Ranked by Attention Score: stars gained over the last 90 complete days
1–100 of 103 by Attention Score · Aug 6, 2026 – Nov 3, 2026 (UTC)
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
ALL IN ONE Hacking Tool For Hackers
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Automated Penetration Testing Agentic Framework Powered by Large Language Models
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
World's fastest and most advanced password recovery utility
Automatic SQL injection and database takeover tool
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Adversary Emulation Framework
The ZAP by Checkmarx Core project
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
Web path scanner
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
Small and highly portable detection tests based on MITRE's ATT&CK.
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
hydra
An all-in-one hacking tool to remotely take over Android devices.
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
Automated Adversary Emulation Platform
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
The Rogue Access Point Framework
Wireless keystroke injection attack platform
CTF framework and exploit development library
📱 objection - runtime mobile exploration
Affordable WiFi hacking platform for testing and learning
fsociety Hacking Tools Pack – A Penetration Testing Framework
Most advanced XSS scanner.
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
Cameradar hacks its way into RTSP videosurveillance cameras
Common User Passwords Profiler (CUPP)
The Browser Exploitation Framework Project
Exploitation Framework for Embedded Devices
Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.
Automated Αll-in-One OS command injection exploitation tool.
(⌐■_■) - Deep Reinforcement Learning instrumenting bettercap for WiFi pwning.
Crack legacy zip encryption with Biham and Kocher's known plaintext attack.
The Leading Security Assessment Framework for Android.
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
Infection Monkey - An open-source adversary emulation platform
Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
This is a webshell open source project
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
Automated NoSQL database enumeration and web application exploitation tool.
UFONet - Denial of Service Toolkit
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
A python script that finds endpoints in JavaScript files
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
Server-Side Template Injection and Code Injection Detection and Exploitation Tool
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
Small utilities that are useful in advanced password cracking
Mentalist is a graphical tool for custom wordlist generation. It utilizes common human paradigms for constructing passwords and can output the full wordlist as well as rules compatible with Hashcat and John the Ripper.
A toolset to make a system look as if it was the victim of an APT attack
Hashtopolis - distributed password cracking with Hashcat
Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
Reverse Shell as a Service
PEDA - Python Exploit Development Assistance for GDB
Automated Security Testing For REST API's
w3af: web application attack and audit framework, the open source web vulnerability scanner.
A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
A tool for automating cracking methodologies through Hashcat from the TrustedSec team.
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
One rule to crack all passwords. or atleast we hope so.
Exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js.
🔗 Don't know what type of hash it is? Name That Hash will name that hash type! 🤖 Identify MD5, SHA256 and 300+ other hashes ☄ Comes with a neat web app 🔥
PowerSploit - A PowerShell Post-Exploitation Framework
RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact
P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W.
Rip web accessible (distributed) version control systems: SVN/GIT/HG...
Empire is a PowerShell and Python post-exploitation agent.
An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
The Offensive Manual Web Application Penetration Testing Framework.
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
XSS'OR - Hack with JavaScript.