Ranked by Attention Score: stars gained over the last 7 complete days
1–100 of 214 by Attention Score · Oct 28, 2026 – Nov 3, 2026 (UTC)
🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.
An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.
Enterprise-grade Shopify Admin API authentication adapter — OAuth 2.0 Client Credentials Grant with automatic token refresh.
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
Hunt down social media accounts by username across social networks
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Custom apps for the BMW MGU / iDrive 7 head unit (shift lights, virtual dyno, brake and drag timers, G-meter, fault scanner) plus an SDK kit to build and install your own.
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
🕵️♂️ Collect a dossier on a person by username from 6K websites
TranslatedBased on an in-depth REA teardown, a high-fidelity recreation of the official Claude desktop UI. Recreates 30 independent React components and 8 hardcore interaction physics algorithms, and comes with a 3000+ line reverse-engineering analysis manual.
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
ALL IN ONE Hacking Tool For Hackers
A blade runner for your network. Detects shadow AI agents before they go rogue.
Catch risky npm dependency changes before they merge.
Reverse engineer anything with agents, from app behavior down to native binaries.
The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.
Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
【全链哨兵】全流程渗透测试 Agent 系统，支持 Web、小程序、安卓 APP、IOS app(测试中)。安全服务渗透测试辅助工具，禁止用于非法攻击。
Offline, encrypted vault for seed phrases, private keys, passwords and API keys. Also used by agents.
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
Automated Penetration Testing Agentic Framework Powered by Large Language Models
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
The most comprehensive authentication framework
🕵️♂️ All-in-one OSINT tool for analysing any website
A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
Socket-based TS/JavaScript API for WhatsApp Web
Exploit chain for PS5 7.00 - 13.60
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Program for determining types of files for Windows, Linux and MacOS.
Community curated list of templates for the nuclei engine to find security vulnerabilities.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
Fast passive subdomain enumeration tool.
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
Small and highly portable detection tests based on MITRE's ATT&CK.
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
Suitable for Android APK reverse engineering analysis
fsociety Hacking Tools Pack – A Penetration Testing Framework
Let's Encrypt/ACME client and library written in Go
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
Search and browse documents and data; find the people and companies you look for.
Open-source agentic security operations platform:
Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
The modern Java bytecode editor
Cameradar hacks its way into RTSP videosurveillance cameras
Your web application for managing personal data.
Cross-platform desktop GUI app to clean image metadata
A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups
A library for patching, replacing and decorating .NET and Mono methods during runtime
Wireless keystroke injection attack platform
The universe in numbers. Free, open-source calculators for everything countable.
Cover your Mac's screen with a hotkey while AI agents keep running, even with the lid closed. The covered screen glows when Claude Code, Codex or Gemini needs you. Touch ID unlock.
High-Fidelity AI-Assisted Deterministic Reverse Engineering FastMCP Server
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
comment engine
A repository of sysmon configuration modules
Browser automation engine benchmark - Test bypass rates, performance & stealth against Cloudflare, DataDome, reCAPTCHA, Kasada, Imperva, Akamai, PerimeterX and other bot detection systems. Find the best browser for scraping.
Small set of tools for helping with reverse engineering Linux drivers
RetDec is a retargetable machine-code decompiler based on LLVM.
Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.
A fast & densely stored hashmap and hashset
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.
CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access
A high performance offensive security tool for reconnaissance and vulnerability scanning
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
What The Function: your AI agent decompiles games you own into C that compiles to the exact same bytes. Runs locally.
Use your phone's Face ID or fingerprint to approve sudo and unlock your Mac. QR pairing, encrypted BLE, Secure Enclave signing — keys never leave your phone. Works with iPhone, Android, Apple Watch, Wear OS, or any browser. No $199 Magic Keyboard needed.
Keep passwords and other sensitive information out of your chat logs and inboxes.
This is the public repository for the CFR Java decompiler
HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.
Audited & minimal JS implementation of hash functions, MACs and KDFs.
Content discovery and fuzzing with HTTP/3 support (100k requests per second)
Translated🏆Gitee's most valuable open source project 🚀:100: A small, comprehensive and elegant open source component for third-party login. It currently supports authorized login via third-party platforms including Github, Gitee, Weibo, DingTalk, Baidu, Coding, Tencent Cloud Developer Platform, OSChina, Alipay, QQ, WeChat, Taobao, Google, Facebook, Douyin, LinkedIn, Xiaomi, Microsoft, Toutiao, Teambition, StackOverflow, Pinterest, Renren, Huawei, WeCom, Kujiale, Gitlab, Meituan, Ele.me, Twitter, Feishu, JD.com, Alibaba Cloud, Ximalaya, Amazon, Slack and Line. Login, so easy!
Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/
Malicious traffic detection system
Github.com/CryptoSignal - Trading & Technical Analysis Bot - 4,100+ stars, 1,100+ forks
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
Entity Framework Core Power Tools - reverse engineering, migrations and model visualization in Visual Studio & CLI
Optimized C library for EC operations on curve secp256k1