Ranked by Attention Score: stars gained over the last 180 complete days
1–100 of 126 by Attention Score · May 8, 2026 – Nov 3, 2026 (UTC)
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
ALL IN ONE Hacking Tool For Hackers
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Automated Penetration Testing Agentic Framework Powered by Large Language Models
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
Automatic SQL injection and database takeover tool
World's fastest and most advanced password recovery utility
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
Adversary Emulation Framework
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
The ZAP by Checkmarx Core project
Small and highly portable detection tests based on MITRE's ATT&CK.
Web path scanner
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
hydra
Common User Passwords Profiler (CUPP)
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
An all-in-one hacking tool to remotely take over Android devices.
Automated Adversary Emulation Platform
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
Wireless keystroke injection attack platform
📱 objection - runtime mobile exploration
CTF framework and exploit development library
fsociety Hacking Tools Pack – A Penetration Testing Framework
The Rogue Access Point Framework
Affordable WiFi hacking platform for testing and learning
Most advanced XSS scanner.
Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
Cameradar hacks its way into RTSP videosurveillance cameras
The Browser Exploitation Framework Project
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
Exploitation Framework for Embedded Devices
(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.
Automated Αll-in-One OS command injection exploitation tool.
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
PowerSploit - A PowerShell Post-Exploitation Framework
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
The Leading Security Assessment Framework for Android.
Infection Monkey - An open-source adversary emulation platform
A python script that finds endpoints in JavaScript files
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
This is a webshell open source project
Automated NoSQL database enumeration and web application exploitation tool.
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
UFONet - Denial of Service Toolkit
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
Creates up to a thousand WiFi access points with custom SSIDs.
Hashtopolis - distributed password cracking with Hashcat
Server-Side Template Injection and Code Injection Detection and Exploitation Tool
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.
w3af: web application attack and audit framework, the open source web vulnerability scanner.
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
PEDA - Python Exploit Development Assistance for GDB
A toolset to make a system look as if it was the victim of an APT attack
Small utilities that are useful in advanced password cracking
Empire is a PowerShell and Python post-exploitation agent.
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
A tool for automating cracking methodologies through Hashcat from the TrustedSec team.
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
Automated Security Testing For REST API's
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Generate smart and powerful wordlists
Crack password hashes without the fuss :cat2:
Reverse Shell as a Service
SIPVicious OSS is a VoIP security testing toolset. It helps security teams, QA and developers test SIP-based VoIP systems and applications. This toolset is useful in simulating VoIP hacking attacks against PBX systems especially through identification, scanning, extension enumeration and password cracking.
Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.