Trending repositories

1.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

2.soxoj / maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

• osint
• social-network
• identification
• socmint
• sherlock
• investigation
• +14 more

3.sherlock-project / sherlock

Hunt down social media accounts by username across social networks

• osint
• reconnaissance
• linux
• cli
• sherlock
• python3
• +10 more

4.Z4nzu / hackingtool

ALL IN ONE Hacking Tool For Hackers

• allinonehackingtool
• web-attack
• password-attack
• hacking
• wireless-attack
• besthackingtool
• +7 more

5.smicallef / spiderfoot

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python
• infosec
• intelligence-gathering
• +13 more

6.promptfoo / promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

• llm
• prompt-engineering
• prompts
• llmops
• prompt-testing
• testing
• +12 more

7.0x4m4 / hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

• 0x4m4
• ai
• ai-agents
• ai-cybersecurity
• ai-hacking
• ai-penetration-testing
• +14 more

8.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

9.danielmiessler / SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

10.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

11.GreyDGL / PentestGPT

Automated Penetration Testing Agentic Framework Powered by Large Language Models

• penetration-testing
• python
• large-language-models
• llm

12.ComposioHQ / composio

Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.

• ai
• python
• agents
• aiagents
• function-calling
• developer-tools
• +11 more

13.better-auth / better-auth

The most comprehensive authentication framework

• authentication
• oauth
• oauth2
• typescript
• iam
• oidc
• +2 more

14.lissy93 / web-check

🕵️‍♂️ All-in-one OSINT tool for analysing any website

• osint
• privacy
• security
• security-tools
• sysadmin

15.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

16.WhiskeySockets / Baileys

Socket-based TS/JavaScript API for WhatsApp Web

• bun
• deno
• nodejs
• reverse-engineering
• typescript
• websockets
• +2 more

17.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

18.icsharpcode / ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

• decompiler
• decompiler-engine
• c-sharp
• dotnet
• dotnetcore
• mono
• +4 more

19.wasp-lang / open-saas

A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.

• full-stack
• open-source
• saas
• nodejs
• prisma
• react
• +14 more

20.SWE-agent / SWE-agent

SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]

• agent
• ai
• developer-tools
• llm
• agent-based-model
• lms
• +1 more

21.juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

• owasp
• javascript
• vulnerable
• hacking
• application-security
• owasp-top-10
• +8 more

22.MatrixTM / MHDDoS

Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods

• ddos
• ddos-attacks
• ddos-tool
• attack
• cloudflare-bypass
• layer4
• +13 more

23.horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler
• reverse-engineering
• elf
• +14 more

24.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

25.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

26.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

27.projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

• nuclei-templates
• nuclei
• bugbounty
• security
• nuclei-checks
• exploits
• +4 more

28.moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +4 more

29.redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

• mitre
• mitre-attack

30.pwndbg / pwndbg

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

• python
• gdb
• pwndbg
• reverse-engineering
• debugging
• ctf
• +12 more

31.yokoffing / Betterfox

Firefox user.js for optimal privacy and security. Your favorite browser, but better.

• firefox
• anti-tracking
• mozilla
• privacy
• security
• settings
• +5 more

32.ReFirmLabs / binwalk

Firmware Analysis Tool

33.arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

• privacy
• firefox
• security
• settings
• anti-fingerprinting
• arkenfox
• +2 more

34.evyatarmeged / Raccoon

A high performance offensive security tool for reconnaissance and vulnerability scanning

• reconnaissance
• scanner
• vulnerability-assessment
• vulnerability-scanner
• enumeration
• pentesting
• +9 more

35.lucasg / Dependencies

A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.

• windows
• dll
• wpf
• csharp

36.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

37.bee-san / Ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

• decryption
• natural-language-processing
• cryptography
• cipher
• artificial-intelligence
• ctf-tools
• +11 more

38.SpacehuhnTech / WiFiDuck

Wireless keystroke injection attack platform

• esp8266
• arduino
• hid
• hacktoberfest

39.Mail-0 / Zero

Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord

• ai
• email
• privacy
• security

40.szTheory / exifcleaner

Cross-platform desktop GUI app to clean image metadata

• exif
• exiftool
• electron
• javascript
• nodejs
• desktop-app
• +14 more

41.Manisso / fsociety

fsociety Hacking Tools Pack – A Penetration Testing Framework

• fsociety
• exploitation
• port-scanning
• fsociety-hacking
• post-exploitation
• web-hacking
• +7 more

42.Col-E / Recaf

The modern Java bytecode editor

• java
• bytecode
• bytecode-engineering
• reverse-engineering
• jvm-bytecode
• decompile
• +8 more

43.hugsy / gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

• python
• exploit
• gdb
• linux
• reverse-engineering
• ctf
• +13 more

44.RsaCtfTool / RsaCtfTool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

• rsa-attack
• rsa
• cryptography

45.Agent-Threat-Rule / agent-threat-rules

Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.

• agent-security
• ai-security
• llm-security
• mcp-security
• owasp
• prompt-injection
• +5 more

46.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

47.BlessedRebuS / Krawl

Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.

• anti-crawling
• cloud-native
• crawler
• deception
• honeypot
• kubernetes
• +11 more

48.pardeike / Harmony

A library for patching, replacing and decorating .NET and Mono methods during runtime

• csharp
• patcher
• detour
• detours
• runtime
• mono
• +5 more

49.horsicq / DIE-engine

DIE engine

• signature
• reverse-engineering
• unpacker
• yara
• elf
• program-analysis
• +5 more

50.stamparm / maltrail

Malicious traffic detection system

• security
• malware
• intrusion-detection
• sensor
• python
• network-monitoring
• +2 more

51.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

52.GrapheneOS / hardened_malloc

Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.

• malloc
• security
• memory-allocation
• malloc-library
• memory-allocator
• memory
• +4 more

53.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

54.momenbasel / htb-writeups

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

• active-directory
• cheatsheet
• ctf
• cybersecurity
• ethical-hacking
• hackthebox
• +14 more

55.stalniy / casl

CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

• authorization
• permissions
• acl
• cancan
• casl
• isomorphic-javascript

56.leibnitz27 / cfr

This is the public repository for the CFR Java decompiler

57.Volmarg / personal-management-system

Your web application for managing personal data.

• dashboard
• dashboards
• manager
• symfony
• mit
• self-hosted
• +14 more

58.justauth / JustAuth

Translated🏆Gitee's most valuable open source project 🚀:100: A small, comprehensive and elegant open source component for third-party login. It currently supports authorized login via third-party platforms including Github, Gitee, Weibo, DingTalk, Baidu, Coding, Tencent Cloud Developer Platform, OSChina, Alipay, QQ, WeChat, Taobao, Google, Facebook, Douyin, LinkedIn, Xiaomi, Microsoft, Toutiao, Teambition, StackOverflow, Pinterest, Renren, Huawei, WeCom, Kujiale, Gitlab, Meituan, Ele.me, Twitter, Feishu, JD.com, Alibaba Cloud, Ximalaya, Amazon, Slack and Line. Login, so easy!

• justauth
• oauth2
• qqlogin
• googlelogin
• weixinlogin

59.onetimesecret / onetimesecret

Keep passwords and other sensitive information out of your chat logs and inboxes.

• privacy
• onetime
• secrets
• chat
• email
• messaging
• +1 more

60.iamsopotatoe-coder / TinyLoad

Open source Windows x64 PE packer and crypter. Compresses and encrypts executables with a custom virtual machine into a self extracting stub.

• compression
• packer
• pe-packer
• pe-compress
• pe-protection
• pepacker
• +13 more

61.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

62.Hexastrike / PyrsistenceSniper

We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSniper.

• cybersecurity
• cybersecurity-tools
• incident-response
• security
• security-audit
• security-tools

63.avast / retdec

RetDec is a retargetable machine-code decompiler based on LLVM.

64.OTRF / ThreatHunter-Playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis
• hunting
• dfir
• +3 more

65.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

66.niklashigi / apk-mitm

🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection

• cli
• reverse-engineering
• android
• apk
• mitm
• certificate-pinning
• +2 more

67.CryptoSignal / Crypto-Signal

Github.com/CryptoSignal - Trading & Technical Analysis Bot - 4,100+ stars, 1,100+ forks

• technical-analysis
• bittrex-api
• crypto
• bitcoin
• ethereum
• trading
• +14 more

68.benbusby / whoogle-searchArchived

A self-hosted, ad-free, privacy-respecting metasearch engine

• adblock
• privacy
• docker
• heroku
• flask
• metasearch
• +5 more

69.spatie / laravel-permission

Associate users with roles and permissions

• laravel
• php
• permission
• secure

70.alephdata / aleph

Search and browse documents and data; find the people and companies you look for.

• python
• data-search
• graph-database
• journalism
• osint
• investigative-journalism

71.GerbenJavado / LinkFinder

A python script that finds endpoints in JavaScript files

• infosec
• endpoints

72.twintproject / twintArchived

An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a user's followers, following, Tweets and more while evading most API limitations.

• osint
• twitter
• python
• scrape
• tweets
• elasticsearch
• +6 more

73.HMAKT99 / UnTouchID

Use your phone's Face ID or fingerprint to approve sudo and unlock your Mac. QR pairing, encrypted BLE, Secure Enclave signing — keys never leave your phone. Works with iPhone, Android, Apple Watch, Wear OS, or any browser. No $199 Magic Keyboard needed.

• android
• biometrics
• kotlin
• mac-mini
• macbook
• macos
• +13 more

74.martinus / unordered_dense

A fast & densely stored hashmap and hashset

• c-plus-plus
• cpp17
• cpp
• hash
• hash-tables
• header-only-library
• +4 more

75.digitalocean / nginxconfig.io

⚙️ NGINX config generator on steroids 💉

• nginx
• nginx-configuration
• php-fpm
• ssl
• letsencrypt
• cdn
• +14 more

76.tennc / webshell

This is a webshell open source project

• webshell
• webshell-sniper
• php
• jsp
• asp
• aspx
• +3 more

77.deepfence / SecretScanner

:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

• scanning-tool
• secret-keys
• secrets-management
• infosectools
• vulnerability-scanners
• k8s
• +10 more

78.panva / node-oidc-provider

OpenID Certified™ OAuth 2.0 Authorization Server implementation for Node.js

• openid
• oidc
• openid-provider
• openid-connect
• connect
• server
• +4 more

79.markbates / goth

Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.

80.techinz / browsers-benchmark

Browser automation engine benchmark - Test bypass rates, performance & stealth against Cloudflare, DataDome, reCAPTCHA, Kasada, Imperva, Akamai, PerimeterX and other bot detection systems. Find the best browser for scraping.

• anti-detect
• antidetect-browser
• automation
• browser
• captcha
• patchright
• +4 more

81.helmetjs / helmet

Help secure Express apps with various HTTP headers

• javascript
• middleware
• security
• helmet
• http-headers

82.sane-apps / SaneBar

The privacy-first menu bar manager for macOS. Now 100% free and open source (MIT) — every feature unlocked. Native, lightweight, and scriptable.

• mac-app
• macos
• menubar
• privacy
• swift
• swiftui
• +8 more

83.pennersr / django-allauth

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/

• authentication
• django
• oauth2
• openid-connect
• python
• saml
• +8 more

84.ZerBea / hcxtools

A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.

• wlan
• wpa
• wpa2
• raspberry-pi
• hashcat
• handshake
• +8 more

85.panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes

• oidc
• openid
• openid-client
• openid-connect
• passport
• connect
• +1 more

86.auth0 / node-jsonwebtoken

JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

87.WebDecoy / FCaptcha

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

• anti-bot
• behavioral-analysis
• bot-detection
• captcha
• fingerprinting
• go
• +14 more

88.microsoft / Sysmon-Linux

Sysmon for Linux

89.jpadilla / pyjwt

JSON Web Token implementation in Python

• python
• jwt
• hacktoberfest

90.bitcoin-core / secp256k1

Optimized C library for EC operations on curve secp256k1

91.heartcombo / devise

Flexible authentication solution for Rails with Warden.

• rails
• ruby
• authentication
• devise

92.paulmillr / noble-hashes

Audited & minimal JS implementation of hash functions, MACs and KDFs.

• cryptography
• hash
• kdf
• hashing
• sha256
• sha512
• +13 more

93.pry0cc / axiom

The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!

• hacking-vps
• bug-bounty
• tmux
• axiom
• masscan
• gowitness
• +12 more

94.spacehuhn / esp8266_beaconSpam

Creates up to a thousand WiFi access points with custom SSIDs.

• ssid
• custom-ssids
• wifi
• esp8266
• spam
• flood
• +1 more

95.0xMassi / stik_app

Instant thought capture for macOS. One shortcut, post-it appears, type, close.

• ai
• macos
• nlp
• note-taking
• productivity
• react
• +14 more

96.alexedwards / scs

HTTP Session Management for Go

• go
• golang
• session
• sessions
• http
• context

97.jaredhanson / passport

Simple, unobtrusive authentication for Node.js.

• nodejs
• express
• passport
• oauth
• oauth2
• saml
• +2 more

98.agentrhq / authsome

Credential gateway for AI agents. Log in once via Oauth2 or API Key. Every agent stays authenticated — headless, no SaaS, agents never see your credentials.

• ai-agents
• authentication
• cli
• headless
• local-first
• mcp
• +14 more

99.securitybunker / databunker

Secure Vault for Customer PII/PHI/PCI/KYC Records

• gdpr
• pii
• piidata
• security
• privacy
• privacy-by-design
• +14 more

100.lestrrat-go / jwx

Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe

• jwt
• jwe
• jws
• jwk
• go
• golang
• +1 more