SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 170 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
- penetration-testing
- pentesting
- security-audit
- security-automation
Metasploit Framework
- hacktoberfest
Automatic SQL injection and database takeover tool
- sql-injection
- detection
- exploitation
- python
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
World's fastest and most advanced password recovery utility
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- static-analysis
- dynamic-analysis
- mobsf
- android-security
A little tool to play with Windows security
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
- password-sniffer
- mitm
- rogue-ap
- wifi
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
- phishing
- phisher
- phishing-attacks
- htr-tech
Fast web fuzzer written in Go
- fuzzer
- pentesting
- infosec
- web
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
- ddos
- ddos-attacks
- ddos-tool
- attack
The ZAP by Checkmarx Core project
- zap
- zap-development
- dast
- appsec
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
Most advanced XSS scanner.
- xss
- xss-scanner
- xss-exploit
- xss-bruteforce
Web path scanner
The Rogue Access Point Framework
- wifiphisher
- wifi
- rogue
- access-point
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
Open-Source Phishing Toolkit
- gophish
- phishing
- golang
- security