resource: penetration-testing
422 resources, primary matches first, then adoption-weighted; health v2 shown.
| Resource | Health v2 | Stars | Maturity |
|---|---|---|---|
| tanprathan/MobileApp-Pentest-Cheatsheet A curated cheat sheet and checklist of high-value tools and techniques for mobile application penetration testing, mapped to the OWASP Mobi… | 32 | 5257 | maintenance |
| Cyber-Guy1/API-SecurityEmpire A curated collection of mindmaps, tips, and resources for API security and API penetration testing, based on the OWASP API Top 10. It cover… | 32 | 1445 | active |
| initstring/passphrase-wordlist A large wordlist of over 20 million passphrase phrases paired with two hashcat rule files that generate 1,000+ permutations per phrase for … | 37 | 1440 | active |
| pushsecurity/browser-identity-attacks-matrix A curated knowledge base of browser and identity attack techniques covering SaaS applications, identity providers, phishing, and browser-ba… | 64 | 1436 | active |
| msanft/CVE-2025-55182 A Python proof-of-concept and technical writeup for CVE-2025-55182, a remote code execution vulnerability in React Server Functions (as use… | 41 | 1431 | active |
| random-robbie/bruteforce-lists A collection of wordlist files for brute-forcing various targets, useful in bug bounty and penetration testing workflows. It is a data repo… | 68 | 1427 | active |
| bollwarm/SecToolSet A curated collection of GitHub security-related tools and projects, organized into categories like scanners, penetration testing, CTF pract… | 67 | 1423 | active |
| BypassAntiVirus A Chinese-language knowledge base and tool collection on antivirus evasion (bypassing AV) for remote access payloads, summarizing dozens of… | 32 | 5120 | maintenance |
| microsoft/MSRC-Security-Research A repository hosting security research published by the Microsoft Security Response Center (MSRC). It contains research papers, tools, and … | 32 | 1392 | active |
| Hack-with-Github/Free-Security-eBooks A curated list of links to free security, hacking, and penetration-testing eBooks available on the internet, organized by topic such as net… | 10 | 4974 | maintenance |
| kaiiyer/awesome-vulnerable A curated awesome-list of intentionally vulnerable applications and systems for practicing penetration testing. It catalogs vulnerable web … | 72 | 1381 | active |
| taielab/awesome-hacking-lists An auto-generated awesome list curating thousands of GitHub repositories (via the starred tool), with an emphasis on penetration testing to… | 57 | 1381 | active |
| nickvourd/Windows-Local-Privilege-Escalation-Cookbook A curated cookbook of Windows local privilege escalation techniques covering misconfiguration vulnerabilities, with sections for descriptio… | 60 | 1368 | active |
| harishsg993010/damn-vulnerable-MCP-server Damn Vulnerable MCP Server (DVMCP) is a deliberately vulnerable implementation of the Model Context Protocol built as an educational securi… | 45 | 1339 | active |
| may215/awesome-termux-hacking A curated awesome list of the best hacking and penetration testing tools that run in Termux on Android. It catalogs links to tools for OSIN… | 32 | 4767 | maintenance |
| Hacking-Notes/Hacker-Roadmap A curated roadmap repository guiding learners toward hacking and penetration testing proficiency through multiple pathways, including hobby… | 31 | 1315 | active |
| SexyBeast233/SecBooks A curated collection of Chinese-language cybersecurity articles and vulnerability write-ups aggregated from various security blogs and WeCh… | 48 | 1308 | active |
| phith0n/Mind-Map A curated collection of security-related mind maps covering topics like penetration testing, web application security, code auditing, XSS, … | 32 | 4600 | maintenance |
| bsauce/kernel-exploit-factory A curated collection of Linux kernel CVE exploits paired with preconfigured QEMU debug environments and analysis writeups. It lets research… | 70 | 1296 | active |
| kleo/evilportals A collection of captive portal templates for the Hak5 WiFi Pineapple's Evil Portal module, used to conduct phishing attacks against WiFi cl… | 68 | 1279 | active |
| topscoder/nuclei-wordfence-cve A collection of 80,000+ Nuclei vulnerability-scanning templates for WordPress core, plugins, and themes, generated daily from Wordfence thr… | 78 | 1278 | active |
| gmelodie/awesome-wordlists A curated awesome-list of wordlists for brute-forcing and fuzzing, covering enumeration, passwords, usernames, emails, and vulnerabilities.… | 73 | 1276 | active |
| osirislab/Hack-Night Hack Night is the open-source curriculum for NYU Tandon OSIRIS Lab's weekly thirteen-week offensive security training course. It provides l… | 32 | 1273 | active |
| beigeworm/BadUSB-Files-For-FlipperZero A collection of over 60 Ducky Script payloads curated for the FlipperZero BadUSB/BadKB feature, ranging from pranks to red team tools, most… | 71 | 1266 | active |
| rng70/TryHackMe-Roadmap A curated list of 350+ free TryHackMe rooms organized by cybersecurity topic, from Linux and Windows fundamentals to CTFs, forensics, and A… | 53 | 1266 | active |
| ax1sX/SecurityList A curated collection of web security and code audit resources, focused on Chinese enterprise software (OA systems), common Java components,… | 32 | 1262 | active |
| ybdt/exp-hub A curated collection of proof-of-concept (PoC) and exploit (Exp) scripts for reproducing known vulnerabilities, written primarily in HTML/J… | 76 | 1253 | active |
| jhaddix/tbhm A curated collection of tips, tricks, tools, and notes for web application security assessments and bug bounty hunting, maintained by Jason… | 32 | 4396 | maintenance |
| CHYbeta/Web-Security-Learning A curated collection of links and learning materials on web security, covering SQL injection, XSS, CSRF, SSRF, XXE, file upload vulnerabili… | 32 | 4299 | maintenance |
| emadshanab/Nuclei-Templates-Collection A curated collection of links to community Nuclei template repositories, aggregating vulnerability detection templates for the Nuclei scann… | 58 | 1225 | active |
| blackarrowsec/redteam-research A collection of proof-of-concept code and offensive security techniques published by the BlackArrow Red Team. It serves as a research repos… | 67 | 1219 | active |
| giuliacassara/awesome-social-engineering A curated awesome-list of social engineering resources including online courses, books, CTF events, tools, and OSINT links. It is aimed at … | 32 | 4244 | maintenance |
| t3l3machus/PowerShell-Obfuscation-Bible A curated educational reference of manual PowerShell script obfuscation techniques for bypassing signature-based antivirus detection, with … | 30 | 1204 | active |
| c0ny1/upload-labs A PHP-based deliberately vulnerable training range (CTF-style lab) that collects 20 levels of file upload vulnerabilities found in penetrat… | 23 | 4190 | maintenance |
| uphiago/recon-skills A curated pack of Markdown skill files documenting reconnaissance and penetration-testing procedures for web apps, APIs, authentication, cl… | 58 | 1199 | active |
| httpvoid/writeups A collection of application security research writeups by the HTTPVoid team, covering their own CVEs and technical analyses of public n-day… | 32 | 1199 | active |
| ayoubfathi/leaky-paths A curated wordlist of special web paths linked to sensitive APIs, devops internals, framework configs, and known misconfigurations. It is d… | 66 | 1193 | active |
| xiaoy-sec/Pentest_Note A Chinese-language penetration testing handbook (Pentest Handbook) organized as a GitBook wiki covering reconnaissance, initial access, pri… | 32 | 4132 | maintenance |
| tib36/PhishingBook A curated Chinese-language resource collection (memo/awesome list) of phishing simulation and red-blue team exercise materials, covering Of… | 30 | 1183 | active |
| mdisec/mdisec-twitch-yayinlari A companion repository for the MDISEC Twitch channel's live cybersecurity training streams, containing code written during each episode. It… | 71 | 1178 | active |
| yeswehack/vulnerable-code-snippets A collection of intentionally vulnerable code snippets (mostly PHP) published weekly by YesWeHack for practicing secure code analysis. Each… | 62 | 1176 | active |
| pe3zx/my-infosec-awesome A curated awesome-list of links, resources, and tools covering information security topics such as adversary simulation, application securi… | 74 | 1169 | active |
| Zeyad-Azima/Offensive-Resources A large curated collection of learning resources and labs for offensive security, covering topics like infrastructure, web, mobile, API, cl… | 48 | 1167 | active |
| foospidy/payloads A curated collection of web attack payloads (XSS, SQLi, CRLF, open redirect, password lists, and more) aggregated from many well-known secu… | 32 | 3979 | maintenance |
| 1N3/IntruderPayloads A curated collection of Burp Suite Intruder and BurpBounty payloads, fuzz lists, malicious file upload samples, and web pentesting methodol… | 32 | 3970 | maintenance |
| S3N4T0R-0X0/APTs-Adversary-Simulation A curated collection of simulated APT campaigns modeled on real-world state-sponsored threat groups from Russia, China, Iran, and North Kor… | 68 | 1123 | active |
| The-Hacker-Recipes/The-Hacker-Recipes The Hacker Recipes is a free and open-source collection of technical guides on hacking topics, with a focus on Active Directory and web ser… | 74 | 1118 | active |
| conwnet/wpa-dictionary A WPA/WPA2 password dictionary (wordlist) dataset intended for Wi-Fi password cracking, paired with a tutorial on using aircrack-ng on Linu… | 32 | 3794 | maintenance |
| rodolfomarianocy/OSCP-Tricks A curated OSCP preparation guide collecting tricks, tutorials, exercises, and machine recommendations for penetration testing. It organizes… | 63 | 1101 | active |
| Medicean/VulApps VulApps is a collection of Dockerized vulnerability environments (CVE-based, e.g. Struts2, Spring, Tomcat, Drupal) plus security tool envir… | 10 | 3783 | maintenance |
| SourByte05/Vulnerability-Wiki-PoC A continuously updated archive of 1-day/N-day vulnerability PoCs and reproduction write-ups focused on high-value enterprise assets such as… | 61 | 1099 | active |
| BMayhew/awesome-sites-to-test-on A curated awesome-style list of websites and applications for practicing software testing, including security, web, mobile, performance, AP… | 76 | 1096 | active |
| scadastrangelove/awesome-ai-security-tools A curated awesome-list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity. It catalogs tools ac… | 59 | 1095 | active |
| nixawk/pentest-wiki A free online knowledge library (wiki) of penetration testing and security resources, organized into sections like information gathering, v… | 32 | 3751 | maintenance |
| hak5/omg-payloads The official community payload library for Hak5's O.MG line of covert USB attack devices (Cable, Adapter, Plug, Unblocker). It contains Duc… | 57 | 1090 | active |
| javaweb-sec/javaweb-sec An open-source knowledge base and training project summarizing Java Web security topics, published as a GitBook at javasec.org. It explains… | 70 | 1083 | active |
| BC-SECURITY/Beginners-Guide-to-Obfuscation A hands-on workshop and course material from BC Security teaching malware obfuscation and defense evasion techniques on Windows. It covers … | 32 | 1080 | active |
| R00tS3c/DDOS-RootSec A curated archive of DDoS-related source code and tools, including Mirai and QBot botnet variants, scanners, exploits, Layer 4/7 attack met… | 32 | 1053 | active |
| qazbnm456/awesome-cve-poc A curated awesome-list collecting proof-of-concept exploits for known CVEs, organized by CVE identifier. It serves as a reference index lin… | 32 | 3527 | maintenance |
| safe6Sec/PentestDB A curated Chinese-language knowledge base collecting database exploitation techniques for penetration testing, covering MySQL, MSSQL, Oracl… | 32 | 1032 | active |
| safe6Sec/command A curated cheatsheet of commands commonly used in penetration testing and red team operations, covering command execution, file writing, an… | 65 | 1023 | active |
| maestron/botnets A curated collection of botnet source code samples gathered for educational and malware research purposes. It aggregates many historical bo… | 32 | 3335 | maintenance |
| kleiton0x00/Advanced-SQL-Injection-Cheatsheet A curated cheat sheet of advanced SQL injection queries and methodologies covering MySQL, PostgreSQL, Oracle, and MSSQL. It documents error… | 32 | 3248 | maintenance |
| Ascotbe/Kernelhub A curated collection of kernel privilege escalation vulnerabilities for Windows, Linux, and macOS, including exploit code, compilation envi… | 23 | 3196 | maintenance |
| GrrrDog/Java-Deserialization-Cheat-Sheet A curated cheat sheet for pentesters and security researchers covering deserialization vulnerabilities across Java/JVM serialization librar… | 32 | 3182 | maintenance |
| hookmaster/frida-all-in-one A Chinese-language handbook (《FRIDA操作手册》) collecting tutorials, scripts, and case studies for the Frida dynamic instrumentation toolkit. It… | 32 | 3148 | maintenance |
| l3m0n/pentest_study A Chinese-language study guide and tutorial repository for learning internal network (intranet) penetration testing from scratch, covering … | 32 | 3034 | maintenance |
| NoorQureshi/kali-linux-cheatsheet A community-maintained cheat sheet of Kali Linux commands and techniques for penetration testers, covering recon, enumeration, password cra… | 32 | 2988 | maintenance |
| Kitsun3Sec/Pentest-Cheat-Sheets A curated collection of penetration testing cheat sheets containing command snippets for reconnaissance, exploitation, and post-exploitatio… | 32 | 2931 | maintenance |
| HackJava/HackJava A curated Chinese-language collection of Java security learning resources covering vulnerability analysis, code auditing, security tools, a… | 32 | 2893 | maintenance |
| ExpLangcn/NucleiTP A continuously updated aggregation of Nuclei vulnerability POC templates collected from across the web, organized by risk level. It automat… | 32 | 2877 | maintenance |
| xuanhun/PythonHackingBook1 An open-source Chinese-language tutorial book, 'Python Hacking Programming: Rapid Introduction', teaching Python programming from basics th… | 32 | 2838 | maintenance |
| Voorivex/pentest-guide A curated penetration testing guide that reorganizes the OWASP Testing Guide v4 into 9 test classes with concrete test cases, plus 15 extra… | 32 | 2826 | maintenance |
| wtsxDev/Penetration-Testing A curated awesome-list of penetration testing resources, including tools, distributions, books, courses, vulnerability databases, and secur… | 32 | 2783 | maintenance |
| rewardone/OSCPRepo A consolidated collection of OSCP study resources, including CherryTree notebooks of commands and bookmarks, wordlists, and a Python recon … | 32 | 2752 | maintenance |
| Kayzaks/HackingNeuralNetworks A short educational course (article plus Python exercises) on attacking and defending neural networks, covering techniques like backdooring… | 32 | 2635 | maintenance |
| r0eXpeR/redteam_vul A curated Chinese-language reference list of high-value vulnerabilities commonly encountered during red team operations, covering systems l… | 32 | 2524 | maintenance |
| ashemery/exploitation-course A free online course on offensive security and reverse engineering (OSRE), originally taught at Champlain College, with labs, slides, notes… | 32 | 2523 | maintenance |
| r4j0x00/exploits A collection of public exploit proof-of-concepts written primarily in C and JavaScript, targeting CVEs such as CVE-2021-3156 (sudo heap ove… | 32 | 2521 | maintenance |
| aleenzz/Cobalt_Strike_wiki A Chinese-language wiki-style knowledge base documenting Cobalt Strike, a commercial post-exploitation and command-and-control framework us… | 32 | 2429 | maintenance |
| nebgnahz/awesome-iot-hacks A curated awesome-list of documented IoT hacks, security vulnerabilities, research reports, and communities. It serves as a reference catal… | 32 | 2425 | maintenance |
| S3cur3Th1sSh1t/Pentest-Tools A curated awesome-list of penetration testing tools, organized into categories such as privilege escalation, lateral movement, credential h… | 32 | 2411 | maintenance |
| helloexp/0day A continuously updated collection of exploits (EXP) and proofs-of-concept (POC) for vulnerabilities in various CMS platforms, systems, and … | 32 | 2364 | maintenance |
| Escapingbug/awesome-browser-exploit A curated awesome list of tutorials, articles, writeups, and resources about browser exploitation, covering engines like Chrome V8, IE/Chak… | 32 | 2295 | maintenance |
| cider-security-research/cicd-goat CI/CD Goat is a deliberately vulnerable CI/CD environment for learning CI/CD security through 11 capture-the-flag challenges. It runs local… | 23 | 2295 | maintenance |
| Snowming04/The-Hacker-Playbook-3-Translation A Chinese translation of The Hacker Playbook 3 (Red Team edition), a penetration testing book, published as a readable GitHub book with dow… | 32 | 2285 | maintenance |
| tanc7/hacking-books A curated collection of well-known cybersecurity and hacking books, including titles on penetration testing, exploitation, malware analysis… | 32 | 2285 | maintenance |
| bartblaze/PHP-backdoors A curated collection of PHP backdoor and webshell samples (e.g., c99Shell) intended for educational and testing purposes, including obfusca… | 32 | 2271 | maintenance |
| tiancode/learn-hacking A curated collection of 83 Chinese-language tutorial notes on penetration testing, ethical hacking, and reverse engineering using Kali Linu… | 70 | 2263 | maintenance |
| inonshk/31-days-of-API-Security-Tips A curated collection of 31 daily API security tips by Inon Shkedy, covering vulnerabilities like BOLA/IDOR, SSRF, mass assignment, and auth… | 32 | 2241 | maintenance |
| 0x90/wifi-arsenal A curated awesome-list of WiFi and 802.11 security tools and resources, organized by category such as attack/penetration testing, sniffing,… | 32 | 2206 | maintenance |
| 0xRadi/OWASP-Web-Checklist A comprehensive OWASP-based web application security testing checklist available as PDF, DOCX, and a copyable Trello board. It organizes hu… | 32 | 2203 | maintenance |
| S3cur3Th1sSh1t/Amsi-Bypass-Powershell A curated collection of PowerShell scripts demonstrating various Antimalware Scan Interface (AMSI) bypass and avoidance techniques gathered… | 32 | 2190 | maintenance |
| yadox666/The-Hackers-Hardware-Toolkit A curated catalog of over one hundred hardware gadgets for red team pentesters and security researchers, organized into eight categories su… | 32 | 2175 | maintenance |
| ckjbug/Hacking A curated collection of network security and hacking learning resources, including Kali Linux penetration testing materials, VPN/VPS setup … | 32 | 2168 | maintenance |
| hhhrrrttt222111/Ethical-Hacking-Tools A curated listing and usage guide of tools used for ethical hacking and penetration testing, covering tools like Metasploit, Wireshark, and… | 32 | 2168 | maintenance |
| sagishahar/lpeworkshop A free workshop covering local privilege escalation attack vectors on Windows and Linux, including slides, exercise worksheets, lab VMs, an… | 32 | 2124 | maintenance |
| FabioBaroni/awesome-exploit-development A curated list of books, tutorials, courses, tools, and vulnerable applications for learning exploit development. It aggregates learning re… | 32 | 2121 | maintenance |
| tom0li/collection-document A curated awesome-list of quality security articles covering penetration testing, cloud security, threat detection, Java code auditing, and… | 32 | 2116 | maintenance |
| 13o-bbr-bbq/machine_learning_security A collection of Python source code and educational materials combining machine learning with cybersecurity, including a training course for… | 69 | 2088 | maintenance |