Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| ttionya/vaultwarden-backup A Docker-based backup tool for Vaultwarden (formerly bitwarden_rs) that archives the database, config, RSA keys, attachments, and sends dir… | 94 | 1892 | active |
| liamg/traitor Traitor is a Go-based CLI tool that automatically exploits common Linux misconfigurations and known vulnerabilities (GTFOBins, pwnkit, dirt… | 23 | 7161 | maintenance |
| zakirkun/guardian-cli Guardian is a Python CLI tool that automates penetration testing workflows using LLM providers (OpenAI, Claude, Gemini, Ollama, and others)… | 63 | 1889 | active |
| pentestfunctions/BlueDucky BlueDucky is a Python tool that exploits CVE-2023-45866, an unauthenticated Bluetooth peering vulnerability, to execute keystroke injection… | 53 | 1885 | active |
| srixivas/PcapXray PcapXray is a Python-based network forensics tool that visualizes PCAP files or live traffic as an annotated network diagram. It identifies… | 78 | 1884 | active |
| Chleba/netscanner netscanner is a terminal-based network scanner and diagnostic tool with a modern TUI, written in Rust. It supports WiFi network scanning, C… | 73 | 1884 | active |
| googleapis/google-auth-library-nodejs Google's officially supported Node.js client library for OAuth 2.0 authentication and authorization with Google APIs. It supports Applicati… | 10 | 1884 | stable |
| sarperavci/GoogleRecaptchaBypass A Python library that automatically solves Google reCAPTCHA v2 challenges in under five seconds using browser automation with DrissionPage … | 65 | 1883 | active |
| zhlynn/zsign zsign is a fast, cross-platform open-source alternative to Apple's codesign tool for re-signing iOS .ipa packages, Mach-O binaries, and .ap… | 92 | 1882 | active |
| abc123info/BlueTeamTools BlueTeamTools is a Java-based GUI toolbox that aggregates utilities for blue-team security analysts, covering memory-shell decompilation, w… | 85 | 1882 | active |
| cloudflare/workers-oauth-provider An OAuth 2.1 provider library for Cloudflare Workers that adds authorization-server capabilities to HTTP APIs and remote MCP servers. It ha… | 87 | 1881 | active |
| tls-client A Go HTTP client library with a net/http-like interface that lets you select specific browser TLS fingerprints (Chrome, Firefox, Safari, et… | 90 | 1879 | active |
| jazzband/django-two-factor-auth A Django package providing complete two-factor authentication built on top of django-otp and Django's built-in auth framework. It supports … | 79 | 1879 | active |
| wapiti-scanner/wapiti Wapiti is an open-source black-box web vulnerability scanner written in Python that crawls deployed web applications and fuzzes scripts and… | 95 | 1877 | active |
| Symfony Security The core library of the Symfony Security component, providing infrastructure for authentication tokens, user providers, role hierarchies, a… | 93 | 1877 | stable |
| emsec/ChameleonMini ChameleonMini is a freely programmable, portable NFC device that can emulate and clone contactless smartcards, read RFID tags, and sniff/lo… | 23 | 1877 | active |
| sbabic/swupdate SWUpdate is a Linux update agent for safely updating embedded Linux devices in the field, supporting local and OTA updates with multiple st… | 81 | 1876 | stable |
| iMerica/dj-rest-auth dj-rest-auth provides drop-in authentication and registration endpoints for Django REST Framework, including login, logout, password manage… | 74 | 1876 | active |
| initstring/linkedin2username A Python OSINT tool that scrapes LinkedIn employee lists for a target company and generates multiple probable username formats (e.g., first… | 70 | 1876 | active |
| airbus-seclab/bincat BinCAT is a static binary code analysis toolkit that performs value analysis, taint analysis, type reconstruction, and use-after-free/doubl… | 23 | 1876 | active |
| schollz/howmanypeoplearearound A Python CLI tool that estimates how many people are nearby by sniffing WiFi probe requests from smartphones using tshark. It works with mo… | 23 | 7088 | maintenance |
| tanrax/maza-ad-blocking Maza is a local ad blocker written as a single Bash script that blocks ads at the DNS level by editing the operating system's hosts file, w… | 72 | 1872 | active |
| niklasb/libc-database A shell-based tool that builds a searchable database of libc symbol offsets from Ubuntu, Debian, and other distributions to simplify binary… | 72 | 1872 | active |
| lazaronixon/authentication-zero A Rails generator that scaffolds a complete, pre-built authentication system directly into a Rails application (web or API-only), following… | 34 | 1872 | active |
| iliyami/MacSai Mac Sai is a free, open-source macOS application that cleans junk files, scans for malware, uninstalls apps completely, and visualizes disk… | 82 | 1870 | active |
| Sourcery Sourcery is an AI-powered automated code review service that reviews pull requests on GitHub and GitLab, posting summaries, inline comments… | 96 | 1869 | active |
| keshavdv/unifi-cam-proxy A Python proxy that lets non-Ubiquiti RTSP-enabled cameras appear as native cameras in UniFi Protect NVR. It supports live streaming, full-… | 77 | 1869 | active |
| DosX-dev/obfus.h A macro-only C header library that obfuscates code at compile time, designed for the Tiny C Compiler on Windows x86/x64. It provides contro… | 70 | 1867 | active |
| lifting-bits/remill Remill is a C++ library that statically translates machine code instructions (x86, amd64, AArch64, SPARC32/64) into LLVM bitcode. It is des… | 78 | 1866 | active |
| aquasecurity/tfsec tfsec is a static analysis security scanner for Terraform code that detects misconfigurations across major cloud providers using hundreds o… | 59 | 7046 | maintenance |
| jnitrace jnitrace is a Frida-based command-line tool that dynamically traces JNI API calls made by native libraries in Android apps. It works like f… | 23 | 1865 | stable |
| ninoseki/mitaka Mitaka is a browser extension for Chrome and Firefox that simplifies OSINT (Open Source Intelligence) searches. It automatically detects an… | 91 | 1864 | active |
| 0xKayala/NucleiFuzzer NucleiFuzzer is a Python-based automation tool that combines URL discovery tools (ParamSpider, Waybackurls, Gauplus, Hakrawler, Katana) wit… | 63 | 1863 | active |
| trustedsec/hate_crack hate_crack is a Python tool by TrustedSec that automates password cracking methodologies on top of Hashcat, orchestrating wordlists, masks,… | 93 | 1862 | active |
| alfiecg24/TrollInstallerX TrollInstallerX is a universal TrollStore installer for iOS 14.0 through 16.6.1, supporting both arm64 and arm64e devices. It uses the kfd … | 16 | 1861 | active |
| superagent-ai/vibekit VibeKit is a CLI tool that wraps AI coding agents such as Claude Code, Gemini CLI, Grok CLI, and Codex in isolated Docker sandboxes with au… | 46 | 1860 | active |
| complexorganizations/wireguard-manager A shell-based tool that automates the installation, configuration, and management of WireGuard VPN servers. It provides a user-friendly way… | 45 | 1860 | active |
| nix-community/lanzaboote Lanzaboote is Rust tooling that brings UEFI Secure Boot and Measured Boot support to NixOS. Its lzbt tool signs boot components, builds Uni… | 80 | 1858 | active |
| zengzhan/qqzeng-ip A high-performance IP geolocation lookup engine (QZDB) with multi-language SDKs (Rust, C/C++, Go, Java, C#, Node.js, Python, PHP) that reso… | 76 | 1856 | active |
| selinuxG/Golin Golin is a Go-based security assessment tool combining asset discovery, port/service scanning, weak password brute-forcing for 40+ services… | 62 | 1856 | active |
| iojw/socialscan socialscan is a Python library and CLI tool that checks whether usernames and email addresses are taken, available, or invalid across onlin… | 62 | 1856 | active |
| j3ssie/metabigor Metabigor is a Go-based command-line OSINT tool that maps a target's infrastructure—IP ranges, subdomains, related domains, open ports, and… | 80 | 1853 | active |
| Automattic/jetpack Jetpack is a suite of WordPress plugins and packages providing security, performance, marketing, and site-management tools for WordPress si… | 68 | 1850 | active |
| Place1/wg-access-server wg-access-server is a single-binary WireGuard VPN server with a built-in web UI for managing and registering devices. It supports user auth… | 32 | 1850 | active |
| iRedMail iRedMail is an open source, full-featured mail server solution that installs and configures SMTP, IMAP/POP3, webmail (Roundcube/SOGo), and … | 77 | 1848 | active |
| rust-fuzz/afl.rs afl.rs is a Cargo subcommand that lets you fuzz test Rust code with AFLplusplus, the coverage-guided fuzzer. It instruments Rust builds so … | 72 | 1848 | active |
| anhskohbo/no-captcha A Laravel package integrating Google's No CAPTCHA reCAPTCHA into forms. It provides Blade helpers for rendering the widget and a validation… | 63 | 1848 | active |
| h44z/wg-portal WireGuard Portal is a self-hosted, web-based configuration portal for managing WireGuard VPN servers and peers. It is a single Go binary wi… | 93 | 1847 | active |
| mailvelope/mailvelope Mailvelope is a browser extension for Chrome and Firefox that adds OpenPGP end-to-end email encryption to arbitrary webmail providers. It u… | 85 | 1847 | active |
| Tencent/CodeAnalysis Tencent Cloud Code Analysis (TCA, code-named CodeDog) is a self-hosted static code analysis platform consisting of server, web, and client … | 42 | 1847 | active |
| sniptt-official/ots OTS is a Go CLI tool for sharing end-to-end encrypted secrets (API keys, passwords, signing secrets) via one-time URLs. Secrets are destroy… | 34 | 1845 | active |
| LoseNine/ruyipage RuyiPage is a Python browser automation framework built on Firefox and the WebDriver BiDi protocol, shipping with an anti-detection Firefox… | 82 | 1844 | active |
| scipag/HardeningKitty HardeningKitty is a PowerShell module that audits and hardens Windows system configurations against a predefined finding list. It reads reg… | 77 | 1844 | active |
| unicodeveloper/globalthreatmap A real-time global threat and event intelligence map that plots security events, conflicts, military bases, and geopolitical developments o… | 53 | 1842 | active |
| hacl-star/hacl-star HACL* is a formally verified cryptographic library written in F* (Low*) and compiled to efficient standalone C code, covering algorithms li… | 58 | 1840 | active |
| trezor/trezor-firmware The official open-source firmware monorepo for Trezor hardware wallets, containing firmware for Trezor One and Trezor T/Safe devices, a sta… | 76 | 1837 | active |
| bvcyber/CVE-2020-1472 A Python CLI script that tests domain controllers for the ZeroLogon vulnerability (CVE-2020-1472) using the Impacket library. It attempts t… | 41 | 1837 | stable |
| pirxthepilot/wtfis wtfis is a Python command-line tool that performs passive lookups of hostnames, domains, and IP addresses using OSINT services like VirusTo… | 72 | 1836 | active |
| pandasec888/taowu-cobalt_strike Taowu is a red team automation plugin (Aggressor script) for the Cobalt Strike platform, bundling a large collection of post-exploitation m… | 52 | 1836 | active |
| OpenAEV-Platform/openaev OpenAEV is an open-source platform for planning, scheduling, and running cyber adversary simulation campaigns and security exercises, from … | 95 | 1834 | active |
| marin-m/vmlinux-to-elf A Python CLI (with optional GUI) that recovers a fully analyzable ELF file from raw or stripped Linux kernel images (vmlinux, vmlinuz, bzIm… | 92 | 1834 | stable |
| 78778443/QingScan QingScan is a self-hosted, open-source security operations platform that unifies vulnerability scanning, code auditing, asset inventory, an… | 62 | 1831 | active |
| Magma Encrypted Email System Magma is an encrypted email server daemon written in C, providing SMTP, POP, IMAP, and HTTP protocol support along with a bundled webmail s… | 33 | 1831 | active |
| White-hua/Apt_t00ls A Java-based exploitation tool that aggregates proof-of-concept and weaponized exploits for high-severity vulnerabilities in Chinese enterp… | 23 | 1828 | active |
| nilsteampassnet/TeamPass TeamPass is a free, self-hosted collaborative password manager written in PHP/MySQL, offering folder-level access control, AES-256-GCM auth… | 92 | 1827 | active |
| HoShiMin/Kernel-Bridge Kernel-Bridge is a C++20 Windows kernel driver template, development framework, and kernel-mode API with wrappers, including a hypervisor s… | 23 | 1827 | active |
| Tai-e Tai-e is an easy-to-learn, developer-friendly static analysis framework for Java and Android programs, offering pointer analysis, taint ana… | 82 | 1825 | active |
| MatheuZSecurity/Singularity Singularity is a stealthy Linux kernel module (LKM) rootkit targeting modern 6.x kernels, using ftrace-based syscall hooking to hide proces… | 62 | 1825 | active |
| 1N3/BlackWidow BlackWidow is a Python-based web application spider that crawls a target site to collect URLs, dynamic parameters, subdomains, email addres… | 54 | 1824 | active |
| vulnersCom/getsploit A Python command-line tool that searches and downloads public exploits from the Vulners database, aggregating sources like Exploit-DB, Meta… | 85 | 1823 | active |
| OpenSCAP OpenSCAP is a NIST-certified open-source toolkit providing both a C library and the 'oscap' command-line tool for parsing, validating, edit… | 83 | 1822 | stable |
| Hashtopolis Hashtopolis is a multi-platform client-server application for distributing hashcat password cracking tasks across multiple computers. It pr… | 89 | 1821 | active |
| QBDI/QBDI QBDI (QuarkslaB Dynamic binary Instrumentation) is a modular, cross-platform, cross-architecture DBI framework built on LLVM, supporting x8… | 77 | 1820 | active |
| JesseCHale/HaleHound-CYD HaleHound-CYD is a multi-protocol offensive security toolkit firmware for the ESP32 Cheap Yellow Display, offering 40+ attack modules acros… | 83 | 1819 | active |
| Gregwar Captcha A PHP library for generating CAPTCHA images to protect web forms from bots and spam. It builds distorted text images, exposes the phrase fo… | 89 | 1818 | active |
| githubXiaowangzi/NP-Manager NP-Manager is an Android application for APK, DEX, JAR, Smali, PDF, and media file manipulation. It provides reverse-engineering features s… | 75 | 1818 | active |
| guardianproject/haven Haven is an open-source Android application that turns a spare phone into a physical security monitor using its on-device sensors (motion, … | 23 | 6824 | maintenance |
| REDasm REDasm is an open-source disassembler and binary analysis tool with a native Qt6 GUI, supporting many CPU architectures and executable form… | 92 | 1814 | active |
| antrea-io/antrea Antrea is a Kubernetes-native CNI plugin that provides pod networking and NetworkPolicy enforcement using Open vSwitch as the data plane. I… | 96 | 1813 | stable |
| ntop/nProbe nProbe is a high-performance NetFlow/IPFIX probe and network sensor from ntop that captures traffic and exports flow data for monitoring an… | 74 | 1813 | active |
| elder-plinius/ST3GG ST3GG is an all-in-one steganography toolkit that hides secret data inside images, audio, documents, and network packets using 100+ encodin… | 60 | 1813 | active |
| xaitax/Chrome-App-Bound-Encryption-Decryption A Windows post-exploitation research tool that bypasses Chromium's App-Bound Encryption using direct syscall-based reflective process hollo… | 58 | 1813 | active |
| mschwager/fierce Fierce is a Python 3 DNS reconnaissance tool that locates non-contiguous IP space and hostnames for specified domains. It enumerates subdom… | 32 | 1813 | active |
| wagiro/BurpBounty Burp Bounty (Scan Check Builder) is a Burp Suite extension that lets users improve Burp's active and passive web vulnerability scanners wit… | 23 | 1812 | active |
| wallarm/gotestwaf GoTestWAF is a Go-based tool that simulates OWASP and API attacks (SQL injection, XSS, etc.) across REST, GraphQL, gRPC, SOAP, and XMLRPC p… | 97 | 1811 | active |
| doyensec/inql InQL is an open-source Burp Suite extension for advanced GraphQL security testing. It provides schema introspection, vulnerability detectio… | 78 | 1811 | active |
| AloneMonkey/MonkeyDev MonkeyDev is an Xcode-integrated framework (an upgraded fork of iOSOpenDev) for developing iOS tweaks and command-line tools using CaptainH… | 77 | 6805 | maintenance |
| PortSwigger/turbo-intruder Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests at exceptional speed and analyzing the results. It uses… | 66 | 1810 | active |
| dreadl0ck/netcap Netcap is a Go framework that converts network packets into structured, type-safe Protocol Buffer audit records for security monitoring, fo… | 98 | 1809 | active |
| google/gopacket GoPacket is a Go library that provides packet decoding and processing capabilities, originally forked from the gopcap project. It enables G… | 34 | 6793 | maintenance |
| tdragon6/Supershell Supershell is a web-accessible C2 remote control platform that establishes reverse SSH tunnels to targets, yielding fully interactive shell… | 52 | 1808 | active |
| wgpsec/fofa_viewer Fofa Viewer is a JavaFX desktop client for the FOFA internet asset search engine, wrapping its API in a tabbed GUI. It helps security profe… | 51 | 1808 | active |
| fwdcloudsec/granted Granted is a Go-based CLI application that simplifies finding and assuming AWS IAM roles across multiple accounts. It encrypts cached SSO c… | 86 | 1806 | active |
| OpenVPN/openvpn-gui OpenVPN GUI is a graphical frontend for OpenVPN on Windows 10 and 11, providing a notification-area icon to start and stop VPN tunnels, vie… | 75 | 1806 | active |
| XJar XJar is a Java library and Maven-integrated tool that encrypts Spring Boot and plain JAR files (e.g., with AES) and provides a custom class… | 23 | 1806 | active |
| mozilla/fx-private-relay Firefox Relay is a Mozilla service that generates email aliases (masks) which forward messages to your real inbox, hiding your personal add… | 95 | 1802 | active |
| Cedar Policy Language Cedar is a purpose-built policy language and Rust implementation for writing and enforcing fine-grained authorization policies in applicati… | 98 | 1801 | stable |
| tuigreet/tuigreet tuigreet is a terminal-based graphical console greeter for greetd, providing a login interface with session management, user selection, and… | 96 | 1801 | active |
| Lojii/Knot Knot is a full-featured iOS app for capturing and analyzing HTTP/HTTPS network traffic using MITM (man-in-the-middle) techniques, built ent… | 70 | 1801 | active |
| wtf wtf (what the fuzz) is a distributed, code-coverage guided, snapshot-based fuzzer for attacking user- and kernel-mode targets on Windows an… | 82 | 1800 | active |