resource: security
1184 resources, primary matches first, then adoption-weighted; health v2 shown.
| Resource | Health v2 | Stars | Maturity |
|---|---|---|---|
| Exely/CSAPP-Labs A collection of solutions and study notes for the labs accompanying Computer Systems: A Programmer's Perspective (3rd Edition), including D… | 32 | 2611 | maintenance |
| yukaiji/buildVpn An illustrated Chinese-language tutorial repository walking users through renting an overseas VPS on Vultr and setting up a personal VPN se… | 32 | 2561 | maintenance |
| r0eXpeR/redteam_vul A curated Chinese-language reference list of high-value vulnerabilities commonly encountered during red team operations, covering systems l… | 32 | 2524 | maintenance |
| r4j0x00/exploits A collection of public exploit proof-of-concepts written primarily in C and JavaScript, targeting CVEs such as CVE-2021-3156 (sudo heap ove… | 32 | 2521 | maintenance |
| c0ny1/vulstudy vulstudy is a collection of Docker Compose configurations that package popular intentionally vulnerable web applications (DVWA, bWAPP, sqli… | 32 | 2453 | maintenance |
| aleenzz/Cobalt_Strike_wiki A Chinese-language wiki-style knowledge base documenting Cobalt Strike, a commercial post-exploitation and command-and-control framework us… | 32 | 2429 | maintenance |
| nebgnahz/awesome-iot-hacks A curated awesome-list of documented IoT hacks, security vulnerabilities, research reports, and communities. It serves as a reference catal… | 32 | 2425 | maintenance |
| S3cur3Th1sSh1t/Pentest-Tools A curated awesome-list of penetration testing tools, organized into categories such as privilege escalation, lateral movement, credential h… | 32 | 2411 | maintenance |
| Bypass007/Safety-Project-Collection A curated Chinese-language list of excellent open-source security projects aimed at helping enterprise (blue-team/defender) security practi… | 32 | 2387 | maintenance |
| WalterInSH/risk-management-note A Chinese-language collection of notes and essays on business risk control (风控) for internet companies, written by a practitioner with expe… | 32 | 2385 | maintenance |
| Sairyss/backend-best-practices A curated guide of best practices, tools, and guidelines for backend application development, with code examples in TypeScript and NodeJS. … | 32 | 2368 | maintenance |
| EONRaider/blackhat-python3 A Python 3 port of the source code from the book 'Black Hat Python' by Justin Seitz, reformatted to PEP8 and refactored to fix deprecated l… | 32 | 2367 | maintenance |
| helloexp/0day A continuously updated collection of exploits (EXP) and proofs-of-concept (POC) for vulnerabilities in various CMS platforms, systems, and … | 32 | 2364 | maintenance |
| futurice/backend-best-practices An evolving, community-maintained guide from Futurice describing general best practices for backend development, covering persistence, envi… | 32 | 2358 | maintenance |
| SHUR1K-N/Flipper-Zero-Sub-GHz-Jamming-Files A collection of Sub-GHz jamming signal files for the Flipper Zero multi-tool device, restored after removal from custom firmwares. Files ar… | 31 | 2346 | maintenance |
| tunz/js-vuln-db A curated database of JavaScript engine vulnerabilities (CVEs) with proof-of-concept exploits, covering engines like V8, SpiderMonkey, Java… | 32 | 2318 | maintenance |
| Escapingbug/awesome-browser-exploit A curated awesome list of tutorials, articles, writeups, and resources about browser exploitation, covering engines like Chrome V8, IE/Chak… | 32 | 2295 | maintenance |
| cider-security-research/cicd-goat CI/CD Goat is a deliberately vulnerable CI/CD environment for learning CI/CD security through 11 capture-the-flag challenges. It runs local… | 23 | 2295 | maintenance |
| Snowming04/The-Hacker-Playbook-3-Translation A Chinese translation of The Hacker Playbook 3 (Red Team edition), a penetration testing book, published as a readable GitHub book with dow… | 32 | 2285 | maintenance |
| tanc7/hacking-books A curated collection of well-known cybersecurity and hacking books, including titles on penetration testing, exploitation, malware analysis… | 32 | 2285 | maintenance |
| PatrikH0lop/malware_showcase An educational repository demonstrating how different types of malware (file infectors, trojans, worms, spyware, ransomware) work through s… | 32 | 2282 | maintenance |
| bartblaze/PHP-backdoors A curated collection of PHP backdoor and webshell samples (e.g., c99Shell) intended for educational and testing purposes, including obfusca… | 32 | 2271 | maintenance |
| tiancode/learn-hacking A curated collection of 83 Chinese-language tutorial notes on penetration testing, ethical hacking, and reverse engineering using Kali Linu… | 70 | 2263 | maintenance |
| alphaSeclab/awesome-rat A curated awesome-list collecting 250+ open-source RAT (Remote Administration Tool) and C&C (Command & Control) projects along with 1200+ a… | 32 | 2259 | maintenance |
| DP-3T/documents A documentation repository for DP-3T, a decentralized privacy-preserving proximity tracing protocol designed to slow the spread of SARS-CoV… | 32 | 2241 | maintenance |
| inonshk/31-days-of-API-Security-Tips A curated collection of 31 daily API security tips by Inon Shkedy, covering vulnerabilities like BOLA/IDOR, SSRF, mass assignment, and auth… | 32 | 2241 | maintenance |
| crytic/not-so-smart-contracts A curated collection of example Solidity smart contracts demonstrating common Ethereum and EVM vulnerabilities, including real-world code s… | 10 | 2226 | maintenance |
| 0x90/wifi-arsenal A curated awesome-list of WiFi and 802.11 security tools and resources, organized by category such as attack/penetration testing, sniffing,… | 32 | 2206 | maintenance |
| ssllabs/research A repository hosting SSL Labs' SSL/TLS Deployment Best Practices guide and SSL Server Rating Guide, plus a wiki of TLS configuration and as… | 32 | 2205 | maintenance |
| 0xRadi/OWASP-Web-Checklist A comprehensive OWASP-based web application security testing checklist available as PDF, DOCX, and a copyable Trello board. It organizes hu… | 32 | 2203 | maintenance |
| S3cur3Th1sSh1t/Amsi-Bypass-Powershell A curated collection of PowerShell scripts demonstrating various Antimalware Scan Interface (AMSI) bypass and avoidance techniques gathered… | 32 | 2190 | maintenance |
| transmissions11/solcurity An opinionated security and code quality checklist standard for Solidity smart contracts, compiled from work by BoringCrypto, Mudit Gupta, … | 32 | 2181 | maintenance |
| yadox666/The-Hackers-Hardware-Toolkit A curated catalog of over one hundred hardware gadgets for red team pentesters and security researchers, organized into eight categories su… | 32 | 2175 | maintenance |
| ckjbug/Hacking A curated collection of network security and hacking learning resources, including Kali Linux penetration testing materials, VPN/VPS setup … | 32 | 2168 | maintenance |
| hhhrrrttt222111/Ethical-Hacking-Tools A curated listing and usage guide of tools used for ethical hacking and penetration testing, covering tools like Metasploit, Wireshark, and… | 32 | 2168 | maintenance |
| CTF Write-ups A community-maintained archive of CTF (capture the flag) write-ups and challenge source files, organized by year from 2013 to 2017. It cent… | 32 | 2148 | maintenance |
| sagishahar/lpeworkshop A free workshop covering local privilege escalation attack vectors on Windows and Linux, including slides, exercise worksheets, lab VMs, an… | 32 | 2124 | maintenance |
| FabioBaroni/awesome-exploit-development A curated list of books, tutorials, courses, tools, and vulnerable applications for learning exploit development. It aggregates learning re… | 32 | 2121 | maintenance |
| cure53/HTTPLeaks HTTPLeaks is a single HTML file that enumerates all known ways a website can inadvertently leak HTTP requests through HTML elements and att… | 59 | 2117 | maintenance |
| tom0li/collection-document A curated awesome-list of quality security articles covering penetration testing, cloud security, threat detection, Java code auditing, and… | 32 | 2116 | maintenance |
| lebinh/nginx-conf A curated collection of useful Nginx configuration snippets covering rewrites, redirects, performance, caching, and security. It serves as … | 32 | 2116 | maintenance |
| api0cradle/UltimateAppLockerByPassList A curated collection of documented AppLocker bypass techniques for Windows, organized into verified, unverified, generic, and DLL-execution… | 32 | 2081 | maintenance |
| ExpLife0011/awesome-windows-kernel-security-development A curated awesome-list of resources for Windows kernel security development, covering kernel drivers, hooking techniques, process injection… | 32 | 2074 | maintenance |
| insightglacier/Dictionary-Of-Pentesting A curated collection of dictionaries and wordlists for penetration testing, SRC bug bounty hunting, bruteforcing, and fuzzing. It aggregate… | 23 | 2072 | maintenance |
| YfryTchsGD/Log4jAttackSurface A community-curated list documenting which manufacturers, products, and components were affected by the Log4j (Log4Shell) vulnerability, wi… | 32 | 2069 | maintenance |
| Hackplayers/hackthebox-writeups A community-maintained collection of writeups for HackTheBox boot2root machines and challenges, written in Spanish or English. Writeups for… | 32 | 2053 | maintenance |
| 0xSobky/HackVault A curated collection of web security payloads, regexes, and offensive/defensive hacking notes hosted primarily in a wiki. It serves as a re… | 32 | 2036 | maintenance |
| Baeldung/spring-security-oauth A companion repository of example modules for Baeldung's Spring Security OAuth tutorials and the 'Learn Spring Security OAuth' course. It c… | 72 | 2025 | maintenance |
| HolyBugx/HolyTips HolyTips is a curated collection of notes, checklists, and writeups on bug bounty hunting and web application security. It serves as a refe… | 32 | 2020 | maintenance |
| xl7dev/WebShell A curated collection of webshells and backdoors written in many languages (PHP, ASP, JSP, Python, etc.) for security research and penetrati… | 32 | 2009 | maintenance |
| Leezj9671/Pentest_Interview A curated collection of penetration testing and cybersecurity job interview notes from 2018-2019, including HR questions, technical questio… | 70 | 2001 | maintenance |
| akr3ch/BugBountyBooks A curated collection of PDF books and cheatsheets covering modern web application security and bug bounty hunting. It serves as a free lear… | 32 | 1998 | maintenance |
| GitGuardian/APISecurityBestPractices A curated collection of guides and checklists from GitGuardian on keeping secrets like API keys, database credentials, and certificates out… | 32 | 1980 | maintenance |
| sehno/Bug-bounty A curated collection of resources for bug bounty hunting, including a checklist, a toolkit of tools, and a list of public bug bounty progra… | 32 | 1967 | maintenance |
| JohnTroony/php-webshells A curated collection of common PHP webshells intended for penetration testing assignments and CTF challenges. It is an educational/offensiv… | 23 | 1956 | maintenance |
| p0dalirius/Awesome-RCE-techniques A curated awesome list documenting step-by-step techniques to achieve Remote Code Execution (RCE) on various applications such as CMSs, fra… | 32 | 1939 | maintenance |
| fabacab/awesome-lockpicking A curated awesome-list of guides, books, tools, events, communities, and research covering the security and compromise of locks, safes, and… | 32 | 1918 | maintenance |
| hongriSec/PHP-Audit-Labs A Chinese-language tutorial series on PHP code auditing by HongRi Security, covering common PHP function pitfalls and vulnerabilities in fr… | 32 | 1910 | maintenance |
| yenchenlin/awesome-adversarial-machine-learning A curated awesome-list of adversarial machine learning resources including blogs, papers, and talks. It is deprecated and no longer updated… | 32 | 1910 | maintenance |
| stuxnet999/MemLabs MemLabs is an educational set of CTF-styled challenges for learning memory forensics, providing Windows memory dumps across six labs of inc… | 32 | 1888 | maintenance |
| GrrrDog/weird_proxies A cheat sheet documenting the behavior of various reverse proxies, cache proxies, and load balancers (Nginx, Apache, HAProxy, Varnish, Trae… | 32 | 1886 | maintenance |
| ThreatHuntingProject/ThreatHunting An informational repository of knowledge about hunting for adversaries in IT environments, associated with ThreatHunting.net. It serves as … | 32 | 1886 | maintenance |
| NCSC-NL/log4shell A repository of operational information from the Dutch National Cyber Security Centre about the Log4Shell vulnerabilities in the Log4j logg… | 10 | 1883 | maintenance |
| zbetcheckin/Security_list A curated awesome-list of security resources covering penetration testing, OSINT, malware analysis, CTFs, forensics, and more. It is a refe… | 32 | 1880 | maintenance |
| dsasmblr/hacking-online-games A curated list of tutorials, articles, tools, and resources for hacking online games, covering topics like reverse engineering game clients… | 32 | 1870 | maintenance |
| apachecn/sec-books-part1 A curated collection of out-of-print cybersecurity and network security books, maintained by the ApacheCN community. It serves as a downloa… | 31 | 1862 | maintenance |
| p4-team/ctf A collection of capture-the-flag (CTF) competition writeups and solution code from the Polish P4 team, covering events like Google CTF, HIT… | 32 | 1847 | maintenance |
| fabrimagic72/malware-samples A dataset of real malware samples collected from distributed honeypots worldwide, including ransomware like WannaCry and botnets like Etern… | 32 | 1840 | maintenance |
| Naetw/CTF-pwn-tips A curated collection of tips and techniques for CTF binary exploitation (pwn) challenges, covering buffer overflows, libc offsets, leaks, a… | 32 | 1830 | maintenance |
| offensive-security/exploitdb-bin-sploits The legacy GitHub repository of Exploit-DB's binary exploit files (the old /sploits directory), now mirrored to GitLab. It archives compile… | 10 | 1828 | maintenance |
| ctfs/resources A community-maintained archive of guides, tools, and references for Capture The Flag (CTF) security competitions. It covers common CTF topi… | 32 | 1824 | maintenance |
| chvancooten/maldev-for-dummies A self-paced workshop with slides and exercises teaching the fundamentals of malware development for offensive security practitioners, cove… | 32 | 1817 | maintenance |
| parsiya/Hacking-with-Go A free tutorial series teaching Go programming to security professionals, modeled on the Black Hat Python/C# book series. It covers Go fund… | 10 | 1815 | maintenance |
| brunofacca/zen-rails-security-checklist A community-maintained security checklist for Ruby on Rails applications covering injection, XSS, CSRF, authentication, authorization, and … | 32 | 1811 | maintenance |
| aptnotes/data APTnotes data is a curated dataset of publicly available papers and blogs about APT (Advanced Persistent Threat) campaigns and toolsets, in… | 32 | 1809 | maintenance |
| tanprathan/OWASP-Testing-Checklist An Excel-based web application security testing checklist built on the OWASP Testing Guide v5 (WSTG), used to track completed and pending t… | 32 | 1808 | maintenance |
| uknowsec/Active-Directory-Pentest-Notes A personal study notebook of Active Directory domain penetration testing notes, organized as Markdown documents covering Kerberos, SPN, MS1… | 32 | 1808 | maintenance |
| davincifans101/pinduoduo_backdoor_detailed_report A detailed technical analysis report of malicious code and backdoors found in the Pinduoduo Android app, published as PDF documents in Chin… | 30 | 1800 | maintenance |
| PaulSec/awesome-windows-domain-hardening A curated awesome-list of security hardening techniques for Windows domains, compiled from conference research on attack mitigation. It cat… | 32 | 1798 | maintenance |
| Hack-with-Github/Windows A curated awesome-list of open-source tools for exploiting and post-exploiting Windows machines, covering privilege escalation, credential … | 10 | 1797 | maintenance |
| ASTTeam/CodeQL A curated Chinese-language knowledge base titled 'Deep Understanding of CodeQL' collecting resources, fundamentals, and case studies for fi… | 32 | 1789 | maintenance |
| dmarman/sha256algorithm An interactive web application that visually explains how the SHA-256 hash algorithm works step by step, hosted at sha256algorithm.com. Bui… | 32 | 1778 | maintenance |
| shadowrocketHelp/help A Chinese-language tutorial repository (wiki-based) explaining how to set up and use proxy nodes with SS/SSR/V2Ray/Trojan/Clash clients acr… | 23 | 1777 | maintenance |
| SecWiki/CMS-Hunter A curated collection of vulnerability test cases and proof-of-concept exploits for popular content management systems like WordPress, Jooml… | 32 | 1767 | maintenance |
| neoFelhz/neohosts neoHosts is a curated hosts file dataset for blocking advertising domains, built with principles of freedom, responsibility, and restraint.… | 32 | 1763 | maintenance |
| truevault-safe/hipaa-compliance-developers-guide An open-source developers guide explaining HIPAA compliance requirements for application development in plain language. It is a documentati… | 32 | 1749 | maintenance |
| r3motecontrol/Ghostpack-CompiledBinaries A repository of pre-compiled Windows binaries for the GhostPack security toolset (e.g., Seatbelt, SafetyKatz, Rubeus) authored by harmj0y. … | 32 | 1744 | maintenance |
| LandGrey/webshell-detect-bypass A collection of research articles and evasion-ready webshell source code (PHP, JSP, ASP) demonstrating techniques to bypass professional we… | 32 | 1737 | maintenance |
| lizrice/ebpf-beginners A beginner's guide to eBPF programming, collecting slides, talk recordings, and Python/C example code from Liz Rice's conference presentati… | 32 | 1730 | maintenance |
| JoasASantos/Awesome-Red-Team-Operations A curated awesome-list of red team and penetration testing tools, organized by category such as PowerShell scripts, AMSI bypass, payload ho… | 32 | 1729 | maintenance |
| michalmalik/osx-re-101 A curated collection of links, papers, and references for reverse engineering macOS and iOS binaries, covering the Mach-O file format, syst… | 32 | 1729 | maintenance |
| 1ndianl33t/Bug-Bounty-Roadmaps A curated collection of bug bounty and penetration testing roadmaps, mostly visual mindmaps and methodology documents created by well-known… | 32 | 1728 | maintenance |
| bowu678/php_bugs A curated collection of PHP code audit exercises explained step by step, based on CTF-style challenges covering sensitive functions and PHP… | 32 | 1723 | maintenance |
| cn0xroot/RFSec-ToolKit A curated collection of radio frequency communication protocol hacking tools, tutorials, and resources covering SDR hardware/software, GSM,… | 32 | 1721 | maintenance |
| KiriKira/vTemplate A collection of ready-made V2Ray configuration file templates covering common proxy setups such as WebSocket+TLS+Web. It was created as a s… | 32 | 1718 | maintenance |
| Maskhe/javasec A Chinese-language collection of study notes and tutorials on Java security and code auditing, covering topics like reflection, deserializa… | 32 | 1704 | maintenance |
| harsh-bothra/learn365 A curated collection of 365 days of daily learning notes and mindmaps on information security topics, covering web vulnerabilities, bug bou… | 32 | 1702 | maintenance |
| ukncsc/zero-trust-architecture UK NCSC guidance providing eight design principles for building and reviewing zero trust architectures. It is documentation rather than sof… | 23 | 1697 | maintenance |
| Ascotbe/HackerMind A curated collection of security-related mind maps covering penetration testing, web security, CTF, social engineering, binary and mobile s… | 32 | 1675 | maintenance |
| quicwg/base-drafts The historical repository of Internet-Drafts that formed the base QUIC version 1 specification from the IETF QUIC Working Group, now publis… | 71 | 1662 | maintenance |