1.swisskyrepo / PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
+220 stars
from 82,064 · score 5.40
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
19 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.projectdiscovery / nuclei-templates
Community curated list of templates for the nuclei engine to find security vulnerabilities.
+48 stars
from 13,219 · score 3.89
3.blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
+46 stars
from 10,863 · score 3.85
4.projectdiscovery / subfinder
Fast passive subdomain enumeration tool.
+37 stars
from 14,661 · score 3.64
5.edoardottt / awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
+37 stars
from 11,413 · score 3.64
6.projectdiscovery / httpx
httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.
+30 stars
from 10,539 · score 3.43
7.maurosoria / dirsearch
Web path scanner
+25 stars
from 15,008 · score 3.26
8.Mr-Destroyer / ZimZilla
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
+25 stars
from 215 · score 3.26
9.nahamsec / Resources-for-Beginner-Bug-Bounty-Hunters
A list of resources for those interested in getting started in bug bounties
+7 stars
from 12,306 · score 2.08
10.EdOverflow / bugbounty-cheatsheet
A list of interesting payloads, tips and tricks for bug bounty hunters.
+7 stars
from 6,571 · score 2.08
11.antonio-morales / Fuzzing101
An step by step fuzzing tutorial. A GitHub Security Lab initiative
+7 stars
from 3,919 · score 2.08
12.dwisiswant0 / apkleaks
Scanning APK file for URIs, endpoints & secrets.
+4 stars
from 6,370 · score 1.61
13.codingo / NoSQLMap
Automated NoSQL database enumeration and web application exploitation tool.
+4 stars
from 3,366 · score 1.61
14.dstotijn / hetty
An HTTP toolkit for security research.
+3 stars
from 12,525 · score 1.39
15.momenbasel / keyFinder
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
+3 stars
from 727 · score 1.39
16.commixproject / commix
Automated Αll-in-One OS command injection exploitation tool.
+2 stars
from 5,896 · score 1.10
17.doyensec / inql
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
+1 stars
from 1,813 · score 0.69
18.B3nac / Android-Reports-and-Resources
A big list of Android Hackerone disclosed reports and other resources.
+1 stars
from 1,717 · score 0.69
19.codingo / VHostScan
A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
+1 stars
from 1,313 · score 0.69