This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org
Repository Index
47,133 repositories indexed
1–22 of 22 · Most stars
A collection of hacking / penetration testing resources to make you better!
CTF framework and exploit development library
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
An all-in-one hacking tool to remotely take over Android devices.
Exploit chain for PS5 7.00 - 13.60
The best tool for finding one gadget RCE in libc.so.6
Reverse Shell as a Service
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
A collection of android Exploits and Hacks
Detect deauthentication frames using an ESP8266
Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
:hammer: A multiple reverse shell session/client manager via terminal
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12
IOS/MAC Denial-Of-Service [POC/EXPLOIT FOR MASSIVE ATTACK TO IOS/MAC IN NETWORK]
National Vulnerability Database (NVD) implemented by rust
Express honeypot for remote file inclusion (RFI) and local file inclusion (LFI).