Topics / #bypass

Bypass projects on GitHub

Techniques and payloads for bypassing security restrictions, filters, and protections.

As of , the most-starred Bypass projects on GitHub are PayloadsAllTheThings (81.8K stars), fanqiang (54.2K stars) and zapret-discord-youtube (34.8K stars). GitHub.Locker tracks 29 Bypass repositories with 379.5K stars combined. The fastest-growing on October 16 was zapret-discord-youtube, with +35 stars in a day.

29Projects
379.5KStars in total
+176Stars in a day
Browse in the catalog →github.com/topics/bypass ↗

Hot right now

Most stars gained in a day · Oct 16

+35

zapret-discord-youtube

Flowseal/zapret-discord-youtube · ★ 34.8K

A free Windows toolkit of batch scripts around bol-van's zapret that runs DPI-bypass strategies to restore access to Discord and YouTube — no VPN or subscription involved.

+28

fanqiang

bannedbook/fanqiang · ★ 54.2K

A collection of tutorials and tools for circumventing China's internet censorship (翻墙/科学上网), covering proxy protocols like V2Ray, Shadowsocks, SSR and Trojan, plus a bundled all-in-one client package for Windows.

+27

PayloadsAllTheThings

swisskyrepo/PayloadsAllTheThings · ★ 81.8K

A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

+10

vpn-configs-for-russia

igareck/vpn-configs-for-russia · ★ 9.2K

A free, auto-updated collection of VPN and Tor configurations tested to work in Russia, for bypassing Roskomnadzor's black- and whitelist blocking.

The all-time top

29 projects · by stars

  1. #1 · swisskyrepo/PayloadsAllTheThings

    PayloadsAllTheThings

    A massive curated collection of payloads, bypass techniques, and exploitation methodology for web application security testing, pentesting, and CTF challenges.

    81.8K
  2. #2 · bannedbook/fanqiang

    fanqiang

    A collection of tutorials and tools for circumventing China's internet censorship (翻墙/科学上网), covering proxy protocols like V2Ray, Shadowsocks, SSR and Trojan, plus a bundled all-in-one client package for Windows.

    54.2K
  3. #3 · Flowseal/zapret-discord-youtube

    zapret-discord-youtube

    A free Windows toolkit of batch scripts around bol-van's zapret that runs DPI-bypass strategies to restore access to Discord and YouTube — no VPN or subscription involved.

    34.8K
  1. 4

    GoodbyeDPI

    28.8KValdikSS/GoodbyeDPI · C

    A free Windows utility that bypasses Deep Packet Inspection (DPI) systems ISPs use to block websites. It handles both passive DPI (optical splitter or port mirroring) and active DPI connected in sequence.

  2. 5

    downkyi

    24.4Kleiurayer/downkyi

    Downkyi (下载姬) was a desktop GUI tool for downloading videos, subtitles, and danmaku from the Chinese video platform Bilibili (B站) by reverse-engineering its private APIs and bypassing login authentication and anti-scraping protections. The repository has since been permanently shut down and is no longer maintained.

  3. 6

    CMWTAT_Digital_Edition

    19.6KTGSAN/CMWTAT_Digital_Edition · C#

    CMWTAT (CloudMoe Windows 10+ Activation Toolkit, Digital Edition) is an open-source tool that activates Windows 10 and Windows 11 with a digital license. It is written in C# and has around 19.5k stars.

  4. 7

    MHDDoS

    16.9KMatrixTM/MHDDoS · Python

    MHDDoS is a Python 3 DDoS testing toolkit with 57 attack methods spanning Layer 7 (HTTP floods, Cloudflare/OVH bypasses) and Layer 4/3 (TCP, UDP, SYN, amplification attacks), meant for authorized security testing and research.

  5. 8

    Cloudflare-vless-trojan

    16.6Kyonggekkk/Cloudflare-vless-trojan · JavaScript

    Scripts that deploy free VLESS-WS(TLS) and Trojan-WS(TLS) proxy nodes on Cloudflare Workers/Pages, plus a local Socks5/HTTP proxy script with ECH-TLS, normal TLS or no-TLS modes for devices like soft routers.

  6. 9

    zapret

    16.3Kbol-van/zapret · C

    An autonomous DPI circumvention tool that needs no third-party servers. It can help bypass blocking or throttling of HTTP(S) sites and signature-based blocking of TCP and UDP protocols, such as VPN bans.

  7. 10

    GTFOBins.github.io

    13.8KGTFOBins/GTFOBins.github.io · YAML

    GTFOBins is a curated list of Unix-like executables that can be abused to bypass local security restrictions in misconfigured systems — for example, binaries a restricted user can turn into a root shell.

  8. 11

    BiliRoaming

    11.5Kyujincheng08/BiliRoaming · Kotlin

    BiliRoaming (哔哩漫游) was an Xposed module that unblocked region-restricted bangumi (anime) in the Android Bilibili app, with a few miscellaneous extra features. The repo is now archived, and its README is a cease-and-desist letter from Bilibili's lawyers.

  9. 12

    TheFatRat

    11.5Kscreetsec/TheFatRat · C

    TheFatRat is an exploiting tool that compiles malware from famous payloads — an easy way to generate backdoors built to slip past most anti-virus software.

  10. 13

    nopecha-extension

    11KNopeCHALLC/nopecha-extension

    NopeCHA is a browser extension that automatically detects and solves CAPTCHAs on any page, powered by multimodal AI running through the NopeCHA API platform.

  11. 14

    vpn-configs-for-russia

    9.2Kigareck/vpn-configs-for-russia

    A free, auto-updated collection of VPN and Tor configurations tested to work in Russia, for bypassing Roskomnadzor's black- and whitelist blocking.

  12. 15

    fq-book

    7Khoochanlon/fq-book · Shell

    A free open-source Chinese-language book, 《这本书能让你连接互联网》 (This Book Can Get You Online), about getting online under censorship: hands-on setup for popular circumvention tools plus the principles behind proxies, tunnels, VPNs and GFW blocking.

  13. 16

    botasaurus

    5.8Komkarcloud/botasaurus · Python

    Botasaurus is an all-in-one Python web scraping framework built to make scrapers that pass bot-detection checks, including Cloudflare WAF, BrowserScan, Fingerprint, Datadome, and Cloudflare Turnstile CAPTCHA.

  14. 17

    reverse-SynthID

    5Kaloshdenny/reverse-SynthID · Python

    reverse-SynthID reverse-engineers Google's SynthID watermark embedded in Gemini-generated images using signal processing and spectral analysis, and ships tools that detect and surgically bypass that watermark without any access to Google's proprietary encoder/decoder.

  15. 18

    GuJumpgate

    3.9KFoundZiGu/GuJumpgate · JavaScript

    GuJumpgate is an archived Chrome extension that automated account registration and payment flows for a target platform - creating a Free account, upgrading it to Plus through a PayPal-via-Stripe billing chain, and managing Hotmail/Outlook email aliases. It stopped being maintained on 2026-07-11.

  16. 19

    russia-mobile-internet-whitelist

    3.8Khxehex/russia-mobile-internet-whitelist

    A community-maintained list of domains and IP ranges that stay reachable in Russia even when mobile internet gets throttled or filtered, meant to be fed into VPN or proxy clients so their traffic blends in with what the government allows through.

  17. 20

    Antigravity

    675loysger/Antigravity · TypeScript

    Antigravity Client is a connector that lets users in Russia and the CIS run Google Antigravity (IDE, the Antigravity 2.0 orchestrator, and the agy CLI) without the regional 400 errors and account-eligibility blocks that normally prevent access from those countries.

  18. 21

    patchright-enhanced

    498whaleyxbt/patchright-enhanced · TypeScript

    It's a stealth browser automation toolkit built on top of Patchright (a patched Playwright) aimed at QA testing, monitoring, scraping, and penetration testing. It focuses on producing clean Chrome sessions that get past WAFs like Cloudflare, Kasada, and DataDome out of the box.

  19. 22

    FilzaSlop

    4480xjohnnydev/FilzaSlop · Objective-C

    FilzaSlop is a fork of FilzaJailedDS that adds a sandbox escape exploit and app container access to the Filza file manager on iOS 18, iOS 26, and iOS 27 beta 1-4, plus a bundled PosterBoard Wallpaper Lab.

  20. 23

    tiktok-signature

    399n1tr00-10/tiktok-signature · Python

    This is a Python library that generates the signatures TikTok's Web API requires on requests — X-Gnarly, X-Bogus, and X-Dynosaur — matching SDK version 5.1.2 (build 1.0.0.316).

  21. 24

    Free-Configs

    385patterniha/Free-Configs · Python

    A free collection of proxy configs for getting around internet filtering: add its subscription link to a client app and it feeds you working configs, refreshed every 24 hours.

  22. 25

    github-farm

    354d4ncboz/github-farm · Python

    It is an automation framework that farms GitHub OAuth signup bonuses across multiple AI-gateway platforms (Tabi AI, GoRouter, CodeBuddy Global) by generating email aliases, catching their OTP codes over IMAP, and harvesting the resulting OAuth sessions.

  23. 26

    cloudflare-turnstile-solver

    346biusberline/cloudflare-turnstile-solver · Python

    A small Python library and CLI for Cloudflare Turnstile on your own pages: it reads the sitekey from a page, gets a valid token via the Peak API, and hands you a cf-turnstile-response to inject into a form or request.

  24. 27

    SteamDaddy-Backup

    290Contrary7/SteamDaddy-Backup · PowerShell

    SteamDaddy is a Windows tool that replaces SteamTools and GreenLuma for unlocking Steam games and DLCs, fixing 'No Internet Connection' and purchase errors, managing game manifests, and auto-patching online multiplayer fixes, all from a native UI inside the Steam client.

  25. 28

    nyx

    158thecynetx/nyx · TypeScript

    Nyx Panel is a self-hosted web management suite for Xray-core proxy servers, built to resist heavy censorship (Iran-focused) using VLESS+REALITY, XHTTP/SplitHTTP, packet fragmentation and Cloudflare WARP.

  26. 29

    qoder-workflow

    142d4ncboz/qoder-workflow · Python

    Qoder Workflow is an unofficial toolkit built around Qoder (an AI coding assistant) that patches machine identity, harvests Personal Access Tokens, decrypts local session credentials, and exposes the resulting access through an OpenAI-compatible gateway serving 15 upstream models (Claude, Qwen, Kimi, GLM, DeepSeek, MiniMax, and more).

Often tagged together