SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
61,121 visible repositories in the index
1–24 of 65 · Most stars
DNS-Blocklists: For a better internet - keep the internet clean!
- dns
- ads
- blacklist
- blocklist
⚙️ NGINX config generator on steroids 💉
Daemon to ban hosts that cause multiple authentication errors
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
- security
- security-tools
- security-audit
- security-hardening
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
- owasp
- javascript
- vulnerable
- hacking
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators.
- investigation
- osint
- recon
- python
Version 2 is live! Wordlists sorted by probability originally created for password generation and testing - make sure your passwords aren't popular!
- wordlist
- password
- password-strength
- password-safety
Testing TLS/SSL encryption anywhere on any port
- tls
- cipher
- openssl
- ct
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
🔣 A collection of GitHub issue, pull request and security templates
- github
- templates
- template
- issues
:busts_in_silhouette: A bash-tool to store your private data inside a git repository.
- git-secret
- git
- git-addons
- gpg
A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.
- burpsuite
- intruder
- payloads
- fuzz-lists
ipsets dynamically updated with firehol's update-ipsets.sh script
- blocklists
- ipset
- ipset-lists
- attacks
My simple Swiss Army knife for http/https troubleshooting and profiling.
- https-troubleshoting
- http-requests
- httptracer
- redirect-urls
A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.
This map lists the essential techniques to bypass anti-virus and EDR
- av
- bypass
- edr
- mindmap
Manages application of security headers with many safe defaults
- secure-headers
- csp
- hsts
- referrer-policy
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte
- incident-response
- malware-detection
- persistence
- powershell
Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
- incident-response
- forensics
- computer-forensics
- triage