security

A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.

A collection of various awesome lists for hackers, pentesters and security researchers

List of Computer Science courses with video lectures.

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

Comfortably monitor your network traffic 🕵️‍♂️

An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

🕵️‍♂️ All-in-one OSINT tool for analysing any website

817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platforms · 29 security domains · Apache 2.0

The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

The official NGINX Open Source repository.

An evolving how-to guide for securing a Linux server.

🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

Set up a personal VPN in the cloud

Find secrets with Gitleaks 🔑

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

Proxmox VE Helper-Scripts (Community Edition)

KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.

The Single Sign-On Multi-Factor portal for web apps. OpenID Certified™ and Post-Quantum Cryptography Ready.

Set up your own IPsec VPN server in just a few minutes, with IPsec/L2TP, Cisco IPsec and IKEv2. Supports Ubuntu, Debian, CentOS/RHEL, Alpine Linux and Raspberry Pi OS. Includes client config and management scripts.

Find, verify, and analyze leaked credentials

⚙️ NGINX config generator on steroids 💉

OpenZeppelin Contracts is a library for secure smart contract development.

The authentication glue you need.

eBPF-based Networking, Security, and Observability

UNIX-like reverse engineering framework and command-line toolset

SQL powered operating system instrumentation, monitoring, and analytics.

Weighs the soul of incoming HTTP requests to stop AI crawlers

Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)

Simple and flexible tool for managing secrets

Checklist of the most important security countermeasures when designing, testing, and releasing your API

SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.

🔒 A compiled checklist of 300+ tips for protecting digital security and privacy in 2026

Community guide to securing and improving privacy on macOS.

Manage your dotfiles across multiple diverse machines, securely.

Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!

🚀 An open and lightweight modification to Windows, designed to optimize performance, privacy and usability.

Security Guide for Developers

The easiest, and most secure way to access and protect all of your infrastructure.

Get Android app updates straight from the source.

🤖 The Modern Port Scanner 🤖

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

open-source agentic AI data assistant for the next generation of AI + Data products.

Free and Open Source Reverse Engineering Platform powered by rizin

SimpleX - the first messaging network operating without user identifiers of any kind - 100% private by design! iOS, Android and desktop apps 📱!

Daemon to ban hosts that cause multiple authentication errors

Internet-scale OpenID Certified™ OpenID Connect and OAuth2.1 provider that integrates with your user management through headless APIs. Solve OIDC/OAuth2 user cases over night. Consume as a service on Ory Network or self-host. Trusted by OpenAI and many others for scale and security. Written in Go.

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.

A powerful obfuscator for JavaScript and Node.js

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com

The ZAP by Checkmarx Core project

A collection of hacking tools, resources and references to practice ethical hacking.

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.

Web path scanner

The Rogue Access Point Framework

OpenVPN is an open source VPN daemon

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

Database governance built for humans and agents — controlling changes and access across every major database.

Source code for Hacker101.com - a free online web and mobile security class.

Open-Source Phishing Toolkit

How to improve NGINX performance, security, and other important things.

OpenSnitch is a GNU/Linux interactive application firewall inspired by Little Snitch.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

🐶 A curated list of Web Security materials and resources.

Damn Vulnerable Web Application (DVWA)

Nmap - the Network Mapper. Github mirror of official SVN repository.

Tink is a multi-language, cross-platform, open source library that provides cryptographic APIs that are secure, easy to use correctly, and hard(er) to misuse.

面向开发人员梳理的代码安全指南

Force Remove Copilot, Recall and More in Windows 11

Exploitation Framework for Embedded Devices

Community curated list of templates for the nuclei engine to find security vulnerabilities.

A vulnerability scanner for container images and filesystems

Free cross-platform password manager compatible with KeePass

Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening

OSS-Fuzz - continuous fuzzing for open source software.

Scapy: the Python-based interactive packet manipulation program & library.

Universal Radio Hacker: Investigate Wireless Protocols Like A Boss

Community guide to using YubiKey for GnuPG and SSH - protect secrets with hardware crypto.

Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices

The best IP Toolbox. Check your IP address & geolocation, test IP for WebRTC and DNS IP leaks, run an IP quality check, browser fingerprint check, website availability check, network speed test, global latency test, MTR test, Whois search, and more.

A curated list of CTF frameworks, libraries, resources and softwares

This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.

A collection of Linux Sysadmin Test Questions and Answers. Test your knowledge and skills in different fields with these Q/A.

Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

一款长亭自研的完善的安全评估工具，支持常见 web 安全问题扫描和自定义 poc | 使用之前务必先阅读文档

Command-line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages.

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.

404StarLink - 推荐优质、有意义、有趣、坚持维护的安全开源项目