security.md

1. [abstract-syntax-tree](#abstract-syntax-tree)
1. [acl](#acl)
1. [active-directory](#active-directory)
1. [aead](#aead)
1. [aircrack](#aircrack)
1. [analysis](#analysis)
1. [analytics](#analytics)
1. [android](#android)
1. [angular](#angular)
1. [angularjs](#angularjs)
1. [anonymity](#anonymity)
1. [ansible](#ansible)
1. [anti-bot](#anti-bot)
1. [anti-spam](#anti-spam)
1. [api](#api)
1. [apparmor](#apparmor)
1. [application-security](#application-security)
1. [arm](#arm)
1. [arm64](#arm64)
1. [aspnet-core](#aspnet-core)
1. [assembler](#assembler)
1. [assessment](#assessment)
1. [asynchronous](#asynchronous)
1. [audit](#audit)
1. [auth](#auth)
1. [authentication](#authentication)
1. [authorization](#authorization)
1. [automation](#automation)
1. [awesome](#awesome)
1. [awesome-list](#awesome-list)
1. [aws](#aws)
1. [bash](#bash)
1. [benchmarking](#benchmarking)
1. [best-practices](#best-practices)
1. [bettercap](#bettercap)
1. [binary-analysis](#binary-analysis)
1. [blockchain](#blockchain)
1. [book](#book)
1. [bro](#bro)
1. [browser](#browser)
1. [brute-force](#brute-force)
1. [bruteforce](#bruteforce)
1. [bug-bounty](#bug-bounty)
1. [bugbounty](#bugbounty)
1. [build-tool](#build-tool)
1. [c](#c)
1. [c-plus-plus](#c-plus-plus)
1. [c-sharp](#c-sharp)
1. [cache](#cache)
1. [captcha](#captcha)
1. [cas](#cas)
1. [cctv](#cctv)
1. [cdn](#cdn)
1. [cheatsheet](#cheatsheet)
1. [checklist](#checklist)
1. [chrome](#chrome)
1. [cli](#cli)
1. [cloud](#cloud)
1. [cloud-native](#cloud-native)
1. [communication](#communication)
1. [compliance](#compliance)
1. [configuration](#configuration)
1. [container](#container)
1. [containers](#containers)
1. [cracking](#cracking)
1. [cross-site-scripting](#cross-site-scripting)
1. [crypto](#crypto)
1. [cryptography](#cryptography)
1. [csrf](#csrf)
1. [ctf](#ctf)
1. [curve25519](#curve25519)
1. [cyber-security](#cyber-security)
1. [cybersecurity](#cybersecurity)
1. [debugger](#debugger)
1. [devops](#devops)
1. [dfir](#dfir)
1. [dictionary-attack](#dictionary-attack)
1. [disassembler](#disassembler)
1. [distributed](#distributed)
1. [django](#django)
1. [dns](#dns)
1. [docker](#docker)
1. [docker-image](#docker-image)
1. [dotnet](#dotnet)
1. [dynamic-analysis](#dynamic-analysis)
1. [education](#education)
1. [elasticsearch](#elasticsearch)
1. [electron](#electron)
1. [elk](#elk)
1. [elk-stack](#elk-stack)
1. [email](#email)
1. [embedded](#embedded)
1. [emulation](#emulation)
1. [emulator](#emulator)
1. [encrypted](#encrypted)
1. [encryption](#encryption)
1. [enumeration](#enumeration)
1. [ethereum](#ethereum)
1. [exfiltration](#exfiltration)
1. [exploit](#exploit)
1. [exploitation](#exploitation)
1. [exploits](#exploits)
1. [federation](#federation)
1. [file-integrity-management](#file-integrity-management)
1. [file-sharing](#file-sharing)
1. [firefox](#firefox)
1. [firewall](#firewall)
1. [flask](#flask)
1. [forensics](#forensics)
1. [framework](#framework)
1. [fuzzer](#fuzzer)
1. [fuzzing](#fuzzing)
1. [github](#github)
1. [go](#go)
1. [golang](#golang)
1. [graylog](#graylog)
1. [guide](#guide)
1. [hack](#hack)
1. [hacking](#hacking)
1. [hacking-tool](#hacking-tool)
1. [hacking-tools](#hacking-tools)
1. [halite](#halite)
1. [hardening](#hardening)
1. [hkdf](#hkdf)
1. [hmac](#hmac)
1. [honeypot](#honeypot)
1. [html](#html)
1. [http](#http)
1. [http2](#http2)
1. [https](#https)
1. [identity](#identity)
1. [identityserver4](#identityserver4)
1. [ids](#ids)
1. [ikev2](#ikev2)
1. [incident-response](#incident-response)
1. [information-security](#information-security)
1. [infosec](#infosec)
1. [intelligence](#intelligence)
1. [intrusion-detection](#intrusion-detection)
1. [ios](#ios)
1. [iot](#iot)
1. [ips](#ips)
1. [ipsec](#ipsec)
1. [java](#java)
1. [javascript](#javascript)
1. [jwt](#jwt)
1. [jwt-authentication](#jwt-authentication)
1. [kafka](#kafka)
1. [kali-linux](#kali-linux)
1. [kernel](#kernel)
1. [keychain](#keychain)
1. [kubernetes](#kubernetes)
1. [kvm](#kvm)
1. [l2tp](#l2tp)
1. [lab](#lab)
1. [lambda](#lambda)
1. [laravel](#laravel)
1. [ldap](#ldap)
1. [letsencrypt](#letsencrypt)
1. [library](#library)
1. [libsodium](#libsodium)
1. [libsodium-php](#libsodium-php)
1. [lint](#lint)
1. [linux](#linux)
1. [list](#list)
1. [log-analysis](#log-analysis)
1. [loganalyzer](#loganalyzer)
1. [logging](#logging)
1. [login](#login)
1. [logs](#logs)
1. [lua](#lua)
1. [mac](#mac)
1. [machine-learning](#machine-learning)
1. [macos](#macos)
1. [macros](#macros)
1. [malware](#malware)
1. [malware-analysis](#malware-analysis)
1. [malware-detection](#malware-detection)
1. [man-in-the-middle](#man-in-the-middle)
1. [messenger](#messenger)
1. [microservices](#microservices)
1. [middleware](#middleware)
1. [mips](#mips)
1. [mitm](#mitm)
1. [mobile](#mobile)
1. [mobile-app](#mobile-app)
1. [mobile-security](#mobile-security)
1. [monitor](#monitor)
1. [monitoring](#monitoring)
1. [nacl](#nacl)
1. [netty](#netty)
1. [network](#network)
1. [network-analysis](#network-analysis)
1. [network-discovery](#network-discovery)
1. [network-monitoring](#network-monitoring)
1. [network-security](#network-security)
1. [network-visualization](#network-visualization)
1. [networking](#networking)
1. [nginx](#nginx)
1. [nmap](#nmap)
1. [nmap-scripts](#nmap-scripts)
1. [nodejs](#nodejs)
1. [nsm](#nsm)
1. [oauth](#oauth)
1. [oauth2](#oauth2)
1. [obfuscator](#obfuscator)
1. [oci](#oci)
1. [opencontainers](#opencontainers)
1. [openid](#openid)
1. [openid-connect](#openid-connect)
1. [openpgp](#openpgp)
1. [openssl](#openssl)
1. [osint](#osint)
1. [ossec](#ossec)
1. [osx](#osx)
1. [owasp](#owasp)
1. [packet-crafting](#packet-crafting)
1. [parser](#parser)
1. [password](#password)
1. [password-manager](#password-manager)
1. [passwords](#passwords)
1. [paste](#paste)
1. [pcap](#pcap)
1. [pci-dss](#pci-dss)
1. [penetration](#penetration)
1. [penetration-testing](#penetration-testing)
1. [pentest](#pentest)
1. [pentest-tool](#pentest-tool)
1. [pentest-tools](#pentest-tools)
1. [pentesting](#pentesting)
1. [performance](#performance)
1. [permissions](#permissions)
1. [phishing](#phishing)
1. [php](#php)
1. [php-extension](#php-extension)
1. [play-framework](#play-framework)
1. [poc](#poc)
1. [policy](#policy)
1. [policy-monitoring](#policy-monitoring)
1. [powerpc](#powerpc)
1. [powershell](#powershell)
1. [privacy](#privacy)
1. [program-analysis](#program-analysis)
1. [protection](#protection)
1. [proxy](#proxy)
1. [pyparsing](#pyparsing)
1. [python](#python)
1. [python2](#python2)
1. [python3](#python3)
1. [rails](#rails)
1. [rbac](#rbac)
1. [reconnaissance](#reconnaissance)
1. [red-team](#red-team)
1. [redis](#redis)
1. [reverse-engineering](#reverse-engineering)
1. [roles](#roles)
1. [ruby](#ruby)
1. [ruby-cli](#ruby-cli)
1. [ruby-on-rails](#ruby-on-rails)
1. [rust](#rust)
1. [saml](#saml)
1. [scan](#scan)
1. [scanner](#scanner)
1. [scanning](#scanning)
1. [scans](#scans)
1. [scapy](#scapy)
1. [seccomp](#seccomp)
1. [secure](#secure)
1. [secure-by-default](#secure-by-default)
1. [self-hosted](#self-hosted)
1. [serverless](#serverless)
1. [service-discovery](#service-discovery)
1. [siem](#siem)
1. [signature](#signature)
1. [smart-contracts](#smart-contracts)
1. [sniffing](#sniffing)
1. [software-composition-analysis](#software-composition-analysis)
1. [solidity](#solidity)
1. [sparc](#sparc)
1. [spoofing](#spoofing)
1. [spring](#spring)
1. [spring-boot](#spring-boot)
1. [sql](#sql)
1. [sql-injection](#sql-injection)
1. [ssh](#ssh)
1. [ssh-tunnel](#ssh-tunnel)
1. [ssl](#ssl)
1. [ssllabs](#ssllabs)
1. [sslstrip](#sslstrip)
1. [static-analysis](#static-analysis)
1. [static-code-analysis](#static-code-analysis)
1. [subdomain](#subdomain)
1. [swift](#swift)
1. [symfony](#symfony)
1. [taint-analysis](#taint-analysis)
1. [terraform](#terraform)
1. [testing](#testing)
1. [threat-analysis](#threat-analysis)
1. [threat-hunting](#threat-hunting)
1. [threat-sharing](#threat-sharing)
1. [threatintel](#threatintel)
1. [tls](#tls)
1. [tls13](#tls13)
1. [tor](#tor)
1. [tor-network](#tor-network)
1. [totp](#totp)
1. [touch-id](#touch-id)
1. [tox](#tox)
1. [tracking](#tracking)
1. [tunnel](#tunnel)
1. [tvos](#tvos)
1. [two-factor](#two-factor)
1. [twofactorauth](#twofactorauth)
1. [typescript](#typescript)
1. [update](#update)
1. [vba](#vba)
1. [video](#video)
1. [virtual-machine](#virtual-machine)
1. [virtualization](#virtualization)
1. [vpn](#vpn)
1. [vpn-client](#vpn-client)
1. [vpn-server](#vpn-server)
1. [vulnerabilities](#vulnerabilities)
1. [vulnerability](#vulnerability)
1. [vulnerability-assessment](#vulnerability-assessment)
1. [vulnerability-databases](#vulnerability-databases)
1. [vulnerability-detection](#vulnerability-detection)
1. [vulnerability-management](#vulnerability-management)
1. [vulnerability-scanners](#vulnerability-scanners)
1. [vulnerability-scanning](#vulnerability-scanning)
1. [watchos](#watchos)
1. [web](#web)
1. [webapp](#webapp)
1. [website](#website)
1. [whitelist](#whitelist)
1. [wifi](#wifi)
1. [wifi-security](#wifi-security)
1. [windows](#windows)
1. [wireless](#wireless)
1. [wordpress](#wordpress)
1. [x86](#x86)
1. [x86-64](#x86-64)
1. [xss](#xss)
1. [yubikey](#yubikey)


## abstract-syntax-tree

1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [Solium](https://github.com/duaraghav8/Solium). Linter to identify and fix style & security issues in Solidity


## acl

1. [bouncer](https://github.com/JosephSilber/bouncer). Eloquent roles and abilities.
1. [lock](https://github.com/BeatSwitch/lock). A flexible, driver based Acl package for PHP 5.4+
1. [accesscontrol](https://github.com/onury/accesscontrol). Role and Attribute based Access Control for Node.js


## active-directory

1. [DeathStar](https://github.com/byt3bl33d3r/DeathStar). Automate getting Domain Admin using Empire (https://github.com/EmpireProject/Empire)
1. [GoFetch](https://github.com/GoFetchAD/GoFetch). GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application.


## aead

1. [miscreant](https://github.com/miscreant/miscreant). Misuse-resistant symmetric encryption library with AES-SIV (RFC 5297) and AES-PMAC-SIV support
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## aircrack

1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.


## analysis

1. [streamalert](https://github.com/airbnb/streamalert). StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
1. [timesketch](https://github.com/google/timesketch). Collaborative forensic timeline analysis
1. [AIL-framework](https://github.com/CIRCL/AIL-framework). AIL framework - Analysis Information Leak framework
1. [Seccubus](https://github.com/schubergphilis/Seccubus). Easy automated vulnerability scanning, reporting and analysis
1. [rita](https://github.com/activecm/rita). Real Intelligence Threat Analytics


## analytics

1. [django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo). DefectDojo is an open-source defect tracking application
1. [rita](https://github.com/activecm/rita). Real Intelligence Threat Analytics


## android

1. [Awesome-Hacking](https://github.com/Hack-with-Github/Awesome-Hacking). A collection of various awesome lists for hackers, pentesters and security researchers
1. [android-security-awesome](https://github.com/ashishb/android-security-awesome). A collection of android security related resources
1. [hawk](https://github.com/orhanobut/hawk). ✔️ Secure, simple key-value storage for Android
1. [drozer](https://github.com/mwrlabs/drozer). The Leading Security Assessment Framework for Android.
1. [MifareClassicTool](https://github.com/ikarus23/MifareClassicTool). An Android NFC-App for reading, writing, analysing, etc. MIFARE Classic RFID-Tags.
1. [objection](https://github.com/sensepost/objection). 📱 objection - runtime mobile exploration
1. [Android-Security-Reference](https://github.com/doridori/Android-Security-Reference). A W.I.P Android Security Ref
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client


## angular

1. [AspNetCoreSpa](https://github.com/asadsahi/AspNetCoreSpa). Asp.Net Core 2 & Angular (5+) SPA with Angular CLI full featured application. Live demo: 
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4


## angularjs

1. [zmNinja](https://github.com/pliablepixels/zmNinja). High performance, cross platform ionic app for Home/Commerical Security Surveillance using ZoneMinder or other NVRs
1. [GlobaLeaks](https://github.com/globaleaks/GlobaLeaks). GlobaLeaks - The Open-Source Whistleblowing Software


## anonymity

1. [OnionBrowser](https://github.com/mtigas/OnionBrowser). An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network
1. [i2pd](https://github.com/PurpleI2P/i2pd).  🛡 I2P: End-to-End encrypted and anonymous Internet
1. [GlobaLeaks](https://github.com/globaleaks/GlobaLeaks). GlobaLeaks - The Open-Source Whistleblowing Software


## ansible

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [teleport](https://github.com/gravitational/teleport). Modern SSH server for clusters and teams.


## anti-bot

1. [fail2ban](https://github.com/fail2ban/fail2ban). Daemon to ban hosts that cause multiple authentication errors
1. [Captcha](https://github.com/Gregwar/Captcha). PHP Captcha library


## anti-spam

1. [Captcha](https://github.com/Gregwar/Captcha). PHP Captcha library
1. [invisible_captcha](https://github.com/markets/invisible_captcha). :honey_pot: Unobtrusive and flexible spam protection for Rails apps


## api

1. [API-Security-Checklist](https://github.com/shieldfy/API-Security-Checklist). Checklist of the most important security countermeasures when designing, testing, and releasing your API
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP


## apparmor

1. [docker-slim](https://github.com/docker-slim/docker-slim). DockerSlim (docker-slim): Optimize and secure your Docker containers (free and open source)
1. [bane](https://github.com/genuinetools/bane). Custom & better AppArmor profile generator for Docker containers.
1. [contained.af](https://github.com/genuinetools/contained.af). A stupid game for learning about containers, capabilities, and syscalls.
1. [amicontained](https://github.com/genuinetools/amicontained). Container introspection tool. Find out what container runtime is being used as well as features available.


## application-security

1. [awesome-appsec](https://github.com/paragonie/awesome-appsec). A curated list of resources for learning about application security
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.
1. [airship](https://github.com/paragonie/airship). Secure Content Management for the Modern Web - "The sky is only the beginning"


## arm

1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## arm64

1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## aspnet-core

1. [IdentityServer4](https://github.com/IdentityServer/IdentityServer4). OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4


## assembler

1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## assessment

1. [prowler](https://github.com/toniblyx/prowler). AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool. It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf). It performs extra checks as well.
1. [objection](https://github.com/sensepost/objection). 📱 objection - runtime mobile exploration


## asynchronous

1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [slurp](https://github.com/bbb31/slurp). Enumerate S3 buckets via certstream, domain, or keywords


## audit

1. [inspec](https://github.com/chef/inspec). InSpec: Auditing and Testing Framework
1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.


## auth

1. [bouncer](https://github.com/JosephSilber/bouncer). Eloquent roles and abilities.
1. [sentinel](https://github.com/cartalyst/sentinel). A framework agnostic authentication & authorization system.
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.


## authentication

1. [twofactorauth](https://github.com/2factorauth/twofactorauth). List of sites with two factor auth support which includes SMS, email, phone calls, hardware, and software.
1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [sentinel](https://github.com/cartalyst/sentinel). A framework agnostic authentication & authorization system.
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
1. [yosai](https://github.com/YosaiProject/yosai). A Security Framework for Python applications featuring Authorization (rbac permissions and roles), Authentication (2fa totp), Session Management and an extensive Audit Trail
1. [Flask-HTTPAuth](https://github.com/miguelgrinberg/Flask-HTTPAuth). Simple extension that provides Basic, Digest and Token HTTP authentication for Flask routes
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## authorization

1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [bouncer](https://github.com/JosephSilber/bouncer). Eloquent roles and abilities.
1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [sentinel](https://github.com/cartalyst/sentinel). A framework agnostic authentication & authorization system.
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
1. [yosai](https://github.com/YosaiProject/yosai). A Security Framework for Python applications featuring Authorization (rbac permissions and roles), Authentication (2fa totp), Session Management and an extensive Audit Trail
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4
1. [accesscontrol](https://github.com/onury/accesscontrol). Role and Attribute based Access Control for Node.js
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## automation

1. [AutoSploit](https://github.com/NullArray/AutoSploit). Automated Mass Exploiter
1. [guide](https://github.com/hobby-kube/guide).  Kubernetes clusters for the hobbyist.
1. [owtf](https://github.com/owtf/owtf). Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient @owtfp http://owtf.org
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
1. [django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo). DefectDojo is an open-source defect tracking application


## awesome

1. [Awesome-Hacking](https://github.com/Hack-with-Github/Awesome-Hacking). A collection of various awesome lists for hackers, pentesters and security researchers
1. [android-security-awesome](https://github.com/ashishb/android-security-awesome). A collection of android security related resources
1. [awesome-ctf](https://github.com/apsdehal/awesome-ctf). A curated list of CTF frameworks, libraries, resources and softwares
1. [awesome-incident-response](https://github.com/meirwah/awesome-incident-response). A curated list of tools for incident response
1. [awesome-threat-intelligence](https://github.com/hslatman/awesome-threat-intelligence). A curated list of Awesome Threat Intelligence resources
1. [awesome-infosec](https://github.com/onlurking/awesome-infosec).  A curated list of awesome infosec courses and training resources.
1. [awesome-web-security](https://github.com/qazbnm456/awesome-web-security). 🐶 A curated list of Web Security materials and resources.
1. [awesome-pentest-cheat-sheets](https://github.com/coreb1t/awesome-pentest-cheat-sheets). Collection of the cheat sheets useful for pentesting
1. [awesome-iot-hacks](https://github.com/nebgnahz/awesome-iot-hacks). A Collection of Hacks in IoT Space so that we can address them (hopefully).
1. [awesome-threat-detection](https://github.com/0x4D31/awesome-threat-detection). A curated list of awesome threat detection and hunting resources


## awesome-list

1. [android-security-awesome](https://github.com/ashishb/android-security-awesome). A collection of android security related resources
1. [awesome-security](https://github.com/sbilly/awesome-security). A collection of awesome software, libraries, documents, books, resources and cools stuffs about security.
1. [awesome-incident-response](https://github.com/meirwah/awesome-incident-response). A curated list of tools for incident response
1. [awesome-web-security](https://github.com/qazbnm456/awesome-web-security). 🐶 A curated list of Web Security materials and resources.
1. [awesome-threat-detection](https://github.com/0x4D31/awesome-threat-detection). A curated list of awesome threat detection and hunting resources


## aws

1. [sops](https://github.com/mozilla/sops). Secrets management stinks, use some sops!
1. [confidant](https://github.com/lyft/confidant). Confidant: your secret keeper.
1. [streamalert](https://github.com/airbnb/streamalert). StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
1. [Scout2](https://github.com/nccgroup/Scout2). Security auditing tool for AWS environments
1. [xiringuito](https://github.com/ivanilves/xiringuito). SSH-based "VPN for poors"
1. [binaryalert](https://github.com/airbnb/binaryalert). BinaryAlert: Serverless, Real-time & Retroactive Malware Detection
1. [prowler](https://github.com/toniblyx/prowler). AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool. It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf). It performs extra checks as well.
1. [scans](https://github.com/cloudsploit/scans). AWS security scanning checks
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation


## bash

1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.
1. [security-cheatsheets](https://github.com/andrewjkerr/security-cheatsheets). 🔒 A collection of cheatsheets for various infosec tools and topics.


## benchmarking

1. [cleverhans](https://github.com/tensorflow/cleverhans). An adversarial example library for constructing attacks, building defenses, and benchmarking both
1. [processhacker](https://github.com/processhacker/processhacker). A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.


## best-practices

1. [kubernetes-security-best-practice](https://github.com/freach/kubernetes-security-best-practice). Kubernetes Security - Best Practice Guide
1. [sonarwhal](https://github.com/sonarwhal/sonarwhal). A linting tool for the web
1. [AspNetCoreSpa](https://github.com/asadsahi/AspNetCoreSpa). Asp.Net Core 2 & Angular (5+) SPA with Angular CLI full featured application. Live demo: 
1. [best-practices-badge](https://github.com/coreinfrastructure/best-practices-badge). Core Infrastructure Initiative Best Practices Badge


## bettercap

1. [bettercap](https://github.com/evilsocket/bettercap). DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.


## binary-analysis

1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform


## blockchain

1. [smart-contract-best-practices](https://github.com/ConsenSys/smart-contract-best-practices). A guide to smart contract security best practices
1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool
1. [Solium](https://github.com/duaraghav8/Solium). Linter to identify and fix style & security issues in Solidity


## book

1. [heap-exploitation](https://github.com/DhavalKapil/heap-exploitation). This book on heap exploitation is a guide to understanding the internals of glibc's heap and various attacks possible on the heap structure. 
1. [CTF-All-In-One](https://github.com/firmianay/CTF-All-In-One). 一本 CTF 书


## bro

1. [bro](https://github.com/bro/bro). Bro is a powerful network analysis framework that is much different from the typical IDS you may know.  Official mirror of git.bro.org/bro.git .
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.


## browser

1. [decentraleyes](https://github.com/Synzvato/decentraleyes). Decentraleyes - Local emulation of Content Delivery Networks.
1. [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator). A powerful obfuscator for JavaScript and Node.js
1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [OnionBrowser](https://github.com/mtigas/OnionBrowser). An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera


## brute-force

1. [KeychainCracker](https://github.com/macmade/KeychainCracker). macOS keychain cracking tool
1. [c-jwt-cracker](https://github.com/brendan-rius/c-jwt-cracker). JWT brute force cracker written in C


## bruteforce

1. [routersploit](https://github.com/reverse-shell/routersploit). The Router Exploitation Framework
1. [dirsearch](https://github.com/maurosoria/dirsearch). Web path scanner


## bug-bounty

1. [Awesome-Hacking](https://github.com/Hack-with-Github/Awesome-Hacking). A collection of various awesome lists for hackers, pentesters and security researchers
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## bugbounty

1. [StaCoAn](https://github.com/vincentcox/StaCoAn). StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## build-tool

1. [retire.js](https://github.com/RetireJS/retire.js). scanner detecting the use of JavaScript libraries with known vulnerabilities
1. [DependencyCheck](https://github.com/jeremylong/DependencyCheck). OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.


## c

1. [processhacker](https://github.com/processhacker/processhacker). A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
1. [honggfuzz](https://github.com/google/honggfuzz). Security oriented fuzzer with powerful analysis options. Supports evolutionary, feedback-driven fuzzing based on code coverage (software- and hardware-based)
1. [toxic](https://github.com/JFreegman/toxic). An ncurses-based Tox client
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client
1. [sigmavpn](https://github.com/neilalexander/sigmavpn). Light-weight, secure and modular VPN solution


## c-plus-plus

1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [edb-debugger](https://github.com/eteran/edb-debugger). edb is a cross platform x86/x86-64 debugger.
1. [i2pd](https://github.com/PurpleI2P/i2pd).  🛡 I2P: End-to-End encrypted and anonymous Internet
1. [botan](https://github.com/randombit/botan). Crypto and TLS for C++11


## c-sharp

1. [QuasarRAT](https://github.com/quasar/QuasarRAT). Remote Administration Tool for Windows
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## cache

1. [spring-boot](https://github.com/timebusker/spring-boot). spring-boot 项目实践总结
1. [edgedns](https://github.com/jedisct1/edgedns). A high performance DNS cache designed for Content Delivery Networks


## captcha

1. [captcha](https://github.com/mewebstudio/captcha). Captcha for Laravel 5
1. [Captcha](https://github.com/Gregwar/Captcha). PHP Captcha library
1. [rucaptcha](https://github.com/huacnlee/rucaptcha). Captcha gem for Rails Application. No dependencies. No ImageMagick, No RMagick.
1. [invisible_captcha](https://github.com/markets/invisible_captcha). :honey_pot: Unobtrusive and flexible spam protection for Rails apps


## cas

1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## cctv

1. [cameradar](https://github.com/Ullaakut/cameradar). Cameradar hacks its way into RTSP videosurveillance cameras
1. [zmNinja](https://github.com/pliablepixels/zmNinja). High performance, cross platform ionic app for Home/Commerical Security Surveillance using ZoneMinder or other NVRs


## cdn

1. [sites-using-cloudflare](https://github.com/pirate/sites-using-cloudflare). :broken_heart: Archived list of domains using Cloudflare DNS at the time of the CloudBleed announcement.
1. [decentraleyes](https://github.com/Synzvato/decentraleyes). Decentraleyes - Local emulation of Content Delivery Networks.
1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator
1. [edgedns](https://github.com/jedisct1/edgedns). A high performance DNS cache designed for Content Delivery Networks


## cheatsheet

1. [awesome-pentest-cheat-sheets](https://github.com/coreb1t/awesome-pentest-cheat-sheets). Collection of the cheat sheets useful for pentesting
1. [filterbypass](https://github.com/masatokinugawa/filterbypass). 


## checklist

1. [zen-rails-security-checklist](https://github.com/brunofacca/zen-rails-security-checklist). Checklist of security precautions for Ruby on Rails applications.
1. [rails-security-checklist](https://github.com/eliotsykes/rails-security-checklist). :key: Community-driven Rails Security Checklist (see our GitHub Issues for the newest checks that aren't yet in the README)


## chrome

1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera


## cli

1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [bane](https://github.com/genuinetools/bane). Custom & better AppArmor profile generator for Docker containers.


## cloud

1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [scans](https://github.com/cloudsploit/scans). AWS security scanning checks


## cloud-native

1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [pouch](https://github.com/alibaba/pouch). Pouch is an open-source project created to promote the container technology movement.


## communication

1. [system-bus-radio](https://github.com/fulldecent/system-bus-radio). Transmits AM radio on computers without radio transmitting hardware.
1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [i2pd](https://github.com/PurpleI2P/i2pd).  🛡 I2P: End-to-End encrypted and anonymous Internet


## compliance

1. [ossec-hids](https://github.com/ossec/ossec-hids). OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
1. [inspec](https://github.com/chef/inspec). InSpec: Auditing and Testing Framework
1. [prowler](https://github.com/toniblyx/prowler). AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool. It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf). It performs extra checks as well.
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security
1. [scap-security-guide](https://github.com/OpenSCAP/scap-security-guide). Baseline compliance content in SCAP formats


## configuration

1. [iniscan](https://github.com/psecio/iniscan). A php.ini scanner for best security practices
1. [pcc](https://github.com/sektioneins/pcc). PHP Secure Configuration Checker


## container

1. [runtime](https://github.com/clearcontainers/runtime). OCI (Open Containers Initiative) compatible runtime using Virtual Machines
1. [cc-oci-runtime](https://github.com/intel/cc-oci-runtime). OCI (Open Containers Initiative) compatible runtime for Intel® Architecture


## containers

1. [labs](https://github.com/docker/labs). This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.
1. [pouch](https://github.com/alibaba/pouch). Pouch is an open-source project created to promote the container technology movement.
1. [Portus](https://github.com/SUSE/Portus). Authorization service and frontend for Docker registry (v2)
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [docker-slim](https://github.com/docker-slim/docker-slim). DockerSlim (docker-slim): Optimize and secure your Docker containers (free and open source)
1. [felix](https://github.com/projectcalico/felix). Project Calico's per-host agent Felix, responsible for programming routes and security policy.
1. [subuser](https://github.com/subuser-security/subuser). Run programs on linux with selectively restricted permissions.
1. [bane](https://github.com/genuinetools/bane). Custom & better AppArmor profile generator for Docker containers.
1. [runtime](https://github.com/clearcontainers/runtime). OCI (Open Containers Initiative) compatible runtime using Virtual Machines
1. [cc-oci-runtime](https://github.com/intel/cc-oci-runtime). OCI (Open Containers Initiative) compatible runtime for Intel® Architecture
1. [contained.af](https://github.com/genuinetools/contained.af). A stupid game for learning about containers, capabilities, and syscalls.
1. [amicontained](https://github.com/genuinetools/amicontained). Container introspection tool. Find out what container runtime is being used as well as features available.


## cracking

1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [KeychainCracker](https://github.com/macmade/KeychainCracker). macOS keychain cracking tool


## cross-site-scripting

1. [DOMPurify](https://github.com/cure53/DOMPurify). DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
1. [csp-builder](https://github.com/paragonie/csp-builder). Build Content-Security-Policy headers from a JSON file (or build them programmatically)


## crypto

1. [cryptomator](https://github.com/cryptomator/cryptomator). Multi-platform transparent client-side encryption of your files in the cloud
1. [piknik](https://github.com/jedisct1/piknik). Copy/paste anything over the network
1. [PrivateBin](https://github.com/PrivateBin/PrivateBin). A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
1. [botan](https://github.com/randombit/botan). Crypto and TLS for C++11
1. [featherduster](https://github.com/nccgroup/featherduster). An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
1. [ghostunnel](https://github.com/square/ghostunnel). A simple SSL/TLS proxy with mutual authentication for securing non-TLS services
1. [CTF-All-In-One](https://github.com/firmianay/CTF-All-In-One). 一本 CTF 书
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## cryptography

1. [cryptomator](https://github.com/cryptomator/cryptomator). Multi-platform transparent client-side encryption of your files in the cloud
1. [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator). A powerful obfuscator for JavaScript and Node.js
1. [i2pd](https://github.com/PurpleI2P/i2pd).  🛡 I2P: End-to-End encrypted and anonymous Internet
1. [cryptocat](https://github.com/cryptocat/cryptocat). Secure chat software for your computer.
1. [ring](https://github.com/briansmith/ring). Safe, fast, small crypto using Rust
1. [PrivateBin](https://github.com/PrivateBin/PrivateBin). A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
1. [botan](https://github.com/randombit/botan). Crypto and TLS for C++11
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [featherduster](https://github.com/nccgroup/featherduster). An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
1. [themis](https://github.com/cossacklabs/themis). Human friendly crypto library for storage and messaging for mobile apps, servers and front-ends.
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [miscreant](https://github.com/miscreant/miscreant). Misuse-resistant symmetric encryption library with AES-SIV (RFC 5297) and AES-PMAC-SIV support
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## csrf

1. [hacker101](https://github.com/Hacker0x01/hacker101). Hacker101
1. [nosurf](https://github.com/justinas/nosurf). CSRF protection middleware for Go.


## ctf

1. [awesome-ctf](https://github.com/apsdehal/awesome-ctf). A curated list of CTF frameworks, libraries, resources and softwares
1. [CTFd](https://github.com/CTFd/CTFd). CTFs as you need them
1. [ctf](https://github.com/p4-team/ctf). Ctf solutions from p4 team
1. [CTF-All-In-One](https://github.com/firmianay/CTF-All-In-One). 一本 CTF 书


## curve25519

1. [ring](https://github.com/briansmith/ring). Safe, fast, small crypto using Rust
1. [nacl](https://github.com/kevinburke/nacl). Pure Go implementation of the NaCL set of API's


## cyber-security

1. [Free-Security-eBooks](https://github.com/Hack-with-Github/Free-Security-eBooks). Free Security and Hacking eBooks
1. [slurp](https://github.com/bbb31/slurp). Enumerate S3 buckets via certstream, domain, or keywords


## cybersecurity

1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [awesome-incident-response](https://github.com/meirwah/awesome-incident-response). A curated list of tools for incident response
1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)
1. [dawnscanner](https://github.com/thesp0nge/dawnscanner). Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
1. [Passhunt](https://github.com/Viralmaniar/Passhunt). Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords.


## debugger

1. [x64dbg](https://github.com/x64dbg/x64dbg). An open-source x64/x32 debugger for windows.
1. [processhacker](https://github.com/processhacker/processhacker). A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
1. [edb-debugger](https://github.com/eteran/edb-debugger). edb is a cross platform x86/x86-64 debugger.
1. [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy). Detect it Easy


## devops

1. [faraday](https://github.com/infobyte/faraday). Collaborative Penetration Test and Vulnerability Management Platform
1. [sops](https://github.com/mozilla/sops). Secrets management stinks, use some sops!
1. [inspec](https://github.com/chef/inspec). InSpec: Auditing and Testing Framework


## dfir

1. [bro](https://github.com/bro/bro). Bro is a powerful network analysis framework that is much different from the typical IDS you may know.  Official mirror of git.bro.org/bro.git .
1. [awesome-incident-response](https://github.com/meirwah/awesome-incident-response). A curated list of tools for incident response
1. [timesketch](https://github.com/google/timesketch). Collaborative forensic timeline analysis


## dictionary-attack

1. [routersploit](https://github.com/reverse-shell/routersploit). The Router Exploitation Framework
1. [cameradar](https://github.com/Ullaakut/cameradar). Cameradar hacks its way into RTSP videosurveillance cameras


## disassembler

1. [x64dbg](https://github.com/x64dbg/x64dbg). An open-source x64/x32 debugger for windows.
1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [panopticon](https://github.com/das-labor/panopticon). A libre cross-platform disassembler.
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy). Detect it Easy


## distributed

1. [meshbird](https://github.com/meshbird/meshbird). Distributed private networking
1. [Hive2Hive](https://github.com/Hive2Hive/Hive2Hive). Java library for secure, distributed, P2P-based file synchronization and sharing.


## django

1. [hawkpost](https://github.com/whitesmith/hawkpost). Generate links that users can use to submit messages encrypted with your public key.
1. [django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo). DefectDojo is an open-source defect tracking application


## dns

1. [sites-using-cloudflare](https://github.com/pirate/sites-using-cloudflare). :broken_heart: Archived list of domains using Cloudflare DNS at the time of the CloudBleed announcement.
1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [awesome-checker-services](https://github.com/Brunty/awesome-checker-services). ✅ List of links to the various checkers out there on the web for sites, domains, security etc.
1. [rita](https://github.com/activecm/rita). Real Intelligence Threat Analytics
1. [edgedns](https://github.com/jedisct1/edgedns). A high performance DNS cache designed for Content Delivery Networks


## docker

1. [teleport](https://github.com/gravitational/teleport). Modern SSH server for clusters and teams.
1. [labs](https://github.com/docker/labs). This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.
1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [Portus](https://github.com/SUSE/Portus). Authorization service and frontend for Docker registry (v2)
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [docker-ipsec-vpn-server](https://github.com/hwdsl2/docker-ipsec-vpn-server). Docker image to run an IPsec VPN server, with IPsec/L2TP and Cisco IPsec
1. [docker-slim](https://github.com/docker-slim/docker-slim). DockerSlim (docker-slim): Optimize and secure your Docker containers (free and open source)
1. [cameradar](https://github.com/Ullaakut/cameradar). Cameradar hacks its way into RTSP videosurveillance cameras
1. [dockerscan](https://github.com/cr0hn/dockerscan). Docker security analysis & hacking tools
1. [felix](https://github.com/projectcalico/felix). Project Calico's per-host agent Felix, responsible for programming routes and security policy.
1. [subuser](https://github.com/subuser-security/subuser). Run programs on linux with selectively restricted permissions.
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.
1. [bane](https://github.com/genuinetools/bane). Custom & better AppArmor profile generator for Docker containers.
1. [runtime](https://github.com/clearcontainers/runtime). OCI (Open Containers Initiative) compatible runtime using Virtual Machines
1. [cc-oci-runtime](https://github.com/intel/cc-oci-runtime). OCI (Open Containers Initiative) compatible runtime for Intel® Architecture
1. [contained.af](https://github.com/genuinetools/contained.af). A stupid game for learning about containers, capabilities, and syscalls.
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com
1. [dagda](https://github.com/eliasgranderubio/dagda). a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
1. [amicontained](https://github.com/genuinetools/amicontained). Container introspection tool. Find out what container runtime is being used as well as features available.


## docker-image

1. [docker-ipsec-vpn-server](https://github.com/hwdsl2/docker-ipsec-vpn-server). Docker image to run an IPsec VPN server, with IPsec/L2TP and Cisco IPsec
1. [cameradar](https://github.com/Ullaakut/cameradar). Cameradar hacks its way into RTSP videosurveillance cameras


## dotnet

1. [labs](https://github.com/docker/labs). This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.
1. [IdentityServer4](https://github.com/IdentityServer/IdentityServer4). OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## dynamic-analysis

1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.


## education

1. [hacker101](https://github.com/Hacker0x01/hacker101). Hacker101
1. [CTFd](https://github.com/CTFd/CTFd). CTFs as you need them


## elasticsearch

1. [search-guard](https://github.com/floragunncom/search-guard). Search Guard is an Open Source Elasticsearch plugin that offers encryption, authentication, and authorisation.
1. [MozDef](https://github.com/mozilla/MozDef). MozDef: The Mozilla Defense Platform
1. [elasticsearch-readonlyrest-plugin](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin). Free Elasticsearch and Kibana security plugin: super-easy Kibana multi-tenancy, Encryption, Authentication, Authorization, Auditing
1. [sigma](https://github.com/Neo23x0/sigma). Generic Signature Format for SIEM Systems
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## electron

1. [keeweb](https://github.com/keeweb/keeweb). Free cross-platform password manager compatible with KeePass
1. [buttercup-desktop](https://github.com/buttercup/buttercup-desktop). :key: Javascript Password Vault - Multi-Platform Desktop Application


## elk

1. [search-guard](https://github.com/floragunncom/search-guard). Search Guard is an Open Source Elasticsearch plugin that offers encryption, authentication, and authorisation.
1. [MozDef](https://github.com/mozilla/MozDef). MozDef: The Mozilla Defense Platform


## elk-stack

1. [search-guard](https://github.com/floragunncom/search-guard). Search Guard is an Open Source Elasticsearch plugin that offers encryption, authentication, and authorisation.
1. [MozDef](https://github.com/mozilla/MozDef). MozDef: The Mozilla Defense Platform


## email

1. [hawkpost](https://github.com/whitesmith/hawkpost). Generate links that users can use to submit messages encrypted with your public key.
1. [FiercePhish](https://github.com/Raikia/FiercePhish). FiercePhish is a full-fledged phishing framework to manage all phishing engagements.  It allows you to track separate phishing campaigns, schedule sending of emails, and much more.


## embedded

1. [routersploit](https://github.com/reverse-shell/routersploit). The Router Exploitation Framework
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com


## emulation

1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool
1. [ViperMonkey](https://github.com/decalage2/ViperMonkey). A VBA parser and emulation engine to analyze malicious macros.


## emulator

1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform


## encrypted

1. [PrivateBin](https://github.com/PrivateBin/PrivateBin). A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client


## encryption

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [hawk](https://github.com/orhanobut/hawk). ✔️ Secure, simple key-value storage for Android
1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [buttercup-desktop](https://github.com/buttercup/buttercup-desktop). :key: Javascript Password Vault - Multi-Platform Desktop Application
1. [featherduster](https://github.com/nccgroup/featherduster). An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
1. [SwiftyRSA](https://github.com/TakeScoop/SwiftyRSA). RSA public/private key encryption in Swift
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation
1. [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt). Ultimate Javascript Object Signing and Encryption (JOSE) and JSON Web Token (JWT) Implementation for .NET and .NET Core
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.
1. [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot). Jasypt integration for Spring boot


## enumeration

1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
1. [slurp](https://github.com/bbb31/slurp). Enumerate S3 buckets via certstream, domain, or keywords
1. [kernelpop](https://github.com/spencerdodd/kernelpop). kernel privilege escalation enumeration and exploitation framework
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## ethereum

1. [zeppelin-solidity](https://github.com/OpenZeppelin/zeppelin-solidity). OpenZeppelin, a framework to build secure smart contracts on Ethereum
1. [smart-contract-best-practices](https://github.com/ConsenSys/smart-contract-best-practices). A guide to smart contract security best practices
1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool
1. [Solium](https://github.com/duaraghav8/Solium). Linter to identify and fix style & security issues in Solidity


## exfiltration

1. [system-bus-radio](https://github.com/fulldecent/system-bus-radio). Transmits AM radio on computers without radio transmitting hardware.
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection


## exploit

1. [AutoSploit](https://github.com/NullArray/AutoSploit). Automated Mass Exploiter
1. [linux-kernel-exploitation](https://github.com/xairy/linux-kernel-exploitation). A bunch of links related to Linux kernel exploitation
1. [labs](https://github.com/nixawk/labs). Vulnerability Labs for security analysis
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [featherduster](https://github.com/nccgroup/featherduster). An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
1. [Am-I-affected-by-Meltdown](https://github.com/raphaelsc/Am-I-affected-by-Meltdown). Meltdown Exploit / Proof-of-concept / checks whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a MELTDOWN.
1. [htshells](https://github.com/wireghoul/htshells). Self contained htaccess shells and attacks
1. [CTF-All-In-One](https://github.com/firmianay/CTF-All-In-One). 一本 CTF 书


## exploitation

1. [AutoSploit](https://github.com/NullArray/AutoSploit). Automated Mass Exploiter
1. [featherduster](https://github.com/nccgroup/featherduster). An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction


## exploits

1. [routersploit](https://github.com/reverse-shell/routersploit). The Router Exploitation Framework
1. [xunfeng](https://github.com/ysrc/xunfeng). 巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
1. [exploits](https://github.com/XiphosResearch/exploits). Miscellaneous exploit code
1. [featherduster](https://github.com/nccgroup/featherduster). An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
1. [wordpress-exploit-framework](https://github.com/rastating/wordpress-exploit-framework). A Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.
1. [kernelpop](https://github.com/spencerdodd/kernelpop). kernel privilege escalation enumeration and exploitation framework


## federation

1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt). Ultimate Javascript Object Signing and Encryption (JOSE) and JSON Web Token (JWT) Implementation for .NET and .NET Core


## file-integrity-management

1. [ossec-hids](https://github.com/ossec/ossec-hids). OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## file-sharing

1. [onionshare](https://github.com/micahflee/onionshare). Securely and anonymously share a file of any size
1. [Hive2Hive](https://github.com/Hive2Hive/Hive2Hive). Java library for secure, distributed, P2P-based file synchronization and sharing.


## firefox

1. [user.js](https://github.com/pyllyukko/user.js). user.js -- Firefox configuration hardening
1. [ghacks-user.js](https://github.com/ghacksuserjs/ghacks-user.js). An ongoing comprehensive user.js template for configuring and hardening Firefox privacy, security and anti-fingerprinting
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera


## firewall

1. [teleport](https://github.com/gravitational/teleport). Modern SSH server for clusters and teams.
1. [opensnitch](https://github.com/evilsocket/opensnitch). OpenSnitch is a GNU/Linux port of the Little Snitch application firewall.


## flask

1. [CTFd](https://github.com/CTFd/CTFd). CTFs as you need them
1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [Flask-HTTPAuth](https://github.com/miguelgrinberg/Flask-HTTPAuth). Simple extension that provides Basic, Digest and Token HTTP authentication for Flask routes


## forensics

1. [Free-Security-eBooks](https://github.com/Hack-with-Github/Free-Security-eBooks). Free Security and Hacking eBooks
1. [timesketch](https://github.com/google/timesketch). Collaborative forensic timeline analysis
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [oletools](https://github.com/decalage2/oletools). oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.


## framework

1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [owtf](https://github.com/owtf/owtf). Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient @owtfp http://owtf.org
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [objection](https://github.com/sensepost/objection). 📱 objection - runtime mobile exploration
1. [honeytrap](https://github.com/honeytrap/honeytrap). Advanced Honeypot framework.


## fuzzer

1. [syzkaller](https://github.com/google/syzkaller). syzkaller is an unsupervised, coverage-guided kernel fuzzer
1. [dirsearch](https://github.com/maurosoria/dirsearch). Web path scanner


## fuzzing

1. [Awesome-Hacking](https://github.com/Hack-with-Github/Awesome-Hacking). A collection of various awesome lists for hackers, pentesters and security researchers
1. [oss-fuzz](https://github.com/google/oss-fuzz). OSS-Fuzz - continuous fuzzing of open source software
1. [syzkaller](https://github.com/google/syzkaller). syzkaller is an unsupervised, coverage-guided kernel fuzzer
1. [dirsearch](https://github.com/maurosoria/dirsearch). Web path scanner
1. [honggfuzz](https://github.com/google/honggfuzz). Security oriented fuzzer with powerful analysis options. Supports evolutionary, feedback-driven fuzzing based on code coverage (software- and hardware-based)


## github

1. [notes](https://github.com/ChALkeR/notes). Some public notes
1. [Hawkeye](https://github.com/0xbug/Hawkeye). GitHub 泄露监控系统(GitHub Sensitive Information Leakage Monitor)


## go

1. [teleport](https://github.com/gravitational/teleport). Modern SSH server for clusters and teams.
1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [gitleaks](https://github.com/zricethezav/gitleaks). Searches full repo history for secrets and keys 🔑
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [docker-slim](https://github.com/docker-slim/docker-slim). DockerSlim (docker-slim): Optimize and secure your Docker containers (free and open source)
1. [secure](https://github.com/unrolled/secure). HTTP middleware for Go that facilitates some quick security wins.
1. [bluemonday](https://github.com/microcosm-cc/bluemonday). bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
1. [nosurf](https://github.com/justinas/nosurf). CSRF protection middleware for Go.
1. [sshesame](https://github.com/jaksi/sshesame). A fake SSH server that lets everyone in and logs their activity
1. [memguard](https://github.com/awnumar/memguard). Easy and secure handling of sensitive memory, in pure Go.
1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [felix](https://github.com/projectcalico/felix). Project Calico's per-host agent Felix, responsible for programming routes and security policy.
1. [ghostunnel](https://github.com/square/ghostunnel). A simple SSL/TLS proxy with mutual authentication for securing non-TLS services
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## golang

1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [gitleaks](https://github.com/zricethezav/gitleaks). Searches full repo history for secrets and keys 🔑
1. [gophish](https://github.com/gophish/gophish). Open-Source Phishing Toolkit
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [docker-slim](https://github.com/docker-slim/docker-slim). DockerSlim (docker-slim): Optimize and secure your Docker containers (free and open source)
1. [cameradar](https://github.com/Ullaakut/cameradar). Cameradar hacks its way into RTSP videosurveillance cameras
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
1. [secure](https://github.com/unrolled/secure). HTTP middleware for Go that facilitates some quick security wins.
1. [sshesame](https://github.com/jaksi/sshesame). A fake SSH server that lets everyone in and logs their activity
1. [gas](https://github.com/GoASTScanner/gas). Go AST Scanner
1. [memguard](https://github.com/awnumar/memguard). Easy and secure handling of sensitive memory, in pure Go.
1. [felix](https://github.com/projectcalico/felix). Project Calico's per-host agent Felix, responsible for programming routes and security policy.
1. [slurp](https://github.com/bbb31/slurp). Enumerate S3 buckets via certstream, domain, or keywords
1. [nacl](https://github.com/kevinburke/nacl). Pure Go implementation of the NaCL set of API's
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## graylog

1. [graylog2-server](https://github.com/Graylog2/graylog2-server). Free and open source log management
1. [nzyme](https://github.com/lennartkoopmann/nzyme). Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog (Open Source log management) setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode.


## guide

1. [guide](https://github.com/hobby-kube/guide).  Kubernetes clusters for the hobbyist.
1. [kubernetes-security-best-practice](https://github.com/freach/kubernetes-security-best-practice). Kubernetes Security - Best Practice Guide


## hack

1. [cameradar](https://github.com/Ullaakut/cameradar). Cameradar hacks its way into RTSP videosurveillance cameras
1. [awesome-iot-hacks](https://github.com/nebgnahz/awesome-iot-hacks). A Collection of Hacks in IoT Space so that we can address them (hopefully).


## hacking

1. [Awesome-Hacking](https://github.com/Hack-with-Github/Awesome-Hacking). A collection of various awesome lists for hackers, pentesters and security researchers
1. [hacker101](https://github.com/Hacker0x01/hacker101). Hacker101
1. [urh](https://github.com/jopohl/urh). Universal Radio Hacker: investigate wireless protocols like a boss
1. [awesome-sec-talks](https://github.com/PaulSec/awesome-sec-talks). A collected list of awesome security talks
1. [DVWA](https://github.com/ethicalhack3r/DVWA). Damn Vulnerable Web Application (DVWA)
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [nishang](https://github.com/samratashok/nishang). Nishang - PowerShell for penetration testing and offensive security. 
1. [Free-Security-eBooks](https://github.com/Hack-with-Github/Free-Security-eBooks). Free Security and Hacking eBooks
1. [dirsearch](https://github.com/maurosoria/dirsearch). Web path scanner
1. [pentest-wiki](https://github.com/nixawk/pentest-wiki). PENTEST-WIKI is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others.
1. [exploits](https://github.com/XiphosResearch/exploits). Miscellaneous exploit code
1. [dockerscan](https://github.com/cr0hn/dockerscan). Docker security analysis & hacking tools
1. [FiercePhish](https://github.com/Raikia/FiercePhish). FiercePhish is a full-fledged phishing framework to manage all phishing engagements.  It allows you to track separate phishing campaigns, schedule sending of emails, and much more.
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.
1. [KeychainCracker](https://github.com/macmade/KeychainCracker). macOS keychain cracking tool
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
1. [CTF-All-In-One](https://github.com/firmianay/CTF-All-In-One). 一本 CTF 书


## hacking-tool

1. [wpscan](https://github.com/wpscanteam/wpscan). WPScan is a black box WordPress vulnerability scanner
1. [trape](https://github.com/boxug/trape). People tracker on the Internet: Learn to track the world, to avoid being traced.
1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.


## hacking-tools

1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.


## halite

1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium


## hardening

1. [hardentools](https://github.com/securitywithoutborders/hardentools). Hardentools is a utility that disables a number of risky Windows features.
1. [prowler](https://github.com/toniblyx/prowler). AWS Security Best Practices Assessment, Auditing, Hardening and Forensics Readiness Tool. It follows guidelines of the CIS Amazon Web Services Foundations Benchmark (https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf). It performs extra checks as well.
1. [awesome-windows-domain-hardening](https://github.com/PaulSec/awesome-windows-domain-hardening). A curated list of awesome Security Hardening techniques for Windows.


## hkdf

1. [ring](https://github.com/briansmith/ring). Safe, fast, small crypto using Rust
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## hmac

1. [itsdangerous](https://github.com/pallets/itsdangerous). Various helpers to pass trusted data to untrusted environments
1. [ring](https://github.com/briansmith/ring). Safe, fast, small crypto using Rust
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## honeypot

1. [cowrie](https://github.com/micheloosterhof/cowrie). Cowrie SSH/Telnet Honeypot
1. [sshesame](https://github.com/jaksi/sshesame). A fake SSH server that lets everyone in and logs their activity
1. [conpot](https://github.com/mushorg/conpot). ICS/SCADA honeypot
1. [invisible_captcha](https://github.com/markets/invisible_captcha). :honey_pot: Unobtrusive and flexible spam protection for Rails apps
1. [honeytrap](https://github.com/honeytrap/honeytrap). Advanced Honeypot framework.


## html

1. [DOMPurify](https://github.com/cure53/DOMPurify). DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
1. [bluemonday](https://github.com/microcosm-cc/bluemonday). bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS


## http

1. [mitmproxy](https://github.com/mitmproxy/mitmproxy). An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [sozu](https://github.com/sozu-proxy/sozu). Sōzu HTTP reverse proxy, configurable at runtime, fast and safe, built in Rust. It will be awesome when it will be ready. Not So Secret Project! Ping us on gitter to know more
1. [protools](https://github.com/SeanDragon/protools). 历经开发周期两年，并且应用过千万级别项目的工具箱
1. [csp-builder](https://github.com/paragonie/csp-builder). Build Content-Security-Policy headers from a JSON file (or build them programmatically)


## http2

1. [mitmproxy](https://github.com/mitmproxy/mitmproxy). An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator


## https

1. [sites-using-cloudflare](https://github.com/pirate/sites-using-cloudflare). :broken_heart: Archived list of domains using Cloudflare DNS at the time of the CloudBleed announcement.
1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator
1. [GlobaLeaks](https://github.com/globaleaks/GlobaLeaks). GlobaLeaks - The Open-Source Whistleblowing Software
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com


## identity

1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [IdentityServer4](https://github.com/IdentityServer/IdentityServer4). OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4


## identityserver4

1. [IdentityServer4](https://github.com/IdentityServer/IdentityServer4). OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4


## ids

1. [fail2ban](https://github.com/fail2ban/fail2ban). Daemon to ban hosts that cause multiple authentication errors
1. [suricata](https://github.com/OISF/suricata). Suricata git repository maintained by the OISF
1. [sigma](https://github.com/Neo23x0/sigma). Generic Signature Format for SIEM Systems
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security
1. [SELKS](https://github.com/StamusNetworks/SELKS). A Suricata based IDS/IPS distro


## ikev2

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [setup-ipsec-vpn](https://github.com/hwdsl2/setup-ipsec-vpn). Scripts to build your own IPsec VPN server, with IPsec/L2TP and Cisco IPsec on Ubuntu, Debian and CentOS


## incident-response

1. [awesome-incident-response](https://github.com/meirwah/awesome-incident-response). A curated list of tools for incident response
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## information-security

1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)
1. [AIL-framework](https://github.com/CIRCL/AIL-framework). AIL framework - Analysis Information Leak framework


## infosec

1. [routersploit](https://github.com/reverse-shell/routersploit). The Router Exploitation Framework
1. [awesome-sec-talks](https://github.com/PaulSec/awesome-sec-talks). A collected list of awesome security talks
1. [DVWA](https://github.com/ethicalhack3r/DVWA). Damn Vulnerable Web Application (DVWA)
1. [nishang](https://github.com/samratashok/nishang). Nishang - PowerShell for penetration testing and offensive security. 
1. [faraday](https://github.com/infobyte/faraday). Collaborative Penetration Test and Vulnerability Management Platform
1. [awesome-infosec](https://github.com/onlurking/awesome-infosec).  A curated list of awesome infosec courses and training resources.
1. [xunfeng](https://github.com/ysrc/xunfeng). 巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
1. [security-txt](https://github.com/securitytxt/security-txt). A proposed standard that allows websites to define security policies.
1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [bugbounty-cheatsheet](https://github.com/EdOverflow/bugbounty-cheatsheet). A list of interesting payloads, tips and tricks for bug bounty hunters.
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [changeme](https://github.com/ztgrace/changeme). A default credential scanner.
1. [metta](https://github.com/uber-common/metta). An information security preparedness tool to do adversarial simulation.
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
1. [GourdScanV2](https://github.com/ysrc/GourdScanV2). 被动式漏洞扫描系统
1. [nzyme](https://github.com/lennartkoopmann/nzyme). Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog (Open Source log management) setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode.
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## intelligence

1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)
1. [xray](https://github.com/evilsocket/xray). XRay is a tool for recon, mapping and OSINT gathering from public networks.


## intrusion-detection

1. [osquery](https://github.com/facebook/osquery). SQL powered operating system instrumentation, monitoring, and analytics.
1. [fail2ban](https://github.com/fail2ban/fail2ban). Daemon to ban hosts that cause multiple authentication errors
1. [maltrail](https://github.com/stamparm/maltrail). Malicious traffic detection system
1. [ossec-hids](https://github.com/ossec/ossec-hids). OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
1. [awesome-threat-detection](https://github.com/0x4D31/awesome-threat-detection). A curated list of awesome threat detection and hunting resources
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## ios

1. [Valet](https://github.com/square/Valet). Valet lets you securely store data in the iOS, tvOS, or macOS Keychain without knowing a thing about how the Keychain works. It’s easy. We promise.
1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [OnionBrowser](https://github.com/mtigas/OnionBrowser). An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network
1. [secure-ios-app-dev](https://github.com/felixgr/secure-ios-app-dev). Collection of the most common vulnerabilities found in iOS applications
1. [needle](https://github.com/mwrlabs/needle). The iOS Security Testing Framework
1. [objection](https://github.com/sensepost/objection). 📱 objection - runtime mobile exploration
1. [SwiftyRSA](https://github.com/TakeScoop/SwiftyRSA). RSA public/private key encryption in Swift
1. [EllipticCurveKeyPair](https://github.com/agens-no/EllipticCurveKeyPair). Sign, verify, encrypt and decrypt using the Secure Enclave


## iot

1. [urh](https://github.com/jopohl/urh). Universal Radio Hacker: investigate wireless protocols like a boss
1. [awesome-iot-hacks](https://github.com/nebgnahz/awesome-iot-hacks). A Collection of Hacks in IoT Space so that we can address them (hopefully).
1. [zmNinja](https://github.com/pliablepixels/zmNinja). High performance, cross platform ionic app for Home/Commerical Security Surveillance using ZoneMinder or other NVRs


## ips

1. [fail2ban](https://github.com/fail2ban/fail2ban). Daemon to ban hosts that cause multiple authentication errors
1. [suricata](https://github.com/OISF/suricata). Suricata git repository maintained by the OISF
1. [SELKS](https://github.com/StamusNetworks/SELKS). A Suricata based IDS/IPS distro


## ipsec

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [setup-ipsec-vpn](https://github.com/hwdsl2/setup-ipsec-vpn). Scripts to build your own IPsec VPN server, with IPsec/L2TP and Cisco IPsec on Ubuntu, Debian and CentOS
1. [docker-ipsec-vpn-server](https://github.com/hwdsl2/docker-ipsec-vpn-server). Docker image to run an IPsec VPN server, with IPsec/L2TP and Cisco IPsec
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation


## java

1. [labs](https://github.com/docker/labs). This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.
1. [spring-security](https://github.com/spring-projects/spring-security). Spring Security
1. [cryptomator](https://github.com/cryptomator/cryptomator). Multi-platform transparent client-side encryption of your files in the cloud
1. [drozer](https://github.com/mwrlabs/drozer). The Leading Security Assessment Framework for Android.
1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [elasticsearch-readonlyrest-plugin](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin). Free Elasticsearch and Kibana security plugin: super-easy Kibana multi-tenancy, Encryption, Authentication, Authorization, Auditing
1. [find-sec-bugs](https://github.com/find-sec-bugs/find-sec-bugs). The FindBugs plugin for security audits of Java web applications and Android applications. (Also work with Groovy and Scala projects)
1. [Note](https://github.com/scalad/Note). 常规Java工具，算法，加密，数据库，面试题，源代码分析，解决方案
1. [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot). Jasypt integration for Spring boot
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## javascript

1. [keeweb](https://github.com/keeweb/keeweb). Free cross-platform password manager compatible with KeePass
1. [helmet](https://github.com/helmetjs/helmet). Help secure Express apps with various HTTP headers
1. [DOMPurify](https://github.com/cure53/DOMPurify). DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
1. [retire.js](https://github.com/RetireJS/retire.js). scanner detecting the use of JavaScript libraries with known vulnerabilities
1. [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator). A powerful obfuscator for JavaScript and Node.js
1. [express-gateway](https://github.com/ExpressGateway/express-gateway). A microservices API Gateway built on top of ExpressJS
1. [vm2](https://github.com/patriksimek/vm2). Advanced vm/sandbox for Node.js
1. [zmNinja](https://github.com/pliablepixels/zmNinja). High performance, cross platform ionic app for Home/Commerical Security Surveillance using ZoneMinder or other NVRs
1. [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy). Detect it Easy
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera
1. [NodeJsScan](https://github.com/ajinabraham/NodeJsScan). NodeJsScan is a static security code scanner for Node.js applications.


## jwt

1. [API-Security-Checklist](https://github.com/shieldfy/API-Security-Checklist). Checklist of the most important security countermeasures when designing, testing, and releasing your API
1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt). Ultimate Javascript Object Signing and Encryption (JOSE) and JSON Web Token (JWT) Implementation for .NET and .NET Core
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## jwt-authentication

1. [c-jwt-cracker](https://github.com/brendan-rius/c-jwt-cracker). JWT brute force cracker written in C
1. [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt). Ultimate Javascript Object Signing and Encryption (JOSE) and JSON Web Token (JWT) Implementation for .NET and .NET Core


## kafka

1. [graylog2-server](https://github.com/Graylog2/graylog2-server). Free and open source log management
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP


## kali-linux

1. [Free-Security-eBooks](https://github.com/Hack-with-Github/Free-Security-eBooks). Free Security and Hacking eBooks
1. [WhatWeb](https://github.com/urbanadventurer/WhatWeb). Next generation web scanner
1. [owtf](https://github.com/owtf/owtf). Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient @owtfp http://owtf.org
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.


## kernel

1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [syzkaller](https://github.com/google/syzkaller). syzkaller is an unsupervised, coverage-guided kernel fuzzer
1. [kernelpop](https://github.com/spencerdodd/kernelpop). kernel privilege escalation enumeration and exploitation framework


## keychain

1. [KeychainAccess](https://github.com/kishikawakatsumi/KeychainAccess). Simple Swift wrapper for Keychain that works on iOS, watchOS, tvOS and macOS.
1. [Valet](https://github.com/square/Valet). Valet lets you securely store data in the iOS, tvOS, or macOS Keychain without knowing a thing about how the Keychain works. It’s easy. We promise.
1. [UICKeyChainStore](https://github.com/kishikawakatsumi/UICKeyChainStore). UICKeyChainStore is a simple wrapper for Keychain on iOS, watchOS, tvOS and macOS. Makes using Keychain APIs as easy as NSUserDefaults.
1. [envchain](https://github.com/sorah/envchain). Environment variables meet macOS Keychain and gnome-keyring <3
1. [KeychainCracker](https://github.com/macmade/KeychainCracker). macOS keychain cracking tool
1. [EllipticCurveKeyPair](https://github.com/agens-no/EllipticCurveKeyPair). Sign, verify, encrypt and decrypt using the Secure Enclave


## kubernetes

1. [guide](https://github.com/hobby-kube/guide).  Kubernetes clusters for the hobbyist.
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [kubernetes-security-best-practice](https://github.com/freach/kubernetes-security-best-practice). Kubernetes Security - Best Practice Guide
1. [felix](https://github.com/projectcalico/felix). Project Calico's per-host agent Felix, responsible for programming routes and security policy.
1. [kubernetes-network-policy-recipes](https://github.com/ahmetb/kubernetes-network-policy-recipes). Tutorials and Recipes for Kubernetes Network Policies feature


## kvm

1. [runtime](https://github.com/clearcontainers/runtime). OCI (Open Containers Initiative) compatible runtime using Virtual Machines
1. [cc-oci-runtime](https://github.com/intel/cc-oci-runtime). OCI (Open Containers Initiative) compatible runtime for Intel® Architecture


## l2tp

1. [setup-ipsec-vpn](https://github.com/hwdsl2/setup-ipsec-vpn). Scripts to build your own IPsec VPN server, with IPsec/L2TP and Cisco IPsec on Ubuntu, Debian and CentOS
1. [docker-ipsec-vpn-server](https://github.com/hwdsl2/docker-ipsec-vpn-server). Docker image to run an IPsec VPN server, with IPsec/L2TP and Cisco IPsec
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation


## lab

1. [labs](https://github.com/docker/labs). This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.
1. [awesome-infosec](https://github.com/onlurking/awesome-infosec).  A curated list of awesome infosec courses and training resources.


## lambda

1. [streamalert](https://github.com/airbnb/streamalert). StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
1. [binaryalert](https://github.com/airbnb/binaryalert). BinaryAlert: Serverless, Real-time & Retroactive Malware Detection


## laravel

1. [bouncer](https://github.com/JosephSilber/bouncer). Eloquent roles and abilities.
1. [sentinel](https://github.com/cartalyst/sentinel). A framework agnostic authentication & authorization system.
1. [captcha](https://github.com/mewebstudio/captcha). Captcha for Laravel 5
1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator
1. [laravel-url-signer](https://github.com/spatie/laravel-url-signer). Create and validate signed URLs with a limited lifetime


## ldap

1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## letsencrypt

1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator
1. [GlobaLeaks](https://github.com/globaleaks/GlobaLeaks). GlobaLeaks - The Open-Source Whistleblowing Software


## library

1. [sslyze](https://github.com/nabla-c0d3/sslyze). Fast and powerful SSL/TLS server scanning library.
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.


## libsodium

1. [sigmavpn](https://github.com/neilalexander/sigmavpn). Light-weight, secure and modular VPN solution
1. [airship](https://github.com/paragonie/airship). Secure Content Management for the Modern Web - "The sky is only the beginning"
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium


## libsodium-php

1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium


## lint

1. [sonarwhal](https://github.com/sonarwhal/sonarwhal). A linting tool for the web
1. [Solium](https://github.com/duaraghav8/Solium). Linter to identify and fix style & security issues in Solidity


## linux

1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [fail2ban](https://github.com/fail2ban/fail2ban). Daemon to ban hosts that cause multiple authentication errors
1. [opensnitch](https://github.com/evilsocket/opensnitch). OpenSnitch is a GNU/Linux port of the Little Snitch application firewall.
1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [syzkaller](https://github.com/google/syzkaller). syzkaller is an unsupervised, coverage-guided kernel fuzzer
1. [linux-kernel-exploitation](https://github.com/xairy/linux-kernel-exploitation). A bunch of links related to Linux kernel exploitation
1. [nsjail](https://github.com/google/nsjail). A light-weight process isolation tool, making use of Linux namespaces and seccomp-bpf syscall filters (with help of the kafel bpf language)
1. [edb-debugger](https://github.com/eteran/edb-debugger). edb is a cross platform x86/x86-64 debugger.
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.
1. [Note](https://github.com/scalad/Note). 常规Java工具，算法，加密，数据库，面试题，源代码分析，解决方案
1. [bane](https://github.com/genuinetools/bane). Custom & better AppArmor profile generator for Docker containers.
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client
1. [contained.af](https://github.com/genuinetools/contained.af). A stupid game for learning about containers, capabilities, and syscalls.
1. [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy). Detect it Easy
1. [bleachbit](https://github.com/bleachbit/bleachbit). BleachBit system cleaner for Windows and Linux
1. [amicontained](https://github.com/genuinetools/amicontained). Container introspection tool. Find out what container runtime is being used as well as features available.
1. [SELKS](https://github.com/StamusNetworks/SELKS). A Suricata based IDS/IPS distro


## list

1. [android-security-awesome](https://github.com/ashishb/android-security-awesome). A collection of android security related resources
1. [awesome-incident-response](https://github.com/meirwah/awesome-incident-response). A curated list of tools for incident response
1. [awesome-web-security](https://github.com/qazbnm456/awesome-web-security). 🐶 A curated list of Web Security materials and resources.
1. [awesome-checker-services](https://github.com/Brunty/awesome-checker-services). ✅ List of links to the various checkers out there on the web for sites, domains, security etc.


## log-analysis

1. [graylog2-server](https://github.com/Graylog2/graylog2-server). Free and open source log management
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## loganalyzer

1. [ossec-hids](https://github.com/ossec/ossec-hids). OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## logging

1. [graylog2-server](https://github.com/Graylog2/graylog2-server). Free and open source log management
1. [sigma](https://github.com/Neo23x0/sigma). Generic Signature Format for SIEM Systems


## login

1. [buttercup-desktop](https://github.com/buttercup/buttercup-desktop). :key: Javascript Password Vault - Multi-Platform Desktop Application
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## logs

1. [spring-boot](https://github.com/timebusker/spring-boot). spring-boot 项目实践总结
1. [rita](https://github.com/activecm/rita). Real Intelligence Threat Analytics


## lua

1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE


## mac

1. [security-growler](https://github.com/pirate/security-growler). :satellite: A Mac menubar app that notifies you whenever SSH, VNC, sudo, or other auth events occur.
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## machine-learning

1. [cs-video-courses](https://github.com/Developer-Y/cs-video-courses). List of Computer Science courses with video lectures.
1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [cleverhans](https://github.com/tensorflow/cleverhans). An adversarial example library for constructing attacks, building defenses, and benchmarking both


## macos

1. [macOS-Security-and-Privacy-Guide](https://github.com/drduh/macOS-Security-and-Privacy-Guide). A practical guide to securing macOS.
1. [fail2ban](https://github.com/fail2ban/fail2ban). Daemon to ban hosts that cause multiple authentication errors
1. [Valet](https://github.com/square/Valet). Valet lets you securely store data in the iOS, tvOS, or macOS Keychain without knowing a thing about how the Keychain works. It’s easy. We promise.
1. [KeychainCracker](https://github.com/macmade/KeychainCracker). macOS keychain cracking tool
1. [osx-and-ios-security-awesome](https://github.com/ashishb/osx-and-ios-security-awesome). OSX and iOS related security tools
1. [EllipticCurveKeyPair](https://github.com/agens-no/EllipticCurveKeyPair). Sign, verify, encrypt and decrypt using the Secure Enclave


## macros

1. [oletools](https://github.com/decalage2/oletools). oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
1. [ViperMonkey](https://github.com/decalage2/ViperMonkey). A VBA parser and emulation engine to analyze malicious macros.


## malware

1. [wifiphisher](https://github.com/wifiphisher/wifiphisher). The Rogue Access Point Framework
1. [maltrail](https://github.com/stamparm/maltrail). Malicious traffic detection system


## malware-analysis

1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)
1. [oletools](https://github.com/decalage2/oletools). oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
1. [ViperMonkey](https://github.com/decalage2/ViperMonkey). A VBA parser and emulation engine to analyze malicious macros.


## malware-detection

1. [binaryalert](https://github.com/airbnb/binaryalert). BinaryAlert: Serverless, Real-time & Retroactive Malware Detection
1. [dagda](https://github.com/eliasgranderubio/dagda). a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities


## man-in-the-middle

1. [mitmproxy](https://github.com/mitmproxy/mitmproxy). An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
1. [bettercap](https://github.com/evilsocket/bettercap). DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.


## messenger

1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client


## microservices

1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [express-gateway](https://github.com/ExpressGateway/express-gateway). A microservices API Gateway built on top of ExpressJS


## middleware

1. [helmet](https://github.com/helmetjs/helmet). Help secure Express apps with various HTTP headers
1. [secure](https://github.com/unrolled/secure). HTTP middleware for Go that facilitates some quick security wins.
1. [nosurf](https://github.com/justinas/nosurf). CSRF protection middleware for Go.


## mips

1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## mitm

1. [bettercap](https://github.com/evilsocket/bettercap). DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [Seth](https://github.com/SySS-Research/Seth). Perform a MitM attack and extract clear text credentials from RDP connections


## mobile

1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [drozer](https://github.com/mwrlabs/drozer). The Leading Security Assessment Framework for Android.
1. [OnionBrowser](https://github.com/mtigas/OnionBrowser). An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network
1. [needle](https://github.com/mwrlabs/needle). The iOS Security Testing Framework
1. [objection](https://github.com/sensepost/objection). 📱 objection - runtime mobile exploration


## mobile-app

1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [zmNinja](https://github.com/pliablepixels/zmNinja). High performance, cross platform ionic app for Home/Commerical Security Surveillance using ZoneMinder or other NVRs


## mobile-security

1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.
1. [StaCoAn](https://github.com/vincentcox/StaCoAn). StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.


## monitor

1. [snyk](https://github.com/snyk/snyk). CLI and build-time tool to find & fix known vulnerabilities in open-source dependencies
1. [trape](https://github.com/boxug/trape). People tracker on the Internet: Learn to track the world, to avoid being traced.


## monitoring

1. [osquery](https://github.com/facebook/osquery). SQL powered operating system instrumentation, monitoring, and analytics.
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [processhacker](https://github.com/processhacker/processhacker). A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
1. [sigma](https://github.com/Neo23x0/sigma). Generic Signature Format for SIEM Systems
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security
1. [SELKS](https://github.com/StamusNetworks/SELKS). A Suricata based IDS/IPS distro


## nacl

1. [sigmavpn](https://github.com/neilalexander/sigmavpn). Light-weight, secure and modular VPN solution
1. [nacl](https://github.com/kevinburke/nacl). Pure Go implementation of the NaCL set of API's


## netty

1. [elasticsearch-readonlyrest-plugin](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin). Free Elasticsearch and Kibana security plugin: super-easy Kibana multi-tenancy, Encryption, Authentication, Authorization, Auditing
1. [protools](https://github.com/SeanDragon/protools). 历经开发周期两年，并且应用过千万级别项目的工具箱


## network

1. [setup-ipsec-vpn](https://github.com/hwdsl2/setup-ipsec-vpn). Scripts to build your own IPsec VPN server, with IPsec/L2TP and Cisco IPsec on Ubuntu, Debian and CentOS
1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [meshbird](https://github.com/meshbird/meshbird). Distributed private networking
1. [docker-ipsec-vpn-server](https://github.com/hwdsl2/docker-ipsec-vpn-server). Docker image to run an IPsec VPN server, with IPsec/L2TP and Cisco IPsec
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.
1. [xray](https://github.com/evilsocket/xray). XRay is a tool for recon, mapping and OSINT gathering from public networks.
1. [xiringuito](https://github.com/ivanilves/xiringuito). SSH-based "VPN for poors"
1. [metta](https://github.com/uber-common/metta). An information security preparedness tool to do adversarial simulation.
1. [SELKS](https://github.com/StamusNetworks/SELKS). A Suricata based IDS/IPS distro


## network-analysis

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.


## network-discovery

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.


## network-monitoring

1. [maltrail](https://github.com/stamparm/maltrail). Malicious traffic detection system
1. [bro](https://github.com/bro/bro). Bro is a powerful network analysis framework that is much different from the typical IDS you may know.  Official mirror of git.bro.org/bro.git .
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.
1. [suricata](https://github.com/OISF/suricata). Suricata git repository maintained by the OISF


## network-security

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.


## network-visualization

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.


## networking

1. [opensnitch](https://github.com/evilsocket/opensnitch). OpenSnitch is a GNU/Linux port of the Little Snitch application firewall.
1. [cilium](https://github.com/cilium/cilium). HTTP, gRPC, and Kafka Aware Security and Networking for Containers with BPF and XDP
1. [felix](https://github.com/projectcalico/felix). Project Calico's per-host agent Felix, responsible for programming routes and security policy.
1. [metta](https://github.com/uber-common/metta). An information security preparedness tool to do adversarial simulation.
1. [kubernetes-network-policy-recipes](https://github.com/ahmetb/kubernetes-network-policy-recipes). Tutorials and Recipes for Kubernetes Network Policies feature


## nginx

1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator


## nmap

1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
1. [Seccubus](https://github.com/schubergphilis/Seccubus). Easy automated vulnerability scanning, reporting and analysis


## nmap-scripts

1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE


## nodejs

1. [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator). A powerful obfuscator for JavaScript and Node.js
1. [notes](https://github.com/ChALkeR/notes). Some public notes
1. [accesscontrol](https://github.com/onury/accesscontrol). Role and Attribute based Access Control for Node.js
1. [protect](https://github.com/RisingStack/protect). Proactively protect your Node.js web services
1. [NodeJsScan](https://github.com/ajinabraham/NodeJsScan). NodeJsScan is a static security code scanner for Node.js applications.


## nsm

1. [bro](https://github.com/bro/bro). Bro is a powerful network analysis framework that is much different from the typical IDS you may know.  Official mirror of git.bro.org/bro.git .
1. [suricata](https://github.com/OISF/suricata). Suricata git repository maintained by the OISF


## oauth

1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## oauth2

1. [API-Security-Checklist](https://github.com/shieldfy/API-Security-Checklist). Checklist of the most important security countermeasures when designing, testing, and releasing your API
1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [IdentityServer4](https://github.com/IdentityServer/IdentityServer4). OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
1. [express-gateway](https://github.com/ExpressGateway/express-gateway). A microservices API Gateway built on top of ExpressJS
1. [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt). Ultimate Javascript Object Signing and Encryption (JOSE) and JSON Web Token (JWT) Implementation for .NET and .NET Core
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4


## obfuscator

1. [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator). A powerful obfuscator for JavaScript and Node.js
1. [Hikari](https://github.com/HikariObfuscator/Hikari). LLVM Obfuscator


## oci

1. [pouch](https://github.com/alibaba/pouch). Pouch is an open-source project created to promote the container technology movement.
1. [runtime](https://github.com/clearcontainers/runtime). OCI (Open Containers Initiative) compatible runtime using Virtual Machines
1. [cc-oci-runtime](https://github.com/intel/cc-oci-runtime). OCI (Open Containers Initiative) compatible runtime for Intel® Architecture


## opencontainers

1. [bane](https://github.com/genuinetools/bane). Custom & better AppArmor profile generator for Docker containers.
1. [contained.af](https://github.com/genuinetools/contained.af). A stupid game for learning about containers, capabilities, and syscalls.
1. [amicontained](https://github.com/genuinetools/amicontained). Container introspection tool. Find out what container runtime is being used as well as features available.


## openid

1. [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt). Ultimate Javascript Object Signing and Encryption (JOSE) and JSON Web Token (JWT) Implementation for .NET and .NET Core
1. [AspNet5IdentityServerAngularImplicitFlow](https://github.com/damienbod/AspNet5IdentityServerAngularImplicitFlow). OpenID Connect Implicit Flow with Angular and ASP.NET Core 2.0 IdentityServer4


## openid-connect

1. [hydra](https://github.com/ory/hydra). OAuth2 server with OpenID Connect - cloud native, security-first, open source API security for your infrastructure. Written in Go. SDKs for any language.
1. [IdentityServer4](https://github.com/IdentityServer/IdentityServer4). OpenID Connect and OAuth 2.0 Framework for ASP.NET Core
1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [fosite](https://github.com/ory/fosite). Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## openpgp

1. [hawkpost](https://github.com/whitesmith/hawkpost). Generate links that users can use to submit messages encrypted with your public key.
1. [GlobaLeaks](https://github.com/globaleaks/GlobaLeaks). GlobaLeaks - The Open-Source Whistleblowing Software


## openssl

1. [i2pd](https://github.com/PurpleI2P/i2pd).  🛡 I2P: End-to-End encrypted and anonymous Internet
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com


## osint

1. [gitrob](https://github.com/michenriksen/gitrob). Reconnaissance tool for GitHub organizations
1. [aquatone](https://github.com/michenriksen/aquatone). A Tool for Domain Flyovers
1. [xray](https://github.com/evilsocket/xray). XRay is a tool for recon, mapping and OSINT gathering from public networks.
1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [trape](https://github.com/boxug/trape). People tracker on the Internet: Learn to track the world, to avoid being traced.
1. [intrigue-core](https://github.com/intrigueio/intrigue-core). Discover your attack surface!
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## ossec

1. [ossec-hids](https://github.com/ossec/ossec-hids). OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## osx

1. [macOS-Security-and-Privacy-Guide](https://github.com/drduh/macOS-Security-and-Privacy-Guide). A practical guide to securing macOS.
1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client
1. [osx-and-ios-security-awesome](https://github.com/ashishb/osx-and-ios-security-awesome). OSX and iOS related security tools


## owasp

1. [awesome-appsec](https://github.com/paragonie/awesome-appsec). A curated list of resources for learning about application security
1. [bluemonday](https://github.com/microcosm-cc/bluemonday). bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
1. [owtf](https://github.com/owtf/owtf). Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient @owtfp http://owtf.org
1. [find-sec-bugs](https://github.com/find-sec-bugs/find-sec-bugs). The FindBugs plugin for security audits of Java web applications and Android applications. (Also work with Groovy and Scala projects)
1. [django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo). DefectDojo is an open-source defect tracking application


## packet-crafting

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [scapy](https://github.com/phaethon/scapy). Network packet and pcap file crafting/sniffing/manipulation/visualization security tool (based on scapy) with python3 compatibility


## parser

1. [oletools](https://github.com/decalage2/oletools). oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
1. [ViperMonkey](https://github.com/decalage2/ViperMonkey). A VBA parser and emulation engine to analyze malicious macros.


## password

1. [keeweb](https://github.com/keeweb/keeweb). Free cross-platform password manager compatible with KeePass
1. [KeychainCracker](https://github.com/macmade/KeychainCracker). macOS keychain cracking tool
1. [Passhunt](https://github.com/Viralmaniar/Passhunt). Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords.


## password-manager

1. [keeweb](https://github.com/keeweb/keeweb). Free cross-platform password manager compatible with KeePass
1. [buttercup-desktop](https://github.com/buttercup/buttercup-desktop). :key: Javascript Password Vault - Multi-Platform Desktop Application
1. [passbolt_api](https://github.com/passbolt/passbolt_api). Passbolt backend, a JSON API written with Cakephp
1. [mooltipass](https://github.com/limpkin/mooltipass). Github repository dedicated to the mooltipass project


## passwords

1. [sites-using-cloudflare](https://github.com/pirate/sites-using-cloudflare). :broken_heart: Archived list of domains using Cloudflare DNS at the time of the CloudBleed announcement.
1. [mooltipass](https://github.com/limpkin/mooltipass). Github repository dedicated to the mooltipass project


## paste

1. [piknik](https://github.com/jedisct1/piknik). Copy/paste anything over the network
1. [PrivateBin](https://github.com/PrivateBin/PrivateBin). A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.


## pcap

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [bro](https://github.com/bro/bro). Bro is a powerful network analysis framework that is much different from the typical IDS you may know.  Official mirror of git.bro.org/bro.git .
1. [scapy](https://github.com/phaethon/scapy). Network packet and pcap file crafting/sniffing/manipulation/visualization security tool (based on scapy) with python3 compatibility


## pci-dss

1. [ossec-hids](https://github.com/ossec/ossec-hids). OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security
1. [scap-security-guide](https://github.com/OpenSCAP/scap-security-guide). Baseline compliance content in SCAP formats


## penetration

1. [awesome-ctf](https://github.com/apsdehal/awesome-ctf). A curated list of CTF frameworks, libraries, resources and softwares
1. [evilgrade](https://github.com/infobyte/evilgrade). 


## penetration-testing

1. [Awesome-Hacking](https://github.com/Hack-with-Github/Awesome-Hacking). A collection of various awesome lists for hackers, pentesters and security researchers
1. [nishang](https://github.com/samratashok/nishang). Nishang - PowerShell for penetration testing and offensive security. 
1. [faraday](https://github.com/infobyte/faraday). Collaborative Penetration Test and Vulnerability Management Platform
1. [awesome-infosec](https://github.com/onlurking/awesome-infosec).  A curated list of awesome infosec courses and training resources.
1. [Free-Security-eBooks](https://github.com/Hack-with-Github/Free-Security-eBooks). Free Security and Hacking eBooks
1. [WhatWeb](https://github.com/urbanadventurer/WhatWeb). Next generation web scanner
1. [awesome-web-security](https://github.com/qazbnm456/awesome-web-security). 🐶 A curated list of Web Security materials and resources.
1. [awesome-pentest-cheat-sheets](https://github.com/coreb1t/awesome-pentest-cheat-sheets). Collection of the cheat sheets useful for pentesting
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [Passhunt](https://github.com/Viralmaniar/Passhunt). Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords.
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
1. [htshells](https://github.com/wireghoul/htshells). Self contained htaccess shells and attacks
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.
1. [changeme](https://github.com/ztgrace/changeme). A default credential scanner.
1. [intrigue-core](https://github.com/intrigueio/intrigue-core). Discover your attack surface!


## pentest

1. [awesome-infosec](https://github.com/onlurking/awesome-infosec).  A curated list of awesome infosec courses and training resources.
1. [dirsearch](https://github.com/maurosoria/dirsearch). Web path scanner
1. [pentest-wiki](https://github.com/nixawk/pentest-wiki). PENTEST-WIKI is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others.
1. [awesome-pentest-cheat-sheets](https://github.com/coreb1t/awesome-pentest-cheat-sheets). Collection of the cheat sheets useful for pentesting
1. [owtf](https://github.com/owtf/owtf). Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient @owtfp http://owtf.org
1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [evilgrade](https://github.com/infobyte/evilgrade). 
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [objection](https://github.com/sensepost/objection). 📱 objection - runtime mobile exploration
1. [filterbypass](https://github.com/masatokinugawa/filterbypass). 
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.


## pentest-tool

1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [Passhunt](https://github.com/Viralmaniar/Passhunt). Passhunt is a simple tool for searching of default credentials for network devices, web applications and more. Search through 523 vendors and their 2084 default passwords.
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.


## pentest-tools

1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.


## pentesting

1. [faraday](https://github.com/infobyte/faraday). Collaborative Penetration Test and Vulnerability Management Platform
1. [xunfeng](https://github.com/ysrc/xunfeng). 巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
1. [drozer](https://github.com/mwrlabs/drozer). The Leading Security Assessment Framework for Android.
1. [needle](https://github.com/mwrlabs/needle). The iOS Security Testing Framework
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [DeathStar](https://github.com/byt3bl33d3r/DeathStar). Automate getting Domain Admin using Empire (https://github.com/EmpireProject/Empire)
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
1. [GourdScanV2](https://github.com/ysrc/GourdScanV2). 被动式漏洞扫描系统
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## performance

1. [sonarwhal](https://github.com/sonarwhal/sonarwhal). A linting tool for the web
1. [processhacker](https://github.com/processhacker/processhacker). A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
1. [sozu](https://github.com/sozu-proxy/sozu). Sōzu HTTP reverse proxy, configurable at runtime, fast and safe, built in Rust. It will be awesome when it will be ready. Not So Secret Project! Ping us on gitter to know more


## permissions

1. [bouncer](https://github.com/JosephSilber/bouncer). Eloquent roles and abilities.
1. [sentinel](https://github.com/cartalyst/sentinel). A framework agnostic authentication & authorization system.
1. [lock](https://github.com/BeatSwitch/lock). A flexible, driver based Acl package for PHP 5.4+
1. [accesscontrol](https://github.com/onury/accesscontrol). Role and Attribute based Access Control for Node.js


## phishing

1. [wifiphisher](https://github.com/wifiphisher/wifiphisher). The Rogue Access Point Framework
1. [gophish](https://github.com/gophish/gophish). Open-Source Phishing Toolkit
1. [FiercePhish](https://github.com/Raikia/FiercePhish). FiercePhish is a full-fledged phishing framework to manage all phishing engagements.  It allows you to track separate phishing campaigns, schedule sending of emails, and much more.
1. [king-phisher](https://github.com/securestate/king-phisher). Phishing Campaign Toolkit


## php

1. [DVWA](https://github.com/ethicalhack3r/DVWA). Damn Vulnerable Web Application (DVWA)
1. [bouncer](https://github.com/JosephSilber/bouncer). Eloquent roles and abilities.
1. [iniscan](https://github.com/psecio/iniscan). A php.ini scanner for best security practices
1. [sentinel](https://github.com/cartalyst/sentinel). A framework agnostic authentication & authorization system.
1. [captcha](https://github.com/mewebstudio/captcha). Captcha for Laravel 5
1. [lock](https://github.com/BeatSwitch/lock). A flexible, driver based Acl package for PHP 5.4+
1. [security-checker](https://github.com/sensiolabs/security-checker). PHP frontend for security.sensiolabs.org
1. [exploits](https://github.com/XiphosResearch/exploits). Miscellaneous exploit code
1. [PrivateBin](https://github.com/PrivateBin/PrivateBin). A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
1. [Captcha](https://github.com/Gregwar/Captcha). PHP Captcha library
1. [pcc](https://github.com/sektioneins/pcc). PHP Secure Configuration Checker
1. [security](https://github.com/symfony/security). The Security component provides a complete security system for your web application.
1. [laravel-url-signer](https://github.com/spatie/laravel-url-signer). Create and validate signed URLs with a limited lifetime
1. [security-bundle](https://github.com/symfony/security-bundle). The security system is one of the most powerful parts of Symfony and can largely be controlled via its configuration.
1. [csp-builder](https://github.com/paragonie/csp-builder). Build Content-Security-Policy headers from a JSON file (or build them programmatically)
1. [airship](https://github.com/paragonie/airship). Secure Content Management for the Modern Web - "The sky is only the beginning"
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [latte](https://github.com/nette/latte). ☕ Latte: the intuitive and fast template engine for those who want the most secure PHP sites.


## php-extension

1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium
1. [libsodium-php](https://github.com/jedisct1/libsodium-php). PHP extension for libsodium


## play-framework

1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## poc

1. [exploits](https://github.com/XiphosResearch/exploits). Miscellaneous exploit code
1. [Am-I-affected-by-Meltdown](https://github.com/raphaelsc/Am-I-affected-by-Meltdown). Meltdown Exploit / Proof-of-concept / checks whether system is affected by Variant 3: rogue data cache load (CVE-2017-5754), a.k.a MELTDOWN.


## policy

1. [security-txt](https://github.com/securitytxt/security-txt). A proposed standard that allows websites to define security policies.
1. [felix](https://github.com/projectcalico/felix). Project Calico's per-host agent Felix, responsible for programming routes and security policy.


## policy-monitoring

1. [ossec-hids](https://github.com/ossec/ossec-hids). OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security


## powerpc

1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## powershell

1. [nishang](https://github.com/samratashok/nishang). Nishang - PowerShell for penetration testing and offensive security. 
1. [PowerShdll](https://github.com/p3nt4/PowerShdll). Run PowerShell with rundll32. Bypass software restrictions.
1. [GoFetch](https://github.com/GoFetchAD/GoFetch). GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application.


## privacy

1. [macOS-Security-and-Privacy-Guide](https://github.com/drduh/macOS-Security-and-Privacy-Guide). A practical guide to securing macOS.
1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [meshbird](https://github.com/meshbird/meshbird). Distributed private networking
1. [cryptomator](https://github.com/cryptomator/cryptomator). Multi-platform transparent client-side encryption of your files in the cloud
1. [decentraleyes](https://github.com/Synzvato/decentraleyes). Decentraleyes - Local emulation of Content Delivery Networks.
1. [user.js](https://github.com/pyllyukko/user.js). user.js -- Firefox configuration hardening
1. [OnionBrowser](https://github.com/mtigas/OnionBrowser). An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network
1. [privacy-respecting](https://github.com/nikitavoloboev/privacy-respecting). 🔐 Curated List of Privacy Respecting Services and Software
1. [i2pd](https://github.com/PurpleI2P/i2pd).  🛡 I2P: End-to-End encrypted and anonymous Internet
1. [toxic](https://github.com/JFreegman/toxic). An ncurses-based Tox client
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [ghacks-user.js](https://github.com/ghacksuserjs/ghacks-user.js). An ongoing comprehensive user.js template for configuring and hardening Firefox privacy, security and anti-fingerprinting
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera
1. [bleachbit](https://github.com/bleachbit/bleachbit). BleachBit system cleaner for Windows and Linux


## program-analysis

1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform


## protection

1. [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator). A powerful obfuscator for JavaScript and Node.js
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera


## proxy

1. [mitmproxy](https://github.com/mitmproxy/mitmproxy). An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
1. [bettercap](https://github.com/evilsocket/bettercap). DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [sozu](https://github.com/sozu-proxy/sozu). Sōzu HTTP reverse proxy, configurable at runtime, fast and safe, built in Rust. It will be awesome when it will be ready. Not So Secret Project! Ping us on gitter to know more
1. [ghostunnel](https://github.com/square/ghostunnel). A simple SSL/TLS proxy with mutual authentication for securing non-TLS services


## pyparsing

1. [oletools](https://github.com/decalage2/oletools). oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
1. [ViperMonkey](https://github.com/decalage2/ViperMonkey). A VBA parser and emulation engine to analyze malicious macros.


## python

1. [mitmproxy](https://github.com/mitmproxy/mitmproxy). An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
1. [wifiphisher](https://github.com/wifiphisher/wifiphisher). The Rogue Access Point Framework
1. [routersploit](https://github.com/reverse-shell/routersploit). The Router Exploitation Framework
1. [fail2ban](https://github.com/fail2ban/fail2ban). Daemon to ban hosts that cause multiple authentication errors
1. [AutoSploit](https://github.com/NullArray/AutoSploit). Automated Mass Exploiter
1. [maltrail](https://github.com/stamparm/maltrail). Malicious traffic detection system
1. [onionshare](https://github.com/micahflee/onionshare). Securely and anonymously share a file of any size
1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [sslyze](https://github.com/nabla-c0d3/sslyze). Fast and powerful SSL/TLS server scanning library.
1. [MozDef](https://github.com/mozilla/MozDef). MozDef: The Mozilla Defense Platform
1. [itsdangerous](https://github.com/pallets/itsdangerous). Various helpers to pass trusted data to untrusted environments
1. [dirsearch](https://github.com/maurosoria/dirsearch). Web path scanner
1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.
1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool
1. [exploits](https://github.com/XiphosResearch/exploits). Miscellaneous exploit code
1. [owtf](https://github.com/owtf/owtf). Offensive Web Testing Framework (OWTF), is a framework which tries to unite great tools and make pen testing more efficient @owtfp http://owtf.org
1. [security-growler](https://github.com/pirate/security-growler). :satellite: A Mac menubar app that notifies you whenever SSH, VNC, sudo, or other auth events occur.
1. [hawkpost](https://github.com/whitesmith/hawkpost). Generate links that users can use to submit messages encrypted with your public key.
1. [tuf](https://github.com/theupdateframework/tuf). A framework for securing software update systems
1. [needle](https://github.com/mwrlabs/needle). The iOS Security Testing Framework
1. [subuser](https://github.com/subuser-security/subuser). Run programs on linux with selectively restricted permissions.
1. [king-phisher](https://github.com/securestate/king-phisher). Phishing Campaign Toolkit
1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [featherduster](https://github.com/nccgroup/featherduster). An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
1. [DeathStar](https://github.com/byt3bl33d3r/DeathStar). Automate getting Domain Admin using Empire (https://github.com/EmpireProject/Empire)
1. [oletools](https://github.com/decalage2/oletools). oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
1. [BrainDamage](https://github.com/mehulj94/BrainDamage). Remote administration tool which uses Telegram as a C&C server
1. [yosai](https://github.com/YosaiProject/yosai). A Security Framework for Python applications featuring Authorization (rbac permissions and roles), Authentication (2fa totp), Session Management and an extensive Audit Trail
1. [Flask-HTTPAuth](https://github.com/miguelgrinberg/Flask-HTTPAuth). Simple extension that provides Basic, Digest and Token HTTP authentication for Flask routes
1. [changeme](https://github.com/ztgrace/changeme). A default credential scanner.
1. [metta](https://github.com/uber-common/metta). An information security preparedness tool to do adversarial simulation.
1. [conpot](https://github.com/mushorg/conpot). ICS/SCADA honeypot
1. [django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo). DefectDojo is an open-source defect tracking application
1. [GlobaLeaks](https://github.com/globaleaks/GlobaLeaks). GlobaLeaks - The Open-Source Whistleblowing Software
1. [exitmap](https://github.com/NullHypothesis/exitmap). A fast and modular scanner for Tor exit relays.
1. [bleachbit](https://github.com/bleachbit/bleachbit). BleachBit system cleaner for Windows and Linux
1. [ViperMonkey](https://github.com/decalage2/ViperMonkey). A VBA parser and emulation engine to analyze malicious macros.


## python2

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.


## python3

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [hawkpost](https://github.com/whitesmith/hawkpost). Generate links that users can use to submit messages encrypted with your public key.
1. [scapy](https://github.com/phaethon/scapy). Network packet and pcap file crafting/sniffing/manipulation/visualization security tool (based on scapy) with python3 compatibility


## rails

1. [brakeman](https://github.com/presidentbeef/brakeman). A static analysis security vulnerability scanner for Ruby on Rails applications
1. [Portus](https://github.com/SUSE/Portus). Authorization service and frontend for Docker registry (v2)
1. [zen-rails-security-checklist](https://github.com/brunofacca/zen-rails-security-checklist). Checklist of security precautions for Ruby on Rails applications.
1. [rails-security-checklist](https://github.com/eliotsykes/rails-security-checklist). :key: Community-driven Rails Security Checklist (see our GitHub Issues for the newest checks that aren't yet in the README)
1. [best-practices-badge](https://github.com/coreinfrastructure/best-practices-badge). Core Infrastructure Initiative Best Practices Badge
1. [dawnscanner](https://github.com/thesp0nge/dawnscanner). Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
1. [railsgoat](https://github.com/OWASP/railsgoat). A vulnerable version of Rails that follows the OWASP Top 10
1. [invisible_captcha](https://github.com/markets/invisible_captcha). :honey_pot: Unobtrusive and flexible spam protection for Rails apps


## rbac

1. [yosai](https://github.com/YosaiProject/yosai). A Security Framework for Python applications featuring Authorization (rbac permissions and roles), Authentication (2fa totp), Session Management and an extensive Audit Trail
1. [accesscontrol](https://github.com/onury/accesscontrol). Role and Attribute based Access Control for Node.js


## reconnaissance

1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [intrigue-core](https://github.com/intrigueio/intrigue-core). Discover your attack surface!


## red-team

1. [nishang](https://github.com/samratashok/nishang). Nishang - PowerShell for penetration testing and offensive security. 
1. [Cloakify](https://github.com/TryCatchHCF/Cloakify). CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings; Evade DLP/MLS Devices; Defeat Data Whitelisting Controls; Social Engineering of Analysts; Evade AV Detection
1. [DumpsterFire](https://github.com/TryCatchHCF/DumpsterFire). "Security Incidents In A Box!"   A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.


## redis

1. [spring-boot](https://github.com/timebusker/spring-boot). spring-boot 项目实践总结
1. [metta](https://github.com/uber-common/metta). An information security preparedness tool to do adversarial simulation.


## reverse-engineering

1. [x64dbg](https://github.com/x64dbg/x64dbg). An open-source x64/x32 debugger for windows.
1. [Awesome-Hacking](https://github.com/Hack-with-Github/Awesome-Hacking). A collection of various awesome lists for hackers, pentesters and security researchers
1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [panopticon](https://github.com/das-labor/panopticon). A libre cross-platform disassembler.
1. [edb-debugger](https://github.com/eteran/edb-debugger). edb is a cross platform x86/x86-64 debugger.
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.
1. [CTF-All-In-One](https://github.com/firmianay/CTF-All-In-One). 一本 CTF 书
1. [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy). Detect it Easy


## roles

1. [bouncer](https://github.com/JosephSilber/bouncer). Eloquent roles and abilities.
1. [sentinel](https://github.com/cartalyst/sentinel). A framework agnostic authentication & authorization system.
1. [accesscontrol](https://github.com/onury/accesscontrol). Role and Attribute based Access Control for Node.js


## ruby

1. [brakeman](https://github.com/presidentbeef/brakeman). A static analysis security vulnerability scanner for Ruby on Rails applications
1. [Portus](https://github.com/SUSE/Portus). Authorization service and frontend for Docker registry (v2)
1. [zen-rails-security-checklist](https://github.com/brunofacca/zen-rails-security-checklist). Checklist of security precautions for Ruby on Rails applications.
1. [WhatWeb](https://github.com/urbanadventurer/WhatWeb). Next generation web scanner
1. [dawnscanner](https://github.com/thesp0nge/dawnscanner). Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
1. [railsgoat](https://github.com/OWASP/railsgoat). A vulnerable version of Rails that follows the OWASP Top 10


## ruby-cli

1. [gitrob](https://github.com/michenriksen/gitrob). Reconnaissance tool for GitHub organizations
1. [aquatone](https://github.com/michenriksen/aquatone). A Tool for Domain Flyovers


## ruby-on-rails

1. [zen-rails-security-checklist](https://github.com/brunofacca/zen-rails-security-checklist). Checklist of security precautions for Ruby on Rails applications.
1. [rails-security-checklist](https://github.com/eliotsykes/rails-security-checklist). :key: Community-driven Rails Security Checklist (see our GitHub Issues for the newest checks that aren't yet in the README)
1. [railsgoat](https://github.com/OWASP/railsgoat). A vulnerable version of Rails that follows the OWASP Top 10


## rust

1. [panopticon](https://github.com/das-labor/panopticon). A libre cross-platform disassembler.
1. [ring](https://github.com/briansmith/ring). Safe, fast, small crypto using Rust
1. [sozu](https://github.com/sozu-proxy/sozu). Sōzu HTTP reverse proxy, configurable at runtime, fast and safe, built in Rust. It will be awesome when it will be ready. Not So Secret Project! Ping us on gitter to know more
1. [edgedns](https://github.com/jedisct1/edgedns). A high performance DNS cache designed for Content Delivery Networks


## saml

1. [pac4j](https://github.com/pac4j/pac4j). Security engine for Java (authentication, authorization, multi frameworks): OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## scan

1. [dockerscan](https://github.com/cr0hn/dockerscan). Docker security analysis & hacking tools
1. [slurp](https://github.com/bbb31/slurp). Enumerate S3 buckets via certstream, domain, or keywords


## scanner

1. [routersploit](https://github.com/reverse-shell/routersploit). The Router Exploitation Framework
1. [retire.js](https://github.com/RetireJS/retire.js). scanner detecting the use of JavaScript libraries with known vulnerabilities
1. [xunfeng](https://github.com/ysrc/xunfeng). 巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
1. [iniscan](https://github.com/psecio/iniscan). A php.ini scanner for best security practices
1. [WhatWeb](https://github.com/urbanadventurer/WhatWeb). Next generation web scanner
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
1. [slurp](https://github.com/bbb31/slurp). Enumerate S3 buckets via certstream, domain, or keywords
1. [SQLiScanner](https://github.com/0xbug/SQLiScanner). Automatic SQL injection with Charles and sqlmap api
1. [GourdScanV2](https://github.com/ysrc/GourdScanV2). 被动式漏洞扫描系统
1. [exitmap](https://github.com/NullHypothesis/exitmap). A fast and modular scanner for Tor exit relays.


## scanning

1. [processhacker](https://github.com/processhacker/processhacker). A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
1. [Reconnoitre](https://github.com/codingo/Reconnoitre). A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
1. [rita](https://github.com/activecm/rita). Real Intelligence Threat Analytics


## scans

1. [sslyze](https://github.com/nabla-c0d3/sslyze). Fast and powerful SSL/TLS server scanning library.
1. [ivre](https://github.com/cea-sec/ivre). Network recon framework.


## scapy

1. [scapy](https://github.com/secdev/scapy). Scapy: the Python-based interactive packet manipulation program & library. Supports Python 2 & Python 3.
1. [scapy](https://github.com/phaethon/scapy). Network packet and pcap file crafting/sniffing/manipulation/visualization security tool (based on scapy) with python3 compatibility


## seccomp

1. [docker-slim](https://github.com/docker-slim/docker-slim). DockerSlim (docker-slim): Optimize and secure your Docker containers (free and open source)
1. [contained.af](https://github.com/genuinetools/contained.af). A stupid game for learning about containers, capabilities, and syscalls.


## secure

1. [cryptocat](https://github.com/cryptocat/cryptocat). Secure chat software for your computer.
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client
1. [airship](https://github.com/paragonie/airship). Secure Content Management for the Modern Web - "The sky is only the beginning"


## secure-by-default

1. [csp-builder](https://github.com/paragonie/csp-builder). Build Content-Security-Policy headers from a JSON file (or build them programmatically)
1. [airship](https://github.com/paragonie/airship). Secure Content Management for the Modern Web - "The sky is only the beginning"


## self-hosted

1. [privacy-respecting](https://github.com/nikitavoloboev/privacy-respecting). 🔐 Curated List of Privacy Respecting Services and Software
1. [PrivateBin](https://github.com/PrivateBin/PrivateBin). A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.


## serverless

1. [streamalert](https://github.com/airbnb/streamalert). StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
1. [binaryalert](https://github.com/airbnb/binaryalert). BinaryAlert: Serverless, Real-time & Retroactive Malware Detection


## service-discovery

1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [express-gateway](https://github.com/ExpressGateway/express-gateway). A microservices API Gateway built on top of ExpressJS


## siem

1. [graylog2-server](https://github.com/Graylog2/graylog2-server). Free and open source log management
1. [MozDef](https://github.com/mozilla/MozDef). MozDef: The Mozilla Defense Platform
1. [sigma](https://github.com/Neo23x0/sigma). Generic Signature Format for SIEM Systems
1. [nzyme](https://github.com/lennartkoopmann/nzyme). Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog (Open Source log management) setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode.


## signature

1. [jose-jwt](https://github.com/dvsekhvalnov/jose-jwt). Ultimate Javascript Object Signing and Encryption (JOSE) and JSON Web Token (JWT) Implementation for .NET and .NET Core
1. [Detect-It-Easy](https://github.com/horsicq/Detect-It-Easy). Detect it Easy


## smart-contracts

1. [smart-contract-best-practices](https://github.com/ConsenSys/smart-contract-best-practices). A guide to smart contract security best practices
1. [Solium](https://github.com/duaraghav8/Solium). Linter to identify and fix style & security issues in Solidity


## sniffing

1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.


## software-composition-analysis

1. [retire.js](https://github.com/RetireJS/retire.js). scanner detecting the use of JavaScript libraries with known vulnerabilities
1. [DependencyCheck](https://github.com/jeremylong/DependencyCheck). OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.


## solidity

1. [zeppelin-solidity](https://github.com/OpenZeppelin/zeppelin-solidity). OpenZeppelin, a framework to build secure smart contracts on Ethereum
1. [smart-contract-best-practices](https://github.com/ConsenSys/smart-contract-best-practices). A guide to smart contract security best practices
1. [Solium](https://github.com/duaraghav8/Solium). Linter to identify and fix style & security issues in Solidity


## sparc

1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## spoofing

1. [bettercap](https://github.com/evilsocket/bettercap). DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.


## spring

1. [spring-security](https://github.com/spring-projects/spring-security). Spring Security
1. [spring-boot](https://github.com/timebusker/spring-boot). spring-boot 项目实践总结
1. [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot). Jasypt integration for Spring boot


## spring-boot

1. [spring-boot](https://github.com/timebusker/spring-boot). spring-boot 项目实践总结
1. [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot). Jasypt integration for Spring boot


## sql

1. [osquery](https://github.com/facebook/osquery). SQL powered operating system instrumentation, monitoring, and analytics.
1. [play-pac4j](https://github.com/pac4j/play-pac4j). Security library for Play framework 2 in Java and Scala: OAuth, CAS, SAML, OpenID Connect, LDAP, JWT...


## sql-injection

1. [hacker101](https://github.com/Hacker0x01/hacker101). Hacker101
1. [DVWA](https://github.com/ethicalhack3r/DVWA). Damn Vulnerable Web Application (DVWA)
1. [protect](https://github.com/RisingStack/protect). Proactively protect your Node.js web services


## ssh

1. [teleport](https://github.com/gravitational/teleport). Modern SSH server for clusters and teams.
1. [YubiKey-Guide](https://github.com/drduh/YubiKey-Guide). Guide to using YubiKey as a SmartCard for GPG and SSH
1. [cowrie](https://github.com/micheloosterhof/cowrie). Cowrie SSH/Telnet Honeypot
1. [sshesame](https://github.com/jaksi/sshesame). A fake SSH server that lets everyone in and logs their activity
1. [xiringuito](https://github.com/ivanilves/xiringuito). SSH-based "VPN for poors"


## ssh-tunnel

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation


## ssl

1. [mitmproxy](https://github.com/mitmproxy/mitmproxy). An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
1. [sites-using-cloudflare](https://github.com/pirate/sites-using-cloudflare). :broken_heart: Archived list of domains using Cloudflare DNS at the time of the CloudBleed announcement.
1. [sslyze](https://github.com/nabla-c0d3/sslyze). Fast and powerful SSL/TLS server scanning library.
1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator
1. [ghostunnel](https://github.com/square/ghostunnel). A simple SSL/TLS proxy with mutual authentication for securing non-TLS services
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com


## ssllabs

1. [sslyze](https://github.com/nabla-c0d3/sslyze). Fast and powerful SSL/TLS server scanning library.
1. [Seccubus](https://github.com/schubergphilis/Seccubus). Easy automated vulnerability scanning, reporting and analysis


## sslstrip

1. [bettercap](https://github.com/evilsocket/bettercap). DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.


## static-analysis

1. [brakeman](https://github.com/presidentbeef/brakeman). A static analysis security vulnerability scanner for Ruby on Rails applications
1. [panopticon](https://github.com/das-labor/panopticon). A libre cross-platform disassembler.
1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [sobelow](https://github.com/nccgroup/sobelow). Security-focused static analysis for the Phoenix Framework
1. [Solium](https://github.com/duaraghav8/Solium). Linter to identify and fix style & security issues in Solidity
1. [dagda](https://github.com/eliasgranderubio/dagda). a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
1. [NodeJsScan](https://github.com/ajinabraham/NodeJsScan). NodeJsScan is a static security code scanner for Node.js applications.


## static-code-analysis

1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.
1. [StaCoAn](https://github.com/vincentcox/StaCoAn). StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications.


## subdomain

1. [amass](https://github.com/caffix/amass). In-depth subdomain enumeration written in Go
1. [subjack](https://github.com/haccer/subjack). Hostile Subdomain Takeover tool written in Go featuring self-reliant subdomain discovery with amass integration, allowing for simultaneous checking for subdomain takeovers while enumerating DNS.


## swift

1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [SwiftyRSA](https://github.com/TakeScoop/SwiftyRSA). RSA public/private key encryption in Swift


## symfony

1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator
1. [security](https://github.com/symfony/security). The Security component provides a complete security system for your web application.
1. [security-bundle](https://github.com/symfony/security-bundle). The security system is one of the most powerful parts of Symfony and can largely be controlled via its configuration.


## taint-analysis

1. [pyt](https://github.com/python-security/pyt). A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications
1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool
1. [find-sec-bugs](https://github.com/find-sec-bugs/find-sec-bugs). The FindBugs plugin for security audits of Java web applications and Android applications. (Also work with Groovy and Scala projects)
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform


## terraform

1. [guide](https://github.com/hobby-kube/guide).  Kubernetes clusters for the hobbyist.
1. [streamalert](https://github.com/airbnb/streamalert). StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
1. [binaryalert](https://github.com/airbnb/binaryalert). BinaryAlert: Serverless, Real-time & Retroactive Malware Detection


## testing

1. [syzkaller](https://github.com/google/syzkaller). syzkaller is an unsupervised, coverage-guided kernel fuzzer
1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [inspec](https://github.com/chef/inspec). InSpec: Auditing and Testing Framework
1. [manticore](https://github.com/trailofbits/manticore). Symbolic execution tool


## threat-analysis

1. [cowrie](https://github.com/micheloosterhof/cowrie). Cowrie SSH/Telnet Honeypot
1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)


## threat-hunting

1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)
1. [awesome-threat-detection](https://github.com/0x4D31/awesome-threat-detection). A curated list of awesome threat detection and hunting resources


## threat-sharing

1. [cowrie](https://github.com/micheloosterhof/cowrie). Cowrie SSH/Telnet Honeypot
1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)


## threatintel

1. [cowrie](https://github.com/micheloosterhof/cowrie). Cowrie SSH/Telnet Honeypot
1. [MISP](https://github.com/MISP/MISP). MISP (core software) - Open Source Threat Intelligence Platform (formely known as Malware Information Sharing Platform)


## tls

1. [mitmproxy](https://github.com/mitmproxy/mitmproxy). An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
1. [bettercap](https://github.com/evilsocket/bettercap). DEPRECATED, bettercap developement moved here: https://github.com/bettercap/bettercap
1. [sslyze](https://github.com/nabla-c0d3/sslyze). Fast and powerful SSL/TLS server scanning library.
1. [badssl.com](https://github.com/chromium/badssl.com). :lock: Memorable site for testing clients against bad SSL configs.
1. [botan](https://github.com/randombit/botan). Crypto and TLS for C++11
1. [ghostunnel](https://github.com/square/ghostunnel). A simple SSL/TLS proxy with mutual authentication for securing non-TLS services
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com
1. [istlsfastyet.com](https://github.com/igrigorik/istlsfastyet.com). Is TLS fast yet? Yes, yes it is.


## tls13

1. [sslyze](https://github.com/nabla-c0d3/sslyze). Fast and powerful SSL/TLS server scanning library.
1. [wolfssl](https://github.com/wolfSSL/wolfssl). wolfSSL (formerly CyaSSL) is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. http://www.wolfssl.com


## tor

1. [onionshare](https://github.com/micahflee/onionshare). Securely and anonymously share a file of any size
1. [OnionBrowser](https://github.com/mtigas/OnionBrowser). An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network
1. [GlobaLeaks](https://github.com/globaleaks/GlobaLeaks). GlobaLeaks - The Open-Source Whistleblowing Software
1. [exitmap](https://github.com/NullHypothesis/exitmap). A fast and modular scanner for Tor exit relays.


## tor-network

1. [OnionBrowser](https://github.com/mtigas/OnionBrowser). An open-source, privacy-enhancing web browser for iOS, utilizing the Tor anonymity network
1. [exitmap](https://github.com/NullHypothesis/exitmap). A fast and modular scanner for Tor exit relays.


## totp

1. [yosai](https://github.com/YosaiProject/yosai). A Security Framework for Python applications featuring Authorization (rbac permissions and roles), Authentication (2fa totp), Session Management and an extensive Audit Trail
1. [SecurityDriven.Inferno](https://github.com/sdrapkin/SecurityDriven.Inferno). :white_check_mark: .NET crypto done right. Professionally audited.


## touch-id

1. [KeychainAccess](https://github.com/kishikawakatsumi/KeychainAccess). Simple Swift wrapper for Keychain that works on iOS, watchOS, tvOS and macOS.
1. [Valet](https://github.com/square/Valet). Valet lets you securely store data in the iOS, tvOS, or macOS Keychain without knowing a thing about how the Keychain works. It’s easy. We promise.
1. [UICKeyChainStore](https://github.com/kishikawakatsumi/UICKeyChainStore). UICKeyChainStore is a simple wrapper for Keychain on iOS, watchOS, tvOS and macOS. Makes using Keychain APIs as easy as NSUserDefaults.


## tox

1. [toxic](https://github.com/JFreegman/toxic). An ncurses-based Tox client
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client


## tracking

1. [trape](https://github.com/boxug/trape). People tracker on the Internet: Learn to track the world, to avoid being traced.
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera


## tunnel

1. [sigmavpn](https://github.com/neilalexander/sigmavpn). Light-weight, secure and modular VPN solution
1. [ghostunnel](https://github.com/square/ghostunnel). A simple SSL/TLS proxy with mutual authentication for securing non-TLS services


## tvos

1. [Valet](https://github.com/square/Valet). Valet lets you securely store data in the iOS, tvOS, or macOS Keychain without knowing a thing about how the Keychain works. It’s easy. We promise.
1. [SwiftyRSA](https://github.com/TakeScoop/SwiftyRSA). RSA public/private key encryption in Swift


## two-factor

1. [teleport](https://github.com/gravitational/teleport). Modern SSH server for clusters and teams.
1. [twofactorauth](https://github.com/2factorauth/twofactorauth). List of sites with two factor auth support which includes SMS, email, phone calls, hardware, and software.
1. [yosai](https://github.com/YosaiProject/yosai). A Security Framework for Python applications featuring Authorization (rbac permissions and roles), Authentication (2fa totp), Session Management and an extensive Audit Trail


## twofactorauth

1. [twofactorauth](https://github.com/2factorauth/twofactorauth). List of sites with two factor auth support which includes SMS, email, phone calls, hardware, and software.
1. [yosai](https://github.com/YosaiProject/yosai). A Security Framework for Python applications featuring Authorization (rbac permissions and roles), Authentication (2fa totp), Session Management and an extensive Audit Trail


## typescript

1. [javascript-obfuscator](https://github.com/javascript-obfuscator/javascript-obfuscator). A powerful obfuscator for JavaScript and Node.js
1. [AspNetCoreSpa](https://github.com/asadsahi/AspNetCoreSpa). Asp.Net Core 2 & Angular (5+) SPA with Angular CLI full featured application. Live demo: 


## update

1. [evilgrade](https://github.com/infobyte/evilgrade). 
1. [tuf](https://github.com/theupdateframework/tuf). A framework for securing software update systems


## vba

1. [oletools](https://github.com/decalage2/oletools). oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.
1. [ViperMonkey](https://github.com/decalage2/ViperMonkey). A VBA parser and emulation engine to analyze malicious macros.


## video

1. [wire-ios](https://github.com/wireapp/wire-ios). 📱 Wire for iOS (iPhone and iPad)
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client
1. [zmNinja](https://github.com/pliablepixels/zmNinja). High performance, cross platform ionic app for Home/Commerical Security Surveillance using ZoneMinder or other NVRs


## virtual-machine

1. [runtime](https://github.com/clearcontainers/runtime). OCI (Open Containers Initiative) compatible runtime using Virtual Machines
1. [cc-oci-runtime](https://github.com/intel/cc-oci-runtime). OCI (Open Containers Initiative) compatible runtime for Intel® Architecture


## virtualization

1. [runtime](https://github.com/clearcontainers/runtime). OCI (Open Containers Initiative) compatible runtime using Virtual Machines
1. [cc-oci-runtime](https://github.com/intel/cc-oci-runtime). OCI (Open Containers Initiative) compatible runtime for Intel® Architecture


## vpn

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [setup-ipsec-vpn](https://github.com/hwdsl2/setup-ipsec-vpn). Scripts to build your own IPsec VPN server, with IPsec/L2TP and Cisco IPsec on Ubuntu, Debian and CentOS
1. [openvpn](https://github.com/OpenVPN/openvpn). OpenVPN  is  an open source VPN daemon
1. [meshbird](https://github.com/meshbird/meshbird). Distributed private networking
1. [docker-ipsec-vpn-server](https://github.com/hwdsl2/docker-ipsec-vpn-server). Docker image to run an IPsec VPN server, with IPsec/L2TP and Cisco IPsec
1. [i2pd](https://github.com/PurpleI2P/i2pd).  🛡 I2P: End-to-End encrypted and anonymous Internet
1. [xiringuito](https://github.com/ivanilves/xiringuito). SSH-based "VPN for poors"
1. [sigmavpn](https://github.com/neilalexander/sigmavpn). Light-weight, secure and modular VPN solution
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation


## vpn-client

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation


## vpn-server

1. [algo](https://github.com/trailofbits/algo). Set up a personal IPSEC VPN in the cloud
1. [setup-ipsec-vpn](https://github.com/hwdsl2/setup-ipsec-vpn). Scripts to build your own IPsec VPN server, with IPsec/L2TP and Cisco IPsec on Ubuntu, Debian and CentOS
1. [docker-ipsec-vpn-server](https://github.com/hwdsl2/docker-ipsec-vpn-server). Docker image to run an IPsec VPN server, with IPsec/L2TP and Cisco IPsec
1. [AWS-VPN-Server-Setup](https://github.com/webdigi/AWS-VPN-Server-Setup). Setup your own private, secure, free* VPN on the Amazon AWS Cloud in 10 minutes. CloudFormation


## vulnerabilities

1. [brakeman](https://github.com/presidentbeef/brakeman). A static analysis security vulnerability scanner for Ruby on Rails applications
1. [retire.js](https://github.com/RetireJS/retire.js). scanner detecting the use of JavaScript libraries with known vulnerabilities
1. [snyk](https://github.com/snyk/snyk). CLI and build-time tool to find & fix known vulnerabilities in open-source dependencies
1. [dawnscanner](https://github.com/thesp0nge/dawnscanner). Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
1. [railsgoat](https://github.com/OWASP/railsgoat). A vulnerable version of Rails that follows the OWASP Top 10
1. [kernelpop](https://github.com/spencerdodd/kernelpop). kernel privilege escalation enumeration and exploitation framework
1. [dagda](https://github.com/eliasgranderubio/dagda). a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities


## vulnerability

1. [faraday](https://github.com/infobyte/faraday). Collaborative Penetration Test and Vulnerability Management Platform
1. [labs](https://github.com/nixawk/labs). Vulnerability Labs for security analysis
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE


## vulnerability-assessment

1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [xunfeng](https://github.com/ysrc/xunfeng). 巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
1. [secure-ios-app-dev](https://github.com/felixgr/secure-ios-app-dev). Collection of the most common vulnerabilities found in iOS applications
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.


## vulnerability-databases

1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo). DefectDojo is an open-source defect tracking application


## vulnerability-detection

1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [xunfeng](https://github.com/ysrc/xunfeng). 巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
1. [DependencyCheck](https://github.com/jeremylong/DependencyCheck). OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [wazuh](https://github.com/wazuh/wazuh). Wazuh - Host and endpoint security
1. [Seccubus](https://github.com/schubergphilis/Seccubus). Easy automated vulnerability scanning, reporting and analysis


## vulnerability-management

1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [faraday](https://github.com/infobyte/faraday). Collaborative Penetration Test and Vulnerability Management Platform
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.
1. [django-DefectDojo](https://github.com/DefectDojo/django-DefectDojo). DefectDojo is an open-source defect tracking application
1. [Seccubus](https://github.com/schubergphilis/Seccubus). Easy automated vulnerability scanning, reporting and analysis


## vulnerability-scanners

1. [vuls](https://github.com/future-architect/vuls). Vulnerability scanner for Linux/FreeBSD, agentless, written in Go
1. [faraday](https://github.com/infobyte/faraday). Collaborative Penetration Test and Vulnerability Management Platform
1. [xunfeng](https://github.com/ysrc/xunfeng). 巡风是一款适用于企业内网的漏洞快速应急，巡航扫描系统。
1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.
1. [intrigue-core](https://github.com/intrigueio/intrigue-core). Discover your attack surface!


## vulnerability-scanning

1. [vulscan](https://github.com/scipag/vulscan). Advanced vulnerability scanning with Nmap NSE
1. [jackhammer](https://github.com/olacabs/jackhammer). Jackhammer - One Security vulnerability assessment/management tool to solve all the security team problems.


## watchos

1. [Valet](https://github.com/square/Valet). Valet lets you securely store data in the iOS, tvOS, or macOS Keychain without knowing a thing about how the Keychain works. It’s easy. We promise.
1. [SwiftyRSA](https://github.com/TakeScoop/SwiftyRSA). RSA public/private key encryption in Swift


## web

1. [WhatWeb](https://github.com/urbanadventurer/WhatWeb). Next generation web scanner
1. [awesome-web-security](https://github.com/qazbnm456/awesome-web-security). 🐶 A curated list of Web Security materials and resources.
1. [CTF-All-In-One](https://github.com/firmianay/CTF-All-In-One). 一本 CTF 书
1. [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot). Jasypt integration for Spring boot


## webapp

1. [hawkpost](https://github.com/whitesmith/hawkpost). Generate links that users can use to submit messages encrypted with your public key.
1. [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot). Jasypt integration for Spring boot


## website

1. [awesome-checker-services](https://github.com/Brunty/awesome-checker-services). ✅ List of links to the various checkers out there on the web for sites, domains, security etc.
1. [jasypt-spring-boot](https://github.com/ulisesbocchio/jasypt-spring-boot). Jasypt integration for Spring boot


## whitelist

1. [bluemonday](https://github.com/microcosm-cc/bluemonday). bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
1. [scriptsafe](https://github.com/andryou/scriptsafe). a browser extension to bring security and privacy to chrome, firefox, and opera


## wifi

1. [wifiphisher](https://github.com/wifiphisher/wifiphisher). The Rogue Access Point Framework
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [nzyme](https://github.com/lennartkoopmann/nzyme). Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog (Open Source log management) setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode.


## wifi-security

1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.


## windows

1. [x64dbg](https://github.com/x64dbg/x64dbg). An open-source x64/x32 debugger for windows.
1. [labs](https://github.com/docker/labs). This is a collection of tutorials for learning how to use Docker with various tools. Contributions welcome.
1. [nmap](https://github.com/nmap/nmap). Nmap - the Network Mapper. Github mirror of official SVN repository.
1. [QuasarRAT](https://github.com/quasar/QuasarRAT). Remote Administration Tool for Windows
1. [processhacker](https://github.com/processhacker/processhacker). A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware.
1. [hardentools](https://github.com/securitywithoutborders/hardentools). Hardentools is a utility that disables a number of risky Windows features.
1. [exploits](https://github.com/XiphosResearch/exploits). Miscellaneous exploit code
1. [awesome-windows-domain-hardening](https://github.com/PaulSec/awesome-windows-domain-hardening). A curated list of awesome Security Hardening techniques for Windows.
1. [uTox](https://github.com/uTox/uTox). µTox the lightest and fluffiest Tox client
1. [bleachbit](https://github.com/bleachbit/bleachbit). BleachBit system cleaner for Windows and Linux


## wireless

1. [urh](https://github.com/jopohl/urh). Universal Radio Hacker: investigate wireless protocols like a boss
1. [bettercap](https://github.com/bettercap/bettercap). The state of the art network attack and monitoring framework.
1. [BoopSuite](https://github.com/MisterBianco/BoopSuite). A Suite of Tools written in Python for wireless auditing and security testing.
1. [airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). This is a multi-use bash script for Linux systems to audit wireless networks.


## wordpress

1. [wpscan](https://github.com/wpscanteam/wpscan). WPScan is a black box WordPress vulnerability scanner
1. [wordpress-exploit-framework](https://github.com/rastating/wordpress-exploit-framework). A Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.
1. [nginxconfig.io](https://github.com/valentinxxx/nginxconfig.io). nginx config generator


## x86

1. [x64dbg](https://github.com/x64dbg/x64dbg). An open-source x64/x32 debugger for windows.
1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [edb-debugger](https://github.com/eteran/edb-debugger). edb is a cross platform x86/x86-64 debugger.
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [bap](https://github.com/BinaryAnalysisPlatform/bap). Binary Analysis Platform
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## x86-64

1. [x64dbg](https://github.com/x64dbg/x64dbg). An open-source x64/x32 debugger for windows.
1. [capstone](https://github.com/aquynh/capstone). Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)
1. [unicorn](https://github.com/unicorn-engine/unicorn). Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, X86)
1. [edb-debugger](https://github.com/eteran/edb-debugger). edb is a cross platform x86/x86-64 debugger.
1. [keystone](https://github.com/keystone-engine/keystone). Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings
1. [keypatch](https://github.com/keystone-engine/keypatch). Multi-architecture assembler for IDA Pro. Powered by Keystone Engine.


## xss

1. [hacker101](https://github.com/Hacker0x01/hacker101). Hacker101
1. [DOMPurify](https://github.com/cure53/DOMPurify). DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
1. [Web-Security-Learning](https://github.com/CHYbeta/Web-Security-Learning). Web-Security-Learning
1. [bluemonday](https://github.com/microcosm-cc/bluemonday). bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
1. [filterbypass](https://github.com/masatokinugawa/filterbypass). 
1. [csp-builder](https://github.com/paragonie/csp-builder). Build Content-Security-Policy headers from a JSON file (or build them programmatically)
1. [latte](https://github.com/nette/latte). ☕ Latte: the intuitive and fast template engine for those who want the most secure PHP sites.
1. [protect](https://github.com/RisingStack/protect). Proactively protect your Node.js web services


## yubikey

1. [teleport](https://github.com/gravitational/teleport). Modern SSH server for clusters and teams.
1. [YubiKey-Guide](https://github.com/drduh/YubiKey-Guide). Guide to using YubiKey as a SmartCard for GPG and SSH