Ranked by Attention Score: stars gained over the last 180 complete days
1–100 of 1,254 by Attention Score · May 8, 2026 – Nov 3, 2026 (UTC)
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface
Ghidra is a software reverse engineering (SRE) framework
Fully autonomous AI Agents system capable of performing complex penetration testing tasks
🕵️♂️ Collect a dossier on a person by username from 6K websites
Hunt down social media accounts by username across social networks
Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
ALL IN ONE Hacking Tool For Hackers
Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.
Useful tool to track location or mobile number
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.
DNS-Blocklists: For a better internet - keep the internet clean!
The authentication glue you need.
HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.
holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.
Self-Hosting Guide. Learn all about locally hosting (on premises & private web servers) and managing software applications by yourself or your organization. Including Cloud, LLMs, WireGuard, Automation, Home Assistant, and Networking.
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
Open Source Identity and Access Management For Modern Applications and Services
Automated Penetration Testing Agentic Framework Powered by Large Language Models
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.
Find, verify, and analyze leaked credentials
KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.
🧑🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
A tool for reverse engineering Android apk files
The most comprehensive authentication framework
🕵️♂️ All-in-one OSINT tool for analysing any website
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
Socket-based TS/JavaScript API for WhatsApp Web
Disk encryption with strong security based on TrueCrypt
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32
The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
Free implementation of Play Services
E-mails, subdomains and names Harvester - OSINT
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
Bitwarden infrastructure/backend (API, database, Docker, etc).
Information gathering framework for phone numbers
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!
A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.
Simple and flexible tool for managing secrets
The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
ZITADEL - Identity infrastructure, simplified for you.
API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
Automatic SQL injection and database takeover tool
UNIX-like reverse engineering framework and command-line toolset
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]
Alternative Twitter front-end
A pure Unix shell script ACME client for SSL / TLS certificate automation
Bitwarden client apps (web, browser extension, desktop, and cli).
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
World's fastest and most advanced password recovery utility
🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
Free and Open Source Reverse Engineering Platform powered by rizin
An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
An open source trusted cloud native registry project that stores, signs, and scans content.
The recursive internet scanner for hackers. 🧡
Daemon to ban hosts that cause multiple authentication errors
A simple zero-config tool to make locally trusted development certificates with any names you'd like.
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
Unofficial revival of the well known .NET debugger and assembly editor, dnSpy
An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods
General purpose TLS and crypto library
Program for determining types of files for Windows, Linux and MacOS.
Fast passive subdomain enumeration tool.
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
Adversary Emulation Framework
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.
The ZAP by Checkmarx Core project
A tool for secrets management, encryption as a service, and privileged access management
A vulnerability scanner for container images and filesystems
Community curated list of templates for the nuclei engine to find security vulnerabilities.
In-depth attack surface mapping and asset discovery
Privacy-first password manager with built-in email aliasing. Fully encrypted and self-hostable.
Main Sigma Rule Repository