Pentesting projects on GitHub

1. 1
   #1 · trimstray/the-book-of-secret-knowledge

   the-book-of-secret-knowledge

   A massive curated collection of lists, manuals, cheatsheets, blogs, hacks, one-liners and CLI/GUI/web tools that the author gathers from everyday sysadmin, DevOps and security work.

   251.3K
2. 2
   #2 · Hack-with-Github/Awesome-Hacking

   Awesome-Hacking

   A massive index that links out to dozens of other awesome-lists covering nearly every security domain: android security, bug bounty, fuzzing, malware analysis, OSINT, reverse engineering, web hacking, and more.

   123K
3. 3
   #3 · sherlock-project/sherlock

   sherlock

   Sherlock hunts down social media accounts by username: give it a name and it checks across social networks for accounts registered under it.

   94.5K

4. 4

   SecLists

   74.2Kdanielmiessler/SecLists · PHP

   SecLists is a huge collection of ready-made wordlists for security testing: usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells and more, all gathered in one repository.

   • wordlist
   • patterns
   • password
   • hacking-tools
5. 5

   shannon

   49.1KKeygraphHQ/shannon · TypeScript

   Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

   • ai-penetration-testing
   • sarif
   • security-testing
   • pentesting-tools
6. 6

   mitmproxy

   45.7Kmitmproxy/mitmproxy · Python

   mitmproxy is an interactive, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, and WebSockets, used by penetration testers and developers to inspect and modify traffic. mitmdump is its CLI version, and mitmweb is a web-based interface.

   • http2
   • ssl
   • tls
   • debugging
7. 7

   reverse-skill

   42.7Kzhaoxuya520/reverse-skill · PowerShell

   It is a skill pack that routes AI coding agents to the right reverse engineering, penetration testing, and security research methodology for a given task (APK, binary, JS, CTF, malware, etc.), checks which tools are installed, and runs a repeatable workflow instead of letting the agent guess commands.

   • malware-analysis
   • ctf
   • binary-analysis
   • powershell
8. 8

   maigret

   39.2Ksoxoj/maigret · Python

   Maigret is an OSINT command-line tool that builds a dossier on a person by checking for an account under a given username across thousands of websites and pulling together whatever profile info it finds, with no API keys required.

   • osint-python
   • investigation
   • osint-framework
   • osint-tool
9. 9

   metasploit-framework

   39.2Krapid7/metasploit-framework · Ruby

   Metasploit Framework is an open-source penetration testing framework written in Ruby — one of the best-known security toolkits on GitHub, with about 39,000 stars.

   • kali-linux
   • exploitation
   • api-documentation
   • infosec
10. 10

    sqlmap

    38.7Ksqlmapproject/sqlmap · Python

    sqlmap is an open-source penetration testing tool that automates detecting and exploiting SQL injection flaws and taking over the underlying database server.

    • sql-injection
    • security-testing
    • detection
    • exploitation
11. 11

    Anthropic-Cybersecurity-Skills

    34.7Kmukul975/Anthropic-Cybersecurity-Skills · Python

    An open-source library of 818 production-grade cybersecurity skills for AI agents, covering 34 security domains and mapped to six frameworks including MITRE ATT&CK and NIST CSF 2.0.

    • container-security
    • threat-hunting
    • cloud-security
    • vulnerability-management
12. 12

    security-audit-skill

    32.5Kcloudflare/security-audit-skill · JavaScript

    A Cloudflare coding-agent skill that turns your agent into a security auditor: it orchestrates isolated agents through a structured, multi-phase audit and returns independently verified, machine-readable findings.

    • security-testing
    • security-audit
    • vulnerability-scanner
    • ai-security
13. 13

    awesome-osint

    30.4Kjivoi/awesome-osint

    This is a curated 'awesome list' of hundreds of free and paid OSINT (open source intelligence) tools and resources, organized into categories like general search, Google dorks, data breach lookup, social media, threat actors, and dark web.

    • threat-hunting
    • domain
    • osint-tool
    • information-gathering
14. 14

    h4cker

    29.8KThe-Art-of-Hacking/h4cker · Jupyter Notebook

    A curated collection of thousands of cybersecurity resources — references, scripts, tools, code, labs, and training material — maintained by Omar Santos as a companion to his books, video courses, and live training.

    • vulnerability-assessment
    • cloud-security
    • vulnerability-management
    • vulnerability-research
15. 15

    awesome-pentest

    27.5Kenaqx/awesome-pentest

    A curated collection of penetration testing and offensive-security resources: tools, books, courses, conferences and practice targets for authorized security testing.

    • password-cracking
    • wifi-security
    • privilege-escalation
    • ethical-hacking
16. 16

    promptfoo

    26.2Kpromptfoo/promptfoo · TypeScript

    promptfoo is a CLI and library for evaluating and red-teaming LLM apps — you test prompts, agents, and RAGs and run security scans on them, instead of relying on trial-and-error.

    • vulnerability-scanners
    • evaluation-framework
    • cicd
    • red-teaming
17. 17

    masscan

    26.1Krobertdavidgraham/masscan · C

    Masscan is an Internet-scale TCP port scanner that transmits SYN packets asynchronously and can scan the entire IPv4 Internet in under 5 minutes, sending up to 10 million packets per second from a single machine.

    • scanner
    • reconnaissance
    • vulnerability-scanner
    • infosec
18. 18

    awesome-flipperzero

    24.5Kdjsime1/awesome-flipperzero

    A curated list of resources for the Flipper Zero, the pocket multi-tool hacking device, covering firmware, apps, file dumps, cases, modules, and debugging tools.

    • flipperzero
    • hacking-tools
    • firmware
    • debugging
19. 19

    social-analyzer

    24.3Kqeeqbox/social-analyzer · JavaScript

    Social-Analyzer is an OSINT tool that searches and correlates a person's profile across roughly 1000 social media sites and websites, available as a CLI, an API, and a web app.

    • analyzer
    • analysis
    • information-gathering
    • pentest
20. 20

    spiderfoot

    23.6Ksmicallef/spiderfoot · Python

    Open source OSINT automation — it collects intelligence on a target for threat intel and attack surface mapping, whether you are doing red team recon or checking what your organisation has exposed.

    • darknet
    • osint-framework
    • osint-tool
    • recon
21. 21

    unleashed-firmware

    22.6KDarkFlippers/unleashed-firmware · C

    Unleashed is custom firmware for the Flipper Zero multitool — a fork of the official firmware (OFW) that adds extra features and improvements while staying compatible with official apps.

    • flipperzero
    • unofficial
    • bruteforce
    • wireless
22. 22

    frida

    22.4Kfrida/frida · Meson

    Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers, used to instrument running apps; more at frida.re.

    • injection
    • pip
    • debugging
    • hacking
23. 23

    Mobile-Security-Framework-MobSF

    22KMobSF/Mobile-Security-Framework-MobSF · JavaScript

    MobSF is an automated, all-in-one mobile security framework: it performs static and dynamic analysis, penetration testing, malware analysis and privacy analysis on Android, iOS and Windows Mobile apps.

    • dynamic-analysis
    • api-testing
    • mobile-security
    • owasp
24. 24

    mimikatz

    21.9Kgentilkiwi/mimikatz · C

    A small Windows security tool, originally written to learn C. It is best known for extracting plaintext passwords, hashes, PIN codes and Kerberos tickets from memory, and can perform pass-the-hash, pass-the-ticket or build Golden tickets.

    • post-exploitation
    • password
    • visual-studio
    • driver
25. 25

    Ciphey

    21.7Kbee-san/Ciphey · Rust

    ciphey automatically decrypts ciphertext without knowing the key or cipher, decodes encodings and cracks hashes. It is the Rust-built next generation of Ciphey — roughly 7x faster per decode — and the same team intends it to fully replace the original.

    • ctf-tools
    • discord-bot
    • bert
    • ctf
26. 26

    vulhub

    21.4Kvulhub/vulhub · Dockerfile

    Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments: with one command you get a working lab for security research, learning, or demos.

    • dockerfile
    • security-research
    • vulnerability
    • exploit
27. 27

    PEASS-ng

    20.7Kpeass-ng/PEASS-ng · C#

    PEASS-ng is a suite of local privilege escalation enumeration tools: LinPEAS for Linux/Unix/macOS and WinPEAS for Windows. They scan a machine for privesc paths and print misconfigurations with nice colors so you can spot them easily.

    • color
    • redteam
    • infosec
    • script
28. 28

    RustScan

    20.6Kbee-san/RustScan · Rust

    RustScan is an open-source port scanner written in Rust: it finds open ports fast — all 65k ports in as little as 3 seconds — and has a scripting engine for Python, Lua and Shell.

    • scanning
    • kali-linux
    • scanner
    • reconnaissance
29. 29

    bettercap

    20.2Kbettercap/bettercap · Go

    A portable all-in-one framework written in Go for recon and attacks on WiFi, Bluetooth Low Energy, wireless HID, CAN-bus and IPv4/IPv6 networks, built for security researchers and red teamers.

    • redteaming
    • wifi-security
    • mitm
    • redteam
30. 30

    GHunt

    19.7Kmxrch/GHunt · Python

    GHunt is an offensive Google framework geared toward OSINT — collecting intelligence around Google — and its authors note that any Google-related use is possible.

    • osint-framework
    • information-gathering
    • reconnaissance
    • osint
31. 31

    GhostTrack

    19.5KHunxByts/GhostTrack · Python

    GhostTrack is a Python command-line OSINT tool used to track a target's approximate location or gather details about a phone number, essentially a piece of information-gathering tooling for recon work.

    • osint-python
    • phone-number
    • termux
    • osint-tool
32. 32

    theHarvester

    18Klaramies/theHarvester · Python

    An open-source OSINT tool that gathers emails, subdomains and names about a domain or organization from public sources: search engines, certificate transparency logs, DNS datasets, code repositories and threat-intel platforms, normalizing hostnames, emails, IPs, URLs, ASNs, people and breach names.

    • subdomain-enumeration
    • data-collection
    • recon
    • information-gathering
33. 33

    Awesome-Hacking-Resources

    17.5Kvitalysim/Awesome-Hacking-Resources

    A curated collection of hacking, penetration testing and AI red-teaming resources — courses, YouTube channels, CTF platforms and guides, picked to make you better at offensive security.

    • kali-linux
    • exploit-development
    • privilege-escalation
    • owasp
34. 34

    awesome-hacking

    17.3Kcarpedm20/awesome-hacking

    A curated list of hacking tutorials, tools and resources covering system exploitation, reverse engineering, web security, network security, forensics, cryptography and wargames.

    • hacking-tools
    • forensics
    • ctf
    • network-security
35. 35

    zphisher

    17Khtr-tech/zphisher · HTML

    Zphisher is an automated phishing tool with 30+ ready-made login-page templates, written as a beginners-friendly shell script and intended purely for education.

    • phishing
    • termux
    • tunnel
    • offensive-security
36. 36

    ffuf

    16.9Kffuf/ffuf · Go

    ffuf is a fast web fuzzer written in Go — a command-line tool that sends many crafted requests to a target to discover directories, virtual hosts, and fuzzable GET/POST parameters.

    • bugbounty
    • scanner
    • web-security
    • reconnaissance
37. 37

    impacket

    16.2Kfortra/impacket · Python

    Impacket is a collection of Python classes for working with network protocols, giving low-level programmatic access to packets and, for some protocols like SMB1-3 and MSRPC, full protocol implementations.

    • network-programming
    • network
    • protocol
    • red-team
38. 38

    PentestGPT

    16KGreyDGL/PentestGPT · Python

    PentestGPT is an agentic framework that uses large language models to run automated penetration testing and solve CTF challenges, working through staged phases like recon, exploitation and reporting.

    • ctf
    • offensive-security
    • hacking-tool
    • red-team
39. 39

    zaproxy

    16Kzaproxy/zaproxy · Java

    ZAP (Zed Attack Proxy) by Checkmarx is the world's most widely used web app security scanner, used to automatically find vulnerabilities in web applications during development and testing.

    • security-scanner
    • appsec
    • opensource
    • vulnerability-scanner
40. 40

    evilginx2

    15.7Kkgretzky/evilginx2 · Go

    Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which lets an attacker bypass 2-factor authentication.

    • phishing
    • credentials
    • two-factor-authentication
    • session
41. 41

    hacker-roadmap

    15.7Ksundowndev/hacker-roadmap

    This is a curated roadmap and toolkit index for learning and practicing ethical hacking: it explains what penetration testing is and groups hundreds of security tools, wordlists and references by category (recon, password attacks, wireless, exploitation, web hacking, post-exploitation, frameworks).

    • wordlist
    • password-cracking
    • post-exploitation
    • wireless
42. 42

    XSStrike

    15.2Ks0md3v/XSStrike · Python

    XSStrike is a Cross Site Scripting (XSS) detection suite built around four hand-written parsers, an intelligent payload generator, a fuzzing engine, and a fast crawler. Instead of just firing generic payloads like most scanners, it analyzes the live response and crafts payloads guaranteed to work through context analysis.

    • web-application-firewall
    • xss
    • web-security
    • vulnerability-scanner
43. 43

    esp8266_deauther

    15KSpacehuhnTech/esp8266_deauther · C

    ESP8266 Deauther is open-source firmware for the ESP8266 chip that lets you scan nearby WiFi networks, send deauthentication packets to disconnect devices, and spin up dozens of fake WiFi networks to confuse scanners - an affordable platform for testing and learning about WiFi security.

    • esp8266
    • scanning
    • hack
    • wifi-security
44. 44

    awesome-security

    15Ksbilly/awesome-security

    A curated, categorized collection of well-known security resources — software, libraries, documents, books and other cool stuff — maintained by the community in the spirit of awesome-php and awesome-python.

    • forensics
    • web-security
    • malware-analysis
    • firewall
45. 45

    dirsearch

    15Kmaurosoria/dirsearch · Python

    Dirsearch is an advanced command-line web path brute-forcer used to discover hidden files and directories on websites for security testing.

    • wordlist
    • pentest-tool
    • appsec
    • bugbounty
46. 46

    wifiphisher

    14.9Kwifiphisher/wifiphisher · Python

    Wifiphisher is a rogue access point framework for conducting Wi-Fi phishing and man-in-the-middle attacks against wireless clients, used in red team and penetration testing engagements.

    • redteaming
    • phishing
    • wifi-security
    • malware
47. 47

    HackBrowserData

    14.6KmoonD4rk/HackBrowserData · Go

    HackBrowserData is a command-line tool that decrypts and exports browser data — passwords, cookies, history, bookmarks, credit cards and more — from Chromium-based browsers, Firefox and Safari, built for security research.

    • pentest-tool
    • safari
    • edge
    • data-extraction
48. 48

    binwalk

    14.5KReFirmLabs/binwalk · Rust

    Binwalk is a firmware analysis tool that can identify, and optionally extract, files and data that have been embedded inside other files.

    • forensics
    • binary-analysis
    • embedded-systems
    • hacking-tool
49. 49

    gophish

    14.3Kgophish/gophish · Go

    Gophish is an open-source phishing toolkit for businesses and penetration testers: it lets you quickly set up and run phishing engagements and security awareness training campaigns.

    • phishing
    • red-team
    • email
    • penetration-testing
50. 50

    awesome-malware-analysis

    14.3Krshipp/awesome-malware-analysis

    A curated 'awesome list' of malware analysis tools and resources, covering sample collection, sandboxes, detection tools, threat intelligence feeds, reverse engineering, and forensics.

    • dynamic-analysis
    • chinese-translation
    • threat-intelligence
    • forensics
51. 51

    gobuster

    14.2KOJ/gobuster · Go

    Gobuster is a fast, multi-threaded command-line tool written in Go for brute-forcing web directories/files, DNS subdomains, and virtual hosts, plus enumerating S3/GCS cloud storage buckets and TFTP files.

    • brute-force
    • subdomain-enumeration
    • fuzzing
    • scanner
52. 52

    juice-shop

    14.2Kjuice-shop/juice-shop · TypeScript

    OWASP Juice Shop is an intentionally insecure web application (a fake online juice store) built for security training, awareness demos, CTFs, and testing security tools.

    • appsec
    • owasp
    • application-security
    • security-audit
53. 53

    DVWA

    13.9Kdigininja/DVWA · PHP

    DVWA (Damn Vulnerable Web Application) is a PHP/MariaDB web app that is deliberately full of security bugs, built as a legal practice target for security pros, students, and developers to learn web application security.

    • sql-injection
    • application-security
    • web-security
    • vulnerability-scanner
54. 54

    john

    13.8Kopenwall/john · C

    A fast, offline password cracker. Its primary purpose is detecting weak Unix passwords, but the jumbo build supports hundreds of hash and cipher types and runs on Unix, macOS, Windows and more.

    • gpgpu
    • hashing
    • password-cracking
    • opencl
55. 55

    pwntools

    13.8KGallopsled/pwntools · Python

    Pwntools is a CTF framework and exploit development library written in Python, built for rapid prototyping with the goal of making exploit writing as simple as possible.

    • assembly
    • ctf
    • exploit
    • python3
56. 56

    GTFOBins.github.io

    13.8KGTFOBins/GTFOBins.github.io · YAML

    GTFOBins is a curated list of Unix-like executables that can be abused to bypass local security restrictions in misconfigured systems — for example, binaries a restricted user can turn into a root shell.

    • post-exploitation
    • exploitation
    • privilege-escalation
    • redteam
57. 57

    Photon

    13.3Ks0md3v/Photon · Python

    Photon is a fast web crawler built for OSINT (open-source intelligence) gathering, extracting URLs, emails, social media accounts, secret keys, subdomains and more while it crawls a target site.

    • osint-tools
    • spider
    • web-scraper
    • information-gathering
58. 58

    mastg

    13.3KOWASP/mastg · Python

    A comprehensive OWASP manual for mobile app security testing and reverse engineering. It gives technical processes for verifying the weaknesses listed in the OWASP Mobile Security Weakness Enumeration (MASWE).

    • dynamic-analysis
    • android-application
    • network-analysis
    • checklist
59. 59

    hexstrike-ai

    12.9K0x4m4/hexstrike-ai · Python

    HexStrike AI MCP Agents is an MCP server that lets AI agents like Claude, GPT, or Copilot autonomously run 150+ real cybersecurity tools for automated pentesting, bug bounty hunting, CTF challenges, and vulnerability discovery.

    • ai-hacking
    • ctf-tools
    • ai-penetration-testing
    • ai-security-tool
60. 60

    atomic-red-team

    12.7Kredcanaryco/atomic-red-team · C

    Atomic Red Team is a library of small, portable security tests, each mapped to a specific MITRE ATT&CK technique, that security teams run to check whether their defenses actually detect real attacker behavior.

    • mitre-attack
    • offensive-security
    • red-team
    • ruby
61. 61

    wifi-cracking

    12.7Kbrannondorsey/wifi-cracking

    A step-by-step tutorial for cracking WPA/WPA2 Wi-Fi passwords: capture a handshake with Airodump-ng, then crack it offline with Aircrack-ng or Hashcat.

    • password-cracking
    • wireless
    • wifi-security
    • cracking
62. 62

    hacktricks

    12.6KHackTricks-wiki/hacktricks · JavaScript

    A free, open wiki of hacking tricks and techniques — everything the author has learnt from CTFs, real-world apps and security research, organized into a browsable reference with 12.5k+ GitHub stars.

    • pentesting-tools
    • exploitation
    • recon
    • appsec
63. 63

    hetty

    12.5Kdstotijn/hetty · Go

    Hetty is an HTTP toolkit for security research, aiming to be an open source alternative to commercial tools like Burp Suite Pro, aimed at the infosec and bug bounty community.

    • bugbounty
    • mitm
    • infosec
    • penetration-testing
64. 64

    thc-hydra

    12.4Kvanhauser-thc/thc-hydra · C

    Hydra is a parallelized network login cracker by van Hauser / THC: a proof-of-concept tool showing researchers and security consultants how easily a remote system can be broken into through weak passwords. It supports over 50 protocols.

    • brute-force
    • bruteforce
    • password-cracking
    • pentest-tool
65. 65

    fsociety

    12.4KManisso/fsociety · Python

    fsociety is a penetration testing toolkit that bundles dozens of existing hacking tools (Nmap, sqlmap, WPScan, Reaver, etc.) behind one menu-driven script, inspired by the tools used in the 'Mr. Robot' TV series.

    • finder
    • penetration-testing-tools
    • post-exploitation
    • exploitation
66. 66

    sliver

    12.1KBishopFox/sliver · Go

    Sliver is an open source cross-platform adversary emulation and red team framework that organizations of any size can use to perform security testing.

    • adversarial-attacks
    • command-and-control
    • dns-server
    • red-teaming
67. 67

    awesome-ctf

    11.9Kapsdehal/awesome-ctf · JavaScript

    A curated list of frameworks, libraries, tools, and resources for Capture The Flag (CTF) competitions, covering everything from building challenges to solving them.

    • ctf-tools
    • forensics
    • ctf
    • exploit
68. 68

    TheFatRat

    11.5Kscreetsec/TheFatRat · C

    TheFatRat is an exploiting tool that compiles malware from famous payloads — an easy way to generate backdoors built to slip past most anti-virus software.

    • post-exploitation
    • kali-linux
    • remote
    • bypass
69. 69

    Sn1per

    11.5K1N3/Sn1per · Shell

    Sn1per is an offensive-security platform that bundles reconnaissance, vulnerability scanning, exploitation and reporting into one workspace, orchestrating 600+ exploits and 90+ third-party tools for pentesters and attack-surface-management teams.

    • osint-framework
    • pentest-tool
    • pentesting-tools
    • osint-tool
70. 70

    beef

    11.1Kbeefproject/beef · JavaScript

    BeEF (Browser Exploitation Framework) is a penetration testing tool that focuses on the web browser, letting a tester assess the real security posture of a target by using client-side attack vectors instead of network-perimeter exploits.

    • context
    • exploitation
    • pentest
    • website
71. 71

    Sublist3r

    11.1Kaboul3la/Sublist3r · Python

    Sublist3r is a Python tool that enumerates subdomains of a target website using OSINT, helping penetration testers and bug hunters gather subdomains for a domain they are targeting.

    • subdomain-enumeration
    • wordlist
    • subdomain
    • bruteforce
72. 72

    LaZagne

    11KAlessandroZ/LaZagne · Python

    LaZagne is an open-source tool that retrieves passwords stored locally on a computer by reverse-engineering the storage method of each software (plaintext, APIs, custom algorithms, databases, etc.).

    • penetration-testing-tools
    • password-cracking
    • post-exploitation
    • security-testing
73. 73

    webshell

    10.8Ktennc/webshell · PHP

    It's a community collection of webshells - scripts that give you control of a web server once uploaded - covering all the common server-side languages and maintained by tennc with 10k+ stars.

    • waf
    • perl
    • hacking-tools
    • anti-detection
74. 74

    Red-Teaming-Toolkit

    10.8Kinfosecn1nja/Red-Teaming-Toolkit

    It is a curated list of cutting-edge open-source security tools for red teamers and threat hunters, covering the full attack lifecycle from reconnaissance to exfiltration.

    • command-and-control
    • phishing
    • credentials
    • privilege-escalation
75. 75

    nikto

    10.8Ksullo/nikto · Perl

    Nikto is an open-source web server scanner that checks servers for dangerous files, outdated software versions, and other common vulnerabilities.

    • perl
    • scanner
    • redteam
    • web-security
76. 76

    bbot

    10.7Kblacklanternsecurity/bbot · Python

    BBOT is a recursive internet scanner for hackers — it automates recon, bug bounty work and attack surface management (ASM), inspired by Spiderfoot.

    • subdomain-enumeration
    • osint-framework
    • bruteforce
    • recon
77. 77

    httpx

    10.5Kprojectdiscovery/httpx · Go

    httpx is a fast, multi-purpose HTTP toolkit from ProjectDiscovery that runs many probes against lists of hosts and URLs, built on the retryablehttp library to stay reliable under high thread counts.

    • ssl-certificate
    • pentest-tool
    • bugbounty
    • pipeline
78. 78

    nishang

    10.2Ksamratashok/nishang · PowerShell

    Nishang is a framework and large collection of PowerShell scripts and payloads for offensive security, penetration testing, and red teaming, covering every phase of an engagement.

    • redteam
    • malware
    • infosec
    • exploit
79. 79

    OneForAll

    10.1Kshmilylty/OneForAll · Python

    OneForAll is a powerful subdomain collection tool: point it at a target domain and it gathers subdomains from many sources — a core reconnaissance step in penetration testing, which is why the author built it.

    • brute-force
    • subdomain-enumeration
    • subdomain
    • pentest-tool
80. 80

    flowsint

    9.9Kreconurge/flowsint · TypeScript

    Flowsint is an open-source, graph-based OSINT investigation tool that lets analysts explore relationships between people, domains, IPs, organizations and more through a visual graph interface with automated enrichers.

    • investigation
    • recon
    • neo4j
    • graph-database
81. 81

    Cybersecurity-Projects

    8.3KCarterPerez-dev/Cybersecurity-Projects · Go

    This is a growing collection of 70 hands-on cybersecurity projects with full source code, organized into four difficulty tiers, plus 10 certification roadmaps and curated learning resources for cybersecurity careers.

    • certification
    • malware
    • red-team
    • agplv3
82. 82

    Claude-Red

    7.6KSnailSploit/Claude-Red · Python

    claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.

    • vulnerability-research
    • post-exploitation
    • pentesting-tools
    • phishing
83. 83

    T3MP3ST

    6.6Kelder-plinius/T3MP3ST · TypeScript

    T3MP3ST is a multi-agent offensive-security framework that turns an AI coding agent you already use into an autonomous red-teaming operator. Point it at an authorized target and it runs the kill chain — recon, exploit, report — from a browser 'War Room' or the CLI.

    • redteam
    • ctf
    • vulnerability
    • offensive-security
84. 84

    Decepticon

    6.3KBitterSecurity/Decepticon · Python

    Decepticon is a professional autonomous Red Team agent that runs full attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and C2 — the way a real adversary would, instead of just scanning and printing a report.

    • ai-penetration-testing
    • command-and-control
    • mitre-attack
    • kali-linux
85. 85

    user-scanner

    5.4Kkaifcodec/user-scanner · Python

    User Scanner is an OSINT (open-source intelligence) CLI tool that takes an email address or username and scans it across 2720+ platforms (210+ email vectors, 2510+ username vectors) to map digital footprints, scrape profile metadata, and surface linked accounts.

    • redteaming
    • osint-tools
    • osint-tool
    • threat-intelligence
86. 86

    Claude-BugHunter

    5.2Kelementalsouls/Claude-BugHunter · Python

    A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.

    • bugbounty
    • application-security
    • bug-bounty
    • ethical-hacking
87. 87

    exploitarium

    5.2Kbikini/exploitarium · Python

    Exploitarium is a single consolidated archive of the author's public proof-of-concept exploits and vulnerability research writeups, merging dozens of their former standalone PoC repos into one place.

    • cve
    • exploit-development
    • fuzzing
    • ethical-hacking
88. 88

    airgorah

    4.5Kmartin-olivier/airgorah · Rust

    Airgorah is a WiFi security auditing tool written in Rust that captures nearby WiFi traffic, discovers clients connected to access points, performs deauthentication attacks, captures handshakes and PMKIDs, and cracks access point passwords.

    • password-cracking
    • wireless
    • gtk4
    • wifi-security
89. 89

    METATRON

    4.2Ksooryathejas/METATRON · Python

    Metatron is a CLI-based AI penetration testing assistant that runs real recon tools against a target and lets a locally-hosted LLM analyze the results, suggest exploits, and recommend fixes, with no cloud or API keys involved.

    • mariadb
    • reconnaissance
    • vulnerability
    • local-ai
90. 90

    raptor

    3.9Kgadievron/raptor · Python

    RAPTOR turns a Claude Code session into an offensive/defensive security agent: Claude.md rules, sub-agents and skills orchestrate tools like radare2, Frida, Z3 and CodeQL for binary reverse-engineering, exploit-feasibility research, and software supply-chain (SCA) analysis.

    • supply-chain-security
    • fuzzing
    • malware-analysis
    • vulnerability-scanner
91. 91

    redamon

    3.2Ksamugit83/redamon · Python

    RedAmon is an open-source, self-hosted AI framework that chains reconnaissance, exploitation and post-exploitation into one pipeline, maps the attack surface into a Neo4j graph, and then triages findings and opens GitHub pull requests that fix what it discovers.

    • penetration-testing-tools
    • kali-linux
    • exploitation
    • bug-bounty
92. 92

    wifit3

    2.6Kderv82/wifit3 · Python

    wifit3 is a standalone Wi-Fi security auditing tool that scans networks, captures WPA/WPA2 handshakes, and exploits WPS/WEP weaknesses using a supported USB Wi-Fi adapter, without relying on aircrack-ng or OS kernel drivers.

    • wifi-security
    • vulnerability-detection
    • hacking-tools
    • recon
93. 93

    ghostlock-app

    2.1KYuKongA/ghostlock-app · Kotlin

    GhostLock is a one-tap Android app that runs the CVE-2026-43499 kernel exploit to grant uid 0 (root) on a matching vulnerable kernel, optionally loading a KernelSU-style module afterward.

    • kernelsu
    • cve
    • privilege-escalation
    • linux-kernel
94. 94

    Seep-Reverse-Lab

    1.7Kangusdevgo/Seep-Reverse-Lab · Lua

    Seep Reverse Lab is an agent-native reverse engineering and security-audit workbench that lets an AI coding agent autonomously run Radare2, JADX, Apktool and Frida to triage binaries, decompile APKs, and determine whether an app's feature gates are enforced locally or verified by a server (a CWE-602 authorization audit).

    • ida-pro
    • pi-agent
    • mcp-tools
    • decompiler
95. 95

    ARTEX

    1.3Ktrhhubsd/ARTEX · Go

    ARTEX is an AI-driven autonomous penetration testing system (Go backend + Next.js frontend) where LLM-powered planner and worker agents explore targets, map assets, and find vulnerabilities on their own.

    • vulnerability-scanners
    • mitm
    • llm-agent
    • pentest
96. 96

    Cybermes

    949Zyrexnn/Cybermes · Python

    Cybermes is an offensive security assistant and automation framework for authorized bug bounty hunting, reconnaissance, vulnerability research, and structured reporting, driven by AI agents and a library of 200+ playbooks.

    • appsec
    • bug-bounty
    • red-teaming
    • llm-security
97. 97

    ai-security-tool

    939ZeroDayEvil/ai-security-tool · HTML

    AI Security Tool is an open-source, cross-platform terminal and vulnerability scanner that combines a multi-protocol connectivity client (SSH, RDP, VNC, etc.), CVE/SBOM supply-chain auditing, and 12+ autonomous AI agents (DeepSeek, OpenAI) to automate pentesting, Red Team, and CTF workflows.

    • ai-hacking
    • ai-security-tool
    • rdp
    • ssh-client
98. 98

    ARTEX

    849Hinln/ARTEX · Go

    ARTEX is an AI-driven autonomous penetration testing system with a Go backend and a Next.js frontend. It runs multiple LLM agents that explore a target, build an asset graph, and chain findings into vulnerabilities, all shown on a web dashboard.

    • mitm
    • sse
    • vulnerability
    • offensive-security
99. 99

    VulnHunter

    752nealbridges/VulnHunter · Python

    An open-source, agentic AI security scanner that reasons like an attacker to find exploitable vulnerabilities in source code, proves them with executable proof-of-concept exploits, and fixes them test-first. It is a maintained fork of Capital One's VulnHunter, rebuilt to run on any agent harness instead of just Claude Code.

    • ai-penetration-testing
    • ai-security-tool
    • sast
    • poc
100. 100

     BEAR-C2

     704S3N4T0R-0X0/BEAR-C2 · Python

     BEAR-C2 is an adversary simulation and emulation framework for red team operations, built around real-world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups.

     • command-and-control
     • phishing
     • mitre-attack
     • security-automation

Showing the 100 most-starred of 114. See every one in the catalog.

• security1,006
• security-tools293
• cybersecurity253
• linux4,265
• penetration-testing130
• windows3,493
• hacking143
• macos3,624
• open-source5,768
• cli2,284
• offensive-security78
• python2,440
• red-team83
• docker1,686
• terminal1,136
• cross-platform2,682
• hacking-tool79
• mit3,401
• osint71
• infosec49
• reconnaissance41
• reverse-engineering241
• self-hosted1,985
• tool1,342