Topics / #bugbounty

Bugbounty projects on GitHub

Bug bounty hunting and web security testing

As of , the most-starred Bugbounty projects on GitHub are PayloadsAllTheThings (81.8K stars), runtime (18.4K stars) and ffuf (16.9K stars). GitHub.Locker tracks 16 Bugbounty repositories with 269.4K stars combined. The fastest-growing on October 18 was hexstrike-ai, with +32 stars in a day.

16Projects
269.4KStars in total
+142Stars in a day
Browse in the catalog →github.com/topics/bugbounty ↗

Hot right now

Most stars gained in a day · Oct 18

+32

hexstrike-ai

0x4m4/hexstrike-ai · ★ 12.9K

HexStrike AI MCP Agents is an MCP server that lets AI agents like Claude, GPT, or Copilot autonomously run 150+ real cybersecurity tools for automated pentesting, bug bounty hunting, CTF challenges, and vulnerability discovery.

+30

PayloadsAllTheThings

swisskyrepo/PayloadsAllTheThings · ★ 81.8K

A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

+20

Claude-BugHunter

elementalsouls/Claude-BugHunter · ★ 5.2K

A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.

+14

nuclei-templates

projectdiscovery/nuclei-templates · ★ 13.1K

This is a community-curated collection of over 11,000 detection templates for the Nuclei vulnerability scanner, covering CVEs, misconfigurations, exposed panels, and other security issues.

The all-time top

16 projects · by stars

  1. #1 · swisskyrepo/PayloadsAllTheThings

    PayloadsAllTheThings

    A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

    81.8K
  2. #2 · dotnet/runtime

    runtime

    This is the source code for the .NET runtime itself - the code that builds the runtime, its base class libraries, and the shared host (dotnet) installers for all supported platforms.

    18.4K
  3. #3 · ffuf/ffuf

    ffuf

    ffuf is a fast web fuzzer written in Go — a command-line tool that sends many crafted requests to a target to discover directories, virtual hosts, and fuzzable GET/POST parameters.

    16.9K
  1. 4

    dirsearch

    15Kmaurosoria/dirsearch · Python

    Dirsearch is an advanced command-line web path brute-forcer used to discover hidden files and directories on websites for security testing.

  2. 5

    subfinder

    14.6Kprojectdiscovery/subfinder · Go

    Subfinder is a fast passive subdomain enumeration tool that returns valid subdomains for a website by querying passive online sources, built for penetration testers and bug bounty hunters.

  3. 6

    nuclei-templates

    13.1Kprojectdiscovery/nuclei-templates · JavaScript

    This is a community-curated collection of over 11,000 detection templates for the Nuclei vulnerability scanner, covering CVEs, misconfigurations, exposed panels, and other security issues.

  4. 7

    hexstrike-ai

    12.9K0x4m4/hexstrike-ai · Python

    HexStrike AI MCP Agents is an MCP server that lets AI agents like Claude, GPT, or Copilot autonomously run 150+ real cybersecurity tools for automated pentesting, bug bounty hunting, CTF challenges, and vulnerability discovery.

  5. 8

    hacktricks

    12.6KHackTricks-wiki/hacktricks · JavaScript

    A free, open wiki of hacking tricks and techniques — everything the author has learnt from CTFs, real-world apps and security research, organized into a browsable reference with 12.5k+ GitHub stars.

  6. 9

    hetty

    12.5Kdstotijn/hetty · Go

    Hetty is an HTTP toolkit for security research, aiming to be an open source alternative to commercial tools like Burp Suite Pro, aimed at the infosec and bug bounty community.

  7. 10

    Resources-for-Beginner-Bug-Bounty-Hunters

    12.3Knahamsec/Resources-for-Beginner-Bug-Bounty-Hunters

    A curated collection of resources for people getting started with web hacking and bug bounty hunting, including blog posts, talks, books, tools, labs and vulnerability-type guides.

  8. 11

    Sn1per

    11.5K1N3/Sn1per · Shell

    Sn1per is an offensive-security platform that bundles reconnaissance, vulnerability scanning, exploitation and reporting into one workspace, orchestrating 600+ exploits and 90+ third-party tools for pentesters and attack-surface-management teams.

  9. 12

    awesome-hacker-search-engines

    11.3Kedoardottt/awesome-hacker-search-engines · Shell

    A curated list of search engines useful for penetration testing, vulnerability assessment, red/blue team operations, bug bounty hunting, and general OSINT work.

  10. 13

    bbot

    10.7Kblacklanternsecurity/bbot · Python

    BBOT is a recursive internet scanner for hackers — it automates recon, bug bounty work and attack surface management (ASM), inspired by Spiderfoot.

  11. 14

    httpx

    10.5Kprojectdiscovery/httpx · Go

    httpx is a fast, multi-purpose HTTP toolkit from ProjectDiscovery that runs many probes against lists of hosts and URLs, built on the retryablehttp library to stay reliable under high thread counts.

  12. 15

    OneForAll

    10.1Kshmilylty/OneForAll · Python

    OneForAll is a powerful subdomain collection tool: point it at a target domain and it gathers subdomains from many sources — a core reconnaissance step in penetration testing, which is why the author built it.

  13. 16

    Claude-BugHunter

    5.2Kelementalsouls/Claude-BugHunter · Python

    A drop-in skill bundle for the Claude Code skills system that turns Claude into a bug-hunting researcher or red-team operator: it ships 83 skills, 15 slash commands, and knowledge curated from 681 disclosed HackerOne reports across 24 vulnerability classes, plus enterprise identity and infrastructure attack matrices.

Often tagged together