1.vxcontrol / pentagi
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
- graphql
- multi-agent-system
- +12 more
+11,959 stars
from 21,368 · score 9.39
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
50 repositories by Attention Score · Aug 7, 2026 – Nov 4, 2026 (UTC)
2.Z4nzu / hackingtool
ALL IN ONE Hacking Tool For Hackers
- allinonehackingtool
- web-attack
- password-attack
- hacking
- wireless-attack
- besthackingtool
- +7 more
+3,353 stars
from 78,327 · score 8.12
3.promptfoo / promptfoo
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
- llm
- prompt-engineering
- prompts
- llmops
- prompt-testing
- testing
- +12 more
+2,976 stars
from 23,867 · score 8.00
4.0x4m4 / hexstrike-ai
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
+2,619 stars
from 10,736 · score 7.87
5.danielmiessler / SecLists
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
+2,172 stars
from 72,367 · score 7.68
6.GreyDGL / PentestGPT
Automated Penetration Testing Agentic Framework Powered by Large Language Models
+1,650 stars
from 14,620 · score 7.41
+597 stars
from 11,934 · score 6.39
8.shadow1ng / fscan
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
- security-tools
- security
+579 stars
from 14,158 · score 6.36
+567 stars
from 16,421 · score 6.34
10.MatrixTM / MHDDoS
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
- ddos
- ddos-attacks
- ddos-tool
- attack
- cloudflare-bypass
- layer4
- +13 more
+551 stars
from 16,406 · score 6.31
11.redcanaryco / atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
+452 stars
from 12,318 · score 6.12
12.bee-san / Ciphey
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
- artificial-intelligence
- ctf-tools
- +11 more
+247 stars
from 21,496 · score 5.51
13.SpacehuhnTech / WiFiDuck
Wireless keystroke injection attack platform
+231 stars
from 3,109 · score 5.45
14.Manisso / fsociety
fsociety Hacking Tools Pack – A Penetration Testing Framework
- fsociety
- exploitation
- port-scanning
- fsociety-hacking
- post-exploitation
- web-hacking
- +7 more
+211 stars
from 12,183 · score 5.36
15.RsaCtfTool / RsaCtfTool
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
- rsa-attack
- rsa
- cryptography
+176 stars
from 7,036 · score 5.18
16.Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
- penetration-testing
- security
- hacking
- infosec
- rtsp
- cctv
- +5 more
+165 stars
from 5,124 · score 5.11
17.goshs-labs / goshs
Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.
- golang
- http-server
- https-server
- ctf
- devtools
- file-transfer
- +14 more
+68 stars
from 939 · score 4.23
18.tennc / webshell
This is a webshell open source project
- webshell
- webshell-sniper
- php
- jsp
- asp
- aspx
- +3 more
+61 stars
from 10,736 · score 4.13
19.GerbenJavado / LinkFinder
A python script that finds endpoints in JavaScript files
- infosec
- endpoints
+56 stars
from 4,417 · score 4.04
20.ZerBea / hcxtools
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
- wlan
- wpa
- wpa2
- raspberry-pi
- hashcat
- handshake
- +8 more
+54 stars
from 2,415 · score 4.01
21.spacehuhn / esp8266_beaconSpam
Creates up to a thousand WiFi access points with custom SSIDs.
- ssid
- custom-ssids
- wifi
- esp8266
- spam
- flood
- +1 more
+52 stars
from 1,337 · score 3.97
22.pry0cc / axiom
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
- hacking-vps
- bug-bounty
- tmux
- axiom
- masscan
- gowitness
- +12 more
+50 stars
from 4,395 · score 3.93
23.NextronSystems / APTSimulator
A toolset to make a system look as if it was the victim of an APT attack
+32 stars
from 2,756 · score 3.50
24.sc0tfree / mentalist
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
- cracking-hashes
- wordlist-technique
+32 stars
from 2,008 · score 3.50
25.lukechilds / reverse-shell
Reverse Shell as a Service
- reverse-shell
- exploit
- vulnerability
- pentesting
- microservice
- security
+29 stars
from 2,043 · score 3.40
26.mufeedvh / pdfrip
A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.
- rust
- security
- security-tools
- password
- password-cracker
- +1 more
+27 stars
from 1,392 · score 3.33
+26 stars
from 321 · score 3.30
+23 stars
from 1,425 · score 3.18
29.NotSoSecure / password_cracking_rules
One rule to crack all passwords. or atleast we hope so.
+22 stars
from 1,623 · score 3.14
+21 stars
from 1,879 · score 3.09
+20 stars
from 1,305 · score 3.04
32.brannondorsey / naive-hashcat
Crack password hashes without the fuss :cat2:
+19 stars
from 1,410 · score 3.00
33.noraj / haiti
:key: Hash type identifier (CLI & lib)
- security-tools
- hash
- identify
- digest
- hashing
- security
- +14 more
+19 stars
from 992 · score 3.00
34.Aegrah / PANIX
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
+19 stars
from 876 · score 3.00
35.mgeeky / ProtectMyTooling
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.
+16 stars
from 1,090 · score 2.83
36.hashcat / maskprocessor
High-Performance word generator with a per-position configureable charset
+11 stars
from 504 · score 2.48
37.khast3x / Redcloud
Automated Red Team Infrastructure deployement using Docker
+9 stars
from 1,271 · score 2.30
38.TryCatchHCF / DumpsterFire
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
+8 stars
from 1,036 · score 2.20
39.ReversecLabs / leonidas
Automated Attack Simulation in the Cloud, complete with detection use cases.
+8 stars
from 612 · score 2.20
40.pralab / secml_malware
Create adversarial attacks against machine learning Windows malware detectors
- adversarial-machine-learning
- infosec
- python
- attack
- machine-learning
- security
+7 stars
from 246 · score 2.08
41.uber-common / metta
An information security preparedness tool to do adversarial simulation.
- uber
- vagrant
- yaml
- celery
- python
- redis
- +7 more
+6 stars
from 1,142 · score 1.95
+4 stars
from 936 · score 1.61
43.Paradoxis / StegCrackerArchived
Steganography brute-force utility to uncover hidden data inside files
- steghide
- steganography
- ctf-tools
- ctf
- brute-force
- stegcracker
- +2 more
+4 stars
from 601 · score 1.61
44.jordanpotti / AWSBucketDump
Security Tool to Look For Interesting Files in S3 Buckets
- s3-bucket
- penetration-testing
- bugbounty
- enumeration
+3 stars
from 1,468 · score 1.39
45.LewisArdern / bXSS
bXSS is a utility which can be used by bug hunters and organizations to identify Blind Cross-Site Scripting.
- xss
- bxss
- security
- bugbounty
- blueteam
- cross-site-scripting
- +1 more
+3 stars
from 575 · score 1.39
+3 stars
from 497 · score 1.39
47.brannondorsey / dns-rebind-toolkit
A front-end JavaScript toolkit for creating DNS rebinding attacks.
+2 stars
from 502 · score 1.10
48.ctxis / crackerjack
CrackerJack / Hashcat Web Interface / Context Information Security
+2 stars
from 378 · score 1.10
49.gsmith257-cyber / GraphCrawlerArchived
GraphQL automated security testing toolkit
- api
- automated-testing
- cybersecurity
- graphql
- graphql-api
- pentesting
- +2 more
+2 stars
from 333 · score 1.10
50.brannondorsey / whonow
A "malicious" DNS server for executing DNS Rebinding attacks on the fly (public instance running on rebind.network:53)
- dns
- dns-rebinding
- hacking
- malicious-domains
- nodejs
- penetration-testing
- +2 more
+1 stars
from 657 · score 0.69