Open-source penetration-testing software
1322 open-source libraries, tools and applications tagged penetration-testing, ranked by how closely penetration-testing is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
1322 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Manisso/fsociety Fsociety is a Python-based penetration testing framework that bundles a menu of hacking tools covering information gathering, password atta… | 70 | 12354 | maintenance |
| thewhiteh4t/FinalRecon FinalRecon is an all-in-one automatic web reconnaissance tool written in Python that provides a fast overview of a web target. It bundles h… | 67 | 3006 | active |
| oritera/Cairn Cairn is a general-purpose AI state-space search engine built on a blackboard architecture with a fact-intent graph, where LLM agent worker… | 71 | 2997 | active |
| makoto56/penetration-suite-toolkit A preconfigured Windows 11 penetration testing toolkit distributed as a VM image, bundling a large curated collection of security tools wit… | 31 | 2983 | active |
| palahsu/DDoS-Ripper DDoS-Ripper (DRipper) is a Python command-line tool that floods a target IP with traffic to simulate a distributed denial-of-service attack… | 68 | 2966 | active |
| jayofelony/pwnagotchi Pwnagotchi is a Raspberry Pi-based Wi-Fi penetration-testing gadget that leverages Bettercap to passively sniff or actively attack nearby W… | 90 | 2956 | active |
| i-am-shodan/USBArmyKnife USB Army Knife is firmware for ESP32-based USB devices (like the T-Dongle-S3) that turns them into a close-access penetration testing tool.… | 73 | 2954 | active |
| SnaffCon/Snaffler Snaffler is a C# command-line tool for pentesters and red teamers that enumerates Windows/AD environments to find sensitive files (mostly c… | 62 | 2945 | active |
| calebstewart/pwncat pwncat is a post-exploitation platform and handler for reverse and bind shells, written in Python. It wraps raw shell communication with an… | 10 | 2913 | active |
| pwndoc/pwndoc PwnDoc is a self-hosted web application for writing penetration test findings and generating customizable Docx reports. It supports multi-u… | 94 | 2895 | active |
| flozz/p0wny-shell p0wny@shell is a single-file PHP webshell that provides a browser-based terminal for executing commands on a remote server. It is designed … | 35 | 2891 | active |
| LimerBoy/Impulse Impulse is a Python-based denial-of-service toolkit that bundles multiple attack methods including SYN, UDP, ICMP, HTTP floods, Slowloris, … | 35 | 2864 | active |
| digininja/CeWL CeWL is a Ruby command-line tool that spiders a target website to a specified depth and collects unique words into a custom wordlist for us… | 59 | 2862 | stable |
| gkbrk/slowloris A Python rewrite of the Slowloris low-bandwidth HTTP Denial of Service attack tool. It holds many connections open to threaded web servers … | 32 | 2838 | stable |
| screetsec/TheFatRat TheFatRat is a menu-driven exploiting tool that automates MSFvenom and Metasploit to generate backdoors and payloads for Windows, Linux, Ma… | 23 | 11505 | maintenance |
| zema1/suo5 Suo5 is a high-performance HTTP tunneling tool that creates a local SOCKS5 forward proxy by tunneling traffic through a compromised web ser… | 80 | 2815 | active |
| ryfineZ/codex-session-patcher A Python tool that cleans AI refusal responses from Codex CLI, Claude Code, and OpenCode session files so conversations can be resumed, wit… | 73 | 2797 | active |
| hasherezade/pe_to_shellcode A C++ command-line tool that converts Windows PE executables into shellcode-compatible form, adding a reflective loading stub post-compilat… | 37 | 2797 | active |
| Impact-I/reFlutter reFlutter is a Python CLI framework for reverse engineering Flutter mobile apps by repacking APK/IPA files with a specially patched, precom… | 99 | 2776 | active |
| calebmadrigal/trackerjacker A Python CLI tool that maps nearby WiFi networks and their connected devices via raw 802.11 monitor-mode packet capture, similar to nmap bu… | 52 | 2743 | active |
| f0rb1dd3n/Reptile Reptile is a Linux kernel module (LKM) rootkit written in C that provides privilege escalation, file/process/network connection hiding, per… | 63 | 2742 | active |
| NetSPI/PowerUpSQL PowerUpSQL is a PowerShell toolkit for attacking and auditing SQL Server instances, supporting discovery, weak configuration auditing, priv… | 32 | 2741 | active |
| aboul3la/Sublist3r Sublist3r is a Python command-line tool that enumerates subdomains of a target domain using OSINT sources such as Google, Bing, Yahoo, Baid… | 23 | 11051 | maintenance |
| ankit0183/Wifi-Hacking A Python-based menu-driven CLI tool that automates Wi-Fi penetration testing by wrapping built-in Kali Linux wireless tools. It supports mo… | 56 | 2733 | active |
| 7h30th3r0n3/Evil-M5Project Evil-M5Project is a C++ firmware/tool for M5Stack devices (Cardputer, AtomS3, Fire, Core2) that scans, monitors, and interacts with WiFi ne… | 71 | 2703 | active |
| TermuxHackz/X-osint X-osint is an open-source Python-based OSINT framework for gathering information about phone numbers, email addresses, IP addresses, VINs, … | 69 | 2701 | active |
| samugit83/redamon RedAmon is an AI-powered agentic red team framework that automates offensive security operations end-to-end, chaining reconnaissance, explo… | 81 | 2681 | active |
| arthaud/git-dumper git-dumper is a Python CLI tool that reconstructs a full git repository from a website that exposes its .git directory, even when directory… | 83 | 2678 | stable |
| caido/caido Caido is a lightweight web security auditing toolkit and HTTP proxy for intercepting, viewing, and modifying traffic between browsers and w… | 94 | 2672 | active |
| thewhiteh4t/pwnedOrNot pwnedOrNot is a Python command-line OSINT tool that checks email addresses against the HaveIBeenPwned v3 API for past breaches and then sea… | 62 | 2656 | active |
| honmashironeko/ProxyCat ProxyCat is a self-hosted tunnel proxy pool middleware that turns short-lived proxy IPs into a stable fixed tunnel endpoint over HTTP/SOCKS… | 86 | 2632 | active |
| SummerSec/ShiroAttack2 A Java-based exploitation tool for the Apache Shiro-550 rememberMe deserialization vulnerability, offering both a JavaFX GUI and a CLI. It … | 82 | 2630 | active |
| rbsec/sslscan sslscan is a command-line tool that tests SSL/TLS enabled services to discover supported cipher suites, protocols, key exchange groups, and… | 88 | 2628 | active |
| googleprojectzero/winafl WinAFL is a Windows fork of American Fuzzy Lop (AFL) for coverage-guided fuzzing of Windows binaries, including closed-source black-box tar… | 61 | 2612 | active |
| BishopFox/cloudfox CloudFox is an open-source command line tool by Bishop Fox that automates situational awareness and enumeration in cloud environments, prim… | 88 | 2598 | active |
| SysReptor SysReptor is a customizable pentest reporting platform for penetration testers and red teamers, supporting report design in HTML, writing i… | 97 | 2592 | active |
| lgandx/PCredz PCredz is a Python CLI tool that extracts credentials and authentication tokens (NTLM, Kerberos, HTTP Basic, FTP, SMTP, IMAP, POP3, LDAP, S… | 60 | 2577 | active |
| s0lst1c3/eaphammer EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks, including credential stealing and hostil… | 23 | 2572 | active |
| splunk/attack_range Splunk Attack Range is a tool that builds instrumented, vulnerable lab environments in the cloud (AWS, Azure, GCP) or locally using Terrafo… | 81 | 2562 | active |
| kpcyrd/sn0int sn0int is a semi-automatic OSINT framework and package manager written in Rust that enumerates attack surface by processing public informat… | 66 | 2553 | active |
| monoxgas/sRDI sRDI is a shellcode implementation of Reflective DLL Injection that converts DLL files into position-independent shellcode via a compiled P… | 32 | 2550 | stable |
| x90skysn3k/brutespray Brutespray is a fast, multi-protocol credential brute-forcing tool written in Go. It parses scan output from Nmap, Nessus, Nexpose, JSON, a… | 92 | 2541 | active |
| epsylon/ufonet UFONet is a free, P2P and cryptographic 'disruptive toolkit' written in Python for performing DoS and DDoS attacks at Layer 7 (HTTP) via Op… | 79 | 2535 | active |
| Nidhogg Nidhogg is an open-source Windows x64 kernel rootkit written in C++ that demonstrates a wide range of rootkit techniques such as process, t… | 84 | 2534 | active |
| m4ll0k/SecretFinder SecretFinder is a Python CLI script based on LinkFinder that discovers sensitive data like API keys, access tokens, and JWTs in JavaScript … | 32 | 2534 | active |
| nil0x42/phpsploit PhpSploit is a full-featured command-and-control (C2) framework that persists on a webserver via a stealthy single-line PHP backdoor. It is… | 23 | 2492 | active |
| sabri-zaki/EasY_HaCk EasY_HaCk is a Termux-based penetration testing menu tool that bundles and installs tools like Metasploit, Nmap, SQLmap, and recon-ng for n… | 39 | 2487 | active |
| TH3xACE/SUDO_KILLER SUDO_KILLER is a Shell-based security tool that audits Linux systems for sudo-related privilege escalation vectors, including misconfigurat… | 61 | 2484 | active |
| m0nad/Diamorphine Diamorphine is a loadable kernel module (LKM) rootkit for Linux kernels 2.6.x through 6.x on x86/x86_64 and ARM64. It demonstrates rootkit … | 64 | 2481 | active |
| noob-hackers/hacklock Hacklock is a bash-based Termux tool that generates pattern phishing pages to capture an Android victim's unlock pattern via a shared link … | 50 | 2468 | active |
| Notselwyn/CVE-2024-1086 A proof-of-concept local privilege escalation exploit for CVE-2024-1086, a double-free vulnerability in the Linux kernel's nf_tables subsys… | 16 | 2457 | stable |
| ZerBea/hcxtools A set of C command-line tools that convert WiFi packet captures (pcap/pcapng) into hash formats compatible with Hashcat and John the Ripper… | 77 | 2454 | active |
| assetnote/react2shell-scanner A Python command-line scanner that detects RCE vulnerabilities CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server… | 38 | 2453 | active |
| dirkjanm/BloodHound.py BloodHound.py is a Python-based data ingestor for BloodHound that enumerates Active Directory domains, collecting users, groups, computers,… | 50 | 2447 | active |
| GiacomoLaw/Keylogger A simple, bare-bones keylogger that records keystrokes and saves them to a local log file, with separate implementations for Windows, Linux… | 35 | 2447 | active |
| NetSPI/MicroBurst MicroBurst is a PowerShell toolkit for assessing Microsoft Azure security, including service discovery, weak configuration auditing, and po… | 69 | 2442 | active |
| drk1wi/Portspoof Portspoof is a lightweight C++ tool that emulates open TCP ports and convincing service signatures across all 65535 ports, making port scan… | 79 | 2425 | active |
| DataDog/stratus-red-team Stratus Red Team is a self-contained Go CLI that emulates granular, actionable cloud attack techniques mapped to MITRE ATT&CK, against AWS,… | 98 | 2421 | active |
| LoRexxar/Kunlun-M Kunlun-M is an open-source static code analysis (SAST) tool that detects security vulnerabilities in PHP, JavaScript/Node.js, Python, Golan… | 100 | 2418 | active |
| OpenBullet OpenBullet 2 is a cross-platform automation suite built on .NET for performing HTTP requests against target web applications and processing… | 91 | 2411 | active |
| jorhelp/Ingram Ingram is a Python-based vulnerability scanning framework targeting network cameras (IP/CCTV devices). It integrates known exploits for com… | 67 | 2400 | active |
| lijiejie/BBScan BBScan is a fast, lightweight, high-concurrency web vulnerability scanner written in Python. It helps penetration testers quickly identify … | 23 | 2374 | active |
| bigbrodude6119/flipper-zero-evil-portal A Flipper Zero application that turns the Wi-Fi dev board (ESP32) into an open access point serving a fake captive portal login page. Captu… | 20 | 2373 | active |
| jtpereyda/boofuzz boofuzz is a Python-based network protocol fuzzing framework and the successor to the Sulley Fuzzing Framework. It provides data generation… | 66 | 2365 | active |
| david942j/one_gadget A Ruby command-line tool that finds one-gadget RCE candidates (execve('/bin/sh',...) call sites) in libc binaries for CTF pwn challenges. I… | 97 | 2359 | active |
| googleprojectzero/fuzzilli Fuzzilli is a coverage-guided fuzzer for JavaScript engines, built in Swift by Google Project Zero. It generates test programs via a custom… | 67 | 2354 | active |
| BeichenDream/GodPotato GodPotato is a C# Windows privilege escalation tool that abuses a DCOM/RPCSS oxid resolution defect to elevate from a service account with … | 23 | 2353 | stable |
| MEDUSA MEDUSA is a modular automation framework and script repository for runtime testing and investigating Android and iOS apps, built on FRIDA. … | 79 | 2352 | active |
| AabyssZG/SpringBoot-Scan SpringBoot-Scan is an open-source penetration testing framework targeting Spring Boot applications, written in Python. It scans for sensiti… | 47 | 2352 | active |
| MegaManSec/SSH-Snake SSH-Snake is a self-propagating, file-less bash script that automatically discovers SSH private keys on a system, attempts to connect to re… | 10 | 2341 | active |
| ssl/ezXSS ezXSS is a self-hosted PHP application that helps penetration testers and bug bounty hunters detect and exploit (blind) cross-site scriptin… | 60 | 2339 | active |
| safebuffer/vulnerable-AD A PowerShell script that configures a Windows Server domain controller into a deliberately vulnerable Active Directory environment for prac… | 32 | 2333 | active |
| zakirkun/deep-eye Deep Eye is an AI-driven penetration testing CLI that orchestrates multiple LLM providers (OpenAI, Claude, Gemini, OLLAMA, Groq, and others… | 64 | 2330 | active |
| p0dalirius/Coercer Coercer is a Python CLI tool that automatically coerces Windows servers to authenticate to an arbitrary machine via multiple RPC methods ov… | 55 | 2323 | active |
| CravateRouge/bloodyAD bloodyAD is a Python CLI tool for Active Directory privilege escalation that performs specific LDAP calls against domain controllers. It su… | 95 | 2314 | active |
| 1N3/BruteX BruteX is a shell-based CLI tool that automatically brute forces all services running on a target, enumerating open ports, usernames, and p… | 23 | 2309 | active |
| jofpin/trape Trape is an OSINT analysis and research tool for tracking people online and executing real-time social engineering attacks, built in Python… | 32 | 9055 | maintenance |
| n1nj4sec/pupy Pupy is an open-source, cross-platform (Windows, Linux, macOS, Android) command-and-control and post-exploitation framework written in Pyth… | 10 | 9000 | maintenance |
| DanOps-1/Gpt-Agreement-Payment A Python toolkit that reverse-engineers and replays the end-to-end ChatGPT Plus/Team/Pro subscription payment flow (Stripe Checkout, PayPal… | 50 | 2288 | active |
| Railgun Railgun is a GUI-based penetration testing tool that automates common tasks from manual pentesting experience. It integrates port scanning,… | 30 | 2286 | active |
| API-Security/APIKit APIKit is a BurpSuite extension (Java plugin) that discovers, scans, and audits leaked API documentation such as GraphQL, OpenAPI/Swagger, … | 23 | 2286 | active |
| spyboy-productions/CloakQuest3r CloakQuest3r is a Python-based open-source security research tool that identifies potential origin IP exposure of websites protected by Clo… | 52 | 2269 | active |
| kismetwireless/kismet Kismet is a wireless network detector, sniffer, and intrusion detection system for Wi-Fi, Bluetooth, SDR, and other wireless protocols. It … | 77 | 2244 | active |
| e0e1-wx A Windows GUI tool (PySide6, Python 3.10+) for analyzing and penetration-testing WeChat mini-programs locally. It automates mini-program pa… | 74 | 2243 | active |
| lefayjey/linWinPwn linWinPwn is a bash script that wraps and streamlines a large set of Active Directory penetration testing tools such as impacket, bloodhoun… | 76 | 2228 | active |
| pen4uin/java-memshell-generator A highly customizable Java in-memory webshell (memshell) generator supporting multiple middleware servers, frameworks, shell types, and out… | 34 | 2228 | active |
| punk-security/dnsReaper DNS Reaper is a Python CLI tool that scans DNS records for subdomain takeover vulnerabilities using over 50 signatures, at roughly 50 subdo… | 41 | 2221 | active |
| mandiant/flare-fakenet-ng FakeNet-NG is a dynamic network analysis tool that intercepts and redirects network traffic while simulating legitimate network services. I… | 60 | 2215 | active |
| login-securite/lsassy Lsassy is a Python CLI tool that remotely extracts credentials from the LSASS process memory of Windows hosts over the network. It uses imp… | 78 | 2214 | active |
| ZerBea/hcxdumptool hcxdumptool is a C-based command-line tool that captures packets from WLAN devices and runs layer 2 attacks against the WPA protocol to fin… | 76 | 2209 | active |
| bytecode77/r77-rootkit r77 is a fileless ring 3 (userland) rootkit for Windows that hides files, processes, registry keys, services, and network connections using… | 71 | 2199 | active |
| dronesploit/dronesploit DroneSploit is a Metasploit-style console framework for pentesting commercial drones, built on sploitkit. It gathers drone-focused hacking … | 23 | 2194 | active |
| 0vercl0k/rp rp++ is a fast C++ command-line tool that finds ROP (Return-Oriented Programming) gadgets in PE, ELF, and Mach-O binaries for x86, x64, ARM… | 38 | 2193 | active |
| zmap/zgrab2 ZGrab2 is a fast, modular application-layer network scanner written in Go, designed for large Internet-wide surveys in tandem with ZMap. It… | 73 | 2190 | active |
| vulhub/java-chains Java Chains is a self-hosted web platform for generating Java exploitation payloads, aimed at security researchers. It supports common Java… | 83 | 2166 | active |
| ffffffff0x/f8x f8x is a Bash-based automation deployment script that installs 100+ security and development tools for red team, blue team, CTF, and cloud-… | 67 | 2166 | active |
| zhzyker/dismap Dismap is a Go-based asset discovery and identification tool that fingerprints web, TCP, UDP, and TLS services using a rule base of 4500+ w… | 23 | 2165 | active |
| bit4woo/domain_hunter_pro Domain Hunter Pro is a Burp Suite plugin (Java jar) for automated domain and subdomain collection, web title fetching, and target managemen… | 67 | 2151 | active |
| chainreactors/gogo gogo is a high-performance, highly configurable automated scanning engine written in pure Go for red team operations. It combines port scan… | 85 | 2141 | active |
| fortra/nanodump NanoDump is a C-based tool that creates minidumps of the Windows LSASS process using a variety of stealthy handle-acquisition and dumping t… | 32 | 2140 | active |