resource: penetration-testing
422 resources, primary matches first, then adoption-weighted; health v2 shown.
| Resource | Health v2 | Stars | Maturity |
|---|---|---|---|
| api0cradle/UltimateAppLockerByPassList A curated collection of documented AppLocker bypass techniques for Windows, organized into verified, unverified, generic, and DLL-execution… | 32 | 2081 | maintenance |
| insightglacier/Dictionary-Of-Pentesting A curated collection of dictionaries and wordlists for penetration testing, SRC bug bounty hunting, bruteforcing, and fuzzing. It aggregate… | 23 | 2072 | maintenance |
| Hackplayers/hackthebox-writeups A community-maintained collection of writeups for HackTheBox boot2root machines and challenges, written in Spanish or English. Writeups for… | 32 | 2053 | maintenance |
| 0xSobky/HackVault A curated collection of web security payloads, regexes, and offensive/defensive hacking notes hosted primarily in a wiki. It serves as a re… | 32 | 2036 | maintenance |
| xl7dev/WebShell A curated collection of webshells and backdoors written in many languages (PHP, ASP, JSP, Python, etc.) for security research and penetrati… | 32 | 2009 | maintenance |
| Leezj9671/Pentest_Interview A curated collection of penetration testing and cybersecurity job interview notes from 2018-2019, including HR questions, technical questio… | 70 | 2001 | maintenance |
| sehno/Bug-bounty A curated collection of resources for bug bounty hunting, including a checklist, a toolkit of tools, and a list of public bug bounty progra… | 32 | 1967 | maintenance |
| JohnTroony/php-webshells A curated collection of common PHP webshells intended for penetration testing assignments and CTF challenges. It is an educational/offensiv… | 23 | 1956 | maintenance |
| p0dalirius/Awesome-RCE-techniques A curated awesome list documenting step-by-step techniques to achieve Remote Code Execution (RCE) on various applications such as CMSs, fra… | 32 | 1939 | maintenance |
| fabacab/awesome-lockpicking A curated awesome-list of guides, books, tools, events, communities, and research covering the security and compromise of locks, safes, and… | 32 | 1918 | maintenance |
| hongriSec/PHP-Audit-Labs A Chinese-language tutorial series on PHP code auditing by HongRi Security, covering common PHP function pitfalls and vulnerabilities in fr… | 32 | 1910 | maintenance |
| zbetcheckin/Security_list A curated awesome-list of security resources covering penetration testing, OSINT, malware analysis, CTFs, forensics, and more. It is a refe… | 32 | 1880 | maintenance |
| dsasmblr/hacking-online-games A curated list of tutorials, articles, tools, and resources for hacking online games, covering topics like reverse engineering game clients… | 32 | 1870 | maintenance |
| offensive-security/exploitdb-bin-sploits The legacy GitHub repository of Exploit-DB's binary exploit files (the old /sploits directory), now mirrored to GitLab. It archives compile… | 10 | 1828 | maintenance |
| ctfs/resources A community-maintained archive of guides, tools, and references for Capture The Flag (CTF) security competitions. It covers common CTF topi… | 32 | 1824 | maintenance |
| chvancooten/maldev-for-dummies A self-paced workshop with slides and exercises teaching the fundamentals of malware development for offensive security practitioners, cove… | 32 | 1817 | maintenance |
| tanprathan/OWASP-Testing-Checklist An Excel-based web application security testing checklist built on the OWASP Testing Guide v5 (WSTG), used to track completed and pending t… | 32 | 1808 | maintenance |
| uknowsec/Active-Directory-Pentest-Notes A personal study notebook of Active Directory domain penetration testing notes, organized as Markdown documents covering Kerberos, SPN, MS1… | 32 | 1808 | maintenance |
| Hack-with-Github/Windows A curated awesome-list of open-source tools for exploiting and post-exploiting Windows machines, covering privilege escalation, credential … | 10 | 1797 | maintenance |
| SecWiki/CMS-Hunter A curated collection of vulnerability test cases and proof-of-concept exploits for popular content management systems like WordPress, Jooml… | 32 | 1767 | maintenance |
| r3motecontrol/Ghostpack-CompiledBinaries A repository of pre-compiled Windows binaries for the GhostPack security toolset (e.g., Seatbelt, SafetyKatz, Rubeus) authored by harmj0y. … | 32 | 1744 | maintenance |
| LandGrey/webshell-detect-bypass A collection of research articles and evasion-ready webshell source code (PHP, JSP, ASP) demonstrating techniques to bypass professional we… | 32 | 1737 | maintenance |
| JoasASantos/Awesome-Red-Team-Operations A curated awesome-list of red team and penetration testing tools, organized by category such as PowerShell scripts, AMSI bypass, payload ho… | 32 | 1729 | maintenance |
| 1ndianl33t/Bug-Bounty-Roadmaps A curated collection of bug bounty and penetration testing roadmaps, mostly visual mindmaps and methodology documents created by well-known… | 32 | 1728 | maintenance |
| bowu678/php_bugs A curated collection of PHP code audit exercises explained step by step, based on CTF-style challenges covering sensitive functions and PHP… | 32 | 1723 | maintenance |
| cn0xroot/RFSec-ToolKit A curated collection of radio frequency communication protocol hacking tools, tutorials, and resources covering SDR hardware/software, GSM,… | 32 | 1721 | maintenance |
| BlackFan/client-side-prototype-pollution A curated collection of JavaScript libraries vulnerable to client-side prototype pollution via document.location parsing, along with useful… | 32 | 1644 | maintenance |
| NotSoSecure/password_cracking_rules A consolidated password cracking rules file for hashcat and John the Ripper, aggregating rules from sources like Hob0Rules, KoreLogic, NSAK… | 32 | 1629 | maintenance |
| MTK911/Attiny85 A collection of RubberDucky-style HID payloads for the DigiSpark Attiny85 microcontroller, written in C++ for the Arduino IDE. Payloads inc… | 32 | 1628 | maintenance |
| Wh0ale/SRC-experience A curated Chinese-language collection of links to bug bounty write-ups, cheatsheets, newsletters, and penetration testing resources. It agg… | 32 | 1626 | maintenance |
| wirasecure/pentest-notes A curated collection of penetration testing study notes, cheat sheets, and useful scripts gathered from across the internet. It covers topi… | 32 | 1618 | maintenance |
| api0cradle/LOLBAS A curated knowledge base documenting Windows binaries, scripts, and libraries that can be abused for 'Living Off The Land' attack technique… | 10 | 1613 | maintenance |
| mubix/post-exploitation A curated collection of post-exploitation command lists, binaries, and scripts for Linux, Windows, macOS, and BSD systems. It aggregates of… | 32 | 1585 | maintenance |
| we1h0/redteam-tips A curated collection of links to red team and penetration testing learning materials, mostly in Chinese, covering domain penetration, intra… | 32 | 1513 | maintenance |
| BaizeSec/bylibrary BaizeSec's public vulnerability knowledge base (Baige Wenku) collecting POCs, EXPs, and security articles maintained by the BaizeSec securi… | 32 | 1503 | maintenance |
| ibaiw/2023Hvv A curated Chinese-language intelligence feed aggregating vulnerability disclosures, POCs, and exploit write-ups collected during China's 20… | 28 | 1485 | maintenance |
| dineshshetty/Android-InsecureBankv2 A deliberately vulnerable Android banking application designed for security enthusiasts and developers to learn Android insecurities by tes… | 23 | 1470 | maintenance |
| trailofbits/ctf The CTF Field Guide is a free online book by Trail of Bits that teaches how to win Capture The Flag security competitions. It covers vulner… | 32 | 1438 | maintenance |
| Karanxa/Bug-Bounty-Wordlists A curated collection of wordlists commonly used during bug bounty hunting and web security testing, aggregated from public sources into one… | 23 | 1429 | maintenance |
| xiaoZ-hc/redtool A curated Chinese-language collection of red team tools and self-written shell scripts for offensive security testing, favoring DIY and les… | 32 | 1420 | maintenance |
| JoasASantos/Guide-CEH-Practical-Master A community study guide repository for the EC-Council Certified Ethical Hacker (Practical) exam, covering exam format, tips, tooling (Nmap,… | 32 | 1409 | maintenance |
| justinsteven/dostackbufferoverflowgood An intentionally vulnerable Win32 program plus a PDF tutorial teaching classic stack buffer overflow exploitation, created for CrikeyCon 20… | 32 | 1401 | maintenance |
| tennc/fuzzdb A curated dictionary collection of attack patterns, payloads, and brute-force wordlists for black-box application fault injection and resou… | 23 | 1399 | maintenance |
| threedr3am/JSP-WebShells A curated collection of JSP webshell samples demonstrating various implementation techniques such as class loading, bytecode manipulation, … | 32 | 1398 | maintenance |
| RenwaX23/XSS-Payloads A curated collection of cross-site scripting (XSS) vectors and payloads gathered since 2015 from websites, tweets, and books. It includes a… | 60 | 1391 | maintenance |
| jdonsec/AllThingsSSRF A curated collection of writeups, cheatsheets, videos, and books about Server-Side Request Forgery (SSRF) gathered in one repository. It se… | 32 | 1388 | maintenance |
| adon90/pentest_compilation A curated compilation of penetration testing commands, tips, and scripts covering enumeration, exploitation, privilege escalation, tunnelin… | 32 | 1362 | maintenance |
| rosehgal/BinExp A consolidated tutorial series on Linux binary exploitation, covering memory layout, buffer overflows, shellcode injection, ret2libc, forma… | 32 | 1357 | maintenance |
| sergey-pronin/Awesome-Vulnerability-Research A curated awesome-list of resources for vulnerability research, including books, articles, courses, tools, write-ups, and methodologies. It… | 32 | 1348 | maintenance |
| nocomp/Flipper_Zero_Badusb_hack5_payloads A collection of Hak5 BadUSB payloads adapted to run on the Flipper Zero device. The payloads are primarily PowerShell-based scripts used fo… | 32 | 1332 | maintenance |
| tenable/poc A centralized collection of proof-of-concept code for vulnerabilities discovered by Tenable researchers, organized by vendor and product. I… | 32 | 1330 | maintenance |
| aleenzz/MYSQL_SQL_BYPASS_WIKI A community wiki of notes and techniques for bypassing WAFs and filters in MySQL SQL injection attacks. It documents payload tricks, filter… | 32 | 1329 | maintenance |
| zxcvbn001/password_brute_dictionary A collection of Chinese-oriented password brute-force dictionaries derived from over 42 million leaked passwords across five platforms. It … | 32 | 1325 | maintenance |
| ansjdnakjdnajkd/iOS A curated cheatsheet of tools and resources for iOS and macOS penetration testing, covering static analysis, dynamic instrumentation, jailb… | 32 | 1307 | maintenance |
| WindowsExploits/Exploits A curated archive of compiled and tested public Windows exploits, written primarily in PowerShell. It serves as a reference collection for … | 32 | 1303 | maintenance |
| RistBS/Awesome-RedTeam-Cheatsheet A curated cheatsheet repository of red team techniques, focused heavily on Active Directory attacks, PowerShell tricks, enumeration, privil… | 32 | 1295 | maintenance |
| CHYbeta/Software-Security-Learning A curated collection of links, tutorials, courses, and tools for learning software security, with a strong emphasis on binary security and … | 32 | 1279 | maintenance |
| S3cur3Th1sSh1t/OffensiveVBA A curated collection of offensive VBA macro templates for code execution and antivirus evasion in Microsoft Office documents. It aggregates… | 32 | 1276 | maintenance |
| Jack-Liang/kalitools A community-driven translation project (KTTV) that localizes the Kali Linux tools documentation from tools.kali.org into Chinese. It is a c… | 32 | 1267 | maintenance |
| Ignitetechnologies/Vulnhub-CTF-Writeups A curated cheatsheet of links to Vulnhub CTF and boot-to-root lab writeups published on Hacking Articles. It helps CTF players and beginner… | 32 | 1255 | maintenance |
| chriskaliX/AD-Pentest-Notes A set of Chinese-language study notes on internal network and Active Directory domain penetration testing, covering reconnaissance, SPN sca… | 32 | 1254 | maintenance |
| Kyuu-Ji/Awesome-Azure-Pentest A curated awesome-list of tools, articles, labs, talks, and books for penetration testing and securing Microsoft Azure and Microsoft 365 en… | 32 | 1220 | maintenance |
| Stardustsky/SaiDict A curated collection of attack dictionaries for penetration testing, including weak passwords, common usernames, sensitive directory and fi… | 32 | 1219 | maintenance |
| struct/mms A collection of slides from a Black Hat training course on memory safety in C/C++, covering vulnerability discovery, exploitation, custom m… | 32 | 1219 | maintenance |
| shmilylty/awesome-hacking A curated awesome-list (Chinese version of awesome-hacking) collecting tutorials, tools, Docker images, and resources for hacking, penetrat… | 32 | 1205 | maintenance |
| saisathvik1/OSCP-Cheatsheet A community-maintained OSCP exam preparation cheatsheet covering penetration testing commands, privilege escalation paths, and important fi… | 27 | 1203 | maintenance |
| Ershu1/2021_Hvv A community-curated repository of resources related to China's HVV (HW, 'HuWang') offensive/defensive security exercise, collecting tools, … | 32 | 1200 | maintenance |
| SkyBlueEternal/thinkphp-RCE-POC-Collection A curated collection of proof-of-concept payloads for ThinkPHP 5.x remote code execution and SQL injection vulnerabilities. It documents ex… | 32 | 1193 | maintenance |
| mvelazc0/defcon27_csharp_workshop A Defcon 27 workshop repository with 8 hands-on labs teaching how to write custom backdoor payloads in C# targeting C2 frameworks like Meta… | 32 | 1190 | maintenance |
| Tib3rius/Pentest-Cheatsheets A collection of penetration testing cheatsheets compiled into a Sphinx-based HTML documentation site. It serves as a quick reference guide … | 32 | 1176 | maintenance |
| ctf-wiki/ctf-tools A curated collection of tools, scripts, and security conference materials for CTF (Capture The Flag) competitions, organized by category (c… | 32 | 1176 | maintenance |
| xtiankisutsa/awesome-mobile-CTF A curated awesome-list of mobile-focused CTF challenges, write-ups, and intentionally vulnerable apps, mostly Android with some iOS coverag… | 32 | 1164 | maintenance |
| nixawk/labs A collection of vulnerability labs and proof-of-concept exploits for known CVEs, written primarily in Python. It serves as a security analy… | 32 | 1162 | maintenance |
| masatokinugawa/filterbypass A wiki-based cheat sheet cataloging techniques for bypassing browser XSS (cross-site scripting) filters. It serves as a reference for secur… | 32 | 1159 | maintenance |
| Dm2333/ATTCK-PenTester-Book A ~400-page penetration testing handbook compiled by the DeadEye security team based on the MITRE ATT&CK knowledge base. It is organized by… | 32 | 1150 | maintenance |
| J0o1ey/BountyHunterInChina A curated collection of Chinese-language bug bounty and penetration testing writeups documenting real-world vulnerability hunting cases (XS… | 66 | 1145 | maintenance |
| pgaijin66/XSS-Payloads A curated collection of advanced cross-site scripting (XSS) payloads intended for use in penetration testing. The payload lists can be load… | 23 | 1141 | maintenance |
| payatu/diva-android DIVA Android is an intentionally insecure Android application designed to teach developers, QA engineers, and security professionals about … | 32 | 1140 | maintenance |
| S1ckB0y1337/Cobalt-Strike-CheatSheet A community-maintained cheat sheet of notes, command examples, and OPSEC advice for the Cobalt Strike command-and-control framework. It cov… | 32 | 1137 | maintenance |
| wallarm/jwt-secrets A curated wordlist of thousands of publicly leaked JWT signing secrets, collected via Google dorks and GitHub BigQuery scans. It is used fo… | 37 | 1136 | maintenance |
| JoasASantos/Cloud-Security-Attacks A curated collection of links to cloud security attack writeups covering AWS, Azure, and GCP, including privilege escalation, RCE, and misc… | 32 | 1133 | maintenance |
| ryh04x/CEH-Exam-Questions A GitHub repository containing 125 practice questions and answers for the Certified Ethical Hacker (CEH) certification exam, organized by c… | 30 | 1131 | maintenance |
| 3gstudent/Pentest-and-Development-Tips A curated collection of penetration testing and development tips, primarily focused on Windows post-exploitation techniques like port probi… | 32 | 1126 | maintenance |
| jhaddix/pentest-bookmarks A curated collection of penetration testing bookmarks assembled by Jason Haddix, organized into categories like OSINT sites, blogs, and for… | 32 | 1120 | maintenance |
| DawnFlame/POChouse A curated collection of proof-of-concept (POC) and exploit (EXP) scripts for known N-day and 1-day vulnerabilities, oriented toward HVV red… | 32 | 1108 | maintenance |
| ForbiddenProgrammer/conti-pentester-guide-leak An archive of leaked technical training manuals originally distributed to affiliates of the Conti ransomware gang, covering attack techniqu… | 32 | 1104 | maintenance |
| oskarsve/ms-teams-rce A security research writeup documenting zero-click, wormable remote code execution vulnerabilities in Microsoft Teams, reported to MSRC in … | 32 | 1104 | maintenance |
| HarmJ0y/CheatSheets A collection of cheat sheets for offensive security tools maintained by HarmJ0y, including PowerView, PowerUp, Empire, PowerSploit, and Cob… | 32 | 1102 | maintenance |
| kaonashi-passwords/Kaonashi Kaonashi is a collection of password wordlists, hashcat rules, and masks derived from large-scale analysis of billions of real leaked passw… | 32 | 1099 | maintenance |
| Airboi/bypass-av-note A Chinese-language knowledge base of antivirus evasion (bypass AV) techniques, covering signature-based, behavior-based, and cloud detectio… | 32 | 1093 | maintenance |
| lcatro/Source-and-Fuzzing A Chinese-language tutorial repository teaching source-code reading and fuzzing, covering black-box and white-box testing with real-world e… | 32 | 1082 | maintenance |
| EvilAnne/lzCloudSecurity An open-source Chinese-language textbook, 'Cloud Security Attack and Defense Introduction' (《云安全攻防入门》), published via GitBook. It compiles … | 27 | 1057 | maintenance |
| h4x0r-dz/Leaked-Credentials A tutorial repository teaching how to find leaked credentials (API keys, tokens, passwords) in web traffic using regex patterns with Chrome… | 25 | 1051 | maintenance |
| alphaSeclab/awesome-burp-suite A curated awesome-list of Burp Suite resources, cataloging 400+ open-source Burp plugins along with 400+ posts and videos. Content is organ… | 32 | 1039 | maintenance |
| frostbits-security/MITM-cheatsheet A curated cheat sheet compiling known Man-In-The-Middle attacks across network layers (L2, L3, L4+, wireless), along with protection method… | 32 | 1039 | maintenance |
| 3had0w/Fuzzing-Dicts A curated collection of dictionaries and wordlists for web security testing, including payloads for fuzzing, directory brute-forcing, and v… | 32 | 1028 | maintenance |
| nnamon/linux-exploitation-course A free, open course on intermediate-level Linux binary exploitation, covering techniques like ROP, ret2libc, ASLR bypass, GOT overwrite, an… | 32 | 1015 | maintenance |
| ohmybahgosh/RockYou2021.txt RockYou2021.txt is a massive compiled password wordlist of roughly 82 billion unique entries (6-20 ASCII characters), aggregated from multi… | 32 | 1012 | maintenance |
| sundaysec/Android-Exploits A curated collection of Android exploits, hacking tools, and guides organized by exploit type (DoS, local, remote, webapp), with references… | 32 | 1012 | maintenance |
| hackerscrolls/SecurityTips A curated collection of HackerScrolls security tips presented as images and mindmaps, covering Burp Suite usage, testing for 2FA/OAuth/SSRF… | 32 | 1009 | maintenance |