For authorized security testing and education only. Every tool listed here must be used only against systems you own or have explicit written permission to test. Unauthorized access is illegal. See the Disclaimer .
🔴 Offensive Security (Red Team) Reconnaissance — Subdomain / DNS / ASN
Tool
Description
subfinder Fast passive subdomain enumeration.
Amass In-depth attack-surface mapping and asset discovery (OWASP).
Sublist3r Subdomain enumeration using search engines.
OneForAll Powerful all-in-one subdomain collection tool.
findomain Cross-platform subdomain finder.
puredns Fast DNS resolver + subdomain bruteforce with wildcard filtering.
shuffledns massdns wrapper for bruteforce/resolve subdomains.
dnsx Fast, multi-purpose DNS toolkit.
zdns Fast CLI DNS lookup at scale.
altdns Subdomain permutation / alteration generator.
shosubgo Grab subdomains from the Shodan API.
knock Subdomain enumeration via wordlist.
Sudomy Subdomain enumeration & analysis framework.
scilla Information-gathering (DNS/subdomain/port/dir) tool.
hakrevdns Reverse DNS lookups from a list of IPs.
asnmap Map network ranges using ASN information.
DNSDumpster Online DNS recon & research service.
tlsx TLS grabber for gathering data from certificates.
HostHunter Discover hostnames from IP addresses.
subjack Subdomain takeover detection.
can-i-take-over-xyz Reference of services vulnerable to subdomain takeover.
bbot Recursive OSINT/recon "BEE-bot" scanner.
reconftw End-to-end automated recon framework.
reNgine Web recon engine with a UI and pipelines.
Chaos Public DNS/subdomain dataset by ProjectDiscovery.
cloudlist List assets/hostnames from cloud providers.
uncover Query Shodan/Censys/Fofa for exposed hosts.
csprecon Discover domains from Content-Security-Policy headers.
favirecon Fingerprint tech via favicon hashes.
CloudFox Cloud enumeration and attack-path discovery tool.
Tool
Description
naabu Fast SYN/CONNECT port scanner.
masscan Internet-scale TCP port scanner.
RustScan Ultra-fast port scanner that pipes into Nmap.
Smap Nmap-compatible scanner powered by Shodan (no packets sent).
proxify Swiss-army-knife HTTP/HTTPS proxy for capture & tampering.
axiom Dynamic distributed-scanning infrastructure ("attack fleet").
ax Maintained fork/evolution of Axiom for distributed scanning.
nmap Network Discovery, Scanning, and Security Auditing.
Netcat
The classic TCP/IP "swiss-army knife" for reading/writing across connections.
HTTP Probing / Crawling / Content Discovery
Tool
Description
httpx Fast, multi-purpose HTTP toolkit / prober.
httprobe Probe a list of hosts for working HTTP/HTTPS.
meg Fetch many paths from many hosts without hammering them.
gowitness Screenshot websites at scale.
crawlergo Headless-Chrome crawler that collects URLs & forms.
cariddi Crawl + extract endpoints/params/secrets from JS in one shot.
Photon Fast crawler with parameter & data extraction.
katana Next-gen crawler built for offensive security.
dirsearch Web path/content brute-forcer.
feroxbuster Fast recursive content discovery (Rust).
DirDar Directory brute-force & hidden-path discovery.
gau Fetch known URLs from Wayback/OTX/Common Crawl.
waymore More URLs from more archive sources than gau.
xurlfind3r Passive URL discovery from online archives.
uro De-duplicate and clean lists of near-duplicate URLs.
qsreplace Replace query-string values (great for payload injection).
VHostScan Virtual-host discovery scanner.
hakrawler Simple, fast web crawler for quick scoping.
gospider Fast web spider written in Go.
JavaScript Analysis & Parameter Discovery
Tool
Description
LinkFinder Discover endpoints inside JavaScript files.
xnLinkFinder Extract endpoints/links from JS, files & burp exports.
getJS Extract all JavaScript file URLs from a page.
subjs Fetch JavaScript file references from a list of URLs.
jsluice Extract URLs, paths & secrets from JavaScript (BishopFox).
Arjun HTTP hidden-parameter discovery.
ParamSpider Mine parameters from web archives.
x8 Blazing-fast hidden parameter discovery (Rust).
apkleaks Scan APKs for URIs, endpoints & secrets.
Tool
Description
ffuf Fast web fuzzer (dir, param, vhost, more).
wfuzz Flexible web application fuzzer.
REcollapse Generate payloads to fuzz normalization/validation logic.
Vulnerability Scanners (Web / App)
Tool
Description
nuclei Template-based, fast, community-driven vulnerability scanner.
nuclei-templates Official community templates for Nuclei.
nuclei-wordfence-cve Nuclei templates generated from Wordfence CVEs.
cent Aggregate community Nuclei templates.
jaeles Powerful, flexible web-app scanning framework.
nikto Classic web-server scanner.
wapiti Black-box web-app vulnerability scanner.
scan4all All-in-one scanning framework (recon + vuln).
V3n0M-Scanner Pentest scanner (Dorks/SQLi/XSS/LFI…).
VULNX CVE-focused vulnerability intelligence/scanner.
ZAP OWASP Zed Attack Proxy — full web-app scanner.
Nettacker Automated pentest & information-gathering framework (OWASP).
Artemis Modular scanner that assesses many hosts (CERT-PL).
Sn1per Automated recon & attack-surface scanner.
BugBountyScanner Recon/scan automation designed to run over multiple days.
webanalyze Technology detection (Wappalyzer-style) at scale.
WAD Web application detector (fingerprinting).
RedTeam-Tools Curated set of red-team tools & resources.
Aghast OWASP scanner for common web issues.
Caido A web security platform for auditing and testing web applications efficiently.
PlayWright A framework for automating and testing web applications across all major browsers.
Injection — SQL / NoSQL / Command / SSTI / LFI
Tool
Description
sqlmap Automatic SQL-injection detection & exploitation.
ghauri Fast, smart SQL-injection tool.
DSSS Damn Small SQLi Scanner (<100 lines).
NoSQLMap Automated NoSQL / MongoDB injection.
commix Automated command-injection exploitation.
SSTImap Server-Side Template Injection detection & exploitation.
tplmap Classic SSTI / code-injection exploitation.
LFISuite Local File Inclusion scanner & exploiter.
Tool
Description
dalfox Fast, powerful XSS scanner & param analyzer.
XSStrike Advanced XSS detection with payload generation.
xsser Automated framework to detect & exploit XSS.
xsssniper Automatic XSS discovery tool.
XssPy Python XSS scanner that walks subdomains & params.
toxssin XSS exploitation command-and-control server.
ezXSS Easy blind-XSS testing & payload management.
LOXS Multi-vuln scanner (LFI/OR/SQLi/XSS/CRLF).
DOMLogger++ Browser ext to monitor DOM sinks for XSS research.
postMessage-tracker Track postMessage usage for client-side bugs.
weaponised-XSS-payloads Collection of impactful XSS payloads.
Prototype Pollution / Open Redirect / CRLF
Tool
Description
pphack Client-side prototype-pollution scanner.
ppmap Automated prototype-pollution scanner.
OpenRedireX Fuzzer for open-redirect vulnerabilities.
crlfuzz Fast CRLF-injection scanner.
SSRF / Request Smuggling / Web Cache
Tool
Description
graphw00f GraphQL server fingerprinting.
GraphQLmap Interactive GraphQL pentest / exploitation.
graphql-cop Security auditor for GraphQL endpoints.
graphql-voyager Visualize a GraphQL API as an interactive graph.
Clairvoyance Recover GraphQL schema even with introspection off.
CrackQL GraphQL password/brute-force & fuzzing.
noir Attack-surface detector from source code (API endpoints).
Tool
Description
wpscan WordPress vulnerability scanner.
CMSmap Multi-CMS scanner (WP/Joomla/Drupal).
Auth / JWT / Password Cracking
Tool
Description
jwt-hack JWT attack toolkit (crack, tamper, encode).
jwt-cracker Brute-force HS256 JWT secrets.
jwt_tool Analyze, tamper & attack JSON Web Tokens.
hashcat World's fastest GPU password cracker.
thc-hydra Fast network login brute-forcer.
Deserialization / RMI / XXE
Tool
Description
ysoserial Generate Java deserialization payloads.
ysoserial.net .NET deserialization payload generator.
SerializationDumper Dump Java serialization streams in human-readable form.
BaRMIe Java RMI enumeration & attack tool.
xxeserv Mini web server for XXE OOB exfiltration.
Tool
Description
dontgo403 Bypass 40x access-control restrictions.
C2 / Exploitation / Post-Exploitation
Tool
Description
NetExec Network/AD swiss-army knife (successor to CrackMapExec).
BeEF Browser Exploitation Framework.
pwncat Post-exploitation platform / reverse-shell handler.
CALDERA Automated adversary-emulation platform (MITRE).
evilginx2 MITM phishing framework for 2FA session hijacking.
reverse-shell-generator Generate reverse-shell one-liners quickly.
PowerSploit PowerShell post-exploitation modules.
Findsploit Instantly find exploits locally & online.
PoC-in-GitHub Auto-collected CVE proof-of-concepts from GitHub.
Out-of-Band (OOB) Interaction
Tool
Description
interactsh OOB interaction-gathering server & client.
dnsobserver Helper DNS server to detect OOB/DNS interactions.
Tool
Description
SET Social-engineering attack simulation toolkit.
🔵 Defensive Security (Blue Team / DevSecOps)
Tool
Description
semgrep Fast, multi-language static analysis with custom rules.
Dependency / Container / Supply-Chain Scanning
Tool
Description
trivy All-in-one scanner for containers, IaC, deps & secrets.
osv-scanner Match dependencies against the OSV vulnerability DB (Google).
Tool
Description
trufflehog Find & verify leaked credentials in code/history.
gitleaks Detect hardcoded secrets in git repos.
S3Scanner Find open/misconfigured S3 buckets.
Network Vulnerability Management
Tool
Description
openvas-scanner Full-featured network vulnerability scanner (Greenbone).
Tool
Description
testssl.sh Check a server's TLS/SSL config, ciphers & flaws.
DeepViolet TLS/SSL scanning API & tool (Java).
Tool
Description
DOMPurify XSS sanitizer for HTML/DOM (defensive).
Adversary Emulation / Purple Team
Tool
Description
CALDERA Automated adversary-emulation to validate detections (MITRE).
PowerSploit Useful for building & testing blue-team detections.
The core reason this repo exists: security tooling powered by (and targeting) AI/LLMs. Split into offensive agents , LLM red teaming , defensive guardrails , local models and knowledge .
AI-Powered Offensive Agents
Tool
Description
strix Autonomous AI agents that pentest your apps.
PentestGPT LLM-driven reasoning layer that guides pentests.
CAI (Cybersecurity AI) Framework for building AI agents for offensive/defensive security.
hackingBuddyGPT Research framework for LLM-powered autonomous hacking.
Nebula AI-assisted pentest assistant that suggests & runs commands.
hermes-agent Function-calling agent scaffolding (Nous Research).
Colibri Lightweight AI security agent.
Page Index RAG system that analyzes documents without chunks or vector databases
Lite LLM A unified AI gateway for accessing and managing 100+ LLM providers through one API.
Anthropic-cybersecurity-skills Cybersecurity skills for Claude and other AI agents.
LLM Red Teaming & Vulnerability Scanning
Tool
Description
garak LLM vulnerability scanner (prompt injection, jailbreaks, leakage) — NVIDIA.
PyRIT Python Risk Identification Toolkit for generative AI (Microsoft).
promptfoo Test, red-team & evaluate LLM apps (50+ vuln types).
deepteam LLM red-teaming framework mapped to OWASP LLM Top 10.
agentic_security Open-source LLM/agent vulnerability scanner.
agentic-radar Static analysis of agent workflows for excessive-agency risk.
Garak probes / MITRE ATLAS Adversarial-threat landscape for AI systems.
Tool
Description
LLM Guard Security toolkit for LLM interactions (input/output filtering).
Rebuff Prompt-injection detector with multi-layer defense.
Vigil Detect prompt injections, jailbreaks & risky inputs.
Giskard Test & scan ML/LLM models for vulnerabilities & bias.
Uncensored / Local Models
For offline/private research where cloud models refuse security tasks. Use responsibly and legally.
Resource
Description
heretic Automatic "decensoring" of transformer models.
Huihui-GLM abliterated Abliterated / uncensored GLM model weights (GGUF).
AI Security Frameworks & Knowledge
Tool
Description
SpiderFoot Automated OSINT collection & attack-surface mapping.
recon-ng Full-featured web recon framework (Metasploit-style).
OSINT-Mapping-Tool Map & visualize OSINT relationships.
IntelOwl Threat-intelligence data at scale via one API.
pagodo Passive Google-dorking automation.
ditto Detect typosquatting / lookalike domains.
Maigret Collect a person's accounts across thousands of sites.
Osintgram OSINT toolkit for Instagram.
GhostTrack Track location / phone / username info.
TraceLabs OSINT VM Preconfigured OSINT investigation environment.
Metabigor OSINT without API keys (ASN, IP, org).
gitGraber Monitor GitHub for leaked secrets/tokens.
Maltego Link-analysis & graph OSINT platform.
Hunchly Web-capture tool for OSINT investigations.
IntelX Search engine & data archive for OSINT.
BrixHub Search engine for finding public information quickly.
seeKnow Powerful OSINT tool for searching breach data and online information.
🧰 Utilities / Proxies / HTTP Clients
Tool
Description
mitmproxy Interactive HTTPS intercepting proxy.
hetty Open-source HTTP toolkit / Burp alternative.
CyberChef The "cyber swiss-army knife" for encoding/crypto/data (GCHQ).
curl The universal command-line HTTP client.
httpie Human-friendly CLI HTTP client.
hurl Run & test HTTP requests in plain text.
Atlas Quick SQLmap tamper-script suggester.
fzf Command-line fuzzy finder.
pet Simple command-line snippet manager.
pentest-tools Collection of handy pentest scripts (gwen001).
Hack-Tools All-in-one red-team browser extension.
Redcloud Deploy a full red-team attack infrastructure via UI.
grex Generate regexes from example inputs.
Resource
Description
SecLists The go-to collection of wordlists for security testing.
Assetnote Wordlists High-quality wordlists built from internet-wide data.
PayloadsAllTheThings Payloads & bypasses for every web vuln class.
IntruderPayloads Burp Intruder payloads, fuzz lists & wordlists.
CeWL Generate custom wordlists by spidering a target.
COOK Powerful wordlist generator & permutation engine.
jsfuck Write JS using only 6 characters (filter bypass).
OCD Mindmaps Pentest / Active Directory attack mindmaps.
📖 Frameworks, References & Learning Contributions are welcome! Please read CONTRIBUTING.md first.
In short: open a Pull Request that adds the tool to the correct category , keep the one-line description factual, make sure the link works, and keep entries alphabetical-ish within a section. New categories are fine when something genuinely doesn't fit.
This repository is provided for educational purposes and authorized security testing only . The tools listed are created and maintained by their respective authors. Using any of these tools against systems, networks, or applications without explicit prior authorization is illegal and may result in criminal and civil liability. The maintainers of this list assume no responsibility for misuse. Always act ethically and within the law.
Distributed under the MIT License . The listed tools remain the property of their respective owners and are governed by their own licenses.
