attack-surface-management 开源项目推荐（248 个）

1N3 /Sn1per

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

blacklanternsecurity /bbot

面向黑客的递归互联网扫描器。🧡

j3ssie /osmedeus

A Modern Orchestration Engine for Security

cloudquery /cloudquery

Data pipelines for cloud config and security data. Build cloud asset inventory, CSPM, FinOps, and vulnerability management solutions. Extract from AWS, Azure, GCP, and 70+ cloud and SaaS sources.

jonrau1 /ElectricEye

ElectricEye is a multi-cloud, multi-SaaS Python CLI tool for Asset Management, Security Posture Management & Attack Surface Monitoring supporting 100s of services and evaluations to harden your CSP & SaaS environments with controls mapped to over 20 industry, regulatory, and best practice controls frameworks

PhonePe /mantis

Mantis is a security framework that automates the workflow of discovery, reconnaissance, and vulnerability scanning.

asaotomo /FofaMap

FofaMap v2.0 是一款基于 Python3 开发的全网首个 AI 驱动红队资产测绘智能体。在延续原有 FOFA 数据采集、存活检测、统计聚合、图标 Hash 及批量查询等核心功能的基础上，2.0 版本原生支持 MCP 协议，可无缝接入 Cursor、Claude 等 AI 平台。其核心内置了 AI 自我反思机制，能根据查询结果自动调优语法，并智能联动 Nuclei 推荐精准扫描策略，实现从“被动采集”到“主动智能决策”的红队作业进化。

yyhuni /xingrin

Open-source attack surface management and authorized security automation platform for asset discovery, service probing, scan orchestration, and security result management.

pablosnt /rekono

Offensive security platform that automates attack surface discovery and vulnerability management

hevnsnt /CVEngine

AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration.

owl234 /ARL-Next

🚀 自动化资产侦察与漏洞监控平台 (ARL-Next)。重构自经典 ARL，全面升级 Puppeteer + Nuclei 引擎，打通「天眼查/ICP ➔ 资产发现 ➔ 漏洞扫描 ➔ 威胁情报追踪」安全闭环。支持 Docker 极简部署，AI 二开友好。

censys /censys-python

An easy-to-use and lightweight API wrapper for Censys APIs.

0xbug /biu

网络资产攻击面梳理

g0ldencybersec /EasyEASM

Zero-dollar attack surface management tool

oasm-platform /open-asm

Open-source Attack Surface Management. Discover assets. Identify exposure. Own your security data.

someengineering /cloud-security-list

A list of cloud security tools and vendors.

LINGYK352 /Watchtower

Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.

e1abrador /sub.Monitor

Self-hosted passive subdomain continous monitoring tool.

nishu2402 /HEAVEN-Autonomous-Penetration-Testing

☠️ Advanced autonomous penetration testing framework. Automates web, network, and cloud vulnerability scanning with contextual CVSS scoring, AI-driven attack planning, and compliance reporting.

red-kite-solutions /stalker

Red Kite, the Extensible Attack Surface Management tool.