SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
55,640 visible repositories in the index
1–17 of 17 · Most stars
Automatic SQL injection and database takeover tool
- sql-injection
- detection
- exploitation
- python
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
- rsa-attack
- rsa
- cryptography
Predatory ESP32 Firmware
- bruce
- cardputer
- esp32-s3
- hardware
K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)
- exploit
- 0day
- poc
- getshell
Cairn is a general-purpose AI state-space search engine, validated first on autonomous penetration testing. Sometimes misspelled as Carin.
Automated NoSQL database enumeration and web application exploitation tool.
- nosql
- nosql-databases
- penetration-testing
- scanner
Find exploit tool
- exploit-database
- python
- pentest-tool
- exploits
ARES - authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting.
- active-directory
- cloud-security
- defensive-validation
- fastapi
Ronin is a Free and Open Source Ruby Toolkit for Security Research and Development. Ronin also allows for the rapid development and distribution of code, exploits, payloads, etc, via 3rd-party git repositories.
A revamped and updated version of my original OneRuleToRuleThemAll hashcat rule
Standalone password candidate generator using the PRINCE algorithm
Create n-grams of wordlists based on words, characters, or charsets to use in offline password attacks and data analysis
- hashcat
- jtr
- mdxfind
- ngram
Collection of danish base wordlists for cracking danish passwords (Hashcat, John the Ripper etc.)
- password-cracking
- wordlists
- hashcat-lists
- hashcat
A tool that converts Bitwarden's data into a hashcat-suitable hash
Quickly look up hashes in your terminal using the HashMob API 🔥
- data-breaches
- hash-cracking
- hash-lookup
- hashcat
Extract hashes from the MongoDB database server to a hash format that hashcat accepts: -m 24100 (SCRAM-SHA-1) or -m 24200 (SCRAM-SHA-256)