Topics / #owasp

Owasp projects on GitHub

Security resources and tools from the OWASP community.

As of , the most-starred Owasp projects on GitHub are shannon (49K stars), CheatSheetSeries (33.7K stars) and Mobile-Security-Framework-MobSF (22K stars). GitHub.Locker tracks 17 Owasp repositories with 212.3K stars combined. The fastest-growing on October 16 was shannon, with +81 stars in a day.

17Projects
212.3KStars in total
+150Stars in a day
Browse in the catalog →github.com/topics/owasp ↗

Hot right now

Most stars gained in a day · Oct 16

+81

shannon

KeygraphHQ/shannon · ★ 49K

Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

+10

Mobile-Security-Framework-MobSF

MobSF/Mobile-Security-Framework-MobSF · ★ 22K

MobSF is an automated, all-in-one mobile security framework: it performs static and dynamic analysis, penetration testing, malware analysis and privacy analysis on Android, iOS and Windows Mobile apps.

+9

CheatSheetSeries

OWASP/CheatSheetSeries · ★ 33.7K

A collection of concise, high-value cheat sheets covering specific application security topics, maintained by OWASP.

+9

juice-shop

juice-shop/juice-shop · ★ 14.1K

OWASP Juice Shop is an intentionally insecure web application (a fake online juice store) built for security training, awareness demos, CTFs, and testing security tools.

The all-time top

17 projects · by stars

  1. #1 · KeygraphHQ/shannon

    shannon

    Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

    49K
  2. #2 · OWASP/CheatSheetSeries

    CheatSheetSeries

    A collection of concise, high-value cheat sheets covering specific application security topics, maintained by OWASP.

    33.7K
  3. #3 · MobSF/Mobile-Security-Framework-MobSF

    Mobile-Security-Framework-MobSF

    MobSF is an automated, all-in-one mobile security framework: it performs static and dynamic analysis, penetration testing, malware analysis and privacy analysis on Android, iOS and Windows Mobile apps.

    22K
  1. 4

    security-guide-for-developers

    21.1KFallibleInc/security-guide-for-developers

    This is a practical security guide for web developers that explains common security issues (authentication, encryption, sessions, attacks, etc.) and gives a checklist for building more secure systems.

  2. 5

    Awesome-Hacking-Resources

    17.5Kvitalysim/Awesome-Hacking-Resources

    A curated collection of hacking, penetration testing and AI red-teaming resources — courses, YouTube channels, CTF platforms and guides, picked to make you better at offensive security.

  3. 6

    hacker-roadmap

    15.7Ksundowndev/hacker-roadmap

    This is a curated roadmap and toolkit index for learning and practicing ethical hacking: it explains what penetration testing is and groups hundreds of security tools, wordlists and references by category (recon, password attacks, wireless, exploitation, web hacking, post-exploitation, frameworks).

  4. 7

    amass

    15.4Kowasp-amass/amass · Go

    Amass is an OWASP project that maps attack surfaces and discovers external assets (like subdomains, IPs, and infrastructure) using open source intelligence gathering and active reconnaissance.

  5. 8

    juice-shop

    14.1Kjuice-shop/juice-shop · TypeScript

    OWASP Juice Shop is an intentionally insecure web application (a fake online juice store) built for security training, awareness demos, CTFs, and testing security tools.

  6. 9

    Sn1per

    11.5K1N3/Sn1per · Shell

    Sn1per is an offensive-security platform that bundles reconnaissance, vulnerability scanning, exploitation and reporting into one workspace, orchestrating 600+ exploits and 90+ third-party tools for pentesters and attack-surface-management teams.

  7. 10

    agent-governance-toolkit

    6.4Kmicrosoft/agent-governance-toolkit · Python

    A toolkit from Microsoft that governs autonomous AI agents in production: it enforces policies on tool calls, verifies agent identity, sandboxes execution, and provides SRE controls like kill switches and SLO monitoring. It covers all 10 of the OWASP Agentic Top 10 risks.

  8. 11

    ai-agents-the-definitive-guide

    2.8KNicolepcx/ai-agents-the-definitive-guide · Jupyter Notebook

    It is the companion code repository for the book 'AI Agents - The Definitive Guide': a set of runnable Jupyter notebooks that walk through every chapter, from basic agent patterns to production deployment and threat modeling.

  9. 12

    cve-lite-cli

    769OWASP/cve-lite-cli · TypeScript

    Most tools tell you what's wrong. CVE Lite CLI tells you what to run.

  10. 13

    ai-engineer-notebooks

    700calmrocks/ai-engineer-notebooks · Jupyter Notebook

    A collection of framework-free, hands-on Jupyter/Colab notebooks teaching the applied-LLM engineer skill set — model APIs, RAG, evals, agents, fine-tuning, security, and LLMOps — built for engineers moving into AI Engineer / Forward Deployed Engineer (FDE) roles.

  11. 14

    safelabs-eval

    569AgentSafeLabs/safelabs-eval · Python

    safelabs-eval is an open-source red-teaming and evaluation framework for AI agents, built around an OWASP-inspired ASI01-ASI10 taxonomy. It fires 300 curated adversarial prompts at an agent and scores every response with pattern-based detectors to produce a structured security report.

  12. 15

    0

    5120sec-labs/0 · TypeScript

    0 is an open-source, self-evolving, multi-model AI harness for security research that finds, verifies, and fixes vulnerabilities, built by the Swiss Applied AI & Cybersecurity Research Lab.

  13. 16

    Ai-jailbreak

    476Quincunx33/Ai-jailbreak · JavaScript

    A curated collection of jailbreak prompts and exploit techniques that bypass the safety guardrails of both open-weight models (Gemma, Qwen, Llama, DeepSeek, Phi-4, Mistral) and frontier closed models (GPT-5.x, Gemini 3.x, Grok 4.x), documented for red-teaming and AI safety research.

  14. 17

    awesome-agent-skills-security

    260LLMSecurity/awesome-agent-skills-security

    A curated, awesome-list style collection of research papers, standards, frameworks, and benchmarks about securing AI agent tool use and the emerging 'agent skills' ecosystem — covering attacks like prompt injection and tool poisoning as well as defenses like sandboxing and permission control.

Often tagged together