GitHub stars · StarDay

1swisskyrepo / PayloadsAllTheThingsA list of useful payloads and bypass for Web Application Security and Pentest/CTFPythonMIT · Permissive82,432

2maurosoria / dirsearchWeb path scannerPythonLicense not declared15,052

3projectdiscovery / subfinderFast passive subdomain enumeration tool.GoMIT · Permissive14,736

4projectdiscovery / nuclei-templatesCommunity curated list of templates for the nuclei engine to find security vulnerabilities.JavaScriptMIT · Permissive13,295

5dstotijn / hettyAn HTTP toolkit for security research.GoMIT · Permissive12,534

6nahamsec / Resources-for-Beginner-Bug-Bounty-HuntersA list of resources for those interested in getting started in bug bountiesLicense not declared12,323

7edoardottt / awesome-hacker-search-enginesA curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red/Blue Team operations, Bug Bounty and moreShellMIT · Permissive11,477

8blacklanternsecurity / bbotThe recursive internet scanner for hackers. 🧡PythonAGPL-3.0 · Share derivative source10,999

9projectdiscovery / httpxhttpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.GoMIT · Permissive10,591

10OWASP / wstgThe Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.CSSCC-BY-SA-4.0 · Share derivative source10,218

11shmilylty / OneForAllOneForAll is a powerful subdomain collection toolPythonGPL-3.0 · Share derivative source10,136

12yogeshojha / renginereNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.HTMLGPL-3.0 · Share derivative source8,919

13six2dez / reconftwAuthor description: reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilitiesShellMIT · Permissive8,338

14KathanP19 / HowToHuntCollection of methodology and test case for various web vulnerabilities.GPL-3.0 · Share derivative source7,379

15daffainfo / AllAboutBugBountyAll about bug bounty (bypasses, payloads, and etc)License not declared6,961

16ihebski / DefaultCreds-cheat-sheetOne place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️PythonMIT · Permissive6,820

17reddelexc / hackerone-reportsTop disclosed reports from HackerOnePythonLicense not declared6,655

18j3ssie / osmedeusA Modern Orchestration Engine for SecurityGoMIT · Permissive6,644

19EdOverflow / bugbounty-cheatsheetA list of interesting payloads, tips and tricks for bug bounty hunters.CC-BY-SA-4.0 · Share derivative source6,580

20vavkamil / awesome-bugbounty-toolsA curated list of various bug bounty toolsCC0-1.0 · Permissive6,457