101.digininja / DVWA
Damn Vulnerable Web Application (DVWA)
+1,009 stars
from 12,956 · score 6.92
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
101–200 of 1,236 by Attention Score · May 9, 2026 – Nov 4, 2026 (UTC)
102.moonD4rk / HackBrowserData
Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.
- chrome
- macos
- windows
- pentest-tool
- hacking
- edge
- +10 more
+996 stars
from 13,676 · score 6.90
103.openfga / openfga
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
- authorization
- permissions
- security
- zanzibar
- openfga
- entitlements
- +11 more
+990 stars
from 5,098 · score 6.90
104.redcanaryco / atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
+931 stars
from 11,839 · score 6.84
105.kgretzky / evilginx2
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
+905 stars
from 14,926 · score 6.81
106.maurosoria / dirsearch
Web path scanner
+904 stars
from 14,139 · score 6.81
107.gravitational / teleport
The easiest, and most secure way to access and protect all of your infrastructure.
- ssh
- go
- bastion
- teleport-binaries
- certificate
- golang
- +14 more
+894 stars
from 20,174 · score 6.80
108.openwall / john
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
- john
- c
- ripper
- password
- jtr
- opencl
- +10 more
+882 stars
from 12,985 · score 6.78
109.vxunderground / MalwareSourceCode
Collection of malware source code for a variety of platforms in an array of different programming languages.
- malware
- malware-research
- malware-development
- malware-detection
+863 stars
from 18,029 · score 6.76
110.pwndbg / pwndbg
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
- python
- gdb
- pwndbg
- reverse-engineering
- debugging
- ctf
- +12 more
+812 stars
from 10,338 · score 6.70
111.vanhauser-thc / thc-hydra
hydra
- penetration-testing
- password-cracker
- network-security
- hydra
- thc
- pentesting
- +10 more
+802 stars
from 11,659 · score 6.69
112.open-policy-agent / opa
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
- opa
- policy
- declarative
- json
- compliance
- cloud-native
- +2 more
+788 stars
from 11,641 · score 6.67
113.yokoffing / Betterfox
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
+767 stars
from 10,198 · score 6.64
114.Mebus / cupp
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
- password-strength
- weak-passwords
+762 stars
from 5,856 · score 6.64
+758 stars
from 13,852 · score 6.63
116.trustedsec / social-engineer-toolkit
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
+735 stars
from 14,699 · score 6.60
117.redlib-org / redlib
Private front-end for Reddit
- privacy
- privacy-friendly-alternatives
- privacy-frontend
- rust
+720 stars
from 3,250 · score 6.58
+714 stars
from 13,559 · score 6.57
119.pterodactyl / panel
Pterodactyl® is a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.
- laravel
- opensource
- mit
- docker
- free
- tailwindcss
- +6 more
+704 stars
from 8,762 · score 6.56
+695 stars
from 8,610 · score 6.55
+671 stars
from 13,713 · score 6.51
122.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+667 stars
from 8,884 · score 6.50
123.tutao / tutanota
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
- javascript
- mithril
- encryption
- tutanota
- security
- +1 more
+666 stars
from 7,451 · score 6.50
124.arkenfox / user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
+652 stars
from 12,306 · score 6.48
125.AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.
- adb
- android
- android-debug-bridge
- cybersecurity
- exploit
- hacking
- +14 more
+643 stars
from 5,784 · score 6.47
126.telekom-security / tpotce
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
+631 stars
from 9,063 · score 6.45
127.ytisf / theZoo
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
- malware
- malware-analysis
- malware-samples
- malware-research
- thezoo
- malwareanalysis
+624 stars
from 12,916 · score 6.44
128.cure53 / DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
+616 stars
from 16,887 · score 6.42
129.rizinorg / rizin
UNIX-like reverse engineering framework and command-line toolset.
- reverse-engineering
- program-analysis
- security
- exploitation
- debugging
+589 stars
from 3,540 · score 6.38
130.ory / hydra
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
- hydra
- oauth2
- openid-connect
- docker
- server
- security
- +14 more
+588 stars
from 17,059 · score 6.38
131.FrancescoStabile / numasec
The AI Agent for Cyber Security.
- ai-agent
- ai-security
- appsec
- bug-bounty
- cybersecurity
- devsecops
- +14 more
+586 stars
from 243 · score 6.38
132.apache / caldera
Automated Adversary Emulation Platform
- adversary-emulation
- caldera
- security-automation
- red-team
- mitre-attack
- security-testing
- +1 more
+582 stars
from 6,910 · score 6.37
133.stakater / Reloader
A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!
- kubernetes
- openshift
- configmap
- secrets
- pods
- deployments
- +5 more
+574 stars
from 9,973 · score 6.35
134.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
- security
- monitoring
- intrusion-detection
- sql
- hacktoberfest
+563 stars
from 23,162 · score 6.34
+563 stars
from 10,267 · score 6.34
136.s0md3v / Photon
Incredibly fast crawler designed for OSINT.
+554 stars
from 12,765 · score 6.32
137.evyatarmeged / Raccoon
A high performance offensive security tool for reconnaissance and vulnerability scanning
- reconnaissance
- scanner
- vulnerability-assessment
- vulnerability-scanner
- enumeration
- pentesting
- +9 more
+548 stars
from 3,520 · score 6.31
+538 stars
from 21,414 · score 6.29
139.authzed / spicedb
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
- zanzibar
- permissions
- database
- distributed-systems
- security
- security-tools
- +12 more
+535 stars
from 6,660 · score 6.28
140.PrivateBin / PrivateBin
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
- self-hosted
- self-hosting
- pastebin
- security
- one-time
- self-destroy
- +6 more
+534 stars
from 8,197 · score 6.28
141.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+534 stars
from 4,620 · score 6.28
142.lanmaster53 / recon-ng
Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
+532 stars
from 5,507 · score 6.28
143.lucasg / Dependencies
A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
+531 stars
from 11,404 · score 6.28
144.kubescape / kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
- kubernetes
- security
- nsa
- mitre-attack
- devops
- best-practice
- +1 more
+519 stars
from 11,325 · score 6.25
145.capstone-engine / capstone
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
- reverse-engineering
- disassembler
- security
- framework
- arm
- arm64
- +14 more
+514 stars
from 8,653 · score 6.24
146.go-acme / lego
Let's Encrypt/ACME client and library written in Go
+508 stars
from 9,494 · score 6.23
147.bee-san / Ciphey
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
- artificial-intelligence
- ctf-tools
- +11 more
+506 stars
from 21,237 · score 6.23
+501 stars
from 29,157 · score 6.22
149.screetsec / TheFatRat
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
- thefatrat
- bypass
- linux
- autorun
- bypass-av
- antivirus
- +14 more
+497 stars
from 11,082 · score 6.21
150.kevoreilly / CAPEv2
Malware Configuration And Payload Extraction
- configs
- debugging-tools
- malware
- malware-analysis
- malware-research
- reverse-engineering
- +3 more
+497 stars
from 3,153 · score 6.21
151.Velocidex / velociraptor
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
- endpoint-protection
- endpoint-discovery
- +1 more
+496 stars
from 3,916 · score 6.21
152.volatilityfoundation / volatility3
Volatility 3.0 development
- digital-investigation
- forensics
- incident-response
- malware
- memory
- python
- +3 more
+495 stars
from 4,073 · score 6.21
153.dexidp / dex
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
- oidc
- kubernetes
- idp
- identity-provider
- hacktoberfest
+494 stars
from 10,739 · score 6.20
154.apache / casbin
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
- casbin
- access-control
- authorization
- rbac
- abac
- acl
- +12 more
+490 stars
from 19,986 · score 6.20
155.SpacehuhnTech / WiFiDuck
Wireless keystroke injection attack platform
+481 stars
from 2,859 · score 6.18
156.jhaals / yopass
Secure sharing of secrets, passwords and files
- password-share
- encryption-decryption
- file-upload
- onetimelink
- onetimesecret
- secret-sharing
+478 stars
from 2,744 · score 6.17
157.bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
- terraform
- static-analysis
- aws
- gcp
- azure
- aws-security
- +7 more
+477 stars
from 8,659 · score 6.17
158.Gallopsled / pwntools
CTF framework and exploit development library
+475 stars
from 13,353 · score 6.17
159.Cyan4973 / xxHash
Extremely fast non-cryptographic hash algorithm
- xxhash
- smhasher
- hash-functions
- c
- dispersion
- hash
- +1 more
+470 stars
from 10,937 · score 6.15
160.Mail-0 / Zero
Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord
+470 stars
from 10,410 · score 6.15
161.sensepost / objection
📱 objection - runtime mobile exploration
+469 stars
from 9,015 · score 6.15
162.Mbed-TLS / mbedtls
An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
+465 stars
from 6,585 · score 6.14
+462 stars
from 9,531 · score 6.14
164.Manisso / fsociety
fsociety Hacking Tools Pack – A Penetration Testing Framework
- fsociety
- exploitation
- port-scanning
- fsociety-hacking
- post-exploitation
- web-hacking
- +7 more
+461 stars
from 11,933 · score 6.14
165.wifiphisher / wifiphisher
The Rogue Access Point Framework
- wifiphisher
- wifi
- rogue
- access-point
- python
- security
- +4 more
+454 stars
from 14,488 · score 6.12
166.jedisct1 / libsodium
A modern, portable, easy to use crypto library.
- crypto
- cryptography
- c
- zig-package
+454 stars
from 13,587 · score 6.12
167.dromara / Sa-Token
Translated✨ An open-source, free, one-stop Java permission authentication framework that makes authentication and authorization simple and elegant! — Login authentication, permission authentication, distributed Session, microservice gateway authentication, SSO single sign-on, OAuth2.0 unified authentication, jwt integration, API Key authorization, API parameter signing
- java
- token
- authorization
- sso
- aouth2
- springcloud
+451 stars
from 18,656 · score 6.11
168.certbot / certbot
Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
- acme
- acme-client
- certbot
- certificate
- letsencrypt
- python
+422 stars
from 32,890 · score 6.05
169.SpacehuhnTech / esp8266_deauther
Affordable WiFi hacking platform for testing and learning
+417 stars
from 14,667 · score 6.04
170.javascript-obfuscator / javascript-obfuscator
A powerful obfuscator for JavaScript and Node.js
- javascript-obfuscator
- obfuscation
- uglify
- javascript
- protection
- obfuscate
- +14 more
+415 stars
from 15,907 · score 6.03
171.MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
- misp
- threat-sharing
- threat-hunting
- threatintel
- malware-analysis
- stix
- +14 more
+414 stars
from 6,228 · score 6.03
172.LinkStackOrg / LinkStack
LinkStack - the ultimate solution for creating a personalized & professional profile page. Showcase all your important links in one place, forget the limitation of one link on social media. Set up your personal site on your own server with just a few clicks.
- php
- blade
- laravel
- self-hosted
- webapp
- open-source
- +6 more
+413 stars
from 3,527 · score 6.03
173.cert-manager / cert-manager
Automatically provision and manage TLS certificates in Kubernetes
- kubernetes
- letsencrypt
- tls
- certificate
- crd
- hacktoberfest
+412 stars
from 13,735 · score 6.02
174.ory / kratos
Headless cloud-native authentication and identity management written in Go. Scales to a billion+ users. Replace Homegrown, Auth0, Okta, Firebase with better UX and DX. Passkeys, Social Sign In, OIDC, Magic Link, Multi-Factor Auth, SMS, SAML, TOTP, and more. Runs everywhere, runs best on Ory Network.
- identity
- identity-management
- user-management
- users
- user
- login
- +5 more
+409 stars
from 13,539 · score 6.02
175.supertokens / supertokens-core
Open source alternative to Auth0 / Firebase Auth / AWS Cognito
- authentication
- session-management
- login
- supertokens
- java
- signin
- +13 more
+401 stars
from 14,941 · score 6.00
176.elastic / detection-rules
The repository host gives no description.
- threat-detection
- threat-hunting
+399 stars
from 2,557 · score 5.99
177.s0md3v / XSStrike
Most advanced XSS scanner.
- xss
- xss-scanner
- xss-exploit
- xss-bruteforce
- xss-python
- xss-detection
- +2 more
+398 stars
from 14,843 · score 5.99
178.rustls / rustls
A modern TLS library in Rust
+394 stars
from 7,342 · score 5.98
+387 stars
from 9,595 · score 5.96
180.Karib0u / rustinel
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
- etw
- incident-response
- +14 more
+380 stars
from 147 · score 5.94
181.androguard / androguard
Reverse engineering and pentesting for Android applications
- android
- dalvik
- reverse-engineering
- dex
- odex
- pentesting
+377 stars
from 6,029 · score 5.93
182.dwisiswant0 / apkleaks
Scanning APK file for URIs, endpoints & secrets.
- mobile-security
- android-security
- reverse-engineering
- bugbounty
- static-analysis
- apk
- +2 more
+372 stars
from 6,004 · score 5.92
183.passbolt / passbolt_api
Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!
- password-manager
- passbolt
- security
- cakephp
- productivity
- php
- +3 more
+367 stars
from 5,845 · score 5.91
+362 stars
from 4,574 · score 5.89
185.Col-E / Recaf
The modern Java bytecode editor
- java
- bytecode
- bytecode-engineering
- reverse-engineering
- jvm-bytecode
- decompile
- +8 more
+361 stars
from 7,095 · score 5.89
186.cowrie / cowrie
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
+361 stars
from 6,300 · score 5.89
187.mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
- malware-analysis
- reverse-engineering
- binary-analysis
- threat-intelligence
- gsoc-2026
+355 stars
from 5,944 · score 5.87
188.nextauthjs / next-auth
Authentication for the Web.
- nodejs
- nextjs
- oauth
- react
- authentication
- nextauth
- +12 more
+348 stars
from 28,026 · score 5.86
189.wpscanteam / wpscan
WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected]
- wordpress
- wpscan
- security
- security-scanner
- hacking-tool
- scanner
- +2 more
+348 stars
from 9,486 · score 5.86
190.BLAKE3-team / BLAKE3
the official Rust and C implementations of the BLAKE3 cryptographic hash function
+348 stars
from 6,161 · score 5.86
191.Vineflower / vineflower
Modern Java decompiler aiming to be as accurate as possible, with an emphasis on output quality. Fork of the Fernflower decompiler.
- decompiler
- fernflower
- java
- hacktoberfest
+346 stars
from 2,107 · score 5.85
192.Bubka / 2FAuth
A Web app to manage your Two-Factor Authentication (2FA) accounts and generate their security codes
- otp
- 2fa
- 2factor
- totp
- hotp
- self-hosted
- +4 more
+345 stars
from 3,870 · score 5.85
193.bountyyfi / lonkero
Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.
- cve-scanning
- pentesting-tools
- rust
- vulnerability-scanners
- websecurity
- appsec
- +14 more
+335 stars
from 764 · score 5.82
194.chaitin / xray
TranslatedA comprehensive security assessment tool developed in-house by Chaitin (长亭), supporting scanning for common web security issues and custom PoCs | Be sure to read the documentation before use
- security
- vulnerability
- vulnerability-scanner
- passive-vulnerability-scanner
- xss
- sqlinjection
- +1 more
+332 stars
from 11,453 · score 5.81
+331 stars
from 10,734 · score 5.81
196.hugsy / gef
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
- python
- exploit
- gdb
- linux
- reverse-engineering
- ctf
- +13 more
+330 stars
from 8,090 · score 5.80
197.RsaCtfTool / RsaCtfTool
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
- rsa-attack
- rsa
- cryptography
+326 stars
from 6,886 · score 5.79
198.Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
- penetration-testing
- security
- hacking
- infosec
- rtsp
- cctv
- +5 more
+313 stars
from 4,976 · score 5.75
199.x64dbg / ScyllaHide
Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
+313 stars
from 4,063 · score 5.75
200.BlessedRebuS / Krawl
Krawl is a customizable, lightweight, cloud-native web deception server and anti-crawler that creates fake web applications with low-hanging vulnerabilities using realistic, randomly generated decoy data and AI-generated HTML templates.
- anti-crawling
- cloud-native
- crawler
- deception
- honeypot
- kubernetes
- +11 more
+309 stars
from 519 · score 5.74