Awesome GitHub RepositoriesPassword Cracking

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

Hashcat is a high-performance hash cracking software and OpenCL compute application used to recover plain-text passwords from hashed data. It functions as a GPU-accelerated recovery tool and distributed password cracker, leveraging CPUs and GPUs to perform intensive cryptographic computations. The system differentiates itself through a distributed cracking workflow that coordinates tasks across multiple machines via an overlay network to share computational load. It further optimizes recovery speed using Markov chain keyspace optimization to prioritize the most likely password candidates. Th

zxcvbn is a password strength estimator and entropy analyzer designed to evaluate the complexity of passwords. It calculates the time and effort required to crack a password by identifying common sequences and analyzing predictable vocabulary. The tool functions as a pattern-based security validator that reduces strength scores for inputs containing personal information or strings from custom vocabulary lists. It employs a probabilistic guessing model to simulate cracking strategies, prioritizing common patterns and words over random character combinations. The system covers security workflo

JohnTheRipper is a multi-platform offline password recovery tool designed to detect and crack hundreds of different hash and cipher formats across various operating systems. It functions as a security utility for retrieving lost credentials and performing security audit testing to identify weak passwords within a database of hashes. The project features a custom rule password cracker and a mangling engine that uses a domain-specific language to transform wordlist entries into common password mutation patterns. It provides hardware-accelerated recovery by distributing parallel processing tasks

This project is a WPA Wi-Fi cracking toolkit designed for capturing authentication handshakes and recovering WPA/WPA2 passwords. It provides specialized utilities for scanning wireless networks, obfuscating hardware addresses, and generating password lists to facilitate security audits. The toolkit differentiates itself through a focused workflow that combines handshake capture tools with a password wordlist generator. It enables the interception of the four-way authentication process between wireless clients and access points and utilizes these captured credentials for recovery via dictionar

fsociety is a penetration testing framework and security tool orchestrator designed to conduct full security audits. It functions as a wrapper that integrates external security binaries into a unified, menu-driven interface, providing a centralized system for command-line parameter mapping and execution. The project distinguishes itself by organizing specialized utilities into domain-specific collections for structured navigation. It automates the transition between different phases of an audit by chaining reconnaissance and exploitation tools through sequential workflow automation. The fram

Hydra is a network login password cracker and authentication tester designed to identify valid usernames and passwords through automated brute-force and dictionary attacks. It serves as a multi-protocol authentication tester capable of verifying credentials across a wide range of remote network services, including SSH, SMB, FTP, and various database listeners. The project is distinguished by its ability to execute parallelized password attacks against multiple servers and protocols simultaneously. It features a modular system for implementing diverse network authentication schemes, allowing f

Probable-Wordlists is a collection of curated data resources providing password frequency lists, character masks, and common identity identifiers for security research. These resources serve as credential analysis tools to identify popular password trends and support the creation of secure credentials. The project provides password frequency wordlists and security research wordlists, including common usernames and top-level domains. It includes password recovery datasets featuring character masks and rule sets designed to analyze vulnerability patterns. The repository covers a broad range of

airgeddon is a bash-based wireless network audit suite and security toolkit for Linux. It serves as a framework for testing wireless vulnerabilities and verifying network configurations across various encryption standards, including WPA, WEP, and WPS. The project functions as an orchestration layer that integrates a collection of third-party wireless security tools. It features a modular approach to attack vectorization, coordinating tasks such as evil twin simulations with captive portals, WPA handshake interception, and the execution of WPS vulnerability tests. Its capabilities cover a bro

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

LessPass is a stateless password manager that generates deterministic, site-specific passwords entirely on the client device. It uses a pure function to derive passwords from a master password combined with site details, producing the same output every time without storing any secrets on a server or requiring network access. This approach means passwords can be recalculated on any device from remembered inputs, with no database synchronization needed. The project distinguishes itself through its counter-based password rotation, which allows changing a site's password by incrementing a counter

Este proyecto es una utilidad de auditoría de seguridad y pruebas de penetración diseñada para automatizar la adivinación de contraseñas, el relleno de credenciales y el ataque de fuerza bruta a cuentas de Instagram. Funciona como un auditor de recuperación de cuentas que simula ataques de inicio de sesión automatizados para probar la fortaleza de las contraseñas de las cuentas. La herramienta incorpora un gestor de proxies para manejar la importación y el monitoreo de listas de proxies. Este sistema enruta las solicitudes a través de direcciones IP rotativas y monitorea la salud de los proxies para eliminar direcciones que no responden y evitar la limitación de velocidad (rate limiting). El software proporciona capacidades para la ejecución concurrente de solicitudes y el manejo automatizado de sesiones para simular solicitudes de navegador auténticas. Admite la prueba iterativa de contraseñas candidatas y el uso de ataques de diccionario para evaluar las vulnerabilidades de las cuentas.

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

wlan-sec-test-tool es una colección de herramientas de seguridad inalámbrica especializadas diseñadas para escanear puntos de acceso, auditar la seguridad WPA, WPA2 y WPA3, y realizar pruebas automatizadas de cracking de contraseñas y conexión. Funciona como un escáner de red inalámbrica, un cracker de contraseñas y un auditor de seguridad para evaluar vulnerabilidades de protocolos inalámbricos. La herramienta se diferencia mediante el uso de un probador de conexión concurrente que ejecuta múltiples intentos de conexión simultáneos. Utiliza listas de contraseñas personalizadas e iteración basada en diccionarios para verificar la seguridad de la red inalámbrica y determinar si se puede acceder a las redes sin autorización. El proyecto cubre capacidades más amplias en descubrimiento inalámbrico, incluyendo captura de información de puntos de acceso y detección de estándares de cifrado. También proporciona configuración de interfaz de red y monitoreo del estado de conexión para gestionar adaptadores inalámbricos durante el análisis de seguridad.

SocialBox-Termux is a credential bruteforce suite and security tool collection designed to run within the Termux Android environment. It functions as an automated account cracker used to test password lists against usernames to discover valid login credentials for social media and email platforms. The toolkit incorporates network traffic masking by routing requests through the Tor network to conceal the origin IP address. It utilizes signature-based rate bypass to mimic legitimate client traffic and avoid automated login blocks. The suite provides capabilities for account validation to verif

This project is a curated, version-controlled directory of software and resources designed for cybersecurity professionals and researchers. It functions as a centralized knowledge base that aggregates and organizes external security utilities into a structured taxonomy to facilitate discovery and access for specialized research and testing tasks. The repository distinguishes itself through a community-driven model where external resource locations are verified and maintained by contributors. By leveraging a distributed version control system, the project ensures the historical integrity and c

WinPwn is a Windows penetration testing framework designed for conducting internal security assessments and privilege escalation. It functions as a suite for Active Directory security auditing, credential extraction, and the execution of privilege escalation scripts. The toolset enables the automation of SMB relay attacks to intercept and reuse authentication hashes. It provides specialized capabilities for retrieving passwords and hashes from system memory, registries, and browsers using obfuscated techniques to avoid detection. The framework covers broad capability areas including domain a

Ethical-Hacking-Labs is a comprehensive cybersecurity training curriculum and lab suite designed for learning penetration testing, network analysis, and offensive security techniques. It provides a structured environment for practicing the full attack lifecycle, from initial reconnaissance and scanning to exploitation and post-compromise analysis. The project provides instructional materials and guided exercises that cover specific technical domains, including open source intelligence research and network security courseware. It includes a practical workbook for identifying system vulnerabili

中文

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe