GitHub stars · StarDay

1KeygraphHQ / shannonAn AI-assisted security tester for web applications and APIs.TypeScriptAGPL-3.0 · Share derivative source51,324

2sqlmapproject / sqlmapA tool for SQL injection detection and database security assessment.PythonLicense not declared38,869

3OWASP / CheatSheetSeriesOWASP reference collection of concise guidance on application security topics.JavaScriptCC-BY-SA-4.0 · Share derivative source33,916

4chaitin / SafeLineSafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.GoGPL-3.0 · Share derivative source23,178

5zaproxy / zaproxyThe ZAP by Checkmarx Core projectJavaApache-2.0 · Permissive16,117

6maurosoria / dirsearchWeb path scannerPythonLicense not declared15,049

7juice-shop / juice-shopOWASP Juice Shop: Probably the most modern and sophisticated insecure web applicationTypeScriptMIT · Permissive14,377

8OWASP / wstgThe Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.CSSCC-BY-SA-4.0 · Share derivative source10,212

9infoslack / awesome-web-hackingA list of web application securityMIT · Permissive7,346

10microsoft / Security-1018 Lessons, Kick-start Your Cybersecurity Learning.HTMLCC0-1.0 · Permissive7,028

11urbanadventurer / WhatWebNext generation web scannerRubyGPL-2.0 · Share derivative source6,989

12infobyte / faradayOpen-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.PythonGPL-3.0 · Share derivative source6,842

13awarexone / Agentic-Bug-HunterAI-powered bug bounty hunting toolkit that works with or without subscription.PythonMIT · Permissive5,637

14OWASP / Go-SCPGolang Secure Coding Practices guideGoCC-BY-SA-4.0 · Share derivative source5,301

15DefectDojo / django-DefectDojoOpen-Source Unified Vulnerability Management, DevSecOps & ASPMPythonBSD-3-Clause · Permissive5,193

16jassics / security-study-planComplete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...License not declared5,122

17andresriancho / w3afw3af: web application attack and audit framework, the open source web vulnerability scanner.PythonLicense not declared4,911

18projectdiscovery / interactshAn OOB interaction gathering server and client libraryGoMIT · Permissive4,618

19openziti / zitiThe parent project for OpenZiti. Here you will find the executables for a fully zero-trust, programmable network @OpenZitiGoApache-2.0 · Permissive4,473

20DependencyTrack / dependency-trackDependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.JavaApache-2.0 · Permissive4,419