SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Repository Index
47,133 repositories indexed
1–24 of 78 · Most stars
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
- password-sniffer
- mitm
- rogue-ap
- wifi
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
- phishing
- phisher
- phishing-attacks
- htr-tech
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
Directory/File, DNS and VHost busting tool written in Go
- go
- pentesting
- tool
- dns
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
- john
- c
- ripper
- password
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
hydra
- penetration-testing
- password-cracker
- network-security
- hydra
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
- anti-analysis
- anti-debugging
- anti-sandbox
- anti-vm
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
- pentest
- brute-force
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
- wlan
- wpa
- wpa2
- raspberry-pi
A tool to abuse Exchange services
- mapi
- exchange
- shells
- pentesting
Open-Source Shellcode & PE Packer
- shellcode
- antivirus-evasion
- redteam
- hacktoberfest
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
A tool for automating cracking methodologies through Hashcat from the TrustedSec team.