All repos — GH Trending Explorer

This repository is maintained by Omar Santos (@santosomar) and includes thousands of resources related to ethical hacking, bug bounties, digital forensics and incident response (DFIR), AI security, vulnerability research, exploit development, reverse engineering, and more. 🔥 Also check: https://hackertraining.org

MobSF / Mobile-Security-Framework-MobSF

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

mobile-dev-inc / Maestro

Painless E2E Automation for Mobile and Web

pytest-dev / pytest

The pytest framework makes it easy to write small tests, yet scales to support complex functional testing

juice-shop / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

callstack / agent-device

Mobile app automation and verification for AI coding agents. CLI, MCP server, and typed Node.js API for iOS, Android, HarmonyOS, TV, web, macOS, and Linux.

jwuthri-cloud / Tracely-ai

Trace-native CI/CD for AI agents: grade production traces, cluster failures, freeze them into replayable regression tests, and block PRs that regress. Self-hostable.

ludovic111 / horizon

Minecraft: Java Edition 26.3 rewritten from scratch in Rust, checked against vanilla with 281 differential harnesses. Get it with the Horizon launcher.

ZeroDayEvil / CVE-2026-54121-Certighost

🛡 Official AI Security Tool module for CVE-2026-54121 (Certighost): AD CS certificate abuse deep-dive, defensive audit workflows, and safe in-app console execution for authorized Active Directory security testing.

irraz / vulnerator-ai

Autonomous OODA-loop pentesting agent. Hermes brain, Kali + Playwright tools over MCP, ATT&CK as the Orient language.

kamalx06 / TornadoC2

Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain, and a Qt/CLI console. Linux + Windows, amd64 + arm64.

puppeteer / puppeteer

JavaScript API for Chrome and Firefox

storybookjs / storybook

Storybook is the industry standard workshop for building, documenting, and testing UI components in isolation

Datalux / Osintgram

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

seleniumbase / SeleniumBase

📊 Python APIs for Web Automation, E2E Testing, and Data Scraping. CDP Mode bypasses bot-detection and handles CAPTCHAs. Includes a Stealth mode for Playwright.

google / oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.

HackTricks-wiki / hacktricks

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

apache / jmeter

Apache JMeter open-source load testing tool for analyzing and measuring the performance of a variety of services

nicocha30 / ligolo-ng

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

Kaliiiiiiiiii-Vinyzu / patchright

Undetected version of the Playwright testing and automation library.

Netw0rkNoob / VulnClaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排，配合大语言模型，自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

quantskills / quantskills

QuantSkills组织的全景导航：面向 AI Agent 的开源量化 Skill & Agent 生态，从数据、因子研究、回测验证到风险监控与交易自动化。｜Open-source Quant Skills & Agents for AI-driven research, backtesting, risk and trading automation.——Panoramic navigator for the QuantSkills organization

KatrielMoses / MailAccess

Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess

JoasASantos / NeuroSploit

NeuroSploit is an advanced, AI-powered penetration testing framework designed to automate and augment various aspects of offensive security operations.

KnifeLemon / Droidline

Android automation from code. Test your apps on real phones, script the tasks you repeat, run a shelf of phones, or let an AI agent use one, from Python, Node.js, the CLI, HTTP or Appium clients. No ADB, no USB cable, no root.

open-wxa / wxa-runner

在浏览器中用微信官方基础库运行小程序，支持 Chrome DevTools 调试与 Playwright E2E 测试

gitemre / device-hub-pro

Android and iOS devices, side by side on your Mac. Mirror, control, change settings and capture — free and open source.

google / googletest

GoogleTest - Google Testing and Mocking Framework

stefan-jansen / machine-learning-for-trading

Code for Machine Learning for Trading, 3rd edition — from data sourcing to live execution.

hummingbot / hummingbot

Open source software that helps you create and deploy high-frequency crypto trading bots

keploy / keploy

Open-source platform for creating safe, isolated production sandboxes for API, integration, and E2E testing.

vitest-dev / vitest

Next generation testing framework powered by Vite.

web-infra-dev / midscene

See interfaces like a human. E2E testing in natural language.

microsoft / playwright-python

Python version of the Playwright testing and automation library.

polakowo / vectorbt

The research engine that gives you an unfair advantage. Run thousands of trading ideas before others finish one.

alipay / SoloPi

SoloPi 自动化测试工具

Mathieu2301 / TradingView-API

📈 Get real-time stocks from TradingView

kaifcodec / user-scanner

🕵️‍♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.

capricorn86 / happy-dom

A JavaScript implementation of a web browser without its graphical user interface

CyberStrikeus / CyberStrike

Open-source AI-powered offensive security harness for automated penetration testing.

hello245m / free-stockdb

面向 A 股日K、分钟K与ETF分钟数据的本地量化引擎，集成增量同步、本地缓存、复权、批量查询、回测与指标计算。

Lumiwealth / lumibot

AI agents that actually place the trade. 12 brokers, real backtests, stocks options futures forex crypto and prediction markets.

0xMarcio / pocindex

Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.

itsreyi / BlockSuite

Minecraft server security assessment toolkit. Intercept, analyze, and test from a single desktop app.

ASCIT31 / Dark-Moon

Open-source autonomous AI penetration testing. 50 specialist agents across web, API, cloud, Active Directory, Kubernetes, CI/CD and AI/LLM (OWASP LLM Top 10). Runs on a local LLM behind a Privacy Gateway. Integrates with GitHub, GitLab, Jenkins, VS Code, JetBrains, n8n, Grafana & Splunk.

h5i-dev / h5i

An Axum-based Rust web framework for building and verifying web apps with Lean 4, featuring optional GPU acceleration and integrated development infrastructure for red-teaming and CI/CD.

faiscadev / fakecloud

Free, open-source AWS emulator. LocalStack alternative: 107 services, 7,657 operations, true 100% Smithy conformance (258,545/258,545 variants pass). No account, no auth token, no paid tier.

opencoredev / social-sdk

Typed TypeScript SDK for direct and managed social platform integrations, with capability checks, explicit outcomes, and deterministic testing.

kutukam / autonomous-pentest-agent

Autonomous Pentest Agent — LLM multi-agent autonomous penetration testing system (Go backend + Next.js UI). AGPL-3.0.

BaaRai / ARTEX

ARTEX - AI autonomous penetration testing system (English translation)

cypress-io / cypress

Fast, easy and reliable testing for anything that runs in a browser.

grafana / k6

A modern load testing tool, using Go and JavaScript

catchorg / Catch2

A modern, C++-native, test framework for unit-tests, TDD and BDD - using C++14, C++17 and later (C++11 support is in v2.x branch, and C++03 on the Catch1.x branch)