Ranked by Attention Score: stars gained over the last 7 complete days
201–300 of 769 by Attention Score · Oct 29, 2026 – Nov 4, 2026 (UTC)
WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected]
Cloud Native Runtime Security
Reverse engineering and pentesting for Android applications
Search and browse documents and data; find the people and companies you look for.
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
Common User Passwords Profiler (CUPP)
LIEF - Library to Instrument Executable Formats (C++, Python, Rust)
Modern Java decompiler aiming to be as accurate as possible, with an emphasis on output quality. Fork of the Fernflower decompiler.
A desktop app where AI agents decompile the games you own into C/C++ that rebuilds them byte for byte.
Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident response and DFIR.
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
An open source, portable, easy to use, readable and flexible TLS library, and reference implementation of the PSA Cryptography API. Releases are on a varying cadence, typically around 3 - 6 months between releases.
An all-in-one hacking tool to remotely take over Android devices.
LinkStack - the ultimate solution for creating a personalized & professional profile page. Showcase all your important links in one place, forget the limitation of one link on social media. Set up your personal site on your own server with just a few clicks.
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
The Rogue Access Point Framework
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
📱 objection - runtime mobile exploration
Cameradar hacks its way into RTSP videosurveillance cameras
Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
The repository host gives no description.
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
the official Rust and C implementations of the BLAKE3 cryptographic hash function
Self-hosted collaborative password manager for teams: folder-level access control, AES-256-GCM encryption, LDAP/AD, OAuth2 SSO, audit trail, REST API, browser extension. PHP/MySQL, Docker.
Certbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for any other CA that uses the ACME protocol.
A modern, portable, easy to use crypto library.
OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
The modern Java bytecode editor
RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data
Noriben - Portable, Simple, Malware Analysis Sandbox
cppcryptfs is an implementation of the gocryptfs encrypted overlay filesystem in C++ for Windows.
Prevents you from committing secrets and credentials into git repositories
Fast subdomains enumeration tool for penetration testers
Experience email the way you want with Mail0 – the first open source email app that puts your privacy and safety first. Join the discord: https://mail0.link/discord
A Kubernetes controller and tool for one-way encrypted Secrets
GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux
Infection Monkey - An open-source adversary emulation platform
Sysmon configuration file template with default high-quality event tracing
Triton is a dynamic binary analysis library. Build your own program analysis tools, automate your reverse engineering, perform software verification or just emulate code.
Android Reverse-Engineering Workbench for VS Code
Secure sharing of secrets, passwords and files
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
TranslatedA comprehensive security assessment tool developed in-house by Chaitin (长亭), supporting scanning for common web security issues and custom PoCs | Be sure to read the documentation before use
The Browser Exploitation Framework Project
Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
Wireless keystroke injection attack platform
The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups
Open-source agentic security operations platform:
A Java 8+ Jar & Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger & More)
Automatically provision and manage TLS certificates in Kubernetes
Incredibly fast crawler designed for OSINT.
Google's officially supported Node.js client library for accessing Google APIs. Support for authorization and authentication with OAuth 2.0, API Keys and JWT (Service Tokens) is included.
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
Multi-Cloud Security Auditing Tool
A library for patching, replacing and decorating .NET and Mono methods during runtime
comment engine
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
Your web application for managing personal data.
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
A repository of sysmon configuration modules
A secure low code deception runtime framework, leveraging AI for System Virtualization.
Minimalistic web app designed for sending private and secure notes.
Hardened allocator designed for modern systems. It has integration into Android's Bionic libc and can be used externally with musl and glibc as a dynamic library for use on other Linux-based platforms. It will gain more portability/integration over time.
Free cross-platform password manager compatible with KeePass
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
Flexible and versatile OAuth 2.0/OpenID Connect stack for .NET
A high performance offensive security tool for reconnaissance and vulnerability scanning
Hashtopolis - distributed password cracking with Hashcat
A modular vulnerability scanner with automatic report generation capabilities.
Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
[MIRROR] unofficial implementation of Dante protocol (Audio over IP)
Small set of tools for helping with reverse engineering Linux drivers
PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE
php2shell (CVE-2026-109618 & CVE-2026-109619) security patches for EOL PHP 5.4–8.1. Official & enhanced backports for vanilla php.net and Remi Collet trees. Restores safe file uploads & progress bars without RCE. Fleet-tested on OpenCart, WordPress, HestiaCP, aaPanel.
High-Fidelity AI-Assisted Deterministic Reverse Engineering FastMCP Server
Exploitation Framework for Embedded Devices
Automate SSL/TLS certificates on Windows with ease
The Leading Security Assessment Framework for Android.
FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.
A simple, secure and modern file encryption tool (and Rust library) with small explicit keys, no config options, and UNIX-style composability.
Rapidly Search and Hunt through Windows Forensic Artefacts
Network Analysis Tool
DIE engine