SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 55 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
World's fastest and most advanced password recovery utility
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
- password-sniffer
- mitm
- rogue-ap
- wifi
Most advanced XSS scanner.
- xss
- xss-scanner
- xss-exploit
- xss-bruteforce
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
- john
- c
- ripper
- password
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
This is a webshell open source project
- webshell
- webshell-sniper
- php
- jsp
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
- rsa-attack
- rsa
- cryptography
PEDA - Python Exploit Development Assistance for GDB
Cameradar hacks its way into RTSP videosurveillance cameras
w3af: web application attack and audit framework, the open source web vulnerability scanner.
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
- hacking-vps
- bug-bounty
- tmux
- axiom
Automated Security Testing For REST API's
- security
- restapiautomation
- python
- owasp
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
- rootkit
- lkm-rootkit
- c
- kernel
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
- crack
- zip
- multithread
- attack
XSS'OR - Hack with JavaScript.
- probe
- pentest-tool
- xss
- csrf
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
- graphql
- security-scanner
- graphql-security
- api-documentation-tool
Small utilities that are useful in advanced password cracking