GitHub stars · StarDay

1swisskyrepo / PayloadsAllTheThingsA list of useful payloads and bypass for Web Application Security and Pentest/CTFPythonMIT · Permissive82,432

2The-Art-of-Hacking / h4ckerThis repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.orgJupyter NotebookMIT · Permissive30,058

3chaitin / SafeLineSafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.GoGPL-3.0 · Share derivative source23,178

4Hacker0x01 / hacker101Source code for Hacker101.com - a free online web and mobile security class.SCSSLicense not declared14,628

5anchore / grypeA vulnerability scanner for container images and filesystemsGoApache-2.0 · Permissive13,194

6chaitin / xrayA comprehensive security assessment tool self-developed by Changting, which supports scanning of common web security issues and customized POC | Be sure to read the documentation before using itVueLicense not declared11,786

7frohoff / ysoserialA proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.JavaMIT · Permissive9,095

8trickest / cveGather and update all available and newest CVEs with their PoC.HTMLMIT · Permissive8,190

9nomi-sec / PoC-in-GitHub📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.CC0-1.0 · Permissive8,179

10Tencent / AI-Infra-GuardA full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.PythonApache-2.0 · Permissive7,406

11KathanP19 / HowToHuntCollection of methodology and test case for various web vulnerabilities.GPL-3.0 · Share derivative source7,379

12infoslack / awesome-web-hackingA list of web application securityMIT · Permissive7,346

13daffainfo / AllAboutBugBountyAll about bug bounty (bypasses, payloads, and etc)License not declared6,961

14infobyte / faradayOpen-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.PythonGPL-3.0 · Share derivative source6,842

15LandGrey / SpringBootVulExploitSpringBoot related vulnerability learning materials, collection of utilization methods and techniques, black box security assessment check listJavaLicense not declared6,143

16gommzystudio / device-activity-trackerA phone number can reveal whether a device is active, in standby or offline (and more). This PoC demonstrates how delivery receipts + RTT timing leak sensitive device-activity patterns. (WhatsApp / Signal)TypeScriptLicense not declared5,198

17greenbone / openvas-scannerThis repository contains the scanner component for Greenbone Community Edition.RustGPL-2.0 · Share derivative source4,924

18zhzyker / exphubExphub [Exploit Script Library] Including vulnerability exploitation scripts for Webloigc, Struts2, Tomcat, Nexus, Solr, Jboss, and Drupal, with the latest additions of CVE-2020-14882, CVE-2020-11444, and CVE-2020-10 204. CVE-2020-10199, CVE-2020-1938, CVE-2020-2551, CVE-2020-2555, CVE-2020-2883, CVE-2019-17558, CVE-2019-6340PythonLicense not declared4,294

19alexandreborges / malwoverviewMalwoverview is a first response tool for threat hunting across VirusTotal, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, IPInfo, Shodan, AbuseIPDB, GreyNoise, URLScan.io, Whois/RDAP, NIST, and VulnCheck. Supports LLM enrichment, IOC extraction, YARA scanning, and Android analysis.PythonGPL-3.0 · Share derivative source4,140

20theori-io / copy-fail-CVE-2026-31431Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint CodePythonLicense not declared4,082