Awesome Hacker Search Engines
A curated list of websites for searching security, vulnerability, and internet-device data.
- Stars
- 11.5k
- Forks
- 1.1k
- Licence
- MIT
- Language
- Shell
- Last update
- 4 days ago
- Type
- Curated list
What it is
This is a categorized list of web search engines and databases that security professionals use during penetration tests, vulnerability assessments, and bug bounty work. It groups links by purpose, such as finding internet-connected servers, looking up CVEs, locating exploits, or checking DNS and certificate records. It is a reference list of websites rather than a program you install.
- Look up a CVE in NIST NVD, MITRE CVE, or osv.dev
- Search internet-connected servers and services with engines such as Shodan, Censys, or ZoomEye
- Find public exploit listings on Exploit-DB or Sploitus
- Check Unix or Windows binaries for misuse patterns using GTFOBins or LOLBAS
- Browse DNS, certificate, and web history sources listed in the categories
Great for
- Security professionals starting a penetration test or vulnerability assessment who need a place to look up data
- Bug bounty hunters looking for tools that map internet-facing assets
- Blue team analysts checking CVE and advisory sources
- Students learning which public security databases exist
Not ideal for
- People who want software to install, since this is a list of web links rather than a tool (the README does not describe any downloadable app)
- Anyone seeking guaranteed-current information, because the list links to third-party sites that can change or disappear
- Use against systems you do not have permission to test, since many listed engines scan or expose internet-connected devices and the README gives no usage rules beyond its description
How to get it
- 1
Read it online
Clone the repository to keep a local copy
git clone https://github.com/edoardottt/awesome-hacker-search-engines - 2
Run it
- Open the project page or the homepage linked in the repository.
- Pick a category from the table of contents, such as Vulnerabilities or DNS.
- Open a linked site and read its own terms and access rules before using it.
- Return to the list when you need another source for the same kind of data.
- 3
Get the most out of it
- Use the table of contents to jump straight to the category that matches your task.
- Compare results across several vulnerability databases, such as NVD, osv.dev, and GitHub Advisory Database, rather than relying on one.
- Check the Exploits section alongside the Vulnerabilities section when you need proof-of-concept context.
- Use the Servers section to see what public scanners report about your own infrastructure.
Downloads
Strengths
- Organizes many sources into clear categories such as servers, vulnerabilities, DNS, and certificates
- Each entry includes a short description of what the site offers
- Released under the MIT license and maintained with recent activity
Trade-offs
- It is only links and short descriptions, so the README does not explain how each site works or what it costs
- Some listed services are commercial or require accounts, which the list does not state for each entry
- Several entries repeat across categories, such as Rapid7 DB and Vulmon
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| awesome-hacker-search-engines (this) | 11.5k | Curated list | beginner | 4 days ago | Security professionals starting a penetration test or vulnerability assessment who need a place to look up data |
| awesome-hacking | 17.4k | Curated list | beginner | 2.4 years ago | Students looking for a starting map of security topics |
| awesome-security | 15.1k | Curated list | beginner | 10 months ago | Security learners looking for well-known tools in a given area |
| web-check | 35.3k | App | intermediate | 4 days ago | Developers checking how a site is configured |
| PayloadsAllTheThings | 82.3k | Curated list | beginner | 6 days ago | Penetration testers who want a quick reference of payload variations for a known vulnerability class |
| gitleaks | 30.6k | CLI | beginner | 9 days ago | Developers who want to catch accidentally committed credentials before they reach a shared repository |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.