Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Repository Index
47,133 repositories indexed
1–24 of 52 · Most stars
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
- penetration-testing
- pentesting
- security-audit
- security-automation
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
The ZAP by Checkmarx Core project
- zap
- zap-development
- dast
- appsec
Most advanced XSS scanner.
- xss
- xss-scanner
- xss-exploit
- xss-bruteforce
Web path scanner
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
Exploitation Framework for Embedded Devices
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
w3af: web application attack and audit framework, the open source web vulnerability scanner.
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
Automated NoSQL database enumeration and web application exploitation tool.
- nosql
- nosql-databases
- penetration-testing
- scanner
Reverse Shell as a Service
- reverse-shell
- exploit
- vulnerability
- pentesting
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
- graphql
- security-scanner
- graphql-security
- api-documentation-tool
A utility to safely generate malicious network traffic patterns and evaluate controls.
A DNS rebinding attack framework.
- dns-rebinding
- dns
- vulnerability
- attack
The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.
- csrf
- crawler
- csrf-attacks
- token-generation
Generate smart and powerful wordlists
- wordlist
- password
- hacking-tool
- password-cracking