All repos — GH Trending Explorer

A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.

projectdiscovery / nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

DasterProkio / awesome-ai-companion

Open-source AI companions, desktop pets, long-term memory & proactive chat. 人机恋开源项目大全。让你的家机能够脱离官端自主存在，拥有记忆和主动性。

scadastrangelove / awesome-ai-security-tools

A curated list of public-source, research, and commercial tools for AI security and AI-assisted cybersecurity — autotriage, agent security, AI/ML supply chain, pentest agents, AI SAST, LLM-driven fuzzing, threat intelligence, SOC/SIEM triage, reverse engineering, LLM red-teaming, and more.

VedAstro / VedAstro

A non-profit, open source project to make Vedic Astrology easily available to all.

zaproxy / zaproxy

The ZAP by Checkmarx Core project

m14r41 / PentestingEverything

vigolium / vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

analysis-tools-dev / dynamic-analysis

⚙️ A curated list of dynamic analysis tools and linters for all programming languages, binaries, and more.

zaproxy / zap-extensions

ZAP Add-ons

zaproxy / community-scripts

A collection of ZAP scripts and tips provided by the community - pull requests very welcome!

OWASP-Benchmark / BenchmarkJava

OWASP Benchmark is a test suite designed to verify the speed and accuracy of software vulnerability detection tools. A fully runnable web app written in Java, it supports analysis by Static (SAST), Dynamic (DAST), and Runtime (IAST) tools that support Java. The idea is that since it is fully runnable and all the vulnerabilities are actually exploitable, it’s a fair test for any kind of vulnerability detection tool. For more details on this project, please see the OWASP Benchmark Project home page.

PortSwigger / BChecks

BChecks collection for Burp Suite Professional and Burp Suite DAST

scadastrangelove / SCADAPASS

SCADA StrangeLove Default/Hardcoded Passwords List

gunerguner / AdAstra

—

rootdr-backup / Reconner

Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.

edastobriton-cyber / chameleon-shift-engine

MECCHA Chameleon 2.0: Next-Gen Adaptive Color Combat Simulator 2026

knowbe4 / frieren-dast-ai

AI-driven Dynamic Application Security Testing tool for security engineers. Combines an HTTPS MITM proxy with a multi-agent scanner and a real-time web dashboard. Route any browser or tool through the proxy — findings appear automatically.

kulchankas / paranoid

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.

xiabai2008 / ruoyi-scan

RuoYi (若依) dedicated vulnerability scanner: plugin architecture, three-state verdict, WAF bypass, exploit chains, AI POC generation, nuclei compatible. 若依专项漏洞扫描器

8eeth0ven / bfs-clicker

Playwright 自动点击 Web 控制台爬虫 + Android App 逆向与黑盒测试套件（frida + adb），用于界面遍历、页面跳转、动态 JS/接口捕获。 an auto-clicking Web console crawler (Playwright) plus an Android App reverse-engineering & DAST suite (frida + adb) for UI traversal, activity jumping, and dynamic JS/API capture.