Trending repositories

1.NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework

• software-analysis
• disassembler
• reverse-engineering

2.usestrix / strix

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

• agents
• artificial-intelligence
• cybersecurity
• penetration-testing
• ai-penetration-testing
• ai-pentesting
• +14 more

3.vxcontrol / pentagi

Fully autonomous AI Agents system capable of performing complex penetration testing tasks

• ai-agents
• ai-security-tool
• autonomous-agents
• golang
• graphql
• multi-agent-system
• +12 more

4.koala73 / worldmonitor

Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface

• ai
• dashboard
• geopolitics
• monitoring
• news
• osint
• +6 more

5.NVIDIA / SkillSpector

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

• agent-security
• agent-skills
• agentic-ai
• ai-security
• claude-code
• mcp
• +5 more

6.sherlock-project / sherlock

Hunt down social media accounts by username across social networks

• osint
• reconnaissance
• linux
• cli
• sherlock
• python3
• +10 more

7.HunxByts / GhostTrack

Useful tool to track location or mobile number

• fyp
• hacking
• hacking-tool
• indonesia
• information
• information-gathering
• +13 more

8.dani-garcia / vaultwarden

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

• vaultwarden
• bitwarden
• rust
• docker
• rocket
• bitwarden-rs

9.KeygraphHQ / shannon

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

• penetration-testing
• pentesting
• security-audit
• security-automation
• security-tools
• ai-penetration-testing
• +14 more

10.smicallef / spiderfoot

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

• footprinting
• osint
• threatintel
• python
• infosec
• intelligence-gathering
• +13 more

11.pranshuparmar / witr

Why is this running? Trace any process, port, container, or file back to what started it - CLI + TUI.

• cli
• devops
• freebsd
• golang
• linux
• macos
• +14 more

12.soxoj / maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

• osint
• social-network
• identification
• socmint
• sherlock
• investigation
• +14 more

13.megadose / holehe

holehe allows you to check if the mail is used on different sites like twitter, instagram and will retrieve information on sites with the forgotten password function.

• information-gathering
• osint
• osint-tools
• open-source-intelligence
• python
• email
• +9 more

14.goauthentik / authentik

The authentication glue you need.

• saml
• saml-idp
• saml-sp
• oauth2
• oauth2-server
• oauth2-client
• +11 more

15.Z4nzu / hackingtool

ALL IN ONE Hacking Tool For Hackers

• allinonehackingtool
• web-attack
• password-attack
• hacking
• wireless-attack
• besthackingtool
• +7 more

16.hagezi / dns-blocklists

DNS-Blocklists: For a better internet - keep the internet clean!

• dns
• ads
• blacklist
• blocklist
• coins
• domains
• +14 more

17.promptfoo / promptfoo

Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.

• llm
• prompt-engineering
• prompts
• llmops
• prompt-testing
• testing
• +12 more

18.mvt-project / mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

• forensics
• mobile
• security
• android
• ios
• forensics-tools

19.0x4m4 / hexstrike-ai

HexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly bridge LLMs with real-world offensive security capabilities.

• 0x4m4
• ai
• ai-agents
• ai-cybersecurity
• ai-hacking
• ai-penetration-testing
• +14 more

20.projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

• cve-scanner
• subdomain-takeover
• nuclei-engine
• vulnerability-detection
• vulnerability-assessment
• vulnerability-scanner
• +5 more

21.gitleaks / gitleaks

Find secrets with Gitleaks 🔑

• security
• security-tools
• git
• golang
• go
• secret
• +14 more

22.danielmiessler / SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

23.iBotPeaches / Apktool

A tool for reverse engineering Android apk files

• apktool
• apk
• android
• reverse-engineering
• arsc
• 9patch

24.skylot / jadx

Dex to Java decompiler

• android
• dex
• java
• decompiler

25.aquasecurity / trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

• security
• security-tools
• docker
• containers
• vulnerability-scanners
• vulnerability-detection
• +9 more

26.Infisical / infisical

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

• environment-variables
• secret-management
• secrets
• security
• open-source
• secret-manager
• +14 more

27.keycloak / keycloak

Open Source Identity and Access Management For Modern Applications and Services

• keycloak
• oidc
• saml

28.trufflesecurity / trufflehog

Find, verify, and analyze leaked credentials

• secret
• trufflehog
• credentials
• security
• devsecops
• dynamic-analysis
• +6 more

29.GreyDGL / PentestGPT

Automated Penetration Testing Agentic Framework Powered by Large Language Models

• penetration-testing
• python
• large-language-models
• llm

30.Datalux / Osintgram

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

• osint
• osint-python
• python3
• instagram
• instagram-api
• penetration-testing
• +7 more

31.keepassxreboot / keepassxc

KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.

• keepassxc
• keepass
• password-manager
• linux
• windows
• cross-platform
• +6 more

32.ComposioHQ / composio

Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.

• ai
• python
• agents
• aiagents
• function-calling
• developer-tools
• +11 more

33.WerWolv / ImHex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

• hex-editor
• reverse-engineering
• ips
• dear-imgui
• disassembler
• analyzer
• +14 more

34.mikeroyal / Self-Hosting-Guide

Self-Hosting Guide. Learn all about locally hosting (on premises & private web servers) and managing software applications by yourself or your organization. Including Cloud, LLMs, WireGuard, Automation, Home Assistant, and Networking.

• self-hosted
• selfhosted
• home-assistant
• wireguard
• decentralized
• self-hosting
• +14 more

35.laramies / theHarvester

E-mails, subdomains and names Harvester - OSINT

• osint
• subdomain-enumeration
• redteam
• recon
• blueteam
• discovery
• +4 more

36.pocket-id / pocket-id

The most user-friendly OpenID Connect Certified™ and OAuth 2.0 provider that lets users sign in to your applications with passkeys.

• idp
• oidc
• passkeys
• self-hosted

37.x64dbg / x64dbg

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

• debugger
• windows
• x64
• disassembler
• reverse-engineering
• security
• +14 more

38.better-auth / better-auth

The most comprehensive authentication framework

• authentication
• oauth
• oauth2
• typescript
• iam
• oidc
• +2 more

39.icsharpcode / ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

• decompiler
• decompiler-engine
• c-sharp
• dotnet
• dotnetcore
• mono
• +4 more

40.justcallmekoko / ESP32Marauder

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32

• esp32
• arduino
• firmware
• wifi
• bluetooth
• defensive
• +14 more

41.wazuh / wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

• security
• compliance
• log-analysis
• vulnerability-detection
• cybersecurity
• file-integrity-monitoring
• +14 more

42.frida / frida

Main repo for hosting release binaries

• frida
• instrumentation
• vala

43.veracrypt / VeraCrypt

Disk encryption with strong security based on TrueCrypt

• encryption
• encryption-decryption
• encryption-algorithms
• veracrypt
• idrix
• veracrypt-source

44.microg / GmsCore

Free implementation of Play Services

• java
• android
• microg
• google-cloud-messaging
• maps
• auth
• +8 more

45.FiloSottile / age

A simple, modern and secure encryption tool (and Go library) with small explicit keys, no config options, and UNIX-style composability.

• built-at-rc
• age-encryption

46.wasp-lang / open-saas

A 100% free modern JS SaaS boilerplate (React, NodeJS, Prisma). Full-featured: Auth (email, google, github, slack, MS), Email sending, Background jobs, Landing page, Payments (Stripe, Polar.sh), Shadcn UI, S3 file upload. AI-ready with tailored AGENTS.md, skills, and Claude Code plugin. One cmd deploy. Powered by Wasp full-stack framework.

• full-stack
• open-source
• saas
• nodejs
• prisma
• react
• +14 more

47.zedeus / nitterArchived

Alternative Twitter front-end

• nim
• twitter
• privacy
• self-hosted
• x

48.sundowndev / phoneinfoga

Information gathering framework for phone numbers

• information-gathering
• phone-number
• osint
• open-source-intelligence
• reconnaissance
• footprint
• +4 more

49.calesthio / Crucix

Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.

• ai
• intelligence
• osint

50.lissy93 / web-check

🕵️‍♂️ All-in-one OSINT tool for analysing any website

• osint
• privacy
• security
• security-tools
• sysadmin

51.authelia / authelia

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

• totp
• ldap
• sso-authentication
• two-factor-authentication
• docker
• kubernetes
• +14 more

52.crowdsecurity / crowdsec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

• security
• waf
• anti-bot
• blocklist
• bot-detection
• bot-protection
• +12 more

53.aklivity / zilla

🦎 A lightweight, streaming-native, multi-protocol gateway for AI, APIs, and real-time data. Route LLM requests across providers, govern MCP tools, and connect Kafka, MQTT, and HTTP through one high-performance engine with shared security and observability.

• kafka
• rest
• server-sent-events
• streaming-api
• grpc
• mqtt
• +9 more

54.WhiskeySockets / Baileys

Socket-based TS/JavaScript API for WhatsApp Web

• bun
• deno
• nodejs
• reverse-engineering
• typescript
• websockets
• +2 more

55.getsops / sops

Simple and flexible tool for managing secrets

• security
• secret-distribution
• devops
• aws
• pgp
• gcp
• +3 more

56.zitadel / zitadel

ZITADEL - Identity infrastructure, simplified for you.

• saml
• authentication
• authorization
• login
• oidc
• sso
• +11 more

57.jason5ng32 / MyIP

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

• dns
• ip
• ipinfo
• network
• webrtc
• leaks
• +14 more

58.bitwarden / server

Bitwarden infrastructure/backend (API, database, Docker, etc).

• aspnetcore
• aspnet
• sql-server
• api
• sql
• csharp
• +5 more

59.gchq / CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis

• data-analysis
• data-manipulation
• encryption
• encoding
• compression
• parsing
• +1 more

60.radareorg / radare2

UNIX-like reverse engineering framework and command-line toolset

• radare2
• c
• commandline
• reverse-engineering
• forensics
• security
• +4 more

61.qeeqbox / social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

• osint
• social-media
• analyzer
• username
• profile
• reconnaissance
• +13 more

62.hashcat / hashcat

World's fastest and most advanced password recovery utility

• hashcat
• password
• cracking
• gpgpu
• opencl
• c
• +2 more

63.sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool

• sql-injection
• detection
• exploitation
• python
• database
• pentesting
• +9 more

64.1N3 / Sn1per

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

• sn1per
• sn1per-professional
• bugbounty-platform
• attack-surface
• cybersecurity
• pentest-tool
• +13 more

65.SWE-agent / SWE-agent

SWE-agent takes a GitHub issue and tries to automatically fix it, using your LM of choice. It can also be employed for offensive cybersecurity or competitive coding challenges. [NeurIPS 2024]

• agent
• ai
• developer-tools
• llm
• agent-based-model
• lms
• +1 more

66.lissy93 / personal-security-checklist

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026

• privacy
• security
• censorship
• cybersecurity
• checklist
• awesome
• +7 more

67.juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

• owasp
• javascript
• vulnerable
• hacking
• application-security
• owasp-top-10
• +8 more

68.rizinorg / cutter

Free and Open Source Reverse Engineering Platform powered by rizin

• cutter
• gui
• reverse-engineering
• security
• debugger

69.openssl / openssl

General purpose TLS and crypto library

• cryptography
• openssl
• encryption
• tls
• ssl
• decryption

70.rapid7 / metasploit-framework

Metasploit Framework

• hacktoberfest

71.blacklanternsecurity / bbot

The recursive internet scanner for hackers. 🧡

• hacking
• neo4j
• osint
• osint-framework
• python
• subdomain-enumeration
• +14 more

72.bitwarden / clients

Bitwarden client apps (web, browser extension, desktop, and cli).

• webextension
• javascript
• bitwarden
• typescript
• safari
• chrome
• +7 more

73.cryptomator / cryptomator

Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.

• cryptomator
• java
• cloud-storage
• cryptography
• crypto
• security
• +2 more

74.fail2ban / fail2ban

Daemon to ban hosts that cause multiple authentication errors

• linux
• macos
• security
• intrusion-prevention
• fail2ban
• bsd
• +13 more

75.casdoor / casdoor

An open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD

• oidc
• sso
• oauth
• iam
• saml
• webauthn
• +14 more

76.google / osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

• scanner
• security-audit
• security-tools
• vulnerability-scanner

77.DedSecInside / TorBot

Dark Web OSINT Tool

• tor
• tor-network
• deepweb
• dark-web
• psnappz
• crawler
• +14 more

78.prowler-cloud / prowler

This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.

• security
• security-tools
• security-audit
• security-hardening
• hardening
• aws
• +14 more

79.htr-tech / zphisher

An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this toolkit !

• phishing
• phisher
• phishing-attacks
• htr-tech
• phishing-pages
• zphisher

80.MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

• static-analysis
• dynamic-analysis
• mobsf
• android-security
• mobile-security
• windows-mobile-security
• +13 more

81.acmesh-official / acme.sh

A pure Unix shell script ACME client for SSL / TLS certificate automation

• acme
• acme-protocol
• certbot
• shell
• ash
• bash
• +12 more

82.BishopFox / sliver

Adversary Emulation Framework

• security-tools
• implant
• golang
• dns-server
• http
• c2
• +9 more

83.logto-io / logto

🧑‍🚀 Authentication and authorization infrastructure for SaaS and AI apps, built on OIDC and OAuth 2.1 with multi-tenancy, SSO, and RBAC.

• authentication
• authorization
• identity
• openid-connect
• passwordless
• social-login
• +14 more

84.horsicq / Detect-It-Easy

Program for determining types of files for Windows, Linux and MacOS.

• debugger
• detect
• unpacker
• disassembler
• reverse-engineering
• elf
• +14 more

85.goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.

• cncf
• container
• registry
• helm
• cloud-native
• containers
• +6 more

86.dnSpyEx / dnSpy

Unofficial revival of the well known .NET debugger and assembly editor, dnSpy

• baml
• csharp
• debug
• debugger
• decompile
• decompiler
• +9 more

87.projectdiscovery / subfinder

Fast passive subdomain enumeration tool.

• subdomain-enumeration
• osint
• subdomains
• bugbounty
• reconnaissance
• hacking
• +1 more

88.zaproxy / zaproxy

The ZAP by Checkmarx Core project

• zap
• zap-development
• dast
• appsec
• zaproxy
• security
• +3 more

89.dstotijn / hetty

An HTTP toolkit for security research.

• mitm
• proxy
• http
• pentesting
• infosec
• bugbounty

90.projectdiscovery / nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

• nuclei-templates
• nuclei
• bugbounty
• security
• nuclei-checks
• exploits
• +4 more

91.SigmaHQ / sigma

Main Sigma Rule Repository

• security
• monitoring
• siem
• logging
• signatures
• elasticsearch
• +3 more

92.peass-ng / PEASS-ng

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

• enumeration
• linux
• unix
• bash
• shell
• script
• +13 more

93.owasp-amass / amass

In-depth attack surface mapping and asset discovery

• go
• dns
• subdomain
• enumeration
• recon
• osint
• +7 more

94.shadow1ng / fscan

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

• fscan
• scanner
• scanning
• sec
• security-tools
• security

95.FiloSottile / mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.

• https
• tls
• certificates
• local-development
• localhost
• root-ca
• +6 more

96.mxrch / GHunt

🕵️‍♂️ Offensive Google framework.

• osint
• google
• hideandsec

97.ffuf / ffuf

Fast web fuzzer written in Go

• fuzzer
• pentesting
• infosec
• web

98.CISOfy / lynis

Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

• shell
• linux
• pci-dss
• compliance
• security-audit
• security-hardening
• +14 more

99.bettercap / bettercap

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

• password-sniffer
• mitm
• rogue-ap
• wifi
• hacking
• security
• +14 more

100.MatrixTM / MHDDoS

Best DDoS Attack Script Python3, (Cyber / DDos) Attack With 60 Methods

• ddos
• ddos-attacks
• ddos-tool
• attack
• cloudflare-bypass
• layer4
• +13 more