SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 28 · Most stars
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
- john
- c
- ripper
- password
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
fsociety Hacking Tools Pack – A Penetration Testing Framework
- fsociety
- exploitation
- port-scanning
- fsociety-hacking
Adversary Emulation Framework
- security-tools
- implant
- golang
- dns-server
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
- sn1per
- sn1per-professional
- bugbounty-platform
- attack-surface
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
- hacking-vps
- bug-bounty
- tmux
- axiom
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
Automated Security Testing For REST API's
- security
- restapiautomation
- python
- owasp
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
High-Performance word generator with a per-position configureable charset
:hammer: Manage your website via terminal
- php
- security-tools
- python
- pentest
A USB proxy based on raw-gadget and libusb
:hammer: A multiple reverse shell session/client manager via terminal
- socket
- python
- ctf
- attack-defense
Quantum Insert
- quantum-insert
- python
- detection
- pcap
Chiron - An IPv6 Security Assessment framework with advanced IPv6 Extension Headers manipulation capabilities.
- ipv6
- security-assessments
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
- ai-agents
- attack-surface-management
- docker
- penetration-testing
Extract the information needed from the Manifest.plist files to convert it to hashes compatible with hashcat
Machine-learn password mangling rules