Awesome GitHub RepositoriesSecurity Reconnaissance Tools

Masscan is a command-line network scanner designed for large-scale discovery and infrastructure reconnaissance. It identifies open ports across specific network segments or the entire internet by probing vast address ranges with high efficiency. The tool functions as an asynchronous packet engine, bypassing standard operating system kernel networking stacks to transmit raw packets directly from application memory. The project distinguishes itself through a specialized architecture that manages millions of concurrent connections by separating packet transmission and reception into independent

RustScan is a high-speed TCP network scanner written in Rust, designed for security reconnaissance and network mapping. It functions as an automated port discovery engine that identifies open ports on remote hosts using IPv6 addresses, CIDR ranges, or bulk input files. The tool is built for rapid surface area discovery, utilizing parallel port processing and OS-aware performance optimizations to identify active services. It allows for scan precision tuning through adjustable connection timeout thresholds and concurrent request controls to balance speed and accuracy. The system integrates wit

Bettercap is a modular framework designed for network reconnaissance, security testing, and the execution of man-in-the-middle attacks. It functions as a comprehensive utility for surveying wired and wireless network segments, identifying connected devices, and analyzing communication protocols through real-time traffic interception and manipulation. The platform distinguishes itself through an event-driven architecture that coordinates network state changes and packet-level data through a centralized message pipeline. It provides a programmable scripting engine and an API for orchestrating s

Anubis is a command-line security reconnaissance framework designed for subdomain enumeration and attack surface mapping. It functions as a utility for security professionals to identify, catalog, and visualize the external digital footprint of an organization by discovering all subdomains associated with a target domain. The tool distinguishes itself through a modular resolver pipeline that integrates passive reconnaissance from third-party security APIs and public certificate transparency logs. It combines this data with active discovery methods, including recursive DNS brute-forcing and al

Katana is a web crawler and spider designed for security reconnaissance and web application mapping. It functions as a utility for identifying endpoints, forms, and API structures across web targets by combining standard HTTP request traversal with headless browser automation to render dynamic, JavaScript-heavy content. The tool distinguishes itself through its ability to maintain authenticated sessions and handle complex web interactions, such as automated form submission and captcha resolution. It provides granular control over the discovery process, allowing users to define specific crawl

Nmap is a command-line network security scanner and reconnaissance framework designed for infrastructure mapping and security auditing. It functions as a packet crafting utility that probes target systems to identify active hosts, detect open ports, and determine the services and operating systems running on a network. The tool distinguishes itself through its ability to perform raw socket packet injection and stateful connection tracking, allowing it to bypass standard operating system networking stacks. It utilizes an asynchronous concurrency model to manage large-scale network scans and em

reconftw is an attack surface management framework and reconnaissance workflow orchestrator designed to automate the discovery, mapping, and monitoring of external digital assets. It operates as a modular tool-chain pipeline that coordinates a sequence of security tools to perform intelligence gathering and vulnerability scanning. The project distinguishes itself through a cloud-native deployment model that parallelizes scanning workloads across a fleet of remote VPS instances to bypass local resource constraints. It utilizes container-based environment isolation to ensure consistent executio

This project is a library of pre-defined keyboard scripts and payloads designed for execution via HID injection hardware. It provides a collection of scripted keystroke sequences specifically for the Flipper Zero and other compatible hardware to automate tasks on target computers. The library includes HID attack scripts and USB Rubber Ducky payloads that automate commands to bypass manual user interaction. These scripts are designed to perform system reconnaissance, exfiltrate data, and manipulate user interfaces. The available payloads cover several capability areas, including automated sys

Osmedeus is a security workflow orchestration engine that coordinates AI agents, shell commands, and scanning tools through declarative YAML pipelines. It functions as a distributed security scanner, a declarative workflow automator, and an AI agent framework for security, enabling automated multi-step security analysis with conditional branching, parallel execution, and distributed workers. The engine distinguishes itself through a hybrid runner model that executes workflow steps on the local host, inside Docker containers, or over SSH to remote machines, selected per step or module. It supp

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

WhatWeb is a web application fingerprinting tool that identifies the technology stack powering a website by scanning HTTP responses and page content. It matches responses against a library of over 1800 signatures to detect CMS platforms, JavaScript libraries, web servers, embedded devices, and third-party addons, while also extracting technical metadata such as software versions, user accounts, and module names. The tool operates through a plugin-based detection framework that supports both passive and aggressive scanning modes. Passive plugins analyze existing HTTP headers and page content w

Pacu es un framework de explotación diseñado para auditar y probar la seguridad de entornos de Amazon Web Services. Sirve como herramienta de pruebas de penetración en la nube y enumerador de recursos utilizado para identificar configuraciones erróneas, mapear superficies de ataque y ejecutar rutas de escalada de privilegios. El framework proporciona capacidades especializadas para operaciones de post-explotación y equipos rojos (red team), incluyendo el establecimiento de persistencia mediante la creación de puertas traseras en la gestión de identidad y acceso. Se distingue por un sistema de módulos basado en plugins que permite el desarrollo de tareas personalizadas y la orquestación de solicitudes de API en múltiples regiones geográficas. El proyecto cubre una amplia gama de actividades de auditoría de seguridad, incluyendo enumeración de infraestructura, exfiltración de datos de servicios de almacenamiento y auditoría de identidad. Incluye herramientas para la ejecución remota de código mediante inyección de carga útil y scripts de inicio, así como capacidades para interrumpir servicios de detección y analizar el movimiento lateral en la red. Pacu gestiona claves de autenticación específicas del objetivo y metadatos de sesión utilizando contenedores aislados y una base de datos local para mantener el estado y reducir las llamadas a la API.

Hakrawler is a command-line web spider tool designed for security reconnaissance, built to crawl target websites and extract hyperlinks along with JavaScript file references. As a focused reconnaissance utility, it collects every discoverable URL and script source from a given domain, mapping the attack surface for penetration testing and vulnerability assessment. The tool differentiates itself through its concurrent architecture: a fixed-size goroutine pool fetches pages in parallel, while CSS selectors parse HTML to extract anchor and script references. A depth-aware recursion limiter preve

Seatbelt is a C# offensive security framework and host security auditor designed to perform endpoint surveys on Windows systems. It functions as a modular tool for identifying vulnerabilities, misconfigurations, and security-relevant artifacts on both local and remote hosts. The project distinguishes itself through a module-based check system that allows for the integration of custom security command units. It features a security event log parser to track logon and process activity, alongside a credential extraction utility for gathering browser history, saved passwords, and cloud credentials

PrivescCheck is a PowerShell-based security auditing tool designed to scan Windows configurations for potential privilege escalation paths and local host vulnerabilities. It functions as a vulnerability assessment utility that analyzes system settings and registry configurations to identify weaknesses that could allow unauthorized administrative access. The tool automates internal security reconnaissance and post-exploitation data collection to gather environmental information. It serves as a security compliance reporter by exporting scan results into structured formats, including HTML, CSV,

This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

Lockdoor-Framework es una suite de pruebas de penetración modular diseñada para facilitar evaluaciones de seguridad integrales a través de una interfaz de línea de comandos centralizada. Funciona como una plataforma integrada para reconocimiento, escaneo de vulnerabilidades y explotación de sistemas objetivo, proporcionando un entorno unificado para gestionar flujos de trabajo de seguridad complejos. El framework se distingue por una arquitectura de plugins modular que permite la extensión de capacidades centrales sin modificar el código base subyacente. Incorpora un pipeline de reconocimiento automatizado para mapear superficies de ataque y aprovecha la integración de herramientas externas para envolver utilidades estándar de la industria, permitiendo a los usuarios ejecutar diversas operaciones de seguridad dentro de un sistema único y cohesivo. La herramienta cubre una amplia superficie de capacidades, incluyendo análisis binario e ingeniería inversa para examinar software compilado, así como escaneo automatizado de aplicaciones web para identificar fallos de inyección y errores de configuración. También admite pruebas a nivel de sistema, como escalada de privilegios y auditoría de contraseñas, e incluye un motor dedicado para agregar hallazgos en informes de evaluación de seguridad estandarizados.