Ranked by Attention Score: stars gained over the last 7 complete days
99 repositories by Attention Score · Oct 28, 2026 – Nov 3, 2026 (UTC)
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
ARTEX - AI autonomous penetration testing system (English translation)
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
ALL IN ONE Hacking Tool For Hackers
ARTEX 源码备份：基于 Autumn-27/ARTEX v0.3.15，保留原始提交历史与 AGPL-3.0 许可证。
The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
【全链哨兵】全流程渗透测试 Agent 系统，支持 Web、小程序、安卓 APP、IOS app(测试中)。安全服务渗透测试辅助工具，禁止用于非法攻击。
Local-only browser fingerprint & identity rotation toolkit for authorized security testing. Tor/obfs4, coherent profiles, WebRTC/DNS leak protection.
Automated Penetration Testing Agentic Framework Powered by Large Language Models
World's fastest and most advanced password recovery utility
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.
The ZAP by Checkmarx Core project
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
Adversary Emulation Framework
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
CTF framework and exploit development library
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
Automatic SQL injection and database takeover tool
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
hydra
Small and highly portable detection tests based on MITRE's ATT&CK.
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
Affordable WiFi hacking platform for testing and learning
Automated Adversary Emulation Platform
fsociety Hacking Tools Pack – A Penetration Testing Framework
Web path scanner
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
Common User Passwords Profiler (CUPP)
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
Open-source agentic security operations platform:
📱 objection - runtime mobile exploration
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
Cameradar hacks its way into RTSP videosurveillance cameras
An all-in-one hacking tool to remotely take over Android devices.
The Rogue Access Point Framework
The Browser Exploitation Framework Project
Wireless keystroke injection attack platform
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
Infection Monkey - An open-source adversary emulation platform
Exploitation Framework for Embedded Devices
(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
The Leading Security Assessment Framework for Android.
Content discovery and fuzzing with HTTP/3 support (100k requests per second)
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
Automated NoSQL database enumeration and web application exploitation tool.
UFONet - Denial of Service Toolkit
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
Hashtopolis - distributed password cracking with Hashcat
Small utilities that are useful in advanced password cracking
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
A toolset to make a system look as if it was the victim of an APT attack
Reverse Shell as a Service
A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.
Creates up to a thousand WiFi access points with custom SSIDs.
Most advanced XSS scanner.
Automated Αll-in-One OS command injection exploitation tool.
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
Automated Security Testing For REST API's
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
Rip web accessible (distributed) version control systems: SVN/GIT/HG...
The Offensive Manual Web Application Penetration Testing Framework.
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
SSH man-in-the-middle tool
TranslatedAn AI multi-agent security testing platform for authorized security testing and local research.