Ranked by Attention Score: stars gained over the last 7 complete days
101–200 of 797 by Attention Score · Oct 28, 2026 – Nov 3, 2026 (UTC)
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Disk encryption with strong security based on TrueCrypt
ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.
UNIX-like reverse engineering framework and command-line toolset.
Agent-first reverse engineering for macOS, Windows and Linux: any ACP agent reads, renames and patches binaries, Android apps and GPU kernels next to you.
Bitwarden infrastructure/backend (API, database, Docker, etc).
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
Socket-based TS/JavaScript API for WhatsApp Web
Exploit chain for PS5 7.00 - 13.60
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Bitwarden client apps (web, browser extension, desktop, and cli).
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
Damn Vulnerable Web Application (DVWA)
A pure Unix shell script ACME client for SSL / TLS certificate automation
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
The ZAP by Checkmarx Core project
An automated Themida / Code Virtualizer / WinLicense (v3.0-v4) unpacker and dump fixer tool
ZITADEL - Identity infrastructure, simplified for you.
Program for determining types of files for Windows, Linux and MacOS.
The recursive internet scanner for hackers. 🧡
Daemon to ban hosts that cause multiple authentication errors
Community curated list of templates for the nuclei engine to find security vulnerabilities.
Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
A vulnerability scanner for container images and filesystems
Main Sigma Rule Repository
API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
Fast passive subdomain enumeration tool.
An open source trusted cloud native registry project that stores, signs, and scans content.
Free and Open Source Reverse Engineering Platform powered by rizin
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
In-depth attack surface mapping and asset discovery
Adversary Emulation Framework
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
Operational information regarding the 2026 php2shell vulnerabilities
🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.
eBPF-based Security Observability and Runtime Enforcement
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
CTF framework and exploit development library
Pterodactyl® is a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
SuperGhidra: Autonomous Agent Reverse Engineering, Lock-Free Ghidra Daemon & C++ Recovery Suite
Automatic SQL injection and database takeover tool
The easiest, and most secure way to access and protect all of your infrastructure.
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
hydra
Malware Configuration And Payload Extraction
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
Small and highly portable detection tests based on MITRE's ATT&CK.
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
SQL powered operating system instrumentation, monitoring, and analytics.
Private front-end for Reddit
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
Digging Deeper....
Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.
Affordable WiFi hacking platform for testing and learning
Extremely fast non-cryptographic hash algorithm
Automated Adversary Emulation Platform
Volatility 3.0 development
Suitable for Android APK reverse engineering analysis
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
Reverse engineering and pentesting for Android applications
fsociety Hacking Tools Pack – A Penetration Testing Framework
Let's Encrypt/ACME client and library written in Go
The repository host gives no description.
Web path scanner
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
A Web app to manage your Two-Factor Authentication (2FA) accounts and generate their security codes
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
The FLARE team's open-source tool to identify capabilities in executable files.
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
Collection of malware source code for a variety of platforms in an array of different programming languages.
WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected]
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
Modern Java decompiler aiming to be as accurate as possible, with an emphasis on output quality. Fork of the Fernflower decompiler.
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
Open Policy Agent (OPA) is an open source, general-purpose policy engine.