Trending repositories

1.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

2.Oldcircle / geo-sleuth

An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.

• claude-code
• geoguessr
• geolocation
• osint
• agent-skills
• geoint
• +12 more

3.AhmadHassan-BTed / ShopifyAutoAuth

Enterprise-grade Shopify Admin API authentication adapter — OAuth 2.0 Client Credentials Grant with automatic token refresh.

• authentication
• client-credentials
• httpx
• oauth2
• python
• shopify
• +3 more

4.sherlock-project / sherlock

Hunt down social media accounts by username across social networks

• osint
• reconnaissance
• linux
• cli
• sherlock
• python3
• +10 more

5.Z4nzu / hackingtool

ALL IN ONE Hacking Tool For Hackers

• allinonehackingtool
• web-attack
• password-attack
• hacking
• wireless-attack
• besthackingtool
• +7 more

6.smicallef / spiderfoot

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python
• infosec
• intelligence-gathering
• +13 more

7.soxoj / maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

• osint
• social-network
• identification
• socmint
• sherlock
• investigation
• +14 more

8.promptfoo / promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

• llm
• prompt-engineering
• prompts
• llmops
• prompt-testing
• testing
• +12 more

9.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

10.0x4m4 / hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

• 0x4m4
• ai
• ai-agents
• ai-cybersecurity
• ai-hacking
• ai-penetration-testing
• +14 more

11.ZeroDayEvil / ai-security-tool

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.

• cve-scanner
• mcp-server
• mcp-tools
• osv
• rdp
• sbom
• +13 more

12.ntfargo / Relapse-Exploit

Exploit chain for PS5 7.00 - 13.60

• exploit
• kernel
• research
• webkit

13.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

14.icsharpcode / ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

• decompiler
• decompiler-engine
• c-sharp
• dotnet
• dotnetcore
• mono
• +4 more

15.danielmiessler / SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

16.GreyDGL / PentestGPT

Automated Penetration Testing Agentic Framework Powered by Large Language Models

• penetration-testing
• python
• large-language-models
• llm

17.NPMscan / npmscan-action

Catch risky npm dependency changes before they merge.

• dependency-analysis
• devsecops
• github-actions
• malware
• npm
• npm-security
• +2 more

18.ComposioHQ / composio

Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.

• ai
• python
• agents
• aiagents
• function-calling
• developer-tools
• +11 more

19.better-auth / better-auth

The most comprehensive authentication framework

• authentication
• oauth
• oauth2
• typescript
• iam
• oidc
• +2 more

20.anthropics / claude-code-security-review

An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.

21.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

22.lissy93 / web-check

🕵️‍♂️ All-in-one OSINT tool for analysing any website

• osint
• privacy
• security
• security-tools
• sysadmin

23.LearningCircuit / local-deep-research

~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.

• academia
• arxiv
• brave
• deep-research
• local
• local-llm
• +14 more

24.juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

• owasp
• javascript
• vulnerable
• hacking
• application-security
• owasp-top-10
• +8 more

25.kenryu42 / cc-safety-net

A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.

• claude
• claude-code
• claude-code-plugin
• security
• codex
• pi-extension
• +14 more

26.WhiskeySockets / Baileys

Socket-based TS/JavaScript API for WhatsApp Web

• bun
• deno
• nodejs
• reverse-engineering
• typescript
• websockets
• +2 more

27.SWE-agent / SWE-agent

SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]

• agent
• ai
• developer-tools
• llm
• agent-based-model
• lms
• +1 more

28.horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler
• reverse-engineering
• elf
• +14 more

29.projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

• nuclei-templates
• nuclei
• bugbounty
• security
• nuclei-checks
• exploits
• +4 more

30.ReFirmLabs / binwalk

Firmware Analysis Tool

31.wasp-lang / open-saas

A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.

• full-stack
• open-source
• saas
• nodejs
• prisma
• react
• +14 more

32.MatrixTM / MHDDoS

Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods

• ddos
• ddos-attacks
• ddos-tool
• attack
• cloudflare-bypass
• layer4
• +13 more

33.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

34.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

35.redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

• mitre
• mitre-attack

36.pwndbg / pwndbg

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

• python
• gdb
• pwndbg
• reverse-engineering
• debugging
• ctf
• +12 more

37.projectdiscovery / httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

• http
• bugbounty
• ssl-certificate
• pipeline
• pentest-tool
• cybersecurity
• +4 more

38.szTheory / exifcleaner

Cross-platform desktop GUI app to clean image metadata

• exif
• exiftool
• electron
• javascript
• nodejs
• desktop-app
• +14 more

39.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

40.moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +4 more

41.bee-san / Ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

• decryption
• natural-language-processing
• cryptography
• cipher
• artificial-intelligence
• ctf-tools
• +11 more

42.arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

• privacy
• firefox
• security
• settings
• anti-fingerprinting
• arkenfox
• +2 more

43.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

44.yokoffing / Betterfox

Firefox user.js for optimal privacy and security. Your favorite browser, but better.

• firefox
• anti-tracking
• mozilla
• privacy
• security
• settings
• +5 more

45.schemathesis / schemathesis

Catch API bugs before your users do

• hypothesis
• pytest
• swagger
• cli
• property-based-testing
• graphql
• +6 more

46.Manisso / fsociety

fsociety Hacking Tools Pack – A Penetration Testing Framework

• fsociety
• exploitation
• port-scanning
• fsociety-hacking
• post-exploitation
• web-hacking
• +7 more

47.lucasg / Dependencies

A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.

• windows
• dll
• wpf
• csharp

48.infoslack / awesome-web-hacking

A list of web application security

• penetration-testing
• web-hacking
• vulnerabilities
• scanner
• hacking
• hacking-tools
• +7 more

49.alephdata / aleph

Search and browse documents and data; find the people and companies you look for.

• python
• data-search
• graph-database
• journalism
• osint
• investigative-journalism

50.Col-E / Recaf

The modern Java bytecode editor

• java
• bytecode
• bytecode-engineering
• reverse-engineering
• jvm-bytecode
• decompile
• +8 more

51.paragonie / awesome-appsec

A curated list of resources for learning about application security

• security-experts
• reading-list
• curated
• application-security
• security
• owasp

52.Mail-0 / Zero

Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord

• ai
• email
• privacy
• security

53.BlessedRebuS / Krawl

Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.

• anti-crawling
• cloud-native
• crawler
• deception
• honeypot
• kubernetes
• +11 more

54.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

55.flohoss / gocron

A task scheduler built with Go and Vue.js that allows users to specify recurring jobs via a simple YAML configuration file. The scheduler reads job definitions, executes commands at specified times using cron expressions, and passes in environment variables for each job.

• backup
• backups
• cron
• docker
• golang
• schedule
• +4 more

56.RsaCtfTool / RsaCtfTool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

• rsa-attack
• rsa
• cryptography

57.horsicq / DIE-engine

DIE engine

• signature
• reverse-engineering
• unpacker
• yara
• elf
• program-analysis
• +5 more

58.hugsy / gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

• python
• exploit
• gdb
• linux
• reverse-engineering
• ctf
• +13 more

59.vidstack / player

Deprecated in favour of Video.js 10; security fixes only until January 2028. UI components and hooks for building video and audio players on the web.

• player
• web-components
• html
• javascript
• hls
• audio
• +14 more

60.wasm3 / wasm3

🚀 A fast WebAssembly interpreter and the most universal WASM runtime

• wasm
• webassembly
• embedded
• iot
• scripting
• edge-computing
• +7 more

61.coipond / coi

Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.

• claude
• claude-code
• ai-tools
• anthropic
• coding-assistant
• containers
• +14 more

62.stamparm / maltrail

Malicious traffic detection system

• security
• malware
• intrusion-detection
• sensor
• python
• network-monitoring
• +2 more

63.GrapheneOS / hardened_malloc

Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.

• malloc
• security
• memory-allocation
• malloc-library
• memory-allocator
• memory
• +4 more

64.justauth / JustAuth

🏆Gitee 最有价值开源项目 🚀:100: 小而全而美的第三方登录开源组件。目前已支持Github、Gitee、微博、钉钉、百度、Coding、腾讯云开发者平台、OSChina、支付宝、QQ、微信、淘宝、Google、Facebook、抖音、领英、小米、微软、今日头条、Teambition、StackOverflow、Pinterest、人人、华为、企业微信、酷家乐、Gitlab、美团、饿了么、推特、飞书、京东、阿里云、喜马拉雅、Amazon、Slack和 Line 等第三方平台的授权登录。 Login, so easy!

• justauth
• oauth2
• qqlogin
• googlelogin
• weixinlogin

65.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

66.nhost / nhost

The Open Source Firebase Alternative with GraphQL.

• postgres
• hasura
• graphql
• authentication
• storage
• serverless-functions
• +13 more

67.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

68.rmusser01 / Infosec_Reference

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

• infosec
• infosec-reference
• reverse-engineering
• hacking
• pentesting
• penetration-testing
• +13 more

69.momenbasel / htb-writeups

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

• active-directory
• cheatsheet
• ctf
• cybersecurity
• ethical-hacking
• hackthebox
• +14 more

70.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

71.Volmarg / personal-management-system

Your web application for managing personal data.

• dashboard
• dashboards
• manager
• symfony
• mit
• self-hosted
• +14 more

72.onetimesecret / onetimesecret

Keep passwords and other sensitive information out of your chat logs and inboxes.

• privacy
• onetime
• secrets
• chat
• email
• messaging
• +1 more

73.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

74.owasp-noir / noir

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.

• attack-surfaces
• pentesting
• security
• devsecops
• hacktoberfest
• owasp
• +5 more

75.CryptoSignal / Crypto-Signal

Github.com/CryptoSignal - Trading & Technical Analysis Bot - 4,100+ stars, 1,100+ forks

• technical-analysis
• bittrex-api
• crypto
• bitcoin
• ethereum
• trading
• +14 more

76.emanuele-em / proxelar

Scriptable local traffic workbench for inspecting, intercepting, replaying, and rewriting HTTP/HTTPS and WebSocket traffic.

• mitm
• proxy
• rust
• cli
• http-proxy
• https-proxy
• +9 more

77.coinpaprika / coinpaprika-api-go-client

Official CoinPaprika API Go client — coin prices, tickers, OHLCV, exchanges, and global market stats.

• api-client
• bitcoin
• blockchain
• coinpaprika
• crypto
• cryptocurrency
• +4 more

78.evyatarmeged / Raccoon

A high performance offensive security tool for reconnaissance and vulnerability scanning

• reconnaissance
• scanner
• vulnerability-assessment
• vulnerability-scanner
• enumeration
• pentesting
• +9 more

79.dont-be-evil-company / kulala.nvim

A fully-featured ⚡️ HTTP/GraphQL/gRPC/Websocket-client 🐼 interface 🖥️ for Neovim ❤️, that supports the Jetbrains .http spec (with full scripting support).

• graphql-client
• neovim-plugin
• rest-client
• curl
• http-client
• lua
• +14 more

80.niklashigi / apk-mitm

🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection

• cli
• reverse-engineering
• android
• apk
• mitm
• certificate-pinning
• +2 more

81.stalniy / casl

CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

• authorization
• permissions
• acl
• cancan
• casl
• isomorphic-javascript

82.jtesta / ssh-audit

SSH server & client security auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

• auditing
• security
• ssh

83.OTRF / ThreatHunter-Playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis
• hunting
• dfir
• +3 more

84.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

85.dotnet / MQTTnet

MQTTnet is a high performance .NET library for MQTT based communication. It provides a MQTT client and a MQTT server (broker). The implementation is based on the documentation from http://mqtt.org/.

• mqtt
• mqtt-client
• mqtt-broker
• mqtt-server
• netcore
• net
• +13 more

86.HMAKT99 / UnTouchID

Use your phone's Face ID or fingerprint to approve sudo and unlock your Mac. QR pairing, encrypted BLE, Secure Enclave signing — keys never leave your phone. Works with iPhone, Android, Apple Watch, Wear OS, or any browser. No $199 Magic Keyboard needed.

• android
• biometrics
• kotlin
• mac-mini
• macbook
• macos
• +13 more

87.panva / node-oidc-provider

OpenID Certified™ OAuth 2.0 Authorization Server implementation for Node.js

• openid
• oidc
• openid-provider
• openid-connect
• connect
• server
• +4 more

88.DebugSwift / DebugSwift

A toolkit to make debugging iOS applications easier 🚀

• debug
• swift
• ui
• uikit
• view
• analysis
• +14 more

89.techinz / browsers-benchmark

Browser automation engine benchmark - Test bypass rates, performance & stealth against Cloudflare, DataDome, reCAPTCHA, Kasada, Imperva, Akamai, PerimeterX and other bot detection systems. Find the best browser for scraping.

• anti-detect
• antidetect-browser
• automation
• browser
• captcha
• patchright
• +4 more

90.spatie / laravel-permission

Associate users with roles and permissions

• laravel
• php
• permission
• secure

91.usefathom / fathom

Fathom Lite. Simple, privacy-focused website analytics. Built with Golang & Preact.

• website-analytics
• analytics
• metrics
• privacy
• fathom
• google-analytics
• +2 more

92.GerbenJavado / LinkFinder

A python script that finds endpoints in JavaScript files

• infosec
• endpoints

93.martinus / unordered_dense

A fast & densely stored hashmap and hashset

• c-plus-plus
• cpp17
• cpp
• hash
• hash-tables
• header-only-library
• +4 more

94.sorkila / lockpaw

Cover your Mac's screen with a hotkey while AI agents keep running, even with the lid closed. The covered screen glows when Claude Code, Codex or Gemini needs you. Touch ID unlock.

• ai-agents
• developer-tools
• macos
• macos-app
• open-source
• privacy
• +13 more

95.aquasecurity / tfsec

Tfsec is now part of Trivy

• terraform
• security
• scanner
• static-analysis
• ci
• aws
• +13 more

96.WalletWasabi / WalletWasabi

Open-source, non-custodial, privacy preserving Bitcoin wallet for Windows, Linux, and Mac.

• bitcoin-wallet
• privacy
• bitcoin
• dotnet
• nbitcoin
• cross-platform
• +7 more

97.lightningnetwork / lnd

Lightning Network Daemon ⚡️

• bitcoin
• lightning-network
• blockchain
• micropayments
• lightning
• protocol
• +4 more

98.hectorm / hblock

Improve your security and privacy by blocking ads, tracking and malware domains.

• ad-blocker
• adblock
• adblocker
• ads
• advertisements
• blocker
• +14 more

99.twintproject / twintArchived

An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a user's followers, following, Tweets and more while evading most API limitations.

• osint
• twitter
• python
• scrape
• tweets
• elasticsearch
• +6 more

100.markbates / goth

Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.