# Black Hat USA 2026 Arsenal — all 101 tools with GitHub links

> Source: <https://gist.github.com/chris-rock/6f32859d48a4742e28344d6c729ff51e>
> Published: 2026-08-05 16:06:59+00:00

| 1 |
**AC Scanner - QubitAC Automated Post-Quantum Cryptography Discovery Tool** |
Cryptography |
New Tool |
Scans TLS endpoints and SSH services for post-quantum readiness against NIST PQC standards and emits a Cryptographic Bill of Materials (CBOM). |
[qubitac/AC-Scanner](https://github.com/qubitac/AC-Scanner) |
| 2 |
**AD Miner – One step further applying graph theory for Active Directory security analysis** |
Risks |
Major Update |
Applies graph theory to BloodHound data to turn raw Active Directory graphs into prioritized, ranked findings and remediation paths. |
[AD-Security/AD_Miner](https://github.com/AD-Security/AD_Miner) |
| 3 |
**AgentsLeak: Runtime Protection for AI Coding Agents** |
AI, ML & Data Science |
New Tool |
Runtime security platform hooking Claude Code and Cursor to enforce policy on file, network, process and command actions before they execute. |
[IngaCherny/AgentsLeak](https://github.com/IngaCherny/AgentsLeak) |
| 4 |
**AI Attack & Defence Wargame: The Insurance Company Edition** |
Arsenal Lab, AI |
Major Update |
Live adversarial wargame: each player hardens their own LLM insurance chatbot against prompt injection and exfiltration while attacking everyone else's. |
— *live wargame on the SecDim platform* |
| 5 |
**AI Security Playground** |
Arsenal Lab, AI |
New Tool |
Hands-on workshop covering real-world attacks against LLMs, AI agents and MCP servers, beginner through advanced. |
— *workshop; no repo* |
| 6 |
**Anthropic-Cybersecurity-Skills** |
Arsenal Lab, AI |
Minor Update |
734 open-source agent skills across 37 security subdomains, mapping 127+ MITRE ATT&CK techniques with 1,000+ runnable scripts. |
[mukul975/Anthropic-Cybersecurity-Skills](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) |
| 7 |
**APTL: Advanced Purple Team Labs** |
Arsenal Lab, Exploitation |
New Tool |
Docker-based purple team lab with an open-source SOC stack, MCP servers and a scenario system for running red and blue AI agents against each other. |
[Brad-Edwards/aptl](https://github.com/Brad-Edwards/aptl) |
| 8 |
**ARAY: Benign Binary Synthesis for Signature Validation Without the Malware** |
Malware |
New Tool |
Generates benign ELF/PE binaries matching a given YARA rule via a nine-node LangGraph LLM pipeline, to validate detections without live malware. |
— *no repo confirmed* |
| 9 |
**Azazel-Edge : Deterministic Edge Decision Support for Constrained SOC/NOC Operations** |
Network |
New Tool |
Deterministic edge decision appliance (Raspberry Pi) scoring NOC reliability and SOC threat context separately for small, constrained networks. |
[01rabbit/Azazel-Edge](https://github.com/01rabbit/Azazel-Edge) |
| 10 |
**BadZure: Building Cloud Attack Labs with AI** |
Cloud Security |
Major Update |
Describe an attack scenario in natural language and BadZure provisions a matching misconfigured Entra ID / Azure tenant with traversable attack paths. |
[mvelazc0/BadZure](https://github.com/mvelazc0/BadZure) |
| 11 |
**Bastet: An Infrastructure for Benchmarking LLM Smart Contract Auditing** |
AI, ML & Data Science |
Major Update |
Benchmark dataset of real-world DeFi smart contract vulnerabilities plus an AI detection pipeline for bugs static analyzers miss. |
[OneSavieLabs/Bastet](https://github.com/OneSavieLabs/Bastet) |
| 12 |
**Bedrock Keys Security (BKS): Hunting Phantom IAM Users Created by AWS Bedrock API Keys** |
Cloud Security |
New Tool |
Decodes AWS Bedrock API keys (base64 bearer tokens) and hunts the phantom IAM users AWS provisions behind them and never cleans up. |
[BeyondTrust/bedrock-keys-security](https://github.com/BeyondTrust/bedrock-keys-security) |
| 13 |
**Brutus: Modern Multi-Protocol Credential Testing in Go** |
Exploitation |
New Tool |
Zero-dependency Go replacement for THC Hydra: credential testing across SSH, MySQL, Postgres, Redis, MongoDB and SMB. |
[praetorian-inc/brutus](https://github.com/praetorian-inc/brutus) |
| 14 |
**capa: Beyond Disassembly: Dynamic Matching for Static Blindspots** |
Malware |
Major Update |
FLARE's capability identification tool, now applying its rule engine to dynamic execution traces to cover packed, obfuscated, Rust and Go binaries. |
[mandiant/capa](https://github.com/mandiant/capa) |
| 15 |
**Chameleon Forensics (Android): Assume Adversarial Logical Extraction Forensic Tool** |
Digital Forensics |
New Tool |
Android logical extraction built on the assumption the device is adversarial and actively disrupting forensic acquisition. |
[Ins1ght32/Chameleon-Forensics-Android](https://github.com/Ins1ght32/Chameleon-Forensics-Android) |
| 16 |
**Chef Special: Updates to CSTC - CyberChef-inspired Message Transformator in BurpSuite** |
Arsenal Lab, Vuln Assessment |
Major Update |
CyberChef-style recipe engine inside Burp Suite: transformation chains applied automatically to outgoing and incoming HTTP traffic. |
[usdAG/cstc](https://github.com/usdAG/cstc) |
| 17 |
**Cleric: ETW Sandbox and Memory Scanner** |
Malware |
New Tool |
Windows malware analysis framework combining a C++ memory scanner (15 detection techniques), ETW sandboxing and runtime process inspection. |
— *no repo confirmed* |
| 18 |
**CLOAK : Cloud Testing Agent Harness** |
Cloud Security |
Major Update |
AI red team agent for cloud assessments using "Dual Output Rendering" so ARNs, account IDs and resource names never enter the model's context window. |
— *no repo confirmed* |
| 19 |
**Command Line Threat Analyzer** |
Threat Hunting & IR |
New Tool |
Cross-platform detector reconstructing whole attack sequences from command line activity rather than flagging isolated commands. |
— *no repo confirmed* |
| 20 |
**ConfigManBearPig - Identify, Visualize, and Navigate SCCM Attack Paths in BloodHound** |
Exploitation |
Major Update |
From a low-privileged AD context, collects SCCM/ConfigMgr data and maps every Misconfiguration Manager TAKEOVER, ELEVATE and CRED path into BloodHound. |
[SpecterOps/ConfigManBearPig](https://github.com/SpecterOps/ConfigManBearPig) |
| 21 |
**Continuous Threat Modeling in Agentic AI era - tmdd** |
Code Assessment |
New Tool |
Threat Modeling Driven Development: an AI agent infers components and data flows from code and emits a version-controlled YAML threat model reviewed via PRs. |
[attasec/tmdd](https://github.com/attasec/tmdd) |
| 22 |
**CrowdSentinel: AI-Orchestrated Threat Hunting Across Unified Security Data Sources** |
Threat Hunting & IR |
New Tool |
MCP-based threat hunting orchestrator unifying Elasticsearch, Wireshark, Chainsaw and 5,049 detection rules behind one natural-language endpoint. |
[thomasxm/CrowdSentinels-AI-MCP](https://github.com/thomasxm/CrowdSentinels-AI-MCP) |
| 23 |
**CyberArkHound** |
Exploitation |
— |
Go tool exporting CyberArk PVWA data (users, safes, accounts, permissions) into BloodHound OpenGraph so PAM privilege paths sit alongside AD ones. |
[jazofra/CyberArkHound](https://github.com/jazofra/CyberArkHound) |
| 24 |
**Dradis Framework: Intelligent Automation for collaboration and reporting** |
OSINT |
Major Update |
Collaboration and reporting portal ingesting 47+ scanners, with bring-your-own-LLM assistance (Dradis Echo) that stays on your own infrastructure. |
[dradis/dradis-ce](https://github.com/dradis/dradis-ce) |
| 25 |
**EMBA – The product security analysis framework** |
Arsenal Lab, IoT |
Major Update |
The firmware security analyzer for IoT/ICS/OT: automated static and dynamic analysis of embedded Linux firmware images end to end. |
[e-m-b-a/emba](https://github.com/e-m-b-a/emba) |
| 26 |
**EMBArk – Firmware Analysis for the Enterprise** |
Vulnerability Assessment |
Major Update |
Web-based enterprise front end for EMBA — orchestrate, compare and manage firmware analyses across a product portfolio and supply chain. |
[e-m-b-a/embark](https://github.com/e-m-b-a/embark) |
| 27 |
**Emulate cloud-native attacks with Stratus Red Team** |
Cloud Security |
Minor Update |
Granular, self-contained adversary emulation for AWS, Azure, GCP, Entra ID and Kubernetes to validate that cloud threat detections fire. |
[DataDog/stratus-red-team](https://github.com/DataDog/stratus-red-team) |
| 28 |
**FAInd my XPC: Automated Discovery of Privilege Escalation via macOS XPC Trust Boundaries - powered by LLM** |
Exploitation |
New Tool |
Automated macOS XPC attack-surface discovery: static binary analysis plus runtime enumeration and LLM semantic scoring to find privesc across installed apps. |
— *no repo confirmed* |
| 29 |
**fetter** |
Vulnerability Assessment |
Major Update |
System-wide Python package discovery, validation and allow-listing — what is actually installed, rather than what the manifest claims. |
[fetter-io/fetter-rs](https://github.com/fetter-io/fetter-rs) |
| 30 |
**findmytakeover - find dangling domains in a multi cloud environment** |
Cloud Security |
Major Update |
Finds dangling DNS records across multi-cloud, multi-account estates by comparing live DNS zones against actual infrastructure — no wordlists or brute force. |
[anirudhbiyani/findmytakeover](https://github.com/anirudhbiyani/findmytakeover) |
| 31 |
**From Breakthrough to Completeness: arkdecompiler - The Decompiler for HarmonyOS NEXT** |
Reverse Engineering |
Major Update |
Decompiler for Huawei HarmonyOS NEXT, targeting the Ark bytecode execution environment outside the Android/AOSP toolchain. |
[jd-opensource/arkdecompiler](https://github.com/jd-opensource/arkdecompiler) |
| 32 |
**Ghost in the IDE** |
Exploitation |
Major Update |
Research into the IDE plugin ecosystem as an attack surface across JetBrains IntelliJ, VS Code and Eclipse. |
— *no repo confirmed* |
| 33 |
**Ghostwriter** |
Exploitation |
Major Update |
Offensive-ops platform for report writing, reusable findings libraries, client management and red team infrastructure tracking. |
[GhostManager/Ghostwriter](https://github.com/GhostManager/Ghostwriter) |
| 34 |
**GolemHalt: A Deterministic Reference Monitor for AI Coding Agents** |
AI, ML & Data Science |
New Tool |
Deterministic boundaries for AI coding agents against prompt injection, exfiltration and destructive actions. |
— *no repo confirmed* |
| 35 |
**Hecate: a trivial UART tool** |
Arsenal Lab |
Minor Update |
Turns any CircuitPython-compatible microcontroller into a customizable UART implant for sniffing and interposing on serial links. |
[tigard-tools/hecate](https://github.com/tigard-tools/hecate) |
| 36 |
**HoneyMCP: A Deception Security Layer for MCP Servers** |
AI, ML & Data Science |
New Tool |
Deception layer for MCP servers: plants LLM-generated decoy tools that emit telemetry on exfiltration or indirect prompt injection attempts. |
[barvhaim/HoneyMCP](https://github.com/barvhaim/HoneyMCP) |
| 37 |
**ICSForge™: OT/ICS Security Coverage Validation Platform** |
Smart Grid/Industrial |
New Tool |
Generates realistic OT traffic and PCAPs across 500+ scenarios in 10 industrial protocols (Modbus/TCP, DNP3, S7comm, IEC-104, OPC UA). |
[ICSForge/ICSForge](https://github.com/ICSForge/ICSForge) |
| 38 |
**INFLEX: Cross-Format Malware Analysis and Correlation Framework** |
Malware |
New Tool |
Correlates PE, ELF, shellcode and malicious documents in one workflow through static analysis, emulation, sandboxing and threat intel enrichment. |
— *no repo confirmed* |
| 39 |
**Intercept.js: Context-Aware YARA for Runtime Detection In JavaScript Environments** |
Malware |
New Tool |
Context-aware YARA matching inside JavaScript runtimes — browsers, email clients, Office add-ins — where payloads exist only as in-memory buffers. |
[rishi-sekantsec/sekant-intercept-js](https://github.com/rishi-sekantsec/sekant-intercept-js) |
| 40 |
**JS-Tap v3: JavaScript Post-Exploitation Moves to the Endpoint** |
Exploitation |
Major Update |
JavaScript C2 extended past the web app to the endpoint, with implants for browser extensions, Electron desktop apps and Node.js CLI tools. |
[hoodoer/JS-Tap](https://github.com/hoodoer/JS-Tap) |
| 41 |
**KEIP: Kernel-Enforced Install-Time Policies** |
Malware |
New Tool |
eBPF/LSM kernel hooks intercepting and blocking malicious network activity during `pip install` — supply-chain defense at package install time. |
[Otsmane-Ahmed/KEIP](https://github.com/Otsmane-Ahmed/KEIP) |
| 42 |
**Keychecker : SSH Key based attack tool for DVCS Systems** |
Vulnerability Assessment |
Minor Update |
Fingerprints a found SSH private key and determines which Git hosting accounts it unlocks, via safe handshakes and read-only `git ls-remote` probes. |
[cyfinoid/keychecker](https://github.com/cyfinoid/keychecker) |
| 43 |
**LLM Hacking 101** |
Arsenal Lab, AI |
New Tool |
Two-hour hands-on lab progressing from jailbreak development to guardrail bypass and direct/indirect prompt injection against agentic systems. |
[RootInj3c/LLM-Playground](https://github.com/RootInj3c/LLM-Playground) |
| 44 |
**LogonTracer v2: Faster Malicious Windows Logon Investigations with AI Agent** |
Threat Hunting & IR |
Major Update |
Visualizes Windows authentication events as a user/host graph, now with an AI agent to speed triage of malicious logons in noisy event data. |
[JPCERTCC/LogonTracer](https://github.com/JPCERTCC/LogonTracer) |
| 45 |
**LoRaCraft – Crafting Attacks for LoRaWAN Networks** |
Internet of Things |
New Tool |
LoRaWAN security assessment framework covering the full protocol stack — join request replay, RF-layer testing and target fingerprinting. |
[pinarsadioglu/loracraft](https://github.com/pinarsadioglu/loracraft) |
| 46 |
**MachStealer: One Pipeline Behind Every macOS Infostealer** |
Malware |
New Tool |
Reproduces the shared macOS infostealer pipeline (Keychain extraction, PBKDF2 derivation, SQLite copy, AES decrypt) behind AMOS, Poseidon, Banshee and Cuckoo. |
[ultra-supara/MachStealer](https://github.com/ultra-supara/MachStealer) |
| 47 |
**MCParasite: Universal MCP Worm Security Testing Framework** |
AI, ML & Data Science |
New Tool |
Chains prompt injection and tool poisoning into a self-propagating worm inside MCP — poisoning lands at connection time, before user interaction. |
[MCParasite/mcparasite](https://github.com/MCParasite/mcparasite) |
| 48 |
**Mecha Hayabusa by Yamato Security** |
Digital Forensics |
New Tool |
MCP server loading Hayabusa timelines into DuckDB and exposing them to an LLM for natural-language Windows event log DFIR. |
[Yamato-Security/mecha-hayabusa](https://github.com/Yamato-Security/mecha-hayabusa) |
| 49 |
**Medaudit, an AI assisted Tool for Auditing Hospital Networks and Pentesting Medical Devices** |
Smart Grid/Industrial |
Major Update |
Audits medical device network traffic (HL7 focus) for unencrypted transmissions and PHI/PII exposure, with fuzzing and AI-assisted triage. |
[anirudhduggal/medaudit](https://github.com/anirudhduggal/medaudit) |
| 50 |
**MEM-SBOM: Runtime SBOM Generation from Python Process Memory** |
Digital Forensics |
New Tool |
Generates SBOMs from live Python process memory rather than build manifests, catching dynamically loaded modules static tooling misses. |
[HalaAli198/MEM-SBOM](https://github.com/HalaAli198/MEM-SBOM) |
| 51 |
**MLOKit: MLOps Attack Toolkit** |
Exploitation |
Major Update |
C# toolkit attacking MLOps platforms (Azure ML, SageMaker, Vertex AI, MLflow, BigML, Palantir AIP) via their REST APIs. |
[h4wkst3r/MLOKit](https://github.com/h4wkst3r/MLOKit) |
| 52 |
**MORF - Mobile Reconnaissance Framework** |
OSINT |
Major Update |
Automatically discovers secrets and sensitive information inside Android and iOS application packages. |
[amrudesh1/morf](https://github.com/amrudesh1/morf) |
| 53 |
**MSCodePhish - Dynamic Device Code Phishing Framework** |
Exploitation |
New Tool |
Turns Microsoft Device Code OAuth into an embeddable phishing primitive — codes minted on click via an API, defeating the 15-minute timeout race. |
[TROUBLE-1/MSCodePhish](https://github.com/TROUBLE-1/MSCodePhish) |
| 54 |
**MSSQLHound - Identify, Visualize, and Navigate MSSQL Attack Paths in BloodHound** |
Exploitation |
Major Update |
Enumerates MSSQL principals and permissions at domain, server and database level and maps abusable paths into the BloodHound graph. |
[SpecterOps/MSSQLHound](https://github.com/SpecterOps/MSSQLHound) |
| 55 |
**Nemesis 2.2** |
AI, ML & Data Science |
Major Update |
Centralized enrichment pipeline for files collected on offensive engagements; 2.2 adds ingestion of full disk images and large forensic containers. |
[SpecterOps/Nemesis](https://github.com/SpecterOps/Nemesis) |
| 56 |
**Nogitsune: eBPF-Based Anti-VM Detection for Linux Malware Analysis** |
Malware |
New Tool |
First eBPF-based anti-VM detection toolkit for Linux — hides the analysis VM from malware without patching QEMU or rebuilding SeaBIOS. |
[sumukhchitloor/nogitsune](https://github.com/sumukhchitloor/nogitsune) |
| 57 |
**notyet: Automated IAM Persistence Analysis Through AWS Eventual Consistency Abuse** |
Cloud Security |
New Tool |
Abuses the propagation delay in AWS IAM's eventual consistency to keep using credentials responders believe they revoked. |
[OFFENSAI/notyet](https://github.com/OFFENSAI/notyet) |
| 58 |
**Obscurize: Malware for Defense and Counter Offense** |
Malware |
New Tool |
Repurposes rootkit environment-enumeration techniques (BIOS strings, MAC OUI, RAM size, process lists) into a defensive and offensive tool. |
— *no repo confirmed* |
| 59 |
**OWASP EKS Goat: Hands-On AWS EKS Security** |
Cloud Security |
Major Update |
Intentionally vulnerable AWS EKS cluster for hands-on learning: supply chain compromise, ECR/EKS abuse and RBAC misconfiguration scenarios. |
— *no repo confirmed* |
| 60 |
**OWASP Faction 2.0** |
Vulnerability Assessment |
Major Update |
Ground-up rebuild of the pentest assessment and reporting platform, adding AI-assisted report writing, a CLI integration framework and app inventory. |
[factionsecurity/faction](https://github.com/factionsecurity/faction) |
| 61 |
**Pathrunner: An AWS Privilege Escalation Framework** |
Cloud Security |
Major Update |
Modular AWS IAM privilege escalation framework automating the paths documented at pathfinding.cloud. |
[DataDog/pathrunner](https://github.com/DataDog/pathrunner) |
| 62 |
**Pentest Copilot V2: The Agentic Pentesting Workspace** |
Exploitation |
Major Update |
AI-native browser-based workspace unifying recon, exploitation support, scripting and web testing. |
— *no repo confirmed* |
| 63 |
**Pentesting made easy - Keeping sessions alive with session-chains** |
WebAppSec |
New Tool |
Keeps multiple authenticated web sessions alive across users, roles and tenants so scanners and exploitation tools stop breaking on short-lived sessions and MFA. |
— *no repo confirmed* |
| 64 |
**PETriage: Cross-Platform PE Surface Analysis for Malware Triage** |
Malware |
New Tool |
Symbol-unified PE reader bringing PEStudio/CFF Explorer-style triage to Linux and macOS hosts. |
[uky007/PETriage](https://github.com/uky007/PETriage) |
| 65 |
**Practical Ransomware Detection on macOS (via Math, not AI)** |
Malware |
Major Update |
Math-driven, explicitly not ML, generic macOS ransomware detection keyed on the rapid file-encryption behaviour common to nearly every variant. |
— *no repo confirmed* |
| 66 |
**Praxis - Semantic Command & Control Framework** |
AI, ML & Data Science |
Minor Update |
Adversarial C2 for discovering and driving AI computer-use agents (Claude, Codex, Cursor) already running on endpoints. |
— *no repo confirmed* |
| 67 |
**Precogly: Open Source Threat Modeling for AI-Assisted Security** |
WebAppSec |
New Tool |
Open-source threat modeling: DFD editor, community threat libraries, LINDDUN/CAPEC/ATT&CK taxonomies and PCI-DSS/NIST mappings, with AI hooks. |
[precogly/precogly](https://github.com/precogly/precogly) |
| 68 |
**PrivacyTrollShield: An Open-Source Scanner for Privacy Compliance** |
Privacy |
New Tool |
Scans public sites for the tracking behaviours behind CIPA wiretapping suits — session replay before consent, Meta Pixel form capture, dead Decline buttons. |
[atekippe/PrivacyTrollShield](https://github.com/atekippe/PrivacyTrollShield) |
| 69 |
**PwnSat 2.0: The Vulnerable Satellite Hacking Platform for Learning Through Research** |
Exploitation |
Major Update |
Vulnerable-by-design satellite platform for aerospace security research; 2.0 adds enterprise mission-control integration beyond 1.0's RF attack focus. |
— *no repo confirmed* |
| 70 |
**pymsi - Interactive MSI Installer Analysis in Python and the Browser** |
Code Assessment |
Major Update |
Pure Python MSI parser exposing installer database tables and embedded streams, plus a fully client-side lessmsi-style browser UI. |
[nightlark/pymsi](https://github.com/nightlark/pymsi) |
| 71 |
**QuicDraw & QuicDraw-UI: Racing and Fuzzing HTTP/3** |
WebAppSec |
Major Update |
Fuzzes and race-tests HTTP/3 servers over QUIC using "Quic-Fin-Sync" for high-speed single-packet race conditions. Apache-2.0. |
[cyberark/QuicDrawH3](https://github.com/cyberark/QuicDrawH3) |
| 72 |
**ReARM: Release Governance Platform** |
Vulnerability Assessment |
Major Update |
DevSecOps release governance: an SBOM/xBOM repository and evidence store tracking releases with their bills of materials and security findings. |
[relizaio/rearm](https://github.com/relizaio/rearm) |
| 73 |
**RedTeamSimmer: A Web Based Adversary Emulation Platform and Atomic Red Team Test Orchestration** |
AI, ML & Data Science |
— |
Flask-based web UI for orchestrating Atomic Red Team tests across enterprise Windows estates, handling prerequisites and centralizing results. |
[BreachSimRange/RedTeamSimmer](https://github.com/BreachSimRange/RedTeamSimmer) |
| 74 |
**ROP ROCKET: New ASLR Bypass Mini-Tool & Automating Advanced ROP Attacks** |
Exploitation |
Major Update |
Windows code-reuse framework; adds a mini-tool generating nine automated bypasses for 64-bit high-entropy ASLR with complete x64 ROP chains. |
[Bw3ll/ROP_ROCKET](https://github.com/Bw3ll/ROP_ROCKET) |
| 75 |
**RPCExplorer** |
Reverse Engineering |
New Tool |
Research toolkit for mapping and probing the Windows RPC attack surface at scale — turning an interface UUID into what it does and how to test it. |
— *no repo confirmed* |
| 76 |
**SafeScribe - Edge Device AI Meeting Notetaker** |
Hardware/Embedded |
New Tool |
Privacy-first desk device generating meeting notes entirely locally and delivering them as a PDF. |
— *no repo confirmed* |
| 77 |
**Sage: Giving an AI the Keys to Your C2 Framework** |
AI, ML & Data Science |
New Tool |
Virtual Mythic agent running on the C2 server rather than the target — a multi-agent AI operator that enumerates callbacks and tasks real agents. |
[MythicAgents/sage](https://github.com/MythicAgents/sage) |
| 78 |
**SBoMPlay : SBoM Exploration and Intelligence extraction platform** |
Code Assessment |
Major Update |
Browser-based, privacy-preserving SBOM exploration — query dependency data locally instead of uploading it to a heavyweight platform. |
[cyfinoid/sbomplay](https://github.com/cyfinoid/sbomplay) |
| 79 |
**SEmuRAI: Software Emulation and Reversing AI Agent** |
Reverse Engineering |
New Tool |
Agentic reverse engineering: LLM-driven emulation and analysis of obfuscated or large binaries where compilation stripped the context. |
[DevNerdGR/SEmuRAI-mcp](https://github.com/DevNerdGR/SEmuRAI-mcp) |
| 80 |
**ShadowHunt 2.0: Uncovering Shadow IT and Hidden Secrets** |
OSINT |
— |
Maps Shadow IT on public repos — company code pushed to employees' personal GitHub, Docker Hub and Helm accounts — and the secrets left in it. |
[Research-Nautilus/ShadowHunt](https://github.com/Research-Nautilus/ShadowHunt) |
| 81 |
**SHAREM: Next-Generation Shellcode Analysis Tool** |
Reverse Engineering |
Major Update |
NSA-funded shellcode analysis framework emulating 45,000+ WinAPIs and Windows syscalls to defeat dynamic API resolution and self-unpacking. |
[Bw3ll/sharem](https://github.com/Bw3ll/sharem) |
| 82 |
**ShellWasp: Creating Shellcode with Windows Syscalls** |
Exploitation |
Major Update |
Builds shellcode using Windows syscalls directly, solving the SSN-drift and Wow64 portability problems that break syscall shellcode across OS builds. |
[Bw3ll/ShellWasp](https://github.com/Bw3ll/ShellWasp) |
| 83 |
**Social Engineering with Reel** |
Exploitation |
New Tool |
Workflow-driven phishing framework with credential capture, optional real-time MFA relay, email sending and a plugin system. |
[trustedsec/Reel](https://github.com/trustedsec/Reel) |
| 84 |
**Splunk MCP LLM SIEMulator: Open Source AI Security Monitoring Through MCP Integration** |
AI, ML & Data Science |
Major Update |
Bridges local LLM deployments to Splunk over MCP, giving SIEM visibility into prompt injection, jailbreak attempts and shadow AI usage. |
[rsfl/splunk-mcp-llm-siemulator](https://github.com/rsfl/splunk-mcp-llm-siemulator) |
| 85 |
**StegoScan** |
Digital Forensics |
— |
Automated steganography detection across file types. |
[LCBOWER33/StegoScan](https://github.com/LCBOWER33/StegoScan) |
| 86 |
**Surfactant - Modular Framework for File Information Extraction and SBOM Generation** |
Code Assessment |
Major Update |
LLNL's modular framework extracting software metadata from filesystems to identify components, vendors and third-party libraries and build SBOMs. |
[llnl/Surfactant](https://github.com/llnl/Surfactant) |
| 87 |
**Suricata 8: Discover the Difference in Network Detection** |
Threat Hunting & IR |
Major Update |
The open-source IDS/IPS and network security monitor — this session covers what is new in the Suricata 8 release. |
[OISF/suricata](https://github.com/OISF/suricata) |
| 88 |
**Suricata Turbo: Let Your NIC Drop the Flows Suricata Won't Miss** |
Network |
Major Update |
Adds hardware traffic-filtering offload so the NIC drops uninteresting flows, stopping random packet loss when Suricata cannot keep up. |
[DynaNIC/suricata-turbo](https://github.com/DynaNIC/suricata-turbo) |
| 89 |
**Suzaku by Yamato Security** |
Digital Forensics |
Major Update |
Rust, Sigma-based threat hunting and DFIR timeline generator for cloud logs — Hayabusa's approach applied to JSON/JSON.gz at scale. |
[Yamato-Security/suzaku](https://github.com/Yamato-Security/suzaku) |
| 90 |
**Tengu Marauder Vanguard Version 2.0** |
Arsenal Lab, Hardware |
Major Update |
Raspberry Pi 5 robotic platform for physical red teaming and wireless assessment, with multiple units managed from a single Flask interface. |
[Lexicon121/Tengu-Marauder-Vanguard](https://github.com/Lexicon121/Tengu-Marauder-Vanguard) |
| 91 |
**The Metasploit Framework 6.5: Malleable C2 Payloads, New Relay Capability and Protocol Session Upgrades** |
Exploitation |
Minor Update |
Metasploit 6.5: Malleable C2 profiles for HTTP Meterpreter, HTTP-to-SMB and HTTP-to-LDAP relaying, and protocol session upgrades. |
[rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) |
| 92 |
**ThreatShield - The Intelligent Way of Threat Modelling** |
Arsenal Lab, AI |
— |
Turns PRDs, architecture diagrams, Confluence pages, Slack threads and transcripts into STRIDE/PASTA threat models, attack trees, DREAD scores and ASVS tests. |
— *no repo confirmed* |
| 93 |
**ThreatXtension: AI-Powered Browser Extension Security Analysis Framework** |
Vulnerability Assessment |
New Tool |
Chrome extension security analysis combining SAST with LLM threat intelligence to assess permission risk and detect obfuscated malicious patterns. |
[barvhaim/ThreatXtension](https://github.com/barvhaim/ThreatXtension) |
| 94 |
**Trajan: Cross-Platform CI/CD Security Scanner** |
Exploitation |
New Tool |
One scanner across GitHub Actions, Azure DevOps, GitLab and Jenkins, replacing the per-platform tooling patchwork. |
[praetorian-inc/trajan](https://github.com/praetorian-inc/trajan) |
| 95 |
**TSURUGI LINUX - the sharpest weapon in your DFIR arsenal** |
Digital Forensics |
New Tool |
DFIR-focused Linux distribution shipping a curated, ready-to-use forensics toolset. |
— *not on GitHub; tsurugi-linux.org* |
| 96 |
**unrelabel: how to destroy an ML model** |
AI, ML & Data Science |
New Tool |
Interactive toolkit demonstrating label-poisoning attacks: import a dataset, pick an attack, and watch a classifier degrade from accurate to useless. |
[oz9un/unrelabel](https://github.com/oz9un/unrelabel) |
| 97 |
**Vulnhalla 2.0: LLM-Guided Triage of CodeQL Findings** |
Code Assessment |
Major Update |
Runs CodeQL at scale and uses an LLM agent to triage findings true/false positive, with fast CSV-based context extraction and a reasoning engine. |
[cyberark/Vulnhalla](https://github.com/cyberark/Vulnhalla) |
| 98 |
**VulnZoo: A Complete Vulnerable IoT Ecosystem for Security Research and Training** |
Internet of Things |
New Tool |
Vulnerable IoT ecosystem modelling a whole product — firmware, mobile app and cloud services — so cross-component attack chains can be studied. |
[DEKRA-Cybersecurity/VulnZoo](https://github.com/DEKRA-Cybersecurity/VulnZoo) |
| 99 |
**WaffleX: Adaptive Semantic Analysis for WAF Resilience Testing** |
WebAppSec |
New Tool |
Generates semantically equivalent request variants to expose normalization gaps and parser inconsistencies between CDNs, proxies, WAFs and origin apps. |
— *no repo confirmed* |
| 100 |
**WebAgentAudit: Security Auditing of Web-Based AI Agents Through Browser Automation** |
Vulnerability Assessment |
New Tool |
Audits web-only AI agents (embedded chatbots and LLM widgets) through browser automation, requiring no API access to the model under test. |
[atom41research/webagentaudit](https://github.com/atom41research/webagentaudit) |
| 101 |
**xEndity** |
Internet of Things |
New Tool |
Emulated digital twins of IoT devices, so teams can test hardware they cannot physically obtain or safely attack in production. |
[kenleejl/xEndityv2](https://github.com/kenleejl/xEndityv2) |