface mapper and reconnaissance framework designed to discover and map the external, internet-facing infrastructure of a target organization. It functions as an open source intelligence tool that identifies public network boundaries and locates hidden or forgotten subdomains to define an organization's total reachable footprint. The project utilizes passive-source data aggregation from external APIs and public databases alongside active DNS brute-forcing and recursive subdomain expansion. It employs a graph-based asset mapping system to visualize the relationships

XSStrike is an automated security scanning engine designed for web application discovery, input