Công cụ bảo mật mã nguồn mở trên GitHub — scanner, framework kiểm thử xâm nhập, quản lý secret và tiện ích gia cố, xếp theo sao và có review từ TopGit.
Awesome Hacking is a GitHub-hosted index of other security awesome-lists, maintained by Hack-with-Github: 117,538 stars, 10,586 forks, and two tables of external links split between primary awesome-list repositories and standalone reference tools. It doesn't teach anything itself - every row is a one-line pointer to someone else's list, spanning Android security to prompt injection against AI systems, released under CC0-1.0.
SecLists is a collection of security lists designed to aid penetration testers and ethical hackers. It centralizes various data types, including usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, and web shells, making it a comprehensive resource for conducting security assessments and identifying vulnerabilities. The project aims to provide immediate access to necessary lists upon setting up a new testing environment.
authentik is an open-source Identity Provider (IdP) designed for modern Single Sign-On (SSO), supporting protocols like SAML, OAuth2/OIDC, LDAP, and RADIUS. It's built for self-hosting, suitable for deployments ranging from small test environments to large production clusters. Installation options include Docker Compose, Kubernetes via Helm charts, AWS CloudFormation, and a one-click deployment through the DigitalOcean Marketplace. The project also offers an enterprise solution for organizations looking to replace commercial identity providers, with examples including Okta, Auth0, Entra ID, and Ping Identity.
CloudFoundry's UAA (User Account and Authentication) Server is a multi-tenant identity management service implemented as a Spring MVC web application in Java. Its primary role is to function as an OAuth2 provider, issuing tokens for client applications acting on behalf of users, and it also handles user authentication and single sign-on. While integral to Cloud Foundry, the UAA server can operate as a standalone OAuth2 and partial OpenID Connect server, offering standard endpoints for authorization, token issuance, token verification, and user information. It supports SCIM for user provisioning and can be run with HSQLDB, MySQL, or PostgreSQL, deployable in containers like Tomcat or directly via Gradle.
authentik is an open-source Identity Provider (IdP) designed for modern Single Sign-On (SSO), supporting protocols like SAML, OAuth2/OIDC, LDAP, and RADIUS. It's built for self-hosting, suitable for deployments ranging from small test environments to large production clusters. Installation options include Docker Compose, Kubernetes via Helm charts, AWS CloudFormation, and a one-click deployment through the DigitalOcean Marketplace. The project also offers an enterprise solution for organizations looking to replace commercial identity providers, with examples including Okta, Auth0, Entra ID, and Ping Identity.
SecLists is a collection of security lists designed to aid penetration testers and ethical hackers. It centralizes various data types, including usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, and web shells, making it a comprehensive resource for conducting security assessments and identifying vulnerabilities. The project aims to provide immediate access to necessary lists upon setting up a new testing environment.
CloudFoundry's UAA (User Account and Authentication) Server is a multi-tenant identity management service implemented as a Spring MVC web application in Java. Its primary role is to function as an OAuth2 provider, issuing tokens for client applications acting on behalf of users, and it also handles user authentication and single sign-on. While integral to Cloud Foundry, the UAA server can operate as a standalone OAuth2 and partial OpenID Connect server, offering standard endpoints for authorization, token issuance, token verification, and user information. It supports SCIM for user provisioning and can be run with HSQLDB, MySQL, or PostgreSQL, deployable in containers like Tomcat or directly via Gradle.
Awesome Hacking is a GitHub-hosted index of other security awesome-lists, maintained by Hack-with-Github: 117,538 stars, 10,586 forks, and two tables of external links split between primary awesome-list repositories and standalone reference tools. It doesn't teach anything itself - every row is a one-line pointer to someone else's list, spanning Android security to prompt injection against AI systems, released under CC0-1.0.
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.
🔥 Proxy is a high performance HTTP(S) proxies, SOCKS5 proxies,WEBSOCKET, TCP, UDP proxy server implemented by golang. Now, it supports chain-style proxies,nat forwarding in different lan,TCP/UDP port forwarding, SSH forwarding.Proxy是golang实现的高性能http,https,websocket,tcp,socks5代理服务器,支持内网穿透,链式代理,通讯加密,智能HTTP,SOCKS5代理,黑白名单,限速,限流量,限连接数,跨平台,KCP支持,认证API。
Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices
The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.
Automated penetration testing & attack surface management platform. Recon, scan, exploit, report — 600+ exploits, 90+ integrations, 10K+ detections.
Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication. 🔁 Mirror of https://codeberg.org/allauth/django-allauth/
WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected]
The Web Security Testing Guide is a comprehensive Open Source guide to testing the security of web applications and web services.
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.