1.HunxByts / GhostTrack
Useful tool to track location or mobile number
+3,547 stars
from 16,789 · score 8.17
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
63 repositories by Attention Score · Oct 4, 2026 – Nov 2, 2026 (UTC)
2.KeygraphHQ / shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
+2,429 stars
from 48,412 · score 7.80
3.sherlock-project / sherlock
Hunt down social media accounts by username across social networks
+2,376 stars
from 93,011 · score 7.77
4.smicallef / spiderfoot
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
+1,522 stars
from 22,699 · score 7.33
5.soxoj / maigret
🕵️♂️ Collect a dossier on a person by username from 6K websites
+1,474 stars
from 38,132 · score 7.30
6.promptfoo / promptfoo
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
+1,106 stars
from 25,598 · score 7.01
7.0x4m4 / hexstrike-ai
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
+1,032 stars
from 12,245 · score 6.94
8.ZeroDayEvil / ai-security-tool
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.
+900 stars
from 384 · score 6.80
9.juice-shop / juice-shop
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
+333 stars
from 13,993 · score 5.81
10.blacklanternsecurity / bbot
The recursive internet scanner for hackers. 🧡
+297 stars
from 10,612 · score 5.70
11.qeeqbox / social-analyzer
API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites
+296 stars
from 24,128 · score 5.69
12.sqlmapproject / sqlmap
Automatic SQL injection and database takeover tool
+274 stars
from 38,555 · score 5.62
13.HackTricks-wiki / hacktricks
Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.
+213 stars
from 12,453 · score 5.37
14.1N3 / Sn1per
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
+202 stars
from 11,308 · score 5.31
15.bee-san / RustScan
🤖 The Modern Port Scanner 🤖
+187 stars
from 20,465 · score 5.24
+183 stars
from 16,782 · score 5.21
17.ZeroDayEvil / CVE-2026-75604-PoC
🛡 Official AI Security Tool module for CVE-2026-75604 (Next.js Windows Unauthenticated Remote Code Execution) with safe in-app execution, deep vulnerability validation, and DevSecOps-ready security auditing workflows.
+152 stars
from 26 · score 5.03
18.vanhauser-thc / thc-hydra
hydra
+144 stars
from 12,312 · score 4.98
19.maurosoria / dirsearch
Web path scanner
+133 stars
from 14,900 · score 4.90
20.urbanadventurer / WhatWeb
Next generation web scanner
+110 stars
from 6,865 · score 4.71
21.AzeemIdrisi / PhoneSploit-Pro
An all-in-one hacking tool to remotely take over Android devices.
+107 stars
from 6,314 · score 4.68
22.bee-san / Ciphey
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
+104 stars
from 21,629 · score 4.65
23.OJ / gobuster
Directory/File, DNS and VHost busting tool written in Go
+100 stars
from 14,165 · score 4.62
24.OWASP / mastg
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
+96 stars
from 13,211 · score 4.57
25.androguard / androguard
Reverse engineering and pentesting for Android applications
+90 stars
from 6,309 · score 4.51
26.jakejarvis / awesome-shodan-queries
🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩💻
+88 stars
from 7,747 · score 4.49
27.infosecn1nja / Red-Teaming-Toolkit
This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
+80 stars
from 10,747 · score 4.39
28.sundowndev / hacker-roadmapArchived
A collection of hacking tools, resources and references to practice ethical hacking.
+73 stars
from 15,611 · score 4.30
29.infoslack / awesome-web-hacking
A list of web application security
+58 stars
from 7,279 · score 4.08
30.Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
+53 stars
from 5,233 · score 3.99
31.commixproject / commix
Automated Αll-in-One OS command injection exploitation tool.
+38 stars
from 5,860 · score 3.66
32.dstotijn / hetty
An HTTP toolkit for security research.
+37 stars
from 12,491 · score 3.64
33.tanprathan / MobileApp-Pentest-Cheatsheet
The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.
+36 stars
from 5,283 · score 3.61
34.rmusser01 / Infosec_Reference
An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
+32 stars
from 5,998 · score 3.50
35.evyatarmeged / Raccoon
A high performance offensive security tool for reconnaissance and vulnerability scanning
+26 stars
from 4,038 · score 3.30
36.m0nad / Diamorphine
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
+26 stars
from 2,461 · score 3.30
37.owasp-noir / noir
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
+24 stars
from 1,440 · score 3.22
38.ReversecLabs / drozer
The Leading Security Assessment Framework for Android.
+22 stars
from 4,625 · score 3.14
39.CERT-Polska / Artemis
A modular vulnerability scanner with automatic report generation capabilities.
+17 stars
from 1,235 · score 2.89
40.hashtopolis / server
Hashtopolis - distributed password cracking with Hashcat
+14 stars
from 1,813 · score 2.71
41.lukechilds / reverse-shell
Reverse Shell as a Service
+12 stars
from 2,058 · score 2.56
42.momenbasel / keyFinder
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
+11 stars
from 719 · score 2.48
43.noraj / haiti
:key: Hash type identifier (CLI & lib)
+9 stars
from 1,001 · score 2.30
44.engn33r / awesome-bluetooth-security
List of Bluetooth BR/EDR/LE security resources
+8 stars
from 615 · score 2.20
45.bad-antics / blackflag-ecu
Professional ECU Diagnostics & Tuning Suite
+8 stars
from 39 · score 2.20
46.D4Vinci / elpscrk
An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
+7 stars
from 959 · score 2.08
47.HightechSec / git-scanner
A tool for bug hunting or pentesting for targeting websites that have open .git repositories available in public
+4 stars
from 385 · score 1.61
48.ddddddO / packemon
Packet monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux
+4 stars
from 307 · score 1.61
49.SECFORCE / droidground
A flexible playground for Android CTF challenges.
+4 stars
from 118 · score 1.61
50.omar2535 / GraphQLer
🔍A cutting edge context aware GraphQL API fuzzing tool!
+3 stars
from 171 · score 1.39
51.Nekmo / dirhunt
Find web directories without bruteforce
+2 stars
from 2,006 · score 1.10
52.fportantier / habu
Hacking Toolkit
+2 stars
from 990 · score 1.10
53.ReversecLabs / dref
DNS Rebinding Exploitation Framework
+2 stars
from 494 · score 1.10
54.clem9669 / wordlists
Various wordlists FR & EN - Cracking French passwords
+2 stars
from 327 · score 1.10
55.Warxim / petep
PETEP (PEnetration TEsting Proxy) is an open-source Java application for traffic analysis & modification using TCP/UDP proxies. PETEP is a useful tool for performing penetration tests of applications with various application protocols. ⚡
+2 stars
from 231 · score 1.10
56.bountyyfi / lonkero
Lonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.
+1 stars
from 1,098 · score 0.69
57.TryCatchHCF / DumpsterFire
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
+1 stars
from 1,042 · score 0.69
58.B3nac / InjuredAndroidArchived
A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style.
+1 stars
from 762 · score 0.69
59.Paradoxis / StegCrackerArchived
Steganography brute-force utility to uncover hidden data inside files
+1 stars
from 604 · score 0.69
60.juice-shop / juice-shop-ctf
Tool to export Juice Shop challenges and hints in data format compatible with CTFd, RootTheBox or FBCTF
+1 stars
from 480 · score 0.69
61.s0rg / crawley
The unix-way web crawler
+1 stars
from 339 · score 0.69
62.gsmith257-cyber / GraphCrawlerArchived
GraphQL automated security testing toolkit
+1 stars
from 334 · score 0.69
63.hegusung / WebHashcat
Hashcat web interface
+1 stars
from 326 · score 0.69