SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 109 · Most stars
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
- penetration-testing
- pentesting
- security-audit
- security-automation
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- static-analysis
- dynamic-analysis
- mobsf
- android-security
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
- password-sniffer
- mitm
- rogue-ap
- wifi
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
- phishing
- phisher
- phishing-attacks
- htr-tech
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
Web path scanner
The Rogue Access Point Framework
- wifiphisher
- wifi
- rogue
- access-point
Open-Source Phishing Toolkit
- gophish
- phishing
- golang
- security
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
fsociety Hacking Tools Pack – A Penetration Testing Framework
- fsociety
- exploitation
- port-scanning
- fsociety-hacking
Adversary Emulation Framework
- security-tools
- implant
- golang
- dns-server
This is a webshell open source project
- webshell
- webshell-sniper
- php
- jsp
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
- anti-analysis
- anti-debugging
- anti-sandbox
- anti-vm
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
An all-in-one hacking tool to remotely take over Android devices.
- adb
- android
- android-debug-bridge
- cybersecurity
PEDA - Python Exploit Development Assistance for GDB
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
- reverse-engineering
- rop
- rop-exploitation
- rop-gadgets
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
- hacking-vps
- bug-bounty
- tmux
- axiom
P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
- pentest
- brute-force
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.