SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
65,264 visible repositories in the index
1–24 of 71 · Most stars
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
- https
- tls
- certificates
- local-development
A pure Unix shell script ACME client for SSL / TLS certificate automation
- acme
- acme-protocol
- certbot
- shell
Main repo for hosting release binaries
- frida
- instrumentation
- vala
E-mails, subdomains and names Harvester - OSINT
Pterodactyl® is a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.
The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.
Tool to statically recompile N64 games into native executables
JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes
- jose
- jwa
- jwe
- jwk
A tool for recompiling Xbox 360 games to native executables.
↥ ↥ ↥ Follow for updates An RBAC permission management system based on Spring Cloud 2025, Spring Boot 4, and OAuth2.
- oauth2
- spring-boot
- spring-cloud
- spring-cloud-alibaba
free C++ class library of cryptographic schemes
- cryptography
- crypto
- c-plus-plus
A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps
- crypto
- cryptography
- x509
- message-digest
A phone number can reveal whether a device is active, in standby or offline (and more). This PoC demonstrates how delivery receipts + RTT timing leak sensitive device-activity patterns. (WhatsApp / Signal)
- phone-number
- signal
- tracking
Steamless is a DRM remover of the SteamStub variants. The goal of Steamless is to make a single solution for unpacking all Steam DRM-packed files. Steamless aims to support as many games as possible.
- drm
- steam
- steamstub-drm
- csharp
Cairn is a general-purpose AI state-space search engine, validated first on autonomous penetration testing. Sometimes misspelled as Carin.
Orchestrate end-to-end encryption, cryptographic identities, mutual authentication, and authorization policies between distributed applications – at massive scale.
- messaging
- authentication
- key-management
- identity
An open-source framework for Steam Client themes and plugins
- reverse-engineering
- steam
- valve
- millennium
A Complete Osint Tool :mag:
- osint
- python
- python-script
- osint-python
A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.
Python APNs and iMessage client
- imessage
- proof-of-concept
- reverse-engineering
🔑🔥📈 Next Level PGP
Collaborative forensic timeline analysis
CAUTION: END OF SUPPORT ON 14 AUG 2026. The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES and JSON Web Signature/Token in pure JavaScript.
- asn1
- x509
- certificate
- crl