Awesome GitHub RepositoriesPassword Cracking

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

Hashcat is a high-performance hash cracking software and OpenCL compute application used to recover plain-text passwords from hashed data. It functions as a GPU-accelerated recovery tool and distributed password cracker, leveraging CPUs and GPUs to perform intensive cryptographic computations. The system differentiates itself through a distributed cracking workflow that coordinates tasks across multiple machines via an overlay network to share computational load. It further optimizes recovery speed using Markov chain keyspace optimization to prioritize the most likely password candidates. Th

zxcvbn is a password strength estimator and entropy analyzer designed to evaluate the complexity of passwords. It calculates the time and effort required to crack a password by identifying common sequences and analyzing predictable vocabulary. The tool functions as a pattern-based security validator that reduces strength scores for inputs containing personal information or strings from custom vocabulary lists. It employs a probabilistic guessing model to simulate cracking strategies, prioritizing common patterns and words over random character combinations. The system covers security workflo

JohnTheRipper is a multi-platform offline password recovery tool designed to detect and crack hundreds of different hash and cipher formats across various operating systems. It functions as a security utility for retrieving lost credentials and performing security audit testing to identify weak passwords within a database of hashes. The project features a custom rule password cracker and a mangling engine that uses a domain-specific language to transform wordlist entries into common password mutation patterns. It provides hardware-accelerated recovery by distributing parallel processing tasks

This project is a WPA Wi-Fi cracking toolkit designed for capturing authentication handshakes and recovering WPA/WPA2 passwords. It provides specialized utilities for scanning wireless networks, obfuscating hardware addresses, and generating password lists to facilitate security audits. The toolkit differentiates itself through a focused workflow that combines handshake capture tools with a password wordlist generator. It enables the interception of the four-way authentication process between wireless clients and access points and utilizes these captured credentials for recovery via dictionar

fsociety is a penetration testing framework and security tool orchestrator designed to conduct full security audits. It functions as a wrapper that integrates external security binaries into a unified, menu-driven interface, providing a centralized system for command-line parameter mapping and execution. The project distinguishes itself by organizing specialized utilities into domain-specific collections for structured navigation. It automates the transition between different phases of an audit by chaining reconnaissance and exploitation tools through sequential workflow automation. The fram

Hydra is a network login password cracker and authentication tester designed to identify valid usernames and passwords through automated brute-force and dictionary attacks. It serves as a multi-protocol authentication tester capable of verifying credentials across a wide range of remote network services, including SSH, SMB, FTP, and various database listeners. The project is distinguished by its ability to execute parallelized password attacks against multiple servers and protocols simultaneously. It features a modular system for implementing diverse network authentication schemes, allowing f

Probable-Wordlists is a collection of curated data resources providing password frequency lists, character masks, and common identity identifiers for security research. These resources serve as credential analysis tools to identify popular password trends and support the creation of secure credentials. The project provides password frequency wordlists and security research wordlists, including common usernames and top-level domains. It includes password recovery datasets featuring character masks and rule sets designed to analyze vulnerability patterns. The repository covers a broad range of

airgeddon is a bash-based wireless network audit suite and security toolkit for Linux. It serves as a framework for testing wireless vulnerabilities and verifying network configurations across various encryption standards, including WPA, WEP, and WPS. The project functions as an orchestration layer that integrates a collection of third-party wireless security tools. It features a modular approach to attack vectorization, coordinating tasks such as evil twin simulations with captive portals, WPA handshake interception, and the execution of WPS vulnerability tests. Its capabilities cover a bro

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

LessPass is a stateless password manager that generates deterministic, site-specific passwords entirely on the client device. It uses a pure function to derive passwords from a master password combined with site details, producing the same output every time without storing any secrets on a server or requiring network access. This approach means passwords can be recalculated on any device from remembered inputs, with no database synchronization needed. The project distinguishes itself through its counter-based password rotation, which allows changing a site's password by incrementing a counter

Dieses Projekt ist ein Sicherheits-Audit- und Penetration-Testing-Utility, das für die Automatisierung von Passwort-Raten, Credential-Stuffing und Account-Brute-Forcing auf Instagram entwickelt wurde. Es fungiert als Account-Recovery-Auditor, der automatisierte Login-Angriffe simuliert, um die Stärke von Account-Passwörtern zu testen. Das Tool integriert einen Proxy-Manager für den Import und die Überwachung von Proxy-Listen. Dieses System leitet Anfragen über rotierende IP-Adressen und überwacht die Proxy-Gesundheit, um nicht reagierende Adressen zu entfernen und Ratenbegrenzungen zu vermeiden. Die Software bietet Funktionen für die gleichzeitige Ausführung von Anfragen und die automatisierte Sitzungsverwaltung, um authentische Browser-Anfragen zu simulieren. Sie unterstützt das iterative Testen von Passwortkandidaten und die Verwendung von Wörterbuchangriffen, um Account-Schwachstellen zu bewerten.

Dieses Projekt ist eine Wissensdatenbank für Red Teaming und ein Playbook für offensive Sicherheit, das darauf ausgelegt ist, das Verhalten von Angreifern zu simulieren. Es dient als umfassende Sammlung technischer Anleitungen und Taktiken für die Durchführung von Red-Team-Operationen. Das Repository bietet detaillierte Anweisungen für Active-Directory-Exploitation, einschließlich Kerberos-Missbrauch und Domain-Privilege-Escalation. Es behandelt Defense-Evasion durch API-Unhooking und Payload-Obfuskation sowie Windows-Internals-Forschung, die die Manipulation von Kernel-Objekten und Systemspeicher umfasst. Das Fähigkeitsspektrum erstreckt sich auf Netzwerk-Penetrationstests, Malware-Analyse und -Engineering sowie die Bereitstellung von Infrastruktur für offensive Sicherheit. Es enthält zudem Methoden für Lateral Movement, Persistenz und Datenexfiltration in Unternehmensumgebungen.

wlan-sec-test-tool ist eine Sammlung spezialisierter Wireless-Sicherheitstools, die für das Scannen von Zugangspunkten, die Auditierung von WPA, WPA2 und WPA3-Sicherheit sowie die Durchführung automatisierter Passwort-Cracking- und Verbindungstests entwickelt wurden. Es fungiert als Wireless-Netzwerk-Scanner, Passwort-Cracker und Sicherheitsauditor, um Schwachstellen in Wireless-Protokollen zu bewerten. Das Tool zeichnet sich durch den Einsatz eines gleichzeitigen Verbindungstesters aus, der mehrere gleichzeitige Verbindungsversuche ausführt. Es nutzt benutzerdefinierte Passwortlisten und wörterbuchbasierte Iteration, um die Sicherheit von Wireless-Netzwerken zu verifizieren und festzustellen, ob unbefugt auf Netzwerke zugegriffen werden kann. Das Projekt deckt umfassendere Funktionen bei der Wireless-Discovery ab, einschließlich der Erfassung von Informationen zu Zugangspunkten und der Erkennung von Verschlüsselungsstandards. Es bietet zudem Netzwerkschnittstellenkonfiguration und Verbindungsstatusüberwachung, um Wireless-Adapter während der Sicherheitsanalyse zu verwalten.

SocialBox-Termux is a credential bruteforce suite and security tool collection designed to run within the Termux Android environment. It functions as an automated account cracker used to test password lists against usernames to discover valid login credentials for social media and email platforms. The toolkit incorporates network traffic masking by routing requests through the Tor network to conceal the origin IP address. It utilizes signature-based rate bypass to mimic legitimate client traffic and avoid automated login blocks. The suite provides capabilities for account validation to verif

This project is a curated, version-controlled directory of software and resources designed for cybersecurity professionals and researchers. It functions as a centralized knowledge base that aggregates and organizes external security utilities into a structured taxonomy to facilitate discovery and access for specialized research and testing tasks. The repository distinguishes itself through a community-driven model where external resource locations are verified and maintained by contributors. By leveraging a distributed version control system, the project ensures the historical integrity and c

WinPwn is a Windows penetration testing framework designed for conducting internal security assessments and privilege escalation. It functions as a suite for Active Directory security auditing, credential extraction, and the execution of privilege escalation scripts. The toolset enables the automation of SMB relay attacks to intercept and reuse authentication hashes. It provides specialized capabilities for retrieving passwords and hashes from system memory, registries, and browsers using obfuscated techniques to avoid detection. The framework covers broad capability areas including domain a

Ethical-Hacking-Labs is a comprehensive cybersecurity training curriculum and lab suite designed for learning penetration testing, network analysis, and offensive security techniques. It provides a structured environment for practicing the full attack lifecycle, from initial reconnaissance and scanning to exploitation and post-compromise analysis. The project provides instructional materials and guided exercises that cover specific technical domains, including open source intelligence research and network security courseware. It includes a practical workbook for identifying system vulnerabili

中文

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe