Ranked by Attention Score: stars gained over the last 7 complete days
55 repositories by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
Hunt down social media accounts by username across social networks
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Useful tool to track location or mobile number
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
🕵️♂️ Collect a dossier on a person by username from 6K websites
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
🛡️ Free open-source AI-powered security terminal & vulnerability scanner (CVE, SBOM). Supports SSH, SFTP, RDP, VNC, Serial, and 12+ autonomous AI agents (DeepSeek, OpenAI) for automated security workflows, CTF & DevSecOps. Cross-platform & Web UI.
The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
Next generation web scanner
API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites
The recursive internet scanner for hackers. 🧡
🤖 The Modern Port Scanner 🤖
Automatic SQL injection and database takeover tool
hydra
Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
Reverse engineering and pentesting for Android applications
Web path scanner
THE MOST POWERFUL OFFENSIVE AI AGENT FOR PENTESTING , OSINT , AND ETHICAL HACKING
The OWASP Mobile Application Security Testing Guide (MASTG) is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the OWASP Mobile Security Weakness Enumeration (MASWE) weaknesses, which are in alignment with the OWASP MASVS.
An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
Open-source agentic security operations platform:
Directory/File, DNS and VHost busting tool written in Go
This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩💻
Cameradar hacks its way into RTSP videosurveillance cameras
A collection of hacking tools, resources and references to practice ethical hacking.
An all-in-one hacking tool to remotely take over Android devices.
The Mobile App Pentest cheat sheet was created to provide concise collection of high value information on specific mobile application penetration testing topics.
A list of web application security
The Leading Security Assessment Framework for Android.
A modular vulnerability scanner with automatic report generation capabilities.
A high performance offensive security tool for reconnaissance and vulnerability scanning
Hashtopolis - distributed password cracking with Hashcat
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
An HTTP toolkit for security research.
:key: Hash type identifier (CLI & lib)
Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.
Professional ECU Diagnostics & Tuning Suite
Automated Αll-in-One OS command injection exploitation tool.
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
An Intelligent wordlist generator based on user profiling, permutations, and statistics. (Named after the same tool in Mr.Robot series S01E01)
List of Bluetooth BR/EDR/LE security resources
GraphQL automated security testing toolkit
A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style.
Various wordlists FR & EN - Cracking French passwords
PETEP (PEnetration TEsting Proxy) is an open-source Java application for traffic analysis & modification using TCP/UDP proxies. PETEP is a useful tool for performing penetration tests of applications with various application protocols. ⚡
🔍A cutting edge context aware GraphQL API fuzzing tool!
A flexible playground for Android CTF challenges.