Awesome GitHub RepositoriesPenetration Testing Frameworks

This project is a comprehensive cybersecurity tool collection designed to support security research, penetration testing, and vulnerability assessment. It functions as a unified penetration testing suite, providing a centralized environment where professionals can access a wide range of offensive security utilities to identify system weaknesses and study attack vectors. The platform distinguishes itself through a modular architecture that aggregates disparate security scripts into a single, hierarchical command-line interface. It simplifies the management of these utilities by integrating ext

Strix is an automated security research and vulnerability scanning platform that leverages language models to orchestrate complex security analysis tasks. It functions as a comprehensive framework for penetration testing and continuous security integration, allowing users to embed automated vulnerability research directly into development pipelines or execute it within isolated, containerized environments. The platform distinguishes itself through a multi-agent orchestration engine that coordinates specialized autonomous agents to perform parallel security assessments. By integrating LLM-agno

DVWA is a vulnerable web application sandbox and PHP security training environment. It serves as a deployable penetration testing target and an OWASP Top 10 lab designed for practicing exploits and simulating common web security vulnerabilities. The application allows users to adjust security difficulty levels to match their skill level and toggle between different SQL database engines to test how various systems handle injection attacks. It includes a mechanism to disable authentication, enabling automated security tools to interact directly with the environment. The project provides capabi

fsociety is a penetration testing framework and security tool orchestrator designed to conduct full security audits. It functions as a wrapper that integrates external security binaries into a unified, menu-driven interface, providing a centralized system for command-line parameter mapping and execution. The project distinguishes itself by organizing specialized utilities into domain-specific collections for structured navigation. It automates the transition between different phases of an audit by chaining reconnaissance and exploitation tools through sequential workflow automation. The fram

Empire is a command and control framework and post-exploitation toolkit used for network penetration testing. It serves as a centralized platform for coordinating remote agent communication and automating the delivery of security testing payloads to target systems. The project provides a suite of modules for host reconnaissance, lateral movement, and credential harvesting across corporate environments. It functions as a remote administration tool to maintain persistence and execute commands on compromised hosts. The framework incorporates capabilities for agent orchestration and the executio

Commando-VM is a Windows penetration testing distribution and offensive security toolkit. It provides a specialized virtual machine environment loaded with a curated suite of security auditing and exploitation tools designed for red teaming operations. The project facilitates the creation of red team infrastructure and security audit environments. It focuses on windows security auditing and penetration testing to help simulate adversary behavior and identify exploitable security flaws. The environment is established through script-based provisioning and modular toolset deployment. This proce

Nettacker is an automated penetration testing framework designed to orchestrate reconnaissance, port scanning, and vulnerability detection. It functions as a network reconnaissance tool and vulnerability scanner that identifies open ports, fingerprints services, and checks systems against databases of known security flaws. The framework distinguishes itself by combining a web application crawler for discovering hidden paths via fuzzing with a vulnerability management system that persists scan results in a database to track historical assessments. It also includes specialized capabilities for

Kube-hunter Kubernetes क्लस्टर्स के लिए एक सुरक्षा स्कैनर और भेद्यता हंटर है। यह एक क्लाउड-नेटिव पेनेट्रेशन टूल के रूप में कार्य करता है जिसे हमलावर तकनीकों का अनुकरण करके सुरक्षा कमजोरियों, इंफ्रास्ट्रक्चर मिसकॉन्फ़िगरेशन और शोषण योग्य अंतराल की पहचान करने के लिए डिज़ाइन किया गया है। यह टूल एक डुअल-मोड स्कैनिंग इंजन के माध्यम से खुद को अलग करता है जो रिमोट बाहरी प्रोब्स और आंतरिक नेटवर्क स्कैन दोनों को निष्पादित करता है। इसमें पहचान-आधारित प्रतिरूपण (impersonation) की सुविधा है, जो इसे विशिष्ट क्लस्टर रोल्स से सुरक्षा एक्सेस का अनुकरण करने और कंटेनर समझौते के संभावित ब्लास्ट रेडियस को निर्धारित करने के लिए सर्विस अकाउंट टोकन्स और पॉड पहचान का उपयोग करने की अनुमति देता है। यह प्रोजेक्ट सुरक्षा मूल्यांकन क्षमताओं की एक विस्तृत श्रृंखला को कवर करता है, जिसमें क्लस्टर भेद्यता स्कैनिंग, आंतरिक नेटवर्क टोपोलॉजी मैपिंग और अनुपालन सत्यापन शामिल है। यह उजागर रहस्यों का पता लगा सकता है, मिसकॉन्फ़िगरेशन के लिए इंफ्रास्ट्रक्चर टेम्प्लेट्स का विश्लेषण कर सकता है, और यह सत्यापित करने के लिए सक्रिय शोषण प्रयासों को निष्पादित कर सकता है कि खोजी गई कमजोरियां लाभ उठाने योग्य हैं या नहीं। एप्लिकेशन को डिप्लॉयमेंट के दौरान रनटाइम डिपेंडेंसी को हटाने के लिए एक स्टैंडअलोन निष्पादन योग्य (executable) के रूप में पैक किया गया है।

AntSword एक क्रॉस-प्लेटफॉर्म वेब मैनेजर और पेनेट्रेशन टेस्टिंग फ्रेमवर्क है जिसे कई रिमोट वेबसाइट एनवायरनमेंट के केंद्रीकृत प्रशासन के लिए डिज़ाइन किया गया है। यह एक रिमोट वेबसाइट एडमिनिस्ट्रेशन टूल और वेब शेल मैनेजमेंट टूल के रूप में कार्य करता है, जो यूज़र्स को एक ही इंटरफेस से विविध वेब सर्वर्स को व्यवस्थित और नियंत्रित करने की अनुमति देता है। यह प्रोजेक्ट सुरक्षा शोधकर्ताओं के लिए अधिकृत सुरक्षा ऑडिट करने और कमजोरियों की पहचान करने के लिए एक टूलकिट प्रदान करता है। यह वेब एप्लिकेशन व्यवहार का विश्लेषण करने और संभावित एक्सप्लॉइट्स की खोज करने के लिए वेब पेनेट्रेशन टेस्टिंग और सुरक्षा अनुसंधान वर्कफ़्लो का समर्थन करता है। यह सिस्टम रिमोट वेबसाइट एडमिनिस्ट्रेशन और क्रॉस-प्लेटफॉर्म वेब प्रबंधन में व्यापक क्षमताओं को कवर करता है, जो विभिन्न ऑपरेटिंग सिस्टम और होस्टिंग प्लेटफॉर्म पर प्रशासनिक कार्यों और सुरक्षा जांच को निष्पादित करने में सक्षम बनाता है।

Nexphisher is a command-line security utility and social engineering simulation framework designed for capturing credentials during authorized security audits. It functions as a tool for credential harvesting and penetration testing to evaluate organizational resilience against phishing attacks. The system orchestrates the deployment of realistic login pages and integrates network tunneling to expose local web servers to the public internet. This allows for remote security testing and the execution of controlled social engineering simulations. The framework provides capabilities for template

RED_HAWK is a penetration testing framework and reconnaissance suite designed for information gathering and vulnerability assessment. It provides a toolkit for infrastructure reconnaissance, technology stack detection, automated web spidering, and security scanning. The project distinguishes itself through a multi-stage reconnaissance pipeline that maps attack surfaces. This includes DNS-based infrastructure mapping to resolve network layouts and pattern-based detection to identify specific content management systems and server stacks. The system covers a broad range of capabilities includin

WinPwn is a Windows penetration testing framework designed for conducting internal security assessments and privilege escalation. It functions as a suite for Active Directory security auditing, credential extraction, and the execution of privilege escalation scripts. The toolset enables the automation of SMB relay attacks to intercept and reuse authentication hashes. It provides specialized capabilities for retrieving passwords and hashes from system memory, registries, and browsers using obfuscated techniques to avoid detection. The framework covers broad capability areas including domain a

Ethical-Hacking-Labs is a comprehensive cybersecurity training curriculum and lab suite designed for learning penetration testing, network analysis, and offensive security techniques. It provides a structured environment for practicing the full attack lifecycle, from initial reconnaissance and scanning to exploitation and post-compromise analysis. The project provides instructional materials and guided exercises that cover specific technical domains, including open source intelligence research and network security courseware. It includes a practical workbook for identifying system vulnerabili

Nexmon is a suite of operational tools designed for firmware patching, ROM extraction, frame injection, and enabling monitor mode on wireless hardware. It provides utilities to modify wireless chip firmware to unlock low-level hardware capabilities not supported by official drivers. The project enables the activation of monitor mode for capturing raw network packets with radiotap headers and allows for the transmission of custom-crafted wireless frames. It includes tools for dumping the read-only memory of wireless chips to facilitate reverse engineering and analysis of hardware behavior. Th

Lockdoor-Framework is a modular penetration testing suite designed to facilitate comprehensive security assessments through a centralized command-line interface. It functions as an integrated platform for reconnaissance, vulnerability scanning, and the exploitation of target systems, providing a unified environment for managing complex security workflows. The framework distinguishes itself through a modular plugin architecture that allows for the extension of core capabilities without modifying the underlying codebase. It incorporates an automated reconnaissance pipeline to map attack surface