Ranked by Attention Score: stars gained over the last 30 complete days
1–100 of 322 by Attention Score · Oct 4, 2026 – Nov 2, 2026 (UTC)
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Eleven free Claude skills that clone any app: reverse-engineer it, rebuild it, test it for bugs, then fix what its users hate. Free, MIT.
Point Claude at any game. Skills, tools and the fal MCP that let Claude Code mod almost any PC game you own: recon, reverse engineering, fal-generated art/3D/audio, in-game testing, showcase videos.
An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
Enterprise-grade Shopify Admin API authentication adapter — OAuth 2.0 Client Credentials Grant with automatic token refresh.
Useful tool to track location or mobile number
Hunt down social media accounts by username across social networks
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
ALL IN ONE Hacking Tool For Hackers
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
🕵️♂️ Collect a dossier on a person by username from 6K websites
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
Open Data Platform for analysts, quants and AI agents.
SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. Users are neither tracked nor profiled.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
DeepSeek Harness 破甲一体化安全分析插件：Android · Web · Native · Protocol · Malware · AI-Security 全领域聚合（9 bundle + 1 preset）
十五个 AI 客户端的内置提示词一键替换：双击即用、可自证、改前备份、一键还原。v8.26：一键破甲全程托管（自动结束进程+注入+自动拉起）、注入步骤实时提示、写后自检回滚、托盘常驻。免装 Python 单文件 exe，完全免费开源。
[MLsys2026 Best Paper]: https://arxiv.org/abs/2506.08276. RAG on Everything with LEANN. Enjoy 97% storage savings while running a fast, accurate, and 100% private RAG application on your personal device.
Secure, Fast, and Extensible Sandbox runtime for AI agents.
Real-time network monitor + outbound firewall — see & block every connection. Privacy-first, local-first, Rust fleet agent, SIEM exports, 8 languages. / Moniteur réseau temps réel + pare-feu sortant, agent de flotte Rust, exports SIEM. 100 % local.
Open source software that helps you create and deploy high-frequency crypto trading bots
Samsung Tizen root
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
Trail of Bits skills for security research, vulnerability detection, and audit workflows
Automated Penetration Testing Agentic Framework Powered by Large Language Models
MCP gateway & OAuth MCP servers. LangGraph agent: memory, eval/tracking, PII guard, context trimming. Docker quick start for enterprise agents.
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
A unified trading API with more than 100 crypto exchanges and prediction markets in JavaScript / TypeScript / Python / C# / PHP / Go / Java / Rust
E-mails, subdomains and names Harvester - OSINT
Qoder国际国内多账号反代网关，Qoder 国际国内双区多账号 OpenAI 兼容网关中枢 — COSY 签名推理、稳定设备指纹防风控、OAuth 设备授权免客户端登录、每日签到与 Pro 福利、后台定时调度器、Web 监控看板，支持 Codex / Claude Code 与标准 OpenAI 客户端
holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.
the LLM vulnerability scanner
The authentication glue you need.
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.
Google Chromium, sans integration with Google
Download pictures (or videos) along with their captions and other metadata from Instagram.
The recursive internet scanner for hackers. 🧡
Awesome Privacy - A curated list of services and alternatives that respect your privacy because PRIVACY MATTERS.
Automatic SQL injection and database takeover tool
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Daemon to ban hosts that cause multiple authentication errors
No description provided by the repository host.
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
Main Sigma Rule Repository
Rebuild a reference video as an editable HyperFrames project, compare the match against the original, and export an MP4.
open-source agentic AI data assistant for the next generation of AI + Data products.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
Automated Adversary Emulation Platform
Low code web framework for real world applications, in Python and Javascript
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
🐶 A curated list of Web Security materials and resources.
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
Web path scanner
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
Security linter for AI-generated code: catches the exact vulnerabilities Copilot, Cursor and ChatGPT repeatedly produce. SQL injection, hardcoded secrets, JWT bypass, command injection and 15+ more rules. Grade A–F. Zero config. CI/CD ready.
Personal memory across agents
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
Nosis is a lightweight personal agent runtime: per-session execution boundaries with OS-level sandboxing, computer use, a full built-in toolset, Skill / Plugin / MCP extensions, one runtime shared by GUI and TUI, and file-persisted sessions, plans, and memory.
Volatility 3.0 development
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
An all-in-one hacking tool to remotely take over Android devices.
Securely and anonymously share files, host websites, and chat with friends using the Tor network
Deduplicating archiver with compression and authenticated encryption.
Malware Configuration And Payload Extraction
Scapy: the Python-based interactive packet manipulation program & library.
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
The property-based testing library for Python
Catch API bugs before your users do
Incredibly fast crawler designed for OSINT.
Reverse engineering and pentesting for Android applications
The FLARE team's open-source tool to identify capabilities in executable files.
Bandit is a tool designed to find common security issues in Python code.
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Insular email distribution - mail server as Docker images
CTF framework and exploit development library
The Rogue Access Point Framework
an awesome list of honeypot resources
📱 objection - runtime mobile exploration
fsociety Hacking Tools Pack – A Penetration Testing Framework
Set up a personal VPN in the cloud
Common User Passwords Profiler (CUPP)
Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)
Scanning APK file for URIs, endpoints & secrets.
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Multi-Cloud Security Auditing Tool
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.