Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Repository Index
59,621 visible repositories in the index
1–24 of 118 · Most stars
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
- penetration-testing
- pentesting
- security-audit
- security-automation
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
- phishing
- phisher
- phishing-attacks
- htr-tech
The ZAP by Checkmarx Core project
- zap
- zap-development
- dast
- appsec
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
Directory/File, DNS and VHost busting tool written in Go
- go
- pentesting
- tool
- dns
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
- john
- c
- ripper
- password
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
Adversary Emulation Framework
- security-tools
- implant
- golang
- dns-server
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
- sn1per
- sn1per-professional
- bugbounty-platform
- attack-surface
The recursive internet scanner for hackers. 🧡
Nishang - Offensive PowerShell for red team, penetration testing and offensive security.
- powershell
- nishang
- security
- red-team
TranslatedOneForAll is a powerful subdomain collection tool
- subdomain
- subdomain-scanner
- subdomain-enumeration
- subdomain-bruteforcing
An open-source post-exploitation framework for students, researchers and developers.
- encrypted-connections
- platform-independent
- no-dependencies
- reverse-shells
📱 objection - runtime mobile exploration
(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.
- ai
- deep-reinforcement-learning
- wpa-psk
- handshakes
A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
- java
- deserialization
- gadget
- exploit
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
The ESP32-BlueJammer (Bluetooth jammer, BLE jammer, WiFi jammer, RC jammer) disrupts 2.4GHz communications. Using an ESP32 and nRF24 modules, it generates noise and unnecessary packets, causing interference between the devices communicating, making them unable to work as intended. Ideal for controlled disruption and security testing.
- bluetooth
- bt
- coding
- cybersecurity