Jason Ostrom

open-trajectory-gym. Agentic RL post-training framework

SecureState. CIS Benchmark Automation for Windows

cai. Cybersecurity AI (CAI), the framework for AI Security

Cyber-AutoAgent. AI agent for autonomous cyber operations

ai-workshop. Collection of Jupyter Lab notebooks to help learn Generative AI

llm-security-scanner. LLM-Powered Code Security Scanning

paas-cloud-goat. PaaS Cloud Goat is a simulated vulnerable Salesforce application providing hands-on experience with penetration testing of custom Salesforce applications.

hashcrack-ai. bowing to the AI Overlords.

Nebula. Nebula is a cloud C2 Framework, which at the moment offers reconnaissance, enumeration, exploitation, post exploitation on AWS, but still working to allow testing other Cloud Providers and DevOps Components.

tracecat. Open-source security automation platform for teams and AI agents

Awesome-GPT-Agents. A curated list of GPT agents for cybersecurity

CMLab. Configuration Management (CM) Security Playground. A small enterprise security lab to practice automation + CM tooling like Ansible, Chef, Puppet, SaltStack, DSCv2, DSCv3.

concierge. Repo for Concierge AI dev work

Fabric. Fabric is an open-source framework for augmenting humans using AI. It provides a modular system for solving specific problems using a crowdsourced set of AI prompts that can be used anywhere.

FalconHound. FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool.

awesome-security-ce. Awesome List of Enterprise Security Tools' Community Edition

awesome. 😎 Awesome lists about all kinds of interesting topics

AutomatedEmulation. An automated Adversary Emulation lab with terraform and MCP server. Build Caldera techniques and operations assisted with LLMs. Built for IaC stability, consistency, and speed.

Awesome-CloudSec-Labs. Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

AutoRecon. AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services.

textgen. Open-source desktop app for local LLMs. Text, vision, tool-calling, OpenAI/Anthropic-compatible API. 100% private.

derf. DeRF (Detection Replay Framework) is an "Attacks As A Service" framework, allowing the emulation of offensive techniques and generation of repeatable detection samples in the cloud. Built on Google Workflows

jsluice. Extract URLs, paths, secrets, and other interesting bits from JavaScript

pen-testing-findings. A collection of Active Directory, phishing, mobile technology, system, service, web application, and wireless technology weaknesses that may be discovered during a penetration test.

CloudPrivs. Determine privileges from cloud credentials via brute-force testing.

workshop1_deploy. SANS fire Workshop 1 Deployment

BadZure. BadZure automates the deployment of intentionally misconfigured Entra ID tenants and Azure subscriptions, populating them with diverse entities and configurable, traversable attack paths.

CodePipeline-Poisoning-Tester. Python

guidance. A guidance language for controlling large language models.

azure-iac-workshop-content. Public repository to provide guidance and examples for people to start learning IaC. This repository also contains some open-hack style labs and labs used in Microsoft workshops.

CS-Remote-OPs-BOF. Remote operations commands implemented using Beacon Object Files

AutoGPT. AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.

PentestGPT. Automated Penetration Testing Agentic Framework Powered by Large Language Models

secrets-patterns-db. Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.

RedNimbusC2. A serverless C2 framework

awesome-api-security. A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.

matano. Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

azureOutlookC2. Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Microsoft Graph API for C2 Operations.

Awesome-Azure-Pentest. A collection of resources, tools and more for penetration testing and securing Microsofts cloud platform Azure.

csp_security_mistakes. This repo has been replaced by https://www.cloudvulndb.org

edge. Whois for the Cloud: Recon tool for cloud provider attribution. Supports AWS, Azure, Google, Cloudflare, and Digital Ocean.

OffensiveNim. My experiments in weaponizing Nim (https://nim-lang.org/)

Probable-Wordlists. Version 2 is live! Wordlists sorted by probability originally created for password generation and testing - make sure your passwords aren't popular!

awesome-aws-security. Curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are related to AWS Security

Spray365. Spray365 makes spraying Microsoft accounts (Office 365 / Azure AD) easy through its customizable two-step password spraying approach. The built-in execution plan features options that attempt to bypass Azure Smart Lockout and insecure conditional access policies.

smogcloud. Find cloud assets that no one wants exposed 🔎 ☁️

bicep. Bicep is a declarative language for describing and deploying Azure resources

gitoops. all paths lead to clouds

lite-idp. Lightweight SAML Identity Provider

go-discover. Discover nodes in cloud environments

RIP.

GHOSTS. GHOSTS (General Human-Oriented Synthetic Teammates and Systems) is a realistic user simulation framework for cyber experimentation, simulation, training, and exercise

kubescape. Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

phish_oauth. POC code to explore phishing attacks using OAuth 2.0 authorization flows, such as the device authorization grant.

Cloud-Katana. Unlocking Serverless Computing to Assess Security Controls

chisel. A fast TCP/UDP tunnel over HTTP

axiom. The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!

awesome-wordlists. A curated list of wordlists for bruteforcing and fuzzing

aws-incident-response-playbooks.

cloud_enum. Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

awesome-k8s-security. A curated list for Awesome Kubernetes Security resources

WitnessMe. Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.

CloudBrute. Awesome cloud enumerator

Skadi. Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

timesketch. Collaborative forensic timeline analysis

kubestriker. A Blazing fast Security Auditing tool for Kubernetes

CHIRP. A DFIR tool written in Python.

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

CatMyPhish. Search for categorized domain

Red-Team-Infrastructure-Wiki. Wiki to collect Red Team infrastructure hardening resources

Red-Team-Infrastructure-Automation. Disposable and resilient red team infrastructure with Terraform

Mandiant-Azure-AD-Investigator. PowerShell

MicroBurst. A collection of scripts for assessing Microsoft Azure security

APT-Lab-Terraform. Purple Teaming Attack & Hunt Lab - Terraform

ScareCrow. ScareCrow - Payload creation framework designed around EDR bypass.

amazon-ec2-metadata-mock. A tool to simulate Amazon EC2 instance metadata

Red-Terroir. Terraform resources for building HTTP, DNS, phishing, and mail server red team infrastructure

Mitigating-Web-Shells. Guidance for mitigation web shells. #nsacyber

basicblobfinder. Identify Azure blobs using a wordlist of account name and container name strings

clair. Vulnerability Static Analysis for Containers

ConMachi. Container Blackbox Security Auditing Tool: enumerates security configuration from within the target container

red-kube. Red Team K8S Adversary Emulation Based on kubectl

kops. Kubernetes Operations (kOps) - Production Grade k8s Installation, Upgrades and Management

C3. Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

MFASweep. A tool for checking if MFA is enabled on multiple Microsoft Services

o365-attack-toolkit. A toolkit to attack Office365

pupy. Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

awesome-azure-security. A curated list of awesome Microsoft Azure Security tools, guides, blogs, and other resources.

jarm. Python

opencspm. Open Cloud Security Posture Management Engine

my-arsenal-of-aws-security-tools. List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

SimuLand. Cloud Templates and scripts to deploy mordor environments

blue-teaming-with-kql. Repository with Sample KQL Query examples for Threat Hunting

kubernetes-the-hard-way. Bootstrap Kubernetes the hard way. No scripts.

k8s-sample-apps. Kubernetes application example tutorials

openedr. Open EDR public repository

herpaderping. Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

gitjacker. 🔪 :octocat: Leak git repositories from misconfigured websites

cloudiscovery. The tool to help you discover resources in the cloud environment

CACTUSTORCH. CACTUSTORCH: Payload Generation for Adversary Simulations

lazydocker. The lazier way to manage everything docker

WhatBreach. OSINT tool to find breached emails, databases, pastes, and relevant information

kubernetes-goat. Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

Velociraptor_Azure. A collection of Terraform and Ansible scripts that automatically (and quickly) deploys a small Velociraptor R&D lab.

luckystrike. A PowerShell based utility for the creation of malicious Office macro documents.

DeimosC2. DeimosC2 is a Golang command and control framework for post-exploitation.

Noctilucent. Using TLS 1.3 to evade censors, bypass network defenses, and blend in with the noise

PurpleSharp. PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

windows-event-forwarding. A repository for using windows event forwarding for incident detection and response

attack_range. A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk

EVTX-ATTACK-SAMPLES. Windows Events Attack Samples

CloudSec-Tools. Cloud Security Tools

AtomicPurpleTeam. Atomic Purple Team Framework and Lifecycle

pe_tree. Python module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump in-memory PE files and reconstruct imports.

statistically-likely-usernames. Wordlists for creating statistically likely username lists for use in password attacks and security testing. Used for pentesting for over 10 years with amazing results.

cloudsplaining. Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

user-security-stories. Repo to hold mapping of user-security-stories

project-fantastic. JavaScript

AriaCloud. A Docker container for remote penetration testing.

alerting-detection-strategy-framework. A framework for developing alerting and detection strategies for incident response.

AWSBucketDump. Security Tool to Look For Interesting Files in S3 Buckets

Red-Teaming-Toolkit. This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

voiphopper. VoIP Hopper Network Penetration Testing Tool - Jumping from one VLAN to the next! A network infrastructure penetration testing security tool. A tool to test for the (in)security of VLANS. It can mimic the behavior of IP Phones to better understand business risks within an IP Telephony network infrastructure. VoIP Hopper is included in Kali Linux. This site is for up-to-date code. Documentation website:

MDATP. MDATP

aws-incident-response. HCL

h4cker. This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org

dockerlabs. Docker - Beginners | Intermediate | Advanced

CyberRange. The Open-Source AWS Cyber Range

leonidas. Automated Attack Simulation in the Cloud, complete with detection use cases.

pptxindex. Create a MS Word index file from PowerPoint notes and slides

streamalert. StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.

PurpleCloud. A little tool to play with Azure Identity - Azure and Entra ID lab creation tool. Blog: https://medium.com/@iknowjason/sentinel-for-purple-teaming-183b7df7a2f4

CloudPentestCheatsheets. This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

DemoLab. A very simple lab to demo some Terraform, DSC, Inspec and Gitlab CI

BadBlood. BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

logstash-example. Demonstration logstash configuration using a docker-compose

hammer. An example of a mis-configured Rails application release under MIT license.