Open-source security tools on GitHub — scanners, pentest frameworks, secrets management and hardening utilities, ranked by stars and reviewed by TopGit.
Awesome Hacking is a GitHub-hosted index of other security awesome-lists, maintained by Hack-with-Github, with two tables of external links split between primary awesome-list repositories and standalone reference tools. It doesn't teach anything itself - every row is a one-line pointer to someone else's list, spanning Android security to prompt injection against AI systems, released under CC0-1.0.
Payloads All The Things is an open-source GitHub repository maintained by swisskyrepo that collects payloads and bypass techniques for web application security testing. The README describes it as organized by vulnerability class, with each section containing a README.md write-up, example payloads, and often files for Burp Intruder.
hackingtool is a Python console maintained at Z4nzu/hackingtool that bundles 215 security tools across 21 categories (recon, OSINT, web and wireless attacks, forensics, post-exploitation, and more) behind one menu-driven launcher. An opt-in AI layer maps plain-English goals to the right tool and command. The README frames the project as built for authorized work: bug-bounty hunters, CTF players, OSINT researchers, security researchers or students, penetration testers, red teamers, and blue-team, SOC, or DFIR analysts.
SecLists is a large collection of security wordlists curated for penetration testers and ethical hackers. It bundles usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, and web shells into one repository, organized by type. The goal is to let a security tester pull the repo onto a new box and immediately have access to every list category needed for an assessment. It's maintained by Daniel Miessler and a small team of recognized security professionals.
mkcert generates trusted localhost certificates by creating a local CA and installing it in the system trust store—no manual configuration required. It supports wildcards, IP addresses, and S/MIME, and works on macOS, Linux, Windows, Firefox, Chrome, and Java. Mobile devices and Node.js need extra steps: manually install the CA on iOS/Android, and set NODE_EXTRA_CA_CERTS for Node. Guard the rootCA-key.pem—anyone with it can intercept your traffic.
x64dbg is an open-source debugger for Windows built to inspect executables you don't have source code for, aimed squarely at reverse engineering and malware analysis. It ships as separate 32-bit and 64-bit builds, bundles disassembly, assembly patching, and import reconstruction into one download, and can be extended through a documented plugin system.
Tailscale's tailscale/tailscale repository holds the open-source client for its WireGuard-based private networking service: the tailscaled daemon and the tailscale CLI. It runs on Linux, Windows, and macOS, with partial support on FreeBSD and OpenBSD, and the same codebase underlies the iOS and Android apps, though their GUI layers live in separate repositories. Licensed BSD-3-Clause, with 35,088 GitHub stars at the time of the facts behind this review.
OWASP Cheat Sheet Series is a GitHub repository of markdown security cheat sheets, one file per application-security topic, maintained by the OWASP Foundation. The official reading surface is cheatsheetseries.owasp.org; the repo itself is the source and the place contributions land as pull requests.
How To Secure A Linux Server is a free, GitHub-hosted guide that walks home-server owners through hardening steps in a specific order - SSH keys and root login first, then automatic updates, GRUB, and a firewall - using copy-paste apt commands and pointing to the CIS Benchmarks for anything more advanced.
Consul attacks the problem of keeping services aware of each other in an infrastructure where nodes appear and disappear constantly — it handles discovery (via DNS or HTTP), health checks to stop routing traffic to failing instances, and a full service mesh layer with automatic TLS between services. The datacenter-awareness is built in rather than bolted on, meaning multi-region setups work without custom scripting. The catch is operational complexity: you need to run Consul agents on every node and the Enterprise tier adds things many production deployments need (like namespace isolation and redundancy checks). If you're already running Vault or Nomad, Consul fits naturally into that stack; if you're starting fresh on service discovery alone, the footprint may be heavier than what simpler tools offer.
KeePassXC is a free, open-source, cross-platform password manager that stores credentials in a local encrypted KDBX file, with built-in TOTP codes, YubiKey authentication, and browser integration for autofill.
authentik is a self-hostable, open-source Identity Provider that handles modern Single Sign-On across various protocols like SAML, OAuth2/OIDC, LDAP, and RADIUS. It's built to scale from small dev labs to significant production clusters, offering flexible deployment via Docker Compose, Kubernetes Helm charts, AWS CloudFormation, or a DigitalOcean one-click install. This makes it a viable option if you're aiming to manage identity and access for your applications without relying on a third-party service like Okta or Auth0.
Nginx Ultimate Bad Bot Blocker is an open-source Nginx add-on maintained by Mitchell Krog at mitchellkrogza/nginx-ultimate-bad-bot-blocker. It ships config files and shell scripts that block bad user-agents, spam referrers, and vulnerability scanners, with the README reporting 7115 bad referrers, 699 bad user-agents, and 218 fake Googlebot signatures blocked at version V4.2026.08.6097, refreshed through a daily cron-driven update script.
nDPI is ntop's open-source C library for deep packet inspection at github.com/ntop/nDPI, licensed under LGPL-3.0. It identifies application protocols inside network traffic and documents a repeatable process for adding detection for protocols it doesn't yet cover. Related ntop tools like ntopng and nProbe cento embed it to act on that classification.
Step CLI is Smallstep's open-source command-line tool for X.509 and SSH public key infrastructure, distributed as a single Go binary under the Apache-2.0 license. It groups its commands by domain — certificate, ca, crypto, oauth, and ssh — and can run standalone for local crypto operations or pair with the step-ca certificate authority server for issuing and renewing certificates.
SSRFmap is a Python exploitation framework hosted at swisskyrepo/SSRFmap, built to automate turning a confirmed Server-Side Request Forgery into concrete impact. Given a captured HTTP request and the name of the parameter to fuzz, it runs that parameter through more than 20 modules aimed at specific backend services, from Redis and MySQL to AWS and GCP metadata endpoints, and can open reverse shells or read arbitrary files depending on the module used.
ScubaGear is CISA's open-source PowerShell module for checking a Microsoft 365 tenant against the SCuBA Secure Configuration Baseline documents, spanning Entra ID, Exchange Online, SharePoint, Teams, Power BI, Power Platform, and the Security Suite. It queries live tenant settings, grades them with Open Policy Agent against Rego rules, and reports HTML, JSON, and CSV output, with a YAML config file required for CISA BOD 25-01 submissions.
CloudFoundry User Account and Authentication (UAA) Server is a multi-tenant identity management service, initially developed for Cloud Foundry but also available as a standalone OAuth2 server. Its main function involves acting as an OAuth2 provider, generating tokens that client applications can then utilize on behalf of users. UAA can also authenticate users with their credentials and serve as an SSO service. It provides endpoints for managing user accounts, registering OAuth2 clients, SCIM user provisioning, and offers partial OpenID Connect support, all implemented as a Spring MVC webapp.
ScubaGear is CISA's open-source PowerShell module for checking a Microsoft 365 tenant against the SCuBA Secure Configuration Baseline documents, spanning Entra ID, Exchange Online, SharePoint, Teams, Power BI, Power Platform, and the Security Suite. It queries live tenant settings, grades them with Open Policy Agent against Rego rules, and reports HTML, JSON, and CSV output, with a YAML config file required for CISA BOD 25-01 submissions.
Tailscale's tailscale/tailscale repository holds the open-source client for its WireGuard-based private networking service: the tailscaled daemon and the tailscale CLI. It runs on Linux, Windows, and macOS, with partial support on FreeBSD and OpenBSD, and the same codebase underlies the iOS and Android apps, though their GUI layers live in separate repositories. Licensed BSD-3-Clause, with 35,088 GitHub stars at the time of the facts behind this review.
Nginx Ultimate Bad Bot Blocker is an open-source Nginx add-on maintained by Mitchell Krog at mitchellkrogza/nginx-ultimate-bad-bot-blocker. It ships config files and shell scripts that block bad user-agents, spam referrers, and vulnerability scanners, with the README reporting 7115 bad referrers, 699 bad user-agents, and 218 fake Googlebot signatures blocked at version V4.2026.08.6097, refreshed through a daily cron-driven update script.
Step CLI is Smallstep's open-source command-line tool for X.509 and SSH public key infrastructure, distributed as a single Go binary under the Apache-2.0 license. It groups its commands by domain — certificate, ca, crypto, oauth, and ssh — and can run standalone for local crypto operations or pair with the step-ca certificate authority server for issuing and renewing certificates.
CloudFoundry User Account and Authentication (UAA) Server is a multi-tenant identity management service, initially developed for Cloud Foundry but also available as a standalone OAuth2 server. Its main function involves acting as an OAuth2 provider, generating tokens that client applications can then utilize on behalf of users. UAA can also authenticate users with their credentials and serve as an SSO service. It provides endpoints for managing user accounts, registering OAuth2 clients, SCIM user provisioning, and offers partial OpenID Connect support, all implemented as a Spring MVC webapp.
nDPI is ntop's open-source C library for deep packet inspection at github.com/ntop/nDPI, licensed under LGPL-3.0. It identifies application protocols inside network traffic and documents a repeatable process for adding detection for protocols it doesn't yet cover. Related ntop tools like ntopng and nProbe cento embed it to act on that classification.
SSRFmap is a Python exploitation framework hosted at swisskyrepo/SSRFmap, built to automate turning a confirmed Server-Side Request Forgery into concrete impact. Given a captured HTTP request and the name of the parameter to fuzz, it runs that parameter through more than 20 modules aimed at specific backend services, from Redis and MySQL to AWS and GCP metadata endpoints, and can open reverse shells or read arbitrary files depending on the module used.
authentik is a self-hostable, open-source Identity Provider that handles modern Single Sign-On across various protocols like SAML, OAuth2/OIDC, LDAP, and RADIUS. It's built to scale from small dev labs to significant production clusters, offering flexible deployment via Docker Compose, Kubernetes Helm charts, AWS CloudFormation, or a DigitalOcean one-click install. This makes it a viable option if you're aiming to manage identity and access for your applications without relying on a third-party service like Okta or Auth0.
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
Algorithms and Data Structures implemented in JavaScript for beginners, following best practices.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
OpenZeppelin Contracts is a library for secure smart contract development.
Apache Casbin: an authorization library that supports access control models like ACL, RBAC, ABAC.
SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.
The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
🔥 Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, it supports chain-style proxies,nat forwarding in different lan,TCP/UDP port forwarding, SSH forwarding.Proxy是golang实现的高性能http,https,websocket,tcp,socks5代理服务器,支持内网穿透,链式代理,通讯加密,智能HTTP,SOCKS5代理,黑白名单,限速,限流量,限连接数,跨平台,KCP支持,认证API。
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
