Ranked by Attention Score: stars gained over the last 7 complete days
1–100 of 258 by Attention Score · Oct 28, 2026 – Nov 3, 2026 (UTC)
🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.
An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.
Enterprise-grade Shopify Admin API authentication adapter — OAuth 2.0 Client Credentials Grant with automatic token refresh.
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
Hunt down social media accounts by username across social networks
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Custom apps for the BMW MGU / iDrive 7 head unit (shift lights, virtual dyno, brake and drag timers, G-meter, fault scanner) plus an SDK kit to build and install your own.
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
🕵️♂️ Collect a dossier on a person by username from 6K websites
基于 REA 深度拆解并高保真还原 Claude 官方桌面端 UI。还原 30 个独立 React 组件与 8 项硬核交互物理算法，附带 3000+ 行逆向分析手册。
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
ALL IN ONE Hacking Tool For Hackers
A blade runner for your network. Detects shadow AI agents before they go rogue.
Catch risky npm dependency changes before they merge.
Reverse engineer anything with agents, from app behavior down to native binaries.
The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.
Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
【全链哨兵】全流程渗透测试 Agent 系统，支持 Web、小程序、安卓 APP、IOS app(测试中)。安全服务渗透测试辅助工具，禁止用于非法攻击。
Offline, encrypted vault for seed phrases, private keys, passwords and API keys. Also used by agents.
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
Automated Penetration Testing Agentic Framework Powered by Large Language Models
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
The most comprehensive authentication framework
🕵️♂️ All-in-one OSINT tool for analysing any website
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.
All parts of Claude Code's system prompt, 27 builtin tool descriptions, sub agent prompts (Plan/Explore/Task), utility prompts (CLAUDE.md, compact, statusline, magic docs, WebFetch, Bash cmd, security review, agent creation). Updated for each Claude Code version.
~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
Socket-based TS/JavaScript API for WhatsApp Web
Exploit chain for PS5 7.00 - 13.60
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Program for determining types of files for Windows, Linux and MacOS.
Community curated list of templates for the nuclei engine to find security vulnerabilities.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
OSINT Framework
Enable Opencode to authenticate against Antigravity (Google's IDE) via OAuth so you can use Antigravity rate limits and access models like gemini-3-pro and claude-opus-4-5-thinking with your Google credentials.
Fast passive subdomain enumeration tool.
Low code web framework for real world applications, in Python and Javascript
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.
Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
Deprecated in favour of Video.js 10; security fixes only until January 2028. UI components and hooks for building video and audio players on the web.
Catch API bugs before your users do
Suitable for Android APK reverse engineering analysis
Share your terminal over the web
fsociety Hacking Tools Pack – A Penetration Testing Framework
Let's Encrypt/ACME client and library written in Go
Crack WPA/WPA2 Wi-Fi Routers with Airodump-ng and Aircrack-ng/Hashcat
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
A Rust port of shadowsocks
Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
WireGuard VPN installer for Linux servers
Search and browse documents and data; find the people and companies you look for.
Scriptable local traffic workbench for inspecting, intercepting, replaying, and rewriting HTTP/HTTPS and WebSocket traffic.
Open-source agentic security operations platform:
Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
The modern Java bytecode editor
A list of web application security
Cameradar hacks its way into RTSP videosurveillance cameras
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Give the agent a machine. Just not yours. Each AI coding agent gets its own isolated machine with root, Docker, and systemd - active defense detects and stops threats automatically.
Your web application for managing personal data.
Cross-platform desktop GUI app to clean image metadata
An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups
A curated list of resources for learning about application security
The universe in numbers. Free, open-source calculators for everything countable.
Cover your Mac's screen with a hotkey while AI agents keep running, even with the lid closed. The covered screen glows when Claude Code, Codex or Gemini needs you. Touch ID unlock.
High-Fidelity AI-Assisted Deterministic Reverse Engineering FastMCP Server
A collection of Linux Sysadmin Test Questions and Answers. Test your knowledge and skills in different fields with these Q/A.
🚀 A fast WebAssembly interpreter and the most universal WASM runtime
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
comment engine
SSH server & client security auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)
A repository of sysmon configuration modules
Browser automation engine benchmark - Test bypass rates, performance & stealth against Cloudflare, DataDome, reCAPTCHA, Kasada, Imperva, Akamai, PerimeterX and other bot detection systems. Find the best browser for scraping.
Small set of tools for helping with reverse engineering Linux drivers
This guide details creating a secure Linux production system. OpenSCAP (C2S/CIS, STIG).
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
MQTTnet is a high performance .NET library for MQTT based communication. It provides a MQTT client and a MQTT server (broker). The implementation is based on the documentation from http://mqtt.org/.