Awesome GitHub RepositoriesNetwork Security Auditing

RustScan is a high-speed TCP network scanner written in Rust, designed for security reconnaissance and network mapping. It functions as an automated port discovery engine that identifies open ports on remote hosts using IPv6 addresses, CIDR ranges, or bulk input files. The tool is built for rapid surface area discovery, utilizing parallel port processing and OS-aware performance optimizations to identify active services. It allows for scan precision tuning through adjustable connection timeout thresholds and concurrent request controls to balance speed and accuracy. The system integrates wit

Micro8 is a security auditing knowledge base and penetration testing resource library. It serves as a curated collection of guides and documentation focused on vulnerability assessment. The project provides educational content and study guides for manual source code review, domain escalation, and internal network auditing. It includes a toolkit of reference materials for analyzing network traffic logs and identifying brute-force patterns. The library covers technical domains including web penetration testing and privilege escalation. It organizes these materials through PDF-based knowledge r

Amass is a network attack surface mapper and reconnaissance framework designed to discover and map the external, internet-facing infrastructure of a target organization. It functions as an open source intelligence tool that identifies public network boundaries and locates hidden or forgotten subdomains to define an organization's total reachable footprint. The project utilizes passive-source data aggregation from external APIs and public databases alongside active DNS brute-forcing and recursive subdomain expansion. It employs a graph-based asset mapping system to visualize the relationships

Vuls is an agentless vulnerability scanner and CVE intelligence aggregator. It identifies security flaws in operating systems, containers, and network devices without requiring the installation of permanent software agents on target machines. The project distinguishes itself by cross-referencing software versions against multiple vulnerability databases, security advisories, and known exploit catalogs. It utilizes platform-based enumeration and lockfile analysis to detect vulnerabilities in network hardware, programming libraries, and website plugins. The tool covers a broad range of securit

This project is a collection of bash automation scripts and command-line utilities designed to automate common tasks and retrieve information from web APIs. It serves as a toolkit for developer references, network diagnostics, and media access directly from the terminal. A central component of the suite is a GitHub Gist manager that handles the full lifecycle of code snippets. This includes cloning and syncing Gists into local directories for offline access, organizing content through hashtags, and searching through snippet descriptions and file contents using regular expressions. The toolki

gosec is a static analysis security tool designed to scan Go source code for vulnerabilities and common coding flaws. It functions as a security analyzer that inspects the abstract syntax tree to identify insecure function calls, API usage, and potential security risks. The tool distinguishes itself by mapping detected vulnerabilities to Common Weakness Enumeration identifiers for standardized reporting and integrating with external AI models to suggest code fixes for identified issues. Its capabilities cover the detection of injection vulnerabilities, hardcoded credentials, weak cryptograph

testssl.sh is a network security tool and SSL/TLS security scanner used to audit server configurations. It functions as a diagnostic utility that validates supported ciphers and protocols to identify cryptographic vulnerabilities and flaws in encrypted communication. The tool is available as both a command-line utility and a dockerized security scanner, allowing for execution in isolated environments without the need for local dependency installation. Its capabilities cover SSL configuration auditing and TLS server security analysis. The system exports scan results into structured reports a

Tsunami Security Scanner is a network vulnerability scanner and security auditor designed to identify high-severity flaws across network assets. It functions as an asynchronous security probe engine that utilizes automated probes and specialized detection logic to find critical weaknesses and prioritize remediation efforts. The project is distinguished by a plugin-based scanning engine, which uses a modular architecture of interchangeable detection plugins to identify vulnerabilities. This extensibility allows for the development and integration of custom security plugins to expand the variet

Simplewall is an application firewall manager and network traffic filter that provides a graphical interface for the Windows Filtering Platform. It controls inbound and outbound network access for individual programs and services by intercepting and filtering traffic at the kernel level. The project identifies specific binaries using file hashes to prevent spoofing and allows users to define custom firewall rules based on IP addresses, CIDR ranges, and port numbers. It includes a system for blocking operating system telemetry and managing blocklists of known malicious IP addresses. The tool

This project is a mobile network security auditor and IMSI catcher detector designed to identify fake base stations and surveillance hardware attempting to intercept mobile traffic. It functions as a radio interface analyzer and cellular tower mapping tool, monitoring connections to detect unauthorized network infrastructure. The system distinguishes itself by combining real-time threat level monitoring with the ability to identify silent SMS and stealth communications used for device tracking. It analyzes ciphering status to detect forced network downgrades to weaker encryption standards and

Nettacker is an automated penetration testing framework designed to orchestrate reconnaissance, port scanning, and vulnerability detection. It functions as a network reconnaissance tool and vulnerability scanner that identifies open ports, fingerprints services, and checks systems against databases of known security flaws. The framework distinguishes itself by combining a web application crawler for discovering hidden paths via fuzzing with a vulnerability management system that persists scan results in a database to track historical assessments. It also includes specialized capabilities for

Cameradar is a network scanning tool designed to discover publicly accessible IP cameras. It identifies active Real Time Streaming Protocol services by scanning IP ranges and using device fingerprints to determine specific hardware models. The tool performs security auditing through dictionary-based probing and brute force attacks to uncover valid streaming paths and authentication credentials. It validates discovered streams by verifying the receipt of real-time transport protocol data packets to eliminate false positives. The system supports a multi-stage discovery pipeline and can export

kscan एक नेटवर्क सुरक्षा स्कैनर और सर्विस फिंगरप्रिंटर है जिसका उपयोग सक्रिय होस्ट और ओपन पोर्ट्स खोजने के लिए किया जाता है। यह नेटवर्क प्रोटोकॉल विश्लेषक और आंतरिक नेटवर्क मैपर के रूप में कार्य करता है ताकि पहुंच योग्य गेटवे की पहचान की जा सके और लक्ष्य वातावरण के नेटवर्क सतह क्षेत्र का विश्लेषण किया जा सके। यह टूल बाहरी खुफिया सेवाओं के माध्यम से लक्ष्य होस्ट प्राप्त करके और उनकी उपलब्धता को सत्यापित करके बाहरी एसेट डिस्कवरी को एकीकृत करता है। यह एक क्रेडेंशियल ब्रूट फ़ोर्स टूल के रूप में भी संचालित होता है, जो ऑटोमेटेड उपयोगकर्ता नाम और पासवर्ड शब्दकोशों का उपयोग करके कई प्रोटोकॉल पर प्रमाणीकरण शक्ति का परीक्षण करता है। यह प्रोजेक्ट सॉफ्टवेयर संस्करणों, ऑपरेटिंग सिस्टम, और संचार प्रोटोकॉल की पहचान के माध्यम से नेटवर्क सुरक्षा ऑडिटिंग को कवर करता है। यह IP पतों और URLs सहित विविध लक्ष्य फ़ॉर्मेट्स को आयात करने का समर्थन करता है, और पोर्टेबल निष्पादन के लिए एक स्टैंडअलोन बाइनरी में संकलित किया जा सकता है।

PRET एक नेटवर्क प्रिंटर एक्सप्लॉइटेशन फ्रेमवर्क और सुरक्षा यूटिलिटी है जिसे प्रिंटिंग हार्डवेयर की खोज और फर्मवेयर का ऑडिट करने के लिए डिज़ाइन किया गया है। यह प्रिंटर-विशिष्ट नियंत्रण भाषाओं और प्रोटोकॉल में हेरफेर करके प्रिंटिंग इंफ्रास्ट्रक्चर में प्रवेश करने के लिए एक टूलकिट के रूप में कार्य करता है। यह प्रोजेक्ट बफ़र ओवरफ़्लो के माध्यम से रिमोट कोड एक्जीक्यूशन को ट्रिगर करने और प्रिंटर जॉब लैंग्वेज का उपयोग करके प्रिंटर फ़ाइल सिस्टम को मैनेज करने के लिए विशेष क्षमताएं प्रदान करता है। यह डिवाइस मेटाडेटा, जैसे फर्मवेयर वर्ज़न और मेमोरी संसाधनों को निकालने और हार्डवेयर व्यवहार और सिस्टम मापदंडों को संशोधित करने की अनुमति देता है। यह फ्रेमवर्क नेटवर्क डिवाइस डिस्कवरी, इनपुट फ्लडिंग के माध्यम से वल्नेरेबिलिटी असेसमेंट और प्रिंट वर्कफ़्लो के इंटरसेप्शन सहित एक व्यापक सुरक्षा परीक्षण सतह को कवर करता है। इसमें सिस्टम जानकारी निष्कर्षण और हार्डवेयर-स्तरीय डिनायल-ऑफ़-सर्विस परीक्षण के लिए टूल भी शामिल हैं।

Hubble is an eBPF-based Kubernetes observability platform designed for network monitoring, security auditing, and flow inspection. It provides deep visibility into containerized traffic and cluster security by utilizing kernel-level hooks to collect network events. The system features a service map for visualizing communication patterns and dependencies between microservices and external endpoints. It incorporates identity-based flow labeling to track network traffic using Kubernetes labels rather than volatile IP addresses. The platform covers a broad range of monitoring capabilities, inclu

Vulscan is a network service auditor and vulnerability scanner that utilizes the Nmap Scripting Engine to identify security flaws. It functions as a version-based flaw detector, matching detected software banners against an offline vulnerability database to identify potential security risks without requiring a constant internet connection. The tool provides mechanisms for refining identification accuracy, including an interactive mode for manual version overriding and configurable matching logic to filter results. It manages security data through a system for loading local datasets and synchr

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

RealiTLScanner is a TLS configuration scanner and network security auditor designed to identify security settings across IP addresses and domains. It functions as a target discovery tool that analyzes TLS configurations to find compatible endpoints and evaluate server security postures. The project distinguishes itself as a geolocation-enhanced network scanner, appending geographic location data and country codes to discovered security configurations using a local location database. This allows for the geographic mapping of servers by combining TLS scan results with GeoIP data. The tool supp

Bearer is a static analysis security testing tool and privacy compliance auditor. It identifies security vulnerabilities, hard-coded secrets, and privacy risks in source code through static analysis and data flow tracing. The tool distinguishes itself by tracking the movement of sensitive data through code to identify leaks and by mapping personal and health-related information flows to generate evidence for privacy impact assessments. It also provides differential scanning for pull requests and uses fingerprint-based suppression to exclude known false positives from reports. The platform co

PCredz is a network credential extraction tool and traffic analyzer designed to intercept passwords, hashes, and tokens from IPv4 and IPv6 traffic. It functions as both a real-time monitor for live network interfaces and a parser for saved packet capture files. The tool identifies sensitive information, including credit card numbers and authentication tokens, using protocol-aware parsing. It further acts as a password hash recovery utility by normalizing captured authentication hashes into specific syntaxes compatible with external recovery software. Capabilities include real-time traffic in