- sherlock by sherlock-project, 112k stars. Finds social media accounts by username across many sites
- PayloadsAllTheThings by swisskyrepo, 83k stars. Collection of payloads and filter bypasses for web app pentests and CTFs
- hackingtool by Z4nzu, 82k stars. Menu-driven collection of penetration testing and hacking tools in one script
- strix by usestrix, 76k stars. AI agent tool that runs penetration tests to find vulnerabilities in apps
- SecLists by danielmiessler, 75k stars. Collection of wordlists for usernames, passwords, URLs and fuzzing
- shannon by KeygraphHQ, 52k stars. AI pentesting tool that analyzes source code and runs exploits against web apps
- mitmproxy by mitmproxy, 47k stars. Interactive intercepting proxy for inspecting and modifying TLS and HTTP traffic
- reverse-skill by zhaoxuya520, 45k stars. Skill pack that routes reverse engineering and pentest tasks to tools
- maigret by soxoj, 41k stars. Python OSINT tool that searches thousands of sites for a username
- metasploit-framework by rapid7, 40k stars. Penetration testing framework
- Anthropic-Cybersecurity-Skills by mukul975, 36k stars. 817 cybersecurity skills for agents, mapped to MITRE ATT&CK and NIST
- 90DaysOfCyberSecurity by farhanashrafdev, 21k stars. A 90-day study plan with daily tasks and resources for cybersecurity
- GhostTrack by HunxByts, 21k stars. OSINT tool that tries to trace a phone number or location
- GHunt by mxrch, 20k stars. Python OSINT tool that pulls Google account details from an email address
- Flipper by UberGuidoZ, 18k stars. Collection of files, dumps and tweaks for the Flipper Zero
- holehe by megadose, 16k stars. Checks which sites an email address is registered on via password reset flows
- Crucix by calesthio, 12k stars. Monitors multiple data sources and alerts on changes, for personal OSINT use
- osiris by simplifaisoul, 12k stars. Real-time OSINT dashboard that aggregates global intelligence sources
- Claude-Red by SnailSploit, 11k stars. Collection of SKILL.md files that give Claude offensive security methods
- ProxyBridge by InterceptSuite, 7.1k stars. Routes TCP and UDP traffic from any desktop app through a proxy
- faraday by infobyte, 6.9k stars. Vulnerability management platform with AI-assisted pentesting tools
- cupp by Mebus, 6.6k stars. Generates custom password wordlists from personal details like names and birthdays
- Decepticon by BitterSecurity, 6.6k stars. Autonomous red team agent built on LangGraph for offensive security testing
- ESP32-Bit-Pirate by geo-tp, 6.4k stars. ESP32 hardware hacking tool with a web CLI for CAN, I2C and JTAG
- gmail-account-creator by ShadowHackrs, 5.9k stars. Bulk Gmail account creator with anti-detection and phone verification handling
- commix by commixproject, 5.9k stars. Automated tool for detecting and exploiting OS command injection flaws
- Claude-BugHunter by elementalsouls, 5.8k stars. Claude Code skills for bug hunting and external red-team testing
- exploitarium by bikini, 5.2k stars. Archive of public exploit proof-of-concepts and vulnerability write-ups
- wifit3 by derv82, 3.5k stars. Cross-platform wireless auditing tool that works with USB Wi-Fi adapters
- deepteam by confident-ai, 3.1k stars. Framework for red teaming LLMs and AI agents to find safety issues
- Relapse-Exploit by ntfargo, 2.7k stars. WebKit and kernel exploit chain for PS5 firmware 7.00 through 13.60
- hack-skills by yaklang, 2.7k stars. Skill pack that teaches AI agents offensive security techniques
- SearchPhone by HackUnderway, 2.2k stars. Phone number OSINT toolkit with multiple search APIs and report output
- linux-basics-for-hackers-notes by ahegazy0, 1.9k stars. Course notes from the Linux Basics for Hackers book, organized as lessons
- domain-digger by wotschofsky, 1.6k stars. Toolkit for analyzing DNS records and domain details
- pentest-agents by H-mmer, 1.1k stars. Bug bounty framework of agents, commands, and MCP servers for coding assistants
- airecon by pikpikcu, 1.1k stars. Autonomous pentest agent running on a local Ollama model in Kali Docker
- clearwing by Lazarus-AI, 1.1k stars.
- voidaccess by KatrielMoses, 1.1k stars. Self-hosted dark web OSINT platform that builds threat intel graphs from queries
- StealMyBitcoin-PoC by KillaBoi, 1.1k stars. Source for a bitcoin-themed security challenge, released for study
New repos every two days, stars refreshed daily. Visits are counted without cookies, and the numbers are public. How it works Data RSS Newsletter