Awesome GitHub RepositoriesSecurity Reconnaissance Tools

Masscan is a command-line network scanner designed for large-scale discovery and infrastructure reconnaissance. It identifies open ports across specific network segments or the entire internet by probing vast address ranges with high efficiency. The tool functions as an asynchronous packet engine, bypassing standard operating system kernel networking stacks to transmit raw packets directly from application memory. The project distinguishes itself through a specialized architecture that manages millions of concurrent connections by separating packet transmission and reception into independent

RustScan is a high-speed TCP network scanner written in Rust, designed for security reconnaissance and network mapping. It functions as an automated port discovery engine that identifies open ports on remote hosts using IPv6 addresses, CIDR ranges, or bulk input files. The tool is built for rapid surface area discovery, utilizing parallel port processing and OS-aware performance optimizations to identify active services. It allows for scan precision tuning through adjustable connection timeout thresholds and concurrent request controls to balance speed and accuracy. The system integrates wit

Bettercap is a modular framework designed for network reconnaissance, security testing, and the execution of man-in-the-middle attacks. It functions as a comprehensive utility for surveying wired and wireless network segments, identifying connected devices, and analyzing communication protocols through real-time traffic interception and manipulation. The platform distinguishes itself through an event-driven architecture that coordinates network state changes and packet-level data through a centralized message pipeline. It provides a programmable scripting engine and an API for orchestrating s

Anubis is a command-line security reconnaissance framework designed for subdomain enumeration and attack surface mapping. It functions as a utility for security professionals to identify, catalog, and visualize the external digital footprint of an organization by discovering all subdomains associated with a target domain. The tool distinguishes itself through a modular resolver pipeline that integrates passive reconnaissance from third-party security APIs and public certificate transparency logs. It combines this data with active discovery methods, including recursive DNS brute-forcing and al

Katana is a web crawler and spider designed for security reconnaissance and web application mapping. It functions as a utility for identifying endpoints, forms, and API structures across web targets by combining standard HTTP request traversal with headless browser automation to render dynamic, JavaScript-heavy content. The tool distinguishes itself through its ability to maintain authenticated sessions and handle complex web interactions, such as automated form submission and captcha resolution. It provides granular control over the discovery process, allowing users to define specific crawl

Nmap is a command-line network security scanner and reconnaissance framework designed for infrastructure mapping and security auditing. It functions as a packet crafting utility that probes target systems to identify active hosts, detect open ports, and determine the services and operating systems running on a network. The tool distinguishes itself through its ability to perform raw socket packet injection and stateful connection tracking, allowing it to bypass standard operating system networking stacks. It utilizes an asynchronous concurrency model to manage large-scale network scans and em

reconftw is an attack surface management framework and reconnaissance workflow orchestrator designed to automate the discovery, mapping, and monitoring of external digital assets. It operates as a modular tool-chain pipeline that coordinates a sequence of security tools to perform intelligence gathering and vulnerability scanning. The project distinguishes itself through a cloud-native deployment model that parallelizes scanning workloads across a fleet of remote VPS instances to bypass local resource constraints. It utilizes container-based environment isolation to ensure consistent executio

This project is a library of pre-defined keyboard scripts and payloads designed for execution via HID injection hardware. It provides a collection of scripted keystroke sequences specifically for the Flipper Zero and other compatible hardware to automate tasks on target computers. The library includes HID attack scripts and USB Rubber Ducky payloads that automate commands to bypass manual user interaction. These scripts are designed to perform system reconnaissance, exfiltrate data, and manipulate user interfaces. The available payloads cover several capability areas, including automated sys

Osmedeus is a security workflow orchestration engine that coordinates AI agents, shell commands, and scanning tools through declarative YAML pipelines. It functions as a distributed security scanner, a declarative workflow automator, and an AI agent framework for security, enabling automated multi-step security analysis with conditional branching, parallel execution, and distributed workers. The engine distinguishes itself through a hybrid runner model that executes workflow steps on the local host, inside Docker containers, or over SSH to remote machines, selected per step or module. It supp

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

WhatWeb is a web application fingerprinting tool that identifies the technology stack powering a website by scanning HTTP responses and page content. It matches responses against a library of over 1800 signatures to detect CMS platforms, JavaScript libraries, web servers, embedded devices, and third-party addons, while also extracting technical metadata such as software versions, user accounts, and module names. The tool operates through a plugin-based detection framework that supports both passive and aggressive scanning modes. Passive plugins analyze existing HTTP headers and page content w

Pacu ist ein Exploitation-Framework, das für das Auditieren und Testen der Sicherheit von Amazon Web Services (AWS)-Umgebungen entwickelt wurde. Es dient als Cloud-Penetration-Testing-Tool und Ressourcen-Enumerator, um Fehlkonfigurationen zu identifizieren, Angriffsflächen abzubilden und Pfade zur Privilegieneskalation auszuführen. Das Framework bietet spezialisierte Funktionen für Post-Exploitation- und Red-Team-Operationen, einschließlich der Etablierung von Persistenz durch Backdooring von Identity and Access Management (IAM). Es zeichnet sich durch ein Plugin-basiertes Modulsystem aus, das die Entwicklung benutzerdefinierter Aufgaben und die Orchestrierung von API-Anfragen über mehrere geografische Regionen hinweg ermöglicht. Das Projekt deckt ein breites Spektrum an Sicherheitsaudit-Aktivitäten ab, einschließlich Infrastruktur-Enumeration, Datenexfiltration aus Speicherdiensten und Identitäts-Audits. Es enthält Tools für Remote Code Execution via Payload-Injection und Startskripte sowie Funktionen zur Störung von Erkennungsdiensten und zur Analyse lateraler Netzwerkbewegungen. Pacu verwaltet zielspezifische Authentifizierungsschlüssel und Sitzungsmetadaten unter Verwendung isolierter Container und einer lokalen Datenbank, um den Status beizubehalten und API-Aufrufe zu reduzieren.

Hakrawler is a command-line web spider tool designed for security reconnaissance, built to crawl target websites and extract hyperlinks along with JavaScript file references. As a focused reconnaissance utility, it collects every discoverable URL and script source from a given domain, mapping the attack surface for penetration testing and vulnerability assessment. The tool differentiates itself through its concurrent architecture: a fixed-size goroutine pool fetches pages in parallel, while CSS selectors parse HTML to extract anchor and script references. A depth-aware recursion limiter preve

Seatbelt ist ein C#-Framework für offensive Sicherheit und ein Host-Sicherheitsauditor, das für Endpoint-Surveys auf Windows-Systemen entwickelt wurde. Es fungiert als modulares Tool zur Identifizierung von Schwachstellen, Fehlkonfigurationen und sicherheitsrelevanten Artefakten auf lokalen und Remote-Hosts. Das Projekt zeichnet sich durch ein modulbasiertes Prüfsystem aus, das die Integration benutzerdefinierter Sicherheitsbefehlseinheiten ermöglicht. Es verfügt über einen Parser für Sicherheitsereignisprotokolle zur Verfolgung von Anmelde- und Prozessaktivitäten sowie ein Utility zur Anmeldeinformationsextraktion, um Browserverlauf, gespeicherte Passwörter und Cloud-Anmeldedaten aus Benutzerprofilen zu sammeln. Das System deckt breite Funktionsbereiche ab, einschließlich Remote-System-Enumeration, Registry-basierter Host-Erkennung und Sicherheitsereignisanalyse. Es kann detaillierte Systemkonfigurationsdaten, wie Antivirus-Einstellungen und Netzwerkregeln, erfassen und die resultierenden Survey-Daten in JSON- oder Textformate exportieren.

PrivescCheck is a PowerShell-based security auditing tool designed to scan Windows configurations for potential privilege escalation paths and local host vulnerabilities. It functions as a vulnerability assessment utility that analyzes system settings and registry configurations to identify weaknesses that could allow unauthorized administrative access. The tool automates internal security reconnaissance and post-exploitation data collection to gather environmental information. It serves as a security compliance reporter by exporting scan results into structured formats, including HTML, CSV,

This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

Lockdoor-Framework ist eine modulare Penetration-Testing-Suite, die darauf ausgelegt ist, umfassende Sicherheitsbewertungen über eine zentrale Befehlszeilenschnittstelle zu erleichtern. Sie fungiert als integrierte Plattform für Aufklärung, Schwachstellen-Scanning und die Ausnutzung von Zielsystemen und bietet eine einheitliche Umgebung für die Verwaltung komplexer Sicherheitsworkflows. Das Framework zeichnet sich durch eine modulare Plugin-Architektur aus, die die Erweiterung der Kernfunktionen ohne Modifikation der zugrunde liegenden Codebasis ermöglicht. Es integriert eine automatisierte Aufklärungspipeline zur Abbildung von Angriffsflächen und nutzt externe Tool-Integrationen, um branchenübliche Dienstprogramme zu kapseln, wodurch Benutzer diverse Sicherheitsoperationen innerhalb eines einzigen, kohärenten Systems ausführen können. Das Tool deckt eine breite Palette an Fähigkeiten ab, einschließlich Binäranalyse und Reverse Engineering zur Untersuchung kompilierter Software sowie automatisiertes Webanwendungs-Scanning zur Identifizierung von Injektionsfehlern und Konfigurationsfehlern. Es unterstützt zudem Tests auf Systemebene, wie Privilegieneskalation und Passwort-Auditing, und enthält eine dedizierte Engine zur Aggregation von Ergebnissen in standardisierte Sicherheitsberichte.