SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
76,356 visible repositories in the index
1–24 of 46 · Most stars
🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
- privacy
- security
- censorship
- cybersecurity
Daemon to ban hosts that cause multiple authentication errors
Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
security tips for startups
- security-considerations
- startup
- security
- chinese
Villain is a high level stage 0/1 C2 framework that can handle multiple reverse TCP & HoaxShell-based shells, enhance their functionality with additional features (commands, utilities) and share them among connected sibling servers (Villain instances running on different machines).
- open-source
- pentest
- pentesting
- readteaming
Portable Executable reversing tool with a friendly GUI
- pe-file
- pe-format
- pe-analyzer
- pe-analyzer-gui
The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.
Tool for Active Directory Certificate Services enumeration and abuse
- adcs
- pki
This repository contain a lot of web and api vulnerability checklist , a lot of vulnerability ideas and tips from twitter
- bugbounty
- security
- sqlinjection
- vulnerability
A password manager that supports Bitwarden platform and KeePass (KDBX) files. It autofills your logins, supports passkeys, works offline, and runs a Watchtower that finds leaked and reused passwords and other issues.
A collection of custom security tools for quick needs.
- audit
- bugbounty
- enumeration
- hacking
An #OSINT Framework to perform various recon techniques on Companies, People, Phone Number, Bitcoin Addresses, etc., aggregate all the raw data, and give data in multiple formats.
Quickly discover exposed hosts on the internet using multiple search engines.
- asm
- attack-surface
- bugbounty
- cli
CF-Hero is a reconnaissance tool that uses multiple data sources to discover the origin IP addresses of Cloudflare-protected web applications
Deep Eye orchestrates multiple AI providers (OpenAI, Claude, Grok, Gemini, OLLAMA, Groq, Mistral, OpenRouter, LiteLLM, LM Studio) for intelligent payload generation, scans targets for 45+ vulnerability types, and produces professional reports with compliance mapping.
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
A tool for analyzing the size of compiled Go binaries, offering cross-platform support, detailed breakdowns, and multiple output formats.
- binary
- golang
- symbol
- visualization
Dictionary collection project such as Pentesing, Fuzzing, Bruteforce and BugBounty. 渗透测试、SRC漏洞挖掘、爆破、Fuzzing等字典收集项目。
- pentesting
- fuzzing
- bruteforce
- bugbounty
Real-time phishing & scam domain blocklist - 205k+ curated threats, 1M+ community, free API, multiple formats
- blacklist
- cybersecurity
- domains
- drainer
OSINT power without API key hassle
For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual recon. 🛡️⚔️🧙
- vulnerability-detection
- vulnerability-research
- bugbounty
- pentesting
Spring Boot Template for Micro services Architecture - Show cases how to use Zuul for API Gateway, Spring OAuth 2.0 as Auth Server, Multiple Resource (Web Services) Servers, Angular Web App, Eureka dor registration and Discover and Hystrix for circuit breaker
Here record some tips about pwn. Something is obsoleted and won't be updated. Sorry about that.
- pwn
- ctf
- tips