awesome-cyber-ai-arsenal - A curated collection of offensive, defensive and A

项目说明

<di="center">

<img src="assets/logo.png" alt="Awesome Cyber AI Arsenal" width="450">

⚔️ Awesome Cyber & AI Arsenal

A curated, battle‑tested collection of offensi and AI‑powered security tools.

E is split into 🔴 Offensive (Red Team), 🔵 Defensive (Blue Team) and 🤖 AI / LLM Security, with sane sub‑categories so you can find the right tool in seconds.

!Tools
!Categories
!AI%20Security
!PRs
!License

</div>

---

> [!WARNING]
> For authorized security testing and education only. Every tool listed here must be used only against systems you own or have explicit written permission to test. Unauthorized access is illegal. See the Disclaimer.

---

📑 Table of Contents

🔴 Offensi (Red Team)

- Reconnaissance — Subdomain / DNS / ASN
- Port Scanning & Network
- HTTP Probing / Crawling / Content Discovery
- Ja Analysis & Parameter Discovery
- Fuzzing
- Scanners (Web / App)
- Injection — SQL / NoSQL / Command / SSTI / LFI
- XSS
- Prototype Pollution / Open Redirect / CRLF
- SSRF / Request Smuggling / Web Cache
- GraphQL / API
- CMS / WordPress
- Auth / JWT / Password Cracking
- Deserialization / RMI / XXE
- 403 / 401 Bypass
- C2 / Exploitation / Post-Exploitation
- Out-of-Band (OOB) Interaction

🔵 Defensi (Blue Team / De)

- SAST / Code Analysis
- Dependency / Container / Supply-Chain Scanning
- Secrets Detection
- Network Management
- TLS / SSL Testing
- Hardening / Sanitization
- Ad Emulation / Purple Team

🤖 AI / LLM Security

- AI-Powered Offensi
- LLM Red Teaming & Scanning
- LLM Defense / Guardrails
- Uncensored / Local Models
- AI Security Frameworks & Knowledge

🕵️ OSINT

🧰 Utilities / Proxies / HTTP Clients

📚 Wordlists & Payloads

📖 Frameworks, References & Learning

🤝 Contributing

⚠️ Disclaimer

📄 License

---

🔴 Offensi (Red Team)

Reconnaissance — Subdomain / DNS / ASN

| Tool | Description |
| --- | --- |
| subfinder | Fast passi enumeration. |
| Amass | In-depth attack-surface mapping and asset discovery (OWASP). |
| Sublist3r | Subdomain enumeration using search engines. |
| OneForAll | Powerful all-in-one subdomain collection tool. |
| findomain | Cross-platform subdomain finder. |
| puredns | Fast DNS resolver + subdomain bruteforce with wildcard filtering. |
| shuffledns | massdns wrapper for bruteforce/resol. |
| dnsx | Fast, multi-purpose DNS toolkit. |
| zdns | Fast CLI DNS lookup at scale. |
| altdns | Subdomain permutation / alteration generator. |
| shosubgo | Grab subdomains from the Shodan API. |
| knock | Subdomain enumeration . |
| Sudomy | Subdomain enumeration & analysis framework. |
| scilla | Information-gathering (DNS/subdomain/port/dir) tool. |
| hakrevdns | Reverse DNS lookups from a list of IPs. |
| asnmap | Map network ranges using ASN information. |
| DNSDumpster | Online DNS recon & research service. |
| tlsx | TLS grabber for gathering data from certificates. |
| HostHunter | Disco from IP addresses. |
| subjack | Subdomain takeo. |
| can-i-take-o | Reference of services to subdomain takeover. |
| bbot | Recursi/recon "BEE-bot" scanner. |
| reconftw | End-to-end automated recon framework. |
| reNgine | Web recon engine with a UI and pipelines. |
| Chaos | Public DNS/subdomain dataset by ProjectDiscovery. |
| cloudlist | List assets/hostnames from cloud pro. |
| uncover | Query Shodan/Censys/Fofa for exposed hosts. |
| csprecon | Disco from Content-Security-Policy headers. |
| fa | Fingerprint tech hashes. |
| CloudFox | Cloud enumeration and attack-path discovery tool. |

Port Scanning & Network

| Tool | Description |
| --- | --- |
| naabu | Fast SYN/CONNECT port scanner. |
| masscan | Internet-scale TCP port scanner. |
| RustScan | Ultra-fast port scanner that pipes into Nmap. |
| Smap | Nmap-compatible scanner powered by Shodan (no packets sent). |
| proxify | Swiss-army-knife HTTP/HTTPS proxy for capture & tampering. |
| axiom | Dynamic distributed-scanning infrastructure ("attack fleet"). |
| ax | Maintained fork/e of Axiom for distributed scanning. |
| nmap | Network Discovery, Scanning, and Security Auditing. |
| Netcat | The classic TCP/IP "swiss-army knife" for reading/writing across connections. |

HTTP Probing / Crawling / Content Discovery

| Tool | Description |
| --- | --- |
| httpx | Fast, multi-purpose HTTP toolkit / prober. |
| httprobe | Probe a list of hosts for working HTTP/HTTPS. |
| meg | Fetch many paths from many hosts without hammering them. |
| gowitness | Screenshot websites at scale. |
| crawlergo | Headless-Chrome crawler that collects URLs & forms. |
| cariddi | Crawl + extract endpoints/params/secrets from JS in one shot. |
| Photon | Fast crawler with parameter & data extraction. |
| katana | Next-gen crawler built for offensi. |
| dirsearch | Web path/content brute-forcer. |
| feroxbuster | Fast recursi discovery (Rust). |
| DirDar | Directory brute-force & hidden-path discovery. |
| gau | Fetch known URLs from Wayback/OTX/Common Crawl. |
| waymore | More URLs from more archi than gau. |
| xurlfind3r | Passive URL discovery from online archives. |
| uro | De-duplicate and clean lists of near-duplicate URLs. |
| qsreplace | Replace query-string (great for payload injection). |
| | discovery scanner. |
| hakrawler | Simple, fast web crawler for quick scoping. |
| gospider | Fast web spider written in Go. |

Ja Analysis & Parameter Discovery

| Tool | Description |
| --- | --- |
| LinkFinder | Disco inside Ja files. |
| xnLinkFinder | Extract endpoints/links from JS, files & burp exports. |
| getJS | Extract all Ja file URLs from a page. |
| subjs | Fetch Ja file references from a list of URLs. |
| jsluice | Extract URLs, paths & secrets from Ja (BishopFox). |
| Arjun | HTTP hidden-parameter discovery. |
| ParamSpider | Mine parameters from web archives. |
| x8 | Blazing-fast hidden parameter discovery (Rust). |
| apkleaks | Scan APKs for URIs, endpoints & secrets. |

Fuzzing

| Tool | Description |
| --- | --- |
| ffuf | Fast web fuzzer (dir, param, vhost, more). |
| wfuzz | Flexible web application fuzzer. |
| REcollapse | Generate payloads to fuzz normalization/ logic. |

Scanners (Web / App)

| Tool | Description |
| --- | --- |
| nuclei | Template-based, fast, community-dri scanner. |
| nuclei-templates | Official community templates for Nuclei. |
| nuclei-wordfence-cve | Nuclei templates generated from Wordfence CVEs. |
| cent | Aggregate community Nuclei templates. |
| jaeles | Powerful, flexible web-app scanning framework. |
| nikto | Classic web-ser. |
| wapiti | Black-box web-app scanner. |
| scan4all | All-in-one scanning framework (recon + vuln). |
| | Pentest scanner (Dorks/SQLi/XSS/LFI…). |
| VULNX | C intelligence/scanner. |
| ZAP | OWASP Zed Attack Proxy — full web-app scanner. |
| Nettacker | Automated pentest & information-gathering framework (OWASP). |
| Artemis | Modular scanner that assesses many hosts (CERT-PL). |
| Sn1per | Automated recon & attack-surface scanner. |
| BugBountyScanner | Recon/scan automation designed to run o days. |
| webanalyze | Technology detection (Wappalyzer-style) at scale. |
| WAD | Web application detector (fingerprinting). |
| RedTeam-Tools | Curated set of red-team tools & resources. |
| Aghast | OWASP scanner for common web issues. |
| Caido | A web security platform for auditing and testing web applications efficiently. |
| PlayWright | A framework for automating and testing web applications across all major browsers. |

Injection — SQL / NoSQL / Command / SSTI / LFI

| Tool | Description |
| --- | --- |
| sqlmap | Automatic SQL-injection detection & exploitation. |
| ghauri | Fast, smart SQL-injection tool. |
| DSSS | Damn Small SQLi Scanner (<100 lines). |
| NoSQLMap | Automated NoSQL / MongoDB injection. |
| commix | Automated command-injection exploitation. |
| SSTImap | Ser Template Injection detection & exploitation. |
| tplmap | Classic SSTI / code-injection exploitation. |
| LFISuite | Local File Inclusion scanner & exploiter. |

XSS

| Tool | Description |
| --- | --- |
| dalfox | Fast, powerful XSS scanner & param analyzer. |
| XSStrike | Ad XSS detection with payload generation. |
| xsser | Automated framework to detect & exploit XSS. |
| xsssniper | Automatic XSS discovery tool. |
| XssPy | Python XSS scanner that walks subdomains & params. |
| toxssin | XSS exploitation command-and-control server. |
| ezXSS | Easy blind-XSS testing & payload management. |
| LOXS | Multi-vuln scanner (LFI/OR/SQLi/XSS/CRLF). |
| DOMLogger++ | Browser ext to monitor DOM sinks for XSS research. |
| postMessage-tracker | Track postMessage usage for client-side bugs. |
| weaponised-XSS-payloads | Collection of impactful XSS payloads. |

Prototype Pollution / Open Redirect / CRLF

| Tool | Description |
| --- | --- |
| pphack | Client-side prototype-pollution scanner. |
| ppmap | Automated prototype-pollution scanner. |
| OpenRedireX | Fuzzer for open-redirect . |
| crlfuzz | Fast CRLF-injection scanner. |

SSRF / Request Smuggling / Web Cache

| Tool | Description |
| --- | --- |
| SSRFmap | Automatic SSRF fuzzer & exploitation. |
| Gopherus | Generate gopher payloads for SSRF exploitation. |
| http-request-smuggling | HTTP request-smuggling detection tooling. |
| http2smugl | HTTP/2 request-smuggling detection. |
| smuggler | HTTP request-smuggling / desync tester. |
| Web-Cache- | Detect web-cache poisoning/deception. |

GraphQL / API

| Tool | Description |
| --- | --- |
| graphw00f | GraphQL ser. |
| GraphQLmap | Interacti pentest / exploitation. |
| graphql-cop | Security auditor for GraphQL endpoints. |
| graphql- | a GraphQL API as an interacti. |
| Clair | Reco schema even with introspection off. |
| CrackQL | GraphQL password/brute-force & fuzzing. |
| noir | Attack-surface detector from source code (API endpoints). |

CMS / WordPress

| Tool | Description |
| --- | --- |
| wpscan | WordPress scanner. |
| CMSmap | Multi-CMS scanner (WP/Joomla/Drupal). |

Auth / JWT / Password Cracking

| Tool | Description |
| --- | --- |
| jwt-hack | JWT attack toolkit (crack, tamper, encode). |
| jwt-cracker | Brute-force HS256 JWT secrets. |
| jwt_tool | Analyze, tamper & attack JSON Web Tokens. |
| hashcat | World's fastest GPU password cracker. |
| thc-hydra | Fast network login brute-forcer. |

Deserialization / RMI / XXE

| Tool | Description |
| --- | --- |
| ysoserial | Generate Ja payloads. |
| ysoserial.net | .NET deserialization payload generator. |
| SerializationDumper | Dump Ja streams in human-readable form. |
| BaRMIe | Java RMI enumeration & attack tool. |
| xxeserv | Mini web server for XXE OOB exfiltration. |

403 / 401 Bypass

| Tool | Description |
| --- | --- |
| dontgo403 | Bypass 40x access-control restrictions. |

C2 / Exploitation / Post-Exploitation

| Tool | Description |
| --- | --- |
| NetExec | Network/AD swiss-army knife (successor to CrackMapExec). |
| BeEF | Browser Exploitation Framework. |
| pwncat | Post-exploitation platform / re handler. |
| CALDERA | Automated ad platform (MITRE). |
| e | MITM phishing framework for 2FA session hijacking. |
| re | Generate re one-liners quickly. |
| PowerSploit | PowerShell post-exploitation modules. |
| Findsploit | Instantly find exploits locally & online. |
| PoC-in-GitHub | Auto-collected C from GitHub. |

Out-of-Band (OOB) Interaction

| Tool | Description |
| --- | --- |
| interactsh | OOB interaction-gathering server & client. |
| dnsobserver | Helper DNS server to detect OOB/DNS interactions. |

Phishing

| Tool | Description |
| --- | --- |
| SET | Social-engineering attack simulation toolkit. |

---

🔵 Defensi (Blue Team / De)

🔬 DFIR / Forensics

| Tool | Description |
| --- | --- |
| iLEAPP | Extract info and data from iOS/iPadOS devices. |
| 3 | Memory forensics framework for RAM dump analysis. |
| Aleapp | Android Logs Events And Protobuf Parser |

SAST / Code Analysis

| Tool | Description |
| --- | --- |
| semgrep | Fast, multi-language static analysis with custom rules. |

Dependency / Container / Supply-Chain Scanning

| Tool | Description |
| --- | --- |
| trivy | All-in-one scanner for containers, IaC, deps & secrets. |
| os | Match dependencies against the OS DB (Google). |

Secrets Detection

| Tool | Description |
| --- | --- |
| trufflehog | Find & leaked credentials in code/history. |
| gitleaks | Detect hardcoded secrets in git repos. |
| S3Scanner | Find open/misconfigured S3 buckets. |

Network Management

| Tool | Description |
| --- | --- |
| open | Full-featured network scanner (Greenbone). |

TLS / SSL Testing

| Tool | Description |
| --- | --- |
| testssl.sh | Check a server's TLS/SSL config, ciphers & flaws. |
| Deep | TLS/SSL scanning API & tool (Java). |

Hardening / Sanitization

| Tool | Description |
| --- | --- |
| DOMPurify | XSS sanitizer for HTML/DOM (defensive). |

Ad Emulation / Purple Team

| Tool | Description |
| --- | --- |
| CALDERA | Automated ad to detections (MITRE). |
| PowerSploit | Useful for building & testing blue-team detections. |

---

🤖 AI / LLM Security

> The core reason this repo exists: security tooling powered by (and targeting) AI/LLMs. Split into offensi, LLM red teaming, defensi, local models and knowledge.

AI-Powered Offensi

| Tool | Description |
| --- | --- |
| strix | Autonomous AI agents that pentest your apps. |
| PentestGPT | LLM-dri layer that guides pentests. |
| CAI (Cybersecurity AI) | Framework for building AI agents for offensi security. |
| hackingBuddyGPT | Research framework for LLM-powered autonomous hacking. |
| Nebula | AI-assisted pentest assistant that suggests & runs commands. |
| hermes-agent | Function-calling agent scaffolding (Nous Research). |
| Colibri | Lightweight AI security agent. |
| Page Index | RAG system that analyzes documents without chunks or databases |
| Lite LLM | A unified AI gateway for accessing and managing 100+ LLM pro through one API. |
| Anthropic-cybersecurity-skills | Cybersecurity skills for Claude and other AI agents. |

LLM Red Teaming & Scanning

| Tool | Description |
| --- | --- |
| garak | LLM scanner (prompt injection, jailbreaks, leakage) — NVIDIA. |
| PyRIT | Python Risk Identification Toolkit for generative AI (Microsoft). |
| promptfoo | Test, red-team & e LLM apps (50+ vuln types). |
| deepteam | LLM red-teaming framework mapped to OWASP LLM Top 10. |
| agentic_security | Open-source LLM/agent scanner. |
| agentic-radar | Static analysis of agent workflows for excessi risk. |
| Garak probes / MITRE ATLAS | Ad landscape for AI systems. |
| Claude-bughunter | Red-Team skills for Claude and other AI agents to perform in Bug Bounty |

LLM Defense / Guardrails

| Tool | Description |
| --- | --- |
| LLM Guard | Security toolkit for LLM interactions (input/output filtering). |
| Rebuff | Prompt-injection detector with multi-layer defense. |
| Vigil | Detect prompt injections, jailbreaks & risky inputs. |
| Giskard | Test & scan ML/LLM models for & bias. |

Uncensored / Local Models

> For offline/private research where cloud models refuse security tasks. Use responsibly and legally.

| Resource | Description |
| --- | --- |
| heretic | Automatic "decensoring" of transformer models. |
| Huihui-GLM abliterated | Abliterated / uncensored GLM model weights (GGUF). |

AI Security Frameworks & Knowledge

| Resource | Description |
| --- | --- |
| MITRE ATLAS | Ad threat matrix for AI/ML systems. |
| OWASP Top 10 for LLM Apps | The standard risk list for LLM applications. |
| Local LLMs for pentesting (r/Pentesting) | Community discussion on real-world local-LLM pentest use. |

---

🕵️ OSINT

| Tool | Description |
| --- | --- |
| SpiderFoot | Automated OSINT collection & attack-surface mapping. |
| recon-ng | Full-featured web recon framework (Metasploit-style). |
| OSINT-Mapping-Tool | Map & OSINT relationships. |
| IntelOwl | Threat-intelligence data at scale via one API. |
| pagodo | Passi automation. |
| ditto | Detect typosquatting / lookalike domains. |
| Maigret | Collect a person's accounts across thousands of sites. |
| Osintgram | OSINT toolkit for Instagram. |
| GhostTrack | Track location / phone / username info. |
| TraceLabs OSINT VM | Preconfigured OSINT in en. |
| Metabigor | OSINT without API keys (ASN, IP, org). |
| gitGraber | Monitor GitHub for leaked secrets/tokens. |
| Maltego | Link-analysis & graph OSINT platform. |
| Hunchly | Web-capture tool for OSINT in. |
| Je | Read-only social research app that uses bounded Je and the local socai CLI to retain source-linked Instagram, TikTok, and LinkedIn e. |
| IntelX | Search engine & data archive for OSINT. |
| BrixHub | Search engine for finding public information quickly.|
| PimEyes | Face Search And Reverse Image Search Engine. |
| seeKnow | Powerful OSINT tool for searching breach data and online information. |

---

🧰 Utilities / Proxies / HTTP Clients

| Tool | Description |
| --- | --- |
| mitmproxy | Interacti intercepting proxy. |
| hetty | Open-source HTTP toolkit / Burp alternative. |
| CyberChef | The "cyber swiss-army knife" for encoding/crypto/data (GCHQ). |
| curl | The uni command-line HTTP client. |
| httpie | Human-friendly CLI HTTP client. |
| hurl | Run & test HTTP requests in plain text. |
| Atlas | Quick SQLmap tamper-script suggester. |
| fzf | Command-line fuzzy finder. |
| pet | Simple command-line snippet manager. |
| pentest-tools | Collection of handy pentest scripts (gwen001). |
| Hack-Tools | All-in-one red-team browser extension. |
| Redcloud | Deploy a full red-team attack infrastructure via UI. |
| grex | Generate regexes from example inputs. |

---

📚 Wordlists & Payloads

| Resource | Description |
| --- | --- |
| SecLists | The go-to collection of wordlists for security testing. |
| Assetnote Wordlists | High-quality wordlists built from internet-wide data. |
| PayloadsAllTheThings | Payloads & bypasses for every web vuln class. |
| IntruderPayloads | Burp Intruder payloads, fuzz lists & wordlists. |
| CeWL | Generate custom wordlists by spidering a target. |
| COOK | Powerful wordlist generator & permutation engine. |
| jsfuck | Write JS using only 6 characters (filter bypass). |
| OCD Mindmaps | Pentest / Acti attack mindmaps. |

---

📖 Frameworks, References & Learning

| Resource | Description |
| --- | --- |
| MITRE ATT&CK | Global knowledge base of ad tactics & techniques. |
| OWASP | Foundation for web/app security standards & projects. |
| PortSwigger Web Security Academy | Free, hands-on web-security training. |
| Darkmoon | Open source (GPL-3.0) autonomous AI pentest platform for web, API, Acti and Kubernetes, running as an MCP host with a local privacy gateway. |
| ProjectDiscovery | Home of subfinder/httpx/nuclei & the recon ecosystem. |
| Awesome-Cybersecurity-Handbooks | Huge handbook of techniques, tools & notes. |
| re | Re & pentest skill notes. |
| Wiz Bug Bounty Masterclass | Free recon/bug-bounty masterclass. |
| Exploit-DB | The classic exploit & shellcode database. |
| Google Hacking Database | Curated Google dorks for exposure discovery. |
| cybersecurity-help VDB | CVE / 0-day database. |
| InfoSec Write-ups | Community bug-bounty & security write-ups. |

---

🤝 Contributing

Contributions are welcome! Please read CONTRIBUTING.md first.

In short: open a Pull Request that adds the tool to the correct category, keep the one-line description factual, make sure the link works, and keep entries alphabetical-ish within a section. New categories are fine when something genuinely doesn't fit.

---

⚠️ Disclaimer

This repository is provided for educational purposes and authorized security testing only. The tools listed are created and maintained by their respecti. Using any of these tools against systems, networks, or applications without explicit prior authorization is illegal and may result in criminal and ci. The maintainers of this list assume no responsibility for misuse. Always act ethically and within the law.

---

📄 License

Distributed under the MIT License. The listed tools remain the property of their respecti and are go by their own licenses.

项目信息

开发语言：未知

Star 数：175

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated collection of offensive, defensive and AI/LLM security tools.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。