All projects
Repositories in this selection 16 · UTC 2026-11-04
CompareRankProjectStarFork30-day trend7-day net changeLast pushSign in to save
1—Cchaitin / SafeLineSafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.GoGPL-3.0 · Share derivative sourceInsufficient rank history23,1541,592——2026-10-22
2—Ccure53 / DOMPurifyDOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:JavaScriptApache-2.0 · PermissiveInsufficient rank history17,499894——2026-11-01
3—Ss0md3v / XSStrikeAn XSS vulnerability scanner.PythonGPL-3.0 · Share derivative sourceInsufficient rank history15,2382,099——2025-04-26
4—HHacker0x01 / hacker101Source code for Hacker101.com - a free online web and mobile security class.SCSSNOASSERTION · Restricted / unknownInsufficient rank history14,6152,661——2025-02-22
5—Nnahamsec / Resources-for-Beginner-Bug-Bounty-HuntersA list of resources for those interested in getting started in bug bountiesUnknownUnknown · Restricted / unknownInsufficient rank history12,3122,053——2024-07-23
6—Cchaitin / xrayA comprehensive security assessment tool self-developed by Changting, which supports scanning of common web security issues and customized POC | Be sure to read the documentation before using itVueNOASSERTION · Restricted / unknownInsufficient rank history11,7821,870——2024-10-29
7—Rreddelexc / hackerone-reportsTop disclosed reports from HackerOnePythonUnknown · Restricted / unknownInsufficient rank history6,6531,162——2026-10-12
8—Ddromara / lamp-cloud[Dengdeng] Microservice mid- and back-end rapid development platform supports jdk21, jdk17, and jdk8. It focuses on multi-tenant and open platform solutions. It can also be used as a basic development framework for ordinary projects (non-SaaS architecture). Currently, it has implemented pluggable database isolation, SCHEMA isolation, field isolation and other tenant isolation solutions.JavaApache-2.0 · PermissiveInsufficient rank history5,7651,751——2026-10-09
9—Hhahwul / dalfox🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.RustMIT · PermissiveInsufficient rank history5,355581——2026-11-01
10—Ss0md3v / AwesomeXSSAwesome XSS stuffJavaScriptMIT · PermissiveInsufficient rank history5,156780——2024-10-30
11—CCHYbeta / Web-Security-LearningA directory of Web-security learning resources, organizing reference articles and tool links on SQL injection, XSS, access control, code auditing, and related topics.HTMLUnknown · Restricted / unknownInsufficient rank history4,3071,002——2021-10-02
12—Ffoospidy / payloadsGit All the Payloads! A collection of web attack payloads.ShellGPL-3.0 · Share derivative sourceInsufficient rank history4,003984——2023-05-15
13—Mmicrocosm-cc / bluemondaybluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSSGoBSD-3-Clause · PermissiveInsufficient rank history3,730202——2025-04-04
14—Bbountyyfi / lonkeroLonkero - Wraps around your attack surface. Professional-grade scanner for real penetration testing. Fast. Modular. Rust.RustNOASSERTION · Restricted / unknownInsufficient rank history1,09994——2026-11-02
15—Ttijme / angularjs-csti-scannerAutomated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.PythonMIT · PermissiveInsufficient rank history32694——2021-10-20
16—Vv8blink / Chromium-based-XSS-Taint-TrackingCyclops is a browser with XSS detection capabilitiesUnknownGPL-3.0 · Share derivative sourceInsufficient rank history12712——2024-06-30
License tiers are derived from metadata. Check obligations for your use; unknown does not mean prohibited.