1.trimstray / the-book-of-secret-knowledge
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
+7,932 stars
from 247,187 · score 8.98
Trending repositories
Ranked by Attention Score: stars gained over the last 30 complete days
1–100 of 420 by Attention Score · Oct 4, 2026 – Nov 2, 2026 (UTC)
2.usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
+7,236 stars
from 65,995 · score 8.89
3.Hack-with-Github / Awesome-Hacking
A collection of various awesome lists for hackers, pentesters and security researchers
+2,920 stars
from 121,419 · score 7.98
4.jiwoochris / artex-global
Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)
+2,546 stars
from 0 · score 7.84
5.caddyserver / caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
+2,452 stars
from 76,177 · score 7.81
6.KeygraphHQ / shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
+2,429 stars
from 48,412 · score 7.80
7.mukul975 / Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
+1,790 stars
from 33,614 · score 7.49
8.mitmproxy / mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
+1,427 stars
from 45,115 · score 7.26
9.openqodex / openqodex
Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Codex, Cursor and Cline. No account or key of its own.
+1,126 stars
from 2 · score 7.03
10.ImranR98 / Obtainium
Get Android app updates straight from the source.
+1,033 stars
from 20,094 · score 6.94
11.gitleaks / gitleaks
Find secrets with Gitleaks 🔑
+978 stars
from 29,597 · score 6.89
12.Developer-Y / cs-video-courses
List of Computer Science courses with video lectures.
+951 stars
from 83,522 · score 6.86
13.swisskyrepo / PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
+946 stars
from 81,338 · score 6.85
14.ADWMC / helm-d
DeepSeek Harness 破甲一体化安全分析插件：Android · Web · Native · Protocol · Malware · AI-Security 全领域聚合（9 bundle + 1 preset）
+935 stars
from 17 · score 6.84
15.TecharoHQ / anubis
Weighs the soul of incoming HTTP requests to stop AI crawlers
+905 stars
from 22,978 · score 6.81
16.projectdiscovery / nuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
+879 stars
from 31,646 · score 6.78
17.aquasecurity / trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
+741 stars
from 38,157 · score 6.61
18.NPMscan / npmscan-action
Catch risky npm dependency changes before they merge.
+725 stars
from 3 · score 6.59
19.keepassxreboot / keepassxc
KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.
+686 stars
from 28,994 · score 6.53
20.Infisical / infisical
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
+664 stars
from 29,537 · score 6.50
21.trufflesecurity / trufflehog
Find, verify, and analyze leaked credentials
+608 stars
from 28,209 · score 6.41
22.drduh / YubiKey-Guide
Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.
+582 stars
from 12,480 · score 6.37
23.GyulyVGC / sniffnet
Comfortably monitor your network traffic 🕵️♂️
+544 stars
from 41,256 · score 6.30
24.x64dbg / x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
+513 stars
from 49,625 · score 6.24
25.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+499 stars
from 15,176 · score 6.21
26.chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
+484 stars
from 22,656 · score 6.18
27.wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
+470 stars
from 17,063 · score 6.15
28.OWASP / CheatSheetSeries
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
+448 stars
from 33,388 · score 6.11
29.zoicware / RemoveWindowsAI
Force Remove Copilot, Recall and More in Windows 11
+420 stars
from 13,135 · score 6.04
30.goauthentik / authentik
The authentication glue you need.
+409 stars
from 25,783 · score 6.02
31.crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
+384 stars
from 15,032 · score 5.95
32.lissy93 / web-check
🕵️♂️ All-in-one OSINT tool for analysing any website
+381 stars
from 34,939 · score 5.95
33.twpayne / chezmoi
Manage your dotfiles across multiple diverse machines, securely.
+360 stars
from 21,770 · score 5.89
34.authelia / authelia
The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
+350 stars
from 29,124 · score 5.86
35.radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
+346 stars
from 24,888 · score 5.85
36.juice-shop / juice-shop
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
+333 stars
from 13,993 · score 5.81
37.community-scripts / ProxmoxVE
Proxmox VE Helper-Scripts (Community Edition)
+325 stars
from 29,672 · score 5.79
38.getsops / sops
Simple and flexible tool for managing secrets
+321 stars
from 23,259 · score 5.77
39.kenryu42 / cc-safety-net
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
+319 stars
from 1,564 · score 5.77
40.Atlas-OS / Atlas
🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability.
+315 stars
from 21,673 · score 5.76
41.hwdsl2 / setup-ipsec-vpn
Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and management scripts.
+314 stars
from 28,613 · score 5.75
42.nginx / nginx
The official NGINX Open Source repository.
+303 stars
from 31,722 · score 5.72
43.imthenachoman / How-To-Secure-A-Linux-Server
An evolving how-to guide for securing a Linux server.
+293 stars
from 31,718 · score 5.68
44.rizinorg / cutter
Free and Open Source Reverse Engineering Platform powered by rizin
+286 stars
from 19,841 · score 5.66
45.jason5ng32 / MyIP
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
+281 stars
from 12,000 · score 5.64
46.winsiderss / systeminformer
A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com
+265 stars
from 16,128 · score 5.58
47.lissy93 / personal-security-checklist
🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
+251 stars
from 22,428 · score 5.53
48.fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
+246 stars
from 18,683 · score 5.51
49.zaproxy / zaproxy
The ZAP by Checkmarx Core project
+240 stars
from 15,850 · score 5.48
50.StevenBlack / hosts
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
+238 stars
from 31,123 · score 5.48
51.prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
+238 stars
from 14,912 · score 5.48
52.SigmaHQ / sigma
Main Sigma Rule Repository
+237 stars
from 11,148 · score 5.47
53.projectdiscovery / nuclei-templates
Community curated list of templates for the nuclei engine to find security vulnerabilities.
+233 stars
from 13,034 · score 5.46
54.nmap / nmap
Nmap - the Network Mapper. Github mirror of official SVN repository.
+228 stars
from 13,685 · score 5.43
55.edoardottt / awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
+223 stars
from 11,227 · score 5.41
56.cryptomator / cryptomator
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
+215 stars
from 16,198 · score 5.38
57.1N3 / Sn1per
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
+202 stars
from 11,308 · score 5.31
58.anchore / grype
A vulnerability scanner for container images and filesystems
+194 stars
from 12,961 · score 5.27
59.eosphoros-ai / DB-GPT
open-source agentic AI data assistant for the next generation of AI + Data products.
+189 stars
from 20,045 · score 5.25
60.bee-san / RustScan
🤖 The Modern Port Scanner 🤖
+187 stars
from 20,465 · score 5.24
61.digininja / DVWA
Damn Vulnerable Web Application (DVWA)
+185 stars
from 13,757 · score 5.23
62.DedSecInside / TorBot
Dark Web OSINT Tool
+183 stars
from 4,975 · score 5.21
63.frappe / frappe
Low code web framework for real world applications, in Python and Javascript
+182 stars
from 10,861 · score 5.21
64.bunkerity / bunkerweb
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
+181 stars
from 11,022 · score 5.20
65.cilium / cilium
eBPF-based Networking, Security, and Observability
+178 stars
from 25,573 · score 5.19
66.bettercap / bettercap
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
+172 stars
from 20,053 · score 5.15
67.simplex-chat / simplex-chat
SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱!
+171 stars
from 19,453 · score 5.15
68.fleetdm / fleet
Open device management
+167 stars
from 6,929 · score 5.12
69.rizinorg / rizin
UNIX-like reverse engineering framework and command-line toolset.
+166 stars
from 3,923 · score 5.12
70.openfga / openfga
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
+163 stars
from 5,909 · score 5.10
71.knownsec / 404StarLink
404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目
+158 stars
from 11,307 · score 5.07
72.google / oss-fuzz
OSS-Fuzz - continuous fuzzing for open source software.
+157 stars
from 12,677 · score 5.06
73.qazbnm456 / awesome-web-security
🐶 A curated list of Web Security materials and resources.
+153 stars
from 13,830 · score 5.04
74.bytebase / bytebase
Database governance built for humans and agents — controlling changes and access across every major database.
+151 stars
from 14,515 · score 5.02
75.szTheory / exifcleaner
Cross-platform desktop GUI app to clean image metadata
+144 stars
from 2,710 · score 4.98
76.sbilly / awesome-security
A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
+143 stars
from 14,916 · score 4.97
77.telekom-security / tpotce
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
+142 stars
from 9,536 · score 4.96
78.shadow1ng / fscan
一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)
+139 stars
from 14,591 · score 4.94
79.OpenVPN / openvpn
OpenVPN is an open source VPN daemon
+134 stars
from 14,622 · score 4.91
80.lissy93 / awesome-privacy
🦄 A curated list of privacy & security-focused software and services
+134 stars
from 9,903 · score 4.91
81.maurosoria / dirsearch
Web path scanner
+133 stars
from 14,900 · score 4.90
82.evilsocket / opensnitch
OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.
+129 stars
from 14,104 · score 4.87
83.tutao / tutanota
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
+129 stars
from 7,964 · score 4.87
84.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
+119 stars
from 23,593 · score 4.79
85.hslatman / awesome-threat-intelligence
A curated list of Awesome Threat Intelligence resources
+119 stars
from 10,689 · score 4.79
86.netalertx / NetAlertX
Centralized network visibility and continuous asset discovery. Monitor devices, detect change, and stay aware across distributed networks.
+117 stars
from 7,231 · score 4.77
87.capstone-engine / capstone
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
+116 stars
from 9,044 · score 4.76
88.falcosecurity / falco
Cloud Native Runtime Security
+115 stars
from 9,429 · score 4.75
89.gravitational / teleport
The easiest, and most secure way to access and protect all of your infrastructure.
+112 stars
from 20,945 · score 4.73
90.urbanadventurer / WhatWeb
Next generation web scanner
+110 stars
from 6,865 · score 4.71
91.arkenfox / user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
+106 stars
from 12,842 · score 4.67
92.onionshare / onionshare
Securely and anonymously share files, host websites, and chat with friends using the Tor network
+105 stars
from 7,100 · score 4.66
93.OpenZeppelin / openzeppelin-contracts
OpenZeppelin Contracts is a library for secure smart contract development.
+102 stars
from 27,238 · score 4.63
94.meirwah / awesome-incident-response
A curated list of tools for incident response
+102 stars
from 9,419 · score 4.63
95.matomo-org / matomo
Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!
+98 stars
from 21,897 · score 4.60
96.gophish / gophish
Open-Source Phishing Toolkit
+98 stars
from 14,271 · score 4.60
97.go-acme / lego
Let's Encrypt/ACME client and library written in Go
+98 stars
from 9,897 · score 4.60
98.secdev / scapy
Scapy: the Python-based interactive packet manipulation program & library.
+97 stars
from 12,571 · score 4.58
99.The-Vibe-Company / quivr
An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.
+96 stars
from 39,527 · score 4.57
100.yokoffing / Betterfox
Firefox user.js for optimal privacy and security. Your favorite browser, but better.
+95 stars
from 10,867 · score 4.56