hmartos

agency-agents. A complete AI agency at your fingertips - From frontend wizards to Reddit community ninjas, from whimsy injectors to reality checkers. Each agent is a specialized expert with personality, processes, and proven deliverables.

learn-harness-engineering. Harness engineering beginner tutorial, from 0 to 1

RoguePlanet. RoguePlanet Windows Defender Vulnerability

andrej-karpathy-skills. A single CLAUDE.md file to improve Claude Code behavior, derived from Andrej Karpathy's observations on LLM coding pitfalls.

python-binance. Binance Exchange API python implementation for automated trading

pentesting-skills.

iOS-SSL-pinning-bypass-without-jalibreak. SSL pinning bypass setup for iOS (No Jailbreak) using OpenVPN + iptables traffic redirection to proxy (Burp Suite / mitmproxy)

awesome-codex-subagents. A collection of 130+ specialized Codex subagents covering a wide range of development use cases.

Arjun. HTTP parameter discovery suite.

cai. Cybersecurity AI (CAI), the framework for AI Security

openfang. Open-source Agent Operating System

threat-designer. Threat Designer is a GenerativeAI application designed to automate and streamline the threat modeling process for secure system design.

incapsula-cli. This application provides a simple to use CLI that reflects industry standards (such as the AWS cli), and enables customers to easily integrate into configurations management, orchestration or automation frameworks to support the DevOps model

pentagi. Fully autonomous AI Agents system capable of performing complex penetration testing tasks

moltbot-1click-rce. Clawdbot/Moltbot/OpenClaw One-click RCE PoC 🦞 (CVE-2026-25253)

ecloop. 🔐💻 ecloop: A high-performance, CPU-optimized tool for computing public keys on the secp256k1 elliptic curve, with features for searching compressed & uncompressed public keys and customizable search parameters.

torproxy. Shell

architecture-decision-record. Architecture decision record (ADR) examples for software planning, IT leadership, and template documentation

certmate. SSL Certificate Management System (API + UI)

soc_chef. Security Operations Chef

hetty. An HTTP toolkit for security research.

UptimeKit-CLI. A modern, cross‑platform CLI to monitor websites and APIs.

scilla. Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

Cloudmare. Cloudflare, Sucuri, Incapsula real IP tracker.

evilwaf. evilwaf is a penetration testing tool designed to detect and bypass common Web Application Firewalls (WAFs).

AI-Trader. "AI-Trader: 100% Fully-Automated Agent-Native Trading"

cloud-security-resources.

CVE-2025-55182. Explanation and full RCE PoC for CVE-2025-55182

iptv. Collection of publicly available IPTV channels from all over the world

security_articles.

n8n-skills. n8n skillset for Claude Code to build flawless n8n workflows

rotating-tor-http-proxy. A multi-arch image provides one HTTP proxy endpoint with many concurrent tunnels to the Tor network.

firezone. Enterprise-ready zero-trust access platform built on WireGuard®.

logocreator. A free + OSS logo generator powered by Flux on Together AI

electrs. An efficient re-implementation of Electrum Server in Rust

esplora. Explorer for Bitcoin and Liquid

hexstrike-ai. HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

hashcat. World's fastest and most advanced password recovery utility

FanControl.Releases. This is the release repository for Fan Control, a highly customizable fan controlling software for Windows.

HUNT. Python

libros. Libros y documentación propia desarrollada durante investigaciones

known_aws_accounts. List of known AWS accounts

gitscraper. A tool which scrapes public github repositories for common naming conventions in variables, folders and files

aws_pwn. A collection of AWS penetration testing junk

CyberChef. The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

tinyproxy. tinyproxy - a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems

pgloader. Migrate to PostgreSQL in a single command!

noir. Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

pysonDB. A Simple , ☁️ Lightweight , 💪 Efficent JSON based database for 🐍 Python. PysonDB-V2 has been released ⬇️

jsondiff. Diff JSON and JSON-like structures in Python

pydig. Python wrapper library for the 'dig' command line tool

cloc. cloc counts blank lines, comment lines, and physical lines of source code in many programming languages.

API-Security-Checklist. Checklist of the most important security countermeasures when designing, testing, and releasing your API

hacktricks-cloud. CSS

hacktricks. Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

cloudflared. Cloudflare Tunnel client

trufflehog. Find, verify, and analyze leaked credentials

gitleaks. Find secrets with Gitleaks 🔑

python-dotenv. Reads key-value pairs from a .env file and can set them as environment variables. It helps in developing applications following the 12-factor principles.

local-ssl-proxy. Simple SSL HTTP proxy using a self-signed certificate. Intended for local development only.

prowler. Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

llm-security. New ways of breaking app-integrated LLMs

gitfiti. abusing github commit history for the lulz

DeepLinkDispatch. A simple, annotation-based library for making deep link handling better on Android

urllib3. urllib3 is a user-friendly HTTP client library for Python

pipeline-aws-plugin. Jenkins Pipeline Step Plugin for AWS

python-systemd-tutorial. A tutorial for writing a systemd service in Python

busybox. Busybox container with glibc+opkg

websocket-client. WebSocket client for Python

gpt3_security_vulnerability_scanner. GPT-3 found hundreds of security vulnerabilities in this repo - (this was the first real LLM cybersecurity eval!)

aws-app-mesh-examples. AWS App Mesh is a service mesh that you can use with your microservices to manage service to service communication.

python-zxing. python wrapper for the ZXing barcode library

zxing. ZXing ("Zebra Crossing") barcode scanning library for Java, Android

ta-lib-python. Python wrapper for TA-Lib (http://ta-lib.org/).

go-cast. A command line tool to control Google Chromecast devices.

huginn. Create agents that monitor and act on your behalf. Your agents are standing by!

KeyDecoder. KeyDecoder app lets you use your smartphone or tablet to decode your mechanical keys in seconds.

awesome-layers. λ A curated list of awesome AWS Lambda Layers. Sponsored by https://cloudash.dev

zip-aws-lambda-layer. Zip for AWS Lambda as layer

git-lambda-layer. A layer for AWS Lambda that allows your functions to use `git` and `ssh` binaries

learn-terraform-lambda-api-gateway. HCL

docker-images. Official source of container configurations, images, and examples for Oracle products and projects

agentic. Your API ⇒ Paid MCP. Instantly.

chatgpt-mac. ChatGPT for Mac, living in your menubar.

Awesome-Cybersecurity-Handbooks. A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.

valtix-controller-discovery.

easy-rsa. easy-rsa - Simple shell based CA utility

terraform-aws-setup. AWS Setup for integration with Valtix

wonk. Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

aws-codebuild-docker-images. Official AWS CodeBuild repository for managed Docker images http://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref.html

emoji-shellcoding. 🤩 Emoji shellcoding tools for RISC-V (32-bit and 64-bit)

Windows-WiFi-Extractor. Extract Windows Wi-Fi Passwords to Remote URL

MalwareSourceCode. Collection of malware source code for a variety of platforms in an array of different programming languages.

cloudgoat. CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

terraform. Terraform enables you to safely and predictably create, change, and improve infrastructure. It is a source-available tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.

k6. A modern load testing tool, using Go and JavaScript

NGINX-Demos. NGINX and NGINX Plus demos

dbeaver. Free universal database tool and SQL client

aws-cli. Universal Command Line Interface for Amazon Web Services

aws-load-balancer-controller. A Kubernetes controller for Elastic Load Balancers

argo-cd. Declarative Continuous Deployment for Kubernetes

amazon-ecr-credential-helper. Automatically gets credentials for Amazon ECR on docker push/docker pull

autopsy. Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.

responsively-app. A modified web browser that helps in responsive web development. A web developer's must have dev-tool.

jphs. jphide & seek steganography tools

mvt. MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

nginx-certbot. Boilerplate configuration for nginx and certbot with docker-compose

chokidar. Minimal and efficient cross-platform file watching library

fuxploider. File upload vulnerability scanner and exploitation tool.

ansible-examples. A few starter examples of ansible playbooks, to show features and how they work together. See http://galaxy.ansible.com for example roles from the Ansible community for deploying many popular applications.

skanuvaty. Dangerously fast DNS/network/port scanner

xmrig. RandomX, KawPow, CryptoNight and GhostRider unified CPU/GPU miner and RandomX benchmark

top-10-cicd-security-risks.

Docker-OSX. Run macOS VM in a Docker! Run near native OSX-KVM in Docker! X11 Forwarding! CI/CD for OS X Security Research! Docker mac Containers.

storybook. Storybook is the industry standard workshop for building, documenting, and testing UI components in isolation

ILOVEYOU. Formatted and commented source code of ILOVEYOU/Love Letter

VQGAN-CLIP. Just playing with getting VQGAN+CLIP running locally, rather than having to use colab.

OneListForAll. Rockyou for web fuzzing

wtfbins. WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.

masscan. TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.

dotenv. Loads environment variables from .env for nodejs projects.

dronesploit. Drone pentesting framework console

Diamorphine. LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

playwright-java. Java version of the Playwright testing and automation library

awesome-docker. :whale: A curated list of Docker resources and projects

hello-world-rest. A simple REST Service that echoes back all request send to it.

osint_stuff_tool_collection. A collection of several hundred online tools for OSINT

pdf-lib. Create and modify PDF documents in any JavaScript environment

swiper. Most modern mobile touch slider with hardware accelerated transitions

awesome-browser-exploit. awesome list of browser exploitation tutorials

CS7038-Malware-Analysis. Course Repository for University of Cincinnati Malware Analysis Class (CS[567]038)

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

gophish. Open-Source Phishing Toolkit

automate_firmware. Go

airgeddon. This is a multi-use bash script for Linux systems to audit wireless networks.

isomorphic-dompurify. Use DOMPurify on server and client in the same way

express. Fast, unopinionated, minimalist web framework for node.

docker-compose-icinga. docker-compose Icinga stack

tldraw. Build infinite canvas apps in React with the tldraw SDK. World's best, top-most agent recommended #1 five star SDK.

busboy. A streaming parser for HTML form data for node.js

npm-run-all. A CLI tool to run multiple npm-scripts in parallel or sequential.

playwright. Playwright is a framework for Web Testing and Automation. It allows testing Chromium, Firefox and WebKit with a single API.

pythonizing_nmap. A detailed guide showing you different ways you can incorporate Python into your workflows around Nmap.

awesome-bugbounty-tools. A curated list of various bug bounty tools

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

cors. Node.js CORS middleware

gitlab-plugin. A Jenkins plugin for interfacing with GitLab

pipeline-model-definition-plugin. Groovy

docker-socket-proxy. Proxy over your Docker socket to restrict which requests it accepts

binance-connector-js. A simple connector to Binance Public API

binance-api-postman. Postman collection for Binance Public API, including spot, margin, futures, etc.

knowledge-base-v3. MyEtherWallet's Knowledge Base

MockDate. A JavaScript Mock Date object that can be used to change when "now" is.

js-cookie. A simple, lightweight JavaScript API for handling cookies, client-side.

the-book-of-secret-knowledge. A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

Awesome-Hacking. A collection of various awesome lists for hackers, pentesters and security researchers

react-animate-on-scroll. React component to provide animations when the user scrolls

react-input-mask. Input masking component for React. Made with attention to UX.

Ayusocoin. AyusoCoin token - a simple ERC20 token to help spanish policymakers understand what crypto is about.

next.js. The React Framework

beef. The Browser Exploitation Framework Project

docker-cron. An example of running cron job in a docker container

docker-cron. Docker container for managing cron jobs

docker-cron. Shell

local-cors-proxy. Simple proxy to bypass CORS issues.

dom-to-image. Generates an image from a DOM node using HTML5 canvas

gulp-clean-css. Minify css with clean-css.

pacu. The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

CloudPentestCheatsheets. This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

react-string-replace. A simple way to safely do string replacement with React components

react-inky. 🦑 React components for Inky

tesseract.js. Pure Javascript OCR for more than 100 Languages 📖🎉🖥

react-typist. Typing animations with React

grunt-email-workflow. A Grunt workflow for designing and testing responsive HTML email templates with SCSS.

awesome-osint. :scream: A curated list of amazingly awesome OSINT

trape. People tracker on the Internet: OSINT analysis and research tool by Jose Pino

enzyme-adapter-react-17. Unofficial adapter for React 17 for Enzyme.

prompt. a beautiful command-line prompt for node.js

stacktrace.js. Generate, parse, and enhance JavaScript stack traces in all web browsers

pm2. Node.js/Bun Production Process Manager with a built-in Load Balancer.

n8n. Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.

docassemble. A free, open-source expert system for guided interviews and document assembly, based on Python, YAML, and Markdown.

foundation-emails. Quickly create responsive HTML emails that work on any device and client. Even Outlook.

aws-doc-sdk-examples. Welcome to the AWS Code Examples Repository. This repo contains code examples used in the AWS documentation, AWS SDK Developer Guides, and more. For more information, see the Readme.md file below.

docker-php-mysql. Instala rápidamente un ambiente de desarrollo local para trabajar con PHP y MySQL utilizando Docker

awesome-compose. Awesome Docker Compose samples

seamless-scroll-polyfill. Scroll Behavior polyfill

react-innertext. Returns the innerText of a React JSX object.

chakra-ui. Chakra UI is a component system for building SaaS products with speed ⚡️

slider. 🎚️ Accessible React slider for single values, ranges, marks, and editable handles.

zaproxy. The ZAP by Checkmarx Core project

videospeed. HTML5 video speed controller (for Google Chrome)

awesome-burp-suite. Awesome Burp Suite Resources. 400+ open source Burp plugins, 400+ posts and videos.

cveproject.github.io. CVE Project Documentation

react-loading-skeleton. Create skeleton screens that automatically adapt to your app!

CVEHeatMap. A CVE Heatmap Using CalPlot

env-cmd. Setting environment variables from a file

electronegativity. Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications.

serverless-notifications. Serverless Service for Serverless Notifications (AWS IoT)

zonote. Cross-platform desktop note-taking app. Sticky notes with Markdown and Tabs. All in one .txt file.