Updated October 2026
Open source security tools let you inspect exactly what they do, which matters for software you trust with your systems. Security teams, penetration testers, and developers use them to find vulnerabilities, analyze traffic, and harden machines.
This list covers penetration testing and scanning tools, proxies for inspecting traffic, privacy and hardening utilities, and the community reference collections many security engineers learn from. Every project is licensed, actively maintained, and ranked by GitHub stars.
Ranked by GitHub stars and refreshed daily.
by trimstray
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools and more.
by Hack-with-Github
A collection of various awesome lists for hackers, pentesters and security researchers
by swisskyrepo
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
by caddyserver
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
by usestrix
Open-source AI penetration testing tool to find and fix your app’s vulnerabilities.
by Raphire
A simple, lightweight PowerShell script that allows you to remove pre-installed apps, disable telemetry, as well as perform various other changes to declutter and customize your Windows experience.…
by KeygraphHQ
Shannon is an AI pentester for web applications and APIs. It analyzes your source code, identifies attack vectors, and executes real exploits to prove vulnerabilities before they reach production.
by mitmproxy
An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
by GyulyVGC
Comfortably monitor your network traffic 🕵️♂️
by The-Vibe-Company
An open-source engine that turns continuous content streams into search and monitoring. Durable ingestion, hybrid search, alerts, and plugins for formats, models and business rules.
by searxng
SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. Users are neither tracked nor profiled.
by aquasecurity
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
by AdguardTeam
Network-wide ads & trackers blocking DNS server
by lissy93
🕵️♂️ All-in-one OSINT tool for analysing any website
by OWASP
The OWASP Cheat Sheet Series was created to provide a concise collection of high value information on specific application security topics.
by projectdiscovery
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the …
by nginx
The official NGINX Open Source repository.
by imthenachoman
An evolving how-to guide for securing a Linux server.
by StevenBlack
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
by trailofbits
Set up a personal VPN in the cloud
by gitleaks
Find secrets with Gitleaks 🔑
by community-scripts
Proxmox VE Helper-Scripts (Community Edition)
by plausible
Open source, privacy-first web analytics. Lightweight, cookie-free Google Analytics alternative. Self-hosted or cloud.
by ente
💚 End-to-end encrypted cloud for everything.
by hashgraph-online
Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.
By GitHub stars, the most popular projects on this list right now are the-book-of-secret-knowledge, Awesome-Hacking, and PayloadsAllTheThings. The ranking is rebuilt every day from GitHub.
Open code can be audited by anyone, which is a strength, but popularity is not a security review. Download releases from the project's official repository, check signatures where they are published, and only test systems you own or have written permission to test.
Start with the reference collections on this list to learn the techniques, then try an intercepting proxy such as mitmproxy to see how web traffic works. Practice on deliberately vulnerable labs rather than live systems.
