Angelo Delicato

gf. A wrapper around grep, to help you grep for things

scriptc. TypeScript-to-Native Compiler

jumpserver. JumpServer is an open-source Privileged Access Management (PAM) platform that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser.

gopacket. A complete Go port of Impacket - 63 CLI tools and 24 libraries for Windows & Active Directory protocol attacks, compiled to a single dependency-free binary.

droidground. A flexible playground for Android CTF challenges.

Samsung_Vulnerabilities. 176 vulnerabilities in Samsung preinstalled Android apps

colibri. Run frontier MoE models on hardware you already own — pure C, zero deps, experts streamed from disk. Tiny engine, immense model. 🐦

bad-epoll.

headroom. Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server.

threat-tiger. Threat Tiger is a modern Threat Modeling tool

lore. Lore is a next-generation, open source version control system

react-server. Run React anywhere

ds4. DeepSeek 4 Flash and PRO local inference engine for Metal, CUDA and ROCm

LSPlant. A hook framework for Android Runtime (ART)

ponytail. Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.

rmux. Universal Rust multiplexer with a typed SDK — drive any CLI or TUI app from code. Native on Linux, macOS, and Windows.

RTranslator. Open source real-time translation app for Android that runs locally

Glass. Glass - a fast and free IDA Pro alternative

odysseus. Self-hosted AI workspace.

CryptoBook. A community driven resource for learning CryptoGraphy

Liho. Hooking tool for libart.so and libdl.so, enabling instrumentation of both DEX and native code on Android.

iris. Intent Runtime Inspection System

uploadserver. Python's http.server extended to include a file upload page

CVE-2026-0073. An automated exploit for CVE-2026-0073 (Android ADB TLS Auth Bypass). Features a built-in mDNS/Zeroconf scanner to instantly discover randomized Wireless Debugging ports on Android 13+ and establishes a fully interactive raw PTY shell.

audit. An 8-stage vulnerability-discovery agent.

opengrep. 🔎 Static code analysis engine to find security issues in code.

Nginx-Rift. NGINX RCE exploits

blint. blint is a Binary Linter that checks the security properties and capabilities of your executables. It can also generate a Software Bill-of-Materials (SBOM) for supported binaries.

dexhound. Dump DEX files from a running Android process without instrumentation

tiptap. The headless rich text editor framework for web artisans.

sandblaster. Reversing the Apple sandbox

go-ios. This is an operating system independent implementation of iOS device features. You can run UI tests, launch or kill apps, install apps etc. with it.

redlyne. Detect and patch vulnerabilities in AI-generated Python code — VS Code extension

watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py. Python

libvirt. Read-only mirror. Please submit merge requests / issues to https://gitlab.com/libvirt/libvirt

OpenMythos. A theoretical reconstruction of the Claude Mythos architecture, built from first principles using the available research literature.

noctalia. A sleek, customizable desktop shell crafted for Wayland.

graphify. Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store.

pyGPOAbuse. Partial python implementation of SharpGPOAbuse

DetectFrida. Detect Frida for Android

mise. dev tools, env vars, task runner

Droidspaces-OSS. A lightweight, LXC-like container runtime for Android and Linux. Run full Linux distributions natively with zero performance penalty

ligolo-mp. Multiplayer pivoting solution

SEBASTiAn. A Static and Extensible Black-box Application Security Testing tool for iOS and Android applications

rbcd-attack. Kerberos Resource-Based Constrained Delegation Attack from Outside using Impacket

ocd-mindmaps. Orange Cyberdefense mindmaps

sandboxec. A lightweight command sandbox for Linux, secure-by-default, built on Landlock.

pylnk. Python library for reading and writing Windows shortcut files (.lnk). Python 3 only.

krbrelayx. Kerberos relaying and unconstrained delegation abuse toolkit

nowafpls. Burp Plugin to Bypass WAFs through the insertion of Junk Data

basalt. TUI Application to manage Obsidian notes directly from the terminal

rxdb. The local-first database that runs on every JS runtime and replicates with your existing backend - no vendor, no lock-in - https://rxdb.info/

noir. Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

bug-reaper. Web2 bug bounty Agent Skill — evidence-based, no AI slop. Covers 18 vulnerability classes across HackerOne, Bugcrowd, Intigriti, and YesWeHack.

no-exit-please_Frida_Script_Android. A universal Frida Script that prevents application self-termination at Java and native layers on Android.

klodd. CTF challenge per-team instance runner

pentagi. Fully autonomous AI Agents system capable of performing complex penetration testing tasks

pacu. The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

penelope. Penelope Shell Handler

cloud_enum. Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

CloudBrute. Awesome cloud enumerator

ghidra-frida-hook-gen. Frida hook generator for Ghidra

promon-string-deobfuscator. Promon Shield String Deobfuscator

SSTImap. Automatic SSTI detection tool with interactive interface

clsdumper. Android Dynamic Class Dumper — dump all DEX files from running Android apps using Frida

heresy. Inspect and instrument React Native applications at runtime

hermes_rs. Hermes bytecode disassembler and assembler

feroxbuster. A fast, simple, recursive content discovery tool written in Rust.

AuthMatrix. AuthMatrix is a Burp Suite extension that provides a simple way to test authorization in web applications and web services.

Empire. Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.

shannon. Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

dnscat2. PHP

chisel. A fast TCP/UDP tunnel over HTTP

GhostKatz. Dump LSASS via physical memory read primitives in vulnerable kernel drivers

plist_recon. This tool parses the binary or XML `Info.plist` file found in Apple applications (IPA/APP) to extract critical security configurations, identify potential vulnerabilities, and generate instant hooking snippets for Frida and Objection.

vulnerability-rating-taxonomy. Bugcrowd’s baseline priority ratings for common security vulnerabilities

uber-apk-signer. A cli tool that helps signing and zip aligning single or multiple Android application packages (APKs) with either debug or provided release certificates. It supports v1, v2 and v3 Android signing scheme has an embedded debug keystore and auto verifies after signing.

content-type-research. Content-Type Research

traitor. :arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

lastsignal. A self-hosted dead man's switch for delivering encrypted messages (E2EE) to your loved ones — when you're gone or unresponsive.

ntconthwbp-rs. Assembly

mcp-security-hub. A growing collection of MCP servers bringing offensive security tools to AI assistants. Nmap, Ghidra, Nuclei, SQLMap, Hashcat and more.

pywerview. A (partial) Python rewriting of PowerSploit's PowerView

promon-reversal. Analysis and proof-of-concept bypass of Promon SHIELD's Android application protection

HideDroid. HideDroid is an Android app that allows the per-app anonymization of collected personal data according to a privacy level chosen by the user.

PAPIMonitor. Python API Monitor for Android apps

Hooky. Hooky is a dynamic analysis tool for mobile application security testing and runtime instrumentation.

x64dbg. An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

swaks. Swaks - Swiss Army Knife for SMTP

LiveContainer. Run iOS apps without actually installing them!

cuddlephish. Weaponized Browser-in-the-Middle (BitM) for Penetration Testers

chisel-ng. Chisel new generation, written in rust. SSH under WSS with some customization.

powercat. netshell features all in version 2 powershell

anamnesis-release. Automatic Exploit Generation with LLMs

awesome-note-taking. A curated list of 100+ awesome note-taking apps, PKM tools & knowledge management software — open source and proprietary. Updated regularly.

proxypin. Open source free capture HTTP(S) traffic software ProxyPin, supporting full platform systems

adb-enhanced. 🔪Swiss-army knife for Android testing and development 🔪 ⛺

vmlinux-to-elf. A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

katana. A next-generation crawling and spidering framework.

nuclei. Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

subfinder. Fast passive subdomain enumeration tool.

android-security-awesome. A collection of android security related resources

deadend-cli. Agentic pentest tooling. Currently achieving 81% (KIMI K2.5) on XBOW's benchmark in full black-box. Completely Self-hosted. Every model available on LiteLLM (Ollama, anthropic, openai...)

nginx-analytics. A flexible & privacy-focused analytics solution for NGINX.

frida-ui. Interact with Frida devices, processes, and scripts directly from your browser.

Awesome-Blackhat-Tools. A curated list of tools officially presented at Black Hat events

chronomaly. Android kernel exploit for CVE-2025-38352, previously exploited in-the-wild. Targets vulnerable x86_64 Linux kernels v5.10.x.

scanopy. Network diagrams that update themselves

awesome-blackhat-arsenal. Curated collection of cybersecurity tools featured in Black Hat Arsenal events.

Hardening-Audit-Tool-AuditTAP. FBPro Audit Test Automation Package allows you to create compliance reports for your systems. The resulting HTML-reports provide a transparent overview of your devices' security configuration compared to international security standards and hardening guides.

spikee. Simple Prompt Injection Kit for Evaluation and Exploitation

PwnPad. PwnPad is an affordable, hands-on hardware hacking platform built for practical learning. It features a range of challenges that walk users through key hardware security concepts, from PCB design to side-channel attacks.

kubernetes-goat. Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

react2shell-scanner. High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478)

fizzy. Kanban as it should be. Not as it has been.

virt-manager. Desktop tool for managing virtual machines via libvirt

sysreptor. A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.

pSlip. pSlip is an Android static analysis tool kit designed to find potentially vulnerable escalation paths by analyzing exported components, intent filters, provider permissions and cryptographic misuse

frida-script-gen. Generate Frida bypass scripts for Android APK root and SSL checks.

mobapp-storage-inspector. A tool for inspecting and analyzing mobile application storage files.

Frida-Launcher. An Android app to easily manage Frida server on your device or emulator

KarelWebAssemblyIDE. A modern, web-based integrated development environment for learning programming with Karel the Robot using C and WebAssembly.

LLMGoat. This project is a deliberately vulnerable environment to learn about LLM-specific risks based on the OWASP Top 10 for LLM Applications.

conquest. Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim.

Coercer. A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

cai. Cybersecurity AI (CAI), the framework for AI Security

bofhound. Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel

toon. 🎒 Token-Oriented Object Notation (TOON) – compact, human-readable serialization of JSON data for LLM prompts. TypeScript SDK, CLI, benchmarks.

Shellcode-IDE. Shellcode IDE — makes developing and analyzing shellcode much more convenient.

beerus-android. BEERUS Framework for Android

nushell. A new type of shell

evershop. 🛍️ Typescript E-commerce Platform

hetty. An HTTP toolkit for security research.

winboat. Run Windows apps on 🐧 Linux with ✨ seamless integration

CSPBypass. CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting) vulnerabilities on sites where injections are blocked by CSPs that only allow certain whitelisted domains.

allsafe-android. Intentionally vulnerable Android application.

dont-kill-my-app. Android vendors, don't kill my app!

gollama.cpp. A high-performance Go binding for llama.cpp using purego for cross-platform compatibility without CGO.

datapizza-ai. Build reliable Gen AI solutions without overhead 🍕

agentic_security. Agentic LLM Vulnerability Scanner / AI red teaming kit 🧪

dive. A tool for exploring each layer in a docker image

frida-gadget. Automated tool for patching APKs to enable the use of Frida gadget by downloading the library and injecting code into the main activity.

gmapsapiscanner. Python

ARSCLib. Android binary resources read/write library

dtop. Terminal dashboard for Docker monitoring across multiple hosts with Dozzle integration.

libvirt-hook-qemu. Libvirt hook for setting up iptables port-forwarding rules when using NAT-ed networking.

ttyd. Share your terminal over the web

unrasp_guard. Anti Tamper & Anti Frida Bypass For Our Lovely LolGuard

landrun. Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.

android-webview-research. This app runs various webview tests to explore the attack surface and exploit techniques

libsu. A complete solution for apps using root permissions

android-rasp. RASP (Runtime Application Self-Protection) solution for protecting Android apps against being run on vulnerable devices.

Free-RASP-Android. SDK providing threat detection and security monitoring for Android devices. Shield your app with free RASP for Android. Detect reverse engineering, root (Magisk), jailbreak, Frida, emulators, bots, tampering and integrity issues, obfuscation, VPN usage, malware, and monitor device identification and fingerprint.

frida-interception-and-unpinning. Frida scripts to rewrite mobile applications at runtime to directly MitM all HTTPS traffic

taptrap. TapTrap is a new attack on Android that lures you into performing actions you did not intend to do. This allows an app to silently access your camera or location, or even erase your entire device — all without your consent.

whonow. A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)

rbndr. Simple DNS Rebinding Service

flareprox. Use Cloudflare to create HTTP pass-through proxies for unique IP rotation, similar to fireprox

frida-scripts. A collection of my Frida instrumentation scripts to reverse engineer mobile apps and more.

android-re-ctfs. Reverse engineering CTFs.

llamator. Red Teaming python-framework for testing chatbots and GenAI systems.

omarchy. Beautiful, Modern & Opinionated Linux

TaskTrove. TaskTrove is a modern Todo Manager that is fully self-hostable.

PySpector. PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. It leverages a powerful Rust core to deliver high-speed, accurate vulnerability scanning, wrapped in a developer-friendly Python CLI.

ipsw. iOS/macOS Research Swiss Army Knife

Web-Cache-Vulnerability-Scanner. Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).

frida-ios-dump. pull decrypted ipa from jailbreak device

Ghost. Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device.

dittobytes. Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.

dots-hyprland. Usability-first dotfiles

Spoofy. Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records.

CrackMapExec. A swiss army knife for pentesting networks

strix. Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

android-emulator-container-scripts. This is a set of minimal scripts to run the emulator in a container for various systems such as Docker, for external consumption

JamfHound. JamfHound is a python3 project designed to collect and identify attack paths in Jamf Pro tenants based on existing object permissions by outputting data as JSON for ingestion into BloodHound.

CVE-2025-50154. POCs for CVE-2025-50154 and CVE-2025-59214, zero day vulnerabilities on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a bypass for the CVE-2025-24054 Security Patch

CVE-2025-6543_CitrixNetScaler_PoC. Multi-host, multi-port scanner and auditor for CVE-2025-6543-affected NetScaler devices. Supports SNMP and SSH enumeration with optional CSV reporting and exploit stubs.

gpt-oss. gpt-oss-120b and gpt-oss-20b are two open-weight language models by OpenAI

wakaru. 🔪📦 Javascript decompiler for modern frontend

frida-non-root. Add frida-gadgets into APK for non rooted devices.

ysonet. Deserialization payload generator for a variety of .NET formatters

deptective. Deptective automatically determines the native dependencies required to run any arbitrary program or command.

wscan. Wscan is a web security scanner that focuses on web security, dedicated to making web security accessible to everyone.

nomad. Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. Nomad is easy to operate and scale and has native Consul and Vault integrations.

MBE. Course materials for Modern Binary Exploitation by RPISEC

S3Scanner. Scan for misconfigured S3 buckets across S3-compatible APIs!

bambdas. Bambdas collection for Burp Suite Professional and Community.

commit-watcher. Find interesting and potentially hazardous commits in git projects

obfuscation_analysis. Binary Ninja plugin to analyze and simplify obfuscated code

AndroGoat. AndroGoat

shell_exec. Cross platform library to execute shell scripts

bitchat. bluetooth mesh chat, IRC vibes

historical-redis-versions. Very early versions of Redis with some backstory in the README

APKEditor. Powerful android apk editor - aapt/aapt2 independent

flutter-reverse-engineer. Reverse engineering flutter apps

reFlutter. Flutter Reverse Engineering Framework

CyberSources. A curated list of cybersecurity tools and resources.

http-request-smuggler. Java

droidground-samples. Sample applications to showcase DroidGround

marvin. Marvin is a CLI tool that scans a k8s cluster by performing CEL expressions to report potential issues, misconfigurations and vulnerabilities.