Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| googlesamples/easypermissions EasyPermissions is a Java wrapper library that simplifies Android runtime (M+) system permission requests and handling in Activities and Fr… | 10 | 9854 | maintenance |
| archerysec/archerysec ArcherySec is an open-source application security orchestration and correlation (ASOC) and vulnerability management platform that integrate… | 31 | 2478 | active |
| ChrispyBacon-dev/DockFlare DockFlare is a self-hosted Python/Flask application that watches Docker container events and automatically manages Cloudflare Tunnel ingres… | 85 | 2475 | active |
| duty1g/x64dbg-mcp-server A native MCP (Model Context Protocol) plugin for x64dbg written in Zig that exposes the debugger's full functionality over HTTP with Stream… | 80 | 2473 | active |
| JingMatrix/NeoZygisk NeoZygisk is a Zygote injection module implemented via ptrace that provides Zygisk API support for APatch and KernelSU, and can replace Mag… | 82 | 2470 | active |
| noob-hackers/hacklock Hacklock is a bash-based Termux tool that generates pattern phishing pages to capture an Android victim's unlock pattern via a shared link … | 49 | 2468 | active |
| DNSCrypt/SimpleDnsCrypt Simple DNSCrypt is a Windows GUI management tool for configuring dnscrypt-proxy. It simplifies setting up encrypted DNS on Windows systems. | 52 | 2467 | active |
| mitre-attack/attack-navigator A web application for navigating and annotating MITRE ATT&CK matrices, letting users create custom 'layers' that color-code, comment on, an… | 84 | 2464 | active |
| go-ldap/ldap A Go library providing basic LDAP v3 client functionality, implementing RFC 4511 and related specifications. It supports connecting to LDAP… | 90 | 2460 | stable |
| Notselwyn/CVE-2024-1086 A proof-of-concept local privilege escalation exploit for CVE-2024-1086, a double-free vulnerability in the Linux kernel's nf_tables subsys… | 16 | 2457 | stable |
| Dewalt-arch/pimpmykali A shell script that applies a collection of fixes and configuration tweaks to freshly imported Kali Linux virtual machines. It offers an in… | 42 | 2456 | active |
| square/certstrap certstrap is a Go-based CLI tool for bootstrapping your own certificate authorities and managing a simple public key infrastructure. It ini… | 48 | 2455 | active |
| ZerBea/hcxtools A set of C command-line tools that convert WiFi packet captures (pcap/pcapng) into hash formats compatible with Hashcat and John the Ripper… | 77 | 2454 | active |
| dromara/domain-admin Domain Admin is a self-hosted web platform for monitoring domain and SSL certificate expiration, built with Python (Flask) and Vue3. It als… | 83 | 2453 | active |
| assetnote/react2shell-scanner A Python command-line scanner that detects RCE vulnerabilities CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server… | 38 | 2453 | active |
| hisxo/gitGraber gitGraber is a Python3 command-line tool that monitors GitHub search results in real time to find leaked sensitive data such as API keys an… | 62 | 2452 | active |
| ramonvermeulen/whosthere Whosthere is a Local Area Network discovery tool with an interactive Terminal User Interface, written in Go. It discovers devices via mDNS,… | 80 | 2451 | active |
| 7723mod/NPatch NPatch is a rootless Xposed framework forked from LSPatch, based on LSPosed, that injects Xposed modules into target APKs by inserting dex … | 79 | 2450 | active |
| find-sec-bugs/find-sec-bugs Find Security Bugs is a SpotBugs plugin that performs static security analysis of Java bytecode, detecting 144 vulnerability patterns inclu… | 52 | 2450 | active |
| mandiant/flare-ida A collection of IDA Pro plugins and IDAPython scripts from Mandiant's FLARE team for reverse engineering and malware analysis. It includes … | 10 | 2450 | active |
| EmbarkStudios/cargo-deny cargo-deny is a Cargo plugin (cargo subcommand) for linting Rust dependency graphs. It checks crate licenses against allow/deny lists, bans… | 94 | 2449 | active |
| dirkjanm/BloodHound.py BloodHound.py is a Python-based data ingestor for BloodHound that enumerates Active Directory domains, collecting users, groups, computers,… | 50 | 2447 | active |
| GiacomoLaw/Keylogger A simple, bare-bones keylogger that records keystrokes and saves them to a local log file, with separate implementations for Windows, Linux… | 35 | 2447 | active |
| Shuffle Shuffle is an open source security automation, orchestration and response (SOAR) platform built for security professionals, with a visual w… | 97 | 2444 | active |
| ArgeliusLabs/Chasing-Your-Tail-NG A Python application that monitors Wi-Fi probe requests via Kismet to detect whether a device is being physically followed. It correlates s… | 32 | 2444 | active |
| NetSPI/MicroBurst MicroBurst is a PowerShell toolkit for assessing Microsoft Azure security, including service discovery, weak configuration auditing, and po… | 69 | 2442 | active |
| lestrrat-go/jwx A comprehensive Go library implementing the full JOSE family of standards (JWA, JWE, JWK, JWS, JWT) for signing, verifying, encrypting, and… | 98 | 2440 | active |
| ballerine-io/ballerine Ballerine is an open-source infrastructure and data orchestration platform for identity verification (KYC/KYB), fraud prevention, and merch… | 73 | 2439 | active |
| cloudflare/gokey gokey is a vaultless password manager written in Go that deterministically derives passwords and cryptographic keys on the fly from a maste… | 73 | 2436 | stable |
| RevylAI/greenlight Greenlight is an offline CLI compliance scanner that checks mobile apps against Apple App Store Review Guidelines and Google Play Developer… | 65 | 2436 | active |
| GoCaptcha GoCaptcha is a high-performance, modular behavioral CAPTCHA library for Go that generates interactive challenges including click, slide, dr… | 63 | 2435 | active |
| yjeanrenaud/yj_nearbyglasses Nearby Glasses is a mobile app that scans Bluetooth LE advertisements to detect smart glasses (like Ray-Ban Meta) nearby and warns the user… | 80 | 2433 | active |
| nz-m/SocialEcho SocialEcho is a full-featured social networking platform built on the MERN stack (MongoDB, Express.js, React.js, Node.js) with automated co… | 31 | 2433 | active |
| Microsoft365DSC/Microsoft365DSC Microsoft365DSC is an open-source PowerShell Desired State Configuration (DSC) module that lets organizations automate the deployment, conf… | 96 | 2427 | active |
| drk1wi/Portspoof Portspoof is a lightweight C++ tool that emulates open TCP ports and convincing service signatures across all 65535 ports, making port scan… | 78 | 2425 | active |
| assafdori/bypass-mdm A shell script that bypasses Mobile Device Management (MDM) enrollment during macOS setup, supporting versions up to macOS Tahoe 26.3. It r… | 52 | 2425 | active |
| DataDog/stratus-red-team Stratus Red Team is a self-contained Go CLI that emulates granular, actionable cloud attack techniques mapped to MITRE ATT&CK, against AWS,… | 98 | 2421 | active |
| panva/openid-client openid-client is a TypeScript library providing OAuth 2.0 and OpenID Connect client APIs for JavaScript runtimes including Node.js, Deno, b… | 95 | 2419 | stable |
| hasherezade/hollows_hunter Hollows Hunter is a Windows command-line tool built on the PE-sieve passive memory scanner that scans running processes for malicious impla… | 65 | 2419 | active |
| LoRexxar/Kunlun-M Kunlun-M is an open-source static code analysis (SAST) tool that detects security vulnerabilities in PHP, JavaScript/Node.js, Python, Golan… | 100 | 2418 | active |
| bytedance/android-inline-hook Shadowhook is an Android inline hook library written in C, supporting armeabi-v7a (thumb/arm32) and arm64-v8a architectures on Android 4.1 … | 78 | 2415 | active |
| OpenBullet OpenBullet 2 is a cross-platform automation suite built on .NET for performing HTTP requests against target web applications and processing… | 91 | 2411 | active |
| CrawlerDetect CrawlerDetect is a zero-dependency PHP library that detects bots, crawlers, and spiders by matching User-Agent and HTTP_FROM headers agains… | 94 | 2408 | active |
| bitcookies/winrar-keygen An open-source tool and educational write-up explaining the principle behind WinRAR's 'rarreg.key' license file generation, with implementa… | 90 | 2407 | active |
| mkj/dropbear Dropbear is a small SSH server and client written in C, designed for low memory and disk footprints. It is widely used on embedded Linux sy… | 88 | 2407 | stable |
| smittix/intercept iNTERCEPT is a free, open-source, web-based signal intelligence (SIGINT) platform that unifies dozens of software-defined radio tools into … | 77 | 2403 | active |
| jorhelp/Ingram Ingram is a Python-based vulnerability scanning framework targeting network cameras (IP/CCTV devices). It integrates known exploits for com… | 67 | 2400 | active |
| htrgouvea/nipe Nipe is a Perl-based command-line engine that routes all of a machine's network traffic through the Tor network by manipulating iptables/ip… | 75 | 2398 | active |
| XZB-1248/Spark Spark is a web-based, cross-platform Remote Administration Tool (RAT) written in Go that lets you monitor and control devices from a browse… | 52 | 2395 | active |
| bootleg/ret-sync ret-sync is a set of plugins that synchronize a debugging session (WinDbg, GDB, LLDB, OllyDbg, x64dbg) with disassemblers (IDA, Ghidra, Bin… | 49 | 2395 | active |
| hzqst/VmwareHardenedLoader A Windows kernel driver that mitigates VMware VM detection by filtering VMware-related firmware strings and blocking VMware PnP registry en… | 94 | 2392 | active |
| LSPosed/LSPatch LSPatch is a non-root implementation of the LSPosed Xposed framework that integrates the Xposed API into target Android APKs by inserting d… | 10 | 9439 | maintenance |
| thomseddon/traefik-forward-auth A minimal forward authentication service that adds Google/OpenID Connect OAuth-based SSO login in front of any HTTP service behind the Trae… | 53 | 2391 | active |
| slimm609/checksec A Go rewrite of the classic checksec tool that inspects security hardening properties (RELRO, stack canaries, NX, PIE, FORTIFY_SOURCE, CFI)… | 83 | 2387 | active |
| int128/kubelogin kubelogin is a kubectl plugin (kubectl oidc-login) for Kubernetes OpenID Connect authentication, running as a client-go credential plugin. … | 93 | 2378 | active |
| eslint-community/eslint-plugin-security An ESLint plugin providing security-focused linting rules for Node.js code. It flags potential security hotspots like eval usage, unsafe ch… | 89 | 2378 | active |
| NFCGate NFCGate is an Android application for capturing, analyzing, modifying, relaying, replaying, and cloning NFC traffic. It is a security resea… | 77 | 2378 | active |
| Resinat/Resin Resin is a high-performance proxy pool gateway written in Go that aggregates massive numbers of proxy nodes into a unified, observable prox… | 73 | 2378 | active |
| lijiejie/BBScan BBScan is a fast, lightweight, high-concurrency web vulnerability scanner written in Python. It helps penetration testers quickly identify … | 23 | 2374 | active |
| bigbrodude6119/flipper-zero-evil-portal A Flipper Zero application that turns the Wi-Fi dev board (ESP32) into an open access point serving a fake captive portal login page. Captu… | 20 | 2373 | active |
| MasterKale/SimpleWebAuthn SimpleWebAuthn is a collection of TypeScript-first libraries (@simplewebauthn/server and @simplewebauthn/browser) that simplify adding WebA… | 98 | 2372 | active |
| FiloSottile/whoami.filippo.io A public SSH server (written in Go) that identifies visitors by enumerating the public keys their SSH client offers and matching them again… | 63 | 2367 | stable |
| mojocn/base64Captcha A Go library that generates various types of captchas (digits, strings, math, Chinese, audio) and returns them as base64-encoded image or a… | 50 | 2366 | stable |
| jtpereyda/boofuzz boofuzz is a Python-based network protocol fuzzing framework and the successor to the Sulley Fuzzing Framework. It provides data generation… | 66 | 2365 | active |
| Infisical/agent-vault Agent Vault is an open-source HTTP credential proxy and vault by Infisical that sits between AI agents and the APIs they call. It stores cr… | 81 | 2362 | active |
| hwi/HWIOAuthBundle A Symfony bundle that adds OAuth 1.0a and OAuth 2.0 authentication support, with built-in support for 59 providers such as Google, GitHub, … | 71 | 2361 | active |
| david942j/one_gadget A Ruby command-line tool that finds one-gadget RCE candidates (execve('/bin/sh',...) call sites) in libc binaries for CTF pwn challenges. I… | 97 | 2359 | active |
| alangrainger/immich-public-proxy A stateless proxy that sits in front of a self-hosted Immich instance and serves only explicitly shared photos, videos, and albums to the p… | 85 | 2359 | active |
| keepassxreboot/keepassxc-browser KeePassXC-Browser is a WebExtension that integrates the KeePassXC password manager with Firefox, Chrome/Chromium, and Edge via native messa… | 99 | 2358 | active |
| unrolled/secure Secure is an HTTP middleware library for Go that adds quick security wins to web applications. It works as a standard net/http Handler and … | 55 | 2358 | stable |
| gnuton/asuswrt-merlin.ng A fork of the Asuswrt-Merlin third-party firmware that extends support to additional ASUS routers, including DSL and WiFi 6/7 models. It pr… | 87 | 2357 | active |
| UMSKT/UMSKT UMSKT (Universal MS Key Toolkit) is an open-source C++ CLI toolkit for researching and experimenting with Microsoft's pre-Vista (pre-2012) … | 75 | 2357 | active |
| sddm/sddm SDDM is a QML-based display manager (login screen) for Linux supporting both X11 and Wayland sessions. It is highly themeable via QtQuick, … | 63 | 2356 | active |
| googleprojectzero/fuzzilli Fuzzilli is a coverage-guided fuzzer for JavaScript engines, built in Swift by Google Project Zero. It generates test programs via a custom… | 67 | 2354 | active |
| BeichenDream/GodPotato GodPotato is a C# Windows privilege escalation tool that abuses a DCOM/RPCSS oxid resolution defect to elevate from a service account with … | 23 | 2353 | stable |
| Keybase Keybase is an open-source end-to-end encrypted messaging, file-sharing, and identity-verification platform with clients for macOS, Windows,… | 88 | 9258 | maintenance |
| RKE2 RKE2 (RKE Government) is Rancher's fully conformant, next-generation Kubernetes distribution focused on security and compliance, particular… | 92 | 2352 | active |
| MEDUSA MEDUSA is a modular automation framework and script repository for runtime testing and investigating Android and iOS apps, built on FRIDA. … | 79 | 2352 | active |
| AabyssZG/SpringBoot-Scan SpringBoot-Scan is an open-source penetration testing framework targeting Spring Boot applications, written in Python. It scans for sensiti… | 47 | 2352 | active |
| MegaManSec/SSH-Snake SSH-Snake is a self-propagating, file-less bash script that automatically discovers SSH private keys on a system, attempts to connect to re… | 10 | 2345 | active |
| rabobank-cdc/DeTTECT DeTT&CT is a Python CLI tool and framework that helps blue teams score and map data source quality, visibility, detection coverage, and thr… | 72 | 2341 | active |
| googleprojectzero/sandbox-attacksurface-analysis-tools A suite of PowerShell tools and .NET libraries from Google Project Zero for analyzing Windows sandbox attack surfaces. It includes NtCoreLi… | 42 | 2341 | active |
| crev-dev/cargo-crev cargo-crev is a cryptographically verifiable, distributed code review system for the Rust cargo package manager. It lets developers review … | 79 | 2340 | active |
| ssl/ezXSS ezXSS is a self-hosted PHP application that helps penetration testers and bug bounty hunters detect and exploit (blind) cross-site scriptin… | 60 | 2339 | active |
| dnakov/little-rat A small Chrome extension that monitors and optionally blocks network calls made by other browser extensions. It requires the extensions-on-… | 31 | 2338 | active |
| kubernetes-sigs/aws-iam-authenticator A tool that lets users authenticate to Kubernetes clusters using AWS IAM credentials instead of separate certificates or tokens. It runs as… | 100 | 2337 | active |
| REAndroid/APKEditor APKEditor is a Java command-line tool for editing Android APK resources without depending on aapt/aapt2. It can decode binary resources to … | 84 | 2335 | active |
| safebuffer/vulnerable-AD A PowerShell script that configures a Windows Server domain controller into a deliberately vulnerable Active Directory environment for prac… | 32 | 2333 | active |
| onury/accesscontrol A Node.js library implementing Role-Based Access Control (RBAC) merged with Attribute-Based Access Control (ABAC), including role inheritan… | 93 | 2330 | active |
| zakirkun/deep-eye Deep Eye is an AI-driven penetration testing CLI that orchestrates multiple LLM providers (OpenAI, Claude, Gemini, OLLAMA, Groq, and others… | 64 | 2330 | active |
| LuckPerms LuckPerms is a permissions plugin for Minecraft servers that lets admins control player access by creating groups and assigning permissions… | 77 | 2328 | stable |
| Vue Auth A lightweight, plugin-based authentication library for Vue.js (Vue 2 and Vue 3) that handles login, registration, and token management in s… | 10 | 2327 | active |
| p0dalirius/Coercer Coercer is a Python CLI tool that automatically coerces Windows servers to authenticate to an arbitrary machine via multiple RPC methods ov… | 54 | 2323 | active |
| AhmetCanArslan/ShizuWall ShizuWall is a lightweight Android firewall app that controls per-app network access without using a VPN tunnel. It works on Android 11+ by… | 83 | 2321 | active |
| bjdgyc/anylink AnyLink is an enterprise-grade SSL VPN server written in Go that supports many concurrent remote-access users. It implements the OpenConnec… | 90 | 2316 | active |
| Kritt-ai/open-kritt open·kritt is an open-source, self-hosted AI vulnerability research platform that decomposes a codebase into focused security tasks, runs A… | 77 | 2316 | active |
| kylemanna/docker-openvpn A Docker image and shell tooling that runs an OpenVPN server in a container, bundled with an EasyRSA PKI certificate authority. It automate… | 29 | 9086 | maintenance |
| httptoolkit/frida-interception-and-unpinning A collection of Frida scripts that rewrite mobile applications at runtime to bypass certificate pinning and route all HTTPS traffic through… | 77 | 2315 | active |
| CravateRouge/bloodyAD bloodyAD is a Python CLI tool for Active Directory privilege escalation that performs specific LDAP calls against domain controllers. It su… | 95 | 2314 | active |
| owerdogan/whoami-project Whoami is a user-friendly privacy and anonymity CLI tool for Debian and Arch-based Linux distributions. It bundles 9+ modules such as IP ch… | 40 | 2313 | active |