1.vxcontrol / pentagi
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
- graphql
- multi-agent-system
- +12 more
+17,058 stars
from 16,269 · score 9.74
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
55 repositories by Attention Score · May 9, 2026 – Nov 4, 2026 (UTC)
2.Z4nzu / hackingtool
ALL IN ONE Hacking Tool For Hackers
- allinonehackingtool
- web-attack
- password-attack
- hacking
- wireless-attack
- besthackingtool
- +7 more
+9,658 stars
from 72,022 · score 9.18
3.promptfoo / promptfoo
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
- llm
- prompt-engineering
- prompts
- llmops
- prompt-testing
- testing
- +12 more
+6,098 stars
from 20,745 · score 8.72
4.0x4m4 / hexstrike-ai
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
+4,899 stars
from 8,456 · score 8.50
5.danielmiessler / SecLists
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
+4,280 stars
from 70,259 · score 8.36
6.GreyDGL / PentestGPT
Automated Penetration Testing Agentic Framework Powered by Large Language Models
+3,434 stars
from 12,836 · score 8.14
+2,419 stars
from 10,112 · score 7.79
8.MatrixTM / MHDDoS
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
- ddos
- ddos-attacks
- ddos-tool
- attack
- cloudflare-bypass
- layer4
- +13 more
+1,293 stars
from 15,664 · score 7.17
9.shadow1ng / fscan
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
- security-tools
- security
+1,158 stars
from 13,579 · score 7.06
+1,111 stars
from 15,877 · score 7.01
11.redcanaryco / atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
+931 stars
from 11,839 · score 6.84
12.bee-san / Ciphey
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
- artificial-intelligence
- ctf-tools
- +11 more
+506 stars
from 21,237 · score 6.23
13.SpacehuhnTech / WiFiDuck
Wireless keystroke injection attack platform
+481 stars
from 2,859 · score 6.18
14.Manisso / fsociety
fsociety Hacking Tools Pack – A Penetration Testing Framework
- fsociety
- exploitation
- port-scanning
- fsociety-hacking
- post-exploitation
- web-hacking
- +7 more
+461 stars
from 11,933 · score 6.14
15.RsaCtfTool / RsaCtfTool
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
- rsa-attack
- rsa
- cryptography
+326 stars
from 6,886 · score 5.79
16.Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
- penetration-testing
- security
- hacking
- infosec
- rtsp
- cctv
- +5 more
+313 stars
from 4,976 · score 5.75
17.goshs-labs / goshs
Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.
- golang
- http-server
- https-server
- ctf
- devtools
- file-transfer
- +14 more
+238 stars
from 769 · score 5.48
18.GerbenJavado / LinkFinder
A python script that finds endpoints in JavaScript files
- infosec
- endpoints
+157 stars
from 4,316 · score 5.06
19.tennc / webshell
This is a webshell open source project
- webshell
- webshell-sniper
- php
- jsp
- asp
- aspx
- +3 more
+136 stars
from 10,661 · score 4.92
20.ZerBea / hcxtools
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
- wlan
- wpa
- wpa2
- raspberry-pi
- hashcat
- handshake
- +8 more
+115 stars
from 2,354 · score 4.75
21.pry0cc / axiom
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
- hacking-vps
- bug-bounty
- tmux
- axiom
- masscan
- gowitness
- +12 more
+92 stars
from 4,353 · score 4.53
22.spacehuhn / esp8266_beaconSpam
Creates up to a thousand WiFi access points with custom SSIDs.
- ssid
- custom-ssids
- wifi
- esp8266
- spam
- flood
- +1 more
+91 stars
from 1,298 · score 4.52
23.mufeedvh / pdfrip
A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.
- rust
- security
- security-tools
- password
- password-cracker
- +1 more
+84 stars
from 1,335 · score 4.44
24.sc0tfree / mentalist
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
- cracking-hashes
- wordlist-technique
+69 stars
from 1,971 · score 4.25
25.NextronSystems / APTSimulator
A toolset to make a system look as if it was the victim of an APT attack
+67 stars
from 2,721 · score 4.22
+49 stars
from 298 · score 3.91
27.noraj / haiti
:key: Hash type identifier (CLI & lib)
- security-tools
- hash
- identify
- digest
- hashing
- security
- +14 more
+48 stars
from 963 · score 3.89
28.brannondorsey / naive-hashcat
Crack password hashes without the fuss :cat2:
+46 stars
from 1,383 · score 3.85
+44 stars
from 1,404 · score 3.81
30.lukechilds / reverse-shell
Reverse Shell as a Service
- reverse-shell
- exploit
- vulnerability
- pentesting
- microservice
- security
+42 stars
from 2,030 · score 3.76
+42 stars
from 1,283 · score 3.76
32.mgeeky / ProtectMyTooling
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
+42 stars
from 1,064 · score 3.76
33.bad-antics / nullkia
NullKia Mobile Security Framework - Tools in Nim, Crystal, V, D, Red, Odin, Haxe, Zig, Kotlin, Lua, PHP, Python | bad-antics | github.com/bad-antics
- android-hacking
- baseband
- bootloader-unlock
- checkm8
- firmware-hacking
- ios-jailbreak
- +14 more
+42 stars
from 22 · score 3.76
+40 stars
from 1,860 · score 3.71
35.Aegrah / PANIX
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
+40 stars
from 855 · score 3.71
36.NotSoSecure / password_cracking_rules
One rule to crack all passwords. or atleast we hope so.
+36 stars
from 1,609 · score 3.61
37.hashcat / maskprocessor
High-Performance word generator with a per-position configureable charset
+20 stars
from 495 · score 3.04
38.jordanpotti / AWSBucketDump
Security Tool to Look For Interesting Files in S3 Buckets
- s3-bucket
- penetration-testing
- bugbounty
- enumeration
+19 stars
from 1,452 · score 3.00
39.khast3x / Redcloud
Automated Red Team Infrastructure deployement using Docker
+17 stars
from 1,263 · score 2.89
40.uber-common / metta
An information security preparedness tool to do adversarial simulation.
- uber
- vagrant
- yaml
- celery
- python
- redis
- +7 more
+14 stars
from 1,134 · score 2.71
41.ReversecLabs / leonidas
Automated Attack Simulation in the Cloud, complete with detection use cases.
+13 stars
from 607 · score 2.64
42.TryCatchHCF / DumpsterFire
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
+12 stars
from 1,032 · score 2.56
43.Paradoxis / StegCrackerArchived
Steganography brute-force utility to uncover hidden data inside files
- steghide
- steganography
- ctf-tools
- ctf
- brute-force
- stegcracker
- +2 more
+12 stars
from 593 · score 2.56
44.omar2535 / GraphQLer
🔍A cutting edge context aware GraphQL API fuzzing tool!
- api-testing-framework
- graphql
- api
- automated-testing
- cybersecurity
- pentesting
- +3 more
+12 stars
from 163 · score 2.56
45.LewisArdern / bXSS
bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.
- xss
- bxss
- security
- bugbounty
- blueteam
- cross-site-scripting
- +1 more
+9 stars
from 569 · score 2.30
46.pralab / secml_malware
Create adversarial attacks against machine learning Windows malware detectors
- adversarial-machine-learning
- infosec
- python
- attack
- machine-learning
- security
+8 stars
from 245 · score 2.20
47.KishanBagaria / padding-oracle-attacker
🔓 CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI.
- padding-oracle
- aes
- decryption
- encryption
- cipher-block-chaining
- cbc
- +4 more
+5 stars
from 216 · score 1.79
+4 stars
from 936 · score 1.61
49.brannondorsey / dns-rebind-toolkit
A front-end JavaScript toolkit for creating DNS rebinding attacks.
+4 stars
from 500 · score 1.61
50.brannondorsey / whonow
A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)
- dns
- dns-rebinding
- hacking
- malicious-domains
- nodejs
- penetration-testing
- +2 more
+3 stars
from 655 · score 1.39
51.gsmith257-cyber / GraphCrawlerArchived
GraphQL automated security testing toolkit
- api
- automated-testing
- cybersecurity
- graphql
- graphql-api
- pentesting
- +2 more
+3 stars
from 332 · score 1.39
52.HynekPetrak / sshame
brute force SSH public-key authentication
- ssh
- penetration-testing
- remote-admin-tool
- ssh-key
- brute-force
- brute-force-attacks
- +2 more
+3 stars
from 77 · score 1.39
53.Orange-Cyberdefense / fenrir-ocd
The repository host gives no description.
+2 stars
from 239 · score 1.10
54.NotSoSecure / android_application_analyzer
The tool is used to analyze the content of the android application in local storage.
+2 stars
from 175 · score 1.10
55.TheAdamProject / adams
Reducing Bias in Modeling Real-world Password Strength via Deep Learning and Dynamic Dictionaries
+1 stars
from 22 · score 0.69