Open source pentest projects
Every project in the registry tagged pentest, ranked by real GitHub adoption.
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
Next generation web scanner
Applied offensive security with Rust - https://kerkour.com/black-hat-rust
A Security Tool for Bug Bounty, Pentest and Red Teaming.
Pentest Report Generator
Automatic SSTI detection tool with interactive interface
A next generation version of enum4linux (a Windows/Samba enumeration tool) with additional features like JSON/YAML export. Aimed for security professionals and
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
Related tags
Frequently asked questions
How many open source pentest projects are there?
This registry tracks 9 projects tagged pentest, with 114,139 GitHub stars between them. The most-adopted is PayloadsAllTheThings at 82,315 stars.
Are these pentest projects free to use?
Yes — 9 of the 9 carry an explicit open-source licence across 4 distinct licences, so there is no licence fee. Where a project also sells a hosted or enterprise version, the self-hosted path remains free.
Which pentest project should I choose?
The list above is ranked by GitHub stars, but stars measure attention rather than fit. Check three things on each card: the licence (permissive versus copyleft), the language it is written in, and the last-push date — a high-star project that has not been pushed in a year is a liability.
Are these pentest projects still maintained?
6 of the 9 were pushed in the last 90 days, and every card shows its exact last-push date so you can see the rest. Sort your shortlist by that date before committing to a migration.