Open-source penetration-testing software
861 open-source libraries, tools and applications tagged penetration-testing, ranked by how closely penetration-testing is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
861 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| fortra/nanodump NanoDump is a C-based tool that creates minidumps of the Windows LSASS process using a variety of stealthy handle-acquisition and dumping t… | 32 | 2140 | active |
| defparam/smuggler Smuggler is a Python 3 command-line tool that tests web servers and proxies for HTTP request smuggling and desync vulnerabilities. It fires… | 32 | 2112 | active |
| kkbo8005/mitan Mitan (密探) is an all-in-one penetration testing and security assessment desktop application integrating asset mapping, subdomain brute-forc… | 92 | 2111 | active |
| Sh1Yo/x8 x8 is a hidden parameter discovery suite written in Rust for security testing of web applications. It brute-forces parameter names against … | 23 | 2096 | active |
| rebootuser/LinEnum LinEnum is a shell script that performs scripted local Linux enumeration and privilege escalation checks. It gathers system, user, network,… | 32 | 8039 | maintenance |
| SamueleAmato/sosec sosec is a Python command-line toolkit with a terminal UI for automated credential testing and HTTP request orchestration against social me… | 57 | 2082 | active |
| lukechilds/reverse-shell A hosted service (reverse-shell.sh) that generates reverse shell payloads on demand; piping its URL output into sh on a target spawns a she… | 59 | 2069 | active |
| cifertech/nRFBox nRFBox is an open-source ESP32-based handheld tool that scans, analyzes, jams, and spoofs BLE, Wi-Fi, and 2.4GHz signals using an nRF24L01 … | 69 | 2060 | active |
| ine-labs/AWSGoat AWSGoat is a deliberately vulnerable AWS infrastructure deployed via Terraform, featuring OWASP Top 10 web vulnerabilities and cloud miscon… | 39 | 2055 | active |
| GhostPack/Certify Certify is a C# command-line tool for enumerating and abusing misconfigurations in Active Directory Certificate Services (AD CS). It was re… | 76 | 2044 | active |
| berdav/CVE-2021-4034 A proof-of-concept exploit and vulnerability checker for CVE-2021-4034 (PwnKit), a polkit pkexec local privilege escalation vulnerability i… | 32 | 2044 | stable |
| shivaya-dav/DogeRat DogeRat is a Telegram-controlled Android remote access tool (RAT) consisting of a Node.js/Express/Socket.IO server and a Kotlin Android APK… | 39 | 2038 | active |
| ASHWIN990/ADB-Toolkit ADB-Toolkit is a Bash script wrapping the Android Debug Bridge with 28 options plus a Metasploit section for testing and exploiting Android… | 23 | 2037 | active |
| wyzxxz/jndi_tool A Java-based JNDI exploitation tool that runs malicious RMI/LDAP reference servers to test and exploit JNDI injection vulnerabilities, incl… | 32 | 2017 | active |
| msoedov/agentic_security Agentic Security is an open-source LLM vulnerability scanner and AI red-teaming toolkit that probes large language models and agent workflo… | 83 | 2004 | active |
| t6x/reaver-wps-fork-t6x Reaver is a C-based command-line tool that performs brute force attacks against Wi-Fi Protected Setup (WPS) registrar PINs to recover WPA/W… | 41 | 1991 | active |
| MichaelGrafnetter/DSInternals DSInternals is a PowerShell module and .NET framework for working with Active Directory internals, including offline NTDS.DIT database pars… | 91 | 1971 | active |
| Ragnt/AngryOxide AngryOxide is an 802.11 WiFi attack tool written in Rust that provides a single-interface survey capability with automated attacks to captu… | 66 | 1967 | active |
| owtf/owtf OWASP OWTF (Offensive Web Testing Framework) is a penetration testing framework that unites multiple security tools and aligns testing work… | 83 | 1956 | active |
| intruder-io/autoswagger Autoswagger is a Python command-line tool that discovers Swagger/OpenAPI specifications, parses their endpoints, and automatically tests th… | 31 | 1956 | active |
| autoDecoder A modified version of the captcha-killer Burp Suite extension that intercepts captcha images from HTTP responses and recognizes them using … | 36 | 1954 | active |
| legba Legba is a fast, multiprotocol credentials bruteforcer, password sprayer, and enumerator written in Rust on top of the Tokio async runtime.… | 78 | 1950 | active |
| evildevill/instahack Instahack is a Bash and Python-based brute-force tool for testing Instagram account password strength, routing traffic through Tor for anon… | 59 | 1913 | active |
| joaoviictorti/RustRedOps RustRedOps is a collection of red team tools and technique implementations written in Rust, primarily targeting Windows. It provides workin… | 50 | 1904 | active |
| federicodotta/Brida Brida is a Burp Suite extension that bridges Burp Suite and Frida, letting testers invoke and manipulate an application's own methods while… | 43 | 1899 | active |
| liamg/traitor Traitor is a Go-based CLI tool that automatically exploits common Linux misconfigurations and known vulnerabilities (GTFOBins, pwnkit, dirt… | 23 | 7161 | maintenance |
| zakirkun/guardian-cli Guardian is a Python CLI tool that automates penetration testing workflows using LLM providers (OpenAI, Claude, Gemini, Ollama, and others)… | 63 | 1889 | active |
| pentestfunctions/BlueDucky BlueDucky is a Python tool that exploits CVE-2023-45866, an unauthenticated Bluetooth peering vulnerability, to execute keystroke injection… | 53 | 1885 | active |
| wapiti-scanner/wapiti Wapiti is an open-source black-box web vulnerability scanner written in Python that crawls deployed web applications and fuzzes scripts and… | 95 | 1877 | active |
| 0xKayala/NucleiFuzzer NucleiFuzzer is a Python-based automation tool that combines URL discovery tools (ParamSpider, Waybackurls, Gauplus, Hakrawler, Katana) wit… | 63 | 1863 | active |
| trustedsec/hate_crack hate_crack is a Python tool by TrustedSec that automates password cracking methodologies on top of Hashcat, orchestrating wordlists, masks,… | 93 | 1862 | active |
| selinuxG/Golin Golin is a Go-based security assessment tool combining asset discovery, port/service scanning, weak password brute-forcing for 40+ services… | 62 | 1856 | active |
| bvcyber/CVE-2020-1472 A Python CLI script that tests domain controllers for the ZeroLogon vulnerability (CVE-2020-1472) using the Impacket library. It attempts t… | 41 | 1837 | stable |
| pandasec888/taowu-cobalt_strike Taowu is a red team automation plugin (Aggressor script) for the Cobalt Strike platform, bundling a large collection of post-exploitation m… | 52 | 1836 | active |
| White-hua/Apt_t00ls A Java-based exploitation tool that aggregates proof-of-concept and weaponized exploits for high-severity vulnerabilities in Chinese enterp… | 23 | 1828 | active |
| JesseCHale/HaleHound-CYD HaleHound-CYD is a multi-protocol offensive security toolkit firmware for the ESP32 Cheap Yellow Display, offering 40+ attack modules acros… | 83 | 1819 | active |
| xaitax/Chrome-App-Bound-Encryption-Decryption A Windows post-exploitation research tool that bypasses Chromium's App-Bound Encryption using direct syscall-based reflective process hollo… | 58 | 1813 | active |
| wagiro/BurpBounty Burp Bounty (Scan Check Builder) is a Burp Suite extension that lets users improve Burp's active and passive web vulnerability scanners wit… | 23 | 1812 | active |
| wallarm/gotestwaf GoTestWAF is a Go-based tool that simulates OWASP and API attacks (SQL injection, XSS, etc.) across REST, GraphQL, gRPC, SOAP, and XMLRPC p… | 88 | 1811 | active |
| doyensec/inql InQL is an open-source Burp Suite extension for advanced GraphQL security testing. It provides schema introspection, vulnerability detectio… | 78 | 1811 | active |
| emp3r0r emp3r0r is an open-source post-exploitation framework and command-and-control (C2) system written in Go, targeting Linux and Windows hosts.… | 95 | 1790 | active |
| D4Vinci/One-Lin3r One-Lin3r is a lightweight, modular Python framework that provides a searchable database of over 176 one-liner commands for penetration tes… | 54 | 1790 | active |
| kost/dvcs-ripper dvcs-ripper is a set of Perl command-line tools that download (rip) web-accessible version control repositories such as GIT, SVN, Mercurial… | 32 | 1789 | stable |
| GoSecure/pyrdp PyRDP is a Python Remote Desktop Protocol (RDP) Monster-in-the-Middle (MITM) tool and library. It intercepts RDP connections to capture cre… | 56 | 1786 | active |
| R4gd0ll/I-Wanna-Get-All A comprehensive Java post-exploitation vulnerability exploitation tool integrating 470 exploit modules for detection and attack of known vu… | 54 | 1781 | active |
| ron190/jsql-injection jSQL Injection is a free, open-source Java application for automatic SQL database injection, used to find and extract database information … | 81 | 1780 | active |
| quentinhardy/odat ODAT (Oracle Database Attacking Tool) is an open-source Python penetration testing tool for assessing the security of remote Oracle Databas… | 53 | 1776 | active |
| j3ers3/Hello-Java-Sec A deliberately vulnerable Java Spring Boot application demonstrating common web vulnerabilities (SQLi, XSS, RCE, deserialization, SSTI, SSR… | 24 | 1767 | active |
| MatheuZSecurity/Singularity Singularity is a stealthy Linux kernel module (LKM) rootkit targeting modern 6.x kernels, using ftrace-based syscall hooking to hide proces… | 61 | 1766 | active |
| xmendez/wfuzz Wfuzz is a Python-based command-line web application fuzzer that replaces a FUZZ keyword in HTTP requests with values from configurable pay… | 54 | 6588 | maintenance |
| qi4L/JYso JYso is a Java-based offensive security tool that combines the capabilities of ysoserial (Java deserialization gadget generation) and JNDIE… | 77 | 1759 | active |
| wiire-a/pixiewps Pixiewps is a C command-line utility that brute-forces Wi-Fi Protected Setup (WPS) PINs offline, exploiting low- or non-entropy software im… | 54 | 1750 | active |
| zalexdev/strykerapp StrykerOSS is a free, open-source mobile penetration testing suite for rooted Android devices that bundles network, wireless, and web secur… | 98 | 1726 | active |
| cr0hn/dockerscan DockerScan is a comprehensive Docker security scanner written in Go that scans containers, images, and registries using multiple techniques… | 90 | 1722 | active |
| Pentest AI pentest-ai is an MIT-licensed local CLI and MCP server that turns Claude Code (or any LLM) into an offensive security assistant, pairing 50… | 79 | 1717 | active |
| MorDavid/BruteForceAI BruteForceAI is a Python-based penetration testing tool that uses LLMs (via Ollama or Groq) to automatically analyze login page HTML and id… | 57 | 1715 | active |
| dolevf/Damn-Vulnerable-GraphQL-Application Damn Vulnerable GraphQL Application (DVGA) is an intentionally insecure GraphQL service built for learning and practicing GraphQL security … | 30 | 1714 | active |
| dafthack/MFASweep MFASweep is a PowerShell script that attempts to log in to multiple Microsoft services with provided credentials to detect whether MFA is e… | 63 | 1709 | active |
| S3cur3Th1sSh1t/PowerSharpPack PowerSharpPack wraps many useful offensive C# security projects (Seatbelt, Rubeus, SharpUp, winPEAS, etc.) into PowerShell scripts for easy… | 36 | 1707 | active |
| whwlsfb/JDumpSpider JDumpSpider is a Java CLI tool that extracts sensitive information (datasource credentials, config properties, Redis configs, Shiro keys, u… | 66 | 1690 | active |
| vladko312/SSTImap SSTImap is a Python-based penetration testing tool that automatically detects and exploits Server-Side Template Injection (SSTI) and code i… | 82 | 1679 | active |
| dirkjanm/krbrelayx A Python toolkit for abusing Kerberos in Active Directory environments, including Kerberos relaying and unconstrained delegation attacks. I… | 61 | 1676 | active |
| rebeyond/Behinder Behinder ('冰蝎') is a cross-platform Java client for managing encrypted webshells on compromised web servers running PHP, Java, or .NET. It … | 23 | 6199 | maintenance |
| cddmp/enum4linux-ng enum4linux-ng is a Python rewrite of the enum4linux.pl Windows/Samba enumeration tool, wrapping Samba utilities like nmblookup, net, rpccli… | 69 | 1672 | active |
| whwlsfb/BurpCrypto BurpCrypto is a Burp Suite extension that encrypts Intruder payloads with algorithms like AES, RSA, and DES, or by executing arbitrary Java… | 23 | 1652 | active |
| shekyan/slowhttptest SlowHTTPTest is a highly configurable command-line tool that simulates Application Layer Denial of Service attacks by prolonging HTTP conne… | 84 | 1650 | active |
| 4lbH4cker/ALHacking ALHacking is a shell-script-based toolkit bundling a menu of so-called ethical hacking utilities, including social media account attacks, p… | 32 | 1648 | active |
| coffinxp/loxs Loxs is a Python-based multi-vulnerability scanner for web applications that detects SQL injection, XSS, LFI, open redirect, and CRLF injec… | 46 | 1622 | active |
| Orange-Cyberdefense/ocd-mindmaps A collection of interactive mindmaps from Orange Cyberdefense covering offensive security and penetration testing methodologies, published … | 33 | 1614 | active |
| repplus/rep-chrome rep+ is a Chrome DevTools extension inspired by Burp Suite's Repeater that captures and replays HTTP requests with modified methods, header… | 48 | 1610 | active |
| liamg/gitjacker Gitjacker is a Go CLI tool that downloads and reconstructs git repositories from websites where the .git directory has been mistakenly expo… | 44 | 1610 | active |
| AlisamTechnology/ATSCAN ATSCAN is a Perl-based command-line scanner for mass dork searching and vulnerability exploitation. It combines search engine dorking with … | 23 | 1589 | active |
| ChipWhisperer ChipWhisperer is an open-source toolchain for hardware security research, providing capture hardware designs, FPGA/USB firmware, and a Pyth… | 96 | 1578 | active |
| stealthcopter/deepce DEEPCE is a single-file pure-shell script for enumerating Docker environments and attempting privilege escalation and container escapes. It… | 55 | 1578 | active |
| moom825/xeno-rat Xeno-RAT is an open-source remote access tool (RAT) written in C# for remotely controlling Windows 10/11 machines. It includes features suc… | 18 | 1570 | active |
| OWASP/QRLJacking QRLJacking is an OWASP project documenting and exploiting the Quick Response Code Login Jacking attack vector, which hijacks user sessions … | 44 | 1567 | active |
| Tsojan/TsojanScan TsojanScan is an integrated BurpSuite plugin for vulnerability detection that bundles multiple common vulnerability POCs into a single exte… | 84 | 1565 | active |
| Gowtham-Darkseid/AutoPentestX AutoPentestX is a Python-based automated penetration testing toolkit that scans targets for vulnerabilities and generates security reports.… | 43 | 1562 | active |
| XSS Hunter XSS Hunter Express is a self-hosted service for tracking and detecting blind cross-site scripting (XSS) vulnerabilities via injected payloa… | 32 | 1561 | active |
| LitterBox LitterBox is a self-hosted payload-analysis sandbox for red teams that runs static, dynamic, and EDR-based analysis on samples and produces… | 57 | 1544 | active |
| bugbasesecurity/pentest-copilot Pentest Copilot is an open-source, AI-driven penetration testing agent that connects to a Kali attack box, autonomously runs security tools… | 61 | 1531 | active |
| webpwnized/mutillidae OWASP Mutillidae II is a deliberately vulnerable PHP web application used as a target for web-security training and practice. It includes o… | 75 | 1527 | active |
| nikitastupin/clairvoyance Clairvoyance is a Python CLI tool that recovers a GraphQL API's schema even when introspection is disabled, by probing field and type names… | 51 | 1527 | active |
| nemesida-waf/waf-bypass WAF Bypass Tool is an open-source Python CLI tool that tests web application firewalls for false positives and false negatives using predef… | 77 | 1519 | active |
| Goby Goby is a network security assessment tool that maps an organization's attack surface and scans for known vulnerabilities and weak password… | 23 | 1519 | active |
| assetnote/nowafpls nowafpls is a Jython-based Burp Suite plugin that bypasses web application firewalls (WAFs) by inserting junk data into HTTP request bodies… | 35 | 1518 | active |
| ztgrace/changeme changeme is a Python CLI tool that scans networks for devices and services using default or backdoor credentials. Credential definitions ar… | 33 | 1517 | active |
| Greenwolf/ntlm_theft ntlm_theft is a Python3 CLI tool that generates 21 different types of NTLMv2 hash theft files (e.g., .url, .scf, .docx, .pdf, .jnlp) that t… | 75 | 1503 | active |
| Meckazin/ChromeKatz ChromeKatz is a set of offensive security tools (CookieKatz, ElevationKatz) written in C that dump cookies and decryption keys directly fro… | 62 | 1500 | active |
| inguardians/peirates Peirates is a Go-based, interactive Kubernetes penetration testing tool that automates privilege escalation, lateral movement, and cluster … | 99 | 1483 | active |
| Schira4396/VcenterKiller A Go-based all-in-one exploitation and verification tool targeting VMware vCenter, covering major CVEs such as CVE-2021-21972, CVE-2021-219… | 23 | 1482 | active |
| Fuzion24/JustTrustMe An Xposed module for rooted Android devices that disables SSL certificate pinning in apps, enabling traffic interception during security au… | 23 | 5368 | maintenance |
| urbanadventurer/username-anarchy Username Anarchy is a Ruby command-line tool that generates lists of likely usernames from people's first and last names for use in penetra… | 23 | 1480 | stable |
| v4lkyr0/Buildware-Tools Buildware-Tools is a Python-based terminal multitool combining OSINT reconnaissance, network diagnostics, Discord automation, cryptography … | 73 | 1479 | active |
| lengjibo/RedTeamTools A collection of red team tools written and modified by the author, primarily in C++ and Python. It includes utilities for AV bypass, privil… | 50 | 1473 | active |
| ssh-mitm/ssh-mitm SSH-MITM is an open-source man-in-the-middle SSH server for authorized security audits and malware analysis. It proxies SSH client-server c… | 84 | 1470 | active |
| epsylon/xsser XSSer is an automatic penetration testing framework for detecting, exploiting, and reporting cross-site scripting (XSS) vulnerabilities in … | 80 | 1470 | active |
| t3l3machus/psudohash psudohash is a Python CLI tool that generates millions of keyword-based password mutations for brute-force attacks and hash cracking. It mi… | 30 | 1470 | active |
| AhMyth/AhMyth-Android-RAT AhMyth is an open-source Android Remote Administration Tool (RAT) consisting of an Electron-based desktop control panel and an Android back… | 10 | 5312 | maintenance |
| OWASP/wrongsecrets OWASP WrongSecrets is a deliberately vulnerable Java application containing 50+ challenges that demonstrate how secrets are commonly miscon… | 97 | 1466 | active |