SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–23 of 23 · Most stars
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
- anti-analysis
- anti-debugging
- anti-sandbox
- anti-vm
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
- reverse-engineering
- rop
- rop-exploitation
- rop-gadgets
P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.
SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.
- sip
- voip
- password-cracker
- svwar
Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking)
An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
- elliot
- cupp
- passwords
- hacking-tool
bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.
- xss
- bxss
- security
- bugbounty
HAT (Hashcat Automation Tool) - An Automated Hashcat Tool for common wordlists and rules to speed up the process of cracking hashes during engagements. Created for Linux based systems
A USB proxy based on raw-gadget and libusb
HTTP/2 Last Frame Synchronization (also known as Single Packet Attack) low Level Library / Tool based on Scapy + Exploit Timing Attacks
- http2
- race-condition
- race-conditions
- scapy
Android Framework for Exploitation, is a framework for exploiting android based devices
A hashcat-based distributed password cracking system
The tool is used to analyze the content of the android application in local storage.
Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives.
- cybersecurity
- hacking
- iast
- dast
Fragscapy is a command-line tool to fuzz network protocols by automating the modification of outgoing network packets. It can run multiple successive tests to determine which options can be used to evade firewalls and IDS.
Phraser is a phrase generator using n-grams and Markov chains to generate phrases for passphrase cracking. The generated phraselists can be used as wordlists in your favourite password cracking application.
A tool to assist IoT developers in securing MQTT-based IoT deployments
Create n-grams of wordlists based on words, characters, or charsets to use in offline password attacks and data analysis
- hashcat
- jtr
- mdxfind
- ngram