Ranked by Attention Score: stars gained over the last 30 complete days
101–200 of 1,148 by Attention Score · Oct 5, 2026 – Nov 3, 2026 (UTC)
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.
Pterodactyl® is a free, open-source game server management panel built with PHP, React, and Go. Designed with security in mind, Pterodactyl runs all game servers in isolated Docker containers while exposing a beautiful and intuitive UI to end users.
GetContact CLI adalah project Python untuk melakukan lookup nomor telepon lewat API GetContact, tanpa aplikasi Android dan tanpa browser.
A vulnerability scanner for container images and filesystems
Damn Vulnerable Web Application (DVWA)
An open source trusted cloud native registry project that stores, signs, and scans content.
A pure Unix shell script ACME client for SSL / TLS certificate automation
UNIX-like reverse engineering framework and command-line toolset.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
Automated Adversary Emulation Platform
Watchtower | Self-hosted AI security assessment, asset intelligence, and evidence workflows.
Fast passive subdomain enumeration tool.
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
🛡 Official AI Security Tool module for CVE-2026-54121 (Certighost): AD CS certificate abuse deep-dive, defensive audit workflows, and safe in-app console execution for authorized Active Directory security testing.
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
Small and highly portable detection tests based on MITRE's ATT&CK.
Exploit Development and Reverse Engineering with GDB & LLDB Made Easy
Private front-end for Reddit
Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
Cross-platform desktop GUI app to clean image metadata
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
Collection of malware source code for a variety of platforms in an array of different programming languages.
hydra
A tool for secrets management, encryption as a service, and privileged access management
Web path scanner
SQL powered operating system instrumentation, monitoring, and analytics.
Digging Deeper....
The easiest, and most secure way to access and protect all of your infrastructure.
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
Volatility 3.0 development
Extremely fast non-cryptographic hash algorithm
Open Policy Agent (OPA) is an open source, general-purpose policy engine.
Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).
A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.
Cloud Native Runtime Security
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
An all-in-one hacking tool to remotely take over Android devices.
Malware Configuration And Payload Extraction
The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.
Let's Encrypt/ACME client and library written in Go
eBPF-based Security Observability and Runtime Enforcement
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
The FLARE team's open-source tool to identify capabilities in executable files.
Reverse engineering and pentesting for Android applications
A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig – [✩Star] if you're using it!
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
Affordable WiFi hacking platform for testing and learning
Incredibly fast crawler designed for OSINT.
CTF framework and exploit development library
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
A modern TLS library in Rust
Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
MISP (core software) - Open Source Threat Intelligence and Sharing Platform
A modern, portable, easy to use crypto library.
An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
A lightweight, high-performance, industrial-grade cross-language logging library (C++/Java/C#/Kotlin/TS/Python/Go), battle-tested in Honor of Kings.
fsociety Hacking Tools Pack – A Penetration Testing Framework
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
The Rogue Access Point Framework
Modern Java decompiler aiming to be as accurate as possible, with an emphasis on output quality. Fork of the Fernflower decompiler.
Open source, self-hostable watched list for all your content (movies, tv series, anime, games) with user authentication, modern and clean UI and a very simple setup.
Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.
📱 objection - runtime mobile exploration
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!
Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
Common User Passwords Profiler (CUPP)
Canarytokens helps track activity and actions on your network
Translated✨ An open-source, free, one-stop Java permission authentication framework that makes authentication and authorization simple and elegant! — Login authentication, permission authentication, distributed Session, microservice gateway authentication, SSO single sign-on, OAuth2.0 unified authentication, jwt integration, API Key authorization, API parameter signing
the official Rust and C implementations of the BLAKE3 cryptographic hash function
Secure sharing of secrets, passwords and files