Open-source penetration-testing software
1322 open-source libraries, tools and applications tagged penetration-testing, ranked by how closely penetration-testing is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
1322 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| cSploit cSploit is an open-source Android network analysis and penetration testing suite for rooted devices, integrating Metasploit RPC, MITM attac… | 23 | 3665 | abandoned |
| byt3bl33d3r/MITMf MITMf is a Python framework for performing Man-In-The-Middle and network attacks, featuring built-in SMB, HTTP, and DNS servers, an SSLStri… | 10 | 3641 | abandoned |
| Proxmark3 The official (now archived) client software, FPGA logic, and design documentation for the Proxmark3, a general-purpose RFID tool that can s… | 46 | 3553 | abandoned |
| FeeiCN/Cobra Cobra is a source code security audit (SAST) tool that scans PHP, Java, and other languages for common vulnerabilities like SQL injection, … | 10 | 3184 | abandoned |
| NewEraCracker/LOIC LOIC (Low Orbit Ion Cannon) is an open-source network stress testing tool written in C#, based on Praetox's original LOIC. It supports TCP/… | 10 | 2969 | abandoned |
| optiv/ScareCrow ScareCrow is a Go-based payload creation framework designed to bypass EDR (Endpoint Detection and Response) and application whitelisting co… | 10 | 2886 | abandoned |
| DanMcInerney/LANs.py A Python-based penetration testing tool that scans WiFi networks for active clients, performs targeted ARP spoofing, and intercepts or inje… | 32 | 2636 | abandoned |
| CrimsonForge-io/king-phisher King Phisher is a phishing campaign toolkit for testing and promoting user awareness by simulating real-world phishing attacks, with contro… | 62 | 2602 | abandoned |
| WiFi-Pumpkin WiFi-Pumpkin is a Python framework for auditing Wi-Fi security by creating rogue wireless access points and performing man-in-the-middle at… | 23 | 2498 | abandoned |
| evilsocket/bettercap bettercap is a network attack and reconnaissance framework, described as a Swiss Army knife for WiFi, BLE, HID hijacking, CAN-bus, and IPv4… | 10 | 2490 | abandoned |
| Marten4n6/EvilOSX EvilOSX is a Remote Administration Tool (RAT) for macOS/OS X written in pure Python, with a server providing both GUI and CLI interfaces an… | 32 | 2425 | abandoned |
| aress31/burpgpt burpgpt is a Burp Suite extension that sends HTTP traffic to OpenAI GPT models for AI-driven passive vulnerability scanning and traffic ana… | 31 | 2394 | abandoned |
| Jaeles Jaeles is a Go-based framework for building and running automated web application vulnerability scanners using customizable YAML signatures… | 59 | 2379 | abandoned |
| codebutler/firesheep Firesheep is a Firefox extension that demonstrates HTTP session hijacking attacks by sniffing unencrypted Wi-Fi traffic and capturing sessi… | 32 | 2351 | abandoned |
| Nosey Parker Suite Nosey Parker is a Rust-based command-line secrets scanner that finds credentials and sensitive information in files, directories, GitHub, a… | 10 | 2340 | abandoned |
| sevagas/macro_pack macro_pack is a Python CLI tool that automates obfuscation and generation of MS Office documents, VBA/VBS scripts, shortcuts, and other for… | 10 | 2304 | abandoned |
| secgroundzero/warberry WarBerryPi is a tactical exploitation toolkit built to run on a Raspberry Pi, acting as a drop-box/implant for red-team engagements to scan… | 32 | 2221 | abandoned |
| PowerShellEmpire/PowerTools PowerTools is a collection of PowerShell projects focused on offensive security operations, including tools like PowerView, PowerUp, PowerP… | 23 | 2208 | abandoned |
| AdrMXR/KitHack KitHack is a Python-based framework that automates downloading and installing a curated pack of penetration testing tools, organized into c… | 23 | 2096 | abandoned |
| yahoo/gryffin Gryffin is a large-scale web security scanning platform written in Go, built on a publisher-subscriber architecture for horizontal scaling.… | 10 | 2052 | abandoned |
| rasta-mouse/Sherlock Sherlock is a PowerShell script that identifies missing software patches for known Windows local privilege escalation vulnerabilities. It i… | 10 | 2018 | abandoned |
| Fadi002/unshackle Unshackle is a bootable Linux-based ISO that resets or bypasses Windows and Linux user login passwords from a USB drive. It works offline b… | 10 | 1983 | abandoned |
| feihong-cs/ShiroExploit-Deprecated A Java-based one-click exploitation tool for Apache Shiro vulnerabilities Shiro550 (hardcoded key) and Shiro721 (Padding Oracle), supportin… | 23 | 1957 | abandoned |
| Veil Veil-Evasion is a Python tool that generates Metasploit payloads designed to bypass common antivirus solutions, optionally compiling them i… | 10 | 1842 | abandoned |
| samyk/skyjack SkyJack is a drone hacking tool that autonomously seeks out, disconnects the owner of, and takes wireless control of nearby Parrot AR.Drone… | 32 | 1835 | abandoned |
| govolution/avet AVET (AntiVirus Evasion Tool) is a shell-based toolbox for pentesters to build Windows executables that evade antivirus detection, using te… | 36 | 1758 | abandoned |
| xdavidhu/mitmAP A Python program that creates a fake wireless access point and performs man-in-the-middle data sniffing using tools like SSLstrip2, mitmpro… | 10 | 1692 | abandoned |
| DesignativeDave/androrat Androrat is a client/server Remote Administration Tool for Android devices, with the client written in Java Android and the server in Java/… | 32 | 1657 | abandoned |
| chinoogawa/fbht A Python 2 command-line tool for interacting with and scraping Facebook accounts, including graph-based analysis of social connections. It … | 23 | 1616 | abandoned |
| carmaa/inception Inception is a Python-based physical memory manipulation tool that exploits PCI-based DMA (over FireWire, Thunderbolt, ExpressCard, PC Card… | 31 | 1606 | abandoned |
| byt3bl33d3r/SprayingToolkit A set of Python 3 scripts for performing fast password spraying attacks against Lync/Skype for Business, OWA, IMAP, and Office 365, built o… | 10 | 1578 | abandoned |
| SofianeHamlaoui/Lockdoor-Framework Lockdoor Framework is a Python-based penetration testing framework that bundles a curated selection of security tools (information gatherin… | 30 | 1560 | abandoned |
| ring04h/wydomain wydomain is a Python command-line tool for discovering subdomains of a target domain. It combines dictionary-based DNS bruteforcing with qu… | 32 | 1480 | abandoned |
| D4Vinci/Dr0p1t-Framework Dr0p1t-Framework is a Python-based penetration testing framework that generates stealthy Windows dropper executables designed to bypass ant… | 10 | 1477 | abandoned |
| jseidl/GoldenEye GoldenEye is a Python 3 command-line tool for testing HTTP servers against Layer 7 denial-of-service attacks using the HTTP KeepAlive + NoC… | 10 | 1468 | abandoned |
| OpenRCE/sulley Sulley is a pure-Python fuzzing engine and framework for automated, unattended fuzz testing of network protocols and targets. It handles da… | 23 | 1450 | abandoned |
| Lucifer1993/AngelSword AngelSword is a simple CMS vulnerability detection framework written in Python3, designed to help security engineers quickly discover known… | 32 | 1441 | abandoned |
| superSearchPlus superSearchPlus is a Chrome browser extension that aggregates information gathering for white-hat hackers, integrating common asset mapping… | 32 | 1434 | abandoned |
| ReversecLabs/needle Needle is an open-source, modular Python framework for streamlining security assessments of iOS applications, covering areas like data stor… | 10 | 1402 | abandoned |
| hahwul/XSpear XSpear is a Ruby-based XSS (cross-site scripting) scanner and parameter analysis tool distributed as a gem, usable both as a CLI and as a R… | 10 | 1358 | abandoned |
| byt3bl33d3r/gcat Gcat is a proof-of-concept Python backdoor that uses a Gmail account as its command-and-control channel, with an implant deployed on target… | 10 | 1351 | abandoned |
| WWILLV/GodOfHacker GodOfHacker is a satirical C# 'hacker all-in-one tool' whose feature list is intentionally absurd (one-click 0day attacks, stealing QQ acco… | 23 | 1347 | abandoned |
| hackappcom/ibrute A Python proof-of-concept tool that brute-forces AppleID passwords via the Find My iPhone service API, which lacked bruteforce protection. … | 32 | 1322 | abandoned |
| clymb3r/PowerShell A collection of useful PowerShell scripts, most notably security and penetration testing tools that were contributed to PowerSploit. The re… | 32 | 1286 | abandoned |
| cisagov/log4j-scanner A CISA-derived scanner for detecting web services vulnerable to the Log4Shell remote code execution vulnerabilities (CVE-2021-44228 and CVE… | 10 | 1277 | abandoned |
| uknowsec/SharpDecryptPwd SharpDecryptPwd is a Windows command-line tool that decrypts passwords saved locally by popular applications such as Navicat, TeamViewer, F… | 32 | 1271 | abandoned |
| samyk/usbdriveby USBdriveby is an Arduino/Teensy microcontroller project that emulates a USB HID keyboard and mouse to covertly install a backdoor, evade fi… | 32 | 1265 | abandoned |
| LOoLzeC/ASU ASU is a Python-based Facebook hacking toolkit offering account checking and spamming features, distributed via a Termux/Linux install scri… | 32 | 1260 | abandoned |
| Ha3MrX/Gemail-Hack A Python command-line script that performs brute-force password attacks against Gmail accounts. It is a simple educational/offensive-securi… | 62 | 1252 | abandoned |
| vaycore/OneScan OneScan is a BurpSuite extension written in Java for recursive directory scanning, helping discover hidden vulnerabilities in deeper direct… | 10 | 1247 | abandoned |
| optiv/Mangle Mangle is a Go-based CLI tool that manipulates compiled Windows executables (.exe and DLL) to evade EDR detection. It strips known indicato… | 10 | 1233 | abandoned |
| the-robot/sqliv SQLiv is a Python command-line tool that scans websites for SQL injection vulnerabilities. It supports dork-based scanning via search engin… | 10 | 1232 | abandoned |
| DeimosC2/DeimosC2 DeimosC2 is a Golang-based command and control (C2) framework for post-exploitation, supporting TCP, HTTPS, DoH, and QUIC agent communicati… | 26 | 1164 | abandoned |
| ring04h/weakfilescan A Python-based multi-threaded sensitive information leakage detection tool that crawls a target site, dynamically builds dictionary rules f… | 32 | 1140 | abandoned |
| NYAN-x-CAT/Lime-RAT LimeRAT is a remote administration tool (RAT) for Windows written in Visual Basic .NET, providing remote desktop, file management, keyloggi… | 10 | 1135 | abandoned |
| Mana MANA is a toolkit for rogue access point (evilAP) attacks, implementing improved KARMA attacks via a modified hostapd plus MitM configurati… | 23 | 1119 | abandoned |
| vesche/scanless A Python CLI utility and library that scrapes online port scanning websites to perform port scans on a target IP or domain on your behalf. … | 10 | 1119 | abandoned |
| BuffaloWill/Serpico Serpico is a self-hosted web application for writing and collaborating on penetration testing reports. Users assemble findings from a share… | 10 | 1116 | abandoned |
| evilsocket/bleah A deprecated command-line tool for scanning and enumerating Bluetooth Low Energy (BLE) devices. It has been ported into bettercap's BLE mod… | 10 | 1093 | abandoned |
| ekkoo-z/Z-Godzilla_ekp A modified (second-development) fork of the Godzilla webshell management tool, customized to evade network traffic detection devices and an… | 37 | 1075 | abandoned |
| arnaucube/coffeeMiner CoffeeMiner is a Python tool that performs a man-in-the-middle attack on a WiFi/LAN network, injecting a JavaScript cryptocurrency miner in… | 32 | 1075 | abandoned |
| 1n7erface/PocList A Java-based collection of proof-of-concept (PoC) tools for verifying and exploiting known vulnerabilities in products like Nacos, WebLogic… | 32 | 1074 | abandoned |
| WyAtu/Perun Perun is a Python-based network asset vulnerability scanner and scanning framework designed for penetration testers and red teams, primaril… | 32 | 1052 | abandoned |
| M4cs/BabySploit BabySploit is a beginner-friendly penetration testing toolkit and framework written in Python, designed to ease newcomers into using more c… | 23 | 1044 | abandoned |
| Netflix-Skunkworks/sleepy-puppy Sleepy Puppy is a cross-site scripting (XSS) payload management framework from Netflix Skunkworks that captures, manages, and tracks XSS pa… | 32 | 1043 | abandoned |
| utkusen/leviathan Leviathan is a Python-based mass audit toolkit that combines masscan, ncrack, and DSSS to discover services, brute-force credentials, detec… | 10 | 1042 | abandoned |
| denandz/KeeFarce KeeFarce is a security tool that extracts passwords and other cleartext data from a running KeePass 2.x process by injecting a DLL into its… | 32 | 1030 | abandoned |
| ba0gu0/520apkhook A Java-based tool that attaches an Android remote-access APK payload to a legitimate app, producing a trojanized APK where the original app… | 32 | 1014 | abandoned |
| qwqdanchun/DcRat DcRat is an open-source remote administration tool (RAT) written in C# for Windows, providing remote desktop, file management, and remote c… | 10 | 1011 | abandoned |
| rhaidiz/broxy Broxy is an open-source HTTP/HTTPS intercepting proxy written in Go, built on goproxy with a Qt5-based GUI. It offers an interceptor, filte… | 23 | 1008 | abandoned |
| mitmproxy/mitmproxy mitmproxy is an interactive, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, HTTP/3, and WebSockets, offered as a console tool (mitm… | 89 | 45113 | stable |
| secdev/scapy Scapy is a powerful Python-based interactive packet manipulation program and library that can forge, decode, send, capture, and match packe… | 88 | 12599 | stable |
| EmenstaNougat/ESP32-BlueJammer ESP32-BlueJammer is firmware for an ESP32 paired with nRF24 modules that disrupts 2.4GHz communications (Bluetooth, BLE, WiFi, RC) by flood… | 45 | 8594 | active |
| firerpa/lamda FIRERPA (lamda) is an all-in-one Android device control platform whose server runs directly on the device (root or non-root) and exposes 16… | 97 | 8593 | active |
| Tencent/AI-Infra-Guard Tencent's full-stack AI red teaming platform that scans AI infrastructure, agents, MCP servers, and skills for vulnerabilities and evaluate… | 85 | 6916 | active |
| AidLux (AidLearning) AidLux (originally AidLearning) is an AIoT development platform that runs a native Ubuntu Linux environment with GUI, deep learning tooling… | 63 | 5812 | active |
| microsoft/PyRIT PyRIT is Microsoft's open-source Python framework for identifying security and safety risks in generative AI systems. It provides automatio… | 88 | 4668 | active |
| sensity-ai/dot dot (Deepfake Offensive Toolkit) is a Python tool that generates real-time, controllable deepfakes from a webcam feed and injects them into… | 23 | 4589 | active |
| google/tamperchrome Tamper Dev is a browser extension that intercepts and edits HTTP/HTTPS requests and responses in real time without requiring a proxy or aux… | 50 | 4227 | active |
| ivre/ivre IVRE is an open-source network recon framework written in Python that collects, stores, and analyzes network intelligence from active scann… | 66 | 4177 | active |
| edoardottt/cariddi Cariddi is a fast command-line web crawler written in Go that takes a list of domains, crawls URLs, and scans for endpoints, secrets, API k… | 84 | 3786 | active |
| nabla-c0d3/sslyze SSLyze is a fast SSL/TLS scanning tool and Python library that analyzes a server's TLS configuration, including certificates, cipher suites… | 77 | 3780 | stable |
| EMBA EMBA is an open-source firmware security analyzer for embedded Linux devices, written in Bash. It automates firmware extraction, static and… | 94 | 3701 | active |
| google/honggfuzz Honggfuzz is a security-oriented, feedback-driven evolutionary fuzzer that uses software and hardware code coverage to discover bugs in bin… | 66 | 3397 | active |
| techgaun/github-dorks A Python CLI tool that automates GitHub code searches using a curated list of dorks to find leaked secrets like credentials, private keys, … | 65 | 3287 | active |
| m0bilesecurity/RMS-Runtime-Mobile-Security Runtime Mobile Security (RMS) is a NodeJS-powered web interface built on FRIDA for manipulating Android and iOS apps at runtime. It lets us… | 82 | 3130 | active |
| Qianlitp/crawlergo crawlergo is a Go-based browser crawler that uses headless Chrome to discover URLs for web vulnerability scanners. It renders pages, fills … | 24 | 3039 | active |
| confident-ai/deepteam DeepTeam is an open-source Python framework for red teaming LLM systems, AI agents, RAG pipelines, and chatbots. It simulates adversarial a… | 65 | 3005 | active |
| protectai/vulnhuntr Vulnhuntr is a Python CLI tool that uses large language models combined with static code analysis to autonomously discover exploitable vuln… | 23 | 2775 | active |
| ROADtools ROADtools is a Python framework for interacting with Azure AD/Entra ID, comprising the roadlib authentication library, the ROADrecon explor… | 72 | 2737 | active |
| musana/CF-Hero CF-Hero is a Go-based reconnaissance CLI tool that discovers the real origin IP addresses of Cloudflare-protected web applications. It aggr… | 63 | 2640 | active |
| NVISOsecurity/AlwaysTrustUserCerts A Magisk/KernelSU module that automatically copies user-installed certificates into the Android system root CA store. It enables TLS traffi… | 43 | 2565 | active |
| quasar/Quasar Quasar is a free, open-source remote administration tool (RAT) for Windows written in C#, offering remote desktop, shell, file management, … | 10 | 9906 | maintenance |
| Kritt-ai/open-kritt open·kritt is an open-source, self-hosted AI vulnerability research platform that decomposes a codebase into focused security tasks, runs A… | 77 | 2316 | active |
| SafeGroceryStore/MDUT MDUT is a cross-platform desktop application for managing and exploiting multiple databases (MySQL, MSSQL, PostgreSQL, Oracle, Redis) built… | 89 | 2273 | active |
| Trail of Bits Claude Code Config A Claude Code plugin marketplace from Trail of Bits offering skills for AI-assisted security analysis, code auditing, and vulnerability det… | 57 | 2120 | active |
| Fr4nkFletcher/ESP32-Marauder-Cheap-Yellow-Display A port of the ESP32-Marauder WiFi/Bluetooth testing firmware to the Cheap Yellow Display (CYD) family of ESP32 boards with ILI9341/ST7789/S… | 44 | 1773 | active |
| Gerenios/AADInternals AADInternals is a PowerShell module for administering and hacking Entra ID (Azure AD), Office 365, and related endpoints. It includes tools… | 48 | 1703 | active |
| attify/firmware-analysis-toolkit Firmware Analysis Toolkit (FAT) is a Python-based automation wrapper around Firmadyne that emulates IoT and embedded device firmware images… | 99 | 1615 | active |
| ChipWhisperer ChipWhisperer is an open-source toolchain for hardware security research, providing capture hardware designs, FPGA/USB firmware, and a Pyth… | 95 | 1578 | active |