Open source penetration-testing projects
Every project in the registry tagged penetration-testing, ranked by real GitHub adoption.
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabi
A Modern Orchestration Engine for Security
AI-powered bug bounty hunting toolkit that works with or without subscription.
PentestAgent is an AI agent framework for black-box security testing, supporting bug bounty, red-team, and penetration testing workflows.
Pentest Report Generator
The SpecterOps project management and reporting engine
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance throu
A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features com
Pen Test Report Generation and Assessment Collaboration
Related tags
Frequently asked questions
How many open source penetration-testing projects are there?
This registry tracks 10 projects tagged penetration-testing, with 71,086 GitHub stars between them. The most-adopted is shannon at 48,105 stars.
Are these penetration-testing projects free to use?
Yes — 10 of the 10 carry an explicit open-source licence across 5 distinct licences, so there is no licence fee. Where a project also sells a hosted or enterprise version, the self-hosted path remains free.
Which penetration-testing project should I choose?
The list above is ranked by GitHub stars, but stars measure attention rather than fit. Check three things on each card: the licence (permissive versus copyleft), the language it is written in, and the last-push date — a high-star project that has not been pushed in a year is a liability.
Are these penetration-testing projects still maintained?
10 of the 10 were pushed in the last 90 days, and every card shows its exact last-push date so you can see the rest. Sort your shortlist by that date before committing to a migration.