Awesome GitHub RepositoriesPassword Cracking

SecLists is a centralized library of security assessment data designed to support vulnerability discovery and penetration testing. It functions as a comprehensive repository of wordlists, payloads, and testing methodologies used to audit software, firmware, and internet-connected hardware for technical vulnerabilities. The project distinguishes itself through a standardized taxonomy and a language-agnostic data format, which allows security tools to predictably ingest and utilize its assets regardless of the underlying programming environment. By decoupling raw testing data from execution log

Hashcat is a high-performance hash cracking software and OpenCL compute application used to recover plain-text passwords from hashed data. It functions as a GPU-accelerated recovery tool and distributed password cracker, leveraging CPUs and GPUs to perform intensive cryptographic computations. The system differentiates itself through a distributed cracking workflow that coordinates tasks across multiple machines via an overlay network to share computational load. It further optimizes recovery speed using Markov chain keyspace optimization to prioritize the most likely password candidates. Th

zxcvbn is a password strength estimator and entropy analyzer designed to evaluate the complexity of passwords. It calculates the time and effort required to crack a password by identifying common sequences and analyzing predictable vocabulary. The tool functions as a pattern-based security validator that reduces strength scores for inputs containing personal information or strings from custom vocabulary lists. It employs a probabilistic guessing model to simulate cracking strategies, prioritizing common patterns and words over random character combinations. The system covers security workflo

JohnTheRipper is a multi-platform offline password recovery tool designed to detect and crack hundreds of different hash and cipher formats across various operating systems. It functions as a security utility for retrieving lost credentials and performing security audit testing to identify weak passwords within a database of hashes. The project features a custom rule password cracker and a mangling engine that uses a domain-specific language to transform wordlist entries into common password mutation patterns. It provides hardware-accelerated recovery by distributing parallel processing tasks

This project is a WPA Wi-Fi cracking toolkit designed for capturing authentication handshakes and recovering WPA/WPA2 passwords. It provides specialized utilities for scanning wireless networks, obfuscating hardware addresses, and generating password lists to facilitate security audits. The toolkit differentiates itself through a focused workflow that combines handshake capture tools with a password wordlist generator. It enables the interception of the four-way authentication process between wireless clients and access points and utilizes these captured credentials for recovery via dictionar

fsociety is a penetration testing framework and security tool orchestrator designed to conduct full security audits. It functions as a wrapper that integrates external security binaries into a unified, menu-driven interface, providing a centralized system for command-line parameter mapping and execution. The project distinguishes itself by organizing specialized utilities into domain-specific collections for structured navigation. It automates the transition between different phases of an audit by chaining reconnaissance and exploitation tools through sequential workflow automation. The fram

Hydra is a network login password cracker and authentication tester designed to identify valid usernames and passwords through automated brute-force and dictionary attacks. It serves as a multi-protocol authentication tester capable of verifying credentials across a wide range of remote network services, including SSH, SMB, FTP, and various database listeners. The project is distinguished by its ability to execute parallelized password attacks against multiple servers and protocols simultaneously. It features a modular system for implementing diverse network authentication schemes, allowing f

Probable-Wordlists is a collection of curated data resources providing password frequency lists, character masks, and common identity identifiers for security research. These resources serve as credential analysis tools to identify popular password trends and support the creation of secure credentials. The project provides password frequency wordlists and security research wordlists, including common usernames and top-level domains. It includes password recovery datasets featuring character masks and rule sets designed to analyze vulnerability patterns. The repository covers a broad range of

airgeddon is a bash-based wireless network audit suite and security toolkit for Linux. It serves as a framework for testing wireless vulnerabilities and verifying network configurations across various encryption standards, including WPA, WEP, and WPS. The project functions as an orchestration layer that integrates a collection of third-party wireless security tools. It features a modular approach to attack vectorization, coordinating tasks such as evil twin simulations with captive portals, WPA handshake interception, and the execution of WPS vulnerability tests. Its capabilities cover a bro

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

LessPass is a stateless password manager that generates deterministic, site-specific passwords entirely on the client device. It uses a pure function to derive passwords from a master password combined with site details, producing the same output every time without storing any secrets on a server or requiring network access. This approach means passwords can be recalculated on any device from remembered inputs, with no database synchronization needed. The project distinguishes itself through its counter-based password rotation, which allows changing a site's password by incrementing a counter

Ce projet est un utilitaire d'audit de sécurité et de test d'intrusion conçu pour automatiser la devinette de mots de passe, le credential stuffing et le brute-forcing de comptes sur Instagram. Il fonctionne comme un auditeur de récupération de compte qui simule des attaques de connexion automatisées pour tester la force des mots de passe des comptes. L'outil intègre un gestionnaire de proxy pour gérer l'importation et le monitoring de listes de proxys. Ce système route les requêtes via des adresses IP rotatives et surveille la santé des proxys pour élaguer les adresses non réactives et éviter la limitation de débit (rate limiting). Le logiciel fournit des capacités pour l'exécution de requêtes concurrentes et la gestion automatisée de sessions pour simuler des requêtes de navigateur authentiques. Il prend en charge le test itératif de mots de passe candidats et l'utilisation d'attaques par dictionnaire pour évaluer les vulnérabilités des comptes.

Ce projet est une base de connaissances red teaming et un playbook de sécurité offensive conçu pour simuler le comportement d'un adversaire. Il sert de collection complète de guides techniques et de tactiques pour mener des opérations de red team. Le dépôt fournit des instructions détaillées pour l'exploitation d'Active Directory, y compris l'abus de Kerberos et l'élévation de privilèges de domaine. Il couvre l'évasion de défense via le déhooking d'API et l'obfuscation de payload, ainsi que la recherche sur les composants internes de Windows impliquant la manipulation d'objets noyau et de la mémoire système. La surface de capacité s'étend aux tests de pénétration réseau, à l'analyse et à l'ingénierie de logiciels malveillants, et au déploiement d'infrastructures de sécurité offensive. Il inclut également des méthodes pour le mouvement latéral, la persistance et l'exfiltration de données dans les environnements d'entreprise.

wlan-sec-test-tool est une collection d'outils de sécurité sans fil spécialisés conçus pour scanner les points d'accès, auditer la sécurité WPA, WPA2 et WPA3, et effectuer le craquage automatique de mots de passe et le test de connexion. Il fonctionne comme un scanner de réseau sans fil, un craqueur de mots de passe et un auditeur de sécurité pour évaluer les vulnérabilités des protocoles sans fil. L'outil se différencie par l'utilisation d'un testeur de connexion concurrent qui exécute plusieurs tentatives de connexion simultanées. Il utilise des listes de mots de passe personnalisées et une itération basée sur des dictionnaires pour vérifier la sécurité du réseau sans fil et déterminer si les réseaux peuvent être accédés sans autorisation. Le projet couvre des capacités plus larges en découverte sans fil, incluant la capture d'informations de points d'accès et la détection de standards de chiffrement. Il fournit également la configuration de l'interface réseau et la surveillance de l'état de connexion pour gérer les adaptateurs sans fil pendant l'analyse de sécurité.

SocialBox-Termux is a credential bruteforce suite and security tool collection designed to run within the Termux Android environment. It functions as an automated account cracker used to test password lists against usernames to discover valid login credentials for social media and email platforms. The toolkit incorporates network traffic masking by routing requests through the Tor network to conceal the origin IP address. It utilizes signature-based rate bypass to mimic legitimate client traffic and avoid automated login blocks. The suite provides capabilities for account validation to verif

This project is a curated, version-controlled directory of software and resources designed for cybersecurity professionals and researchers. It functions as a centralized knowledge base that aggregates and organizes external security utilities into a structured taxonomy to facilitate discovery and access for specialized research and testing tasks. The repository distinguishes itself through a community-driven model where external resource locations are verified and maintained by contributors. By leveraging a distributed version control system, the project ensures the historical integrity and c

WinPwn is a Windows penetration testing framework designed for conducting internal security assessments and privilege escalation. It functions as a suite for Active Directory security auditing, credential extraction, and the execution of privilege escalation scripts. The toolset enables the automation of SMB relay attacks to intercept and reuse authentication hashes. It provides specialized capabilities for retrieving passwords and hashes from system memory, registries, and browsers using obfuscated techniques to avoid detection. The framework covers broad capability areas including domain a

Ethical-Hacking-Labs is a comprehensive cybersecurity training curriculum and lab suite designed for learning penetration testing, network analysis, and offensive security techniques. It provides a structured environment for practicing the full attack lifecycle, from initial reconnaissance and scanning to exploitation and post-compromise analysis. The project provides instructional materials and guided exercises that cover specific technical domains, including open source intelligence research and network security courseware. It includes a practical workbook for identifying system vulnerabili

中文

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe