Sealbook / Open source / Security & hacking

Top open-source security & hacking on GitHub

2,493 repositories with 1,000+ stars, ranked by stars. Leading: frp, sherlock, ghidra.

	Repository	Stars	Language	License	Activity
1	fatedier/frpA fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.	★ 110k	Go	Apache-2.0	Active
2	sherlock-project/sherlockHunt down social media accounts by username across social networks	★ 94.4k	Python	MIT	Active
3	NationalSecurityAgency/ghidraGhidra is a software reverse engineering (SRE) framework	★ 90.7k	Java	Apache-2.0	Active
4	caddyserver/caddyFast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS	★ 78.1k	Go	Apache-2.0	Active
5	danielmiessler/SecListsSecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one	★ 74.2k	PHP	MIT	Active
6	2dust/v2rayNGA V2Ray client for Android, support Xray core and v2fly core	★ 64.2k	Kotlin	GPL-3.0	Active
7	rclone/rclone"rsync for cloud storage" - Google Drive, S3, Dropbox, Backblaze B2, One Drive, Swift, Hubic, Wasabi, Google Cloud Storage, Azure Blob, Azur	★ 60.4k	Go	MIT	Active
8	Raphire/Win11DebloatA simple, lightweight PowerShell script that allows you to remove pre-installed apps, disable telemetry, as well as perform various other ch	★ 59.5k	PowerShell	MIT	Active
9	bilawalsidhu/gods-eye-viewA spy satellite simulator in your browser, except the data is real. Live open source spatial intelligence on a photorealistic 3D globe.	★ 57.9k	JavaScript	Other	Active
10	chen08209/FlClashA multi-platform proxy client based on ClashMeta,simple and easy to use, open-source and ad-free.	★ 56.6k	Dart	GPL-3.0	Active
11	WerWolv/ImHex🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.	★ 55.4k	C++	GPL-2.0	Active
12	x64dbg/x64dbgAn open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.	★ 49.9k	C++	Other	Active
13	KeygraphHQ/shannonShannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploit	★ 49.1k	TypeScript	AGPL-3.0	Active
14	mitmproxy/mitmproxyAn interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.	★ 45.7k	Python	MIT	Active
15	freefq/free翻墙、免费翻墙、免费科学上网、免费节点、免费梯子、免费ss/v2ray/trojan节点、蓝灯、谷歌商店、翻墙梯子	★ 42.8k	—	—	Stale
16	XTLS/Xray-coreXray, Penetrates Everything. Also the best v2ray-core. Where the magic happens. An open platform for various uses.	★ 42.2k	Go	MPL-2.0	Active
17	GyulyVGC/sniffnetComfortably monitor your network traffic 🕵️‍♂️	★ 41.6k	Rust	Apache-2.0	Active
18	spacedriveapp/spacedriveSpacedrive is an open source cross-platform file explorer, powered by a virtual distributed filesystem written in Rust.	★ 39.2k	Rust	Apache-2.0	Active
19	soxoj/maigret🕵️‍♂️ Collect a dossier on a person by username from 6K websites	★ 39.2k	Python	MIT	Active
20	searxng/searxngSearXNG is a free internet metasearch engine which aggregates results from various search services and databases. Users are neither tracked	★ 38.5k	Python	AGPL-3.0	Active
21	aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more	★ 38.5k	Go	Apache-2.0	Active
22	tailscale/tailscaleThe easiest, most secure way to use WireGuard and 2FA.	★ 37.7k	Go	BSD-3-Clause	Active
23	AdguardTeam/AdGuardHomeNetwork-wide ads & trackers blocking DNS server	★ 37.5k	TypeScript	GPL-3.0	Active
24	hashicorp/vaultA tool for secrets management, encryption as a service, and privileged access management	★ 36.4k	Go	Other	Active
25	gchq/CyberChefThe Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis	★ 36.1k	JavaScript	Apache-2.0	Active
26	lissy93/web-check🕵️‍♂️ All-in-one OSINT tool for analysing any website	★ 35.2k	TypeScript	MIT	Active
27	v2fly/v2ray-coreA platform for building proxies to bypass network restrictions.	★ 34.7k	Go	MIT	Active
28	ehang-io/nps一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, h	★ 34.2k	Go	GPL-3.0	Stale
29	OWASP/CheatSheetSeriesThe OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.	★ 33.7k	JavaScript	CC-BY-SA-4.0	Active
30	XX-net/XX-NetA proxy tool to bypass GFW.	★ 33.5k	Python	—	Active
31	certbot/certbotCertbot is EFF's tool to obtain certs from Let's Encrypt and (optionally) auto-enable HTTPS on your server. It can also act as a client for	★ 33.3k	Python	Other	Active
32	projectdiscovery/nucleiNuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling	★ 32.1k	Go	MIT	Active
33	nginx/nginxThe official NGINX Open Source repository.	★ 31.9k	C	BSD-2-Clause	Active
34	imthenachoman/How-To-Secure-A-Linux-ServerAn evolving how-to guide for securing a Linux server.	★ 31.8k	—	CC-BY-SA-4.0	Active
35	StevenBlack/hosts🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other ca	★ 31.3k	Python	MIT	Active
36	openssl/opensslGeneral purpose TLS and crypto library	★ 31k	C	Apache-2.0	Active
37	trailofbits/algoSet up a personal VPN in the cloud	★ 30.4k	Python	AGPL-3.0	Active
38	librepods-org/librepodsAirPods liberated from Apple's ecosystem.	★ 30.4k	Kotlin	GPL-3.0	Active
39	netbirdio/netbirdNetBird securely connects people, machines and AI agents across any network with one identity-based Zero Trust platform. Powered by peer-to-	★ 30k	Go	Other	Active
40	ente/ente💚 End-to-end encrypted cloud for everything.	★ 29.4k	Dart	AGPL-3.0	Active
41	authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.	★ 29.3k	Go	Apache-2.0	Active
42	keepassxreboot/keepassxcKeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.	★ 29.3k	C++	Other	Active
43	trufflesecurity/trufflehogFind, verify, and analyze leaked credentials	★ 28.6k	Go	AGPL-3.0	Active
44	digitalocean/nginxconfig.io⚙️ NGINX config generator on steroids 💉	★ 28.3k	JavaScript	MIT	Stale
45	ungoogled-software/ungoogled-chromiumGoogle Chromium, sans integration with Google	★ 28k	Python	BSD-3-Clause	Active
46	hagezi/dns-blocklistsDNS-Blocklists: For a better internet - keep the internet clean!	★ 27.5k	Text	GPL-3.0	Active
47	OpenZeppelin/openzeppelin-contractsOpenZeppelin Contracts is a library for secure smart contract development.	★ 27.3k	Solidity	MIT	Active
48	wg-easy/wg-easyThe easiest way to run WireGuard VPN + Web-based Admin UI.	★ 27.2k	TypeScript	AGPL-3.0	Active
49	iBotPeaches/ApktoolA tool for reverse engineering Android apk files	★ 26k	Java	Apache-2.0	Active
50	goauthentik/authentikThe authentication glue you need.	★ 26k	Python	Other	Active