1.trimstray / the-book-of-secret-knowledge
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
+1,898 stars
from 253,221 · score 7.55
Trending repositories
Ranked by Attention Score: stars gained over the last 7 complete days
1–100 of 332 by Attention Score · Oct 27, 2026 – Nov 2, 2026 (UTC)
2.KeygraphHQ / shannon
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
+1,495 stars
from 49,346 · score 7.31
3.usestrix / strix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
+1,348 stars
from 71,883 · score 7.21
4.Hack-with-Github / Awesome-Hacking
A collection of various awesome lists for hackers, pentesters and security researchers
+711 stars
from 123,628 · score 6.57
5.Developer-Y / cs-video-courses
List of Computer Science courses with video lectures.
+704 stars
from 83,769 · score 6.56
6.mukul975 / Anthropic-Cybersecurity-Skills
817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0
+392 stars
from 35,012 · score 5.97
7.NPMscan / npmscan-action
Catch risky npm dependency changes before they merge.
+350 stars
from 170 · score 5.86
8.salemalem / npmscan-mcp-plugin
NPMscan MCP Plugin
+338 stars
from 171 · score 5.83
9.jiwoochris / artex-global
Global edition of ARTEX — an LLM multi-agent autonomous penetration-testing framework. English default, switchable to Korean/Chinese/Spanish/Japanese. For authorized, defensive and detection use only. (upstream: Autumn-27/ARTEX, AGPL-3.0)
+321 stars
from 2,163 · score 5.77
10.ADWMC / helm-d
DeepSeek Harness 破甲一体化安全分析插件：Android · Web · Native · Protocol · Malware · AI-Security 全领域聚合（9 bundle + 1 preset）
+311 stars
from 641 · score 5.74
11.openqodex / openqodex
Open source AI code review for coding agents. A separate reviewer checks every change your agent writes before you push, in Claude Code, Codex, Cursor and Cline. No account or key of its own.
+309 stars
from 784 · score 5.74
12.lordbasex / LordOS
LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.
+305 stars
from 21 · score 5.72
13.morluto / awesome-reverse-engineering
Curated reverse-engineering tools and learning resources for binaries, apps, firmware, formats, and protocols.
+268 stars
from 1,233 · score 5.59
14.opentrap / opentrap
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
+268 stars
from 504 · score 5.59
15.ImranR98 / Obtainium
Get Android app updates straight from the source.
+253 stars
from 20,874 · score 5.54
16.gitleaks / gitleaks
Find secrets with Gitleaks 🔑
+250 stars
from 30,325 · score 5.53
17.swisskyrepo / PayloadsAllTheThings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
+220 stars
from 82,064 · score 5.40
18.caddyserver / caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
+220 stars
from 78,409 · score 5.40
19.projectdiscovery / nuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
+217 stars
from 32,308 · score 5.38
20.Infisical / infisical
Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.
+212 stars
from 29,989 · score 5.36
21.mitmproxy / mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
+198 stars
from 46,344 · score 5.29
22.keepassxreboot / keepassxc
KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.
+193 stars
from 29,487 · score 5.27
23.aquasecurity / trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
+184 stars
from 38,714 · score 5.22
24.irraz / vulnerator-ai
Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.
+184 stars
from 24 · score 5.22
25.chaitin / SafeLine
SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.
+183 stars
from 22,957 · score 5.21
26.TecharoHQ / anubis
Weighs the soul of incoming HTTP requests to stop AI crawlers
+182 stars
from 23,701 · score 5.21
27.drduh / YubiKey-Guide
Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.
+181 stars
from 12,881 · score 5.20
28.imthenachoman / How-To-Secure-A-Linux-Server
An evolving how-to guide for securing a Linux server.
+170 stars
from 31,841 · score 5.14
29.mvt-project / mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
+139 stars
from 15,536 · score 4.94
30.trufflesecurity / trufflehog
Find, verify, and analyze leaked credentials
+116 stars
from 28,701 · score 4.76
31.x64dbg / x64dbg
An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
+115 stars
from 50,023 · score 4.75
32.wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
+115 stars
from 17,418 · score 4.75
33.dbx0 / executioner
The agentic pentesting environment that lives on your machine. AI agent teams, visual workflows and your own tools, 100% local.
+113 stars
from 0 · score 4.74
34.crowdsecurity / crowdsec
Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.
+107 stars
from 15,309 · score 4.68
35.GyulyVGC / sniffnet
Comfortably monitor your network traffic 🕵️♂️
+106 stars
from 41,694 · score 4.67
36.OWASP / CheatSheetSeries
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
+97 stars
from 33,739 · score 4.58
37.goauthentik / authentik
The authentication glue you need.
+95 stars
from 26,097 · score 4.56
38.kenryu42 / cc-safety-net
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, DeepSeek Harness, Devin CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code, OpenClaw, OpenCode, and Pi.
+93 stars
from 1,790 · score 4.54
39.juice-shop / juice-shop
OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
+91 stars
from 14,235 · score 4.52
40.bunkerity / bunkerweb
🛡️ Open-source and cloud-native Web Application Firewall (WAF)
+88 stars
from 11,115 · score 4.49
41.hwdsl2 / setup-ipsec-vpn
Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and management scripts.
+87 stars
from 28,840 · score 4.48
42.lissy93 / web-check
🕵️♂️ All-in-one OSINT tool for analysing any website
+86 stars
from 35,234 · score 4.47
43.twpayne / chezmoi
Manage your dotfiles across multiple diverse machines, securely.
+86 stars
from 22,044 · score 4.47
44.community-scripts / ProxmoxVE
Proxmox VE Helper-Scripts (Community Edition)
+81 stars
from 29,916 · score 4.41
45.radareorg / radare2
UNIX-like reverse engineering framework and command-line toolset
+81 stars
from 25,153 · score 4.41
46.getsops / sops
Simple and flexible tool for managing secrets
+74 stars
from 23,506 · score 4.32
47.Atlas-OS / Atlas
🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability.
+67 stars
from 21,921 · score 4.22
48.cryptomator / cryptomator
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
+66 stars
from 16,347 · score 4.20
49.authelia / authelia
The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.
+65 stars
from 29,409 · score 4.19
50.zoicware / RemoveWindowsAI
Force Remove Copilot, Recall and More in Windows 11
+64 stars
from 13,491 · score 4.17
51.jason5ng32 / MyIP
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
+63 stars
from 12,218 · score 4.16
52.winsiderss / systeminformer
A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com
+62 stars
from 16,331 · score 4.14
53.zaproxy / zaproxy
The ZAP by Checkmarx Core project
+62 stars
from 16,028 · score 4.14
54.urbanadventurer / WhatWeb
Next generation web scanner
+62 stars
from 6,913 · score 4.14
55.in-toto / witness
Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
+62 stars
from 553 · score 4.14
56.fail2ban / fail2ban
Daemon to ban hosts that cause multiple authentication errors
+57 stars
from 18,872 · score 4.06
57.prowler-cloud / prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
+57 stars
from 15,093 · score 4.06
58.lissy93 / personal-security-checklist
🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026
+56 stars
from 22,623 · score 4.04
59.nginx / nginx
The official NGINX Open Source repository.
+55 stars
from 31,970 · score 4.03
60.szTheory / exifcleaner
Cross-platform desktop GUI app to clean image metadata
+55 stars
from 2,799 · score 4.03
61.Alejandros17487 / ai-jailbreaks
AI jailbreaks: 35 paste-ready AI jailbreak prompts for 25+ frontier and open-weight models - system prompts, AGENTS.md specs, and Ollama Modelfiles. Built for AI security research and red-team testing.
+54 stars
from 483 · score 4.01
62.NyxFoundation / nyxis
A Lean backend framework whose authorization safety is formally proven. The developer writes only a Cedar schema and policies; handlers are built on Supabase Auth and PostgreSQL.
+53 stars
from 264 · score 3.99
63.fleetdm / fleet
Open device management
+52 stars
from 7,044 · score 3.97
64.projectdiscovery / nuclei-templates
Community curated list of templates for the nuclei engine to find security vulnerabilities.
+48 stars
from 13,219 · score 3.89
65.anchore / grype
A vulnerability scanner for container images and filesystems
+48 stars
from 13,107 · score 3.89
66.StevenBlack / hosts
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
+47 stars
from 31,314 · score 3.87
67.tutao / tutanota
Tuta is an email service with a strong focus on security and privacy that lets you encrypt emails, contacts and calendar entries on all your devices.
+47 stars
from 8,046 · score 3.87
68.frappe / frappe
Low code web framework for real world applications, in Python and Javascript
+46 stars
from 10,997 · score 3.85
69.rizinorg / rizin
UNIX-like reverse engineering framework and command-line toolset.
+46 stars
from 4,043 · score 3.85
70.bee-san / RustScan
🤖 The Modern Port Scanner 🤖
+45 stars
from 20,607 · score 3.83
71.knownsec / 404StarLink
404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目
+45 stars
from 11,420 · score 3.83
72.eosphoros-ai / DB-GPT
open-source agentic AI data assistant for the next generation of AI + Data products.
+43 stars
from 20,191 · score 3.78
73.DedSecInside / TorBot
Dark Web OSINT Tool
+43 stars
from 5,115 · score 3.78
74.SigmaHQ / sigma
Main Sigma Rule Repository
+42 stars
from 11,343 · score 3.76
75.cilium / cilium
eBPF-based Networking, Security, and Observability
+40 stars
from 25,711 · score 3.71
76.bettercap / bettercap
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
+38 stars
from 20,187 · score 3.66
77.digininja / DVWA
Damn Vulnerable Web Application (DVWA)
+38 stars
from 13,904 · score 3.66
78.nmap / nmap
Nmap - the Network Mapper. Github mirror of official SVN repository.
+38 stars
from 13,875 · score 3.66
79.cilium / tetragon
eBPF-based Security Observability and Runtime Enforcement
+38 stars
from 5,102 · score 3.66
80.osquery / osquery
SQL powered operating system instrumentation, monitoring, and analytics.
+37 stars
from 23,675 · score 3.64
81.google / oss-fuzz
OSS-Fuzz - continuous fuzzing for open source software.
+37 stars
from 12,797 · score 3.64
82.edoardottt / awesome-hacker-search-engines
A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and more
+37 stars
from 11,413 · score 3.64
83.OpenZeppelin / openzeppelin-contracts
OpenZeppelin Contracts is a library for secure smart contract development.
+36 stars
from 27,304 · score 3.61
84.openfga / openfga
A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.
+36 stars
from 6,036 · score 3.61
85.rizinorg / cutter
Free and Open Source Reverse Engineering Platform powered by rizin
+35 stars
from 20,092 · score 3.58
86.gravitational / teleport
The easiest, and most secure way to access and protect all of your infrastructure.
+34 stars
from 21,023 · score 3.56
87.BlueRingsLabs / no-shortcuts
Free Course : Data, Machine Learning, Deep Learning and AI Engineering, the long way round: the math, the code, the systems and the security. 173 lessons, 166 runnable labs, no shortcuts. Free under CC BY-NC 4.0.
+34 stars
from 132 · score 3.56
88.aarsaputra / php2shell
Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design
+34 stars
from 87 · score 3.56
89.telekom-security / tpotce
🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
+33 stars
from 9,645 · score 3.53
90.hslatman / awesome-threat-intelligence
A curated list of Awesome Threat Intelligence resources
+32 stars
from 10,776 · score 3.50
91.OpenVPN / openvpn
OpenVPN is an open source VPN daemon
+30 stars
from 14,726 · score 3.43
92.firezone / firezone
Blazing-fast remote access
+29 stars
from 9,126 · score 3.40
93.simplex-chat / simplex-chat
SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱!
+28 stars
from 19,596 · score 3.37
94.bytebase / bytebase
Database governance built for humans and agents — controlling changes and access across every major database.
+28 stars
from 14,638 · score 3.37
95.1N3 / Sn1per
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
+27 stars
from 11,483 · score 3.33
96.Hacker0x01 / hacker101
Source code for Hacker101.com - a free online web and mobile security class.
+26 stars
from 14,589 · score 3.30
97.qazbnm456 / awesome-web-security
🐶 A curated list of Web Security materials and resources.
+26 stars
from 13,957 · score 3.30
98.go-acme / lego
Let's Encrypt/ACME client and library written in Go
+26 stars
from 9,969 · score 3.30
99.capstone-engine / capstone
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.
+26 stars
from 9,134 · score 3.30
100.cowrie / cowrie
Cowrie SSH/Telnet Honeypot https://docs.cowrie.org/
+26 stars
from 6,626 · score 3.30