SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
Fast web fuzzer written in Go
- fuzzer
- pentesting
- infosec
- web
Web path scanner
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
Web application fuzzer
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
- phishing
- typosquatting
- domains
- dns
A high performance offensive security tool for reconnaissance and vulnerability scanning
- reconnaissance
- scanner
- vulnerability-assessment
- vulnerability-scanner
Potentially dangerous files
- list
- web
- vulnerability
- files
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
pure-python ECDSA signature/verification and ECDH key agreement
- python
- elliptic-curves
- cryptography
- digital-signatures
A friendly car security exploration tool for the CAN bus
- python
- can-bus
- security-scanner
- security-testing
Fast HTTP enumerator
- http
- fuzz
- fuzzer
- enumerator
Malware Analysis Tool using Function Level Fuzzy Hashing
🔍A cutting edge context aware GraphQL API fuzzing tool!
- api-testing-framework
- graphql
- api
- automated-testing
Content discovery and fuzzing with HTTP/3 support (100k requests per second)
🤖 Repeat tests. Repeat tests. Repeat tests.
- testing
- test
- test-automation
- data-driven
NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis (IEEE S&P '21)
- fuzzer
- fuzzing
- kernel-fuzzer
- windows-kernel
Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives.
- cybersecurity
- hacking
- iast
- dast
Fragscapy is a command-line tool to fuzz network protocols by automating the modification of outgoing network packets. It can run multiple successive tests to determine which options can be used to evade firewalls and IDS.
A tool to enable fuzzing for Spectre vulnerabilities
Generate wordlists of Danish phone numbers by area and/or usage (Mobile, landline etc.) Useful for password cracking or fuzzing Danish targets.
Code for ASE'21 Paper "CorbFuzz: Checking Browser Security Policies with Fuzzing"
- fuzzing
- concolic-execution
- browser-security
Stream-first CAN & J1939 toolkit for security research and AI agents — typed JSONL events, CLI, TUI, fuzzing, MCP server.
- automotive-security
- can-bus
- can-bus-hacking
- can-bus-security