#1Phishing simulation, detection, analysis, and security awareness training tools.
Kitploit recommended
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
julioliraup/antiphishingAdvanced Phishing Protection: Suricata rulesets open and free
rderaison/bromureProper sandboxing for agentic coding and web browsing
sublime-security/sublime-rulesSublime rules for email attack detection, prevention, and threat hunting.
beefproject/beefThe Browser Exploitation Framework Project
rspamd/rspamdSpam filtering and email processing framework with regex rules, statistical analysis, custom Lua plugins, and external blocklists for MTA integration.
grisuno/lazyownRed team framework and multi-operator C2 platform with AI agents, malleable implants, rootkits, phishing engine, and 741 CLI commands covering the…
mattkeeley/spoofyBulk domain spoofability checker using authoritative SPF and DMARC record analysis with custom, real-world tested spoof logic and optional DKIM…
criticalpathsecurity/zeek-intelligence-feedsAggregated Zeek-format threat intelligence feeds with combined indicators from public and curated sources for continuous IDS and network threat…
ilianazz/young-domain-guardBrowser extension that warns users about recently registered domains to prevent phishing attacks. Queries RDAP to check domain age and displays…
sherlock-project/sherlockHunt down social media accounts by username across social networks
specterops/skillsReusable offensive security skills and plugins for AI agents, covering reconnaissance, exploitation, C2, payload development, and reporting across…
s3n4t0r-0x0/bear-c2The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a…
hac01/azure-pentesting-suiteGo toolkit for authorized Azure security assessments: enumerates subscriptions and resources, audits misconfigurations, and attacks public Blob…
fluxionnetwork/fluxionAutomated WPA/WPA2 phishing tool that captures handshakes, spawns a rogue access point, and lures users to a captive portal to harvest credentials…
fkasler/cuddlephishWeaponized Browser-in-the-Middle (BitM) for Penetration Testers
shaheeryasirofficial/smugglemypayloadGenerates HTML smuggling pages that embed and reconstruct files client-side via JavaScript, with payload encoding, chunking, obfuscation, and…
qyvora/qyvora-toha3eeGo-based network exploitation and MITM framework for authorized penetration testing, network reconnaissance, traffic interception, wireless security…
