#1Tools for testing, exploiting, and securing web applications and APIs.
Kitploit recommended
garrytan/gstackUse Garry Tan's exact Claude Code setup: 23 opinionated tools that serve as CEO, Designer, Eng Manager, Release Manager, Doc Engineer, and QA
hack-with-github/awesome-hackingA collection of various awesome lists for hackers, pentesters and security researchers
owasp/cheatsheetseriesThe OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
trimstray/the-book-of-secret-knowledgeA collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
z4nzu/hackingtoolAll-in-one penetration testing toolkit aggregating 185+ tools across 20 categories including information gathering, web & wireless attacks, phishing,…
swisskyrepo/payloadsallthethingsA list of useful payloads and bypass for Web Application Security and Pentest/CTF
danielmiessler/seclistsCurated collection of wordlists for security assessments, including usernames, passwords, URLs, fuzzing payloads, and sensitive data patterns for…
enaqx/awesome-pentestA collection of awesome penetration testing resources, tools and other shiny things
usestrix/strixOpen-source AI penetration testing tool to find and fix your app’s vulnerabilities.
mitmproxy/mitmproxyAn interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
caddyserver/caddyFast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
sqlmapproject/sqlmapAutomatic SQL injection and database takeover tool
d4vinci/scrapling🕷️ An adaptive Web Scraping framework that handles everything from a single request to a full-scale crawl!
keygraphhq/shannonShannon is an autonomous, white-box AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes…
gorhill/ublockWide-spectrum content blocker for browsers that blocks ads, trackers, coin miners, and malicious sites using filter lists and customizable privacy…
naibowang/easyspiderA visual no-code/code-free web crawler/spider易采集：一个可视化浏览器自动化测试/数据采集/网页爬虫软件，可以无代码图形化的设计和执行爬虫任务。别名：ServiceWrapper面向Web应用的智能化服务封装系统。
symfony/symfonyThe Symfony PHP framework
certbot/certbotCertbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any…
