GitHub stars · StarDay

1chaitin / SafeLineSafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.GoGPL-3.0 · Share derivative source23,178

2MobSF / Mobile-Security-Framework-MobSFMobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.PythonGPL-3.0 · Share derivative source22,153

3crowdsecurity / crowdsecOpen-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.GoMIT · Permissive15,483

4Hacker0x01 / hacker101Source code for Hacker101.com - a free online web and mobile security class.SCSSLicense not declared14,628

5nahamsec / Resources-for-Beginner-Bug-Bounty-HuntersA list of resources for those interested in getting started in bug bountiesLicense not declared12,320

6bunkerity / bunkerweb🛡️ Open-source and cloud-native Web Application Firewall (WAF)PythonAGPL-3.0 · Share derivative source11,229

7infoslack / awesome-web-hackingA list of web application securityMIT · Permissive7,346

8vavkamil / awesome-bugbounty-toolsA curated list of various bug bounty toolsCC0-1.0 · Permissive6,457

9elementalsouls / Claude-BugHunterA Claude Code skill bundle for bug hunting and external red-team work - 82 skills, 15 slash commands, 681 disclosed-report patterns curated across 24 core vulnerability classes, plus enterprise identity + infrastructure attack matrices.PythonMIT · Permissive5,462

10lunasec-io / lunasecLunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/TypeScriptLicense not declared1,472

11blst-security / cherrybombStop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.RustApache-2.0 · Permissive1,238

12bountyyfi / lonkeroLonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.RustLicense not declared1,099

13h5i-dev / h5iAn Axum-based Rust web framework for building and verifying web apps with Lean 4, featuring optional GPU acceleration and integrated development infrastructure for red-teaming and CI/CD.RustApache-2.0 · Permissive896

14ossamayasserr / WebAppPentestRoadmapRoadmap for Web Application Penetration Testing | FREE Resources (Not Pirated)PythonGPL-3.0 · Share derivative source461

15Ares-X / VulWikiThe Chinese vulnerability knowledge base organizes the principles and public recurrence data of Web, middleware, network equipment and system vulnerabilities, and supports retrieval by product, CVE, and fingerprint. Chinese vulnerability knowledge base.PythonLicense not declared233

16elbraino / awesome-blackhat-arsenalCurated collection of cybersecurity tools featured in Black Hat Arsenal events.PythonCC0-1.0 · Permissive208