1.usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
+48,874 stars
from 24,357 · score 10.80
Trending repositories
Ranked by Attention Score: stars gained over the last 180 complete days
1–100 of 467 by Attention Score · May 7, 2026 – Nov 2, 2026 (UTC)
2.trimstray / the-book-of-secret-knowledge
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
+37,797 stars
from 217,322 · score 10.54
3.mukul975 / Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
+29,518 stars
from 5,886 · score 10.29
4.Hack-with-Github / Awesome-Hacking
A collection of various awesome lists for hackers, pentesters and security researchers
+13,623 stars
from 110,716 · score 9.52
5.KeygraphHQ / shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
+10,268 stars
from 40,573 · score 9.24
6.simplex-chat / simplex-chat
SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱!
+8,786 stars
from 10,838 · score 9.08
7.caddyserver / caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
+6,987 stars
from 71,642 · score 8.85
8.imthenachoman / How-To-Secure-A-Linux-Server
An evolving how-to guide for securing a Linux server.
+6,245 stars
from 25,766 · score 8.74
9.swisskyrepo / PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
+5,442 stars
from 76,842 · score 8.60
10.TecharoHQ / anubis
Weighs the soul of incoming HTTP requests to stop AI crawlers
+5,144 stars
from 18,739 · score 8.55
11.goauthentik / authentik
The authentication glue you need.
+5,078 stars
from 21,114 · score 8.53
12.GyulyVGC / sniffnet
Comfortably monitor your network traffic 🕵️♂️
+4,900 stars
from 36,900 · score 8.50
13.ImranR98 / Obtainium
Get Android app updates straight from the source.
+4,532 stars
from 16,595 · score 8.42
14.projectdiscovery / nuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
+4,501 stars
from 28,024 · score 8.41
15.aquasecurity / trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
+4,299 stars
from 34,599 · score 8.37
16.gitleaks / gitleaks
Find secrets with Gitleaks 🔑
+4,154 stars
from 26,421 · score 8.33
17.Developer-Y / cs-video-courses
List of Computer Science courses with video lectures.
+4,083 stars
from 80,390 · score 8.31
18.Infisical / infisical
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
+3,799 stars
from 26,402 · score 8.24
19.mitmproxy / mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
+3,426 stars
from 43,116 · score 8.14
20.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+3,384 stars
from 12,291 · score 8.13
21.trufflesecurity / trufflehog
Find, verify, and analyze leaked credentials
+3,025 stars
from 25,792 · score 8.01
22.keepassxreboot / keepassxc
KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.
+2,975 stars
from 26,705 · score 8.00
23.twpayne / chezmoi
Manage your dotfiles across multiple diverse machines, securely.
+2,721 stars
from 19,409 · score 7.91
24.lissy93 / web-check
🕵️♂️ All-in-one OSINT tool for analysing any website
+2,573 stars
from 32,747 · score 7.85
25.community-scripts / ProxmoxVE
Proxmox VE Helper-Scripts (Community Edition)
+2,377 stars
from 27,620 · score 7.77
26.crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
+2,256 stars
from 13,160 · score 7.72
27.zoicware / RemoveWindowsAI
Force Remove Copilot, Recall and More in Windows 11
+2,217 stars
from 11,338 · score 7.70
28.x64dbg / x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
+2,155 stars
from 47,983 · score 7.68
29.wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
+2,150 stars
from 15,383 · score 7.67
30.nginx / nginx
The official NGINX Open Source repository.
+2,147 stars
from 29,878 · score 7.67
31.chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
+2,137 stars
from 21,003 · score 7.67
32.jason5ng32 / MyIP
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
+2,137 stars
from 10,144 · score 7.67
33.winsiderss / systeminformer
A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com
+2,074 stars
from 14,319 · score 7.64
34.OWASP / CheatSheetSeries
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
+2,054 stars
from 31,782 · score 7.63
35.getsops / sops
Simple and flexible tool for managing secrets
+1,991 stars
from 21,589 · score 7.60
36.authelia / authelia
The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
+1,977 stars
from 27,497 · score 7.59
37.1N3 / Sn1per
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
+1,826 stars
from 9,684 · score 7.51
38.Atlas-OS / Atlas
🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability.
+1,813 stars
from 20,175 · score 7.50
39.radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
+1,752 stars
from 23,482 · score 7.47
40.eosphoros-ai / DB-GPT
open-source agentic AI data assistant for the next generation of AI + Data products.
+1,702 stars
from 18,532 · score 7.44
41.cilium / cilium
eBPF-based Networking, Security, and Observability
+1,630 stars
from 24,121 · score 7.40
42.prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
+1,506 stars
from 13,644 · score 7.32
43.rizinorg / cutter
Free and Open Source Reverse Engineering Platform powered by rizin
+1,502 stars
from 18,625 · score 7.32
44.lissy93 / personal-security-checklist
🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
+1,496 stars
from 21,183 · score 7.31
45.cryptomator / cryptomator
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
+1,495 stars
from 14,918 · score 7.31
46.fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
+1,364 stars
from 17,565 · score 7.22
47.juice-shop / juice-shop
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
+1,356 stars
from 12,970 · score 7.21
48.hwdsl2 / setup-ipsec-vpn
Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and management scripts.
+1,334 stars
from 27,593 · score 7.20
49.StevenBlack / hosts
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
+1,283 stars
from 30,078 · score 7.16
50.bettercap / bettercap
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
+1,195 stars
from 19,030 · score 7.09
51.nmap / nmap
Nmap - the Network Mapper. Github mirror of official SVN repository.
+1,194 stars
from 12,719 · score 7.09
52.shadow1ng / fscan
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
+1,167 stars
from 13,563 · score 7.06
53.DedSecInside / TorBot
Dark Web OSINT Tool
+1,155 stars
from 4,003 · score 7.05
54.OpenVPN / openvpn
OpenVPN is an open source VPN daemon
+1,103 stars
from 13,653 · score 7.01
55.zaproxy / zaproxy
The ZAP by Checkmarx Core project
+1,092 stars
from 14,998 · score 7.00
56.bee-san / RustScan
🤖 The Modern Port Scanner 🤖
+1,083 stars
from 19,569 · score 6.99
57.frappe / frappe
Low code web framework for real world applications, in Python and Javascript
+1,073 stars
from 9,970 · score 6.98
58.anchore / grype
A vulnerability scanner for container images and filesystems
+1,072 stars
from 12,083 · score 6.98
59.projectdiscovery / nuclei-templates
Community curated list of templates for the nuclei engine to find security vulnerabilities.
+1,064 stars
from 12,203 · score 6.97
60.netalertx / NetAlertX
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
+1,047 stars
from 6,301 · score 6.95
61.SigmaHQ / sigma
Main Sigma Rule Repository
+1,031 stars
from 10,354 · score 6.94
62.digininja / DVWA
Damn Vulnerable Web Application (DVWA)
+1,012 stars
from 12,930 · score 6.92
63.openfga / openfga
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
+988 stars
from 5,084 · score 6.90
64.edoardottt / awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
+958 stars
from 10,492 · score 6.87
65.knownsec / 404StarLink
404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目
+931 stars
from 10,534 · score 6.84
66.gravitational / teleport
The easiest, and most secure way to access and protect all of your infrastructure.
+903 stars
from 20,154 · score 6.81
67.maurosoria / dirsearch
Web path scanner
+903 stars
from 14,130 · score 6.81
68.sbilly / awesome-security
A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
+872 stars
from 14,187 · score 6.77
69.bunkerity / bunkerweb
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
+835 stars
from 10,368 · score 6.73
70.The-Vibe-Company / quivr
An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.
+834 stars
from 38,789 · score 6.73
71.fleetdm / fleet
Open device management
+818 stars
from 6,278 · score 6.71
72.lissy93 / awesome-privacy
🦄 A curated list of privacy & security-focused software and services
+813 stars
from 9,224 · score 6.70
73.drduh / YubiKey-Guide
Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.
+808 stars
from 12,254 · score 6.70
74.bytebase / bytebase
Database governance built for humans and agents — controlling changes and access across every major database.
+805 stars
from 13,861 · score 6.69
75.yokoffing / Betterfox
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
+776 stars
from 10,186 · score 6.66
76.evilsocket / opensnitch
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
+743 stars
from 13,490 · score 6.61
77.qazbnm456 / awesome-web-security
🐶 A curated list of Web Security materials and resources.
+735 stars
from 13,248 · score 6.60
78.hslatman / awesome-threat-intelligence
A curated list of Awesome Threat Intelligence resources
+710 stars
from 10,098 · score 6.57
79.google / oss-fuzz
OSS-Fuzz - continuous fuzzing for open source software.
+689 stars
from 12,145 · score 6.54
80.falcosecurity / falco
Cloud Native Runtime Security
+667 stars
from 8,877 · score 6.50
81.gophish / gophish
Open-Source Phishing Toolkit
+663 stars
from 13,706 · score 6.50
82.matomo-org / matomo
Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!
+653 stars
from 21,342 · score 6.48
83.tutao / tutanota
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
+651 stars
from 7,442 · score 6.48
84.arkenfox / user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
+646 stars
from 12,302 · score 6.47
85.cure53 / DOMPurify
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
+630 stars
from 16,869 · score 6.45
86.telekom-security / tpotce
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
+620 stars
from 9,058 · score 6.43
87.firezone / firezone
Blazing-fast remote access
+618 stars
from 8,537 · score 6.43
88.kenryu42 / cc-safety-net
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
+602 stars
from 1,281 · score 6.40
89.secluso / core
A privacy-preserving Raspberry Pi home security camera that uses advanced end-to-end encryption.
+601 stars
from 1,091 · score 6.40
90.ory / hydra
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
+589 stars
from 17,054 · score 6.38
91.infoslack / awesome-web-hacking
A list of web application security
+575 stars
from 6,762 · score 6.36
92.rizinorg / rizin
UNIX-like reverse engineering framework and command-line toolset.
+561 stars
from 3,528 · score 6.33
93.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
+557 stars
from 23,155 · score 6.32
94.meirwah / awesome-incident-response
A curated list of tools for incident response
+555 stars
from 8,966 · score 6.32
95.monero-project / monero
Monero: the secure, private, untraceable cryptocurrency
+551 stars
from 10,419 · score 6.31
96.apsdehal / awesome-ctf
A curated list of CTF frameworks, libraries, resources and softwares
+546 stars
from 11,415 · score 6.30
97.authzed / spicedb
Open Source, Google Zanzibar-inspired database for scalably storing and querying fine-grained authorization data
+532 stars
from 6,652 · score 6.28
98.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+530 stars
from 4,610 · score 6.27
99.PrivateBin / PrivateBin
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
+529 stars
from 8,194 · score 6.27
100.kubescape / kubescape
Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.
+526 stars
from 11,312 · score 6.27