AppSec & Supply Chain Repositories

LOLBAS

by LOLBAS-Project

Total Stargazers:8807

Total Subscribers:239

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

tsunami-security-scanner

by google

Total Stargazers:8616

Total Subscribers:303

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

bandit

by PyCQA

Total Stargazers:8259

Total Subscribers:70

Bandit is a tool designed to find common security issues in Python code.

kube-bench

by aquasecurity

Total Stargazers:8181

Total Subscribers:107

Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

kyverno

by kyverno

Total Stargazers:8138

Total Subscribers:54

Unified Policy as Code

cve

by trickest

Total Stargazers:8063

Total Subscribers:395

Gather and update all available and newest CVEs with their PoC.

PoC-in-GitHub

by nomi-sec

Total Stargazers:8062

Total Subscribers:479

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

All-Defense-Tool

by guchangan1

Total Stargazers:8008

Total Subscribers:121

本项目集成了全网优秀的攻防武器工具项目，包含自动化利用，子域名、目录扫描、端口扫描等信息收集工具，各大中间件、cms、OA漏洞利用工具，爆破工具、内网横向、免杀、社工钓鱼以及应急响应、甲方安全资料等其他安全攻防资料。

deepsec

by vercel-labs

Total Stargazers:7949

Total Subscribers:23

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents

ScoutSuite

by nccgroup

Total Stargazers:7815

Total Subscribers:135

Multi-Cloud Security Auditing Tool

cap

by tiagozip

Total Stargazers:7746

Total Subscribers:25

Free, open-source and self-hosted CAPTCHA alternative to reCAPTCHA. Privacy-first and powered by proof-of-work and instrumentation challenges.

yakit

by yaklang

Total Stargazers:7736

Total Subscribers:252

Cyber Security ALL-IN-ONE Platform

DependencyCheck

by dependency-check

Total Stargazers:7690

Total Subscribers:175

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

aircrack-ng

by aircrack-ng

Total Stargazers:7626

Total Subscribers:317

WiFi security auditing tools suite

defending-code-reference-harness

by anthropics

Total Stargazers:7433

Total Subscribers:44

Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize

Recaf

by Col-E

Total Stargazers:7383

Total Subscribers:173

The modern Java bytecode editor

deepdarkCTI

by fastfire

Total Stargazers:7272

Total Subscribers:260

Collection of Cyber Threat Intelligence sources from the deep and dark web

brakeman

by presidentbeef

Total Stargazers:7269

Total Subscribers:159

A static analysis security vulnerability scanner for Ruby on Rails applications

awesome-web-hacking

by infoslack

Total Stargazers:7266

Total Subscribers:245

A list of web application security

clamav

by Cisco-Talos

Total Stargazers:7234

Total Subscribers:141

ClamAV - Documentation is here: https://docs.clamav.net

tfsec

by aquasecurity

Total Stargazers:7036

Total Subscribers:69

Tfsec is now part of Trivy

DeepAudit

by lintsinghua

Total Stargazers:6998

Total Subscribers:68

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。国内首个开源的代码漏洞挖掘多智能体系统。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署，一键生成报告。支持中转站。让安全不再昂贵，让审计不再复杂。

DevSecOps

by sottlmarek

Total Stargazers:6876

Total Subscribers:159

Ultimate DevSecOps library

fleet

by fleetdm

Total Stargazers:6844

Total Subscribers:45

Open device management

DeFiHackLabs

by SunWeb3Sec

Total Stargazers:6785

Total Subscribers:136

Reproduce DeFi hacked incidents using Foundry.

superagent

by superagent-ai

Total Stargazers:6744

Total Subscribers:60

Superagent protects your AI applications against prompt injections, data leaks, and harmful outputs. Embed safety directly into your app and prove compliance to your customers.

faraday

by infobyte

Total Stargazers:6742

Total Subscribers:245

Open Source Vulnerability Management Platform

linux-exploit-suggester

by The-Z-Labs

Total Stargazers:6611

Total Subscribers:125

Linux privilege escalation auditing tool

wfuzz

by xmendez

Total Stargazers:6578

Total Subscribers:169

Web application fuzzer

wafw00f

by EnableSecurity

Total Stargazers:6545

Total Subscribers:133

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

hackerone-reports

by reddelexc

Total Stargazers:6539

Total Subscribers:197

Top disclosed reports from HackerOne

zizmor

by zizmorcore

Total Stargazers:6485

Total Subscribers:15

Static analysis for GitHub Actions

slither

by crytic

Total Stargazers:6361

Total Subscribers:66

Static Analyzer for Solidity and Vyper

TrickyStore

by 5ec1cff

Total Stargazers:6349

Total Subscribers:58

______________

keyhacks

by streaak

Total Stargazers:6338

Total Subscribers:112

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

syzkaller

by google

Total Stargazers:6320

Total Subscribers:179

syzkaller is an unsupervised coverage-guided kernel fuzzer

cosign

by sigstore

Total Stargazers:6296

Total Subscribers:62

Code signing and transparency for containers and binaries

adversarial-robustness-toolbox

by Trusted-AI

Total Stargazers:6222

Total Subscribers:104

Adversarial Robustness Toolbox (ART) - Python Library for Machine Learning Security - Evasion, Poisoning, Extraction, Inference - Red and Blue Teams

claude-code-security-review

by anthropics

Total Stargazers:6209

Total Subscribers:40

An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.

Top10

by OWASP

Total Stargazers:6073

Total Subscribers:302

Official OWASP Top 10 Document Repository

psalm

by vimeo

Total Stargazers:5891

Total Subscribers:54

A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications

commix

by commixproject

Total Stargazers:5840

Total Subscribers:157

Automated Αll-in-One OS command injection exploitation tool.

dependabot-core

by dependabot

Total Stargazers:5767

Total Subscribers:115

🤖 Dependabot's core logic for creating update PRs.

dangerzone

by freedomofpress

Total Stargazers:5745

Total Subscribers:49

Take potentially dangerous PDFs, office documents, or images and convert them to safe PDFs

garble

by burrowers

Total Stargazers:5687

Total Subscribers:44

Obfuscate Go builds

scorecard

by ossf

Total Stargazers:5687

Total Subscribers:71

OpenSSF Scorecard - Security health metrics for Open Source

cli

by snyk

Total Stargazers:5661

Total Subscribers:156

Snyk CLI scans and monitors your projects for security vulnerabilities.

clusterfuzz

by google

Total Stargazers:5600

Total Subscribers:114

Scalable fuzzing infrastructure.

Nettacker

by OWASP

Total Stargazers:5565

Total Subscribers:117

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

LIEF

by lief-project

Total Stargazers:5563

Total Subscribers:129

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)

disposable-email-domains

by disposable-email-domains

Total Stargazers:5489

Total Subscribers:91

a list of disposable email domains

cve-rs

by Speykious

Total Stargazers:5425

Total Subscribers:26

Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀

pacu

by RhinoSecurityLabs

Total Stargazers:5328

Total Subscribers:111

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

ThreatMapper

by deepfence

Total Stargazers:5322

Total Subscribers:57

Open Source Cloud Native Application Protection Platform (CNAPP)

js-xss

by leizongmin

Total Stargazers:5311

Total Subscribers:117

Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist

dalfox

by hahwul

Total Stargazers:5289

Total Subscribers:55

🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.

SecretScanner

by deepfence

Total Stargazers:3387

Total Subscribers:45

:unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

ort

by oss-review-toolkit

Total Stargazers:2083

Total Subscribers:36

A suite of tools to automate software compliance checks.

openscap

by OpenSCAP

Total Stargazers:1815

Total Subscribers:69

AppSec & Supply Chain

Vulnerability scanning, SAST/DAST, SCA, SBOMs and software supply-chain security.

LOLBAS

by LOLBAS-Project

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

tsunami-security-scanner

by google

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

bandit

by PyCQA

Bandit is a tool designed to find common security issues in Python code.

kube-bench

by aquasecurity

Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

kyverno

by kyverno

Unified Policy as Code

cve

by trickest

Gather and update all available and newest CVEs with their PoC.

PoC-in-GitHub

by nomi-sec

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

All-Defense-Tool

by guchangan1

deepsec

by vercel-labs

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents

ScoutSuite

by nccgroup

Multi-Cloud Security Auditing Tool

cap

by tiagozip

Free, open-source and self-hosted CAPTCHA alternative to reCAPTCHA. Privacy-first and powered by proof-of-work and instrumentation challenges.

yakit

by yaklang

Cyber Security ALL-IN-ONE Platform

DependencyCheck

by dependency-check

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

aircrack-ng

by aircrack-ng

WiFi security auditing tools suite

defending-code-reference-harness

by anthropics

Skills for threat modeling, scanning, triage, patching, plus an autonomous scanning harness you can /customize

Recaf

by Col-E

The modern Java bytecode editor

deepdarkCTI

by fastfire

Collection of Cyber Threat Intelligence sources from the deep and dark web

brakeman

by presidentbeef

A static analysis security vulnerability scanner for Ruby on Rails applications

awesome-web-hacking

by infoslack

A list of web application security

clamav

by Cisco-Talos

ClamAV - Documentation is here: https://docs.clamav.net

tfsec

by aquasecurity

Tfsec is now part of Trivy

DeepAudit

by lintsinghua

DevSecOps

by sottlmarek

Ultimate DevSecOps library

fleet

by fleetdm

Open device management

DeFiHackLabs

by SunWeb3Sec

Reproduce DeFi hacked incidents using Foundry.

superagent

by superagent-ai

Superagent protects your AI applications against prompt injections, data leaks, and harmful outputs. Embed safety directly into your app and prove compliance to your customers.

faraday

by infobyte