Awesome GitHub RepositoriesSecurity Analysis Tools

OpenHands is an autonomous agent framework designed for software engineering workflows. It provides a modular platform for orchestrating AI agents that reason, plan, and execute tasks within isolated, containerized development environments. By integrating with standard version control and development tools, the system enables agents to autonomously navigate codebases, implement features, and resolve issues through iterative reasoning and tool execution. The platform distinguishes itself through a model-agnostic orchestrator that connects diverse language models to a unified tool registry. It

Ghidra is a software reverse engineering suite designed to analyze compiled binaries and reconstruct program logic without access to original source code. It provides an interactive environment for disassembly and decompilation, utilizing a platform-independent intermediate representation to maintain consistency across diverse hardware architectures. The framework supports automated binary analysis through programmatic routines, enabling the investigation of complex code patterns and security indicators. The platform distinguishes itself through a modular architecture that allows for extensiv

Shannon is an integrated security platform designed for autonomous penetration testing, static and dynamic analysis, and automated vulnerability remediation within self-hosted, private infrastructure. It functions as a unified security suite that orchestrates the entire lifecycle of vulnerability management, from initial discovery and reachability prioritization to the generation and verification of code-level patches. The platform distinguishes itself through its agentic approach to security, deploying autonomous agents to execute both black-box and white-box exploits against running applica

Radare2 is a comprehensive framework for reverse engineering and analyzing compiled software. It provides a command-line environment designed for disassembling, debugging, and patching binary executables across a wide range of processor architectures and operating systems. The system distinguishes itself through a modular, plugin-based architecture that supports cross-platform analysis and automated workflows. It utilizes memory-mapped file access to enable efficient structural inspection and modification of binaries without requiring full file loads. By lifting machine instructions into a un

Teleport is a zero-trust access platform designed to provide secure, identity-based connectivity to servers, databases, and Kubernetes clusters. It functions as a centralized gateway that replaces static credentials with short-lived, identity-bound cryptographic certificates, effectively eliminating the need for traditional VPNs and long-term secret exposure. The platform distinguishes itself by orchestrating access through a unified control plane that maps external identity provider claims to granular, role-based infrastructure permissions. It enforces security through mutual TLS gateways an

Frida is a dynamic binary instrumentation toolkit that provides a framework for deep process introspection and live application state manipulation. It enables the injection of custom scripts into running processes to trace function calls, modify memory, and analyze application behavior in real-time across diverse operating systems and processor architectures. The project distinguishes itself by embedding a high-performance JavaScript engine directly within the target process, allowing for the execution of user-defined logic for real-time inspection. It utilizes instruction-level hooking to re

Cutter is a binary analysis platform and graphical user interface for the Rizin reverse engineering framework. It provides an environment for analyzing the internal logic and data structures of compiled binaries through integrated disassembly and visualization. The platform supports a containerized deployment model to provide isolated environments for binary analysis, which is used to examine suspicious binaries without risking the host system. It is an extensible security tool that allows for the addition of custom analysis capabilities and visualizers via native plugins and scripts. The to

Transfer.sh is a self-hosted file storage server designed for rapid data sharing through a command-line interface. It functions as an encrypted hosting platform that allows users to upload and download files using standard HTTP requests, facilitating direct data transfer between systems without the need for external accounts or complex configurations. The service distinguishes itself by processing data as continuous streams, which minimizes memory usage during large transfers. It provides granular control over file availability through automated lifecycle management, allowing administrators t

This project is a Java bytecode reverse engineering suite that functions as a disassembler, decompiler, and editor for Java class files and Android APK binaries. It provides tools to transform compiled bytecode into assembly instructions or readable source code. The toolset supports Android APK analysis and Java binary patching, allowing for the modification of source code or bytecode and subsequent recompilation into functional binaries. It includes capabilities for removing Java obfuscation and performing malware analysis through the detection of malicious code patterns. The system incorpo

OWASP ZAP is a dynamic application security testing tool and intercepting HTTP proxy used to find vulnerabilities in web applications. It functions as a penetration testing framework that enables both automated security scanning and manual security testing of running web services. The tool provides a suite of capabilities for analyzing web applications from the outside in, including the ability to capture and modify traffic between a browser and a target application. It is designed to integrate into DevSecOps pipelines to provide consistent security checks across different environments.

TheZoo is a centralized repository and management system designed for the storage, organization, and retrieval of live malicious software samples. It provides a structured environment for security researchers and educators to access, track, and analyze dangerous code for the purpose of threat intelligence and defense development. The system utilizes a command-line interface to manage the lifecycle of malware samples, including the preparation of new submissions and the querying of a centralized database. To ensure safety and authenticity, the platform stores binaries in password-protected, en

BloodHound is a graph-based security analysis tool designed to map trust relationships and attack vectors within Active Directory environments. It functions as an attack path mapper and risk assessment system that uses graph theory to identify hidden relationships and paths leading to high-privilege accounts. The tool specializes in network attack surface mapping and privilege escalation pathfinding. It quantifies security risks by measuring the reliability of attack paths to critical targets, allowing for the prioritization of vulnerability elimination. The system provides capabilities for

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes container images and filesystems to produce comprehensive inventories of installed packages and dependencies in standard formats. Additionally, it serves as a software attestation tool and an SBOM format converter. The project distinguishes itself through the ability to create cryptographically signed attestations for software inventories to ensure provenance and integrity. It also provides the capability to transform software bills of materials between different industry sche

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

ScoutSuite is a multi-cloud security audit and configuration tool designed to identify security risks and misconfigurations across cloud environments. It functions as a security posture manager and compliance auditor, gathering resource metadata from cloud APIs to evaluate infrastructure against security benchmarks. The tool provides auditing capabilities for AWS, Google Cloud, DigitalOcean, and Kubernetes clusters and control planes. It distinguishes itself by decoupling data collection from analysis, allowing users to cache cloud configurations locally for offline auditing and iterative rul

ScyllaHide est un plugin de contournement d'anti-débogage et un outil de rétro-ingénierie conçu pour masquer un débogueur à une application cible. Il fonctionne comme une bibliothèque de hooking d'API en mode utilisateur et un framework d'injection de DLL qui empêche les programmes de se détecter et de se fermer lorsqu'ils sont analysés. Le projet permet l'analyse de logiciels malveillants et l'étude de logiciels protégés en neutralisant les défenses de sécurité. Il y parvient en interceptant et en modifiant les réponses des bibliothèques système pour tromper les applications sur leur environnement d'exécution. L'utilitaire emploie plusieurs méthodes techniques pour maintenir la furtivité, notamment le hooking d'API inline, le proxying d'appels système et le patching du bloc d'environnement de processus (PEB). Il gère également les traps en mode utilisateur et utilise la redirection de bibliothèques dynamiques pour filtrer les réponses d'API sensibles.

Malwoverview est un utilitaire de sécurité en ligne de commande conçu pour l'agrégation de renseignements sur les menaces, l'analyse de logiciels malveillants et le triage d'incidents. Il fonctionne comme un framework pour automatiser l'investigation de fichiers, hashs, domaines et adresses IP suspects en orchestrant des requêtes à travers plusieurs services de sécurité externes et sandboxes. L'outil se distingue par ses capacités de traitement par lots asynchrone, qui permettent une gestion efficace des investigations d'indicateurs à grande échelle sans bloquer l'exécution. Il dispose d'une architecture de plugins modulaire qui permet l'intégration de divers fournisseurs de renseignements sur les menaces, tandis que sa couche de normalisation de données unifiée garantit que les réponses disparates sont structurées de manière cohérente pour l'analyse. De plus, la plateforme intègre des modèles de langage pour fournir des évaluations de risques automatisées, des mappages de framework et des résumés contextuels des renseignements recueillis. Au-delà de ses capacités d'agrégation, le projet inclut des moteurs d'analyse locaux qui prennent en charge la détection basée sur les signatures et les motifs, y compris l'application de règles personnalisées sur les systèmes de fichiers locaux. Il fournit également des utilitaires d'extraction automatisés qui analysent le texte non structuré, les documents et les pages web pour identifier et isoler les indicateurs de compromission. Le logiciel est distribué sous forme d'interface en ligne de commande basée sur Python, facilitant l'intégration dans des workflows de sécurité automatisés et des opérations de triage à grande échelle.