L

spinel. C

RatatuiRuby. 💎 Unofficial Ruby wrapper for Ratatui 👨‍🍳🐀.

ruby_llm. One delightful Ruby framework for every major AI provider. Build AI agents, chatbots, RAG apps, and multimodal workflows in beautiful, expressive code.

mlx-ruby. Ruby Bindings for the MLX Framework

openclaw. Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

wails. Create beautiful applications using Go

tauri. Build smaller, faster, and more secure desktop and mobile applications with a web frontend.

ViewState-Cracker. ASP.net ViewState密钥被动扫描爆破BurpSuite插件

red-candle. Ruby gem for running state-of-the-art language models locally. Access LLMs, embeddings, rerankers, and NER models directly from Ruby using Rust-powered Candle with Metal/CUDA acceleration.

sgkrank. 2026最新免费社工库排行

ptcpdump. Process-aware, eBPF-based tcpdump

kyanos. Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.

linux-firmware. C

chsrc. chsrc 全平台通用换源工具与框架. Change Source everywhere for every software

btop. A monitor of resources

unisec. Unicode Security Toolkit

DllToShellCode. Fast Conversion Windows Dynamic Link Library To ShellCode

xaes256gcm. Package xaes256gcm implements the XAES-256-GCM extended-nonce AEAD.

arthas. Alibaba Java Diagnostic Tool Arthas/Alibaba Java诊断利器Arthas

relay. 高性能、低资源开销的 relay/proxy 工具

awesome-free-chatgpt. 🆓免费的 ChatGPT 镜像网站列表，持续更新。List of free ChatGPT mirror sites, continuously updated.

java-echo-generator. 一款支持自定义的 Java 回显载荷生成工具｜A customizable Java echo payload generation tool.

java-memshell-generator. 一款支持自定义的 Java 内存马生成工具｜A customizable Java in-memory webshell generation tool.

torch.rb. Deep learning for Ruby, powered by LibTorch

Awesome-Domain-LLM. 收集和梳理垂直领域的开源模型、数据集及评测基准。

picker. 将repo变成RSS订阅,文章整理归档, 讨论的社区

deobfuscator. The real deal

protocol-quic. C++

pics. File formats dissections and more...

zeek. Zeek is a powerful network analysis framework that is much different from the typical IDS you may know.

speedscope. 🔬 A fast, interactive web-based viewer for performance profiles.

rbspy. Sampling CPU profiler for Ruby

cli. GitHub’s official command line tool

create_ap. [NOT MAINTAINED] This script creates a NATed or Bridged WiFi Access Point.

bettercap. The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

stackprof. a sampling call-stack profiler for ruby 2.2+

nsproxy. A Linux tool that forces apps to use a SOCKS/HTTP proxy

Good-MITM. Rule-based MITM engine. Rewriting, redirecting and rejecting on HTTP(S) requests and responses, supports JavaScript rule.

nali. An offline tool for querying IP geographic information and CDN provider. 一个查询IP地理信息和CDN服务提供商的离线终端工具.

alacritty. A cross-platform, OpenGL terminal emulator.

carbonyl. Chromium running inside your terminal

BilibiliVideoDownload. Cross-platform download bilibili video desktop software, support windows, macOS, Linux

fzf. :cherry_blossom: A command-line fuzzy finder

re0-kubernetes-sec-archive. :atom: [WIP] 整理过去我和K8s、容器、虚拟化相关的分享 🧐

ronin. Ronin is a Free and Open Source Ruby Toolkit for Security Research and Development. Ronin also allows for the rapid development and distribution of code, exploits, payloads, etc, via 3rd-party git repositories.

zeitwerk. Efficient and thread-safe code loader for Ruby

msgpack-ruby. MessagePack implementation for Ruby / msgpack.org[Ruby]

ppspoofing. Rust编写的父进程PID欺骗技术测试工具

goweight. A tool to analyze and troubleshoot a Go binary size.

learnjavabug. Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

katana. A next-generation crawling and spidering framework.

cnzhnet.music_decrypt. 中国国内音乐 app 会员下载的无损音乐解密工具.

WechatExporter. Wechat Chat History Exporter 微信聊天记录导出备份程序

wsMemShell. WebSocket 内存马/Webshell，一种新型内存马/WebShell技术

lux. 👾 Fast and simple video download library and CLI tool written in Go

bore. 🕳 bore is a simple CLI tool for making tunnels to localhost

r0capture. 安卓应用层抓包通杀脚本

Bash-Oneliner. A collection of handy Bash One-Liners and terminal tricks for data processing and Linux system maintenance.

java-memshell-scanner. 通过jsp脚本扫描java web Filter/Servlet型内存马

chatViewTool. 基于Java实现的图形化微信聊天记录解密查看器

Graph-Easy. Convert or render graphs (as ASCII, HTML, SVG or via Graphviz)

hacktricks. Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

Awesome-Redteam. 一个攻防知识库。A knowledge base for red teaming and offensive security.

Pentest101. 一些关于渗透测试的Tips

Neo-reGeorg. Neo-reGeorg is a project that seeks to aggressively refactor reGeorg

HackJava. 《Java安全-只有Java安全才能拯救宇宙》Only Java Security Can Save The Universe.

bad-bpf. A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29

sysdig. Linux system exploration and troubleshooting tool with first class support for containers

bpftrace. High-level tracing language for Linux

bpf_study. bpf 学习仓库

dll_to_exe. Converts a DLL into EXE

hertzbeat. An AI-powered next-generation open source real-time observability system.

vulbase. 各大漏洞文库合集

PentestDB. 各种数据库的利用姿势

zkar. ZKar is a Java serialization protocol analysis tool implement in Go.

ecapture. Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.

expert_readed_books. 2021年最新总结，推荐工程师合适读本，计算机科学，软件技术，创业，思想类，数学类，人物传记书籍

concurrent-ruby. Modern concurrency tools including agents, futures, promises, thread pools, supervisors, and more. Inspired by Erlang, Clojure, Scala, Go, Java, JavaScript, and classic concurrency patterns.

kernel_new_features. 一个深挖 Linux 内核的新功能特性，以 io_uring, cgroup, ebpf, llvm 为代表，包含开源项目，代码案例，文章，视频，架构脑图等

rakkess. Review Access - kubectl plugin to show an access matrix for k8s server resources

rakkess. Review Access - kubectl plugin to show an access matrix for k8s server resources

StopDefender. Stop Windows Defender programmatically

golang-shellcode-bypassav. 2021.12.9 使用go语言免杀360、微软、腾讯、火绒

massdns. A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

IoT-vulhub. IoT固件漏洞复现环境

Impost3r. 👻Impost3r -- A linux password thief

PowerRemoteDesktop. Remote Desktop entirely coded in PowerShell.

Shhhloader. Syscall Shellcode Loader (Work in Progress)

Armariris. 孤挺花（Armariris） -- 由上海交通大学密码与计算机安全实验室维护的LLVM混淆框架

rogue-jndi. A malicious LDAP server for JNDI injection attacks

fq. jq for binary formats - tool, language and decoders for working with binary and text formats

mosh. Mobile Shell

Remmina. Mirror of https://gitlab.com/Remmina/Remmina The GTK+ Remmina Remote Desktop Client

OffensiveRust. Rust Weaponization for Red Team Engagements.

the-art-of-command-line. Master the command line, in one page

nuclei. Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

learn-hack. 打造超人學習

LTProxy. Linux Transparent Proxy (Similar to Proxifiter)

awesome-console-services. A curated list of awesome console services (reachable via HTTP, HTTPS and other network protocols)

modern-unix. A collection of modern/faster/saner alternatives to common unix commands.

fapro. Fake Protocol Server

vulfocus. 🚀Vulfocus 是一个漏洞集成平台，将漏洞环境 docker 镜像，放入即可使用，开箱即用。

jq. Command-line JSON processor

fd. A simple, fast and user-friendly alternative to 'find'

dog. A command-line DNS client.

yjit. Optimizing JIT compiler built inside CRuby

age. A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

remote-method-guesser. Java RMI Vulnerability Scanner

MetasploitModules_0x727. Metasploit Modules Development

Seatbelt. Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

MemoryShell. JavaWeb MemoryShell Inject/Scan/Killer/Protect Research & Exploring

UTM. Virtual machines for iOS and macOS

artichoke. 💎 Artichoke is a Ruby made with Rust

awesome-compose. Awesome Docker Compose samples

phpggc. PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

rjb. Ruby Java Bridge

ysoserial-for-woodpecker. 给woodpecker框架量身定制的ysoserial

ctf-scripts. Some of CTF scripts

pwcrack-framework. Password Crack Framework

MX1014. MX1014 is a flexible, lightweight and fast port scanner.

pentest_study. 从零开始内网渗透学习

As-Exploits. 中国蚁剑后渗透框架

linux. Linux kernel source tree

GadgetProbe. Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

PEx64-Injector. A tool for injecting 64-bit executables into legitimate processes. Users can specify a local file or download one from a URL, with all operations performed in memory to evade antivirus detection.

ProcessInjection. This program is designed to demonstrate various process injection techniques

iox. Tool for port forwarding & intranet proxy

RedTeamCCode. Red Team C code repo

Stowaway. 👻Stowaway -- Multi-hop Proxy Tool for pentesters

LLK. a linux login log check & fake tool

herpaderping. Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

Java-Rce-Echo. Java RCE 回显测试代码

delete-self-poc. A way to delete a locked file, or current running executable, on disk.

bof-collection. Collection of Beacon Object Files (BOF) for Cobalt Strike

MacHack. Hidden Tools in macOS

DefaultCreds-cheat-sheet. One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️

vcpkg. C++ Library Manager for Windows, Linux, and MacOS

PentesterSpecialDict. 构建优化高效的渗透 fuzz 字典合集

cpr. C++ Requests: Curl for People, a spiritual port of Python Requests.

360SafeBrowsergetpass. 这是一个一键辅助抓取360安全浏览器密码的CobaltStrike脚本以及解密小工具，用于节省红队工作量，通过下载浏览器数据库、记录密钥来离线解密浏览器密码。

Active-Directory-Pentest-Notes. 个人域渗透学习笔记

JspMaster-Deprecated. 一款基于webshell命令执行功能实现的GUI webshell管理工具，支持流量加密

portfwd. User-space TCP/UDP port forwarding services

redteam_vul. 红队作战中比较常遇到的一些重点系统漏洞整理。

shellcodeloader. shellcodeloader

r77-rootkit. Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

OffensiveNim. My experiments in weaponizing Nim (https://nim-lang.org/)

domainTools. 内网域渗透小工具

RustScan. 🤖 The Modern Port Scanner 🤖

WhatsMyName. Community-maintained dataset of 700+ websites for finding accounts by username — powers OSINT and digital footprint tools.

Eventlogedit-evtx--Evolution. Remove individual lines from Windows XML Event Log (EVTX) files

HackBrowserData. Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

purple-team-attack-automation. Praetorian's public release of our Metasploit automation of MITRE ATT&CK™ TTPs

PowerShdll. Run PowerShell with rundll32. Bypass software restrictions.

WMIHACKER. A Bypass Anti-virus Software Lateral Movement Command Execution Tool

Powershell-Attack-Guide. Powershell攻击指南----黑客后渗透之道

tsh. Tiny SHell is an open-source UNIX backdoor.

Erebus. CobaltStrike后渗透测试插件

fakelogonscreen. Fake Windows logon screen to steal passwords

xsv. A fast CSV command line toolkit written in Rust.

tmuxinator. Manage complex tmux sessions easily

lsassy. Extract credentials from lsass remotely

bcc. BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

slim. Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)

fuzzDicts. You Know, For WEB Fuzzing !

nnn. n³ The unorthodox terminal file manager

mimikatz. A little tool to play with Windows security

ruler. A tool to abuse Exchange services

metasploit-framework. Metasploit Framework

BaiduYunVIP. 百度云百度网盘超级会员账号SVIP账号 分享, 另分享多款百度网盘不限速下载工具以及各大平台会员账号（迅雷 优酷 爱奇艺 腾讯视频等）.

airgeddon. This is a multi-use bash script for Linux systems to audit wireless networks.

ctftool. Interactive CTF Exploration Tool

watir. Watir Powered By Selenium

shodan-python. The official Python library for Shodan

tty. Toolkit for developing sleek command line apps.

radare2. UNIX-like reverse engineering framework and command-line toolset

CyberChef. The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

gophish. Open-Source Phishing Toolkit

FastjsonExploit. Fastjson vulnerability quickly exploits the framework（fastjson漏洞快速利用框架）

SSRF-Testing. SSRF (Server Side Request Forgery) testing resources

BaiduNetdiskPlugin-macOS. For macOS.百度网盘 破解SVIP、下载速度限制~

high-speed-downloader. 已不再维护

PicGo. :rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosting services (S3, GitHub, Cloudflare R2, Imgur, Aliyun OSS...). Paste, upload, done.

huginn. Create agents that monitor and act on your behalf. Your agents are standing by!

RsaCtfTool. RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

algorithms. algorithms playground for common questions

EnterpriseWifiPasswordRecover. This is a tool that recovers WPA2 Enterprise Wifi Credentials from a machine.

WeChatExtension-ForMac. A plugin for Mac WeChat

patator. Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.

ffuf. Fast web fuzzer written in Go

exploits. Some of my exploits.

CheckPlease. Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.

ChinaMobilePhoneNumberRegex. Regular expressions that match the mobile phone number in mainland China. / 一组匹配中国大陆手机号码的正则表达式。

CarHackingTools. Install and Configure Common Car Hacking Tools.

pupy. Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Awesome-WAF. Everything about Web Application Firewalls (WAFs) from Security Standpoint! 🔥

jadx. Dex to Java decompiler

Java-Deserialization-Cheat-Sheet. The cheat sheet about Java Deserialization vulnerabilities

the-practical-linux-hardening-guide. This guide details creating a secure Linux production system. OpenSCAP (C2S/CIS, STIG).

IntruderPayloads. A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.