SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 702 · Most stars
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
- https
- tls
- certificates
- local-development
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
- hex-editor
- reverse-engineering
- ips
- dear-imgui
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
- penetration-testing
- pentesting
- security-audit
- security-automation
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
Metasploit Framework
- hacktoberfest
Automatic SQL injection and database takeover tool
- sql-injection
- detection
- exploitation
- python
Open Source Identity and Access Management For Modern Applications and Services
- keycloak
- oidc
- saml
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
- cve-scanner
- subdomain-takeover
- nuclei-engine
- vulnerability-detection
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.
- keepassxc
- keepass
- password-manager
- linux
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
- decompiler
- decompiler-engine
- c-sharp
- dotnet
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
- agent-security
- agent-skills
- agentic-ai
- ai-security
A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
- built-at-rc
- age-encryption
Simple and flexible tool for managing secrets
Simple, unobtrusive authentication for Node.js.
Self-Hosting Guide. Learn all about locally hosting (on premises & private web servers) and managing software applications by yourself or your organization. Including Cloud, LLMs, WireGuard, Automation, Home Assistant, and Networking.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- static-analysis
- dynamic-analysis
- mobsf
- android-security
A little tool to play with Windows security
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Free and Open Source Reverse Engineering Platform powered by rizin
Daemon to ban hosts that cause multiple authentication errors