301.elceef / dnstwist
Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
+65 stars
from 5,709 · score 4.19
Trending repositories
Ranked by Attention Score: stars gained over the last 90 complete days
301–400 of 1,306 by Attention Score · Aug 7, 2026 – Nov 4, 2026 (UTC)
302.google / timesketch
Collaborative forensic timeline analysis
+64 stars
from 3,383 · score 4.17
+63 stars
from 29,595 · score 4.16
+63 stars
from 10,562 · score 4.16
305.JonathanSalwan / ROPgadget
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
- reverse-engineering
- rop
- rop-exploitation
- rop-gadgets
- binary-exploitation
+63 stars
from 4,452 · score 4.16
306.ashvardanian / StringZilla
Up to 100x faster strings for C, C++, CUDA, Python, Rust, Swift, JS, & Go, leveraging NEON, AVX2, AVX-512, SVE, GPGPU, & SWAR to accelerate search, hashing, sorting, edit distances, sketches, and memory ops 🦖
+63 stars
from 3,520 · score 4.16
307.pxb1988 / dex2jar
Tools to work with android .dex and java .class files
+62 stars
from 13,097 · score 4.14
+61 stars
from 12,918 · score 4.13
309.tennc / webshell
This is a webshell open source project
- webshell
- webshell-sniper
- php
- jsp
- asp
- aspx
- +3 more
+61 stars
from 10,736 · score 4.13
310.ambionics / phpggc
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
+61 stars
from 3,856 · score 4.13
311.splunk / security_content
Splunk Security Content
- splunk
- detection
- engineering
- responses
- cicd
- cybersecurity
- +1 more
+61 stars
from 1,666 · score 4.13
312.MacPass / MacPass
A native macOS KeePass client
- keepass
- kdbx
- macpass
- password-manager
- password
- objective-c
- +2 more
+60 stars
from 6,837 · score 4.11
313.step-security / harden-runner
Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.
- github-actions
- actions
- supply-chain-security
- hardening
- security-hardening
- runners
- +3 more
+60 stars
from 1,235 · score 4.11
314.jwtk / jjwt
Java JWT: JSON Web Token for Java and Android
- jwt
- java
- java-jwt
- jjwt
- jwt-token
- jwt-tokens
- +14 more
+59 stars
from 11,082 · score 4.09
315.google / uuid
Go package for UUIDs based on RFC 4122 and DCE 1.1: Authentication and Security Services.
- go
- uuid
+59 stars
from 6,095 · score 4.09
316.linuxserver / docker-swag
Nginx webserver and reverse proxy with php support and a built-in Certbot (Let's Encrypt) client. It also contains fail2ban for intrusion prevention.
- hacktoberfest
+59 stars
from 3,695 · score 4.09
317.rabbitstack / fibratus
Security sensor for realtime threat detection and protection
+59 stars
from 2,507 · score 4.09
318.panva / openid-client
OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
- oidc
- openid
- openid-client
- openid-connect
- passport
- connect
- +1 more
+59 stars
from 2,381 · score 4.09
319.codingo / NoSQLMap
Automated NoSQL database enumeration and web application exploitation tool.
- nosql
- nosql-databases
- penetration-testing
- scanner
- security-audit
- security-tools
- +14 more
+58 stars
from 3,314 · score 4.08
+58 stars
from 1,780 · score 4.08
321.apereo / cas
Apereo CAS - Identity & Single Sign On for all earthlings and beyond.
- sso-authentication
- authentication
- authorization
- java
- websso
- saml2
- +14 more
+57 stars
from 11,337 · score 4.06
+57 stars
from 5,467 · score 4.06
+57 stars
from 2,446 · score 4.06
324.mandiant / flare-fakenet-ng
FakeNet-NG - Next Generation Dynamic Network Analysis Tool
- fakenet-ng
- traffic-redirection
- malware-analysis
- mandiant-flare
- gsoc-2026
+57 stars
from 2,166 · score 4.06
325.markbates / goth
Package goth provides a simple, clean, and idiomatic way to write authentication packages for Go web applications.
+56 stars
from 6,566 · score 4.04
326.GerbenJavado / LinkFinder
A python script that finds endpoints in JavaScript files
- infosec
- endpoints
+56 stars
from 4,417 · score 4.04
+56 stars
from 3,932 · score 4.04
328.log2timeline / plaso
Super timeline all the things
+56 stars
from 2,130 · score 4.04
329.epsylon / ufonet
UFONet - Denial of Service Toolkit
- dos
- ddos
- ufonet
- botnet
- disruption
- cryptography
- +1 more
+55 stars
from 2,494 · score 4.03
330.cider-security-research / cicd-goat
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
+55 stars
from 2,277 · score 4.03
331.Permify / permify
An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉
- access-control
- authorization
- rbac
- rebac
- zanzibar
- acl
- +13 more
+54 stars
from 5,913 · score 4.01
332.ZerBea / hcxtools
A small set of tools to convert packets from capture files to hash files for use with Hashcat or John the Ripper.
- wlan
- wpa
- wpa2
- raspberry-pi
- hashcat
- handshake
- +8 more
+54 stars
from 2,415 · score 4.01
333.htrgouvea / nipe
An engine to make Tor network your default gateway
+54 stars
from 2,353 · score 4.01
+54 stars
from 1,233 · score 4.01
335.activecm / rita
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
- beacons
- blue-team
- c2
- command-and-control
- cyber-security
- network-traffic-analysis
- +10 more
+54 stars
from 613 · score 4.01
336.teodly / inferno
[MIRROR] unofficial implementation of Dante protocol (Audio over IP)
- audio-over-ip
- dante
- reverse-engineering
- aoip
- audinate
+54 stars
from 311 · score 4.01
337.helmetjs / helmet
Help secure Express apps with various HTTP headers
- javascript
- middleware
- security
- helmet
- http-headers
+53 stars
from 10,692 · score 3.99
338.pennersr / django-allauth
Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/
- authentication
- django
- oauth2
- openid-connect
- python
- saml
- +8 more
+53 stars
from 10,330 · score 3.99
+53 stars
from 5,669 · score 3.99
340.RetireJS / retire.js
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
- vulnerabilities
- scanner
- firefox-extension
- grunt-plugins
- javascript
- vulnerable-libraries
- +8 more
+53 stars
from 4,150 · score 3.99
341.s0md3v / ReconDog
Reconnaissance Swiss Army Knife
- recon
- information-gathering
- honeypot-detector
- subdomain-enumeration
- cms-detector
+52 stars
from 2,075 · score 3.97
342.spacehuhn / esp8266_beaconSpam
Creates up to a thousand WiFi access points with custom SSIDs.
- ssid
- custom-ssids
- wifi
- esp8266
- spam
- flood
- +1 more
+52 stars
from 1,337 · score 3.97
343.paulmillr / noble-hashes
Audited & minimal JS implementation of hash functions, MACs and KDFs.
- cryptography
- hash
- kdf
- hashing
- sha256
- sha512
- +13 more
+52 stars
from 892 · score 3.97
+52 stars
from 721 · score 3.97
345.WebDecoy / FCaptcha
Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.
- anti-bot
- behavioral-analysis
- bot-detection
- captcha
- fingerprinting
- go
- +14 more
+52 stars
from 180 · score 3.97
346.docker / docker-bench-security
The Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
+50 stars
from 9,656 · score 3.93
347.ossec / ossec-hids
OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
- hids
- security
- pci-dss
- nist800-53
- ossec
- compliance
- +5 more
+50 stars
from 5,020 · score 3.93
348.pry0cc / axiom
The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!
- hacking-vps
- bug-bounty
- tmux
- axiom
- masscan
- gowitness
- +12 more
+50 stars
from 4,395 · score 3.93
349.bitcoin-core / secp256k1
Optimized C library for EC operations on curve secp256k1
+50 stars
from 2,452 · score 3.93
350.objective-see / BlockBlock
BlockBlock provides continual protection by monitoring persistence locations.
+50 stars
from 826 · score 3.93
+49 stars
from 2,761 · score 3.91
352.uxmal / reko
Reko is a binary decompiler.
- decompiler
- dotnet
- decompiler-engine
- decompile
- reverse-engineering
- x86
- +7 more
+49 stars
from 2,586 · score 3.91
+48 stars
from 2,562 · score 3.89
354.RustCrypto / hashes
Collection of cryptographic hash functions written in pure Rust
- cryptographic-hash-functions
- blake2
- gost
- streebog
- groestl
- md2
- +13 more
+47 stars
from 2,241 · score 3.87
355.simsong / bulk_extractor
This is the development tree. Production downloads are at:
+47 stars
from 1,394 · score 3.87
356.fox-it / dissect
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
- dfir
- dissect
- python
+47 stars
from 1,134 · score 3.87
357.ory / keto
The most scalable and customizable permission server on the market. Fix your slow or broken permission system with Google's proven "Zanzibar" approach. Supports ACL, RBAC, and more. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
- hacktoberfest
- abac
- access-control
- acl
- authorization
- fine-grained-permissions
- +8 more
+46 stars
from 5,372 · score 3.85
+46 stars
from 1,410 · score 3.85
359.schemaspy / schemaspy
Database documentation built easy
- schemaspy
- java
- documentation
- database
- database-schemas
- database-diagrams
- +6 more
+45 stars
from 3,691 · score 3.83
360.sbousseaden / EVTX-ATTACK-SAMPLES
Windows Events Attack Samples
- threat-hunting
- evtx
- windows-security
- mitre-attack
- detection-engineering
- dataset
- +2 more
+45 stars
from 2,596 · score 3.83
361.sigstore / rekor
Software Supply Chain Transparency Log
- supply-chain
- provenance
- security
- transparency-log
+45 stars
from 1,185 · score 3.83
+44 stars
from 4,741 · score 3.81
363.brix / crypto-js
JavaScript library of crypto standards.
+43 stars
from 16,357 · score 3.78
364.lestrrat-go / jwx
Complete implementation of JWx (Javascript Object Signing and Encryption/JOSE) technologies for Go. #golang #jwt #jws #jwk #jwe
- jwt
- jwe
- jws
- jwk
- go
- golang
- +1 more
+43 stars
from 2,401 · score 3.78
365.ReversecLabs / damn-vulnerable-llm-agent
The repository host gives no description.
+43 stars
from 499 · score 3.78
366.auth0 / node-jsonwebtoken
JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html
+42 stars
from 18,140 · score 3.76
+42 stars
from 2,137 · score 3.76
368.jaksi / sshesame
An easy to set up and use SSH honeypot, a fake SSH server that lets anyone in and logs their activity
+42 stars
from 1,731 · score 3.76
369.elastic / protections-artifacts
Elastic Security detection content for Endpoint
+42 stars
from 1,467 · score 3.76
370.Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
- azure
- defender-for-endpoint
- dfir
- kql
- sentinel
- threat-hunting
- +9 more
+41 stars
from 1,728 · score 3.74
371.google / grr
GRR Rapid Response: remote live forensics for incident response
+40 stars
from 5,071 · score 3.71
372.Legrandin / pycryptodome
A self-contained cryptographic library for Python
- cryptography
- security
- python
+40 stars
from 3,246 · score 3.71
373.OneKeePass / desktop
A secure password manager for macOS,Linux and Windows platforms
+40 stars
from 479 · score 3.71
374.pic-standard / pic-standard
Open standard for Provenance & Intent Contracts (PIC) in AI agents. Verify intent, provenance, and evidence before high-impact tool calls.
- action-proposals
- agentic-ai
- agents
- ai
- cli
- crewai
- +14 more
+40 stars
from 30 · score 3.71
375.caddyserver / certmagic
Automatic HTTPS for any Go program: fully-managed TLS certificate issuance and renewal
- https
- acme
- letsencrypt
- golang
- go
- automatic-https
- +2 more
+39 stars
from 5,577 · score 3.69
376.Greenwolf / social_mapper
A Social Media Enumeration & Correlation Tool by Jacob Wilkin(Greenwolf)
+39 stars
from 4,053 · score 3.69
377.den4uk / andriller
📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.
+39 stars
from 1,591 · score 3.69
378.yunginnanet / HellPot
HellPot is a cross-platform portal to endless suffering meant to punish unruly HTTP bots.
+39 stars
from 1,130 · score 3.69
+39 stars
from 1,123 · score 3.69
380.heartcombo / devise
Flexible authentication solution for Rails with Warden.
- rails
- ruby
- authentication
- devise
+38 stars
from 24,315 · score 3.66
+38 stars
from 4,985 · score 3.66
382.epinna / tplmap
Server-Side Template Injection and Code Injection Detection and Exploitation Tool
+38 stars
from 4,178 · score 3.66
383.odedshimon / BruteShark
Network Analysis Tool
- hacking
- pcap-files
- pcap
- cyber
- network-analysis
- hashcat
- +11 more
+38 stars
from 3,377 · score 3.66
384.Luzifer / ots
One-Time-Secret sharing platform with a symmetric 256bit AES encryption in the browser
- one-time-secret
- golang
- encryption
- aes256
+38 stars
from 772 · score 3.66
385.momenbasel / keyFinder
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
- pentesting
- security
- chrome-extension
- api-keys
- api-security
- browser-extension
- +14 more
+38 stars
from 694 · score 3.66
386.FutureComputing4AI / EMBER2024
The repository host gives no description.
+38 stars
from 127 · score 3.66
387.jaredhanson / passport
Simple, unobtrusive authentication for Node.js.
+37 stars
from 23,483 · score 3.64
388.99designs / aws-vault
A vault for securely storing and accessing AWS credentials in development environments
+37 stars
from 8,963 · score 3.64
389.mushorg / conpot
ICS/SCADA honeypot
+37 stars
from 1,502 · score 3.64
390.SSLMate / certspotter
Lightweight Certificate Transparency Log Monitor
- certificate-transparency
- pki
- x509
- security
- webpki
+37 stars
from 1,160 · score 3.64
391.paulmillr / noble-curves
Audited & minimal JS implementation of elliptic curve cryptography.
- crypto
- cryptography
- ecdsa
- ed25519
- ed448
- eddsa
- +14 more
+37 stars
from 933 · score 3.64
392.lanjelot / patator
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage.
- pentest
- brute-force
+36 stars
from 3,906 · score 3.61
+36 stars
from 3,767 · score 3.61
394.microcosm-cc / bluemonday
bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
+36 stars
from 3,695 · score 3.61
395.Moham3dRiahi / Th3inspector
Th3Inspector 🕵️ Best Tool For Information Gathering 🔎
- information-gathering
- reverse-phone-lookup
- mx-lookup
- whois-lookup
- geo-ip
- cloudflare
- +14 more
+36 stars
from 2,641 · score 3.61
+36 stars
from 2,600 · score 3.61
397.mcginty / snow
A Rust implementation of the Noise Protocol Framework
- cryptography
- crypto
- noise-protocol-framework
- noise-protocol
- noise
- rust
- +1 more
+36 stars
from 1,080 · score 3.61
398.greg7mdp / parallel-hashmap
A family of header-only, very fast and memory-friendly hashmap and btree containers.
+35 stars
from 3,194 · score 3.58
399.jtsylve / LiME
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
+35 stars
from 2,020 · score 3.58
400.ev-flow / quark-engine
The repository host gives no description.
- defcon
- android
- blackhat
- blackbox
- malware-analysis
- malware-detection
+35 stars
from 1,703 · score 3.58