SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
61,121 visible repositories in the index
1–21 of 21 · Most stars
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.
- burpsuite
- intruder
- payloads
- fuzz-lists
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
Generate smart and powerful wordlists
- wordlist
- password
- hacking-tool
- password-cracking
Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking)
tool for generating wordlists or extending an existing one using mutations.
Various wordlists FR & EN - Cracking French passwords
- wordlists
- hashcat
- french
- cracking-hashes
HAT (Hashcat Automation Tool) - An Automated Hashcat Tool for common wordlists and rules to speed up the process of cracking hashes during engagements. Created for Linux based systems
PETEP (PEnetration TEsting Proxy) is an open-source Java application for traffic analysis & modification using TCP/UDP proxies. PETEP is a useful tool for performing penetration tests of applications with various application protocols. ⚡
- proxy
- tcp
- tcp-proxy
- penetration-testing
🔓 CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI.
- padding-oracle
- aes
- decryption
- encryption
Hascat Rules Collection – Probably the largest collection of hashcat rule-files anywhere.
- hashcat
- hashcat-rules
- hashcat-rule
- password-cracking
Content discovery and fuzzing with HTTP/3 support (100k requests per second)
Custom password cracking rules for Hashcat and John the Ripper
- password-cracking
- hashcat
- johntheripper
- jtr
Fragscapy is a command-line tool to fuzz network protocols by automating the modification of outgoing network packets. It can run multiple successive tests to determine which options can be used to evade firewalls and IDS.
Phraser is a phrase generator using n-grams and Markov chains to generate phrases for passphrase cracking. The generated phraselists can be used as wordlists in your favourite password cracking application.
Collection of hashcat lists and things.
- hashcat
- hashcat-rules
- hashcat-masks
- password-cracking
Create n-grams of wordlists based on words, characters, or charsets to use in offline password attacks and data analysis
- hashcat
- jtr
- mdxfind
- ngram
Collection of danish base wordlists for cracking danish passwords (Hashcat, John the Ripper etc.)
- password-cracking
- wordlists
- hashcat-lists
- hashcat
A script to automate the creation of cloud infrastructure for hash cracking.
- redteam-infrastructure
- redteaming
- pentest-tool
- password-cracker
Generate wordlists of Danish phone numbers by area and/or usage (Mobile, landline etc.) Useful for password cracking or fuzzing Danish targets.