Topics / #security-research

Security-research projects on GitHub

Vulnerability research, CVE analysis, and exploit studies.

As of , the most-starred Security-research projects on GitHub are L1B3RT4S (21.9K stars), vulhub (21.4K stars) and hacker-roadmap (15.7K stars). GitHub.Locker tracks 41 Security-research repositories with 168.7K stars combined. The fastest-growing on October 16 was awesome-reverse-engineering, with +59 stars in a day.

41Projects
168.7KStars in total
+308Stars in a day
Browse in the catalog →github.com/topics/security-research ↗

Hot right now

Most stars gained in a day · Oct 16

+59

awesome-reverse-engineering

morluto/awesome-reverse-engineering · ★ 628

A curated list of reverse-engineering tools and learning resources covering binaries, applications, firmware, file formats, and protocols, organized by the task you need to do rather than alphabetically.

+52

Relapse-Exploit

ntfargo/Relapse-Exploit · ★ 2.3K

Relapse Exploit is a browser-based jailbreak chain for the PS5, working on firmware 7.00 through 13.60, that chains a WebKit browser exploit with a kernel exploit to gain kernel read/write and load custom payloads.

+30

GhidraMCP

LaurieWired/GhidraMCP · ★ 11.3K

GhidraMCP is a Model Context Protocol server that lets LLMs autonomously reverse engineer applications by exposing Ghidra's core functionality (decompiling, renaming, listing imports/exports) to any MCP client.

+30

artex-global

jiwoochris/artex-global · ★ 1.6K

ARTEX-KO is a Korean localization of the ARTEX (Autumn-27/ARTEX) framework: a system where multiple LLM-driven agents autonomously run a penetration test end-to-end, from reconnaissance to exploitation, with a Go backend and an embedded Next.js frontend.

The all-time top

41 projects · by stars

  1. #1 · elder-plinius/L1B3RT4S

    L1B3RT4S

    A public collection of jailbreak prompts — the author calls them 'liberation prompts' — meant to make flagship AI models respond without their usual refusals. It is maintained by AI red-teamer elder-plinius.

    21.9K
  2. #2 · vulhub/vulhub

    vulhub

    Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments: with one command you get a working lab for security research, learning, or demos.

    21.4K
  3. #3 · sundowndev/hacker-roadmap

    hacker-roadmap

    This is a curated roadmap and toolkit index for learning and practicing ethical hacking: it explains what penetration testing is and groups hundreds of security tools, wordlists and references by category (recon, password attacks, wireless, exploitation, web hacking, post-exploitation, frameworks).

    15.7K
  1. 4

    HackBrowserData

    14.6KmoonD4rk/HackBrowserData · Go

    HackBrowserData is a command-line tool that decrypts and exports browser data — passwords, cookies, history, bookmarks, credit cards and more — from Chromium-based browsers, Firefox and Safari, built for security research.

  2. 5

    GhidraMCP

    11.3KLaurieWired/GhidraMCP · Java

    GhidraMCP is a Model Context Protocol server that lets LLMs autonomously reverse engineer applications by exposing Ghidra's core functionality (decompiling, renaming, listing imports/exports) to any MCP client.

  3. 6

    webshell

    10.8Ktennc/webshell · PHP

    It's a community collection of webshells - scripts that give you control of a web server once uploaded - covering all the common server-side languages and maintained by tennc with 10k+ stars.

  4. 7

    awesome-threat-intelligence

    10.7Khslatman/awesome-threat-intelligence

    A curated catalog of threat intelligence resources — feeds, tools, frameworks, standards and research for tracking online threats. It is a pointer list on GitHub, not software you install.

  5. 8

    Claude-Red

    7.6KSnailSploit/Claude-Red · Python

    claude-red is a curated library of offensive security skills for the Claude Skills system: structured SKILL.md files that prime Claude with expert-level methodology for one attack surface each, from SQLi to shellcode.

  6. 9

    AI-Infra-Guard

    6.9KTencent/AI-Infra-Guard · Python

    AI-Infra-Guard (A.I.G) is a full-stack AI red teaming platform built by Tencent Zhuque Lab that scans AI agents, MCP servers, agent skills, and AI infrastructure components for security vulnerabilities, and evaluates LLMs against jailbreak attacks.

  7. 10

    device-activity-tracker

    5.2Kgommzystudio/device-activity-tracker · TypeScript

    This is a proof-of-concept security research tool that monitors WhatsApp and Signal users by measuring the Round-Trip Time (RTT) of message delivery receipts, revealing whether a target's device is actively in use, idle, or offline.

  8. 11

    exploitarium

    5.2Kbikini/exploitarium · Python

    Exploitarium is a single consolidated archive of the author's public proof-of-concept exploits and vulnerability research writeups, merging dozens of their former standalone PoC repos into one place.

  9. 12

    dirtyfrag

    5.1KV4bel/dirtyfrag · C

    Dirty Frag is a proof-of-concept Linux kernel local privilege escalation exploit that chains two page-cache write vulnerabilities (CVE-2026-43284 and CVE-2026-43500) to obtain root on major Linux distributions.

  10. 13

    reverse-SynthID

    5Kaloshdenny/reverse-SynthID · Python

    reverse-SynthID reverse-engineers Google's SynthID watermark embedded in Gemini-generated images using signal processing and spectral analysis, and ships tools that detect and surgically bypass that watermark without any access to Google's proprietary encoder/decoder.

  11. 14

    copy-fail-CVE-2026-31431

    4.1Ktheori-io/copy-fail-CVE-2026-31431 · Python

    This repository is a technical writeup and proof-of-concept for CVE-2026-31431, a 9-year-old Linux kernel local privilege escalation (LPE) vulnerability found by Theori's AI vulnerability research tool, Xint Code.

  12. 15

    claude-code-analysis

    4Kliuup/claude-code-analysis · TypeScript

    A Chinese-language static analysis document collection dissecting the source code of Claude Code, after its npm package accidentally shipped unminified source maps revealing the full TypeScript codebase.

  13. 16

    raptor

    3.9Kgadievron/raptor · Python

    RAPTOR turns a Claude Code session into an offensive/defensive security agent: Claude.md rules, sub-agents and skills orchestrate tools like radare2, Frida, Z3 and CodeQL for binary reverse-engineering, exploit-feasibility research, and software supply-chain (SCA) analysis.

  14. 17

    mantis

    2.5Kgoogle/mantis · Python

    Mantis is a toolkit of skills plus a reference agent harness (built on Google's ADK) that lets AI coding agents autonomously find, reproduce, triage, and patch vulnerabilities in a codebase.

  15. 18

    Relapse-Exploit

    2.3Kntfargo/Relapse-Exploit · JavaScript

    Relapse Exploit is a browser-based jailbreak chain for the PS5, working on firmware 7.00 through 13.60, that chains a WebKit browser exploit with a kernel exploit to gain kernel read/write and load custom payloads.

  16. 19

    artex-global

    1.6Kjiwoochris/artex-global · Go

    ARTEX-KO is a Korean localization of the ARTEX (Autumn-27/ARTEX) framework: a system where multiple LLM-driven agents autonomously run a penetration test end-to-end, from reconnaissance to exploitation, with a Go backend and an embedded Next.js frontend.

  17. 20

    gpt6-Astra

    1.1K3641397194-wq/gpt6-Astra · JavaScript

    It is 'Cold Brew' (CHA), a jailbreak prompt workbench that packages prompt-injection techniques to break the safety guardrails ('破甲越狱') of six chat models — GPT-6 Astra/Codex, Claude Code, Grok 4.6, DeepSeek v4 Pro, GLM 5.3 and Gemini — for security research.

  18. 21

    APSD

    897hcliucs/APSD

    APSD is a large-scale dataset for studying how visually stealthy adversarial perturbations look to humans, containing 10,586 clean-adversarial image pairs with human opinion scores.

  19. 22

    awesome-reverse-engineering

    628morluto/awesome-reverse-engineering

    A curated list of reverse-engineering tools and learning resources covering binaries, applications, firmware, file formats, and protocols, organized by the task you need to do rather than alphabetically.

  20. 23

    bug-bounty-hunting-prompts

    612mdpsec/bug-bounty-hunting-prompts

    A pack of reusable prompt files for running a structured, evidence-first bug bounty hunting workflow with an LLM agent, covering recon through triage and escalation.

  21. 24

    Stuxnet

    588Sadpainy/Stuxnet · C

    This is a reconstructed source code of Stuxnet, the famous 2010 worm that sabotaged Siemens industrial control systems, rebuilt by the author from reverse-engineering research for educational and malware-analysis purposes.

  22. 25

    scuttle

    521Continuum-AI-Corp/scuttle · Go

    Scuttle is an open-source Go library that encrypts sensitive fields in application logs before they ever reach storage, so copies that survive in databases, replicas, snapshots and backups stay unreadable even if the datastore is later compromised.

  23. 26

    0

    5120sec-labs/0 · TypeScript

    0 is an open-source, self-evolving, multi-model AI harness for security research that finds, verifies, and fixes vulnerabilities, built by the Swiss Applied AI & Cybersecurity Research Lab.

  24. 27

    Ai-jailbreak

    476Quincunx33/Ai-jailbreak · JavaScript

    A curated collection of jailbreak prompts and exploit techniques that bypass the safety guardrails of both open-weight models (Gemma, Qwen, Llama, DeepSeek, Phi-4, Mistral) and frontier closed models (GPT-5.x, Gemini 3.x, Grok 4.x), documented for red-teaming and AI safety research.

  25. 28

    FilzaSlop

    4480xjohnnydev/FilzaSlop · Objective-C

    FilzaSlop is a fork of FilzaJailedDS that adds a sandbox escape exploit and app container access to the Filza file manager on iOS 18, iOS 26, and iOS 27 beta 1-4, plus a bundled PosterBoard Wallpaper Lab.

  26. 29

    OhMyKeymint

    438ITxiao6666/OhMyKeymint · Rust

    Oh My Keymint (OMK) is a custom Android Keystore implementation that fully mirrors the AOSP AIDL interface, designed to spoof key attestation and make app behavior harder for detectors to distinguish from a genuine AOSP device.

  27. 30

    edrEvasionWorkshop

    397tyeurada/edrEvasionWorkshop

    Workshop materials from DEF CON 34 and BSidesLV 2026 on writing custom malware that evades EDR — from loaders to kernel-level techniques.

  28. 31

    vmp-lazy-unpack

    396x86rc/vmp-lazy-unpack · Python

    This is a Python tool that automatically unpacks Windows x64 binaries protected with VMProtect 3.x and rebuilds their import table (IAT), without needing a debugger or live memory dump.

  29. 32

    EvilFontTool

    353DoctorEww/EvilFontTool · Python

    EvilFontTool is a font-based deception tool for red teaming and security research. It generates 'Evil Fonts' — fonts that remap glyphs so a document shows humans one text while terminals, AI systems, and copy-paste see completely different text.

  30. 33

    bad_query

    276forcequitOS/bad_query · C

    badquery is a proof-of-concept sandbox escape for iOS 26 and 27, written in C — code that demonstrates breaking out of the iOS app sandbox.

  31. 34

    Erosion

    245jailbreakdotparty/Erosion · Swift

    Erosion is an iOS customization toolbox that uses the bad_query sandbox escape exploit to apply tweaks on supported iOS/iPadOS versions, no traditional jailbreak required.

  32. 35

    BLEhound

    223BLEhound/BLEhound · C

    BLEhound is an open-source Bluetooth LE sniffer built on the nRF54 chip, combining custom firmware, a Wireshark extcap plugin, and open hardware (PCB/Gerbers/case) to capture BLE traffic with an RF front-end for better range.

  33. 36

    Claude-AD

    211ADScanPro/Claude-AD

    Claude-AD is a Claude Code plugin that gives Claude the methodology for an internal Active Directory penetration test: skills, agents and slash commands covering Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay and delegation abuse, each with OPSEC and telemetry notes.

  34. 37

    noai-watermark

    209mertizci/noai-watermark · Python

    noai-watermark is an open-source CLI and Python toolkit that uses diffusion-based image regeneration to disrupt invisible AI watermarks (like Google SynthID, StableSignature, TreeRing) embedded in generated images, and it also inspects/strips AI metadata (EXIF, PNG text chunks, C2PA manifests).

  35. 38

    open-crypto-puzzles

    203floflo777/open-crypto-puzzles · Python

    A catalog of real, unsolved crypto puzzles with wallets still funded on-chain (about 6 BTC, 13 ETH, 1,900 AR across 31 puzzles), each with the author's own research: the escrow address, the puzzle author's clues, what has been tried, and where the trail goes cold.

  36. 39

    CVE-2026-62911

    187hypnguyen1209/CVE-2026-62911 · Python

    A proof-of-concept exploit for CVE-2026-62911, a pre-auth RCE in Microsoft Exchange Server that relays an NTLM machine account hash to the MRSProxy service to drop and run an ASPX webshell, giving full SYSTEM access without any credentials.

  37. 40

    badnotes

    149c22dev/badnotes · Objective-C

    BadNotes is a jailbreak tweak for iOS that unlocks GoodNotes Pro by spoofing the app's subscription check.

  38. 41

    NSNFSSSFSFN

    103ucsd-hacc/NSNFSSSFSFN · Python

    This repository contains the code accompanying the paper (eprint 2026/2131) implementing a variant of the number field sieve that lets an attacker with temporary access to a raw RSA signing oracle permanently forge signatures or decrypt ciphertexts, without ever factoring the public modulus N.

Often tagged together