NationalSecurityAgency / ghidra

Ghidra is an NSA-created software reverse engineering framework with disassembly, decompilation, graphing, and scripting for compiled code.

RikkaApps / Shizuku

Lets normal Android apps call privileged system APIs through a server process started with adb or root privileges.

Lakr233 / vphone-cli

Runs a virtual iPhone on an Apple Silicon Mac using Apple's Virtualization.framework, for security research and debugging.

tiann / KernelSU

A kernel-based root solution for Android devices, providing su and root access management via a kernel module and manager app.

gitleaks / gitleaks

Scans git repos, files, and stdin for hardcoded secrets such as passwords, API keys, and tokens.

getlantern / lantern

Open-source VPN app for circumventing censorship and improving privacy and speed across desktop and mobile platforms.

CarterPerez-dev / Cybersecurity-Projects

A collection of 70 cybersecurity projects with source code, certification roadmaps, and learning resources, organized from foundations to advanced.

rawfilejson / awesome-osint-arsenal

Curated list and one-command installer for 750+ open-source intelligence and security tools across 50 categories.

caddyserver / caddy

Extensible HTTP/1-2-3 web server written in Go that obtains and renews TLS certificates automatically by default.

topjohnwu / Magisk

Magisk is a open-source root solution for Android that modifies the system at boot without altering the system partition.

aquasecurity / trivy

Open-source scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM data in containers, filesystems, git repos, VM images, and Kubernetes.

YuKongA / ghostlock-app

Android app that exploits CVE-2026-43499 to gain temporary root on supported kernels and load KernelSU.

Autumn-27 / ScopeSentry

Distributed security asset discovery platform covering subdomain enumeration, port scanning, vulnerability scanning, and page monitoring.

bitwarden / server

Backend APIs, SQL Server database, and Docker deployment tooling for the Bitwarden password manager clients.

danielmiessler / SecLists

A collection of security testing wordlists covering usernames, passwords, URLs, fuzzing payloads, web shells, and sensitive data patterns.

SimoneAvogadro / android-reverse-engineering-skill

Claude Code skill that decompiles Android APK/XAPK/JAR/AAR files and extracts the HTTP APIs an app uses.

KernelSU-Next / KernelSU-Next

Kernel-based root solution for Android devices, forked from KernelSU with additional features and fixes.

openbao / openbao

Open-source, community-governed fork of HashiCorp Vault for storing, encrypting, and distributing secrets, certificates, and keys.

trufflesecurity / trufflehog

Scans repositories, filesystems, and chats for leaked credentials, then verifies whether each one is still live.

opa334 / Dopamine

A rootless, semi-untethered jailbreak for iOS 15 through 26 devices, built on the Fugu15 exploit chain.

iliyami / MacSai

Open-source macOS cleaner, optimizer, and malware scanner built with Swift 6 and SwiftUI as a free alternative to CleanMyMac.

opa334 / TrollStore

iOS app that permanently installs IPA files by exploiting a CoreTrust signature verification bug.

rapid7 / metasploit-framework

Open-source framework for developing, testing, and running exploit code against remote systems, with the msfconsole interactive interface.

microsoft / mxc

Sandboxed execution system that runs untrusted code on Windows, Linux, and macOS using OS-native sandboxes or VMs behind one policy model.

edoardottt / awesome-hacker-search-engines

A curated Markdown list of search engines for security work, covering servers, vulnerabilities, exploits, leaks, and threat intelligence.

wanghongenpin / proxypin

Cross-platform app for capturing, inspecting, and rewriting HTTP(S) traffic on Windows, macOS, Linux, Android, and iOS.

PatchMon / PatchMon

Web platform for monitoring, patching and compliance-scanning Linux server fleets via outbound-only agents.

OWASP / wstg

A community-written guide covering methods and test cases for security testing web applications and web services.

x64dbg / x64dbg

Open-source user-mode binary debugger for Windows, built for reverse engineering and malware analysis of executables without source.

openssl / openssl

General-purpose toolkit implementing TLS, DTLS, and QUIC protocols on top of a standalone cryptographic library and CLI.

cilium / cilium

eBPF-based networking, security, and observability layer for Kubernetes and other container platforms.

docker-mailserver / docker-mailserver

Containerized full-stack mail server bundling Postfix, Dovecot, Rspamd, and ClamAV for SMTP, IMAP, and POP3 with config-file-based setup.

vulhub / vulhub

Collection of ready-to-run vulnerable Docker Compose environments for security research, learning, and demonstration.

simplex-chat / simplex-chat

End-to-end encrypted messaging app and network that uses no user identifiers, with mobile, desktop and CLI clients.

digininja / DVWA

A deliberately vulnerable PHP/MariaDB web app for practicing common web security flaws across adjustable difficulty levels.

SukiSU-Ultra / SukiSU-Ultra

Kernel-based root solution for Android devices, with a Kernel Patch Module (KPM) system for loadable kernel extensions.

thewhiteh4t / seeker

Hosts a fake location-permission page that captures a smartphone's GPS coordinates and device details from a visitor who clicks through.

EchoStretch / kstuff-lite

Modified kstuff-lite PS4 kernel-exploit toolkit (1.11-opt) that optimizes UELF/KELF transitions, FPU/CR0 handling, and adds opt-in diagnostics.

OWASP / Top10

Official repository for the OWASP Top 10 document, a ranked list of the most critical web application security risks.

vxunderground / MalwareSourceCode

Archive of malware source code samples across many platforms and programming languages, organized by OS and language.

ShiftLeftSecurity / codepropertygraph

Specification and Scala tooling for the Code Property Graph, a language-agnostic representation of program code for analysis.

oauth2-proxy / oauth2-proxy

Reverse proxy that adds OAuth2 and OIDC authentication in front of web applications, supporting many identity providers.

PrivateBin / PrivateBin

A self-hostable pastebin that encrypts pastes in the browser with AES-256 so the server never sees plaintext.

Orange-Cyberdefense / GOAD

Deployable vulnerable Active Directory lab environments for practicing pentest attack techniques.

opengrep / opengrep

Open-source static analysis engine that searches code for patterns and security issues, a fork of Semgrep under LGPL 2.1.

mandiant / flare-vm

Chocolatey and Boxstarter install scripts that set up a Windows reverse engineering and malware analysis VM.

opnsense / core

GUI, API and system management backend for the OPNsense open source firewall and routing platform based on FreeBSD.

tegal1337 / CiLocks

Bash toolkit for bypassing Android lockscreens and running ADB, Metasploit payload, IP-logger and webcam-capture tasks against target devices.

urbanadventurer / WhatWeb

Command-line web scanner that fingerprints websites to identify their CMS, servers, JavaScript libraries, and other technologies.

joernio / joern

Open-source platform that builds code property graphs from source, bytecode, and binaries for querying vulnerabilities with a Scala DSL.

tailscale / tailscale-android

Official open source Android client for Tailscale, a WireGuard-based private mesh VPN network.

Mbed-TLS / mbedtls

A C library implementing X.509 certificate handling and the TLS and DTLS protocols, with a small footprint for embedded systems.

OpenZeppelin / openzeppelin-contracts

Reusable, community-audited Solidity smart contract library with ERC20/ERC721 implementations and role-based access control.

hak5 / usbrubberducky-payloads

Community payload library of DuckyScript keystroke-injection scripts for the Hak5 USB Rubber Ducky.

linuxserver / docker-swag

Docker image bundling Nginx reverse proxy, PHP support, Certbot for Let's Encrypt/ZeroSSL certificates, and fail2ban.

lowRISC / opentitan

Open source silicon root of trust hardware, software, and tooling in a single monorepo, developed by lowRISC and partners.

ValdikSS / GoodbyeDPI

Windows utility that bypasses ISP Deep Packet Inspection blocking of websites by manipulating outgoing HTTP and TLS traffic.

pglombardo / PasswordPusher

Web app for sharing passwords, text, files, and URLs via links that expire after a set number of views or time.

SkipToTheEndpoint / OpenIntuneBaseline

Community-maintained set of Microsoft Intune configuration baselines for Windows devices, built from CIS, NCSC, ACSC and Microsoft guidance.

opnsense / plugins

Collection of optional add-on plugins for the OPNsense firewall distribution, installable from the firmware GUI.