Ranked by Attention Score: stars gained over the last 180 complete days
1–100 of 342 by Attention Score · May 7, 2026 – Nov 2, 2026 (UTC)
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
🕵️♂️ Collect a dossier on a person by username from 6K websites
Hunt down social media accounts by username across social networks
ALL IN ONE Hacking Tool For Hackers
SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. Users are neither tracked nor profiled.
Open Data Platform for analysts, quants and AI agents.
Useful tool to track location or mobile number
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Secure, Fast, and Extensible Sandbox runtime for AI agents.
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
The authentication glue you need.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.
~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
Automated Penetration Testing Agentic Framework Powered by Large Language Models
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Trail of Bits skills for security research, vulnerability detection, and audit workflows
[MLsys2026 Best Paper]: https://arxiv.org/abs/2506.08276. RAG on Everything with LEANN. Enjoy 97% storage savings while running a fast, accurate, and 100% private RAG application on your personal device.
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
A unified trading API with more than 100 crypto exchanges and prediction markets in JavaScript / TypeScript / Python / C# / PHP / Go / Java / Rust
Open source software that helps you create and deploy high-frequency crypto trading bots
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
E-mails, subdomains and names Harvester - OSINT
the LLM vulnerability scanner
Google Chromium, sans integration with Google
Automatic SQL injection and database takeover tool
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
open-source agentic AI data assistant for the next generation of AI + Data products.
Awesome Privacy - A curated list of services and alternatives that respect your privacy because PRIVACY MATTERS.
Download pictures (or videos) along with their captions and other metadata from Instagram.
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
The recursive internet scanner for hackers. 🧡
Daemon to ban hosts that cause multiple authentication errors
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
Personal memory across agents
Low code web framework for real world applications, in Python and Javascript
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
Main Sigma Rule Repository
Web path scanner
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
Common User Passwords Profiler (CUPP)
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
🐶 A curated list of Web Security materials and resources.
Deduplicating archiver with compression and authenticated encryption.
An all-in-one hacking tool to remotely take over Android devices.
ValueCell is a community-driven, multi-agent platform for financial applications.
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
Automated Adversary Emulation Platform
The property-based testing library for Python
Incredibly fast crawler designed for OSINT.
A high performance offensive security tool for reconnaissance and vulnerability scanning
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
Malware Configuration And Payload Extraction
Volatility 3.0 development
Catch API bugs before your users do
📱 objection - runtime mobile exploration
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Insular email distribution - mail server as Docker images
Scapy: the Python-based interactive packet manipulation program & library.
CTF framework and exploit development library
The Rogue Access Point Framework
fsociety Hacking Tools Pack – A Penetration Testing Framework
Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)
an awesome list of honeypot resources
🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.
Bandit is a tool designed to find common security issues in Python code.
No description provided by the repository host.
Set up a personal VPN in the cloud
Scanning APK file for URIs, endpoints & secrets.
Reverse engineering and pentesting for Android applications
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
Rich-powered CLI that breaks each HTTP request into DNS, connect, TLS, wait, and transfer phases with waterfall timelines, compact summaries, or metrics-only output.
The FLARE team's open-source tool to identify capabilities in executable files.
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
Securely and anonymously share files, host websites, and chat with friends using the Tor network
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
Expose your FastAPI endpoints as Model Context Protocol (MCP) tools, with Auth!
CTFs as you need them
Reverse engineering tool for Linux
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
PyInstaller Extractor
Malicious traffic detection system
Exploitation Framework for Embedded Devices
Multi-Cloud Security Auditing Tool
Universal Radio Hacker: Investigate Wireless Protocols Like A Boss
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
Hercules is the world’s first open-source testing agent, enabling UI, API, Security, Accessibility, and Visual validations – all without code or maintenance. Automate testing effortlessly and let Hercules handle the heavy lifting! ⚡
Automated Αll-in-One OS command injection exploitation tool.
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.