Penetration Open Source Projects

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

Automatic SQL injection and database takeover tool

一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, high-performance, powerful intranet penetration proxy server, with a powerful web management terminal.

This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org

A collection of awesome penetration testing resources, tools and other shiny things

Gitbook

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.

Fast passive subdomain enumeration tool.

fsociety Hacking Tools Pack – A Penetration Testing Framework

A curated list of CTF frameworks, libraries, resources and softwares

The Browser Exploitation Framework Project

A list of web application security

Open Source Vulnerability Management Platform

Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet

The Penetration Testers Framework (PTF) is a way for modular support for up-to-date tools.

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

Modlishka. Reverse Proxy.

📦 Make security testing of K8s, Docker, and Containerd easier.

⚡️An awesome list of the best Termux hacking tools

PENTEST-WIKI is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others.

A curated list of awesome OSCP resources

An ArchLinux based distribution for penetration testers and security researchers.

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

Red Teaming & Pentesting checklists for various engagements

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

Source code about machine learning and security.

Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient http://owtf.org https://twitter.com/owtfp

WEB安全手册(红队安全技能栈)，漏洞理解，漏洞利用，代码审计和渗透测试总结。【持续更新】

A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.

Bug Bounty Roadmaps

Everything for pentest. | 用于渗透测试的 payload 和 bypass 字典.

Peirates - Kubernetes Penetration Testing tool

🔒 A collection of cheatsheets for various infosec tools and topics.

A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB.

Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates.

Payload for teensy like a rubber ducky but the syntax is different. this Human interfaes device ( HID attacks ). Penetration With Teensy . Brutal is a toolkit to quickly create various payload,powershell attack , virus attack and launch listener for a Human Interface Device ( Payload Teensy )

Kali Linux工具清单

a collection of handy bookmarks

Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security enthusiasts/professionals or students to test their iOS penetration testing skills in a legal environment. This project is developed and maintained by @prateekg147. The vulnerabilities and solutions covered in this app are tested up to iOS 11. The current version is writen in Swift and has the following vulnerabilities.

DNSChef - DNS proxy for Penetration Testers and Malware Analysts

A Ruby framework designed to aid in the penetration testing of WordPress systems.

secureCodeBox (SCB) - continuous secure delivery out of the box

A comprehensive guide/material for anyone looking to get into infosec or take the OSCP exam

A collection of awesome Command & Control (C2) frameworks, tools and resources for post-exploitation and red teaming assignments.

Payload Arsenal for Pentration Tester and Bug Bounty Hunters

Focus on promoting the evolution of tools in different aspects of security research.专注于推动安全研究各个领域工具化.(项目收录逐步迁移至 https://github.com/knownsec/404StarLink)

Modern tactical exploitation toolkit.

JustTryHarder, a cheat sheet which will aid you through the PWK course & the OSCP Exam. (Inspired by PayloadAllTheThings)

Work in progress...

A Xposed Module for Android Penetration Test, with NanoHttpd.

A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner

PC客户端（C-S架构）渗透测试checklist / Client side(C-S) penetration checklist

E-Hentai/ExHentai 全部 TAGs 中文翻译

Library for collision detection between two convex shapes

Windows post-exploitation tools, resources, techniques and commands to use during post-exploitation phase of penetration test. Contributions are appreciated. Enjoy!

A modular C2 framework

Penetration Testing tools - one repo to clone them all... containing latest pen testing tools

PenBox - A Penetration Testing Framework - The Tool With All The Tools , The Hacker's Repo