SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 127 · Most stars
Automatic SQL injection and database takeover tool
- sql-injection
- detection
- exploitation
- python
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
- data-analysis
- data-manipulation
- encryption
- encoding
Find secrets with Gitleaks 🔑
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
- decompiler
- decompiler-engine
- c-sharp
- dotnet
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
- agent-security
- agent-skills
- agentic-ai
- ai-security
The easiest, and most secure way to access and protect all of your infrastructure.
- ssh
- go
- bastion
- teleport-binaries
Bitwarden infrastructure/backend (API, database, Docker, etc).
- aspnetcore
- aspnet
- sql-server
- api
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
- cryptomator
- java
- cloud-storage
- cryptography
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
- osint
- osint-python
- python3
Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
- chrome
- macos
- windows
- pentest-tool
Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
- self-hosted
- self-hosting
- pastebin
- security
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
- rsa-attack
- rsa
- cryptography
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
- zanzibar
- permissions
- database
- distributed-systems
Your web application for managing personal data.
- dashboard
- dashboards
- manager
- symfony
:busts_in_silhouette: A bash-tool to store your private data inside a git repository.
- git-secret
- git
- git-addons
- gpg
Hide secrets with invisible characters in plain text securely using passwords 🧙🏻♂️⭐
- cryptography
- steganography
- compression
- functional-programming
Database documentation built easy
- schemaspy
- java
- documentation
- database
Tool to find metadata and hidden information in the documents.
Up to 100x faster strings for C, C++, CUDA, Python, Rust, Swift, JS, & Go, leveraging NEON, AVX2, AVX-512, SVE, GPGPU, & SWAR to accelerate search, hashing, sorting, edit distances, sketches, and memory ops 🦖
Automated NoSQL database enumeration and web application exploitation tool.
- nosql
- nosql-databases
- penetration-testing
- scanner
CAUTION: END OF SUPPORT ON 14 AUG 2026. The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES and JSON Web Signature/Token in pure JavaScript.
- asn1
- x509
- certificate
- crl