Hunting for the hole is only half the job, because a scanner alert nobody believes wastes more time than the bug itself. Add a domain, CIDR, or bug-bounty scope and Reconner builds the map first: passive and active subdomain enumeration, live HTTP probing and fingerprinting, JavaScript analysis that digs endpoints, secrets, and API keys out of bundles, plus parameter and hidden-param discovery. Then it attacks what it mapped with a context-aware engine covering reflected, stored, and DOM XSS, SQL, NoSQL, SSRF, IDOR, LFI, SSTI, XXE, injection, and open redirects, and every candidate has to survive differential, out-of-band, or control-based proof, re-verified before it is ever reported. Blind issues are not dropped either: OAST callbacks catch out-of-band SSRF, RCE, SQLi, and SSTI that never respond inline. Networks get the same treatment, with port scanning, service detection, network-CVE checks, and IP-camera auditing. Findings land in a live dashboard streamed over WebSocket, with an attack-path view, coverage ledger, monitoring diffs, and HTML, Markdown, and PDF reports, while Telegram can alert you and even start, stop, or resume scans remotely. Run it only against assets you own or are authorized to test; behind a VPN and TLS it becomes your private proving ground. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

An AI agent that maps your attack surface, proves what is exploitable, and drafts the code fix: RedAmon is a red team for domains you are authorized to test. A six-phase recon pipeline runs subdomain, port, HTTP, and vulnerability scanners in parallel and merges every result into a Neo4j graph you can query in plain language. The agent works from a Kali sandbox with 100+ security tools, asks for human approval before risky steps, and can deploy a Fireteam of specialist sub-agents that investigate separate angles of one target at once. CypherFix triages each finding, then a code agent opens a GitHub pull request with the patch. AI Gauntlet attacks chatbots and LLM endpoints with prompt injection and jailbreak batteries, mapped to the OWASP LLM Top 10. TrafficMind records every HTTP request the tools send, with a searchable history the agent can replay. An Insights dashboard charts findings, CVE severity, and attack chains per project, and the settings page connects OpenAI, Anthropic, OpenRouter, Bedrock, or local Ollama and vLLM models. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Point Sirius Scan at a network range and it finds live hosts, fingerprints their services, and lists every matching CVE with its CVSS score in a live web dashboard. The Vulnerability Navigator groups findings by severity, filters on CVSS, and exports results for remediation tracking. Scans run on Nmap with NSE scripts kept in sync with upstream, alongside Naabu port scanning. Lightweight remote agents connect back over gRPC from other networks, so segments the central scanner cannot reach still get assessed, and the same agents can run YAML detection templates locally in CLI mode with no server connection at all. An operator console runs PowerShell commands against connected agents and keeps command history beside the scan results. Real-time progress, severity trend charts, host detail pages, and an environment overview show what changed between scans. A REST API on port 9001 with API key authentication feeds results into existing security workflows, while service health monitoring and centralized logging confirm the platform itself is behaving. An installer generates fresh secrets and an initial admin password, and production overlays tighten the deployment further. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Enter a URL and get a dashboard of everything publicly discoverable about its security posture, server architecture, and technology stack: Web-Check is an all-in-one OSINT tool for analyzing any website. One scan surfaces IP info and server location, the full SSL certificate chain with issuing authority and validity, DNS records (A, MX, NS, CNAME, TXT) with DNSSEC status, HTTP response headers interpreted for security directives like HSTS, CSP, and X-Frame-Options, cookies and their flags, WHOIS domain info, robots.txt crawl rules, a sitemap-derived page map, the redirect ledger, open ports, traceroute, detected technologies, third-party trackers, associated hostnames, site performance, and even carbon footprint. Each card explains what the data means and why it matters, which makes the tool double as a security education resource - junior engineers learn headers and attack surfaces by scanning real sites. Practical uses span pre-deployment security audits (catch missing headers and misconfigurations before they ship), privacy compliance checks (identify trackers and cookie behavior for GDPR work), competitive tech-stack research, and network debugging via DNS and redirect inspection. Built by Lissy93 in TypeScript, it deploys as a single Docker container, and self-hosting keeps your reconnaissance targets and audit activity off third-party services.

SpiderFoot is an open-source OSINT automation platform, replacing hours of manual reconnaissance with automated intelligence gathering across more than 200 data collection modules. The platform accepts ten distinct target types including IP addresses, domains, hostnames, network subnets, ASNs, email addresses, phone numbers, usernames, person names, and Bitcoin addresses, then feeds them through a publisher-subscriber event bus where each module's findings trigger downstream analysis automatically. SpiderFoot queries Shodan, VirusTotal, HaveIBeenPwned, AlienVault OTX, Censys, crt.sh, WHOIS databases, social media platforms, breach databases, and dozens more sources, with most modules requiring no API keys and many offering free tiers for those that do. The YAML-configurable correlation engine applies 37 pre-defined rules to identify relationships between discovered data points, flagging patterns like shared infrastructure, credential exposure, and domain reputation anomalies. Results export in CSV, JSON, and GEXF graph formats for integration with external analysis tools. TOR integration enables dark web searching, and SpiderFoot can invoke external tools including DNSTwist, Whatweb, Nmap, and CMSeeK for deeper technical assessment. The embedded web server delivers an intuitive dashboard for scan management, data visualization, and result exploration alongside a full command-line interface for scripted automation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Xalgorix delivers AI-driven penetration testing that proves vulnerabilities exist rather than guessing, pairing an autonomous LLM agent with an independent exploit verifier that re-exploits every finding before it reaches your report. The 22-phase methodology mirrors how a skilled human pentester works through an engagement, covering reconnaissance, subdomain enumeration, port scanning, web crawling, parameter fuzzing, SQL injection testing, XSS detection, authentication bypass, API testing, and more. Select all phases or pick specific ones per target. The platform ships with 85+ offensive security tools preinstalled (nmap, nuclei, httpx, subfinder, katana, ffuf, gobuster, sqlmap, masscan, dalfox, feroxbuster) plus 14 built-in agent tools for browser automation, terminal execution, and note-taking. Connect your own LLM provider (OpenAI, Anthropic, DeepSeek, Gemini, Groq, Ollama, or MiniMax) so no scan data or target information leaves your infrastructure. The web dashboard on port 9137 provides live WebSocket telemetry showing tool calls, agent reasoning, and findings as scans progress. A findings index with CVSS scoring and severity filters organizes results, and branded PDF reports include your company name and logo. Wildcard and multi-target scans handle red team attack-surface mapping, while source-code scanning audits repositories directly without requiring a deployed target. A REST API enables scripted scans and SIEM pipeline integration, and webhooks push notifications to Discord or Telegram. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Watchtower puts AI-driven security assessments into one web console, where sessions probe your attack surface while every request, finding, and piece of evidence is captured as it happens. The AI session console follows the attack surface, session progress, tool calls, and findings as an assessment runs, so you can watch an engagement unfold instead of reading a log afterwards. A built-in proxy workflow records HTTP and HTTPS traffic history with highlighted patterns, and any captured request can be sent to the Repeater for editing, replay, and response comparison. Mobile work is covered too: connect phones over USB or wireless, capture app traffic separately from accessibility control, and import WeChat mini-program packages to configure an assessment session. A public vulnerability intelligence library can be searched by component, severity, and source and kept synchronized locally, giving assessments current context without sending your targets anywhere. Findings are managed by source, severity, and status, each linked back to its supporting evidence, and the report editor assembles them with a live preview, impact notes, and remediation guidance. The dashboard tracks assets, tasks, AI sessions, token usage, and runtime resources, and task admission is budgeted against physical memory so heavy scans do not starve the host. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL-3.0 licensed.

Point it at your cloud accounts and it returns a ranked list of what is misconfigured, mapped to the standards auditors ask about. Connect providers like AWS, Azure, Google Cloud, Kubernetes, Microsoft 365, and GitHub, launch a scan or schedule recurring ones, and read the results on an overview with a ThreatScore gauge, severity bars, and a resource inventory by category. The Findings page groups failed checks, expands each group into the affected resources, and lets teams mute noise, triage status, send groups to Jira, and create alerts that email or message people after each scan. Compliance pages score every framework from CIS and NIST to PCI DSS, SOC 2, HIPAA, GDPR, and ISO 27001, with a watchlist for the ones you care about and downloadable reports. Attack Paths draws a graph from IAM roles and policies to outcomes like code execution, using a Neo4j graph database filled by AWS scans. A built-in AI assistant answers questions about critical findings and compliance gaps with the model provider you configure. Organizations, roles, and API keys keep access tidy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Security scanners each report in their own format, and DefectDojo is the self-hosted platform that imports those reports and keeps a single, triaged list of findings. Reports in mixed formats? More than 350 built-in parsers read output from Burp Suite, ZAP, Trivy, Tenable Nessus, SonarQube, Snyk, and Checkmarx, and Generic Findings Import covers tools without a parser through CSV or JSON files. The same scan every night? Reimport adds new findings, can close the ones that vanished, and reopens the ones that return, while deduplication ties repeat detections inside an asset to their original. Decisions already made? False positive, out of scope, and risk accepted statuses survive reimport, so nobody triages the same noise twice. A deadline on every fix? Severity-based SLA countdowns flag breaches and can notify the users assigned to each asset, and full risk acceptances carry notes, files, and an expiry date that returns findings to active by default. Many teams, many applications? Organizations, assets, engagements, and tests mirror how security work is organized, with permissions that cascade downward. Pipelines that should report themselves? The REST API and CI/CD engagements import results automatically, and findings push to Jira as tickets. Someone outside security wants a summary? Dashboards track metrics, and a widget-based report builder produces HTML reports that print to PDF. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

Enterprise security stacks assume an enterprise budget; Wildbox assumes a server you already own. It runs your whole security operation as a set of cooperating services behind a single HTTPS gateway: threat intelligence collectors pull indicators from seven public feeds on a schedule, starting with abuse.ch's Feodo Tracker, and every indicator is searchable in one place. Fifty-two security tools sit behind one API, covering DNS, TLS, email security, headers, and port analysis. The cloud posture service runs 22 configuration checks against your live AWS accounts and keeps each scan's report, while the vulnerability service inventories your assets, prioritizes findings by risk, and tracks them through remediation with SLA checks and alert rules. When something needs doing, YAML playbooks execute response workflows as background jobs, and the agents service writes Claude-generated threat-enrichment reports for suspicious indicators when you give it an API key. An osquery-based sensor streams endpoint telemetry from your hosts into the platform, kept separate per team. Users, teams, roles, and scoped API keys live in the identity service, and the backends accept nothing that did not arrive through the gateway, so your security data never leaves hardware you control. Optional Compose profiles add n8n automation and Prometheus monitoring. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

PRISM consolidates passive reconnaissance, credential leak detection, and network asset mapping into a unified operational dashboard to replace fragmented command-line security tools. Analysts can launch simultaneous multi-source investigations against domains, internet protocol addresses, email mailboxes, phone numbers, and online handles to uncover domain registrations, open network ports, cryptographic certificates, and historical web archives. The platform interrogates threat feeds and leak repositories to expose credential leaks, dark web mirrors, and email routing anomalies with automated SMTP mailbox verification. Cross-platform identity engines crawl thousands of social networks and public registries to correlate aliases, discover leaked commit identities, and trace digital footprints across the web. Discovered assets render into interactive entity relationship graphs alongside geographic internet protocol maps to help investigators visualize infrastructure clusters and ownership links. An automated operational security calculator evaluates exposure vulnerabilities across identity, web, and infrastructure vectors, producing an aggregated risk score with granular hardening recommendations. Scheduled watchlists continually monitor target infrastructure, dispatching webhook notifications to chat channels whenever new subdomains, ports, or credential leaks appear. Investigators can export comprehensive audit dossiers as self-contained HTML files, styled PDF documents, or structured spreadsheets. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

MISP is an open source threat intelligence platform where analysts log indicators and incidents, see how they connect, and share them with trusted organizations. Each case is an event holding attributes and structured objects such as files, network connections, and email messages, with Markdown reports beside the machine-readable data. A correlation engine links events that share values, including fuzzy-hash and CIDR matches, and warning lists flag benign values before they cause false positives. Taxonomies and galaxies tag events with TLP levels, threat actors, malware families, and MITRE ATT&CK techniques. Analysts explore relationships in an event graph and a correlation graph with a timeline, and build drag-and-drop dashboards with maps and ATT&CK heatmaps. Sharing groups control who sees which event, and instances synchronize with partner organizations with distribution settings down to a single attribute. Free-text, URL, bulk, and STIX imports fill the database, and exports reach Suricata, Snort, Zeek, OpenIOC, CSV, STIX 1 and 2, and RPZ zones. A REST API, the PyMISP library, expansion modules, and workflows enrich data and automate publishing. ZeroMQ and Kafka streams announce every change to connected tools. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

VoidAccess is a self-hosted dark web OSINT platform that takes a single investigation question and returns a sourced report, a searchable relationship graph, and indicators you can load straight into your defenses. One query fans out in parallel to more than a dozen Tor search engines, code hosts, paste sites, security feeds, and curated onion seeds, then follows newly discovered onion links while mandatory safety gates drop prohibited queries, URLs, and content. A thirteen-step pipeline refines the question, collects across English, Russian, and Chinese sources, filters signal from duplicates and dead ends, enriches what survives, and extracts the entities that matter. It recognizes threat actors, ransomware groups, malware families, IP addresses, domains, onion addresses, file hashes, cryptocurrency wallets across seven chains, exposed credentials with secrets masked, messaging handles, CVEs, and MITRE ATT&CK techniques. Everything lands in an interactive graph with communities and infrastructure clusters, so you can start from one wallet or handle and walk the neighborhood it belongs to, cross-referenced against earlier investigations. Scheduled monitors watch for changes and send Telegram or email alerts when your targets move. Finished work exports as STIX 2.1, MISP events, Sigma and YARA rules, CSV, JSON, and bundled IOC packages, with multi-user access for a team. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.