← The AI Hype Audit — all 422 verdicts

REAL

Holds up: the five 'GitHub repos that will make you a hacker' are real, active, widely used security references (HackTricks, PayloadsAllTheThings, OWASP WSTG, Awesome Hacking, WebGoat), minus the part where reading them makes you a hacker

Facebook · Oct 2026

The claim'5 GitHub Repos That Will Make You a Hacker!' 1. HackTricks (Linux commands, IP, TCP/IP, LAN/PAN, ports). 2. PayloadsAllTheThings (security concepts and pentesting notes). 3. OWASP Web Security Testing Guide (web application testing and methodology). 4. Awesome Hacking (legal hands-on practice labs). 5. OWASP WebGoat (after understanding the concepts, use it as a reference). Caption: 'Which are the best GitHub repos that help us to become a hacker?'

All five repositories exist, are public, and are the kind of thing working penetration testers actually keep open. Checked on GitHub's API today: HackTricks-wiki/hacktricks has about 12,500 stars and was updated this week; swisskyrepo/PayloadsAllTheThings has about 81,400 stars; OWASP/wstg, the Web Security Testing Guide, about 9,900 stars and updated two days ago; Hack-with-Github/Awesome-Hacking about 121,700 stars; WebGoat/WebGoat about 9,400 stars and updated last week. None are archived. The one-line descriptions are mostly right but a little scrambled. HackTricks is a pentesting methodology wiki, not a Linux and networking primer. PayloadsAllTheThings is a payload and bypass cheat sheet, which is 'pentesting notes' in a loose sense. WSTG is exactly what the reel says. Awesome Hacking is a curated list of links, not 'legal hands-on practice labs'; that description belongs to WebGoat, which is OWASP's deliberately vulnerable app for practicing attacks safely, not a 'reference'. The title is the stretch. These are references and a practice target; they do not make anyone a hacker any more than a dictionary makes a writer. Nothing is sold here except the follow: no course, no link, no comment hook, and the audio is a music track. Worth noting that HackTricks also runs a paid training arm, which is not mentioned and not pushed.

What holds up

  • Reel read frame by frame: title '5 GitHub Repos That Will Make You a Hacker!' over a terminal background, then five cards: HackTricks, PayloadsAllTheThings, OWASP Web Security Testing Guide, Awesome Hacking, OWASP WebGoat, each with a one-line description. No voice (music), no link, no comment hook.
  • GitHub API checked Oct 2, 2026: HackTricks-wiki/hacktricks 12,464 stars, pushed within the day; swisskyrepo/PayloadsAllTheThings 81,425 stars; OWASP/wstg 9,946 stars, pushed Sep 30; Hack-with-Github/Awesome-Hacking 121,729 stars; WebGoat/WebGoat 9,388 stars, pushed Sep 28. None archived.
  • Descriptions are shuffled: Awesome Hacking is a curated link list, not practice labs; WebGoat is the practice lab (OWASP's intentionally vulnerable app), not a reference; HackTricks is a pentesting methodology wiki rather than a networking primer.
  • No product, course or funnel attached; the page sells follows. HackTricks has a separate paid training business that the reel does not mention.

What doesn’t

  • 'Will make you a hacker' oversells a reading list; these are references and one practice target, and the skills come from labs, CTFs and time.
  • Two of the five descriptions are swapped (Awesome Hacking vs WebGoat), which suggests the list was assembled from a template, not from use.
  • Nothing here covers the legal line: practice only on WebGoat, your own machines, or platforms that give written permission.

The catch

The list is legit and free, and a beginner could do worse than bookmarking all five. The honest version of the title is 'five references pentesters use'. Becoming one takes WebGoat, a few hundred hours of labs, and never pointing any of this at a system you do not own.

How to actually do it

  • Start with OWASP WebGoat (run it locally in Docker) and the WSTG side by side; do one lesson a day and read the matching WSTG section.
  • Use HackTricks and PayloadsAllTheThings as lookups while you work labs on a legal platform (TryHackMe, Hack The Box, PortSwigger Academy), not as reading material.
  • Treat Awesome Hacking as a map, pick one path (web, network, cloud), and ignore the rest until you have finished it.

Every repo named is real, active and respected, and nothing is being sold beyond the follow. The reel mislabels two of them and the title promises an outcome that only practice delivers.

Confidence
High
Posted by
a cybersecurity-tips meme page (19K reactions on the reel); reel sent to Buddy Sat Sep 26, 2026, ~5:28 PM

See the original claim →

We test hype for free. We build the real thing for a living.

Thirty minutes, no pitch — and you'll leave with something useful either way.

Book a call with Todd or start with the free Business Checkup →

The Verdict Weekly

Three verdicts every Friday. Free forever, unsubscribe anytime, no spam — that would be ironic.

© Schreier Group · schreiergroup.com · See a wild AI claim? Drop it here and we'll test it.