云环境利用框架（Cloud exploitation framework）主要用来方便红队人员在获得 AK 的后续工作。

一款帮助云租户发现和测试云上风险、增强云上防护能力的综合性开源工具

一款综合性网络安全检测和运维工具，旨在快速资产发现、识别、检测，构建基础资产信息库，协助甲方安全团队或者安全运维人员有效侦察和检索资产，发现存在的薄弱点和攻击面。

Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹20000+，暴力破解协议10余种。

An advanced web directory & file scanning tool that will be more powerful than DirBuster, Dirsearch, cansina, and Yu Jian.一个高级web目录、文件扫描工具，功能将会强于DirBuster、Dirsearch、cansina、御剑。

A multifunctional Android RAT with GUI based Web Panel without port forwarding.

A Simple android remote administration tool using sockets. It uses java on the client side and python on the server side

WiFi密码暴力破解工具-图形界面，支持WPA/WPA2/WPA3、多开并发、自动破解、自定义密码本、自动生成密码字典

L3MON is a web-based Remote Administration Tool ( android-RAT ) for managing Android devices via a secure Node.js dashboard. Supports real-time monitoring, data extraction, and remote control for e…

【三万字原创】完全零基础从0到1掌握Java内存马，公众号：追梦信安

专为CTF设计的Jinja2 SSTI全自动绕WAF脚本 | A Jinja2 SSTI cracker for bypassing WAF, designed for CTF

渗透测试：微信小程序信息在线收集，wxapkg源码包内提取信息

VADER Sentiment Analysis. VADER (Valence Aware Dictionary and sEntiment Reasoner) is a lexicon and rule-based sentiment analysis tool that is specifically attuned to sentiments expressed in social …

新浪微博爬虫，用python爬取新浪微博数据，并下载微博图片和微博视频

🕵️‍♂️ Collect a dossier on a person by username from thousands of sites

An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a user's followers, following, Tweets and more while evading most API limitations.

一个基于Django的渗透测试平台

CVE-2025-30208-EXP

针对Navicat的后渗透利用框架

备份的漏洞库，3月开始我们来维护

一个2023届毕业生在毕业前持续更新、收集的安全岗面试题及面试经验分享~

✅ No execution ✅ Pyarmor 8.0 - 9.1.9 ✅ Universal ✅ Statically convert obfuscated Python scripts to disassembly and (experimentally) source code.

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

收集整理漏洞EXP/POC,大部分漏洞来源网络，目前收集整理了900多个poc/exp，长期更新。

👻Stowaway -- Multi-hop Proxy Tool for pentesters

基于Memprocfs和Volatility的可视化内存取证工具

Crawler (Bot) searching for credential leaks on paste sites.

Cortex: a Powerful Observable Analysis and Active Response Engine

holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.