brightio

awesome-security. A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.

garak. the LLM vulnerability scanner

PentestingEverything. Complete Solution for VAPT/AppSec and Pentesting Guide: Web | Mobile | API | Thick Client | Source Code Review | DevSecOps | Wireless | Network Pentesting | SAST | DAST etc...

deploy-your-own-saas. List of "only yours" cloud services for everyday needs :black_flag:

OSWE. OSWE Preparation

Cybersecurity-Projects. Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified Cybersecurity learning 👇

OffByWon. Network Fuzzing Framework

Snaffler. a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )

OSCE3-Complete-Guide. OSWE, OSEP, OSED, OSEE

system_prompts_leaks. Extracted system prompts from Anthropic - Claude Fable 5, Opus 4.8, Claude Code, Claude Design. OpenAI - ChatGPT GPT-5.6, Codex GPT-5.6, GPT-5.5. Google - Gemini 3.5 Flash, 3.1 Pro, Antigravity. xAI - Grok, Cursor, Copilot, VS Code, Perplexity, and more. Updated regularly.

2FA-Bypass-Techniques. A comprehensive collection of various techniques and methods for bypassing Two-Factor Authentication (2FA) security mechanisms.

pentest-guide. Penetration tests guide based on OWASP including test cases, resources and examples.

Web-App-Pentest-Checklist. A OWASP Based Checklist With 500+ Test Cases

CredSpray. Multi-protocol credential validation tool with spray and no-spray modes for penetration testing.

PANIX. Customizable Linux Persistence Tool for Security Research and Detection Engineering.

PwnPad. PwnPad is an affordable, hands-on hardware hacking platform built for practical learning. It features a range of challenges that walk users through key hardware security concepts, from PCB design to side-channel attacks.

ShadowPhish. ShadowPhish is an advanced APT awareness toolkit designed to simulate real-world phishing, malware delivery, deepfakes, smishing/vishing, and command & control attacks through an intuitive graphical interface. Perfect for cybersecurity training, red team education, and security awareness programs.

MANSPIDER. Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content - regex supported!

DefaultCreds-cheat-sheet. One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

Active-Directory-Exploitation-Cheat-Sheet. A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

Red-Teaming-TTPs. Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike!

commix. Automated All-in-One OS Command Injection Exploitation Tool

Pentest-Resources-Cheat-Sheets. This repository contains a curated list of websites and repositories featuring pentest & red-team resources such as cheatsheets, write-ups, tools, techniques, programming/scripting notes, and more. I documented them in this repo to provide like-minded offensive security enthusiasts and professionals easy access to these valuable resources.

OffensiveRust. Rust Weaponization for Red Team Engagements.

malicious-pdf. 💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

PowerRunAsSystem. PowerRunAsSystem is a PowerShell script, also available as an installable module through the PowerShell Gallery, designed to impersonate the NT AUTHORITY/SYSTEM user and execute commands or launch interactive processes without relying on third-party tools. It achieves this using only native Windows build-in features.

trufflehog. Find, verify, and analyze leaked credentials

eviltree. A python3 remake of the classic "tree" command with the additional feature of searching for user provided keywords/regex in files, highlighting those that contain matches.

blog.quentinra.dev. This repository is a collection of notes, links, tutorials, and experiences aimed at helping others. If you find it useful, please consider giving it a star ⭐ to keep me motivated.

XLL_Phishing. XLL Phishing Tradecraft

PEASS-ng. PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

LaZagne. Credentials recovery project

what-happens-when. An attempt to answer the age old interview question "What happens when you type google.com into your browser and press enter?"

PentestTools. Awesome Pentest Tools Collection

computer-science. 🎓 Path to a free self-taught education in Computer Science!

ultimate-nmap-parser. parse nmap files

Advanced-SQL-Injection-Cheatsheet. A cheat sheet that contains advanced queries for SQL Injection of all types.

Infosec_Reference. An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

DDexec. Shell

traitor. :arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

static-binaries. Various *nix tools built as statically-linked binaries

oled-linux. OLED display support on Linux

gif-progress. 🎬 Attach progress bar to animated GIF

modern-unix. A collection of modern/faster/saner alternatives to common unix commands.

sh2bin. Go

HeidiSQL. A lightweight client for managing MariaDB, MySQL, SQL Server, PostgreSQL, SQLite, Interbase and Firebird, written in Delphi and Lazarus/FreePascal

CrackMapExec. A swiss army knife for pentesting networks

honeydoc. "Honey" document generator for beacon document tracking.

nuclei. Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

autorev.sh. Autorev.sh generates reverse shell codes for reverse shell . Supports linux and windows

AggressorScripts. Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

pe-sieve. Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

bmc_bladelogic. BMC Bladelogic RSCD exploits including remote code execution - CVE-2016-1542, CVE-2016-1543, CVE-2016-5063

redacterm. Edit terminal output ready for screenshots - highlight key areas and redact sensitive info.

RAU_crypto. Telerik UI for ASP.NET AJAX File upload and .NET deserialisation exploit (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)

dell-emc_recoverpoint. Exploits for Dell EMC RecoverPoint enterprise data protection platform

dp_crypto. Base64-based encryption oracle exploit for CVE-2017-9248 (Telerik UI for ASP.NET AJAX dialog handler)