1.vxcontrol / pentagi
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
- ai-agents
- ai-security-tool
- autonomous-agents
- golang
- graphql
- multi-agent-system
- +12 more
+8,115 stars
from 25,074 · score 9.00
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
1–100 of 103 by Attention Score · Oct 5, 2026 – Nov 3, 2026 (UTC)
2.usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
- agents
- artificial-intelligence
- cybersecurity
- penetration-testing
- ai-penetration-testing
- ai-pentesting
- +14 more
+7,371 stars
from 66,222 · score 8.91
3.KeygraphHQ / shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
- penetration-testing
- pentesting
- security-audit
- security-automation
- security-tools
- ai-penetration-testing
- +14 more
+2,640 stars
from 48,442 · score 7.88
4.Z4nzu / hackingtool
ALL IN ONE Hacking Tool For Hackers
- allinonehackingtool
- web-attack
- password-attack
- hacking
- wireless-attack
- besthackingtool
- +7 more
+1,686 stars
from 79,959 · score 7.43
5.promptfoo / promptfoo
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
- llm
- prompt-engineering
- prompts
- llmops
- prompt-testing
- testing
- +12 more
+1,161 stars
from 25,640 · score 7.06
6.0x4m4 / hexstrike-ai
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
+1,014 stars
from 12,320 · score 6.92
7.cskwork / scopeweaver
ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.
+882 stars
from 0 · score 6.78
8.danielmiessler / SecLists
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
+666 stars
from 73,856 · score 6.50
9.GreyDGL / PentestGPT
Automated Penetration Testing Agentic Framework Powered by Large Language Models
+572 stars
from 15,683 · score 6.35
10.justcallmekoko / ESP32Marauder
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
+455 stars
from 12,537 · score 6.12
11.hashcat / hashcat
World's fastest and most advanced password recovery utility
+338 stars
from 26,912 · score 5.83
12.BishopFox / sliver
Adversary Emulation Framework
- security-tools
- implant
- golang
- dns-server
- http
- c2
- +9 more
+283 stars
from 11,943 · score 5.65
13.sqlmapproject / sqlmap
Automatic SQL injection and database takeover tool
- sql-injection
- detection
- exploitation
- python
- database
- pentesting
- +9 more
+278 stars
from 38,564 · score 5.63
14.MobSF / Mobile-Security-Framework-MobSF
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
- static-analysis
- dynamic-analysis
- mobsf
- android-security
- mobile-security
- windows-mobile-security
- +13 more
+271 stars
from 21,850 · score 5.61
+261 stars
from 39,045 · score 5.57
16.zaproxy / zaproxy
The ZAP by Checkmarx Core project
+246 stars
from 15,853 · score 5.51
17.Mr-Destroyer / ZimZilla
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
- ai-bug-bounty
- ai-bug-finder
- ai-bug-reporter
- ai-hacking
- bugbounty
- bughunting
- +14 more
+246 stars
from 0 · score 5.51
18.htr-tech / zphisher
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
- phishing
- phisher
- phishing-attacks
- htr-tech
- phishing-pages
- zphisher
+213 stars
from 16,919 · score 5.37
19.MatrixTM / MHDDoS
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
- ddos
- ddos-attacks
- ddos-tool
- attack
- cloudflare-bypass
- layer4
- +13 more
+192 stars
from 16,764 · score 5.26
20.apache / caldera
Automated Adversary Emulation Platform
- adversary-emulation
- caldera
- security-automation
- red-team
- mitre-attack
- security-testing
- +1 more
+187 stars
from 7,302 · score 5.24
21.LINGYK352 / Watchtower
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
- ai-agents
- attack-surface-management
- docker
- penetration-testing
- python
- security-assessment
- +4 more
+187 stars
from 1 · score 5.24
+186 stars
from 16,796 · score 5.23
23.1N3 / Sn1per
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
- sn1per
- sn1per-professional
- bugbounty-platform
- attack-surface
- cybersecurity
- pentest-tool
- +13 more
+179 stars
from 11,339 · score 5.19
24.peass-ng / PEASS-ng
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
+170 stars
from 20,586 · score 5.14
25.redcanaryco / atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
+167 stars
from 12,597 · score 5.12
26.kgretzky / evilginx2
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
+155 stars
from 15,669 · score 5.05
27.bettercap / bettercap
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
+154 stars
from 20,081 · score 5.04
28.openwall / john
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
- john
- c
- ripper
- password
- jtr
- opencl
- +10 more
+149 stars
from 13,713 · score 5.01
29.shadow1ng / fscan
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
- security-tools
- security
+142 stars
from 14,591 · score 4.96
30.vanhauser-thc / thc-hydra
hydra
- penetration-testing
- password-cracker
- network-security
- hydra
- thc
- pentesting
- +10 more
+140 stars
from 12,319 · score 4.95
31.maurosoria / dirsearch
Web path scanner
+133 stars
from 14,907 · score 4.90
32.bee-san / Ciphey
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
- artificial-intelligence
- ctf-tools
- +11 more
+105 stars
from 21,635 · score 4.66
33.AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.
- adb
- android
- android-debug-bridge
- cybersecurity
- exploit
- hacking
- +14 more
+104 stars
from 6,320 · score 4.65
+103 stars
from 14,275 · score 4.64
35.trustedsec / social-engineer-toolkit
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
+101 stars
from 15,329 · score 4.62
+99 stars
from 14,169 · score 4.61
37.SpacehuhnTech / esp8266_deauther
Affordable WiFi hacking platform for testing and learning
+87 stars
from 14,993 · score 4.48
38.Gallopsled / pwntools
CTF framework and exploit development library
+86 stars
from 13,738 · score 4.47
+83 stars
from 21,867 · score 4.43
40.Manisso / fsociety
fsociety Hacking Tools Pack – A Penetration Testing Framework
- fsociety
- exploitation
- port-scanning
- fsociety-hacking
- post-exploitation
- web-hacking
- +7 more
+74 stars
from 12,310 · score 4.32
41.wifiphisher / wifiphisher
The Rogue Access Point Framework
- wifiphisher
- wifi
- rogue
- access-point
- python
- security
- +4 more
+71 stars
from 14,866 · score 4.28
+69 stars
from 10,995 · score 4.25
43.sensepost / objection
📱 objection - runtime mobile exploration
+67 stars
from 9,414 · score 4.22
44.Mebus / cupp
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
- password-strength
- weak-passwords
+64 stars
from 6,554 · score 4.17
45.beefproject / beef
The Browser Exploitation Framework Project
+54 stars
from 11,031 · score 4.01
46.Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
- penetration-testing
- security
- hacking
- infosec
- rtsp
- cctv
- +5 more
+51 stars
from 5,236 · score 3.95
47.s0md3v / XSStrike
Most advanced XSS scanner.
- xss
- xss-scanner
- xss-exploit
- xss-bruteforce
- xss-python
- xss-detection
- +2 more
+49 stars
from 15,190 · score 3.91
48.RsaCtfTool / RsaCtfTool
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
- rsa-attack
- rsa
- cryptography
+48 stars
from 7,160 · score 3.89
49.ayoubfaouzi / al-khaser
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
- anti-analysis
- anti-debugging
- anti-sandbox
- anti-vm
- anti-emulation
- code-injection
- +5 more
+38 stars
from 7,137 · score 3.66
50.commixproject / commix
Automated Αll-in-One OS command injection exploitation tool.
- python
- command-injection
- detection
- exploitation
- pentesting
- vulnerability-scanner
- +4 more
+38 stars
from 5,860 · score 3.66
51.evilsocket / pwnagotchi
(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.
- ai
- deep-reinforcement-learning
- wpa-psk
- handshakes
- bettercap
- deep-learning
- +1 more
+36 stars
from 9,212 · score 3.61
52.threat9 / routersploit
Exploitation Framework for Embedded Devices
+35 stars
from 13,248 · score 3.58
+34 stars
from 12,497 · score 3.56
54.guardicore / monkey
Infection Monkey - An open-source adversary emulation platform
- penetration-testing
- security-tools
- security-automation
- infection-monkey
- adversary-emulation
+34 stars
from 7,088 · score 3.56
55.kimci86 / bkcrack
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
- crack
- zip
- multithread
- attack
- plaintext-attack
- ciphertext
- +5 more
+30 stars
from 2,207 · score 3.43
56.JonathanSalwan / ROPgadget
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
- reverse-engineering
- rop
- rop-exploitation
- rop-gadgets
- binary-exploitation
+26 stars
from 4,487 · score 3.30
57.m0nad / Diamorphine
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
- rootkit
- lkm-rootkit
- c
- kernel
- kernel-module
- security-tools
- +14 more
+26 stars
from 2,462 · score 3.30
58.ReversecLabs / drozer
The Leading Security Assessment Framework for Android.
- drozer
- android
- security
- pentesting
- java
- mobile
- +2 more
+25 stars
from 4,625 · score 3.26
59.ambionics / phpggc
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
+23 stars
from 3,893 · score 3.18
60.GerbenJavado / LinkFinder
A python script that finds endpoints in JavaScript files
- infosec
- endpoints
+21 stars
from 4,449 · score 3.09
+20 stars
from 10,604 · score 3.04
+20 stars
from 2,790 · score 3.04
63.fuzzdb-project / fuzzdb
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
+19 stars
from 8,990 · score 3.00
64.SpacehuhnTech / WiFiDuck
Wireless keystroke injection attack platform
+19 stars
from 3,320 · score 3.00
65.epsylon / ufonet
UFONet - Denial of Service Toolkit
- dos
- ddos
- ufonet
- botnet
- disruption
- cryptography
- +1 more
+18 stars
from 2,532 · score 2.94
66.pry0cc / axiom
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
- hacking-vps
- bug-bounty
- tmux
- axiom
- masscan
- gowitness
- +12 more
+17 stars
from 4,427 · score 2.89
+17 stars
from 3,970 · score 2.89
68.codingo / NoSQLMap
Automated NoSQL database enumeration and web application exploitation tool.
- nosql
- nosql-databases
- penetration-testing
- scanner
- security-audit
- security-tools
- +14 more
+17 stars
from 3,354 · score 2.89
69.ZerBea / hcxtools
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
- wlan
- wpa
- wpa2
- raspberry-pi
- hashcat
- handshake
- +8 more
+16 stars
from 2,453 · score 2.83
+15 stars
from 6,585 · score 2.77
+15 stars
from 2,595 · score 2.77
72.nil0x42 / phpsploit
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
- hacktool
- blackhat
- +12 more
+14 stars
from 2,491 · score 2.71
73.lanjelot / patator
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
- pentest
- brute-force
+13 stars
from 3,929 · score 2.64
74.lukechilds / reverse-shell
Reverse Shell as a Service
- reverse-shell
- exploit
- vulnerability
- pentesting
- microservice
- security
+13 stars
from 2,059 · score 2.64
75.hashtopolis / server
Hashtopolis - distributed password cracking with Hashcat
- cracking
- distributed
- hashcat
- pentesting
- passwords
- hashtopussy
- +8 more
+13 stars
from 1,814 · score 2.64
76.epinna / tplmap
Server-Side Template Injection and Code Injection Detection and Exploitation Tool
+12 stars
from 4,203 · score 2.56
+12 stars
from 3,534 · score 2.56
78.NextronSystems / APTSimulator
A toolset to make a system look as if it was the victim of an APT attack
+12 stars
from 2,775 · score 2.56
79.h3xduck / TripleCross
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
+11 stars
from 1,981 · score 2.48
80.tennc / webshell
This is a webshell open source project
- webshell
- webshell-sniper
- php
- jsp
- asp
- aspx
- +3 more
+10 stars
from 10,786 · score 2.40
81.longld / peda
PEDA - Python Exploit Development Assistance for GDB
+9 stars
from 6,152 · score 2.30
82.flipkart-incubator / Astra
Automated Security Testing For REST API's
- security
- restapiautomation
- python
- owasp
- penetration-testing-framework
- postman-collection
- +4 more
+9 stars
from 2,665 · score 2.30
83.sc0tfree / mentalist
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
- wordlist
- wordlist-generator
- password
- cracking
- cracking-hashes
- wordlist-technique
+9 stars
from 2,031 · score 2.30
84.hashcat / hashcat-utils
Small utilities that are useful in advanced password cracking
+9 stars
from 1,622 · score 2.30
+8 stars
from 2,136 · score 2.20
+7 stars
from 1,924 · score 2.08
87.doyensec / inql
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
- graphql
- security-scanner
- graphql-security
- api-documentation-tool
- security-tools
- security-audit
- +5 more
+6 stars
from 1,808 · score 1.95
88.NotSoSecure / password_cracking_rules
One rule to crack all passwords. or atleast we hope so.
+6 stars
from 1,639 · score 1.95
89.kost / dvcs-ripper
Rip web accessible (distributed) version control systems: SVN/GIT/HG...
+5 stars
from 1,786 · score 1.79
90.samyk / poisontap
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
+4 stars
from 6,478 · score 1.61
91.evilcos / xssor2
XSS'OR - Hack with JavaScript.
- probe
- pentest-tool
- xss
- csrf
- encoding
- hacking-tool
- +2 more
+4 stars
from 2,214 · score 1.61
92.GoSecure / pyrdp
RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
+4 stars
from 1,784 · score 1.61
93.bee-san / Name-That-Hash
🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥
+4 stars
from 1,669 · score 1.61
94.RoganDawes / P4wnP1
P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.
+3 stars
from 4,383 · score 1.39
+3 stars
from 1,898 · score 1.39
96.0xInfection / TIDoS-Framework
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
- web-fuzzer
- osint
- +7 more
+3 stars
from 1,866 · score 1.39
97.andresriancho / w3af
w3af: web application attack and audit framework, the open source web vulnerability scanner.
+2 stars
from 4,908 · score 1.10
98.SpiderLabs / ResponderArchived
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
+2 stars
from 4,888 · score 1.10
99.jtesta / ssh-mitmArchived
SSH man-in-the-middle tool
- penetration-testing
- ssh
- mitm
- man-in-the-middle
- man-in-the-middle-attack
- hacking
+2 stars
from 1,739 · score 1.10
100.byt3bl33d3r / SILENTTRINITYArchived
An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
- security-tools
- c-sharp
- dotnet
- ironpython
- python3
- red-teams
- +4 more
+1 stars
from 2,346 · score 0.69