Trending repositories

1.NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework

• software-analysis
• disassembler
• reverse-engineering

2.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

3.usestrix / strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

• agents
• artificial-intelligence
• cybersecurity
• penetration-testing
• ai-penetration-testing
• ai-pentesting
• +14 more

4.Oldcircle / geo-sleuth

An agent skill that finds where a photo was taken — OpenStreetMap geometry, elevation skylines, satellite imagery and street view — and shows its work. Works with Claude Code, Codex, Cursor, Gemini CLI, OpenCode and GitHub Copilot.

• claude-code
• geoguessr
• geolocation
• osint
• agent-skills
• geoint
• +12 more

5.NVIDIA / SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

• agent-security
• agent-skills
• agentic-ai
• ai-security
• claude-code
• mcp
• +5 more

6.AhmadHassan-BTed / ShopifyAutoAuth

Enterprise-grade Shopify Admin API authentication adapter — OAuth 2.0 Client Credentials Grant with automatic token refresh.

• authentication
• client-credentials
• httpx
• oauth2
• python
• shopify
• +3 more

7.HunxByts / GhostTrack

Useful tool to track location or mobile number

• fyp
• hacking
• hacking-tool
• indonesia
• information
• information-gathering
• +13 more

8.KeygraphHQ / shannon

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

• penetration-testing
• pentesting
• security-audit
• security-automation
• security-tools
• ai-penetration-testing
• +14 more

9.jiwoochris / artex-global

Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)

• ai-agent
• autonomous-agents
• blue-team
• cybersecurity
• detection-engineering
• i18n
• +8 more

10.koala73 / worldmonitor

Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface

• ai
• dashboard
• geopolitics
• monitoring
• news
• osint
• +6 more

11.sherlock-project / sherlock

Hunt down social media accounts by username across social networks

• osint
• reconnaissance
• linux
• cli
• sherlock
• python3
• +10 more

12.dani-garcia / vaultwarden

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

• vaultwarden
• bitwarden
• rust
• docker
• rocket
• bitwarden-rs

13.Z4nzu / hackingtool

ALL IN ONE Hacking Tool For Hackers

• allinonehackingtool
• web-attack
• password-attack
• hacking
• wireless-attack
• besthackingtool
• +7 more

14.Minglink / dsh-infinite-gen-5

DeepSeek v4.1 flash 逆向工具（无限五代） 求 Star 收藏 ⭐欢迎大家提交项目的改进

• deepseek
• deepseek-harness

15.smicallef / spiderfoot

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python
• infosec
• intelligence-gathering
• +13 more

16.soxoj / maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

• osint
• social-network
• identification
• socmint
• sherlock
• investigation
• +14 more

17.iBotPeaches / Apktool

A tool for reverse engineering Android apk files

• apktool
• apk
• android
• reverse-engineering
• arsc
• 9patch

18.promptfoo / promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

• llm
• prompt-engineering
• prompts
• llmops
• prompt-testing
• testing
• +12 more

19.angusdevgo / Seep-Reverse-Lab

Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench.

20.hagezi / dns-blocklists

DNS-Blocklists: For a better internet - keep the internet clean!

• dns
• ads
• blacklist
• blocklist
• coins
• domains
• +14 more

21.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

22.0x4m4 / hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

• 0x4m4
• ai
• ai-agents
• ai-cybersecurity
• ai-hacking
• ai-penetration-testing
• +14 more

23.ZeroDayEvil / ai-security-tool

🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.

• cve-scanner
• mcp-server
• mcp-tools
• osv
• rdp
• sbom
• +13 more

24.ntfargo / Relapse-Exploit

Exploit chain for PS5 7.00 - 13.60

• exploit
• kernel
• research
• webkit

25.ADWMC / helm-d

DeepSeek Harness 破甲一体化安全分析插件：Android · Web · Native · Protocol · Malware · AI-Security 全领域聚合（9 bundle + 1 preset）

• dsh-plugin
• cordis
• deepseek-harness
• dsh
• frida
• reverse-engineering
• +3 more

26.mitschud / DirtyFrag

Ephemeral root via the CVE-2026-43284 page-cache exploit

27.skylot / jadx

Dex to Java decompiler

• android
• dex
• java
• decompiler

28.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

29.cskwork / scopeweaver

ScopeWeaver: English and Korean localization of ARTEX, with preserved AGPL-3.0 attribution.

30.WerWolv / ImHex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

• hex-editor
• reverse-engineering
• ips
• dear-imgui
• disassembler
• analyzer
• +14 more

31.icsharpcode / ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

• decompiler
• decompiler-engine
• c-sharp
• dotnet
• dotnetcore
• mono
• +4 more

32.aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

• security
• security-tools
• docker
• containers
• vulnerability-scanners
• vulnerability-detection
• +9 more

33.notinferred / keypaste

A KeePass-compatible password and secrets manager for people who work with AI agents.

• dotenv
• keepass
• mcp-server
• password-manager
• secrets-management

34.keepassxreboot / keepassxc

KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.

• keepassxc
• keepass
• password-manager
• linux
• windows
• cross-platform
• +6 more

35.Infisical / infisical

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

• environment-variables
• secret-management
• secrets
• security
• open-source
• secret-manager
• +14 more

36.danielmiessler / SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

37.Datalux / Osintgram

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

• osint
• osint-python
• python3
• instagram
• instagram-api
• penetration-testing
• +7 more

38.trailofbits / skills

Trail of Bits skills for security research, vulnerability detection, and audit workflows

• agent-skills

39.trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials

• secret
• trufflehog
• credentials
• security
• devsecops
• dynamic-analysis
• +6 more

40.keycloak / keycloak

Open Source Identity and Access Management For Modern Applications and Services

• keycloak
• oidc
• saml

41.pocket-id / pocket-id

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

• idp
• oidc
• passkeys
• self-hosted

42.GreyDGL / PentestGPT

Automated Penetration Testing Agentic Framework Powered by Large Language Models

• penetration-testing
• python
• large-language-models
• llm

43.x64dbg / x64dbg

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

• debugger
• windows
• x64
• disassembler
• reverse-engineering
• security
• +14 more

44.frida / frida

Main repo for hosting release binaries

• frida
• instrumentation
• vala

45.NPMscan / npmscan-action

Catch risky npm dependency changes before they merge.

• dependency-analysis
• devsecops
• github-actions
• malware
• npm
• npm-security
• +2 more

46.ComposioHQ / composio

Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.

• ai
• python
• agents
• aiagents
• function-calling
• developer-tools
• +11 more

47.mikeroyal / Self-Hosting-Guide

Self-Hosting Guide. Learn all about locally hosting (on premises & private web servers) and managing software applications by yourself or your organization. Including Cloud, LLMs, WireGuard, Automation, Home Assistant, and Networking.

• self-hosted
• selfhosted
• home-assistant
• wireguard
• decentralized
• self-hosting
• +14 more

48.mvt-project / mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

• forensics
• mobile
• security
• android
• ios
• forensics-tools

49.chris-ritsen / samsung-tv-root

Samsung Tizen root

• embedded-linux
• firmware-analysis
• hardware-hacking
• mali-gpu
• privilege-escalation
• reverse-engineering
• +14 more

50.wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection
• cybersecurity
• file-integrity-monitoring
• +14 more

51.megadose / holehe

holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.

• information-gathering
• osint
• osint-tools
• open-source-intelligence
• python
• email
• +9 more

52.better-auth / better-auth

The most comprehensive authentication framework

• authentication
• oauth
• oauth2
• typescript
• iam
• oidc
• +2 more

53.justcallmekoko / ESP32Marauder

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32

• esp32
• arduino
• firmware
• wifi
• bluetooth
• defensive
• +14 more

54.NVIDIA / garak

the LLM vulnerability scanner

• ai
• llm-evaluation
• llm-security
• security-scanners
• vulnerability-assessment

55.microg / GmsCore

Free implementation of Play Services

• java
• android
• microg
• google-cloud-messaging
• maps
• auth
• +8 more

56.anthropics / claude-code-security-review

An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.

57.goauthentik / authentik

The authentication glue you need.

• saml
• saml-idp
• saml-sp
• oauth2
• oauth2-server
• oauth2-client
• +11 more

58.FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

• built-at-rc
• age-encryption

59.laramies / theHarvester

E-mails, subdomains and names Harvester - OSINT

• osint
• subdomain-enumeration
• redteam
• recon
• blueteam
• discovery
• +4 more

60.radareorg / radare2

UNIX-like reverse engineering framework and command-line toolset

• radare2
• c
• commandline
• reverse-engineering
• forensics
• security
• +4 more

61.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

62.lissy93 / web-check

🕵️‍♂️ All-in-one OSINT tool for analysing any website

• osint
• privacy
• security
• security-tools
• sysadmin

63.pranshuparmar / witr

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

• cli
• devops
• freebsd
• golang
• linux
• macos
• +14 more

64.sundowndev / phoneinfoga

Information gathering framework for phone numbers

• information-gathering
• phone-number
• osint
• open-source-intelligence
• reconnaissance
• footprint
• +4 more

65.asciimoo / hister

Your own search engine

• history
• index
• search
• search-engine
• web
• mcp
• +5 more

66.authelia / authelia

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

• totp
• ldap
• sso-authentication
• two-factor-authentication
• docker
• kubernetes
• +14 more

67.LearningCircuit / local-deep-research

~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.

• academia
• arxiv
• brave
• deep-research
• local
• local-llm
• +14 more

68.RPISEC / Malware

Course materials for Malware Analysis by RPISEC

69.juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

• owasp
• javascript
• vulnerable
• hacking
• application-security
• owasp-top-10
• +8 more

70.bitwarden / server

Bitwarden infrastructure/backend (API, database, Docker, etc).

• aspnetcore
• aspnet
• sql-server
• api
• sql
• csharp
• +5 more

71.kenryu42 / cc-safety-net

A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.

• claude
• claude-code
• claude-code-plugin
• security
• codex
• pi-extension
• +14 more

72.MaxHu-xuan / chat-archive-guard

Audit AI chat exports locally before sharing or migration. Find possible secrets, personal-data patterns, broken JSON/JSONL, SQLite issues, and scan gaps—without uploading the archive.

• chat-archive
• python
• secret-scanning
• sqlite
• chat-export
• jsonl
• +8 more

73.hashcat / hashcat

World's fastest and most advanced password recovery utility

• hashcat
• password
• cracking
• gpgpu
• opencl
• c
• +2 more

74.zitadel / zitadel

ZITADEL - Identity infrastructure, simplified for you.

• saml
• authentication
• authorization
• login
• oidc
• sso
• +11 more

75.openssl / openssl

General purpose TLS and crypto library

• cryptography
• openssl
• encryption
• tls
• ssl
• decryption

76.getsops / sops

Simple and flexible tool for managing secrets

• security
• secret-distribution
• devops
• aws
• pgp
• gcp
• +3 more

77.veracrypt / VeraCrypt

Disk encryption with strong security based on TrueCrypt

• encryption
• encryption-decryption
• encryption-algorithms
• veracrypt
• idrix
• veracrypt-source

78.gchq / CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

• data-analysis
• data-manipulation
• encryption
• encoding
• compression
• parsing
• +1 more

79.WhiskeySockets / Baileys

Socket-based TS/JavaScript API for WhatsApp Web

• bun
• deno
• nodejs
• reverse-engineering
• typescript
• websockets
• +2 more

80.aliasvault / aliasvault

Privacy-first password manager with built-in email aliasing. Fully encrypted and self-hostable.

• argon2id
• blazor
• dotnet
• password-manager
• srp
• wasm
• +5 more

81.homarr-labs / homarr

A modern and easy to use dashboard. 80+ integrations. 20K+ icons built in. Authentication out of the box. No YAML, drag and drop configuration.

• dashboard
• docker
• organization
• privacy
• selfhosting
• servarr

82.blacklanternsecurity / bbot

The recursive internet scanner for hackers. 🧡

• hacking
• neo4j
• osint
• osint-framework
• python
• subdomain-enumeration
• +14 more

83.wtsxDev / reverse-engineering

List of awesome reverse engineering resources

84.rizinorg / cutter

Free and Open Source Reverse Engineering Platform powered by rizin

• cutter
• gui
• reverse-engineering
• security
• debugger

85.jason5ng32 / MyIP

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

• dns
• ip
• ipinfo
• network
• webrtc
• leaks
• +14 more

86.BishopFox / sliver

Adversary Emulation Framework

• security-tools
• implant
• golang
• dns-server
• http
• c2
• +9 more

87.qeeqbox / social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

• osint
• social-media
• analyzer
• username
• profile
• reconnaissance
• +13 more

88.sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool

• sql-injection
• detection
• exploitation
• python
• database
• pentesting
• +9 more

89.MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security
• mobile-security
• windows-mobile-security
• +13 more

90.casdoor / casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

• oidc
• sso
• oauth
• iam
• saml
• webauthn
• +14 more

91.lissy93 / personal-security-checklist

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026

• privacy
• security
• censorship
• cybersecurity
• checklist
• awesome
• +7 more

92.google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

• scanner
• security-audit
• security-tools
• vulnerability-scanner

93.rapid7 / metasploit-framework

Metasploit Framework

• hacktoberfest

94.SWE-agent / SWE-agent

SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]

• agent
• ai
• developer-tools
• llm
• agent-based-model
• lms
• +1 more

95.horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler
• reverse-engineering
• elf
• +14 more

96.TechnitiumSoftware / DnsServer

Technitium DNS Server

• dns-server
• privacy
• dns-over-https
• dns-over-tls
• dns
• dns-client
• +6 more

97.fail2ban / fail2ban

Daemon to ban hosts that cause multiple authentication errors

• linux
• macos
• security
• intrusion-prevention
• fail2ban
• bsd
• +13 more

98.dnSpyEx / dnSpy

Unofficial revival of the well known .NET debugger and assembly editor, dnSpy

• baml
• csharp
• debug
• debugger
• decompile
• decompiler
• +9 more

99.bitwarden / clients

Bitwarden client apps (web, browser extension, desktop, and cli).

• webextension
• javascript
• bitwarden
• typescript
• safari
• chrome
• +7 more

100.elastic / detection-rules

The repository host gives no description.

• threat-detection
• threat-hunting