GitHub stars · StarDay

1Hack-with-Github / Awesome-HackingA collection of resource lists for security research and penetration testing.CC0-1.0 · Permissive124,822

2swisskyrepo / PayloadsAllTheThingsA list of useful payloads and bypass for Web Application Security and Pentest/CTFPythonMIT · Permissive82,445

3mukul975 / Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0PythonApache-2.0 · Permissive35,721

4vxcontrol / pentagiFully autonomous AI Agents system capable of performing complex penetration testing tasksGoMIT · Permissive33,537

5The-Art-of-Hacking / h4ckerThis repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.orgJupyter NotebookMIT · Permissive30,073

6vitalysim / Awesome-Hacking-ResourcesA collection of hacking / penetration testing resources to make you better!GPL-3.0 · Share derivative source17,612

7GreyDGL / PentestGPTAutomated Penetration Testing Agentic Framework Powered by Large Language ModelsPythonMIT · Permissive16,302

8Datalux / OsintgramOsintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nicknamePythonGPL-3.0 · Share derivative source15,457

9maurosoria / dirsearchWeb path scannerPythonLicense not declared15,052

10qazbnm456 / awesome-web-security🐶 A curated list of Web Security materials and resources.PythonLicense not declared14,012

11vanhauser-thc / thc-hydrahydraCAGPL-3.0 · Share derivative source12,474

12OWASP / wstgThe Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.CSSCC-BY-SA-4.0 · Share derivative source10,218

13samratashok / nishangNishang - Offensive PowerShell for red team, penetration testing and offensive security.PowerShellLicense not declaredInactive10,181

14A-poc / RedTeam-ToolsTools and Techniques for Red Team / Penetration TestingLicense not declaredInactive9,942

15We5ter / Scanners-BoxThe Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents - A matrix of all-domain open-source network security tools for geeks, enterprises, and AI agentsLicense not declared9,183

16yogeshojha / renginereNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.HTMLGPL-3.0 · Share derivative source8,922

17six2dez / reconftwAuthor description: reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilitiesShellMIT · Permissive8,338

18trickest / cveGather and update all available and newest CVEs with their PoC.HTMLMIT · Permissive8,190

19jakejarvis / awesome-shodan-queries🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻CC0-1.0 · PermissiveInactive7,838

20mandiant / commando-vmComplete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. [email protected]PowerShellApache-2.0 · PermissiveInactive7,833