Open-source alternatives to HackTools

EHole is a specialized toolkit for network asset parsing, binary transformation, payload generation, and vulnerability research. It functions as an asset discovery and fingerprinting tool designed to identify software versions and high-value assets across IP ranges and URLs using custom fingerprints. The project provides a vulnerability research toolkit for decrypting software credentials and retrieving factory default passwords for security devices and web applications. It also includes a security payload generator for encoding and escaping command strings to bypass shell tokenization and ex

Villain is a command and control framework and distributed orchestrator designed for managing reverse TCP and HoaxShell connections. It serves as a reverse shell manager and payload generation tool, allowing for the coordination of remote access across multiple target systems. The project distinguishes itself through a distributed architecture that synchronizes active remote sessions and broadcasts messages across connected server instances for collaborative operations. It includes a fileless execution engine that runs scripts directly in remote memory over HTTP to avoid writing files to the

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

Dalfox is an automated web application security tool specifically designed for discovering and verifying cross-site scripting vulnerabilities. It functions as an XSS vulnerability scanner that analyzes HTTP parameters and DOM structures to identify reflected, stored, and blind injection points. The project distinguishes itself by providing a Model Context Protocol server and a REST API, allowing artificial intelligence agents and remote interfaces to trigger and manage security scans programmatically. It utilizes a payload mutation engine and fingerprinting strategies to execute WAF evasion t

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

Retire.js is a JavaScript vulnerability scanner and dependency security analyzer. It identifies outdated or insecure JavaScript libraries with known security flaws within web applications and local projects. The tool functions as a web security auditing utility that can be used during penetration testing to detect vulnerable scripts on live websites. It supports the generation of Software Bills of Materials using the CycloneDX format to document project dependencies. The system utilizes signature-based library detection and pattern-matching to map identified versions against a JSON-based sec

This project is a comprehensive command-line reference and toolkit designed for Linux system administration and network security assessment. It provides a collection of technical snippets and operational guides focused on managing remote environments, orchestrating shell sessions, and executing administrative tasks through native terminal utilities. The repository distinguishes itself by offering specialized techniques for stealthy operations and infrastructure manipulation. It covers methods for establishing encrypted tunnels to bypass firewalls, obfuscating process identities and command hi

Ladon is an internal network penetration scanner and vulnerability assessment tool designed to identify high-risk security flaws and assets across network segments. It operates as a fileless security scanner, executing its engine and modules directly in memory to avoid leaving a disk footprint on target systems. The project is distinguished by its integration as a plugin for command beacons, specifically within the Cobalt Strike framework. This allows for memory-resident network discovery and vulnerability detection. It further supports stealth operations through payload and script obfuscatio

This project is a comprehensive cybersecurity tool collection designed to support security research, penetration testing, and vulnerability assessment. It functions as a unified penetration testing suite, providing a centralized environment where professionals can access a wide range of offensive security utilities to identify system weaknesses and study attack vectors. The platform distinguishes itself through a modular architecture that aggregates disparate security scripts into a single, hierarchical command-line interface. It simplifies the management of these utilities by integrating ext

This project is a comprehensive toolkit for Linux security auditing and system enumeration. It functions as a framework for identifying configuration weaknesses, gathering system information, and detecting vulnerabilities to assist in gaining higher administrative access levels on Linux systems. The toolkit includes specialized capabilities for version-based vulnerability scanning, which matches installed software against known affected releases, and time-window process monitoring to track recurring system patterns and periodic tasks. It also provides infrastructure for hosting and delivering

fuzzDicts is a repository of curated wordlists and dictionaries designed for web application fuzzing. It provides collections of strings and payloads used to discover hidden files, subdomains, and security vulnerabilities. The project includes specialized libraries for different security testing vectors, such as dictionaries for common request and cookie parameters, lists of common subdomain prefixes, and collections of passwords and default vendor credentials for brute-force testing. It also maintains a security payload library containing character sequences used to identify flaws like SQL i

Veil-Evasion is a framework designed for generating custom executable files to test defensive systems. It functions as a security testing utility that simulates patterns used to bypass security software during authorized penetration testing. The platform distinguishes itself through a modular build system that transforms scripts into standalone native binaries, ensuring consistent execution across different operating systems without external dependencies. It utilizes template-based source injection to construct these payloads, allowing for the dynamic configuration of executable files during

This project is a custom firmware for the Flipper Zero that provides an embedded plugin ecosystem, a hardware pentesting toolkit, and a multi-protocol emulation layer. It modifies the device's operating system to include a Sub-GHz radio suite for expanded frequency range and the ability to build and deploy third-party applications directly onto the hardware. The firmware extends the device's native capabilities through a Sub-GHz radio suite that allows for frequency extension and signal capture beyond factory defaults. It implements specialized emulation for BadUSB and BLE keyboards and inclu

AntSword is a cross-platform web manager and penetration testing framework designed for the centralized administration of multiple remote website environments. It functions as a remote website administration tool and a web shell management tool, allowing users to organize and control diverse web servers from a single interface. The project provides a toolkit for security researchers to perform authorized security audits and identify vulnerabilities. It supports web penetration testing and security research workflows to analyze web application behavior and discover potential exploits. The sys

This tool is a command-line utility designed for automated web resource discovery, fuzzing, and application structure mapping. It functions as a security-focused scanner that identifies hidden files, directories, parameters, and virtual hosts by injecting payloads into HTTP requests. By systematically testing how servers handle various inputs, it assists in mapping the architecture of web applications and uncovering potential security vulnerabilities. The tool distinguishes itself through a highly concurrent engine that manages asynchronous request execution and recursive job orchestration. I

Strix is an automated security research and vulnerability scanning platform that leverages language models to orchestrate complex security analysis tasks. It functions as a comprehensive framework for penetration testing and continuous security integration, allowing users to embed automated vulnerability research directly into development pipelines or execute it within isolated, containerized environments. The platform distinguishes itself through a multi-agent orchestration engine that coordinates specialized autonomous agents to perform parallel security assessments. By integrating LLM-agno

XSStrike is an automated security scanning engine designed for web application discovery, input

TheFatRat is a security exploitation framework designed to automate the creation, obfuscation, and deployment of payloads for penetration testing. It functions as a comprehensive toolkit that streamlines the exploitation lifecycle, enabling users to generate malicious executables, manage network listeners, and execute post-exploitation tasks through a unified command-line interface. The framework distinguishes itself by integrating various third-party exploitation utilities into a single, orchestrated workflow. It provides specialized capabilities for embedding code into legitimate binaries a

Empire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and manages agents written in PowerShell, Python, C#, Go, and C across Windows, Linux, and macOS, using encrypted communication channels over HTTP, HTTPS, and SMB. The framework executes over 400 built-in modules for reconnaissance, privilege escalation, credential theft, and lateral movement, and provides a modular engine for authoring custom attack modules. What sets Empire apart is its multi-language agent deployment system, which allows operators to choose implants that suit each

HowToHunt is a bug bounty hunting knowledge base and a structured guide for web application penetration testing. It provides a research methodology for organizing security testing procedures and validating application behaviors against known vulnerability patterns. The project features a curated library of security flaws and reconnaissance techniques. It organizes security testing into modular playbooks, checklists, and categorical vulnerability mappings to align specific exploitation techniques with target weaknesses. The repository covers a systematic sequence of information gathering task

Discover is an integrated suite of security tools designed for penetration testing, container auditing, payload generation, network reconnaissance, and automated open-source intelligence gathering. This collection of bash scripts provides a coordinated framework for security auditing on Kali Linux and Ubuntu. The toolkit includes a specialized generator for creating reverse shell payloads across various hardware architectures and operating systems, paired with automated configuration for network listeners. It also features a dedicated container security auditor to identify vulnerabilities, le

DVWA is a vulnerable web application sandbox and PHP security training environment. It serves as a deployable penetration testing target and an OWASP Top 10 lab designed for practicing exploits and simulating common web security vulnerabilities. The application allows users to adjust security difficulty levels to match their skill level and toggle between different SQL database engines to test how various systems handle injection attacks. It includes a mechanism to disable authentication, enabling automated security tools to interact directly with the environment. The project provides capabi

This project is a set of specialized utilities for generating malformed documents, obfuscating payloads, and crafting specific attack vectors to evaluate the resilience of security scanners. It functions as a PDF fuzzing framework and security testing tool designed to create PDF files with embedded payloads for verifying how document viewers and web applications handle vulnerabilities. The toolkit provides capabilities for encoding and hiding malicious content to test the detection effectiveness of security scanners. It includes a security payload generator for crafting specific attack vector

DVWA is a vulnerable web application lab and penetration testing sandbox designed to simulate common security flaws. It serves as a training platform for the OWASP Top 10 security risks and functions as a PHP and MySQL security lab for practicing the identification and exploitation of web vulnerabilities. The project provides a graduated learning experience through configurable security levels that adjust the difficulty of the vulnerabilities. It also supports switching between different database engines to research how various storage systems respond to injection attacks. The application is

cve-search is a vulnerability search engine and database manager designed to index, synchronize, and query CVE and CPE security vulnerability data. It functions as a security data warehouse that imports vulnerability feeds into a local database to enable fast, keyword-based discovery of security flaws. The project provides a web-based vulnerability browser and a programmatic JSON API for retrieving records and risk scores. It utilizes full-text indexing for vulnerability descriptions and implements an identity-verified security portal using the OpenID Connect standard for user authentication.

OSV is a distributed database and aggregator of open-source security advisories that uses a standardized vulnerability schema to track security flaws. It functions as a system for collecting and normalizing security data from diverse ecosystems into a single unified format, providing a web API for querying package vulnerabilities and submitting standardized records. The project distinguishes itself through a security advisory distribution service that supports bulk dataset exports via cloud storage buckets and incremental synchronization of security record updates. It also employs sandbox-bas

Ghauri is an automated SQL injection scanner and exploitation tool designed to detect and extract data from vulnerable databases. It functions as a database exfiltration framework that identifies security flaws and retrieves system banners, hostnames, and database schemas. The tool identifies boolean, error, time-based, and stacked query vulnerabilities across multiple input vectors, including HTTP headers, cookies, JSON, SOAP, and XML. It provides capabilities for automated database exfiltration and the processing of bulk target lists to identify flaws across multiple environments. The syst