Ranked by Attention Score: stars gained over the last 90 complete days
47 repositories by Attention Score · Aug 7, 2026 – Nov 4, 2026 (UTC)
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
An all-in-one hacking tool to remotely take over Android devices.
The Rogue Access Point Framework
📱 objection - runtime mobile exploration
Most advanced XSS scanner.
Common User Passwords Profiler (CUPP)
Infection Monkey - An open-source adversary emulation platform
Automated NoSQL database enumeration and web application exploitation tool.
Server-Side Template Injection and Code Injection Detection and Exploitation Tool
Hashtopolis - distributed password cracking with Hashcat
A friendly car security exploration tool for the CAN bus
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥
P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.
RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.
Generate smart and powerful wordlists
An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking)
The Offensive Manual Web Application Penetration Testing Framework.
Ronin is a Free and Open Source Ruby Toolkit for Security Research and Development. Ronin also allows for the rapid development and distribution of code, exploits, payloads, etc, via 3rd-party git repositories.
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations.
A free software to find the components installed in Joomla CMS, built out of the ashes of Joomscan.
Scriptable network authentication cracker
Wordlist, rules and masks from Kaonashi project (RootedCON 2019)
Automatically exported from code.google.com/p/creddump
PETEP (PEnetration TEsting Proxy) is an open-source Java application for traffic analysis & modification using TCP/UDP proxies. PETEP is a useful tool for performing penetration tests of applications with various application protocols. ⚡
:hammer: Manage your website via terminal
HTTP/2 Last Frame Synchronization (also known as Single Packet Attack) low Level Library / Tool based on Scapy + Exploit Timing Attacks
Legion is an open source, easy-to-use, super-extensible and semi-automated network penetration testing tool that aids in discovery, reconnaissance and exploitation of information systems.
Android Framework for Exploitation, is a framework for exploiting android based devices
EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.
Scans for accessibility tools backdoors via RDP
HAT (Hashcat Automation Tool) - An Automated Hashcat Tool for common wordlists and rules to speed up the process of cracking hashes during engagements. Created for Linux based systems
Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives.
Bind/Reverse Shells, SOCKS, etc over Tor in Golang
FETCH THE PASSWORD STRETCHER