Trending repositories

1.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

2.Oldcircle / geo-sleuth

An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.

• claude-code
• geoguessr
• geolocation
• osint
• agent-skills
• geoint
• +12 more

3.AhmadHassan-BTed / ShopifyAutoAuth

Enterprise-grade Shopify Admin API authentication adapter — OAuth 2.0 Client Credentials Grant with automatic token refresh.

• authentication
• client-credentials
• httpx
• oauth2
• python
• shopify
• +3 more

4.sherlock-project / sherlock

Hunt down social media accounts by username across social networks

• osint
• reconnaissance
• linux
• cli
• sherlock
• python3
• +10 more

5.Z4nzu / hackingtool

ALL IN ONE Hacking Tool For Hackers

• allinonehackingtool
• web-attack
• password-attack
• hacking
• wireless-attack
• besthackingtool
• +7 more

6.smicallef / spiderfoot

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python
• infosec
• intelligence-gathering
• +13 more

7.soxoj / maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

• osint
• social-network
• identification
• socmint
• sherlock
• investigation
• +14 more

8.promptfoo / promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

• llm
• prompt-engineering
• prompts
• llmops
• prompt-testing
• testing
• +12 more

9.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

10.0x4m4 / hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

• 0x4m4
• ai
• ai-agents
• ai-cybersecurity
• ai-hacking
• ai-penetration-testing
• +14 more

11.ntfargo / Relapse-Exploit

Exploit chain for PS5 7.00 - 13.60

• exploit
• kernel
• research
• webkit

12.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

13.icsharpcode / ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

• decompiler
• decompiler-engine
• c-sharp
• dotnet
• dotnetcore
• mono
• +4 more

14.danielmiessler / SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

15.GreyDGL / PentestGPT

Automated Penetration Testing Agentic Framework Powered by Large Language Models

• penetration-testing
• python
• large-language-models
• llm

16.NPMscan / npmscan-action

Catch risky npm dependency changes before they merge.

• dependency-analysis
• devsecops
• github-actions
• malware
• npm
• npm-security
• +2 more

17.ComposioHQ / composio

Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.

• ai
• python
• agents
• aiagents
• function-calling
• developer-tools
• +11 more

18.better-auth / better-auth

The most comprehensive authentication framework

• authentication
• oauth
• oauth2
• typescript
• iam
• oidc
• +2 more

19.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

20.lissy93 / web-check

🕵️‍♂️ All-in-one OSINT tool for analysing any website

• osint
• privacy
• security
• security-tools
• sysadmin

21.juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

• owasp
• javascript
• vulnerable
• hacking
• application-security
• owasp-top-10
• +8 more

22.WhiskeySockets / Baileys

Socket-based TS/JavaScript API for WhatsApp Web

• bun
• deno
• nodejs
• reverse-engineering
• typescript
• websockets
• +2 more

23.SWE-agent / SWE-agent

SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]

• agent
• ai
• developer-tools
• llm
• agent-based-model
• lms
• +1 more

24.horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler
• reverse-engineering
• elf
• +14 more

25.projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

• nuclei-templates
• nuclei
• bugbounty
• security
• nuclei-checks
• exploits
• +4 more

26.ReFirmLabs / binwalk

Firmware Analysis Tool

27.wasp-lang / open-saas

A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.

• full-stack
• open-source
• saas
• nodejs
• prisma
• react
• +14 more

28.MatrixTM / MHDDoS

Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods

• ddos
• ddos-attacks
• ddos-tool
• attack
• cloudflare-bypass
• layer4
• +13 more

29.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

30.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

31.pwndbg / pwndbg

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

• python
• gdb
• pwndbg
• reverse-engineering
• debugging
• ctf
• +12 more

32.redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

• mitre
• mitre-attack

33.szTheory / exifcleaner

Cross-platform desktop GUI app to clean image metadata

• exif
• exiftool
• electron
• javascript
• nodejs
• desktop-app
• +14 more

34.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

35.moonD4rk / HackBrowserData

Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +10 more

36.arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

• privacy
• firefox
• security
• settings
• anti-fingerprinting
• arkenfox
• +2 more

37.bee-san / Ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

• decryption
• natural-language-processing
• cryptography
• cipher
• artificial-intelligence
• ctf-tools
• +11 more

38.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

39.yokoffing / Betterfox

Firefox user.js for optimal privacy and security. Your favorite browser, but better.

• firefox
• anti-tracking
• mozilla
• privacy
• security
• settings
• +5 more

40.Manisso / fsociety

fsociety Hacking Tools Pack – A Penetration Testing Framework

• fsociety
• exploitation
• port-scanning
• fsociety-hacking
• post-exploitation
• web-hacking
• +7 more

41.lucasg / Dependencies

A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.

• windows
• dll
• wpf
• csharp

42.alephdata / aleph

Search and browse documents and data; find the people and companies you look for.

• python
• data-search
• graph-database
• journalism
• osint
• investigative-journalism

43.Col-E / Recaf

The modern Java bytecode editor

• java
• bytecode
• bytecode-engineering
• reverse-engineering
• jvm-bytecode
• decompile
• +8 more

44.BlessedRebuS / Krawl

Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.

• anti-crawling
• cloud-native
• crawler
• deception
• honeypot
• kubernetes
• +11 more

45.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

46.RsaCtfTool / RsaCtfTool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

• rsa-attack
• rsa
• cryptography

47.Mail-0 / Zero

Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord

• ai
• email
• privacy
• security

48.pardeike / Harmony

A library for patching, replacing and decorating .NET and Mono methods during runtime

• csharp
• patcher
• detour
• detours
• runtime
• mono
• +5 more

49.hugsy / gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

• python
• exploit
• gdb
• linux
• reverse-engineering
• ctf
• +13 more

50.horsicq / DIE-engine

DIE engine

• signature
• reverse-engineering
• unpacker
• yara
• elf
• program-analysis
• +5 more

51.GrapheneOS / hardened_malloc

Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.

• malloc
• security
• memory-allocation
• malloc-library
• memory-allocator
• memory
• +4 more

52.stamparm / maltrail

Malicious traffic detection system

• security
• malware
• intrusion-detection
• sensor
• python
• network-monitoring
• +2 more

53.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

54.justauth / JustAuth

Translated🏆Gitee's most valuable open source project 🚀:100: A small, comprehensive and elegant open source component for third-party login. It currently supports authorized login via third-party platforms including Github, Gitee, Weibo, DingTalk, Baidu, Coding, Tencent Cloud Developer Platform, OSChina, Alipay, QQ, WeChat, Taobao, Google, Facebook, Douyin, LinkedIn, Xiaomi, Microsoft, Toutiao, Teambition, StackOverflow, Pinterest, Renren, Huawei, WeCom, Kujiale, Gitlab, Meituan, Ele.me, Twitter, Feishu, JD.com, Alibaba Cloud, Ximalaya, Amazon, Slack and Line. Login, so easy!

• justauth
• oauth2
• qqlogin
• googlelogin
• weixinlogin

55.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

56.onetimesecret / onetimesecret

Keep passwords and other sensitive information out of your chat logs and inboxes.

• privacy
• onetime
• secrets
• chat
• email
• messaging
• +1 more

57.momenbasel / htb-writeups

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

• active-directory
• cheatsheet
• ctf
• cybersecurity
• ethical-hacking
• hackthebox
• +14 more

58.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

59.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

60.avast / retdec

RetDec is a retargetable machine-code decompiler based on LLVM.

61.Volmarg / personal-management-system

Your web application for managing personal data.

• dashboard
• dashboards
• manager
• symfony
• mit
• self-hosted
• +14 more

62.evyatarmeged / Raccoon

A high performance offensive security tool for reconnaissance and vulnerability scanning

• reconnaissance
• scanner
• vulnerability-assessment
• vulnerability-scanner
• enumeration
• pentesting
• +9 more

63.CryptoSignal / Crypto-Signal

Github.com/CryptoSignal - Trading & Technical Analysis Bot - 4,100+ stars, 1,100+ forks

• technical-analysis
• bittrex-api
• crypto
• bitcoin
• ethereum
• trading
• +14 more

64.niklashigi / apk-mitm

🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection

• cli
• reverse-engineering
• android
• apk
• mitm
• certificate-pinning
• +2 more

65.coinpaprika / coinpaprika-api-go-client

Official CoinPaprika API Go client — coin prices, tickers, OHLCV, exchanges, and global market stats.

• api-client
• bitcoin
• blockchain
• coinpaprika
• crypto
• cryptocurrency
• +4 more

66.leibnitz27 / cfr

This is the public repository for the CFR Java decompiler

67.dont-be-evil-company / kulala.nvim

A fully-featured ⚡️ HTTP/GraphQL/gRPC/Websocket-client 🐼 interface 🖥️ for Neovim ❤️, that supports the Jetbrains .http spec (with full scripting support).

• graphql-client
• neovim-plugin
• rest-client
• curl
• http-client
• lua
• +14 more

68.OTRF / ThreatHunter-Playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis
• hunting
• dfir
• +3 more

69.GerbenJavado / LinkFinder

A python script that finds endpoints in JavaScript files

• infosec
• endpoints

70.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

71.stalniy / casl

CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

• authorization
• permissions
• acl
• cancan
• casl
• isomorphic-javascript

72.HMAKT99 / UnTouchID

Use your phone's Face ID or fingerprint to approve sudo and unlock your Mac. QR pairing, encrypted BLE, Secure Enclave signing — keys never leave your phone. Works with iPhone, Android, Apple Watch, Wear OS, or any browser. No $199 Magic Keyboard needed.

• android
• biometrics
• kotlin
• mac-mini
• macbook
• macos
• +13 more

73.spatie / laravel-permission

Associate users with roles and permissions

• laravel
• php
• permission
• secure

74.panva / node-oidc-provider

OpenID Certified™ OAuth 2.0 Authorization Server implementation for Node.js

• openid
• oidc
• openid-provider
• openid-connect
• connect
• server
• +4 more

75.SpacehuhnTech / WiFiDuck

Wireless keystroke injection attack platform

• esp8266
• arduino
• hid
• hacktoberfest

76.martinus / unordered_dense

A fast & densely stored hashmap and hashset

• c-plus-plus
• cpp17
• cpp
• hash
• hash-tables
• header-only-library
• +4 more

77.sorkila / lockpaw

Cover your Mac's screen with a hotkey while AI agents keep running, even with the lid closed. The covered screen glows when Claude Code, Codex or Gemini needs you. Touch ID unlock.

• ai-agents
• developer-tools
• macos
• macos-app
• open-source
• privacy
• +13 more

78.twintproject / twintArchived

An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a user's followers, following, Tweets and more while evading most API limitations.

• osint
• twitter
• python
• scrape
• tweets
• elasticsearch
• +6 more

79.bitcoin-core / secp256k1

Optimized C library for EC operations on curve secp256k1

80.paulmillr / noble-hashes

Audited & minimal JS implementation of hash functions, MACs and KDFs.

• cryptography
• hash
• kdf
• hashing
• sha256
• sha512
• +13 more

81.markbates / goth

Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.

82.pry0cc / axiom

The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!

• hacking-vps
• bug-bounty
• tmux
• axiom
• masscan
• gowitness
• +12 more

83.alexedwards / scs

HTTP Session Management for Go

• go
• golang
• session
• sessions
• http
• context

84.yunginnanet / HellPot

HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.

• honeypot
• http
• web
• deception
• stress
• cross-platform
• +6 more

85.ZerBea / hcxtools

A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.

• wlan
• wpa
• wpa2
• raspberry-pi
• hashcat
• handshake
• +8 more

86.lestrrat-go / jwx

Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe

• jwt
• jwe
• jws
• jwk
• go
• golang
• +1 more

87.vvo / iron-session

🛠 Secure, stateless, and cookie-based session library for Next.js or any JavaScript framework

• nextjs
• authentication
• session
• stateless
• cookies
• expressjs
• +2 more

88.helmetjs / helmet

Help secure Express apps with various HTTP headers

• javascript
• middleware
• security
• helmet
• http-headers

89.panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes

• oidc
• openid
• openid-client
• openid-connect
• passport
• connect
• +1 more

90.microsoft / Sysmon-Linux

Sysmon for Linux

91.crypto2011 / IDR

Interactive Delphi Reconstructor

92.paulmillr / noble-post-quantum

Auditable & minimal JS implementation of public-key post-quantum cryptography

• dilithium
• kyber
• ml-kem
• post-quantum-cryptography
• sphincs
• sphincs-plus
• +14 more

93.Mutasem-mk4 / procscope

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang
• linux-security
• reverse-engineering
• +14 more

94.pennersr / django-allauth

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/

• authentication
• django
• oauth2
• openid-connect
• python
• saml
• +8 more

95.jpadilla / pyjwt

JSON Web Token implementation in Python

• python
• jwt
• hacktoberfest

96.NextronSystems / APTSimulator

A toolset to make a system look as if it was the victim of an APT attack

97.lukechilds / reverse-shell

Reverse Shell as a Service

• reverse-shell
• exploit
• vulnerability
• pentesting
• microservice
• security

98.den4uk / andriller

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

• forensics
• python
• android

99.spacehuhn / esp8266_beaconSpam

Creates up to a thousand WiFi access points with custom SSIDs.

• ssid
• custom-ssids
• wifi
• esp8266
• spam
• flood
• +1 more

100.WebDecoy / FCaptcha

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

• anti-bot
• behavioral-analysis
• bot-detection
• captcha
• fingerprinting
• go
• +14 more