Black Hat USA 2026 Arsenal — all 101 tools with GitHub links

Black Hat USA 2026 Arsenal will feature 101 open-source security tools, including new AI-focused offerings such as AgentsLeak, a runtime protection platform for AI coding agents, and ARAY, which generates benign binaries to validate YARA rules. Major updates include AD Miner, which applies graph theory to Active Directory security, and BadZure, which builds cloud attack labs from natural language descriptions.

| 1 | AC Scanner - QubitAC Automated Post-Quantum Cryptography Discovery Tool | Cryptography | New Tool | Scans TLS endpoints and SSH services for post-quantum readiness against NIST PQC standards and emits a Cryptographic Bill of Materials CBOM . | qubitac/AC-Scanner https://github.com/qubitac/AC-Scanner | | 2 | AD Miner – One step further applying graph theory for Active Directory security analysis | Risks | Major Update | Applies graph theory to BloodHound data to turn raw Active Directory graphs into prioritized, ranked findings and remediation paths. | AD-Security/AD Miner https://github.com/AD-Security/AD Miner | | 3 | AgentsLeak: Runtime Protection for AI Coding Agents | AI, ML & Data Science | New Tool | Runtime security platform hooking Claude Code and Cursor to enforce policy on file, network, process and command actions before they execute. | IngaCherny/AgentsLeak https://github.com/IngaCherny/AgentsLeak | | 4 | AI Attack & Defence Wargame: The Insurance Company Edition | Arsenal Lab, AI | Major Update | Live adversarial wargame: each player hardens their own LLM insurance chatbot against prompt injection and exfiltration while attacking everyone else's. | — live wargame on the SecDim platform | | 5 | AI Security Playground | Arsenal Lab, AI | New Tool | Hands-on workshop covering real-world attacks against LLMs, AI agents and MCP servers, beginner through advanced. | — workshop; no repo | | 6 | Anthropic-Cybersecurity-Skills | Arsenal Lab, AI | Minor Update | 734 open-source agent skills across 37 security subdomains, mapping 127+ MITRE ATT&CK techniques with 1,000+ runnable scripts. | mukul975/Anthropic-Cybersecurity-Skills https://github.com/mukul975/Anthropic-Cybersecurity-Skills | | 7 | APTL: Advanced Purple Team Labs | Arsenal Lab, Exploitation | New Tool | Docker-based purple team lab with an open-source SOC stack, MCP servers and a scenario system for running red and blue AI agents against each other. | Brad-Edwards/aptl https://github.com/Brad-Edwards/aptl | | 8 | ARAY: Benign Binary Synthesis for Signature Validation Without the Malware | Malware | New Tool | Generates benign ELF/PE binaries matching a given YARA rule via a nine-node LangGraph LLM pipeline, to validate detections without live malware. | — no repo confirmed | | 9 | Azazel-Edge : Deterministic Edge Decision Support for Constrained SOC/NOC Operations | Network | New Tool | Deterministic edge decision appliance Raspberry Pi scoring NOC reliability and SOC threat context separately for small, constrained networks. | 01rabbit/Azazel-Edge https://github.com/01rabbit/Azazel-Edge | | 10 | BadZure: Building Cloud Attack Labs with AI | Cloud Security | Major Update | Describe an attack scenario in natural language and BadZure provisions a matching misconfigured Entra ID / Azure tenant with traversable attack paths. | mvelazc0/BadZure https://github.com/mvelazc0/BadZure | | 11 | Bastet: An Infrastructure for Benchmarking LLM Smart Contract Auditing | AI, ML & Data Science | Major Update | Benchmark dataset of real-world DeFi smart contract vulnerabilities plus an AI detection pipeline for bugs static analyzers miss. | OneSavieLabs/Bastet https://github.com/OneSavieLabs/Bastet | | 12 | Bedrock Keys Security BKS : Hunting Phantom IAM Users Created by AWS Bedrock API Keys | Cloud Security | New Tool | Decodes AWS Bedrock API keys base64 bearer tokens and hunts the phantom IAM users AWS provisions behind them and never cleans up. | BeyondTrust/bedrock-keys-security https://github.com/BeyondTrust/bedrock-keys-security | | 13 | Brutus: Modern Multi-Protocol Credential Testing in Go | Exploitation | New Tool | Zero-dependency Go replacement for THC Hydra: credential testing across SSH, MySQL, Postgres, Redis, MongoDB and SMB. | praetorian-inc/brutus https://github.com/praetorian-inc/brutus | | 14 | capa: Beyond Disassembly: Dynamic Matching for Static Blindspots | Malware | Major Update | FLARE's capability identification tool, now applying its rule engine to dynamic execution traces to cover packed, obfuscated, Rust and Go binaries. | mandiant/capa https://github.com/mandiant/capa | | 15 | Chameleon Forensics Android : Assume Adversarial Logical Extraction Forensic Tool | Digital Forensics | New Tool | Android logical extraction built on the assumption the device is adversarial and actively disrupting forensic acquisition. | Ins1ght32/Chameleon-Forensics-Android https://github.com/Ins1ght32/Chameleon-Forensics-Android | | 16 | Chef Special: Updates to CSTC - CyberChef-inspired Message Transformator in BurpSuite | Arsenal Lab, Vuln Assessment | Major Update | CyberChef-style recipe engine inside Burp Suite: transformation chains applied automatically to outgoing and incoming HTTP traffic. | usdAG/cstc https://github.com/usdAG/cstc | | 17 | Cleric: ETW Sandbox and Memory Scanner | Malware | New Tool | Windows malware analysis framework combining a C++ memory scanner 15 detection techniques , ETW sandboxing and runtime process inspection. | — no repo confirmed | | 18 | CLOAK : Cloud Testing Agent Harness | Cloud Security | Major Update | AI red team agent for cloud assessments using "Dual Output Rendering" so ARNs, account IDs and resource names never enter the model's context window. | — no repo confirmed | | 19 | Command Line Threat Analyzer | Threat Hunting & IR | New Tool | Cross-platform detector reconstructing whole attack sequences from command line activity rather than flagging isolated commands. | — no repo confirmed | | 20 | ConfigManBearPig - Identify, Visualize, and Navigate SCCM Attack Paths in BloodHound | Exploitation | Major Update | From a low-privileged AD context, collects SCCM/ConfigMgr data and maps every Misconfiguration Manager TAKEOVER, ELEVATE and CRED path into BloodHound. | SpecterOps/ConfigManBearPig https://github.com/SpecterOps/ConfigManBearPig | | 21 | Continuous Threat Modeling in Agentic AI era - tmdd | Code Assessment | New Tool | Threat Modeling Driven Development: an AI agent infers components and data flows from code and emits a version-controlled YAML threat model reviewed via PRs. | attasec/tmdd https://github.com/attasec/tmdd | | 22 | CrowdSentinel: AI-Orchestrated Threat Hunting Across Unified Security Data Sources | Threat Hunting & IR | New Tool | MCP-based threat hunting orchestrator unifying Elasticsearch, Wireshark, Chainsaw and 5,049 detection rules behind one natural-language endpoint. | thomasxm/CrowdSentinels-AI-MCP https://github.com/thomasxm/CrowdSentinels-AI-MCP | | 23 | CyberArkHound | Exploitation | — | Go tool exporting CyberArk PVWA data users, safes, accounts, permissions into BloodHound OpenGraph so PAM privilege paths sit alongside AD ones. | jazofra/CyberArkHound https://github.com/jazofra/CyberArkHound | | 24 | Dradis Framework: Intelligent Automation for collaboration and reporting | OSINT | Major Update | Collaboration and reporting portal ingesting 47+ scanners, with bring-your-own-LLM assistance Dradis Echo that stays on your own infrastructure. | dradis/dradis-ce https://github.com/dradis/dradis-ce | | 25 | EMBA – The product security analysis framework | Arsenal Lab, IoT | Major Update | The firmware security analyzer for IoT/ICS/OT: automated static and dynamic analysis of embedded Linux firmware images end to end. | e-m-b-a/emba https://github.com/e-m-b-a/emba | | 26 | EMBArk – Firmware Analysis for the Enterprise | Vulnerability Assessment | Major Update | Web-based enterprise front end for EMBA — orchestrate, compare and manage firmware analyses across a product portfolio and supply chain. | e-m-b-a/embark https://github.com/e-m-b-a/embark | | 27 | Emulate cloud-native attacks with Stratus Red Team | Cloud Security | Minor Update | Granular, self-contained adversary emulation for AWS, Azure, GCP, Entra ID and Kubernetes to validate that cloud threat detections fire. | DataDog/stratus-red-team https://github.com/DataDog/stratus-red-team | | 28 | FAInd my XPC: Automated Discovery of Privilege Escalation via macOS XPC Trust Boundaries - powered by LLM | Exploitation | New Tool | Automated macOS XPC attack-surface discovery: static binary analysis plus runtime enumeration and LLM semantic scoring to find privesc across installed apps. | — no repo confirmed | | 29 | fetter | Vulnerability Assessment | Major Update | System-wide Python package discovery, validation and allow-listing — what is actually installed, rather than what the manifest claims. | fetter-io/fetter-rs https://github.com/fetter-io/fetter-rs | | 30 | findmytakeover - find dangling domains in a multi cloud environment | Cloud Security | Major Update | Finds dangling DNS records across multi-cloud, multi-account estates by comparing live DNS zones against actual infrastructure — no wordlists or brute force. | anirudhbiyani/findmytakeover https://github.com/anirudhbiyani/findmytakeover | | 31 | From Breakthrough to Completeness: arkdecompiler - The Decompiler for HarmonyOS NEXT | Reverse Engineering | Major Update | Decompiler for Huawei HarmonyOS NEXT, targeting the Ark bytecode execution environment outside the Android/AOSP toolchain. | jd-opensource/arkdecompiler https://github.com/jd-opensource/arkdecompiler | | 32 | Ghost in the IDE | Exploitation | Major Update | Research into the IDE plugin ecosystem as an attack surface across JetBrains IntelliJ, VS Code and Eclipse. | — no repo confirmed | | 33 | Ghostwriter | Exploitation | Major Update | Offensive-ops platform for report writing, reusable findings libraries, client management and red team infrastructure tracking. | GhostManager/Ghostwriter https://github.com/GhostManager/Ghostwriter | | 34 | GolemHalt: A Deterministic Reference Monitor for AI Coding Agents | AI, ML & Data Science | New Tool | Deterministic boundaries for AI coding agents against prompt injection, exfiltration and destructive actions. | — no repo confirmed | | 35 | Hecate: a trivial UART tool | Arsenal Lab | Minor Update | Turns any CircuitPython-compatible microcontroller into a customizable UART implant for sniffing and interposing on serial links. | tigard-tools/hecate https://github.com/tigard-tools/hecate | | 36 | HoneyMCP: A Deception Security Layer for MCP Servers | AI, ML & Data Science | New Tool | Deception layer for MCP servers: plants LLM-generated decoy tools that emit telemetry on exfiltration or indirect prompt injection attempts. | barvhaim/HoneyMCP https://github.com/barvhaim/HoneyMCP | | 37 | ICSForge™: OT/ICS Security Coverage Validation Platform | Smart Grid/Industrial | New Tool | Generates realistic OT traffic and PCAPs across 500+ scenarios in 10 industrial protocols Modbus/TCP, DNP3, S7comm, IEC-104, OPC UA . | ICSForge/ICSForge https://github.com/ICSForge/ICSForge | | 38 | INFLEX: Cross-Format Malware Analysis and Correlation Framework | Malware | New Tool | Correlates PE, ELF, shellcode and malicious documents in one workflow through static analysis, emulation, sandboxing and threat intel enrichment. | — no repo confirmed | | 39 | Intercept.js: Context-Aware YARA for Runtime Detection In JavaScript Environments | Malware | New Tool | Context-aware YARA matching inside JavaScript runtimes — browsers, email clients, Office add-ins — where payloads exist only as in-memory buffers. | rishi-sekantsec/sekant-intercept-js https://github.com/rishi-sekantsec/sekant-intercept-js | | 40 | JS-Tap v3: JavaScript Post-Exploitation Moves to the Endpoint | Exploitation | Major Update | JavaScript C2 extended past the web app to the endpoint, with implants for browser extensions, Electron desktop apps and Node.js CLI tools. | hoodoer/JS-Tap https://github.com/hoodoer/JS-Tap | | 41 | KEIP: Kernel-Enforced Install-Time Policies | Malware | New Tool | eBPF/LSM kernel hooks intercepting and blocking malicious network activity during pip install — supply-chain defense at package install time. | Otsmane-Ahmed/KEIP https://github.com/Otsmane-Ahmed/KEIP | | 42 | Keychecker : SSH Key based attack tool for DVCS Systems | Vulnerability Assessment | Minor Update | Fingerprints a found SSH private key and determines which Git hosting accounts it unlocks, via safe handshakes and read-only git ls-remote probes. | cyfinoid/keychecker https://github.com/cyfinoid/keychecker | | 43 | LLM Hacking 101 | Arsenal Lab, AI | New Tool | Two-hour hands-on lab progressing from jailbreak development to guardrail bypass and direct/indirect prompt injection against agentic systems. | RootInj3c/LLM-Playground https://github.com/RootInj3c/LLM-Playground | | 44 | LogonTracer v2: Faster Malicious Windows Logon Investigations with AI Agent | Threat Hunting & IR | Major Update | Visualizes Windows authentication events as a user/host graph, now with an AI agent to speed triage of malicious logons in noisy event data. | JPCERTCC/LogonTracer https://github.com/JPCERTCC/LogonTracer | | 45 | LoRaCraft – Crafting Attacks for LoRaWAN Networks | Internet of Things | New Tool | LoRaWAN security assessment framework covering the full protocol stack — join request replay, RF-layer testing and target fingerprinting. | pinarsadioglu/loracraft https://github.com/pinarsadioglu/loracraft | | 46 | MachStealer: One Pipeline Behind Every macOS Infostealer | Malware | New Tool | Reproduces the shared macOS infostealer pipeline Keychain extraction, PBKDF2 derivation, SQLite copy, AES decrypt behind AMOS, Poseidon, Banshee and Cuckoo. | ultra-supara/MachStealer https://github.com/ultra-supara/MachStealer | | 47 | MCParasite: Universal MCP Worm Security Testing Framework | AI, ML & Data Science | New Tool | Chains prompt injection and tool poisoning into a self-propagating worm inside MCP — poisoning lands at connection time, before user interaction. | MCParasite/mcparasite https://github.com/MCParasite/mcparasite | | 48 | Mecha Hayabusa by Yamato Security | Digital Forensics | New Tool | MCP server loading Hayabusa timelines into DuckDB and exposing them to an LLM for natural-language Windows event log DFIR. | Yamato-Security/mecha-hayabusa https://github.com/Yamato-Security/mecha-hayabusa | | 49 | Medaudit, an AI assisted Tool for Auditing Hospital Networks and Pentesting Medical Devices | Smart Grid/Industrial | Major Update | Audits medical device network traffic HL7 focus for unencrypted transmissions and PHI/PII exposure, with fuzzing and AI-assisted triage. | anirudhduggal/medaudit https://github.com/anirudhduggal/medaudit | | 50 | MEM-SBOM: Runtime SBOM Generation from Python Process Memory | Digital Forensics | New Tool | Generates SBOMs from live Python process memory rather than build manifests, catching dynamically loaded modules static tooling misses. | HalaAli198/MEM-SBOM https://github.com/HalaAli198/MEM-SBOM | | 51 | MLOKit: MLOps Attack Toolkit | Exploitation | Major Update | C toolkit attacking MLOps platforms Azure ML, SageMaker, Vertex AI, MLflow, BigML, Palantir AIP via their REST APIs. | h4wkst3r/MLOKit https://github.com/h4wkst3r/MLOKit | | 52 | MORF - Mobile Reconnaissance Framework | OSINT | Major Update | Automatically discovers secrets and sensitive information inside Android and iOS application packages. | amrudesh1/morf https://github.com/amrudesh1/morf | | 53 | MSCodePhish - Dynamic Device Code Phishing Framework | Exploitation | New Tool | Turns Microsoft Device Code OAuth into an embeddable phishing primitive — codes minted on click via an API, defeating the 15-minute timeout race. | TROUBLE-1/MSCodePhish https://github.com/TROUBLE-1/MSCodePhish | | 54 | MSSQLHound - Identify, Visualize, and Navigate MSSQL Attack Paths in BloodHound | Exploitation | Major Update | Enumerates MSSQL principals and permissions at domain, server and database level and maps abusable paths into the BloodHound graph. | SpecterOps/MSSQLHound https://github.com/SpecterOps/MSSQLHound | | 55 | Nemesis 2.2 | AI, ML & Data Science | Major Update | Centralized enrichment pipeline for files collected on offensive engagements; 2.2 adds ingestion of full disk images and large forensic containers. | SpecterOps/Nemesis https://github.com/SpecterOps/Nemesis | | 56 | Nogitsune: eBPF-Based Anti-VM Detection for Linux Malware Analysis | Malware | New Tool | First eBPF-based anti-VM detection toolkit for Linux — hides the analysis VM from malware without patching QEMU or rebuilding SeaBIOS. | sumukhchitloor/nogitsune https://github.com/sumukhchitloor/nogitsune | | 57 | notyet: Automated IAM Persistence Analysis Through AWS Eventual Consistency Abuse | Cloud Security | New Tool | Abuses the propagation delay in AWS IAM's eventual consistency to keep using credentials responders believe they revoked. | OFFENSAI/notyet https://github.com/OFFENSAI/notyet | | 58 | Obscurize: Malware for Defense and Counter Offense | Malware | New Tool | Repurposes rootkit environment-enumeration techniques BIOS strings, MAC OUI, RAM size, process lists into a defensive and offensive tool. | — no repo confirmed | | 59 | OWASP EKS Goat: Hands-On AWS EKS Security | Cloud Security | Major Update | Intentionally vulnerable AWS EKS cluster for hands-on learning: supply chain compromise, ECR/EKS abuse and RBAC misconfiguration scenarios. | — no repo confirmed | | 60 | OWASP Faction 2.0 | Vulnerability Assessment | Major Update | Ground-up rebuild of the pentest assessment and reporting platform, adding AI-assisted report writing, a CLI integration framework and app inventory. | factionsecurity/faction https://github.com/factionsecurity/faction | | 61 | Pathrunner: An AWS Privilege Escalation Framework | Cloud Security | Major Update | Modular AWS IAM privilege escalation framework automating the paths documented at pathfinding.cloud. | DataDog/pathrunner https://github.com/DataDog/pathrunner | | 62 | Pentest Copilot V2: The Agentic Pentesting Workspace | Exploitation | Major Update | AI-native browser-based workspace unifying recon, exploitation support, scripting and web testing. | — no repo confirmed | | 63 | Pentesting made easy - Keeping sessions alive with session-chains | WebAppSec | New Tool | Keeps multiple authenticated web sessions alive across users, roles and tenants so scanners and exploitation tools stop breaking on short-lived sessions and MFA. | — no repo confirmed | | 64 | PETriage: Cross-Platform PE Surface Analysis for Malware Triage | Malware | New Tool | Symbol-unified PE reader bringing PEStudio/CFF Explorer-style triage to Linux and macOS hosts. | uky007/PETriage https://github.com/uky007/PETriage | | 65 | Practical Ransomware Detection on macOS via Math, not AI | Malware | Major Update | Math-driven, explicitly not ML, generic macOS ransomware detection keyed on the rapid file-encryption behaviour common to nearly every variant. | — no repo confirmed | | 66 | Praxis - Semantic Command & Control Framework | AI, ML & Data Science | Minor Update | Adversarial C2 for discovering and driving AI computer-use agents Claude, Codex, Cursor already running on endpoints. | — no repo confirmed | | 67 | Precogly: Open Source Threat Modeling for AI-Assisted Security | WebAppSec | New Tool | Open-source threat modeling: DFD editor, community threat libraries, LINDDUN/CAPEC/ATT&CK taxonomies and PCI-DSS/NIST mappings, with AI hooks. | precogly/precogly https://github.com/precogly/precogly | | 68 | PrivacyTrollShield: An Open-Source Scanner for Privacy Compliance | Privacy | New Tool | Scans public sites for the tracking behaviours behind CIPA wiretapping suits — session replay before consent, Meta Pixel form capture, dead Decline buttons. | atekippe/PrivacyTrollShield https://github.com/atekippe/PrivacyTrollShield | | 69 | PwnSat 2.0: The Vulnerable Satellite Hacking Platform for Learning Through Research | Exploitation | Major Update | Vulnerable-by-design satellite platform for aerospace security research; 2.0 adds enterprise mission-control integration beyond 1.0's RF attack focus. | — no repo confirmed | | 70 | pymsi - Interactive MSI Installer Analysis in Python and the Browser | Code Assessment | Major Update | Pure Python MSI parser exposing installer database tables and embedded streams, plus a fully client-side lessmsi-style browser UI. | nightlark/pymsi https://github.com/nightlark/pymsi | | 71 | QuicDraw & QuicDraw-UI: Racing and Fuzzing HTTP/3 | WebAppSec | Major Update | Fuzzes and race-tests HTTP/3 servers over QUIC using "Quic-Fin-Sync" for high-speed single-packet race conditions. Apache-2.0. | cyberark/QuicDrawH3 https://github.com/cyberark/QuicDrawH3 | | 72 | ReARM: Release Governance Platform | Vulnerability Assessment | Major Update | DevSecOps release governance: an SBOM/xBOM repository and evidence store tracking releases with their bills of materials and security findings. | relizaio/rearm https://github.com/relizaio/rearm | | 73 | RedTeamSimmer: A Web Based Adversary Emulation Platform and Atomic Red Team Test Orchestration | AI, ML & Data Science | — | Flask-based web UI for orchestrating Atomic Red Team tests across enterprise Windows estates, handling prerequisites and centralizing results. | BreachSimRange/RedTeamSimmer https://github.com/BreachSimRange/RedTeamSimmer | | 74 | ROP ROCKET: New ASLR Bypass Mini-Tool & Automating Advanced ROP Attacks | Exploitation | Major Update | Windows code-reuse framework; adds a mini-tool generating nine automated bypasses for 64-bit high-entropy ASLR with complete x64 ROP chains. | Bw3ll/ROP ROCKET https://github.com/Bw3ll/ROP ROCKET | | 75 | RPCExplorer | Reverse Engineering | New Tool | Research toolkit for mapping and probing the Windows RPC attack surface at scale — turning an interface UUID into what it does and how to test it. | — no repo confirmed | | 76 | SafeScribe - Edge Device AI Meeting Notetaker | Hardware/Embedded | New Tool | Privacy-first desk device generating meeting notes entirely locally and delivering them as a PDF. | — no repo confirmed | | 77 | Sage: Giving an AI the Keys to Your C2 Framework | AI, ML & Data Science | New Tool | Virtual Mythic agent running on the C2 server rather than the target — a multi-agent AI operator that enumerates callbacks and tasks real agents. | MythicAgents/sage https://github.com/MythicAgents/sage | | 78 | SBoMPlay : SBoM Exploration and Intelligence extraction platform | Code Assessment | Major Update | Browser-based, privacy-preserving SBOM exploration — query dependency data locally instead of uploading it to a heavyweight platform. | cyfinoid/sbomplay https://github.com/cyfinoid/sbomplay | | 79 | SEmuRAI: Software Emulation and Reversing AI Agent | Reverse Engineering | New Tool | Agentic reverse engineering: LLM-driven emulation and analysis of obfuscated or large binaries where compilation stripped the context. | DevNerdGR/SEmuRAI-mcp https://github.com/DevNerdGR/SEmuRAI-mcp | | 80 | ShadowHunt 2.0: Uncovering Shadow IT and Hidden Secrets | OSINT | — | Maps Shadow IT on public repos — company code pushed to employees' personal GitHub, Docker Hub and Helm accounts — and the secrets left in it. | Research-Nautilus/ShadowHunt https://github.com/Research-Nautilus/ShadowHunt | | 81 | SHAREM: Next-Generation Shellcode Analysis Tool | Reverse Engineering | Major Update | NSA-funded shellcode analysis framework emulating 45,000+ WinAPIs and Windows syscalls to defeat dynamic API resolution and self-unpacking. | Bw3ll/sharem https://github.com/Bw3ll/sharem | | 82 | ShellWasp: Creating Shellcode with Windows Syscalls | Exploitation | Major Update | Builds shellcode using Windows syscalls directly, solving the SSN-drift and Wow64 portability problems that break syscall shellcode across OS builds. | Bw3ll/ShellWasp https://github.com/Bw3ll/ShellWasp | | 83 | Social Engineering with Reel | Exploitation | New Tool | Workflow-driven phishing framework with credential capture, optional real-time MFA relay, email sending and a plugin system. | trustedsec/Reel https://github.com/trustedsec/Reel | | 84 | Splunk MCP LLM SIEMulator: Open Source AI Security Monitoring Through MCP Integration | AI, ML & Data Science | Major Update | Bridges local LLM deployments to Splunk over MCP, giving SIEM visibility into prompt injection, jailbreak attempts and shadow AI usage. | rsfl/splunk-mcp-llm-siemulator https://github.com/rsfl/splunk-mcp-llm-siemulator | | 85 | StegoScan | Digital Forensics | — | Automated steganography detection across file types. | LCBOWER33/StegoScan https://github.com/LCBOWER33/StegoScan | | 86 | Surfactant - Modular Framework for File Information Extraction and SBOM Generation | Code Assessment | Major Update | LLNL's modular framework extracting software metadata from filesystems to identify components, vendors and third-party libraries and build SBOMs. | llnl/Surfactant https://github.com/llnl/Surfactant | | 87 | Suricata 8: Discover the Difference in Network Detection | Threat Hunting & IR | Major Update | The open-source IDS/IPS and network security monitor — this session covers what is new in the Suricata 8 release. | OISF/suricata https://github.com/OISF/suricata | | 88 | Suricata Turbo: Let Your NIC Drop the Flows Suricata Won't Miss | Network | Major Update | Adds hardware traffic-filtering offload so the NIC drops uninteresting flows, stopping random packet loss when Suricata cannot keep up. | DynaNIC/suricata-turbo https://github.com/DynaNIC/suricata-turbo | | 89 | Suzaku by Yamato Security | Digital Forensics | Major Update | Rust, Sigma-based threat hunting and DFIR timeline generator for cloud logs — Hayabusa's approach applied to JSON/JSON.gz at scale. | Yamato-Security/suzaku https://github.com/Yamato-Security/suzaku | | 90 | Tengu Marauder Vanguard Version 2.0 | Arsenal Lab, Hardware | Major Update | Raspberry Pi 5 robotic platform for physical red teaming and wireless assessment, with multiple units managed from a single Flask interface. | Lexicon121/Tengu-Marauder-Vanguard https://github.com/Lexicon121/Tengu-Marauder-Vanguard | | 91 | The Metasploit Framework 6.5: Malleable C2 Payloads, New Relay Capability and Protocol Session Upgrades | Exploitation | Minor Update | Metasploit 6.5: Malleable C2 profiles for HTTP Meterpreter, HTTP-to-SMB and HTTP-to-LDAP relaying, and protocol session upgrades. | rapid7/metasploit-framework https://github.com/rapid7/metasploit-framework | | 92 | ThreatShield - The Intelligent Way of Threat Modelling | Arsenal Lab, AI | — | Turns PRDs, architecture diagrams, Confluence pages, Slack threads and transcripts into STRIDE/PASTA threat models, attack trees, DREAD scores and ASVS tests. | — no repo confirmed | | 93 | ThreatXtension: AI-Powered Browser Extension Security Analysis Framework | Vulnerability Assessment | New Tool | Chrome extension security analysis combining SAST with LLM threat intelligence to assess permission risk and detect obfuscated malicious patterns. | barvhaim/ThreatXtension https://github.com/barvhaim/ThreatXtension | | 94 | Trajan: Cross-Platform CI/CD Security Scanner | Exploitation | New Tool | One scanner across GitHub Actions, Azure DevOps, GitLab and Jenkins, replacing the per-platform tooling patchwork. | praetorian-inc/trajan https://github.com/praetorian-inc/trajan | | 95 | TSURUGI LINUX - the sharpest weapon in your DFIR arsenal | Digital Forensics | New Tool | DFIR-focused Linux distribution shipping a curated, ready-to-use forensics toolset. | — not on GitHub; tsurugi-linux.org | | 96 | unrelabel: how to destroy an ML model | AI, ML & Data Science | New Tool | Interactive toolkit demonstrating label-poisoning attacks: import a dataset, pick an attack, and watch a classifier degrade from accurate to useless. | oz9un/unrelabel https://github.com/oz9un/unrelabel | | 97 | Vulnhalla 2.0: LLM-Guided Triage of CodeQL Findings | Code Assessment | Major Update | Runs CodeQL at scale and uses an LLM agent to triage findings true/false positive, with fast CSV-based context extraction and a reasoning engine. | cyberark/Vulnhalla https://github.com/cyberark/Vulnhalla | | 98 | VulnZoo: A Complete Vulnerable IoT Ecosystem for Security Research and Training | Internet of Things | New Tool | Vulnerable IoT ecosystem modelling a whole product — firmware, mobile app and cloud services — so cross-component attack chains can be studied. | DEKRA-Cybersecurity/VulnZoo https://github.com/DEKRA-Cybersecurity/VulnZoo | | 99 | WaffleX: Adaptive Semantic Analysis for WAF Resilience Testing | WebAppSec | New Tool | Generates semantically equivalent request variants to expose normalization gaps and parser inconsistencies between CDNs, proxies, WAFs and origin apps. | — no repo confirmed | | 100 | WebAgentAudit: Security Auditing of Web-Based AI Agents Through Browser Automation | Vulnerability Assessment | New Tool | Audits web-only AI agents embedded chatbots and LLM widgets through browser automation, requiring no API access to the model under test. | atom41research/webagentaudit https://github.com/atom41research/webagentaudit | | 101 | xEndity | Internet of Things | New Tool | Emulated digital twins of IoT devices, so teams can test hardware they cannot physically obtain or safely attack in production. | kenleejl/xEndityv2 https://github.com/kenleejl/xEndityv2 |