| 1 | AC Scanner - QubitAC Automated Post-Quantum Cryptography Discovery Tool | Cryptography | New Tool | Scans TLS endpoints and SSH services for post-quantum readiness against NIST PQC standards and emits a Cryptographic Bill of Materials (CBOM). | qubitac/AC-Scanner | | 2 | AD Miner – One step further applying graph theory for Active Directory security analysis | Risks | Major Update | Applies graph theory to BloodHound data to turn raw Active Directory graphs into prioritized, ranked findings and remediation paths. | AD-Security/AD_Miner | | 3 | AgentsLeak: Runtime Protection for AI Coding Agents | AI, ML & Data Science | New Tool | Runtime security platform hooking Claude Code and Cursor to enforce policy on file, network, process and command actions before they execute. | IngaCherny/AgentsLeak | | 4 | AI Attack & Defence Wargame: The Insurance Company Edition | Arsenal Lab, AI | Major Update | Live adversarial wargame: each player hardens their own LLM insurance chatbot against prompt injection and exfiltration while attacking everyone else's. | — live wargame on the SecDim platform | | 5 | AI Security Playground | Arsenal Lab, AI | New Tool | Hands-on workshop covering real-world attacks against LLMs, AI agents and MCP servers, beginner through advanced. | — workshop; no repo | | 6 | Anthropic-Cybersecurity-Skills | Arsenal Lab, AI | Minor Update | 734 open-source agent skills across 37 security subdomains, mapping 127+ MITRE ATT&CK techniques with 1,000+ runnable scripts. | mukul975/Anthropic-Cybersecurity-Skills | | 7 | APTL: Advanced Purple Team Labs | Arsenal Lab, Exploitation | New Tool | Docker-based purple team lab with an open-source SOC stack, MCP servers and a scenario system for running red and blue AI agents against each other. | Brad-Edwards/aptl | | 8 | ARAY: Benign Binary Synthesis for Signature Validation Without the Malware | Malware | New Tool | Generates benign ELF/PE binaries matching a given YARA rule via a nine-node LangGraph LLM pipeline, to validate detections without live malware. | — no repo confirmed | | 9 | Azazel-Edge : Deterministic Edge Decision Support for Constrained SOC/NOC Operations | Network | New Tool | Deterministic edge decision appliance (Raspberry Pi) scoring NOC reliability and SOC threat context separately for small, constrained networks. | 01rabbit/Azazel-Edge | | 10 | BadZure: Building Cloud Attack Labs with AI | Cloud Security | Major Update | Describe an attack scenario in natural language and BadZure provisions a matching misconfigured Entra ID / Azure tenant with traversable attack paths. | mvelazc0/BadZure | | 11 | Bastet: An Infrastructure for Benchmarking LLM Smart Contract Auditing | AI, ML & Data Science | Major Update | Benchmark dataset of real-world DeFi smart contract vulnerabilities plus an AI detection pipeline for bugs static analyzers miss. | OneSavieLabs/Bastet | | 12 | Bedrock Keys Security (BKS): Hunting Phantom IAM Users Created by AWS Bedrock API Keys | Cloud Security | New Tool | Decodes AWS Bedrock API keys (base64 bearer tokens) and hunts the phantom IAM users AWS provisions behind them and never cleans up. | BeyondTrust/bedrock-keys-security | | 13 | Brutus: Modern Multi-Protocol Credential Testing in Go | Exploitation | New Tool | Zero-dependency Go replacement for THC Hydra: credential testing across SSH, MySQL, Postgres, Redis, MongoDB and SMB. | praetorian-inc/brutus | | 14 | capa: Beyond Disassembly: Dynamic Matching for Static Blindspots | Malware | Major Update | FLARE's capability identification tool, now applying its rule engine to dynamic execution traces to cover packed, obfuscated, Rust and Go binaries. | mandiant/capa | | 15 | Chameleon Forensics (Android): Assume Adversarial Logical Extraction Forensic Tool | Digital Forensics | New Tool | Android logical extraction built on the assumption the device is adversarial and actively disrupting forensic acquisition. | Ins1ght32/Chameleon-Forensics-Android | | 16 | Chef Special: Updates to CSTC - CyberChef-inspired Message Transformator in BurpSuite | Arsenal Lab, Vuln Assessment | Major Update | CyberChef-style recipe engine inside Burp Suite: transformation chains applied automatically to outgoing and incoming HTTP traffic. | usdAG/cstc | | 17 | Cleric: ETW Sandbox and Memory Scanner | Malware | New Tool | Windows malware analysis framework combining a C++ memory scanner (15 detection techniques), ETW sandboxing and runtime process inspection. | — no repo confirmed | | 18 | CLOAK : Cloud Testing Agent Harness | Cloud Security | Major Update | AI red team agent for cloud assessments using "Dual Output Rendering" so ARNs, account IDs and resource names never enter the model's context window. | — no repo confirmed | | 19 | Command Line Threat Analyzer | Threat Hunting & IR | New Tool | Cross-platform detector reconstructing whole attack sequences from command line activity rather than flagging isolated commands. | — no repo confirmed | | 20 | ConfigManBearPig - Identify, Visualize, and Navigate SCCM Attack Paths in BloodHound | Exploitation | Major Update |
From a low-privileged AD context, collects SCCM/ConfigMgr data and maps every Misconfiguration Manager TAKEOVER, ELEVATE and CRED path into BloodHound. |
[SpecterOps/ConfigManBearPig](https://github.com/SpecterOps/ConfigManBearPig) |
| 21 |
Continuous Threat Modeling in Agentic AI era - tmdd |
Code Assessment |
New Tool |
Threat Modeling Driven Development: an AI agent infers components and data flows from code and emits a version-controlled YAML threat model reviewed via PRs. |
attasec/tmdd |
| 22 |
CrowdSentinel: AI-Orchestrated Threat Hunting Across Unified Security Data Sources |
Threat Hunting & IR |
New Tool |
MCP-based threat hunting orchestrator unifying Elasticsearch, Wireshark, Chainsaw and 5,049 detection rules behind one natural-language endpoint. |
thomasxm/CrowdSentinels-AI-MCP |
| 23 |
CyberArkHound |
Exploitation |
— |
Go tool exporting CyberArk PVWA data (users, safes, accounts, permissions) into BloodHound OpenGraph so PAM privilege paths sit alongside AD ones. |
jazofra/CyberArkHound |
| 24 |
Dradis Framework: Intelligent Automation for collaboration and reporting |
OSINT |
Major Update |
Collaboration and reporting portal ingesting 47+ scanners, with bring-your-own-LLM assistance (Dradis Echo) that stays on your own infrastructure. |
dradis/dradis-ce |
| 25 |
EMBA – The product security analysis framework |
Arsenal Lab, IoT |
Major Update |
The firmware security analyzer for IoT/ICS/OT: automated static and dynamic analysis of embedded Linux firmware images end to end. |
e-m-b-a/emba |
| 26 |
EMBArk – Firmware Analysis for the Enterprise |
Vulnerability Assessment |
Major Update |
Web-based enterprise front end for EMBA — orchestrate, compare and manage firmware analyses across a product portfolio and supply chain. |
e-m-b-a/embark |
| 27 |
Emulate cloud-native attacks with Stratus Red Team |
Cloud Security |
Minor Update |
Granular, self-contained adversary emulation for AWS, Azure, GCP, Entra ID and Kubernetes to validate that cloud threat detections fire. |
DataDog/stratus-red-team |
| 28 |
FAInd my XPC: Automated Discovery of Privilege Escalation via macOS XPC Trust Boundaries - powered by LLM |
Exploitation |
New Tool |
Automated macOS XPC attack-surface discovery: static binary analysis plus runtime enumeration and LLM semantic scoring to find privesc across installed apps. |
— no repo confirmed |
| 29 |
fetter |
Vulnerability Assessment |
Major Update |
System-wide Python package discovery, validation and allow-listing — what is actually installed, rather than what the manifest claims. |
fetter-io/fetter-rs |
| 30 |
findmytakeover - find dangling domains in a multi cloud environment |
Cloud Security |
Major Update |
Finds dangling DNS records across multi-cloud, multi-account estates by comparing live DNS zones against actual infrastructure — no wordlists or brute force. |
anirudhbiyani/findmytakeover |
| 31 |
From Breakthrough to Completeness: arkdecompiler - The Decompiler for HarmonyOS NEXT |
Reverse Engineering |
Major Update |
Decompiler for Huawei HarmonyOS NEXT, targeting the Ark bytecode execution environment outside the Android/AOSP toolchain. |
jd-opensource/arkdecompiler |
| 32 |
Ghost in the IDE |
Exploitation |
Major Update |
Research into the IDE plugin ecosystem as an attack surface across JetBrains IntelliJ, VS Code and Eclipse. |
— no repo confirmed |
| 33 |
Ghostwriter |
Exploitation |
Major Update |
Offensive-ops platform for report writing, reusable findings libraries, client management and red team infrastructure tracking. |
GhostManager/Ghostwriter |
| 34 |
GolemHalt: A Deterministic Reference Monitor for AI Coding Agents |
AI, ML & Data Science |
New Tool |
Deterministic boundaries for AI coding agents against prompt injection, exfiltration and destructive actions. |
— no repo confirmed |
| 35 |
Hecate: a trivial UART tool |
Arsenal Lab |
Minor Update |
Turns any CircuitPython-compatible microcontroller into a customizable UART implant for sniffing and interposing on serial links. |
tigard-tools/hecate |
| 36 |
HoneyMCP: A Deception Security Layer for MCP Servers |
AI, ML & Data Science |
New Tool |
Deception layer for MCP servers: plants LLM-generated decoy tools that emit telemetry on exfiltration or indirect prompt injection attempts. |
barvhaim/HoneyMCP |
| 37 |
ICSForge™: OT/ICS Security Coverage Validation Platform |
Smart Grid/Industrial |
New Tool |
Generates realistic OT traffic and PCAPs across 500+ scenarios in 10 industrial protocols (Modbus/TCP, DNP3, S7comm, IEC-104, OPC UA). |
ICSForge/ICSForge |
| 38 |
INFLEX: Cross-Format Malware Analysis and Correlation Framework |
Malware |
New Tool |
Correlates PE, ELF, shellcode and malicious documents in one workflow through static analysis, emulation, sandboxing and threat intel enrichment. |
— no repo confirmed |
| 39 |
Intercept.js: Context-Aware YARA for Runtime Detection In JavaScript Environments |
Malware |
New Tool |
Context-aware YARA matching inside JavaScript runtimes — browsers, email clients, Office add-ins — where payloads exist only as in-memory buffers. |
rishi-sekantsec/sekant-intercept-js |
| 40 |
JS-Tap v3: JavaScript Post-Exploitation Moves to the Endpoint |
Exploitation |
Major Update |
JavaScript C2 extended past the web app to the endpoint, with implants for browser extensions, Electron desktop apps and Node.js CLI tools. |
hoodoer/JS-Tap |
| 41 |
KEIP: Kernel-Enforced Install-Time Policies |
Malware |
New Tool |
eBPF/LSM kernel hooks intercepting and blocking malicious network activity during pip install — supply-chain defense at package install time. |
Otsmane-Ahmed/KEIP |
| 42 |
Keychecker : SSH Key based attack tool for DVCS Systems |
Vulnerability Assessment |
Minor Update |
Fingerprints a found SSH private key and determines which Git hosting accounts it unlocks, via safe handshakes and read-only git ls-remote probes. |
cyfinoid/keychecker |
| 43 |
LLM Hacking 101 |
Arsenal Lab, AI |
New Tool |
Two-hour hands-on lab progressing from jailbreak development to guardrail bypass and direct/indirect prompt injection against agentic systems. |
RootInj3c/LLM-Playground |
| 44 |
LogonTracer v2: Faster Malicious Windows Logon Investigations with AI Agent |
Threat Hunting & IR |
Major Update |
Visualizes Windows authentication events as a user/host graph, now with an AI agent to speed triage of malicious logons in noisy event data. |
JPCERTCC/LogonTracer |
| 45 |
LoRaCraft – Crafting Attacks for LoRaWAN Networks |
Internet of Things |
New Tool |
LoRaWAN security assessment framework covering the full protocol stack — join request replay, RF-layer testing and target fingerprinting. |
pinarsadioglu/loracraft |
| 46 |
MachStealer: One Pipeline Behind Every macOS Infostealer |
Malware |
New Tool |
Reproduces the shared macOS infostealer pipeline (Keychain extraction, PBKDF2 derivation, SQLite copy, AES decrypt) behind AMOS, Poseidon, Banshee and Cuckoo. |
ultra-supara/MachStealer |
| 47 |
MCParasite: Universal MCP Worm Security Testing Framework |
AI, ML & Data Science |
New Tool |
Chains prompt injection and tool poisoning into a self-propagating worm inside MCP — poisoning lands at connection time, before user interaction. |
MCParasite/mcparasite |
| 48 |
Mecha Hayabusa by Yamato Security |
Digital Forensics |
New Tool |
MCP server Hayabusa timelines into DuckDB and exposing them to an LLM for natural-language Windows event log DFIR. |
Yamato-Security/mecha-hayabusa |
| 49 |
Medaudit, an AI assisted Tool for Auditing Hospital Networks and Pentesting Medical Devices |
Smart Grid/Industrial |
Major Update |
Audits medical device network traffic (HL7 focus) for unencrypted transmissions and PHI/PII exposure, with fuzzing and AI-assisted triage. |
anirudhduggal/medaudit |
| 50 |
MEM-SBOM: Runtime SBOM Generation from Python Process Memory |
Digital Forensics |
New Tool |
Generates SBOMs from live Python process memory rather than build manifests, catching dynamically loaded modules static tooling misses. |
HalaAli198/MEM-SBOM |
| 51 |
MLOKit: MLOps Attack Toolkit |
Exploitation |
Major Update |
C# toolkit attacking MLOps platforms (Azure ML, SageMaker, Vertex AI, MLflow, BigML, Palantir AIP) via their REST APIs. |
h4wkst3r/MLOKit |
| 52 |
MORF - Mobile Reconnaissance Framework |
OSINT |
Major Update |
Automatically discovers secrets and sensitive information inside Android and iOS application packages. |
amrudesh1/morf |
| 53 |
MSCodePhish - Dynamic Device Code Phishing Framework |
Exploitation |
New Tool |
Turns Microsoft Device Code OAuth into an embeddable phishing primitive — codes minted on click via an API, defeating the 15-minute timeout race. |
TROUBLE-1/MSCodePhish |
| 54 |
MSSQLHound - Identify, Visualize, and Navigate MSSQL Attack Paths in BloodHound |
Exploitation |
Major Update |
Enumerates MSSQL principals and permissions at domain, server and database level and maps abusable paths into the BloodHound graph. |
SpecterOps/MSSQLHound |
| 55 |
Nemesis 2.2 |
AI, ML & Data Science |
Major Update |
Centralized enrichment pipeline for files collected on offensive engagements; 2.2 adds ingestion of full disk images and large forensic containers. |
SpecterOps/Nemesis |
| 56 |
Nogitsune: eBPF-Based Anti-VM Detection for Linux Malware Analysis |
Malware |
New Tool |
First eBPF-based anti-VM detection toolkit for Linux — hides the analysis VM from malware without patching QEMU or rebuilding SeaBIOS. |
sumukhchitloor/nogitsune |
| 57 |
notyet: Automated IAM Persistence Analysis Through AWS Eventual Consistency Abuse |
Cloud Security |
New Tool |
Abuses the propagation delay in AWS IAM's eventual consistency to keep using credentials responders believe they revoked. |
OFFENSAI/notyet |
| 58 |
Obscurize: Malware for Defense and Counter Offense |
Malware |
New Tool |
Repurposes rootkit environment-enumeration techniques (BIOS strings, MAC OUI, RAM size, process lists) into a defensive and offensive tool. |
— no repo confirmed |
| 59 |
OWASP EKS Goat: Hands-On AWS EKS Security |
Cloud Security |
Major Update |
Intentionally vulnerable AWS EKS cluster for hands-on learning: supply chain compromise, ECR/EKS abuse and RBAC misconfiguration scenarios. |
— no repo confirmed |
| 60 |
OWASP Faction 2.0 |
Vulnerability Assessment |
Major Update |
Ground-up rebuild of the pentest assessment and reporting platform, adding AI-assisted report writing, a CLI integration framework and app inventory. |
factionsecurity/faction |
| 61 |
Pathrunner: An AWS Privilege Escalation Framework |
Cloud Security |
Major Update |
Modular AWS IAM privilege escalation framework automating the paths documented at pathfinding.cloud. |
DataDog/pathrunner |
| 62 |
Pentest Copilot V2: The Agentic Pentesting Workspace |
Exploitation |
Major Update |
AI-native browser-based workspace unifying recon, exploitation support, scripting and web testing. |
— no repo confirmed |
| 63 |
Pentesting made easy - Keeping sessions alive with session-chains |
WebAppSec |
New Tool |
Keeps multiple authenticated web sessions alive across users, roles and tenants so scanners and exploitation tools stop breaking on short-lived sessions and MFA. |
— no repo confirmed |
| 64 |
PETriage: Cross-Platform PE Surface Analysis for Malware Triage |
Malware |
New Tool |
Symbol-unified PE reader bringing PEStudio/CFF Explorer-style triage to Linux and macOS hosts. |
uky007/PETriage |
| 65 |
Practical Ransomware Detection on macOS (via Math, not AI) |
Malware |
Major Update |
Math-driven, explicitly not ML, generic macOS ransomware detection keyed on the rapid file-encryption behaviour common to nearly every variant. |
— no repo confirmed |
| 66 |
Praxis - Semantic Command & Control Framework |
AI, ML & Data Science |
Minor Update |
Adversarial C2 for discovering and driving AI computer-use agents (Claude, Codex, Cursor) already running on endpoints. |
— no repo confirmed |
| 67 |
Precogly: Open Source Threat Modeling for AI-Assisted Security |
WebAppSec |
New Tool |
Open-source threat modeling: DFD editor, community threat libraries, LINDDUN/CAPEC/ATT&CK taxonomies and PCI-DSS/NIST mappings, with AI hooks. |
precogly/precogly |
| 68 |
PrivacyTrollShield: An Open-Source Scanner for Privacy Compliance |
Privacy |
New Tool |
Scans public sites for the tracking behaviours behind CIPA wiretapping suits — session replay before consent, Meta Pixel form capture, dead Decline buttons. |
atekippe/PrivacyTrollShield |
| 69 |
PwnSat 2.0: The Vulnerable Satellite Hacking Platform for Learning Through Research |
Exploitation |
Major Update |
Vulnerable-by-design satellite platform for aerospace security research; 2.0 adds enterprise mission-control integration beyond 1.0's RF attack focus. |
— no repo confirmed |
| 70 |
pymsi - Interactive MSI Installer Analysis in Python and the Browser |
Code Assessment |
Major Update |
Pure Python MSI parser exposing installer database tables and embedded streams, plus a fully client-side lessmsi-style browser UI. |
nightlark/pymsi |
| 71 |
QuicDraw & QuicDraw-UI: Racing and Fuzzing HTTP/3 |
WebAppSec |
Major Update |
Fuzzes and race-tests HTTP/3 servers over QUIC using "Quic-Fin-Sync" for high-speed single-packet race conditions. Apache-2.0. |
cyberark/QuicDrawH3 |
| 72 |
ReARM: Release Governance Platform |
Vulnerability Assessment |
Major Update |
DevSecOps release governance: an SBOM/xBOM repository and evidence store tracking releases with their bills of materials and security findings. |
relizaio/rearm |
| 73 |
RedTeamSimmer: A Web Based Adversary Emulation Platform and Atomic Red Team Test Orchestration |
AI, ML & Data Science |
— |
Flask-based web UI for orchestrating Atomic Red Team tests across enterprise Windows estates, handling prerequisites and centralizing results. |
BreachSimRange/RedTeamSimmer |
| 74 |
ROP ROCKET: New ASLR Bypass Mini-Tool & Automating Advanced ROP Attacks |
Exploitation |
Major Update |
Windows code-reuse framework; adds a mini-tool generating nine automated bypasses for 64-bit high-entropy ASLR with complete x64 ROP chains. |
Bw3ll/ROP_ROCKET |
| 75 |
RPCExplorer |
Reverse Engineering |
New Tool |
Research toolkit for mapping and probing the Windows RPC attack surface at scale — turning an interface UUID into what it does and how to test it. |
— no repo confirmed |
| 76 |
SafeScribe - Edge Device AI Meeting Notetaker |
Hardware/Embedded |
New Tool |
Privacy-first desk device generating meeting notes entirely locally and delivering them as a PDF. |
— no repo confirmed |
| 77 |
Sage: Giving an AI the Keys to Your C2 Framework |
AI, ML & Data Science |
New Tool |
Virtual Mythic agent running on the C2 server rather than the target — a multi-agent AI operator that enumerates callbacks and tasks real agents. |
MythicAgents/sage |
| 78 |
SBoMPlay : SBoM Exploration and Intelligence extraction platform |
Code Assessment |
Major Update |
Browser-based, privacy-preserving SBOM exploration — query dependency data locally instead of up it to a heavyweight platform. |
cyfinoid/sbomplay |
| 79 |
SEmuRAI: Software Emulation and Reversing AI Agent |
Reverse Engineering |
New Tool |
Agentic reverse engineering: LLM-driven emulation and analysis of obfuscated or large binaries where compilation stripped the context. |
DevNerdGR/SEmuRAI-mcp |
| 80 |
ShadowHunt 2.0: Uncovering Shadow IT and Hidden Secrets |
OSINT |
— |
Maps Shadow IT on public repos — company code pushed to employees' personal GitHub, Docker Hub and Helm accounts — and the secrets left in it. |
Research-Nautilus/ShadowHunt |
| 81 |
SHAREM: Next-Generation Shellcode Analysis Tool |
Reverse Engineering |
Major Update |
NSA-funded shellcode analysis framework emulating 45,000+ WinAPIs and Windows syscalls to defeat dynamic API resolution and self-unpacking. |
Bw3ll/sharem |
| 82 |
ShellWasp: Creating Shellcode with Windows Syscalls |
Exploitation |
Major Update |
Builds shellcode using Windows syscalls directly, solving the SSN-drift and Wow64 portability problems that break syscall shellcode across OS builds. |
Bw3ll/ShellWasp |
| 83 |
Social Engineering with Reel |
Exploitation |
New Tool |
Workflow-driven phishing framework with credential capture, optional real-time MFA relay, email sending and a plugin system. |
trustedsec/Reel |
| 84 |
Splunk MCP LLM SIEMulator: Open Source AI Security Monitoring Through MCP Integration |
AI, ML & Data Science |
Major Update |
Bridges local LLM deployments to Splunk over MCP, giving SIEM visibility into prompt injection, jailbreak attempts and shadow AI usage. |
rsfl/splunk-mcp-llm-siemulator |
| 85 |
StegoScan |
Digital Forensics |
— |
Automated steganography detection across file types. |
LCBOWER33/StegoScan |
| 86 |
Surfactant - Modular Framework for File Information Extraction and SBOM Generation |
Code Assessment |
Major Update |
LLNL's modular framework extracting software metadata from filesystems to identify components, vendors and third-party libraries and build SBOMs. |
llnl/Surfactant |
| 87 |
Suricata 8: Discover the Difference in Network Detection |
Threat Hunting & IR |
Major Update |
The open-source IDS/IPS and network security monitor — this session covers what is new in the Suricata 8 release. |
OISF/suricata |
| 88 |
Suricata Turbo: Let Your NIC Drop the Flows Suricata Won't Miss |
Network |
Major Update |
Adds hardware traffic-filtering offload so the NIC drops uninteresting flows, stopping random packet loss when Suricata cannot keep up. |
DynaNIC/suricata-turbo |
| 89 |
Suzaku by Yamato Security |
Digital Forensics |
Major Update |
Rust, Sigma-based threat hunting and DFIR timeline generator for cloud logs — Hayabusa's approach applied to JSON/JSON.gz at scale. |
Yamato-Security/suzaku |
| 90 |
Tengu Marauder Vanguard Version 2.0 |
Arsenal Lab, Hardware |
Major Update |
Raspberry Pi 5 robotic platform for physical red teaming and wireless assessment, with multiple units managed from a single Flask interface. |
Lexicon121/Tengu-Marauder-Vanguard |
| 91 |
The Metasploit Framework 6.5: Malleable C2 Payloads, New Relay Capability and Protocol Session Upgrades |
Exploitation |
Minor Update |
Metasploit 6.5: Malleable C2 profiles for HTTP Meterpreter, HTTP-to-SMB and HTTP-to-LDAP relaying, and protocol session upgrades. |
rapid7/metasploit-framework |
| 92 |
ThreatShield - The Intelligent Way of Threat Modelling |
Arsenal Lab, AI |
— |
Turns PRDs, architecture diagrams, Confluence pages, Slack threads and transcripts into STRIDE/PASTA threat models, attack trees, DREAD scores and ASVS tests. |
— no repo confirmed |
| 93 |
ThreatXtension: AI-Powered Browser Extension Security Analysis Framework |
Vulnerability Assessment |
New Tool |
Chrome extension security analysis combining SAST with LLM threat intelligence to assess permission risk and detect obfuscated malicious patterns. |
barvhaim/ThreatXtension |
| 94 |
Trajan: Cross-Platform CI/CD Security Scanner |
Exploitation |
New Tool |
One scanner across GitHub Actions, Azure DevOps, GitLab and Jenkins, replacing the per-platform tooling patchwork. |
praetorian-inc/trajan |
| 95 |
TSURUGI LINUX - the sharpest weapon in your DFIR arsenal |
Digital Forensics |
New Tool |
DFIR-focused Linux distribution shipping a curated, ready-to-use forensics toolset. |
— not on GitHub; tsurugi-linux.org |
| 96 |
unrelabel: how to destroy an ML model |
AI, ML & Data Science |
New Tool |
Interactive toolkit demonstrating label-poisoning attacks: import a dataset, pick an attack, and watch a classifier degrade from accurate to useless. |
oz9un/unrelabel |
| 97 |
Vulnhalla 2.0: LLM-Guided Triage of CodeQL Findings |
Code Assessment |
Major Update |
Runs CodeQL at scale and uses an LLM agent to triage findings true/false positive, with fast CSV-based context extraction and a reasoning engine. |
cyberark/Vulnhalla |
| 98 |
VulnZoo: A Complete Vulnerable IoT Ecosystem for Security Research and Training |
Internet of Things |
New Tool |
Vulnerable IoT ecosystem modelling a whole product — firmware, mobile app and cloud services — so cross-component attack chains can be studied. |
DEKRA-Cybersecurity/VulnZoo |
| 99 |
WaffleX: Adaptive Semantic Analysis for WAF Resilience Testing |
WebAppSec |
New Tool |
Generates semantically equivalent request variants to expose normalization gaps and parser inconsistencies between CDNs, proxies, WAFs and origin apps. |
— no repo confirmed |
| 100 |
WebAgentAudit: Security Auditing of Web-Based AI Agents Through Browser Automation |
Vulnerability Assessment |
New Tool |
Audits web-only AI agents (embedded chatbots and LLM widgets) through browser automation, requiring no API access to the model under test. |
atom41research/webagentaudit |
| 101 |
xEndity |
Internet of Things |
New Tool |
Emulated digital twins of IoT devices, so teams can test hardware they cannot physically obtain or safely attack in production. |
kenleejl/xEndityv2 |