Ranked by Attention Score: stars gained over the last 90 complete days
1–100 of 360 by Attention Score · Aug 5, 2026 – Nov 2, 2026 (UTC)
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
Hunt down social media accounts by username across social networks
Useful tool to track location or mobile number
SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. Users are neither tracked nor profiled.
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Secure, Fast, and Extensible Sandbox runtime for AI agents.
Open Data Platform for analysts, quants and AI agents.
🕵️♂️ Collect a dossier on a person by username from 6K websites
The authentication glue you need.
holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.
ALL IN ONE Hacking Tool For Hackers
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
Open source software that helps you create and deploy high-frequency crypto trading bots
Automated Penetration Testing Agentic Framework Powered by Large Language Models
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
Trail of Bits skills for security research, vulnerability detection, and audit workflows
E-mails, subdomains and names Harvester - OSINT
A unified trading API with more than 100 crypto exchanges and prediction markets in JavaScript / TypeScript / Python / C# / PHP / Go / Java / Rust
the LLM vulnerability scanner
[MLsys2026 Best Paper]: https://arxiv.org/abs/2506.08276. RAG on Everything with LEANN. Enjoy 97% storage savings while running a fast, accurate, and 100% private RAG application on your personal device.
Google Chromium, sans integration with Google
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
Awesome Privacy - A curated list of services and alternatives that respect your privacy because PRIVACY MATTERS.
Automatic SQL injection and database takeover tool
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Download pictures (or videos) along with their captions and other metadata from Instagram.
Daemon to ban hosts that cause multiple authentication errors
The recursive internet scanner for hackers. 🧡
~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
open-source agentic AI data assistant for the next generation of AI + Data products.
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Main Sigma Rule Repository
Low code web framework for real world applications, in Python and Javascript
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
Web path scanner
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
Personal memory across agents
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
An all-in-one hacking tool to remotely take over Android devices.
🐶 A curated list of Web Security materials and resources.
Deduplicating archiver with compression and authenticated encryption.
Automated Adversary Emulation Platform
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
Rich-powered CLI that breaks each HTTP request into DNS, connect, TLS, wait, and transfer phases with waterfall timelines, compact summaries, or metrics-only output.
The property-based testing library for Python
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
Incredibly fast crawler designed for OSINT.
No description provided by the repository host.
Volatility 3.0 development
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
Malware Configuration And Payload Extraction
Scapy: the Python-based interactive packet manipulation program & library.
The Rogue Access Point Framework
Catch API bugs before your users do
Reverse engineering and pentesting for Android applications
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
📱 objection - runtime mobile exploration
CTF framework and exploit development library
Insular email distribution - mail server as Docker images
fsociety Hacking Tools Pack – A Penetration Testing Framework
Bandit is a tool designed to find common security issues in Python code.
Scanning APK file for URIs, endpoints & secrets.
Securely and anonymously share files, host websites, and chat with friends using the Tor network
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
Set up a personal VPN in the cloud
The FLARE team's open-source tool to identify capabilities in executable files.
Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)
A high performance offensive security tool for reconnaissance and vulnerability scanning
an awesome list of honeypot resources
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
ValueCell is a community-driven, multi-agent platform for financial applications.
Common User Passwords Profiler (CUPP)
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
CTFs as you need them
🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.
Exploitation Framework for Embedded Devices
Automated Αll-in-One OS command injection exploitation tool.
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
Reverse engineering tool for Linux
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
Malicious traffic detection system
PyInstaller Extractor
Hercules is the world’s first open-source testing agent, enabling UI, API, Security, Accessibility, and Visual validations – all without code or maintenance. Automate testing effortlessly and let Hercules handle the heavy lifting! ⚡
Investigate malicious Windows logon by visualizing and analyzing Windows event log
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
Multi-Cloud Security Auditing Tool