GitHub stars · StarDay

1projectdiscovery / nucleiA template-based scanner for application and infrastructure vulnerabilities.GoMIT · Permissive32,642

2NVIDIA / SkillSpectorSecurity scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.PythonApache-2.0 · Permissive24,688

3CISOfy / lynisLynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.ShellGPL-3.0 · Share derivative source16,647

4zaproxy / zaproxyThe ZAP by Checkmarx Core projectJavaApache-2.0 · Permissive16,123

5future-architect / vulsAgent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devicesGoGPL-3.0 · Share derivative source12,330

6wpscanteam / wpscanWPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected]RubyLicense not declared9,840

7PyCQA / banditBandit is a tool designed to find common security issues in Python code.PythonApache-2.0 · Permissive8,374

8jakejarvis / awesome-shodan-queries🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻CC0-1.0 · Permissive7,838

9lintsinghua / DeepAuditDeepAudit: Everyone has an AI hacker team that makes vulnerability mining within reach. One-click deployment and operation by Xiaobai, autonomous collaborative audit + automated sandbox PoC verification. Supports Ollama private deployment and generates reports with one click. Support transfer station. Make security no longer expensive and audit no longer complex.PythonAGPL-3.0 · Share derivative source7,279

10GhostTroops / scan4allOfficial repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...GoBSD-3-Clause · Permissive6,193

11k8gege / LadonLadon large-scale intranet penetration scanner, PowerShell, Cobalt Strike plug-in, memory loading, fileless scanning. It includes port scanning, service identification, network asset detection, password auditing, high-risk vulnerability detection, vulnerability exploitation, password reading and one-click GetShell. It supports batch A/B/C and cross-network segment scanning, and supports URL, host, domain name list scanning, etc. Network asset detection 32 protocols (ICMP\NBT\DNS\MAC\SMB\WMI\SSH\HTTP\HTTPS\Exchange\mssql\FTP\RDP) or methods to quickly obtain target network surviving host IP, computer name, workgroup, shared resources, network card address, operating system version, website, subdomain name, middleware, open services, routers, switches, databases, printers, etc., a large number of high-risk vulnerability detection modules MS17010, Zimbra, ExchangeC#MIT · Permissive5,342

12microsoft / ApplicationInspectorA source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.C#MIT · Permissive4,402

13evyatarmeged / RaccoonA high performance offensive security tool for reconnaissance and vulnerability scanningPythonMIT · Permissive4,070

14scipag / vulscanAdvanced vulnerability scanning with Nmap NSELuaLicense not declared3,794

15webhintio / hint💡 A hinting engine for the webTypeScriptApache-2.0 · Permissive3,702

16Bearer / bearerCode security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.GoLicense not declared2,785

17CERT-Polska / ArtemisA modular vulnerability scanner with automatic report generation capabilities.PythonBSD-3-Clause · Permissive1,259

18olacabs / jackhammerJackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.JavaLicense not declared738

190xsauby / yasuoA ruby script that scans for vulnerable & exploitable 3rd-party web applications on a networkRubyGPL-3.0 · Share derivative source572

20insidersec / insiderStatic Application Security Testing (SAST) engine focused on covering the OWASP Top 10, to make source code analysis to find vulnerabilities right in the source code, focused on a agile and easy to implement software inside your DevOps pipeline. Support the following technologies: Java (Maven and Android), Kotlin (Android), Swift (iOS), .NET Full Framework, C#, and Javascript (Node.js).GoMIT · Permissive554