Penetration-testing projects on GitHub

1. 1
   #1 · trimstray/the-book-of-secret-knowledge

   the-book-of-secret-knowledge

   A massive curated collection of lists, manuals, cheatsheets, blogs, hacks, one-liners and CLI/GUI/web tools that the author gathers from everyday sysadmin, DevOps and security work.

   250.7K
2. 2
   #2 · Hack-with-Github/Awesome-Hacking

   Awesome-Hacking

   A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.

   122.8K
3. 3
   #3 · swisskyrepo/PayloadsAllTheThings

   PayloadsAllTheThings

   A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

   81.8K

4. 4

   SecLists

   74.2Kdanielmiessler/SecLists · PHP

   SecLists is a huge collection of ready-made wordlists for security testing: usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells and more, all gathered in one repository.

   • wordlist
   • patterns
   • password
   • hacking-tools
5. 5

   strix

   69.1Kusestrix/strix · Python

   Strix is an open-source tool that uses autonomous AI agents to pentest your application like real hackers: it runs your code dynamically, finds vulnerabilities, and proves them with working exploits instead of just flagging suspicious patterns.

   • ai-hacking
   • ctf-tools
   • ai-penetration-testing
   • pentesting-tools
6. 6

   x64dbg

   49.9Kx64dbg/x64dbg · C++

   x64dbg is an open-source user-mode debugger for Windows, built specifically for reverse engineering and malware analysis.

   • dynamic-analysis
   • x64
   • exploit-development
   • disassembler
7. 7

   shannon

   49KKeygraphHQ/shannon · TypeScript

   Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

   • ai-penetration-testing
   • sarif
   • security-testing
   • pentesting-tools
8. 8

   mitmproxy

   45.7Kmitmproxy/mitmproxy · Python

   mitmproxy is an interactive, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, and WebSockets, used by penetration testers and developers to inspect and modify traffic. mitmdump is its CLI version, and mitmweb is a web-based interface.

   • http2
   • ssl
   • pentesting
   • tls
9. 9

   reverse-skill

   42.4Kzhaoxuya520/reverse-skill · PowerShell

   It is a skill pack that routes AI coding agents to the right reverse engineering, penetration testing, and security research methodology for a given task (APK, binary, JS, CTF, malware, etc.), checks which tools are installed, and runs a repeatable workflow instead of letting the agent guess commands.

   • malware-analysis
   • ctf
   • binary-analysis
   • powershell
10. 10

    metasploit-framework

    39.2Krapid7/metasploit-framework · Ruby

    Metasploit Framework is an open-source penetration testing framework written in Ruby — one of the best-known security toolkits on GitHub, with about 39,000 stars.

    • kali-linux
    • exploitation
    • api-documentation
    • infosec
11. 11

    sqlmap

    38.7Ksqlmapproject/sqlmap · Python

    sqlmap is an open-source penetration testing tool that automates detecting and exploiting SQL injection flaws and taking over the underlying database server.

    • sql-injection
    • security-testing
    • detection
    • exploitation
12. 12

    Anthropic-Cybersecurity-Skills

    34.6Kmukul975/Anthropic-Cybersecurity-Skills · Python

    An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

    • container-security
    • threat-hunting
    • cloud-security
    • vulnerability-management
13. 13

    CheatSheetSeries

    33.7KOWASP/CheatSheetSeries · JavaScript

    A collection of concise, high-value cheat sheets covering specific application security topics, maintained by OWASP.

    • cheatsheets
    • code
    • appsec
    • owasp
14. 14

    nuclei

    32.1Kprojectdiscovery/nuclei · Go

    A fast, open-source vulnerability scanner that runs YAML-based templates to find security issues in applications, APIs, networks, DNS and cloud configurations. Its checks come from a large global security community.

    • security-scanner
    • vulnerability-detection
    • cve
    • appsec
15. 15

    How-To-Secure-A-Linux-Server

    31.8Kimthenachoman/How-To-Secure-A-Linux-Server

    This is a long-form, evolving how-to guide (written as a GitHub README) that walks you through hardening a self-hosted Linux server, step by step, from SSH to firewalls to intrusion detection.

    • security-hardening
    • hardening
    • checklist
    • firewall
16. 16

    pentagi

    30.8Kvxcontrol/pentagi · Go

    PentAGI (Penetration testing Artificial General Intelligence) is a fully autonomous AI agent system that performs complex penetration testing tasks for you.

    • penetration-testing-tools
    • ai-security-tool
    • security-testing
    • security-automation
17. 17

    h4cker

    29.8KThe-Art-of-Hacking/h4cker · Jupyter Notebook

    A curated collection of thousands of cybersecurity resources — references, scripts, tools, code, labs, and training material — maintained by Omar Santos as a companion to his books, video courses, and live training.

    • cloud-security
    • vulnerability-management
    • vulnerability-research
    • certification
18. 18

    trufflehog

    28.5Ktrufflesecurity/trufflehog · Go

    TruffleHog is a CLI tool that discovers, classifies, validates, and analyzes leaked secrets like API keys, database passwords, and private keys across many sources (Git, GitHub, S3, Docker, Slack, filesystems, and more).

    • dynamic-analysis
    • scanning
    • credentials
    • secret-management
19. 19

    awesome-pentest

    27.4Kenaqx/awesome-pentest

    A curated collection of penetration testing and offensive-security resources: tools, books, courses, conferences and practice targets for authorized security testing.

    • password-cracking
    • wifi-security
    • privilege-escalation
    • ethical-hacking
20. 20

    hashcat

    27Khashcat/hashcat · C

    hashcat is a highly optimized password recovery platform: you feed it password hashes and it recovers the passwords behind them, billed as the world's fastest password cracker.

    • gpgpu
    • password-cracking
    • opencl
    • cracking
21. 21

    masscan

    26.1Krobertdavidgraham/masscan · C

    Masscan is an Internet-scale TCP port scanner that transmits SYN packets asynchronously and can scan the entire IPv4 Internet in under 5 minutes, sending up to 10 million packets per second from a single machine.

    • scanner
    • reconnaissance
    • vulnerability-scanner
    • infosec
22. 22

    social-analyzer

    24.3Kqeeqbox/social-analyzer · JavaScript

    Social-Analyzer is an OSINT tool that searches and correlates a person's profile across roughly 1000 social media sites and websites, available as a CLI, an API, and a web app.

    • analyzer
    • analysis
    • information-gathering
    • pentest
23. 23

    unleashed-firmware

    22.5KDarkFlippers/unleashed-firmware · C

    Unleashed is custom firmware for the Flipper Zero multitool — a fork of the official firmware (OFW) that adds extra features and improvements while staying compatible with official apps.

    • flipperzero
    • unofficial
    • bruteforce
    • wireless
24. 24

    vulhub

    21.4Kvulhub/vulhub · Dockerfile

    Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments: with one command you get a working lab for security research, learning, or demos.

    • dockerfile
    • security-research
    • vulnerability
    • exploit
25. 25

    PEASS-ng

    20.7Kpeass-ng/PEASS-ng · C#

    PEASS-ng is a suite of local privilege escalation enumeration tools: LinPEAS for Linux/Unix/macOS and WinPEAS for Windows. They scan a machine for privesc paths and print misconfigurations with nice colors so you can spot them easily.

    • color
    • redteam
    • infosec
    • script
26. 26

    90DaysOfCyberSecurity

    20.1Kfarhanashrafdev/90DaysOfCyberSecurity

    A free, 90-day self-paced cybersecurity study plan: daily tasks and curated resources that take you from networking basics to ethical hacking, ending with job-hunting help.

    • learn
    • ethical-hacking
    • resume
    • roadmap
27. 27

    Micro8

    18KMicropoor/Micro8

    A free, open-source series of penetration-testing lessons written by veteran Chinese pentester Micropoor and published as a GitBook. It covers code audit, web, intranet and domain penetration, tunneling, and log-based tracing.

    • exploitation
    • information-gathering
    • pentest
    • redteam
28. 28

    Awesome-Hacking-Resources

    17.5Kvitalysim/Awesome-Hacking-Resources

    A curated collection of hacking, penetration testing and AI red-teaming resources — courses, YouTube channels, CTF platforms and guides, picked to make you better at offensive security.

    • kali-linux
    • exploit-development
    • privilege-escalation
    • owasp
29. 29

    awesome-hacking

    17.3Kcarpedm20/awesome-hacking

    A curated list of hacking tutorials, tools and resources covering system exploitation, reverse engineering, web security, network security, forensics, cryptography and wargames.

    • hacking-tools
    • forensics
    • ctf
    • network-security
30. 30

    zphisher

    17Khtr-tech/zphisher · HTML

    Zphisher is an automated phishing tool with 30+ ready-made login-page templates, written as a beginners-friendly shell script and intended purely for education.

    • phishing
    • termux
    • tunnel
    • hacking-tool
31. 31

    ffuf

    16.9Kffuf/ffuf · Go

    ffuf is a fast web fuzzer written in Go — a command-line tool that sends many crafted requests to a target to discover directories, virtual hosts, and fuzzable GET/POST parameters.

    • bugbounty
    • scanner
    • web-security
    • reconnaissance
32. 32

    MHDDoS

    16.9KMatrixTM/MHDDoS · Python

    MHDDoS is a Python 3 DDoS testing toolkit with 57 attack methods spanning Layer 7 (HTTP floods, Cloudflare/OVH bypasses) and Layer 4/3 (TCP, UDP, SYN, amplification attacks), meant for authorized security testing and research.

    • cloudflare-bypass
    • bypass
    • vps
    • hacking-tool
33. 33

    lynis

    16.5KCISOfy/lynis · Shell

    Lynis is a security auditing and hardening tool for Linux, macOS, BSD, and other Unix-like systems. It scans the host it runs on for vulnerable software, misconfigurations, and weak settings, and gives hardening tips while also assisting with compliance testing (HIPAA, ISO27001, PCI DSS).

    • pci-dss
    • security-hardening
    • gdpr
    • hardening
34. 34

    impacket

    16.2Kfortra/impacket · Python

    Impacket is a collection of Python classes for working with network protocols, giving low-level programmatic access to packets and, for some protocols like SMB1-3 and MSRPC, full protocol implementations.

    • network-programming
    • network
    • protocol
    • red-team
35. 35

    PentestGPT

    16KGreyDGL/PentestGPT · Python

    PentestGPT is an agentic framework that uses large language models to run automated penetration testing and solve CTF challenges, working through staged phases like recon, exploitation and reporting.

    • ctf
    • hacking-tool
    • offensive-security
    • red-team
36. 36

    zaproxy

    16Kzaproxy/zaproxy · Java

    ZAP (Zed Attack Proxy) by Checkmarx is the world's most widely used web app security scanner, used to automatically find vulnerabilities in web applications during development and testing.

    • security-scanner
    • appsec
    • opensource
    • vulnerability-scanner
37. 37

    evilginx2

    15.7Kkgretzky/evilginx2 · Go

    Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which lets an attacker bypass 2-factor authentication.

    • credentials
    • phishing
    • two-factor-authentication
    • session
38. 38

    hacker-roadmap

    15.7Ksundowndev/hacker-roadmap

    This is a curated roadmap and toolkit index for learning and practicing ethical hacking: it explains what penetration testing is and groups hundreds of security tools, wordlists and references by category (recon, password attacks, wireless, exploitation, web hacking, post-exploitation, frameworks).

    • wordlist
    • password-cracking
    • post-exploitation
    • wireless
39. 39

    social-engineer-toolkit

    15.4Ktrustedsec/social-engineer-toolkit · Python

    The Social-Engineer Toolkit (SET) is an open-source penetration testing framework for authorized social-engineering assessments, giving security teams guided attack vectors to test user awareness and validate controls.

    • pentesting-tools
    • ethical-hacking
    • pentest
    • exploit
40. 40

    amass

    15.4Kowasp-amass/amass · Go

    Amass is an OWASP project that maps attack surfaces and discovers external assets (like subdomains, IPs, and infrastructure) using open source intelligence gathering and active reconnaissance.

    • subdomain
    • recon
    • owasp
    • information-gathering
41. 41

    XSStrike

    15.2Ks0md3v/XSStrike · Python

    XSStrike is a Cross Site Scripting (XSS) detection suite built around four hand-written parsers, an intelligent payload generator, a fuzzing engine, and a fast crawler. Instead of just firing generic payloads like most scanners, it analyzes the live response and crafts payloads guaranteed to work through context analysis.

    • web-application-firewall
    • xss
    • web-security
    • vulnerability-scanner
42. 42

    Osintgram

    15.1KDatalux/Osintgram · Python

    Osintgram is an OSINT tool for Instagram that lets you collect, analyze, and run reconnaissance on any public Instagram account via an interactive shell, just by giving its nickname.

    • osint-python
    • instagram
    • analysis
    • information-gathering
43. 43

    prowler

    15Kprowler-cloud/prowler · Python

    Prowler is an open-source cloud security platform that automates security and compliance checks across AWS, Azure, GCP, Kubernetes, M365, GitHub, and many other providers.

    • multi-cloud
    • security-hardening
    • gdpr
    • hardening
44. 44

    esp8266_deauther

    15KSpacehuhnTech/esp8266_deauther · C

    ESP8266 Deauther is open-source firmware for the ESP8266 chip that lets you scan nearby WiFi networks, send deauthentication packets to disconnect devices, and spin up dozens of fake WiFi networks to confuse scanners - an affordable platform for testing and learning about WiFi security.

    • esp8266
    • scanning
    • hack
    • wifi-security
45. 45

    dirsearch

    15Kmaurosoria/dirsearch · Python

    Dirsearch is an advanced command-line web path brute-forcer used to discover hidden files and directories on websites for security testing.

    • wordlist
    • pentest-tool
    • appsec
    • bugbounty
46. 46

    fscan

    14.7Kshadow1ng/fscan · Go

    fscan is an open-source intranet scanner written in Go: one command runs an all-round internal-network audit — host discovery, port scanning, service identification, weak-password brute force and vulnerability detection.

    • scanning
    • bruteforce
    • scanner
    • pentest
47. 47

    subfinder

    14.6Kprojectdiscovery/subfinder · Go

    Subfinder is a fast passive subdomain enumeration tool that returns valid subdomains for a website by querying passive online sources, built for penetration testers and bug bounty hunters.

    • subdomain-enumeration
    • bugbounty
    • reconnaissance
    • osint
48. 48

    gophish

    14.3Kgophish/gophish · Go

    Gophish is an open-source phishing toolkit for businesses and penetration testers: it lets you quickly set up and run phishing engagements and security awareness training campaigns.

    • phishing
    • red-team
    • pentesting
    • email
49. 49

    PENTESTING-BIBLE

    14KblaCCkHatHacEEkr/PENTESTING-BIBLE

    A curated catalog of over 200 numbered links to pentesting articles, bug bounty write-ups, cheat sheets and other security lists — a reading collection, not software.

    • recon
    • privilege-escalation
    • bug-bounty
    • pentest
50. 50

    awesome-web-security

    13.9Kqazbnm456/awesome-web-security · Python

    A curated list of web security materials and resources, organized by vulnerability class and attack type (XSS, SQL injection, CSRF, SSRF, XXE, deserialization, OAuth, JWT, and more), plus cheatsheets, tools, and write-ups for penetration testing.

    • waf
    • recon
    • appsec
    • information-gathering
51. 51

    DVWA

    13.9Kdigininja/DVWA · PHP

    DVWA (Damn Vulnerable Web Application) is a PHP/MariaDB web app that is deliberately full of security bugs, built as a legal practice target for security pros, students, and developers to learn web application security.

    • sql-injection
    • application-security
    • web-security
    • vulnerability-scanner
52. 52

    routersploit

    13.3Kthreat9/routersploit · Python

    RouterSploit is an open-source exploitation framework built specifically for testing the security of embedded devices like routers.

    • bruteforce
    • credentials
    • scanner
    • router
53. 53

    mastg

    13.3KOWASP/mastg · Python

    A comprehensive OWASP manual for mobile app security testing and reverse engineering. It gives technical processes for verifying the weaknesses listed in the OWASP Mobile Security Weakness Enumeration (MASWE).

    • dynamic-analysis
    • android-application
    • network-analysis
    • checklist
54. 54

    nuclei-templates

    13.1Kprojectdiscovery/nuclei-templates · JavaScript

    This is a community-curated collection of over 11,000 detection templates for the Nuclei vulnerability scanner, covering CVEs, misconfigurations, exposed panels, and other security issues.

    • vulnerability-detection
    • cve
    • fingerprint
    • exploit-development
55. 55

    PowerSploit

    13.1KPowerShellMafia/PowerSploit · PowerShell

    PowerSploit is a collection of PowerShell modules that penetration testers use during all phases of an assessment, covering code execution, persistence, privilege escalation, credential theft, exfiltration and reconnaissance on Windows systems.

    • persistence
    • credentials
    • post-exploitation
    • encoding
56. 56

    ESP32Marauder

    12.8Kjustcallmekoko/ESP32Marauder · C++

    ESP32 Marauder is a suite of offensive and defensive WiFi and Bluetooth tools that run as firmware on an ESP32 microcontroller, used for things like wardriving, scanning, and wireless security testing.

    • flipperzero
    • esp32-s3
    • arduino
    • scanner
57. 57

    atomic-red-team

    12.7Kredcanaryco/atomic-red-team · C

    Atomic Red Team is a library of small, portable security tests, each mapped to a specific MITRE ATT&CK technique, that security teams run to check whether their defenses actually detect real attacker behavior.

    • mitre-attack
    • offensive-security
    • red-team
    • ruby
58. 58

    wifi-cracking

    12.7Kbrannondorsey/wifi-cracking

    A step-by-step tutorial for cracking WPA/WPA2 Wi-Fi passwords: capture a handshake with Airodump-ng, then crack it offline with Aircrack-ng or Hashcat.

    • password-cracking
    • wireless
    • wifi-security
    • cracking
59. 59

    scapy

    12.6Ksecdev/scapy · Python

    Scapy is a Python-based interactive packet manipulation program and library that lets you forge, decode, send, capture, and analyze network packets.

    • packet-capture
    • network-analysis
    • network
    • network-security
60. 60

    hacktricks

    12.6KHackTricks-wiki/hacktricks · JavaScript

    A free, open wiki of hacking tricks and techniques — everything the author has learnt from CTFs, real-world apps and security research, organized into a browsable reference with 12.5k+ GitHub stars.

    • pentesting-tools
    • exploitation
    • recon
    • privilege-escalation
61. 61

    hetty

    12.5Kdstotijn/hetty · Go

    Hetty is an HTTP toolkit for security research, aiming to be an open source alternative to commercial tools like Burp Suite Pro, aimed at the infosec and bug bounty community.

    • bugbounty
    • mitm
    • infosec
    • pentesting
62. 62

    thc-hydra

    12.4Kvanhauser-thc/thc-hydra · C

    Hydra is a parallelized network login cracker by van Hauser / THC: a proof-of-concept tool showing researchers and security consultants how easily a remote system can be broken into through weak passwords. It supports over 50 protocols.

    • brute-force
    • bruteforce
    • password-cracking
    • pentest-tool
63. 63

    OSINT-Framework

    12.3Klockfale/OSINT-Framework · JavaScript

    OSINT Framework is a curated, browsable index of free OSINT (open-source intelligence) tools and resources, organized into a clickable category tree so you can find the right tool for a given task.

    • osint-framework
    • threat-intelligence
    • directory
    • reconnaissance
64. 64

    Resources-for-Beginner-Bug-Bounty-Hunters

    12.3Knahamsec/Resources-for-Beginner-Bug-Bounty-Hunters

    A curated collection of resources for people getting started with web hacking and bug bounty hunting, including blog posts, talks, books, tools, labs and vulnerability-type guides.

    • xss
    • mobile-security
    • hacking-tools
    • bugbounty
65. 65

    sliver

    12.1KBishopFox/sliver · Go

    Sliver is an open source cross-platform adversary emulation and red team framework that organizations of any size can use to perform security testing.

    • adversarial-attacks
    • command-and-control
    • dns-server
    • red-teaming
66. 66

    awesome-ctf

    11.9Kapsdehal/awesome-ctf · JavaScript

    A curated list of frameworks, libraries, tools, and resources for Capture The Flag (CTF) competitions, covering everything from building challenges to solving them.

    • ctf-tools
    • forensics
    • ctf
    • exploit
67. 67

    xray

    11.8Kchaitin/xray · Vue

    xray is a security assessment tool built by Chaitin for scanning common web vulnerabilities and running custom PoCs against targets.

    • brute-force
    • sql-injection
    • fingerprinting
    • poc
68. 68

    TheFatRat

    11.5Kscreetsec/TheFatRat · C

    TheFatRat is an exploiting tool that compiles malware from famous payloads — an easy way to generate backdoors built to slip past most anti-virus software.

    • post-exploitation
    • kali-linux
    • remote
    • malware
69. 69

    Sn1per

    11.5K1N3/Sn1per · Shell

    Sn1per is an offensive-security platform that bundles reconnaissance, vulnerability scanning, exploitation and reporting into one workspace, orchestrating 600+ exploits and 90+ third-party tools for pentesters and attack-surface-management teams.

    • osint-framework
    • pentest-tool
    • pentesting-tools
    • osint-tool
70. 70

    404StarLink

    11.4Kknownsec/404StarLink

    404StarLink is a curated list of security-focused open-source projects maintained by Knownsec 404 Lab, created to showcase, support, and track high-quality, actively-maintained security tools.

    • hacking-tools
    • web-security
    • opensource
    • reconnaissance
71. 71

    awesome-hacker-search-engines

    11.3Kedoardottt/awesome-hacker-search-engines · Shell

    A curated list of search engines useful for penetration testing, vulnerability assessment, red/blue team operations, bug bounty hunting, and general OSINT work.

    • redteaming
    • vulnerabilities
    • osint-tool
    • cve
72. 72

    beef

    11.1Kbeefproject/beef · JavaScript

    BeEF (Browser Exploitation Framework) is a penetration testing tool that focuses on the web browser, letting a tester assess the real security posture of a target by using client-side attack vectors instead of network-perimeter exploits.

    • context
    • exploitation
    • pentest
    • website
73. 73

    webshell

    10.8Ktennc/webshell · PHP

    It's a community collection of webshells - scripts that give you control of a web server once uploaded - covering all the common server-side languages and maintained by tennc with 10k+ stars.

    • waf
    • perl
    • hacking-tools
    • anti-detection
74. 74

    Red-Teaming-Toolkit

    10.8Kinfosecn1nja/Red-Teaming-Toolkit

    It is a curated list of cutting-edge open-source security tools for red teamers and threat hunters, covering the full attack lifecycle from reconnaissance to exfiltration.

    • command-and-control
    • credentials
    • phishing
    • privilege-escalation
75. 75

    nikto

    10.8Ksullo/nikto · Perl

    Nikto is an open-source web server scanner that checks servers for dangerous files, outdated software versions, and other common vulnerabilities.

    • perl
    • scanner
    • redteam
    • web-security
76. 76

    bbot

    10.7Kblacklanternsecurity/bbot · Python

    BBOT is a recursive internet scanner for hackers — it automates recon, bug bounty work and attack surface management (ASM), inspired by Spiderfoot.

    • subdomain-enumeration
    • osint-framework
    • bruteforce
    • recon
77. 77

    BloodHound-Legacy

    10.6KSpecterOps/BloodHound-Legacy · PowerShell

    BloodHound Legacy is a security tool that uses graph theory to map hidden relationships and attack paths inside an Active Directory environment, helping find the shortest route to Domain Admin — hence its tagline 'Six Degrees of Domain Admin'.

    • neo4j
    • graph-database
    • reconnaissance
    • graph
78. 78

    codeql

    10.2Kgithub/codeql · CodeQL

    This is the standard library and query collection for CodeQL, the code analysis engine that powers GitHub Advanced Security code scanning and GitHub's commercial security products.

    • application-security
    • code-analysis
    • devsecops
    • vulnerability-scanner
79. 79

    nishang

    10.2Ksamratashok/nishang · PowerShell

    Nishang is a framework and large collection of PowerShell scripts and payloads for offensive security, penetration testing, and red teaming, covering every phase of an engagement.

    • malware
    • redteam
    • infosec
    • exploit
80. 80

    OneForAll

    10.1Kshmilylty/OneForAll · Python

    OneForAll is a powerful subdomain collection tool: point it at a target domain and it gathers subdomains from many sources — a core reconnaissance step in penetration testing, which is why the author built it.

    • brute-force
    • subdomain-enumeration
    • subdomain
    • pentest-tool
81. 81

    flowsint

    9.8Kreconurge/flowsint · TypeScript

    Flowsint is an open-source, graph-based OSINT investigation tool that lets analysts explore relationships between people, domains, IPs, organizations and more through a visual graph interface with automated enrichers.

    • investigation
    • recon
    • neo4j
    • graph-database
82. 82

    Cybersecurity-Projects

    8.3KCarterPerez-dev/Cybersecurity-Projects · Go

    This is a growing collection of 70 hands-on cybersecurity projects with full source code, organized into four difficulty tiers, plus 10 certification roadmaps and curated learning resources for cybersecurity careers.

    • certification
    • malware
    • red-team
    • agplv3
83. 83

    android-reverse-engineering-skill

    8.2KSimoneAvogadro/android-reverse-engineering-skill · Shell

    A Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs used by the app — Retrofit endpoints, OkHttp calls, hardcoded URLs, and authentication patterns — so you can document and reproduce them without the original source code.

    • mobile-security
    • decompiler
    • static-analysis
    • hacking
84. 84

    CyberStrikeAI

    7.8KAIPentest/CyberStrikeAI · Go

    CyberStrikeAI is an AI-native cybersecurity platform that turns natural-language intent into governed, auditable security operations, using agents, 100+ security tools, MCP integration, and attack-chain tracking for authorized penetration testing.

    • ai-hacking
    • ctf-tools
    • ai-penetration-testing
    • ai-security-tool
85. 85

    defending-code-reference-harness

    7.6Kanthropics/defending-code-reference-harness · Python

    A reference implementation from Anthropic for finding and fixing vulnerabilities with Claude: a set of Claude Code skills (quickstart, threat-model, vuln-scan, triage, patch, customize) plus an autonomous scanning harness that runs a recon-find-verify-report-patch loop, built from learnings partnering with security teams.

    • security-automation
    • incident-response
    • fuzzing
    • devsecops
86. 86

    Claude-Red

    7.6KSnailSploit/Claude-Red · Python

    claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.

    • vulnerability-research
    • phishing
    • post-exploitation
    • pentesting-tools
87. 87

    ProxyBridge

    6.8KInterceptSuite/ProxyBridge · C

    ProxyBridge is a cross-platform proxy client that transparently redirects TCP and UDP traffic from specific Windows/macOS/Linux applications through SOCKS5 or HTTP proxies, acting as an open-source alternative to Proxifier.

    • http3
    • udp
    • http-proxy
    • proxy-server
88. 88

    Decepticon

    6.2KBitterSecurity/Decepticon · Python

    Decepticon is a professional autonomous Red Team agent that runs full attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and C2 — the way a real adversary would, instead of just scanning and printing a report.

    • ai-penetration-testing
    • command-and-control
    • kali-linux
    • mitre-attack
89. 89

    Agentic-Bug-Hunter

    5.4Kawarexone/Agentic-Bug-Hunter · Python

    Agentic Bug Hunter is an AI-powered bug bounty toolkit that runs recon, tests for vulnerabilities, validates findings against a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, or Immunefi, right from your terminal.

    • recon
    • bug-bounty
    • claude-ai
    • ethical-hacking
90. 90

    exploitarium

    5.2Kbikini/exploitarium · Python

    Exploitarium is a single consolidated archive of the author's public proof-of-concept exploits and vulnerability research writeups, merging dozens of their former standalone PoC repos into one place.

    • cve
    • exploit-development
    • fuzzing
    • ethical-hacking
91. 91

    Claude-BugHunter

    5.1Kelementalsouls/Claude-BugHunter · Python

    A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.

    • bugbounty
    • bug-bounty
    • application-security
    • ethical-hacking
92. 92

    ARTEX

    4.4Kmhtsec/ARTEX · Go

    ARTEX is an AI-driven autonomous penetration testing system with a Go backend (embedding a Next.js frontend) where LLM-powered agents plan and execute security testing against assets. It won first place in Baidu's 'Agent+' attack-defense challenge.

    • mitm
    • sse
    • vulnerability
    • jwt
93. 93

    airgorah

    4.2Kmartin-olivier/airgorah · Rust

    Airgorah is a WiFi security auditing tool written in Rust that captures nearby WiFi traffic, discovers clients connected to access points, performs deauthentication attacks, captures handshakes and PMKIDs, and cracks access point passwords.

    • password-cracking
    • wireless
    • gtk4
    • wifi-security
94. 94

    METATRON

    4.2Ksooryathejas/METATRON · Python

    Metatron is a CLI-based AI penetration testing assistant that runs real recon tools against a target and lets a locally-hosted LLM analyze the results, suggest exploits, and recommend fixes, with no cloud or API keys involved.

    • mariadb
    • reconnaissance
    • vulnerability
    • local-ai
95. 95

    anything-analyzer

    3.8KMouseww/anything-analyzer · TypeScript

    Anything Analyzer is an all-in-one traffic capture and protocol analysis toolkit: it captures HTTP/HTTPS traffic from a browser, desktop apps, terminal commands, scripts, mobile devices, and IoT devices into one session, then uses an LLM to automatically reverse-engineer and explain the protocol.

    • network-analysis
    • automation-tools
    • ai-tools
    • node
96. 96

    redamon

    3.1Ksamugit83/redamon · Python

    RedAmon is an open-source, self-hosted AI framework that chains reconnaissance, exploitation and post-exploitation into one pipeline, maps the attack surface into a Neo4j graph, and then triages findings and opens GitHub pull requests that fix what it discovers.

    • penetration-testing-tools
    • kali-linux
    • exploitation
    • neo4j
97. 97

    Pentest-Swarm-AI

    3KArmur-Ai/Pentest-Swarm-AI · Go

    Pentest Swarm AI is an open-source, self-hosted penetration testing tool where dozens of AI agents work as a swarm to recon, classify, exploit, and report vulnerabilities in APIs and web apps — not just scan for them.

    • penetration-testing-tools
    • swarm-intelligence
    • bug-bounty
    • ctf
98. 98

    dsh-infinite-gen-5

    3KMinglink/dsh-infinite-gen-5 · JavaScript

    This is a system-prompt injection plugin for the DeepSeek Harness (dsh) ecosystem that tries to bypass DeepSeek-V4.1 Flash's safety guardrails, framed as a red-team robustness benchmark suite for studying model defenses.

    • system-prompt
    • prompt-injection
    • red-teaming
    • llm-security
99. 99

    wifit3

    2.4Kderv82/wifit3 · Python

    wifit3 is a standalone Wi-Fi security auditing tool that scans networks, captures WPA/WPA2 handshakes, and exploits WPS/WEP weaknesses using a supported USB Wi-Fi adapter, without relying on aircrack-ng or OS kernel drivers.

    • wifi-security
    • vulnerability-detection
    • hacking-tools
    • recon
100. 100

     Relapse-Exploit

     2.3Kntfargo/Relapse-Exploit · JavaScript

     Relapse Exploit is a browser-based jailbreak chain for the PS5, working on firmware 7.00 through 13.60, that chains a WebKit browser exploit with a kernel exploit to gain kernel read/write and load custom payloads.

     • webkit
     • exploit-development
     • console
     • mit-license

Showing the 100 most-starred of 126. See every one in the catalog.

• security976
• cybersecurity245
• security-tools282
• linux4,184
• pentesting113
• macos3,544
• windows3,403
• hacking135
• open-source5,666
• red-team79
• offensive-security77
• cli2,227
• python2,383
• docker1,660
• hacking-tool75
• cross-platform2,623
• terminal1,101
• mit3,312
• network-security66
• osint68
• self-hosted1,929
• exploit51
• reverse-engineering221
• vulnerability50