npm
CyberStrikeus/CyberStrike
Open-source AI-powered offensive security harness for automated penetration testing.
AGPL-3.0Sep 13, 2026 · metrics 2.10.0
All tags
Catalogue tag
#bug-bounty
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
29 records
PyPI
usestrix/strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Apache-2.0Sep 16, 2026 · metrics 2.10.0
PyPI · crates.io
maurosoria/dirsearch
Web path scanner
No licenseOct 19, 2026 · metrics 2.10.0
Go · npm
xalgorix/xalgorix
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
npm · Go · PyPI
Armur-Ai/Pentest-Swarm-AI
Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — supports bug bounty, continuous monitoring, and CTF modes. Built with Go and 7+ native security tools.
AGPL-3.0Sep 28, 2026 · metrics 2.10.0
Go
Chocapikk/wpprobe
A fast WordPress plugin enumeration tool
MITOct 21, 2026 · metrics 2.10.0
Go
vigolium/vigolium
Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision
Custom licenseSep 8, 2026 · metrics 2.10.0
Go
zan8in/afrog
A Security Tool for Bug Bounty, Pentest and Red Teaming.
MITAug 28, 2026 · metrics 2.10.0
—
0xSteph/pentest-ai-agents
Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.
MITSep 16, 2026 · metrics 2.10.0
Go
cc1a2b/JShunter
jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for and bug bounty hunters and security researchers.
MITSep 6, 2026 · metrics 2.10.0
npm · PyPI
glferreira-devsecops/Cascavel
🐍 Cascavel — The zero-friction offensive security engine. Automate Red Team scans, validate exposures (CTEM), and generate compliance reports in one command.
Custom licenseSep 19, 2026 · metrics 2.10.0
Go · npm
Autumn-27/ScopeSentry
ScopeSentry-Cyberspace mapping, subdomain enumeration, port scanning, sensitive information discovery, vulnerability scanning, distributed nodes
No licenseSep 18, 2026 · metrics 2.10.0
PyPI
s0md3v/wappalyzer-next
detect technologies with wappalyzer alternative
GPL-3.0Sep 30, 2026 · metrics 2.10.0
Go
MikeRoss27/scanforge
One CLI to orchestrate your entire pentest and bug bounty recon workflow.
MITSep 20, 2026 · metrics 2.10.0
npm
iAMv1/omnisectester
Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.
MITSep 22, 2026 · metrics 2.10.0
—
momenbasel/keyFinder
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
MITSep 14, 2026 · metrics 2.10.0
Go
dinosn/leaklens
Bug bounty focused JavaScript security analysis for crawling web assets, source maps, and secret discovery
Apache-2.0Sep 16, 2026 · metrics 2.10.0
npm
3516634930/Payloader
渗透测试Payload速查平台 | Pentest Payload Quick Reference | XSS/SQLi/SSRF/RCE | React+TypeScript
AGPL-3.0Sep 11, 2026 · metrics 2.10.0
crates.io
ethicalhackingplayground/pathbuster
A path-normalization pentesting tool.
MITSep 12, 2026 · metrics 2.10.0
Go
CypherNova1337/paramvoid
Fast HTTP parameter discovery - finds the undocumented query and body parameters a server quietly accepts. Single static Go binary, bundled wordlist, no dependencies.
MITOct 13, 2026 · metrics 2.10.0
Go
11lunaric11/securitychecker
Recon tool for pentesters & bug bounty hunters: check robots.txt, security.txt (RFC 9116) and /.well-known/ across many targets. CLI + web UI, single static Go binary.
MITSep 10, 2026 · metrics 2.10.0
Go
mehulgupta1/subhound
Advanced subdomain enumeration for Linux & macOS — one Go binary that orchestrates subfinder, dnsx, httpx, asnmap & more into a fast discover→resolve→probe pipeline.
No licenseOct 19, 2026 · metrics 2.10.0
Go
rix4uni/gf
A wrapper around grep, to help you grep for things
MITSep 8, 2026 · metrics 2.10.0
PyPI
aaaguirrep/offensive-docker
Offensive Docker is an image with the more used offensive tools to create an environment easily and quickly to launch assessment to the targets.
MITSep 16, 2026 · metrics 2.10.0
Go
LocaMartin/replacex
Enhanced qsreplace-style CLI for replacing, appending, and deduplicating URL query values.
No licenseOct 19, 2026 · metrics 2.10.0
npm
LasCC/HackTools
The all-in-one browser extension for offensive security professionals 🛠
No licenseSep 16, 2026 · metrics 2.10.0
Go
hackthacker-sec/recontool
Unified reconnaissance CLI for subdomain discovery, HTTP probing, asset discovery, OSINT, and Wayback data combining subfinder, httpx, chaos, uncover, and Wayback CDX in one tool
MITSep 9, 2026 · metrics 2.10.0
npm
xaccefy/pi-xpi
XPI — offensive security tools for Pi Agent: casefile, exploit search, web lookup, code intelligence, todo tracker
MITSep 6, 2026 · metrics 2.10.0
Go
ps1-blacklist/wpfather
WPFather - WordPress Vulnerability Scanner & Security Recon Tool with 16 Modules | Zero Config Single Binary
Custom licenseSep 8, 2026 · metrics 2.10.0