101.owasp-amass / amass
In-depth attack surface mapping and asset discovery
+213 stars
from 15,248 · score 5.37
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
101–200 of 1,154 by Attention Score · Oct 5, 2026 – Nov 3, 2026 (UTC)
102.CISOfy / lynis
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
- shell
- linux
- pci-dss
- compliance
- security-audit
- security-hardening
- +14 more
+212 stars
from 16,411 · score 5.36
103.wasp-lang / open-saas
A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.
+211 stars
from 16,032 · score 5.36
104.pterodactyl / panel
Pterodactyl® is a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.
- laravel
- opensource
- mit
- docker
- free
- tailwindcss
- +6 more
+211 stars
from 9,252 · score 5.36
105.xdreizein666 / getcontact-cli
GetContact CLI adalah project Python untuk melakukan lookup nomor telepon lewat API GetContact, tanpa aplikasi Android dan tanpa browser.
+205 stars
from 599 · score 5.33
106.anchore / grype
A vulnerability scanner for container images and filesystems
- containers
- security
- vulnerability
- docker
- golang
- go
- +9 more
+203 stars
from 12,967 · score 5.32
107.digininja / DVWA
Damn Vulnerable Web Application (DVWA)
+200 stars
from 13,762 · score 5.30
108.goharbor / harbor
An open source trusted cloud native registry project that stores, signs, and scans content.
- cncf
- container
- registry
- helm
- cloud-native
- containers
- +6 more
+199 stars
from 29,465 · score 5.30
109.acmesh-official / acme.sh
A pure Unix shell script ACME client for SSL / TLS certificate automation
+198 stars
from 47,722 · score 5.29
110.rizinorg / rizin
UNIX-like reverse engineering framework and command-line toolset.
- reverse-engineering
- program-analysis
- security
- exploitation
- debugging
+194 stars
from 3,926 · score 5.27
111.MatrixTM / MHDDoS
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
- ddos
- ddos-attacks
- ddos-tool
- attack
- cloudflare-bypass
- layer4
- +13 more
+192 stars
from 16,764 · score 5.26
112.apache / caldera
Automated Adversary Emulation Platform
- adversary-emulation
- caldera
- security-automation
- red-team
- mitre-attack
- security-testing
- +1 more
+187 stars
from 7,302 · score 5.24
113.LINGYK352 / Watchtower
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
- ai-agents
- attack-surface-management
- docker
- penetration-testing
- python
- security-assessment
- +4 more
+187 stars
from 1 · score 5.24
+186 stars
from 16,796 · score 5.23
115.projectdiscovery / subfinder
Fast passive subdomain enumeration tool.
+183 stars
from 14,528 · score 5.21
116.1N3 / Sn1per
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
- sn1per
- sn1per-professional
- bugbounty-platform
- attack-surface
- cybersecurity
- pentest-tool
- +13 more
+179 stars
from 11,339 · score 5.19
117.ZeroDayEvil / CVE-2026-54121-Certighost
🛡 Official AI Security Tool module for CVE-2026-54121 (Certighost): AD CS certificate abuse deep-dive, defensive audit workflows, and safe in-app console execution for authorized Active Directory security testing.
- active-directory
- ai-security-tool
- privilege-escalation
- red-team
- cve-2026-54121
+179 stars
from 87 · score 5.19
+178 stars
from 9,122 · score 5.19
+177 stars
from 4,981 · score 5.18
120.peass-ng / PEASS-ng
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
+170 stars
from 20,586 · score 5.14
121.openfga / openfga
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
- authorization
- permissions
- security
- zanzibar
- openfga
- entitlements
- +11 more
+170 stars
from 5,915 · score 5.14
122.FiloSottile / mkcert
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
- https
- tls
- certificates
- local-development
- localhost
- root-ca
- +6 more
+167 stars
from 59,659 · score 5.12
123.redcanaryco / atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK.
- mitre
- mitre-attack
+167 stars
from 12,597 · score 5.12
124.pwndbg / pwndbg
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
- python
- gdb
- pwndbg
- reverse-engineering
- debugging
- ctf
- +12 more
+164 stars
from 10,979 · score 5.11
125.redlib-org / redlib
Private front-end for Reddit
- privacy
- privacy-friendly-alternatives
- privacy-frontend
- rust
+161 stars
from 3,805 · score 5.09
126.calesthio / Crucix
Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
+159 stars
from 12,035 · score 5.08
127.kgretzky / evilginx2
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
+155 stars
from 15,669 · score 5.05
128.telekom-security / tpotce
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
+155 stars
from 9,540 · score 5.05
129.bettercap / bettercap
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
+154 stars
from 20,081 · score 5.04
130.ZeroDayEvil / CVE-2026-75604-PoC
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
- ai-hacking
- ai-security-tool
- cve-scanning
- cve-tools
- exploit
- offensive-security
- +10 more
+152 stars
from 26 · score 5.03
+151 stars
from 19,625 · score 5.02
132.openwall / john
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
- john
- c
- ripper
- password
- jtr
- opencl
- +10 more
+149 stars
from 13,713 · score 5.01
133.tutao / tutanota
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
- javascript
- mithril
- encryption
- tutanota
- security
- +1 more
+144 stars
from 7,966 · score 4.98
134.szTheory / exifcleaner
Cross-platform desktop GUI app to clean image metadata
- exif
- exiftool
- electron
- javascript
- nodejs
- desktop-app
- +14 more
+143 stars
from 2,712 · score 4.97
135.shadow1ng / fscan
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
- fscan
- scanner
- scanning
- sec
- security-tools
- security
+142 stars
from 14,591 · score 4.96
136.vxunderground / MalwareSourceCode
Collection of malware source code for a variety of platforms in an array of different programming languages.
- malware
- malware-research
- malware-development
- malware-detection
+141 stars
from 18,746 · score 4.96
137.vanhauser-thc / thc-hydra
hydra
- penetration-testing
- password-cracker
- network-security
- hydra
- thc
- pentesting
- +10 more
+140 stars
from 12,319 · score 4.95
138.hashicorp / vault
A tool for secrets management, encryption as a service, and privileged access management
- vault
- go
- secrets
+139 stars
from 36,321 · score 4.94
139.maurosoria / dirsearch
Web path scanner
+133 stars
from 14,907 · score 4.90
140.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
- security
- monitoring
- intrusion-detection
- sql
- hacktoberfest
+126 stars
from 23,594 · score 4.84
141.Velocidex / velociraptor
Digging Deeper....
- incident-response
- forensics-investigations
- inventory-management
- endpoint-security
- endpoint-protection
- endpoint-discovery
- +1 more
+123 stars
from 4,286 · score 4.82
142.gravitational / teleport
The easiest, and most secure way to access and protect all of your infrastructure.
- ssh
- go
- bastion
- teleport-binaries
- certificate
- golang
- +14 more
+119 stars
from 20,948 · score 4.79
143.capstone-engine / capstone
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
- reverse-engineering
- disassembler
- security
- framework
- arm
- arm64
- +14 more
+115 stars
from 9,049 · score 4.75
144.volatilityfoundation / volatility3
Volatility 3.0 development
- digital-investigation
- forensics
- incident-response
- malware
- memory
- python
- +3 more
+114 stars
from 4,452 · score 4.74
145.Cyan4973 / xxHash
Extremely fast non-cryptographic hash algorithm
- xxhash
- smhasher
- hash-functions
- c
- dispersion
- hash
- +1 more
+112 stars
from 11,291 · score 4.73
146.open-policy-agent / opa
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
- opa
- policy
- declarative
- json
- compliance
- cloud-native
- +2 more
+111 stars
from 12,314 · score 4.72
147.moonD4rk / HackBrowserData
Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
- chrome
- macos
- windows
- pentest-tool
- hacking
- edge
- +4 more
+108 stars
from 14,563 · score 4.69
148.ytisf / theZoo
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
- malware
- malware-analysis
- malware-samples
- malware-research
- thezoo
- malwareanalysis
+108 stars
from 13,432 · score 4.69
149.falcosecurity / falco
Cloud Native Runtime Security
- cncf
- containers
- security
- falco
- ebpf
- kubernetes
- +4 more
+108 stars
from 9,442 · score 4.69
150.bee-san / Ciphey
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
- decryption
- natural-language-processing
- cryptography
- cipher
- artificial-intelligence
- ctf-tools
- +11 more
+105 stars
from 21,635 · score 4.66
151.arkenfox / user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
+105 stars
from 12,849 · score 4.66
152.AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.
- adb
- android
- android-debug-bridge
- cybersecurity
- exploit
- hacking
- +14 more
+104 stars
from 6,320 · score 4.65
+103 stars
from 14,275 · score 4.64
154.kevoreilly / CAPEv2
Malware Configuration And Payload Extraction
- configs
- debugging-tools
- malware
- malware-analysis
- malware-research
- reverse-engineering
- +3 more
+103 stars
from 3,545 · score 4.64
155.trustedsec / social-engineer-toolkit
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
+101 stars
from 15,329 · score 4.62
156.go-acme / lego
Let's Encrypt/ACME client and library written in Go
+100 stars
from 9,899 · score 4.62
+99 stars
from 14,169 · score 4.61
158.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+98 stars
from 5,052 · score 4.60
159.PrivateBin / PrivateBin
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
- self-hosted
- self-hosting
- pastebin
- security
- one-time
- self-destroy
- +6 more
+97 stars
from 8,635 · score 4.58
160.rustmailer / bichon
Bichon – A lightweight, high-performance Rust email archiver with WebUI
+97 stars
from 1,970 · score 4.58
161.yokoffing / Betterfox
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
+96 stars
from 10,870 · score 4.57
162.mandiant / capa
The FLARE team's open-source tool to identify capabilities in executable files.
- malware-analysis
- reverse-engineering
- binary-analysis
- threat-intelligence
- gsoc-2026
+93 stars
from 6,206 · score 4.54
163.androguard / androguard
Reverse engineering and pentesting for Android applications
- android
- dalvik
- reverse-engineering
- dex
- odex
- pentesting
+90 stars
from 6,312 · score 4.51
164.stakater / Reloader
A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!
- kubernetes
- openshift
- configmap
- secrets
- pods
- deployments
- +5 more
+89 stars
from 10,456 · score 4.50
165.cowrie / cowrie
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
+89 stars
from 6,571 · score 4.50
166.screetsec / TheFatRat
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
- thefatrat
- bypass
- linux
- autorun
- bypass-av
- antivirus
- +14 more
+88 stars
from 11,489 · score 4.49
167.dexidp / dex
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
- oidc
- kubernetes
- idp
- identity-provider
- hacktoberfest
+88 stars
from 11,141 · score 4.49
168.SpacehuhnTech / esp8266_deauther
Affordable WiFi hacking platform for testing and learning
+87 stars
from 14,993 · score 4.48
169.s0md3v / Photon
Incredibly fast crawler designed for OSINT.
+87 stars
from 13,231 · score 4.48
170.TypeWhisper / typewhisper-mac
Local speech-to-text for macOS on-device AI, fully private, optional cloud
- apple-silicon
- dictation
- macos
- on-device
- privacy
- speech-to-text
- +4 more
+87 stars
from 1,817 · score 4.48
171.Gallopsled / pwntools
CTF framework and exploit development library
+86 stars
from 13,738 · score 4.47
+86 stars
from 9,907 · score 4.47
173.kubescape / kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
- kubernetes
- security
- nsa
- mitre-attack
- devops
- best-practice
- +1 more
+85 stars
from 11,757 · score 4.45
174.rustls / rustls
A modern TLS library in Rust
+85 stars
from 7,649 · score 4.45
+83 stars
from 21,867 · score 4.43
176.bridgecrewio / checkov
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
- terraform
- static-analysis
- aws
- gcp
- azure
- aws-security
- +7 more
+82 stars
from 9,049 · score 4.42
+81 stars
from 10,746 · score 4.41
178.authzed / spicedb
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
- zanzibar
- permissions
- database
- distributed-systems
- security
- security-tools
- +12 more
+81 stars
from 7,111 · score 4.41
179.lanmaster53 / recon-ng
Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
+80 stars
from 5,956 · score 4.39
180.MISP / MISP
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
- misp
- threat-sharing
- threat-hunting
- threatintel
- malware-analysis
- stix
- +14 more
+79 stars
from 6,560 · score 4.38
181.jedisct1 / libsodium
A modern, portable, easy to use crypto library.
- crypto
- cryptography
- c
- zig-package
+76 stars
from 13,963 · score 4.34
182.Mbed-TLS / mbedtls
An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
+76 stars
from 6,974 · score 4.34
183.Tencent / BqLog
A lightweight, high-performance, industrial-grade cross-language logging library (C++/Java/C#/Kotlin/TS/Python/Go), battle-tested in Honor of Kings.
- cross-platform
- high-performance
- java
- logging
- cpp
- csharp
- +14 more
+75 stars
from 644 · score 4.33
184.Manisso / fsociety
fsociety Hacking Tools Pack – A Penetration Testing Framework
- fsociety
- exploitation
- port-scanning
- fsociety-hacking
- post-exploitation
- web-hacking
- +7 more
+74 stars
from 12,310 · score 4.32
185.ory / hydra
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
- hydra
- oauth2
- openid-connect
- docker
- server
- security
- +14 more
+73 stars
from 17,573 · score 4.30
186.cure53 / DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
+72 stars
from 17,430 · score 4.29
187.wifiphisher / wifiphisher
The Rogue Access Point Framework
- wifiphisher
- wifi
- rogue
- access-point
- python
- security
- +4 more
+71 stars
from 14,866 · score 4.28
188.Vineflower / vineflower
Modern Java decompiler aiming to be as accurate as possible, with an emphasis on output quality. Fork of the Fernflower decompiler.
- decompiler
- fernflower
- java
- hacktoberfest
+71 stars
from 2,380 · score 4.28
189.sbondCo / Watcharr
Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.
+71 stars
from 1,511 · score 4.28
+69 stars
from 10,995 · score 4.25
191.certbot / certbot
Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
- acme
- acme-client
- certbot
- certificate
- letsencrypt
- python
+67 stars
from 33,241 · score 4.22
192.lucasg / Dependencies
A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
+67 stars
from 11,869 · score 4.22
193.sensepost / objection
📱 objection - runtime mobile exploration
+67 stars
from 9,414 · score 4.22
194.in-toto / witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
- security-tools
- security
- attestation
- verification
- supply-chain
+67 stars
from 547 · score 4.22
195.passbolt / passbolt_api
Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!
- password-manager
- passbolt
- security
- cakephp
- productivity
- php
- +3 more
+66 stars
from 6,141 · score 4.20
196.x64dbg / ScyllaHide
Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
+66 stars
from 4,309 · score 4.20
197.apache / casbin
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
- casbin
- access-control
- authorization
- rbac
- abac
- acl
- +12 more
+64 stars
from 20,411 · score 4.17
198.Mebus / cupp
Common User Passwords Profiler (CUPP)
- wordlist-generator
- wordlist
- dictionary-attack
- password
- password-strength
- weak-passwords
+64 stars
from 6,554 · score 4.17
+63 stars
from 4,872 · score 4.16
200.dromara / Sa-Token
Translated✨ An open-source, free, one-stop Java permission authentication framework that makes authentication and authorization simple and elegant! — Login authentication, permission authentication, distributed Session, microservice gateway authentication, SSO single sign-on, OAuth2.0 unified authentication, jwt integration, API Key authorization, API parameter signing
- java
- token
- authorization
- sso
- aouth2
- springcloud
+61 stars
from 19,047 · score 4.13