Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| salesforce/policy_sentry Policy Sentry is a Python CLI tool and library that generates least-privilege AWS IAM policies. It automates writing security-conscious IAM… | 82 | 2170 | stable |
| vulhub/java-chains Java Chains is a self-hosted web platform for generating Java exploitation payloads, aimed at security researchers. It supports common Java… | 83 | 2166 | active |
| mcu-tools/mcuboot MCUboot is a secure bootloader for 32-bit microcontrollers that defines common infrastructure for bootloaders and flash layout, enabling se… | 79 | 2166 | stable |
| ffffffff0x/f8x f8x is a Bash-based automation deployment script that installs 100+ security and development tools for red team, blue team, CTF, and cloud-… | 67 | 2166 | active |
| BishopFox/unredacter Unredacter is an Electron-based desktop tool that demonstrates how pixelated redactions in images can be reversed by brute-force guessing t… | 32 | 8398 | maintenance |
| zhzyker/dismap Dismap is a Go-based asset discovery and identification tool that fingerprints web, TCP, UDP, and TLS services using a rule base of 4500+ w… | 23 | 2165 | active |
| 0Chencc/CTFCrackTools CTFCrackTools X is a cross-platform desktop CTF toolkit built with Rust and Tauri, featuring a visual node-based workflow for composing enc… | 74 | 2164 | active |
| Ropper Ropper is a Python CLI tool that displays information about binary files (ELF, PE, Mach-O, RAW) and finds ROP/JOP gadgets to build exploit … | 73 | 2152 | active |
| bit4woo/domain_hunter_pro Domain Hunter Pro is a Burp Suite plugin (Java jar) for automated domain and subdomain collection, web title fetching, and target managemen… | 67 | 2151 | active |
| sparrowwallet/sparrow Sparrow is a free, open-source desktop Bitcoin wallet application built in Java with a focus on security, privacy, and transparency. It sup… | 97 | 2150 | active |
| RichardKnop/go-oauth2-server A standalone, specification-compliant OAuth 2.0 authorization server written in Go. It implements the standard grant types (authorization c… | 44 | 2150 | active |
| Python Social Auth The Django integration component of the python-social-auth ecosystem, providing social authentication and registration via OAuth2 and other… | 94 | 2146 | active |
| last-byte/PersistenceSniper PersistenceSniper is a PowerShell module for hunting persistence mechanisms implanted in Windows machines. It is aimed at Blue Teams, Incid… | 34 | 2145 | active |
| TrustKit TrustKit is an open-source Objective-C framework that simplifies deploying SSL public key pinning and reporting in iOS, macOS, tvOS, and wa… | 74 | 2144 | active |
| PowerShell/Win32-OpenSSH A Win32 port of OpenSSH for Windows, now serving as a release and issue tracker plus wiki for the project. Active development has moved to … | 71 | 8291 | maintenance |
| chainreactors/gogo gogo is a high-performance, highly configurable automated scanning engine written in pure Go for red team operations. It combines port scan… | 85 | 2141 | active |
| a13xp0p0v/kernel-hardening-checker A Python CLI tool that checks the security hardening options of the Linux kernel across Kconfig options, boot command line arguments, and s… | 75 | 2140 | active |
| fortra/nanodump NanoDump is a C-based tool that creates minidumps of the Windows LSASS process using a variety of stealthy handle-acquisition and dumping t… | 32 | 2140 | active |
| vvb2060/KeyAttestation An Android app for generating, parsing, and verifying Android key and ID attestation data. It performs self-testing locally with no network… | 39 | 2137 | active |
| tomnomnom/gf gf is a Go-based command-line wrapper around grep that lets you save and reuse named regex patterns and flags as JSON files. It simplifies … | 32 | 2136 | stable |
| phra/PEzor PEzor is an open-source shellcode and PE packer that wraps executables or raw shellcode into new binaries with evasion features like unhook… | 32 | 2136 | active |
| PoshC2 PoshC2 is a proxy-aware Command and Control (C2) framework written in Python3 that aids penetration testers with red teaming, post-exploita… | 43 | 2135 | active |
| Mina Protocol Mina is a layer-1 cryptocurrency protocol implemented in OCaml featuring a constant-sized (~22KB) blockchain built with recursive zero-know… | 95 | 2128 | active |
| Ibex RISC-V Core Ibex is a production-quality, open-source 32-bit RISC-V CPU core written in SystemVerilog, originally developed as 'Zero-riscy' in the PULP… | 77 | 2126 | active |
| motioneye-project/motioneyeos motionEyeOS is a Linux distribution that turns single-board computers like the Raspberry Pi into a video surveillance system with camera mo… | 23 | 8215 | maintenance |
| brightio/penelope Penelope is a modern reverse shell handler for penetration testers and CTF players, serving as a more capable alternative to basic netcat l… | 87 | 2125 | active |
| haccer/subjack Subjack is a DNS takeover scanner written in Go that concurrently scans lists of subdomains to identify ones vulnerable to hijacking. It de… | 91 | 2123 | active |
| megadose/ignorant Ignorant is a Python CLI tool and library that checks whether a phone number is registered on sites like Instagram, Snapchat, and Amazon wi… | 32 | 2121 | active |
| Trail of Bits Claude Code Config A Claude Code plugin marketplace from Trail of Bits offering skills for AI-assisted security analysis, code auditing, and vulnerability det… | 57 | 2120 | active |
| eugene1g/agent-safehouse Agent Safehouse is a macOS-native sandboxing tool that runs local LLM coding agents (Claude Code, Codex, Gemini CLI, Aider, etc.) inside a … | 81 | 2115 | active |
| hannob/snallygaster Snallygaster is a Python command-line scanner that probes HTTP servers for files that should not be publicly accessible, such as exposed gi… | 67 | 2114 | active |
| Btlejack BtleJack is a Python CLI tool for sniffing, jamming, and hijacking Bluetooth Low Energy (BLE) connections. It relies on BBC Micro:Bit, Blue… | 23 | 2113 | active |
| topjohnwu/libsu libsu is an Android library providing a complete solution for apps that need root (superuser) permissions. It wraps the Unix root shell pro… | 52 | 2112 | active |
| defparam/smuggler Smuggler is a Python 3 command-line tool that tests web servers and proxies for HTTP request smuggling and desync vulnerabilities. It fires… | 32 | 2112 | active |
| paragonie/random_compat A PHP 5.x polyfill providing the random_bytes() and random_int() CSPRNG functions that were introduced in PHP 7. It fails with an exception… | 50 | 8151 | maintenance |
| kkbo8005/mitan Mitan (密探) is an all-in-one penetration testing and security assessment desktop application integrating asset mapping, subdomain brute-forc… | 92 | 2111 | active |
| Leanmcp/superview.sh A shell-based setup for the LeanMCP AI Gateway, a hosted proxy that routes Claude Code (and other AI coding tools) requests through a singl… | 59 | 2111 | active |
| AzizKpln/Moriarty-Project Moriarty Project is a web-based phone number investigation tool written in Python that gathers information about a given phone number. It a… | 65 | 2110 | active |
| authorizerdev/authorizer Authorizer is an open-source, self-hosted authentication and authorization server written in Go, providing OAuth2/OIDC, SAML SSO, MFA, soci… | 97 | 2107 | active |
| al0ne/LinuxCheck A shell-based Linux emergency response and information gathering tool that performs 70+ security checks across 13 categories, including roo… | 23 | 2106 | active |
| Keats/jsonwebtoken A Rust library for creating and decoding JSON Web Tokens (JWTs) in a strongly typed way, supporting HS256/384/512, RS256/384/512, PS256/384… | 76 | 2101 | active |
| thoughtworks/talisman Talisman is a Go-based CLI tool that installs a git pre-commit/pre-push hook to scan outgoing changesets for potential secrets such as toke… | 61 | 2099 | active |
| authgear/authgear-server Authgear is an open-source customer identity and access management (CIAM) platform serving as a self-hostable alternative to Auth0, Clerk, … | 98 | 2098 | active |
| oss-review-toolkit/ort The OSS Review Toolkit (ORT) is a FOSS policy automation toolkit that analyzes project dependencies, scans licenses and copyrights, checks … | 94 | 2098 | active |
| hanc00l/nemo_go Nemo is an automated information-gathering platform for penetration testing that integrates common recon tools (Masscan, Nmap, Subfinder, H… | 82 | 2098 | active |
| CorentinTh/enclosed Enclosed is a minimalistic self-hostable web application for sharing end-to-end encrypted notes and file attachments. Notes are encrypted c… | 69 | 2096 | active |
| Sh1Yo/x8 x8 is a hidden parameter discovery suite written in Rust for security testing of web applications. It brute-forces parameter names against … | 23 | 2096 | active |
| 520coding/confuse A Mac application that performs source-to-source obfuscation of iOS projects, simulating human-style renaming with context awareness includ… | 83 | 2090 | active |
| Shadowrocket for Android Shadowrocket for Android is a free VPN client that provides built‑in free proxy nodes and premium private servers. It supports multiple pro… | 97 | 2089 | active |
| SBOM Tool Microsoft's SBOM Tool is a scalable, enterprise-ready CLI that generates SPDX 2.2 and SPDX 3.0 compatible Software Bill of Materials docume… | 77 | 2088 | active |
| pivpn/pivpn PiVPN is a set of shell scripts that turn a Raspberry Pi or any Debian/Ubuntu server into a WireGuard or OpenVPN VPN server with a one-comm… | 75 | 8044 | maintenance |
| rebootuser/LinEnum LinEnum is a shell script that performs scripted local Linux enumeration and privilege escalation checks. It gathers system, user, network,… | 32 | 8039 | maintenance |
| mkhorasani/Streamlit-Authenticator A Python library providing secure authentication widgets and credential management for Streamlit applications. It supports login, registrat… | 60 | 2086 | active |
| OpenPubkey opkssh is a Go CLI tool that enables SSH authentication via OpenID Connect identities instead of long-lived SSH keys. It generates SSH publ… | 88 | 2083 | active |
| TrianguloY/URLCheck URLCheck is an open-source Android app that acts as an intermediary when opening URLs, letting users inspect, clean, and modify links befor… | 83 | 2082 | active |
| SamueleAmato/sosec sosec is a Python command-line toolkit with a terminal UI for automated credential testing and HTTP request orchestration against social me… | 57 | 2082 | active |
| mandiant/speakeasy Speakeasy is a Windows user-mode and kernel-mode emulation framework that runs binaries, drivers, and shellcode inside a modeled Windows ru… | 79 | 2081 | active |
| lasting-yang/frida_dump A collection of Frida scripts for dumping DEX files and native shared libraries (.so) from running Android processes. It includes SoFixer-b… | 45 | 2081 | active |
| someengineering/fixinventory Fix Inventory is an open-source cloud asset inventory and security tool that collects metadata from cloud providers (AWS, GCP, Azure, Digit… | 52 | 2078 | active |
| erocarrera/pefile pefile is a multi-platform Python module for parsing and working with Portable Executable (PE) files such as EXE and DLL binaries. It expos… | 67 | 2076 | stable |
| ipinfo/cli The official command-line client for the IPinfo.io API, written in Go. It lets users look up IP geolocation, ASN, privacy detection, and re… | 67 | 2074 | active |
| hashicorp/envconsul Envconsul is a Go CLI tool that launches a subprocess with environment variables populated from HashiCorp Consul key-value data and Vault s… | 83 | 2073 | active |
| kaikramer/keystore-explorer KeyStore Explorer is a free, open-source Java desktop application that provides a graphical interface replacing the keytool and jarsigner c… | 86 | 2071 | active |
| PlakarKorp/plakar Plakar is an open-source backup engine written in Go that creates encrypted, deduplicated, independently verifiable snapshots of files, dat… | 97 | 2070 | active |
| zarf-dev/zarf Zarf is a free, open-source CLI package manager for declaratively packaging and deploying Kubernetes applications and cloud-native workload… | 95 | 2070 | active |
| redballoonsecurity/ofrak OFRAK is a binary analysis and modification platform that identifies, unpacks, analyzes, modifies, and repacks binaries, with first-class s… | 63 | 2070 | active |
| haad/proxychains ProxyChains is a UNIX command-line tool that forces TCP connections and DNS lookups of any dynamically linked program through SOCKS4/5 or H… | 32 | 7964 | maintenance |
| lukechilds/reverse-shell A hosted service (reverse-shell.sh) that generates reverse shell payloads on demand; piping its URL output into sh on a target spawns a she… | 59 | 2069 | active |
| CYB3RMX/Qu1cksc0pe Qu1cksc0pe is an all-in-one malware analysis tool that statically and dynamically analyzes many file types, including Windows/Linux/macOS e… | 75 | 2067 | active |
| Leon406/ToolsFx ToolsFx is a cross-platform desktop cryptography toolbox built with Kotlin. It bundles encoding/decoding, hash and MAC computation, symmetr… | 71 | 2066 | active |
| SAP/macOS-enterprise-privileges Privileges is a free macOS application from SAP that lets enterprise users temporarily elevate their accounts to administrator rights for a… | 92 | 2065 | active |
| ainfosec/FISSURE FISSURE is an open-source RF and reverse engineering framework built around software-defined radios, supporting signal detection, classific… | 86 | 2063 | active |
| ReAgent auto-re-agent is an open-source AI reverse-engineering agent that combines Ghidra binary analysis with LLMs (Claude, Codex, OpenAI-compatib… | 78 | 2063 | active |
| usbarmory/tamago TamaGo is a framework that enables compilation and execution of Go applications directly on bare metal processors, without any underlying o… | 96 | 2060 | active |
| cifertech/nRFBox nRFBox is an open-source ESP32-based handheld tool that scans, analyzes, jams, and spoofs BLE, Wi-Fi, and 2.4GHz signals using an nRF24L01 … | 69 | 2060 | active |
| vmoranv/jshookmcp An MCP server exposing 600+ tools across 34 domains for JavaScript reverse engineering and security research, including browser automation,… | 72 | 2059 | active |
| ine-labs/AWSGoat AWSGoat is a deliberately vulnerable AWS infrastructure deployed via Terraform, featuring OWASP Top 10 web vulnerabilities and cloud miscon… | 39 | 2055 | active |
| jtsylve/LiME LiME (Linux Memory Extractor) is a loadable kernel module that acquires volatile memory from Linux and Android devices, writing captures to… | 74 | 2050 | active |
| GhostPack/Certify Certify is a C# command-line tool for enumerating and abusing misconfigurations in Active Directory Certificate Services (AD CS). It was re… | 76 | 2044 | active |
| certsocietegenerale/FIR FIR (Fast Incident Response) is a self-hosted cybersecurity incident management platform built with Django. It enables CSIRTs, CERTs, and S… | 65 | 2044 | active |
| sipt/shuttle Shuttle is a cross-platform network proxy tool written in Go supporting SOCKS5, SOCKS5 over TLS, and shadowsocks protocols. It offers rule-… | 44 | 2044 | active |
| berdav/CVE-2021-4034 A proof-of-concept exploit and vulnerability checker for CVE-2021-4034 (PwnKit), a polkit pkexec local privilege escalation vulnerability i… | 32 | 2044 | stable |
| lirantal/is-website-vulnerable A Node.js CLI tool that scans a website's frontend JavaScript libraries for publicly known security vulnerabilities using the Snyk database… | 91 | 2043 | active |
| jdx/aube aube is a fast Node.js package manager written in Rust that auto-installs dependencies when you run scripts, with secure defaults like a li… | 78 | 2041 | active |
| pgkt04/defender-control An open-source Windows utility that permanently disables or re-enables Windows Defender by running as TrustedInstaller, setting disabling p… | 74 | 2040 | active |
| iden3/snarkjs A JavaScript and pure WebAssembly implementation of zkSNARK schemes including Groth16, PLONK, and FFLONK. It provides all tooling for gener… | 73 | 2039 | active |
| shivaya-dav/DogeRat DogeRat is a Telegram-controlled Android remote access tool (RAT) consisting of a Node.js/Express/Socket.IO server and a Kotlin Android APK… | 39 | 2038 | active |
| HackUnderway/SearchPhone SearchPhone is a Python CLI OSINT toolkit for investigating phone numbers across multiple sources, including Google (SerpAPI), DuckDuckGo, … | 63 | 2037 | active |
| ASHWIN990/ADB-Toolkit ADB-Toolkit is a Bash script wrapping the Android Debug Bridge with 28 options plus a Metasploit section for testing and exploiting Android… | 23 | 2037 | active |
| yeti-platform/yeti Yeti is a self-hosted threat intelligence platform that stores and links observables, entities, and indicators to answer questions like 'wh… | 98 | 2034 | active |
| jkroepke/helm-secrets helm-secrets is a Helm plugin that transparently encrypts and decrypts Helm value files using sops, allowing secrets to be safely stored in… | 99 | 2033 | active |
| openid/AppAuth-iOS AppAuth-iOS is an Objective-C client SDK for iOS, macOS, and tvOS that implements OAuth 2.0 and OpenID Connect authorization flows. It foll… | 87 | 2032 | stable |
| sahat/satellizer Satellizer is a token-based authentication module for AngularJS with built-in support for major OAuth providers (Google, Facebook, Twitter,… | 23 | 7787 | maintenance |
| admindroid-community/powershell-scripts A collection of over 100 self-contained PowerShell scripts for managing, reporting on, and auditing Microsoft 365 (Office 365) tenants. Eac… | 75 | 2029 | active |
| GrapheneOS/hardened_malloc hardened_malloc is a security-focused general purpose memory allocator implementing the malloc API with extensive hardening against heap co… | 75 | 2029 | active |
| daymade/Twitter-Block-Porn A Tampermonkey/Greasemonkey userscript that batch-blocks Twitter/X accounts from shared blocklists of porn-spam scammers. It simulates Twit… | 74 | 2029 | active |
| hyperion-cs/dpi-checkers A collection of checkers (a comprehensive Go-based DPI-CH tool plus browser-based checkers) that detect whether an ISP or datacenter applie… | 83 | 2027 | active |
| sc0tfree/mentalist Mentalist is a graphical Python tool for generating custom password wordlists based on common human password-construction patterns. It can … | 57 | 2027 | active |
| Tencent/soter TENCENT SOTER is a biometric authentication standard and platform for Android, developed by Tencent and used in WeChat fingerprint payment.… | 47 | 2027 | active |
| IDA-NO-MCP A collection of reverse engineering skills (prompt/plugin packages) for AI coding assistants like Claude Code, designed to work with IDA-NO… | 55 | 2026 | active |