This repository is a curated 'awesome list' of password cracking tools, research, and resources — not a software application. The primary artifact is a single, comprehensive README.md that catalogs ~150 tools and resources across 15+ categories: hashcat automation/distributed cracking/rules, John the Ripper tooling, cloud-based cracking (AWS/Colab), wordlist generators and analyzers, hash conversion utilities, ML/AI password guessing models, academic papers (2009-2026), and notable researchers in the field. The list is alphabetically sorted, CC0-licensed, and maintained by a human curator who explicitly rejects AI-generated contributions. The repo's engineering value lies in its community governance infrastructure. A GitHub Actions workflow (pr-quality.yaml) uses peakoss/anti-slop to automatically detect and close AI-generated or spam PRs, enforcing account age, profile completeness, PR size limits, and maintainer-can-modify permissions. A second workflow runs awesome-lint to enforce list formatting standards. The PR template requires AI self-disclosure via a magic string. This governance stack is a genuinely reusable pattern for any community-curated repository facing AI slop. The content is current (papers through 2026) and the repo is actively maintained with zero open issues. While it contains no application code, it serves as a high-value reference index for security researchers, penetration testers, and anyone working on password recovery or authentication security. The hybrid nature: it's a curated data resource (the list itself) wrapped in application-grade CI/CD governance.
This repository is a curated collection of wordlists for bug bounty hunting and web application security testing. It aggregates URL paths, payloads, and vulnerability probes from multiple public sources (SecLists, OneListForAll, dirsearch, nuclei-templates, etc.) into a unified, organized dataset. The wordlists are categorized by technology (e.g., Apache, WordPress, Nginx) and severity (info, low, medium, high, critical), making them directly usable with tools like Nuclei, ffuf, and dirsearch. The repository includes two automation scripts: a shell script that fetches and deduplicates wordlists from external URLs, and a Go program that parses nuclei-templates YAML files to generate technology-specific wordlists. These scripts are run weekly via GitHub Actions to keep the dataset current. The repository is purely a data asset; it contains no application code, APIs, or services. Its primary value is as a ready-to-use, aggregated wordlist source for security researchers and penetration testers.
Mentalist is a desktop GUI application for generating custom wordlists targeting password security auditing. Built with Python Tkinter, it allows users to construct chains of operations (base words, case changes, substitutions, appending/prepending) to produce wordlists or rule sets compatible with Hashcat and John the Ripper. The application follows an MVC architecture: the model handles chain/node/attribute logic, the view manages Tkinter UI components, and the controller mediates between them. Key features include real-time word count estimation, saving/loading chain configurations, and background threading for responsive UI during intensive operations. The tool is designed for authorized penetration testing and includes bundled word lists and reference data.