#pentesting-tools (29 Repositories)
Ranked open-source repositories tagged with #pentesting-tools, scored by pull request acceptance likelihood and maintainer engagement velocity.
15.2%
11.2h
29 repositories tagged #pentesting-tools
GH05TCREW/pentestagent
PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.
Ed1s0nZ/CyberStrikeAI
The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next.
Encod3d-Sec/ClaudeBrain
Karpathy LLM based claude harness for PenetrationTesting / Bugbounty using obsidian
enomothem/Whoamifuck
用于Linux应急响应，快速排查异常用户登录情况和入侵信息排查，准确定位溯源时间线，高效辅助还原攻击链。
ice-wzl/Hacknetics
Contained is all my reference material for my OSCP / Red Teaming. Designed to be a one stop shop for code, guides, command syntax, and high level strategy. One simple clone and you have access to some of the most popular tools used for pentesting.
WhiteMuush/sandevistan
Welcome cyberpsycho, SANDEVISTAN is your ultimate hub a single space where every reconnaissance, exploitation, and post-exploitation tool converges.
jonaslejon/malicious-pdf
💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh
grisuno/LazyOwn
LazyOwn RedTeam/APT Framework is the first RedTeam Framework with an AI-powered C&C, featuring rootkits to conceal campaigns, undetectable malleable implants compatible with Windows/Linux/Mac OSX, and self-configuring backdoors. With its Web interface and powerful Console Client, it is the best combination for your Autonomous RedTeam/APT campaigns.
bountyyfi/lonkero
Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.
thewhiteh4t/FinalRecon
All In One Web Recon
t3l3machus/hoaxshell
A Windows reverse shell payload generator and handler that abuses the http(s) protocol to establish a beacon-like reverse shell.
We5ter/Scanners-Box
The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents——面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵
kp300/shotdroid
ShotDroid is a pentesting tool for android. There are 3 tools that have their respective functions, Get files from Android directory, internal and external storage, Android Keylogger + Reverse Shell and Take a webcam shot of the face from the front camera of the phone and PC.
ethicalhackingplayground/bxss
Blind XSS Scanner is a tool that can be used to scan for blind XSS vulnerabilities in web applications.
itaymigdal/Nimbo-C2
Nimbo-C2 is yet another (simple and lightweight) C2 framework
Leo4j/Amnesiac
Amnesiac is a post-exploitation framework entirely written in PowerShell and designed to assist with lateral movement within Active Directory environments
opsqw/scoop-security
Scoop bucket for Penetration Testing and Cybersecurity related tools. 用于渗透测试和网络安全相关工具下载、安装和自动更新的Scoop软件仓库。
freeload101/Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy
Java Android Magisk Burp Objection Root Emulator Easy (JAMBOREE)
0xffsec/handbook
A living document for penetration testing and offensive security.
z2p/sweetPotato
基于burpsuite的资产分析工具
hero-mike/Android-Mobile-Security-Sandbox-Testing
Ultimate Android Security Toolkit JAMBOREE Burp Objection Magisk 2026 Guide
fabaff/nix-security-box
Tool set for Information security professionals and all others
dr34mhacks/JwtAuditor
JWT Auditor – Analyze, break, and understand your tokens like a pro.
harsh-bothra/learn365
This repository is about @harshbothra_'s 365 days of Learning Tweets & Mindmaps collection.
Syslifters/offsec-tools
Compiled tools for internal assessments
Cyber-Buddy/APKHunt
APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.
arget13/DDexec
A technique to run binaries filelessly and stealthily on Linux by "overwriting" the shell's process with another.
EONRaider/RootWire
RootWire: A network traffic monitor for GNU/Linux — Live Capture, PCAP Replay, NDJSON Output. Formerly Packet-Sniffer.
t3l3machus/toxssin
An XSS exploitation command-line interface and payload generator.