SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 173 · Most stars
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
- cve-scanner
- subdomain-takeover
- nuclei-engine
- vulnerability-detection
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.
- information-gathering
- osint
- osint-tools
- open-source-intelligence
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
- security
- security-tools
- security-audit
- security-hardening
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
Disk encryption with strong security based on TrueCrypt
- encryption
- encryption-decryption
- encryption-algorithms
- veracrypt
Socket-based TS/JavaScript API for WhatsApp Web
Hash-based post quantum signatures in Rust
Solidity contracts implementing hash based post quantum signatures
Hash-based signatures in typescript, WOTS+
RetDec is a retargetable machine-code decompiler based on LLVM.
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
- anti-analysis
- anti-debugging
- anti-sandbox
- anti-vm
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
Go package for UUIDs based on RFC 4122 and DCE 1.1: Authentication and Security Services.
- go
- uuid
Role-based Permissions for Laravel 5
A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps
- crypto
- cryptography
- x509
- message-digest
eBPF-based Security Observability and Runtime Enforcement
Split your file into encrypted fragments so that you don't need to remember a passcode
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
- reverse-engineering
- rop
- rop-exploitation
- rop-gadgets