SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 112 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
- acme
- acme-client
- certbot
- certificate
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
- cve-scanner
- subdomain-takeover
- nuclei-engine
- vulnerability-detection
Self-Hosting Guide. Learn all about locally hosting (on premises & private web servers) and managing software applications by yourself or your organization. Including Cloud, LLMs, WireGuard, Automation, Home Assistant, and Networking.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- static-analysis
- dynamic-analysis
- mobsf
- android-security
Translated✨ An open-source, free, one-stop Java permission authentication framework that makes authentication and authorization simple and elegant! — Login authentication, permission authentication, distributed Session, microservice gateway authentication, SSO single sign-on, OAuth2.0 unified authentication, jwt integration, API Key authorization, API parameter signing
- java
- token
- authorization
- sso
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
Open source alternative to Auth0 / Firebase Auth / AWS Cognito
- authentication
- session-management
- login
- supertokens
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
- vuls
- vulnerability-scanners
- golang
- go
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
Minimal authorization through OO design and pure Ruby classes
- ruby
[DEPRECATED] Stanford Javascript Crypto Library
An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
The Leading Security Assessment Framework for Android.
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
- bro
- scans
- nmap
- network
🛠 Secure, stateless, and cookie-based session library for Next.js or any JavaScript framework
- nextjs
- authentication
- session
- stateless
A high performance offensive security tool for reconnaissance and vulnerability scanning
- reconnaissance
- scanner
- vulnerability-assessment
- vulnerability-scanner
Automated NoSQL database enumeration and web application exploitation tool.
- nosql
- nosql-databases
- penetration-testing
- scanner
HTTP Session Management for Go
- go
- golang
- session
- sessions