function: vulnerability-scanning

447 products, primary matches first, then adoption-weighted; health v2 shown.

Product	Health v2	Stars	Maturity
cloudflare/security-audit-skill A coding-agent skill from Cloudflare that turns an LLM coding agent into a security auditor via a six-phase pipeline (recon, hunting, valid…	54	3077	active
opengrep/opengrep Opengrep is an open-source static application security testing (SAST) engine forked from Semgrep under LGPL-2.1, supporting pattern-based c…	84	2995	active
microsoft/AttackSurfaceAnalyzer Attack Surface Analyzer is a Microsoft open-source security tool that scans an operating system's security configuration before and after s…	82	2950	active
netwrix/pingcastle PingCastle is a C# tool that assesses the security posture of Active Directory and Entra ID environments, producing risk scores, health che…	98	2937	active
protectai/vulnhuntr Vulnhuntr is a Python CLI tool that uses large language models combined with static code analysis to autonomously discover exploitable vuln…	24	2747	active
Bearer/bearer Bearer CLI is an open-source static application security testing (SAST) tool written in Go that scans source code and analyzes data flows t…	95	2739	active
Checkmarx/kics KICS (Keeping Infrastructure as Code Secure) is an open-source static analysis tool by Checkmarx that scans IaC files for security vulnerab…	98	2695	active
nuver-labs/vps-audit A dependency-free Bash script that audits Linux VPS security and performance, running 18 graded checks covering SSH configuration, firewall…	86	2676	active
rbsec/sslscan sslscan is a command-line tool that tests SSL/TLS enabled services to discover supported cipher suites, protocols, key exchange groups, and…	75	2618	active
visa/visa-vulnerability-agentic-harness VVAH is Visa's open-source agentic harness for autonomous vulnerability discovery, remediation, and validation using frontier AI models. It…	67	2601	active
ajinabraham/nodejsscan nodejsscan is a static application security testing (SAST) scanner for Node.js applications, built on libsast and semgrep. It provides a we…	44	2570	active
TH3xACE/SUDO_KILLER SUDO_KILLER is a Shell-based security tool that audits Linux systems for sudo-related privilege escalation vectors, including misconfigurat…	64	2481	active
archerysec/archerysec ArcherySec is an open-source application security orchestration and correlation (ASOC) and vulnerability management platform that integrate…	34	2471	active
cisco-ai-defense/skill-scanner A security scanner for AI agent skills that detects prompt injection, data exfiltration, and malicious code patterns using pattern-based de…	80	2460	active
assetnote/react2shell-scanner A Python command-line scanner that detects RCE vulnerabilities CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server…	41	2459	active
XSS Hunter XSS Hunter Express is a self-hosted service for tracking and detecting blind cross-site scripting (XSS) vulnerabilities via injected payloa…	32	2440	active
find-sec-bugs/find-sec-bugs Find Security Bugs is a SpotBugs plugin that performs static security analysis of Java bytecode, detecting 144 vulnerability patterns inclu…	56	2437	active
LoRexxar/Kunlun-M Kunlun-M is an open-source static code analysis (SAST) tool that detects security vulnerabilities in PHP, JavaScript/Node.js, Python, Golan…	96	2413	active
hasherezade/hollows_hunter Hollows Hunter is a Windows command-line tool built on the PE-sieve passive memory scanner that scans running processes for malicious impla…	71	2401	active
slimm609/checksec A Go rewrite of the classic checksec tool that inspects security hardening properties (RELRO, stack canaries, NX, PIE, FORTIFY_SOURCE, CFI)…	86	2371	active
lijiejie/BBScan BBScan is a fast, lightweight, high-concurrency web vulnerability scanner written in Python. It helps penetration testers quickly identify …	23	2371	active
jorhelp/Ingram Ingram is a Python-based vulnerability scanning framework targeting network cameras (IP/CCTV devices). It integrates known exploits for com…	67	2356	active
AabyssZG/SpringBoot-Scan SpringBoot-Scan is an open-source penetration testing framework targeting Spring Boot applications, written in Python. It scans for sensiti…	53	2340	active
ssl/ezXSS ezXSS is a self-hosted PHP application that helps penetration testers and bug bounty hunters detect and exploit (blind) cross-site scriptin…	64	2330	active
API-Security/APIKit APIKit is a BurpSuite extension (Java plugin) that discovers, scans, and audits leaked API documentation such as GraphQL, OpenAPI/Swagger, …	23	2286	active
salesforce/cloudsplaining Cloudsplaining is an AWS IAM security assessment tool that identifies violations of least privilege in IAM policies. It generates a risk-pr…	86	2244	active
zakirkun/deep-eye Deep Eye is an AI-driven penetration testing CLI that orchestrates multiple LLM providers (OpenAI, Claude, Gemini, OLLAMA, Groq, and others…	68	2219	active
punk-security/dnsReaper DNS Reaper is a Python CLI tool that scans DNS records for subdomain takeover vulnerabilities using over 50 signatures, at roughly 50 subdo…	58	2216	active
lenucksi/aur-malware-check A Python CLI tool that detects compromised AUR packages from the June 2026 atomic-lockfile supply-chain attack and other historical campaig…	54	2168	active
zhzyker/dismap Dismap is a Go-based asset discovery and identification tool that fingerprints web, TCP, UDP, and TLS services using a rule base of 4500+ w…	23	2163	active
last-byte/PersistenceSniper PersistenceSniper is a PowerShell module for hunting persistence mechanisms implanted in Windows machines. It is aimed at Blue Teams, Incid…	34	2139	active
a13xp0p0v/kernel-hardening-checker A Python CLI tool that checks the security hardening options of the Linux kernel across Kconfig options, boot command line arguments, and s…	76	2123	active
hannob/snallygaster Snallygaster is a Python command-line scanner that probes HTTP servers for files that should not be publicly accessible, such as exposed gi…	54	2110	active
thoughtworks/talisman Talisman is a Go-based CLI tool that installs a git pre-commit/pre-push hook to scan outgoing changesets for potential secrets such as toke…	66	2096	active
al0ne/LinuxCheck A shell-based Linux emergency response and information gathering tool that performs 70+ security checks across 13 categories, including roo…	23	2096	active
Trail of Bits Claude Code Config A Claude Code plugin marketplace from Trail of Bits offering skills for AI-assisted security analysis, code auditing, and vulnerability det…	60	2079	active
lirantal/is-website-vulnerable A Node.js CLI tool that scans a website's frontend JavaScript libraries for publicly known security vulnerabilities using the Snyk database…	97	2035	active
wyzxxz/jndi_tool A Java-based JNDI exploitation tool that runs malicious RMI/LDAP reference servers to test and exploit JNDI injection vulnerabilities, incl…	32	2021	active
Kritt-ai/open-kritt open·kritt is an open-source, self-hosted AI vulnerability research platform that decomposes a codebase into focused security tasks, runs A…	79	2011	active
pyupio/safety Safety CLI is a Python dependency vulnerability scanner that detects packages with known vulnerabilities and malicious packages in local de…	94	1995	active
msoedov/agentic_security Agentic Security is an open-source LLM vulnerability scanner and AI red-teaming toolkit that probes large language models and agent workflo…	87	1977	active
intruder-io/autoswagger Autoswagger is a Python command-line tool that discovers Swagger/OpenAPI specifications, parses their endpoints, and automatically tests th…	34	1960	active
kkbo8005/mitan Mitan (密探) is an all-in-one penetration testing and security assessment desktop application integrating asset mapping, subdomain brute-forc…	79	1955	active
RustSec RustSec is the Rust ecosystem's security advisory database plus a workspace of tooling crates, including the rustsec client library, cargo-…	97	1943	stable
anthropics/defending-code-reference-harness A reference implementation from Anthropic for autonomous vulnerability discovery and remediation using Claude, including Claude Code skills…	57	7368	maintenance
SleepingBag945/dddd dddd is a Go-based batch information gathering and supply-chain vulnerability detection CLI tool designed to streamline red team workflows.…	19	1924	active
cisagov/cset CSET is a free desktop application from CISA and Idaho National Laboratory that guides organizations through step-by-step cybersecurity ass…	69	1887	active
aquasecurity/tfsec tfsec is a static analysis security scanner for Terraform code that detects misconfigurations across major cloud providers using hundreds o…	59	7035	maintenance
sourcery-ai/sourcery Sourcery is an AI-powered automated code review service that reviews pull requests on GitHub and GitLab, posting summaries, inline comments…	97	1858	active
selinuxG/Golin Golin is a Go-based security assessment tool combining asset discovery, port/service scanning, weak password brute-forcing for 40+ services…	66	1847	active
wapiti-scanner/wapiti Wapiti is an open-source black-box web vulnerability scanner written in Python that crawls deployed web applications and fuzzes scripts and…	98	1846	active
valqore/valqore Valqore is a deterministic infrastructure governance engine that scans Kubernetes manifests, Terraform, Helm, and cloud resources against 1…	81	1831	active
78778443/QingScan QingScan is a self-hosted, open-source security operations platform that unifies vulnerability scanning, code auditing, asset inventory, an…	66	1831	active
White-hua/Apt_t00ls A Java-based exploitation tool that aggregates proof-of-concept and weaponized exploits for high-severity vulnerabilities in Chinese enterp…	26	1830	active
scipag/HardeningKitty HardeningKitty is a PowerShell module that audits and hardens Windows system configurations against a predefined finding list. It reads reg…	84	1822	active
1N3/BlackWidow BlackWidow is a Python-based web application spider that crawls a target site to collect URLs, dynamic parameters, subdomains, email addres…	57	1821	active
wagiro/BurpBounty Burp Bounty (Scan Check Builder) is a Burp Suite extension that lets users improve Burp's active and passive web vulnerability scanners wit…	23	1809	active
OpenSCAP/openscap OpenSCAP is a NIST-certified open-source toolkit providing both a C library and the 'oscap' command-line tool for parsing, validating, edit…	87	1806	stable
betterleaks/betterleaks Betterleaks is a fast, configurable secrets scanner for finding leaked credentials in git repositories, filesystems, and platforms like Git…	82	1792	active
nccgroup/sobelow Sobelow is a security-focused static analysis tool for Elixir and the Phoenix framework, detecting common vulnerability classes like SQL in…	23	1791	active
lirantal/npq npq is a command-line tool that audits npm packages for security risks before installing them, checking CVE databases and applying syntacti…	95	1789	active
R4gd0ll/I-Wanna-Get-All A comprehensive Java post-exploitation vulnerability exploitation tool integrating 470 exploit modules for detection and attack of known vu…	59	1787	active
j3ers3/Hello-Java-Sec A deliberately vulnerable Java Spring Boot application demonstrating common web vulnerabilities (SQLi, XSS, RCE, deserialization, SSTI, SSR…	27	1763	active
ossf/cve-bin-tool A Python CLI tool that scans binaries and systems for known CVEs in over 350 common open-source components like openssl, libpng, and expat.…	67	1753	active
murphysecurity/murphysec MurphySec CLI is an open-source software composition analysis (SCA) tool that detects vulnerable dependencies in projects from the command …	57	1753	active
bytedance/appshark AppShark is a static taint analysis platform written in Kotlin that scans Android APKs for security vulnerabilities and compliance issues. …	54	1752	active
ev-flow/quark-engine Quark Engine is an Android malware scoring and analysis system that inspects APKs using rule-based behavioral detection on Dalvik bytecode.…	98	1713	active
cr0hn/dockerscan DockerScan is a comprehensive Docker security scanner written in Go that scans containers, images, and registries using multiple techniques…	93	1710	active
SiriusScan/Sirius Sirius is an open-source vulnerability scanner that automates network discovery via Nmap and performs CVE-based detection with CVSS scoring…	88	1695	active
duo-labs/cloudmapper CloudMapper is a tool for analyzing Amazon Web Services (AWS) environments, originally built to generate interactive network diagrams in th…	23	6288	maintenance
wireghoul/graudit graudit is a shell-based source code auditing tool that uses GNU grep with signature databases of extended regular expressions to find pote…	59	1688	active
trailofbits/buttercup Buttercup is a Cyber Reasoning System (CRS) developed by Trail of Bits for the DARPA AI Cyber Challenge that automatically finds and patche…	56	1683	active
KeenSecurityLab/BinAbsInspector BinAbsInspector is a static analyzer for automated reverse engineering and vulnerability scanning in binaries, built on abstract interpreta…	23	1672	active
tabby-sec/tabby Tabby is a Java static code analysis tool built on the Soot framework that converts JAR/WAR/CLASS files into a code property graph stored i…	51	1659	active
chaitin/veinmind-tools veinmind-tools is a container security toolkit by Chaitin Tech built on the veinmind-sdk, providing scanners for malicious files, weak pass…	23	1652	active
coffinxp/loxs Loxs is a Python-based multi-vulnerability scanner for web applications that detects SQL injection, XSS, LFI, open redirect, and CRLF injec…	52	1612	active
jakehildreth/Locksmith Locksmith is a PowerShell module and script that audits Active Directory Certificate Services (AD CS) for common misconfigurations. It can …	75	1606	active
Autumn-27/ScopeSentry ScopeSentry is a self-hosted attack surface and asset mapping platform that combines subdomain enumeration, port scanning, fingerprinting, …	88	1587	active
AlisamTechnology/ATSCAN ATSCAN is a Perl-based command-line scanner for mass dork searching and vulnerability exploitation. It combines search engine dorking with …	23	1583	active
attify/firmware-analysis-toolkit Firmware Analysis Toolkit (FAT) is a Python-based automation wrapper around Firmadyne that emulates IoT and embedded device firmware images…	23	1582	active
nccgroup/PMapper Principal Mapper (PMapper) is a Python CLI tool and library that models AWS IAM users and roles as a directed graph to identify privilege e…	23	1576	active
stealthcopter/deepce DEEPCE is a single-file pure-shell script for enumerating Docker environments and attempting privilege escalation and container escapes. It…	58	1567	active
Tsojan/TsojanScan TsojanScan is an integrated BurpSuite plugin for vulnerability detection that bundles multiple common vulnerability POCs into a single exte…	85	1563	active
dwisiswant0/crlfuzz CRLFuzz is a fast command-line tool written in Go that scans websites for CRLF (carriage return/line feed) injection vulnerabilities. It su…	66	1560	active
BlackSnufkin/LitterBox LitterBox is a self-hosted payload-analysis sandbox for red teams that runs static, dynamic, and EDR-based analysis on samples and produces…	62	1526	active
gobysec/Goby Goby is a network security assessment tool that maps an organization's attack surface and scans for known vulnerabilities and weak password…	23	1517	active
fossas/fossa-cli FOSSA CLI is a zero-configuration, language-agnostic dependency analysis tool that detects dependencies in any codebase across 20+ build sy…	95	1516	active
ztgrace/changeme changeme is a Python CLI tool that scans networks for devices and services using default or backdoor credentials. Credential definitions ar…	36	1516	active
Gowtham-Darkseid/AutoPentestX AutoPentestX is a Python-based automated penetration testing toolkit that scans targets for vulnerabilities and generates security reports.…	45	1504	active
Schira4396/VcenterKiller A Go-based all-in-one exploitation and verification tool targeting VMware vCenter, covering major CVEs such as CVE-2021-21972, CVE-2021-219…	23	1485	active
controlplaneio/kubesec Kubesec is a static analysis tool that performs security risk analysis on Kubernetes resource manifests, assigning a security score and det…	64	1477	active
jvoisin/php-malware-finder PHP Malware Finder is a command-line tool that scans filesystems for potentially malicious PHP files using YARA rules. It detects obfuscate…	10	1475	active
shuanx/BurpAPIFinder BurpAPIFinder is a Burp Suite extension written in Java that passively analyzes HTTP traffic (HTML and JS files) to discover hidden API end…	15	1472	active
c0ny1/passive-scan-client A Burp Suite extension written in Java that forwards passive scanning traffic to external passive vulnerability scanners (like xray, w13sca…	23	1462	stable
openclarity/openclarity OpenClarity is an open-source platform for agentless detection and management of Virtual Machine SBOMs and security threats such as vulnera…	10	1460	active
One-Fox-Security-Team/One-Fox-T00ls One-Fox-T00ls is a curated collection of penetration testing and security toolboxes from the One-Fox security team, covering information ga…	56	1443	active
cyberark/KubiScan KubiScan is a Python CLI tool that scans Kubernetes clusters for risky permissions in the RBAC authorization model. It identifies risky rol…	33	1431	active
Metarget/metarget Metarget is a Python-based framework that automatically builds vulnerable cloud-native infrastructures, installing vulnerable versions of D…	65	1415	active
BlendLog/MinerSearch A free Windows utility that scans for and removes hidden cryptocurrency miners by checking processes, files, registry, WMI, services, and s…	91	1413	active
owasp-noir/noir OWASP Noir is a static analysis (SAST) CLI tool that scans source code to extract every endpoint an application exposes, including shadow A…	99	1383	active