Hacking hacking-tools
Recon
- nuclei recon
- Nuclei Forge - Visual Editor & Builder for Nuclei Templates nuclei
- BishopFox/GitGot: Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets. leaked-secrets
- intruder-io/autoswagger: Autoswagger by Intruder - detect API auth weaknesses access-control
Network
- Pennyw0rth/NetExec: The Network Execution Tool network-hacking
- FlareSolverr/FlareSolverr: Proxy server to bypass Cloudflare protection cloudflare proxy
- PortSwigger/bypass-bot-detection: Burp Suite extension that mutates ciphers to bypass TLS-fingerprint based bot detection burp-suite
- 0b1d1 on X: “🛡️ cf-hero – Technical Overview cf-hero is an open-source CLI tool that reveals the real IP addresses of websites hidden behind Cloudflare’s reverse proxy protection. GITHUB Link 🔗 ⤵️⤵️ https://t.co/3wLVGUoY9c” / X recon
- haad/proxychains: proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: “user/pass” for SOCKS4/5, “basic” for HTTP. proxy
- TheSpeedX/PROXY-List: Get PROXY List that gets updated everyday proxy
Scanner
- r0oth3x49/ghauri: An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws SQLi
- Chocapikk/wpprobe: A fast WordPress plugin enumeration tool wordpress
- Moopinger/smugglefuzz: A rapid HTTP downgrade smuggling scanner written in Go.
XSS
- fransr/postMessage-tracker: A Chrome Extension to track postMessage usage (url, domain and stack) both by logging using CORS and also visually as an extension-icon postmessage
- swoops/eval_villain: A Firefox Web Extension to improve the discovery of DOM XSS. XSS
- ClobberX: generate DOM clobbering payloads DOM-clobbering
CSRF
Red Team
- AD-Security/AD_Miner: AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the Bloodhound graph database to uncover security weaknesses redteam active-directory
- 0xdea/blindsight: Red teaming tool to dump LSASS memory, bypassing basic countermeasures. redteam dump-memory
- Aur3ns/LsassStealer: Morpheus is an lsass stealer that extracts lsass.exe in RAM and exfiltrates it via forged and crypted NTP packets. For authorized testing only! redteam
- Maldev-Academy/Alphabetfuscation: Convert your shellcode into an ASCII string maldev
- jakehildreth/Locksmith: A small tool built to find and fix common misconfigurations in Active Directory Certificate Services. active-directory
- BloodHound Query Library bloodhound active-directory
OSINT
- 0b1d1 on X: “🕷️ SpiderFoot: Automated OSINT Tool Your go-to solution for gathering open-source intelligence on domains, IPs, emails, usernames, and more. ⤵️Learn More Plus GitHub Repo👇🏻⤵️ https://t.co/hUrFoSdgmD” / X OSINT
- p1ngul1n0/blackbird: An OSINT tool to search for accounts by username and email in social networks. OSINT redteam
- mxrch/GHunt: 🕵️♂️ Offensive Google framework. OSINT redteam
- GreyNoise Visualizer | GreyNoise Visualizer: search for IP addresses and see their activity on the internet OSINT
- Clats97/ClatScope: ClatScope Info Tool – The best and most versatile OSINT utility for retrieving geolocation, DNS, WHOIS, phone, email, data breach information and much more (70+ features). Perfect for investigators, pentesters, or anyone looking for an effective reconnaissance / OSINT tool. OSINT
AI
- promptfoo/promptfoo: Test your prompts, agents, and RAGs. Red teaming, pentesting, and vulnerability scanning for LLMs. Compare performance of GPT, Claude, Gemini, Llama, and more. Simple declarative configs with command line and CI/CD integration. llm-hacking
- ASCII Smuggler Tool: Crafting Invisible Text and Decoding Hidden Codes · Embrace The Red
Brute-Force
- mufeedvh/pdfrip: A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks. password-attacking
Web3
- nascentxyz/pyrometer: A tool for analyzing the security and parameters of a solidity smart contract smart-contract-audit
- EVM-Storage.codes | EVM Smart Contract Storage Viewer and Comparator
- Scaffold-ETH 2 - Open source toolkit to build dApps on Ethereum: visualize smart contracts
- Dashboard - Alchemy: monitor failed transactions
- Signature Database: database for function selectors lookup to avoid signature collisions in smart contracts.
- DefiLlama - DeFi Dashboard: provides a current snapshot of the DeFi industry.
Misc
- GraphQL Introspection to SDL graphql
- streaak/keyhacks: Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they’re valid. info-disclose leaked-secrets
- Trufflehog alternative: mongodb/kingfisher: Kingfisher is a blazingly fast secret‑scanning and validation tool built in Rust leaked-secrets
- UndeadSec/DockerSpy: DockerSpy searches for images on Docker Hub and extracts sensitive information such as authentication secrets, private keys, and more. OSINT info-disclose leaked-secrets
- Playground | recheck ReDoS : ReDoS checker
- avlidienbrunn/archivealchemist: Archive Alchemist is a tool for creating specially crafted archives to test extraction vulnerabilities. archive
CLI dev-tools
- jesseduffield/lazydocker: The lazier way to manage everything docker docker
- sxyazi/yazi: 💥 Blazing fast terminal file manager written in Rust, based on async I/O.
- bootandy/dust at dailydev
- twpayne/chezmoi: Manage your dotfiles across multiple diverse machines, securely.
- Abdenasser/neohtop: 💪🏻 Blazing-fast system monitoring for your desktop (built with Rust, Tauri & Svelte)
- tmux
- ttyd
- air-verse/air: ☁️ Live reload for Go apps golang
- darrenburns/posting: The modern API client that lives in your terminal. HTTP
- tconbeer/harlequin: The SQL IDE for Your Terminal. SQL
- astral-sh/uv: An extremely fast Python package and project manager, written in Rust. package-manager python
- PowerShell module used for merging, splitting, etc the PDF files: EvotecIT/PSWritePDF: PowerShell Module to create, edit, split, merge PDF files on Windows / Linux and MacOS. Its blog post: Merging, splitting and creating PDF files with PowerShell - Evotec. pdf
- badmotorfinger/z: Save time typing out directory paths in PowerShell by jumping around instead.
- microsoft/parallel-prettier: Concurrent prettier runner
- github.com/matt9ucci/DockerCompletion docker
- Create comment headers for functions or sections: transmissions11/headers: Generate perfect code headers every time.
- opendatalab/MinerU: A high-quality tool for convert PDF to Markdown and JSON.一站式开源高质量数据提取工具，将PDF转换成Markdown和JSON格式。
- kraanzu/smassh: Smassh your Keyboard, TUI Edition: typing test
- charmbracelet/crush: The glamourous AI coding agent for your favourite terminal 💘
Web dev-tools
- Client-side binary/file analysis, hex dump viewer & editor: HEX.DANCE
- Create beautiful images of your source code
- Paragon - Bug Bounty Hunter Training & Security Workspace
- CRXPlorer - Analyze Chrome Extensions for Security
- Squish - Batch Browser-based Image Compression
- Video Compress
- Protobufpal: play with protobuf.
- Domain Locker: manage domain names.
- Home - Cookiedatabase.org: search for meanings of cookies.
- Go Concurrency Rocks: visualize Go concurrency patterns.
Misc
- Install vcpkg on Windows and Visual Studio | A Practical Guide vcpkg
- 🦑 Squid
- massgravel/Microsoft-Activation-Scripts: Open-source Windows and Office activator featuring HWID, Ohook, TSforge, KMS38, and Online KMS activation methods, along with advanced troubleshooting.
- eythaann/Seelen-UI: The Fully Customizable Desktop Environment for Windows 10/11.
- Access to Ext 2/3/4, HFS and ReiserFS from Windows | DiskInternals