SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
55,140 visible repositories in the index
1–24 of 275 · Most stars
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
- https
- tls
- certificates
- local-development
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
- hex-editor
- reverse-engineering
- ips
- dear-imgui
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
- cve-scanner
- subdomain-takeover
- nuclei-engine
- vulnerability-detection
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
- llm
- prompt-engineering
- prompts
- llmops
A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
- built-at-rc
- age-encryption
Simple and flexible tool for managing secrets
Simple, unobtrusive authentication for Node.js.
Daemon to ban hosts that cause multiple authentication errors
JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
- malware
- malware-analysis
- malware-samples
- malware-research
Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
Solidity contracts implementing hash based post quantum signatures
CryptoSwift is a growing collection of standard and secure cryptographic algorithms implemented in Swift
- swift
- aes
- cryptography
- commoncrypto
Authentication, simple and clean
Go implementation of JSON Web Tokens (JWT).
People tracker on the Internet: OSINT analysis and research tool by Jose Pino
- tracking
- osint
- footprint
- hacking-tool
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
- security-tools
- osint
- recon
- recon-engine
Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)
- lolbins
- lolscripts
- redteam
- blueteam
The open-source, privacy-friendly CAPTCHA you host yourself. Bots and AI agents out, people in.
- captcha
- javascript
- proof-of-work
- antispam
A fast, simple, recursive content discovery tool written in Rust.
- web
- pentest
- pentesting-tool
- rust
Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. [email protected]
- penetration-testing
- red-teaming
- windows
- fireeye-flare
A simple library to work with JSON Web Token and JSON Web Signature
- php
- jwt
- tokens
- hacktoberfest