Trending repositories

1.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

2.Oldcircle / geo-sleuth

An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.

• claude-code
• geoguessr
• geolocation
• osint
• agent-skills
• geoint
• +12 more

3.AhmadHassan-BTed / ShopifyAutoAuth

Enterprise-grade Shopify Admin API authentication adapter — OAuth 2.0 Client Credentials Grant with automatic token refresh.

• authentication
• client-credentials
• httpx
• oauth2
• python
• shopify
• +3 more

4.sherlock-project / sherlock

Hunt down social media accounts by username across social networks

• osint
• reconnaissance
• linux
• cli
• sherlock
• python3
• +10 more

5.Z4nzu / hackingtool

ALL IN ONE Hacking Tool For Hackers

• allinonehackingtool
• web-attack
• password-attack
• hacking
• wireless-attack
• besthackingtool
• +7 more

6.smicallef / spiderfoot

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python
• infosec
• intelligence-gathering
• +13 more

7.soxoj / maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

• osint
• social-network
• identification
• socmint
• sherlock
• investigation
• +14 more

8.promptfoo / promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

• llm
• prompt-engineering
• prompts
• llmops
• prompt-testing
• testing
• +12 more

9.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

10.0x4m4 / hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

• 0x4m4
• ai
• ai-agents
• ai-cybersecurity
• ai-hacking
• ai-penetration-testing
• +14 more

11.ZeroDayEvil / ai-security-tool

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.

• cve-scanner
• mcp-server
• mcp-tools
• osv
• rdp
• sbom
• +13 more

12.ntfargo / Relapse-Exploit

Exploit chain for PS5 7.00 - 13.60

• exploit
• kernel
• research
• webkit

13.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

14.icsharpcode / ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

• decompiler
• decompiler-engine
• c-sharp
• dotnet
• dotnetcore
• mono
• +4 more

15.danielmiessler / SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

16.GreyDGL / PentestGPT

Automated Penetration Testing Agentic Framework Powered by Large Language Models

• penetration-testing
• python
• large-language-models
• llm

17.NPMscan / npmscan-action

Catch risky npm dependency changes before they merge.

• dependency-analysis
• devsecops
• github-actions
• malware
• npm
• npm-security
• +2 more

18.ComposioHQ / composio

Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.

• ai
• python
• agents
• aiagents
• function-calling
• developer-tools
• +11 more

19.better-auth / better-auth

The most comprehensive authentication framework

• authentication
• oauth
• oauth2
• typescript
• iam
• oidc
• +2 more

20.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

21.lissy93 / web-check

🕵️‍♂️ All-in-one OSINT tool for analysing any website

• osint
• privacy
• security
• security-tools
• sysadmin

22.juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

• owasp
• javascript
• vulnerable
• hacking
• application-security
• owasp-top-10
• +8 more

23.WhiskeySockets / Baileys

Socket-based TS/JavaScript API for WhatsApp Web

• bun
• deno
• nodejs
• reverse-engineering
• typescript
• websockets
• +2 more

24.SWE-agent / SWE-agent

SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]

• agent
• ai
• developer-tools
• llm
• agent-based-model
• lms
• +1 more

25.horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler
• reverse-engineering
• elf
• +14 more

26.projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

• nuclei-templates
• nuclei
• bugbounty
• security
• nuclei-checks
• exploits
• +4 more

27.ReFirmLabs / binwalk

Firmware Analysis Tool

28.wasp-lang / open-saas

A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.

• full-stack
• open-source
• saas
• nodejs
• prisma
• react
• +14 more

29.MatrixTM / MHDDoS

Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods

• ddos
• ddos-attacks
• ddos-tool
• attack
• cloudflare-bypass
• layer4
• +13 more

30.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

31.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

32.redcanaryco / atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

• mitre
• mitre-attack

33.pwndbg / pwndbg

Exploit Development and Reverse Engineering with GDB & LLDB Made Easy

• python
• gdb
• pwndbg
• reverse-engineering
• debugging
• ctf
• +12 more

34.szTheory / exifcleaner

Cross-platform desktop GUI app to clean image metadata

• exif
• exiftool
• electron
• javascript
• nodejs
• desktop-app
• +14 more

35.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

36.moonD4rk / HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

• chrome
• macos
• windows
• pentest-tool
• hacking
• edge
• +4 more

37.bee-san / Ciphey

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

• decryption
• natural-language-processing
• cryptography
• cipher
• artificial-intelligence
• ctf-tools
• +11 more

38.arkenfox / user.js

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

• privacy
• firefox
• security
• settings
• anti-fingerprinting
• arkenfox
• +2 more

39.go-acme / lego

Let's Encrypt/ACME client and library written in Go

• letsencrypt
• acme
• certificate
• tls
• security
• acme-client
• +4 more

40.yokoffing / Betterfox

Firefox user.js for optimal privacy and security. Your favorite browser, but better.

• firefox
• anti-tracking
• mozilla
• privacy
• security
• settings
• +5 more

41.Manisso / fsociety

fsociety Hacking Tools Pack – A Penetration Testing Framework

• fsociety
• exploitation
• port-scanning
• fsociety-hacking
• post-exploitation
• web-hacking
• +7 more

42.lucasg / Dependencies

A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.

• windows
• dll
• wpf
• csharp

43.alephdata / aleph

Search and browse documents and data; find the people and companies you look for.

• python
• data-search
• graph-database
• journalism
• osint
• investigative-journalism

44.Col-E / Recaf

The modern Java bytecode editor

• java
• bytecode
• bytecode-engineering
• reverse-engineering
• jvm-bytecode
• decompile
• +8 more

45.Mail-0 / Zero

Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord

• ai
• email
• privacy
• security

46.BlessedRebuS / Krawl

Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.

• anti-crawling
• cloud-native
• crawler
• deception
• honeypot
• kubernetes
• +11 more

47.pardeike / Harmony

A library for patching, replacing and decorating .NET and Mono methods during runtime

• csharp
• patcher
• detour
• detours
• runtime
• mono
• +5 more

48.Ullaakut / cameradar

Cameradar hacks its way into RTSP videosurveillance cameras

• penetration-testing
• security
• hacking
• infosec
• rtsp
• cctv
• +5 more

49.flohoss / gocron

A task scheduler built with Go and Vue.js that allows users to specify recurring jobs via a simple YAML configuration file. The scheduler reads job definitions, executes commands at specified times using cron expressions, and passes in environment variables for each job.

• backup
• backups
• cron
• docker
• golang
• schedule
• +4 more

50.RsaCtfTool / RsaCtfTool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

• rsa-attack
• rsa
• cryptography

51.horsicq / DIE-engine

DIE engine

• signature
• reverse-engineering
• unpacker
• yara
• elf
• program-analysis
• +5 more

52.hugsy / gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

• python
• exploit
• gdb
• linux
• reverse-engineering
• ctf
• +13 more

53.stamparm / maltrail

Malicious traffic detection system

• security
• malware
• intrusion-detection
• sensor
• python
• network-monitoring
• +2 more

54.GrapheneOS / hardened_malloc

Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.

• malloc
• security
• memory-allocation
• malloc-library
• memory-allocator
• memory
• +4 more

55.justauth / JustAuth

Translated🏆Gitee's most valuable open source project 🚀:100: A small, comprehensive and elegant open source component for third-party login. It currently supports authorized login via third-party platforms including Github, Gitee, Weibo, DingTalk, Baidu, Coding, Tencent Cloud Developer Platform, OSChina, Alipay, QQ, WeChat, Taobao, Google, Facebook, Douyin, LinkedIn, Xiaomi, Microsoft, Toutiao, Teambition, StackOverflow, Pinterest, Renren, Huawei, WeCom, Kujiale, Gitlab, Meituan, Ele.me, Twitter, Feishu, JD.com, Alibaba Cloud, Ximalaya, Amazon, Slack and Line. Login, so easy!

• justauth
• oauth2
• qqlogin
• googlelogin
• weixinlogin

56.olafhartong / sysmon-modular

A repository of sysmon configuration modules

• sysmon
• dfir
• threat-hunting
• mitre-attack
• modular
• security-tools

57.golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

• go
• golang
• jwt
• auth
• ed25519
• security

58.momenbasel / htb-writeups

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

• active-directory
• cheatsheet
• ctf
• cybersecurity
• ethical-hacking
• hackthebox
• +14 more

59.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

60.avast / retdec

RetDec is a retargetable machine-code decompiler based on LLVM.

61.Volmarg / personal-management-system

Your web application for managing personal data.

• dashboard
• dashboards
• manager
• symfony
• mit
• self-hosted
• +14 more

62.onetimesecret / onetimesecret

Keep passwords and other sensitive information out of your chat logs and inboxes.

• privacy
• onetime
• secrets
• chat
• email
• messaging
• +1 more

63.umputun / remark42

comment engine

• commenting
• comment-system
• self-hosted
• commenting-engines
• comments-widget
• remark42
• +1 more

64.CryptoSignal / Crypto-Signal

Github.com/CryptoSignal - Trading & Technical Analysis Bot - 4,100+ stars, 1,100+ forks

• technical-analysis
• bittrex-api
• crypto
• bitcoin
• ethereum
• trading
• +14 more

65.leibnitz27 / cfr

This is the public repository for the CFR Java decompiler

66.coinpaprika / coinpaprika-api-go-client

Official CoinPaprika API Go client — coin prices, tickers, OHLCV, exchanges, and global market stats.

• api-client
• bitcoin
• blockchain
• coinpaprika
• crypto
• cryptocurrency
• +4 more

67.evyatarmeged / Raccoon

A high performance offensive security tool for reconnaissance and vulnerability scanning

• reconnaissance
• scanner
• vulnerability-assessment
• vulnerability-scanner
• enumeration
• pentesting
• +9 more

68.dont-be-evil-company / kulala.nvim

A fully-featured ⚡️ HTTP/GraphQL/gRPC/Websocket-client 🐼 interface 🖥️ for Neovim ❤️, that supports the Jetbrains .http spec (with full scripting support).

• graphql-client
• neovim-plugin
• rest-client
• curl
• http-client
• lua
• +14 more

69.niklashigi / apk-mitm

🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection

• cli
• reverse-engineering
• android
• apk
• mitm
• certificate-pinning
• +2 more

70.stalniy / casl

CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access

• authorization
• permissions
• acl
• cancan
• casl
• isomorphic-javascript

71.OTRF / ThreatHunter-Playbook

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

• threat-hunting
• sysmon
• hunting-campaigns
• hypothesis
• hunting
• dfir
• +3 more

72.goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

• golang
• http-server
• https-server
• ctf
• devtools
• file-transfer
• +14 more

73.HMAKT99 / UnTouchID

Use your phone's Face ID or fingerprint to approve sudo and unlock your Mac. QR pairing, encrypted BLE, Secure Enclave signing — keys never leave your phone. Works with iPhone, Android, Apple Watch, Wear OS, or any browser. No $199 Magic Keyboard needed.

• android
• biometrics
• kotlin
• mac-mini
• macbook
• macos
• +13 more

74.panva / node-oidc-provider

OpenID Certified™ OAuth 2.0 Authorization Server implementation for Node.js

• openid
• oidc
• openid-provider
• openid-connect
• connect
• server
• +4 more

75.techinz / browsers-benchmark

Browser automation engine benchmark - Test bypass rates, performance & stealth against Cloudflare, DataDome, reCAPTCHA, Kasada, Imperva, Akamai, PerimeterX and other bot detection systems. Find the best browser for scraping.

• anti-detect
• antidetect-browser
• automation
• browser
• captcha
• patchright
• +4 more

76.spatie / laravel-permission

Associate users with roles and permissions

• laravel
• php
• permission
• secure

77.GerbenJavado / LinkFinder

A python script that finds endpoints in JavaScript files

• infosec
• endpoints

78.martinus / unordered_dense

A fast & densely stored hashmap and hashset

• c-plus-plus
• cpp17
• cpp
• hash
• hash-tables
• header-only-library
• +4 more

79.sorkila / lockpaw

Cover your Mac's screen with a hotkey while AI agents keep running, even with the lid closed. The covered screen glows when Claude Code, Codex or Gemini needs you. Touch ID unlock.

• ai-agents
• developer-tools
• macos
• macos-app
• open-source
• privacy
• +13 more

80.SpacehuhnTech / WiFiDuck

Wireless keystroke injection attack platform

• esp8266
• arduino
• hid
• hacktoberfest

81.bitcoin-core / secp256k1

Optimized C library for EC operations on curve secp256k1

82.twintproject / twintArchived

An advanced Twitter scraping & OSINT tool written in Python that doesn't use Twitter's API, allowing you to scrape a user's followers, following, Tweets and more while evading most API limitations.

• osint
• twitter
• python
• scrape
• tweets
• elasticsearch
• +6 more

83.markbates / goth

Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.

84.pry0cc / axiom

The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!

• hacking-vps
• bug-bounty
• tmux
• axiom
• masscan
• gowitness
• +12 more

85.yunginnanet / HellPot

HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.

• honeypot
• http
• web
• deception
• stress
• cross-platform
• +6 more

86.paulmillr / noble-hashes

Audited & minimal JS implementation of hash functions, MACs and KDFs.

• cryptography
• hash
• kdf
• hashing
• sha256
• sha512
• +13 more

87.alexedwards / scs

HTTP Session Management for Go

• go
• golang
• session
• sessions
• http
• context

88.ZerBea / hcxtools

A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.

• wlan
• wpa
• wpa2
• raspberry-pi
• hashcat
• handshake
• +8 more

89.lestrrat-go / jwx

Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe

• jwt
• jwe
• jws
• jwk
• go
• golang
• +1 more

90.Agent-Threat-Rule / agent-threat-rules

Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.

• agent-security
• ai-security
• llm-security
• mcp-security
• owasp
• prompt-injection
• +5 more

91.vvo / iron-session

🛠 Secure, stateless, and cookie-based session library for Next.js or any JavaScript framework

• nextjs
• authentication
• session
• stateless
• cookies
• expressjs
• +2 more

92.panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes

• oidc
• openid
• openid-client
• openid-connect
• passport
• connect
• +1 more

93.jasmin-lang / jasmin

Language for high-assurance and high-speed cryptography

• compiler
• language
• coq

94.pennersr / django-allauth

Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/

• authentication
• django
• oauth2
• openid-connect
• python
• saml
• +8 more

95.jpadilla / pyjwt

JSON Web Token implementation in Python

• python
• jwt
• hacktoberfest

96.crypto2011 / IDR

Interactive Delphi Reconstructor

97.paulmillr / noble-post-quantum

Auditable & minimal JS implementation of public-key post-quantum cryptography

• dilithium
• kyber
• ml-kem
• post-quantum-cryptography
• sphincs
• sphincs-plus
• +14 more

98.helmetjs / helmet

Help secure Express apps with various HTTP headers

• javascript
• middleware
• security
• helmet
• http-headers

99.lukechilds / reverse-shell

Reverse Shell as a Service

• reverse-shell
• exploit
• vulnerability
• pentesting
• microservice
• security

100.den4uk / andriller

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

• forensics
• python
• android