SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
63,269 visible repositories in the index
1–24 of 61 · Most stars
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- static-analysis
- dynamic-analysis
- mobsf
- android-security
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
- phishing
- phisher
- phishing-attacks
- htr-tech
Automated Penetration Testing Agentic Framework Powered by Large Language Models
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
- sn1per
- sn1per-professional
- bugbounty-platform
- attack-surface
An open-source post-exploitation framework for students, researchers and developers.
- encrypted-connections
- platform-independent
- no-dependencies
- reverse-shells
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
Scripted Local Linux Enumeration & Privilege Escalation Checks
Automated Adversary Emulation Platform
- adversary-emulation
- caldera
- security-automation
- red-team
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
Bjorn is a powerful network scanning and offensive security tool for the Raspberry Pi with a 2.13-inch e-Paper HAT. It discovers network targets, identifies open ports, exposed services, and potential vulnerabilities. Bjorn can perform brute force attacks, file stealing, host zombification, and supports custom attack scripts.
- automated-pentesting
- bruteforce
- cybersecurity
- e-paper
Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams
- python
- attack
- adversarial-machine-learning
- poisoning
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
- python
- penetration-testing
- penetration-testing-framework
- owasp
Automated Mass Exploiter
- metasploit
- python
- exploit
- exploitation
Cairn is a general-purpose AI state-space search engine, validated first on autonomous penetration testing. Sometimes misspelled as Carin.
Open-source AI red teaming toolkit from Microsoft. Test generative AI systems with automated scans, adaptive multi-turn attacks, and a web UI.
- ai-red-team
- generative-ai
- red-team-tools
- responsible-ai
Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
- csharp
- situational-awareness
Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share them among connected sibling servers (Villain instances running on different machines).
- open-source
- pentest
- pentesting
- readteaming
Hosted Reverse Shell generator with a ton of functionality. -- (Great for CTFs)