Penetration Testing
Showing 36 of 342 projects
A collection of proof-of-concept (PoC) and exploit (Exp) scripts for various security vulnerabilities.
A Linux Kernel Module (LKM) rootkit for hiding processes, granting root privileges, and making files invisible.
The OWASP Mobile Application Security Verification Standard (MASVS) is the industry standard for mobile app security.
A network OSINT tool that automates subdomain enumeration, service fingerprinting, and data collection via Shodan and ViewDNS APIs.
A web-based toolkit for XSS (Cross-Site Scripting) testing, encoding/decoding, and payload generation.
A dynamic network analysis tool that intercepts and simulates network services for malware analysis and penetration testing.
A deprecated collection of PowerShell tools for offensive security operations and penetration testing.
A reconnaissance tool that gathers information about targets using APIs without direct contact.
A Python tool that scans HTTP servers for publicly accessible secret files and security vulnerabilities like git repos and backup files.
A collection of notes, scripts, and techniques for exploiting vulnerabilities and attacking Jenkins servers.
A vulnerable Node.js web application designed to teach how to identify and fix OWASP Top 10 security vulnerabilities.
A graphical tool for custom wordlist generation using human password paradigms, with output for Hashcat and John the Ripper.
A curated list of awesome guides, tools, and resources related to lockpicking, physical security, and locksport.
A Burp Suite extension that bridges to Frida, enabling dynamic analysis and manipulation of mobile app traffic using the app's own code.
A comprehensive offensive web application penetration testing framework with 108 modules covering reconnaissance to vulnerability analysis.
A comprehensive offensive web application penetration testing framework with 108 modules covering reconnaissance to vulnerability analysis.
A command-line tool that automates password cracking methodologies through Hashcat with integrated wordlist management and attack orchestration.
A Python security analysis tool that automatically discovers and reports comprehensive information about a given domain.
A Python tool that sniffs sensitive credentials and data from network interfaces or pcap files across multiple protocols.
A multi-platform client-server tool for distributing Hashcat password cracking tasks across multiple computers.
A Burp Suite extension for advanced GraphQL security testing, featuring vulnerability scanning, batch attacks, and schema analysis.
A Perl toolkit for ripping web-accessible version control repositories (Git, SVN, Mercurial, Bazaar, CVS) even when directory browsing is disabled.
A Python RDP man-in-the-middle tool and library for intercepting, monitoring, and analyzing Remote Desktop Protocol connections.
A penetration testing tool that intercepts SSH connections to log plaintext passwords and full sessions.
A comprehensive password cracking rule combining multiple sources for improved hashcat performance.
A collection of small, chainable command-line utilities for advanced password cracking operations.
A free, cross-platform, single-file fake protocol server simulator that can start or stop multiple network services.
Statistical password cracking rules for Hashcat based on industry patterns and frequency analysis.
An OWASP training app with 62 challenges demonstrating real-world secrets management mistakes and how to find them.
A security tool that enumerates AWS S3 buckets to discover and download interesting files using wordlist-based scanning.
A reflective PE packer for in-memory execution of Windows executables to bypass security products.
Wordlists for statistically likely usernames, optimized for horizontal password attacks and security testing.
A multithreaded PDF password cracking utility with structured search builders, checkpoint/resume, and optimized performance.
A tool to test Wi-Fi clients and access points for fragmentation and aggregation vulnerabilities affecting all protected Wi-Fi networks.
A pre-configured Linux virtual machine for adversary emulation and threat hunting with attacker and defender toolkits.
A virtual host scanner for penetration testing that performs reverse lookups, detects catch-all scenarios, and works around wildcards and aliases.
Related Tags
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.