Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| microsoft/CyberBattleSim CyberBattleSim is a Python-based experimentation and research platform from Microsoft that simulates abstract enterprise network environmen… | 77 | 1800 | active |
| netyouli/WHC_ConfuseSoftware A macOS (and Windows for some helpers) GUI application that obfuscates and 'renovates' mobile and game project source code across Objective… | 73 | 1798 | active |
| josh0xA/darkdump Darkdump is an open-source OSINT tool for querying multiple dark web search engines and scraping onion site results for emails, metadata, k… | 64 | 1798 | active |
| Heavrnl/nexus-terminal Nexus Terminal is a modern web-based SSH/RDP/VNC client with a self-hosted Node.js backend and an optional standalone desktop app. It offer… | 88 | 1797 | active |
| bellingcat/telegram-phone-number-checker A Python CLI tool by Bellingcat that checks whether phone numbers are registered with Telegram accounts, retrieving usernames, names, and I… | 81 | 1797 | active |
| Homebridge UniFi Protect Integration A Homebridge plugin that provides complete native HomeKit integration for the UniFi Protect ecosystem, including cameras, doorbells, sensor… | 88 | 1796 | active |
| lirantal/npq npq is a command-line tool that audits npm packages for security risks before installing them, checking CVE databases and applying syntacti… | 94 | 1795 | active |
| libtom/libtomcrypt LibTomCrypt is a comprehensive, modular and portable cryptographic toolkit written in C, providing block ciphers, hash functions, chaining … | 64 | 1795 | stable |
| fulldecent/system-bus-radio A C program that transmits AM radio signals from computers and phones that lack radio transmitting hardware by generating precisely timed e… | 52 | 6726 | maintenance |
| ReSukiSU/ReSukiSU ReSukiSU is a KernelSU-based root solution for Android, forked from SukiSU Ultra with a focus on enhanced stability. It provides kernel-lev… | 69 | 1792 | active |
| nccgroup/sobelow Sobelow is a security-focused static analysis tool for Elixir and the Phoenix framework, detecting common vulnerability classes like SQL in… | 23 | 1791 | active |
| emp3r0r emp3r0r is an open-source post-exploitation framework and command-and-control (C2) system written in Go, targeting Linux and Windows hosts.… | 95 | 1790 | active |
| PabloLec/RecoverPy RecoverPy is a Python TUI tool that scans raw partitions and disk images for byte patterns to locate and recover deleted or overwritten fil… | 77 | 1790 | active |
| tchx84/Flatseal Flatseal is a graphical utility for reviewing and modifying permissions of Flatpak applications on Linux. It lets users select an installed… | 75 | 1790 | active |
| ReversecLabs/C3 C3 (Custom Command and Control) is a C++ framework for rapidly prototyping custom command and control (C2) channels for red team operations… | 61 | 1790 | active |
| D4Vinci/One-Lin3r One-Lin3r is a lightweight, modular Python framework that provides a searchable database of over 176 one-liner commands for penetration tes… | 54 | 1790 | active |
| metlo-labs/metlo Metlo is an open-source API security platform that inventories API endpoints, detects malicious traffic in real time, and can automatically… | 34 | 1789 | active |
| kost/dvcs-ripper dvcs-ripper is a set of Perl command-line tools that download (rip) web-accessible version control repositories such as GIT, SVN, Mercurial… | 32 | 1789 | stable |
| un1cum/Beast_Bomber A Python CLI script that floods targets with SMS, email, Discord, and Telegram messages, and performs basic DDoS attacks. It runs on deskto… | 23 | 1787 | active |
| GoSecure/pyrdp PyRDP is a Python Remote Desktop Protocol (RDP) Monster-in-the-Middle (MITM) tool and library. It intercepts RDP connections to capture cre… | 56 | 1786 | active |
| m4b/bingrep bingrep is a cross-platform command-line binary parser and colorizer written in Rust, supporting ELF, Mach-O, PE, and Unix/BSD archives. It… | 56 | 1785 | active |
| Zen by Aikido (in-app firewall) Aikido Safe Chain is a free, tokenless CLI tool that wraps package managers (npm, yarn, pnpm, npx, pip, uv, poetry, and more) to block mali… | 80 | 1783 | active |
| GreenmaskIO/greenmask Greenmask is an open-source CLI utility for logical database dumping, anonymization, synthetic data generation, and restoration, production… | 94 | 1782 | active |
| R4gd0ll/I-Wanna-Get-All A comprehensive Java post-exploitation vulnerability exploitation tool integrating 470 exploit modules for detection and attack of known vu… | 54 | 1781 | active |
| ron190/jsql-injection jSQL Injection is a free, open-source Java application for automatic SQL database injection, used to find and extract database information … | 81 | 1780 | active |
| ossf/cve-bin-tool A Python CLI tool that scans binaries and systems for known CVEs in over 350 common open-source components like openssl, libpng, and expat.… | 67 | 1780 | active |
| andrivet/ADVobfuscator ADVobfuscator is a C++20 header-only library that obfuscates and encrypts strings and data blocks at compile time using metaprogramming, wi… | 88 | 1779 | active |
| cs01/termpair TermPair is a Rust-based tool that lets you share and control a terminal from a browser with end-to-end encryption. A single static binary … | 73 | 1778 | active |
| simsong/tcpflow tcpflow is a C++ command-line tool that captures TCP connection data and demultiplexes it into per-flow files, one per direction, for proto… | 48 | 1778 | active |
| privacyIDEA privacyIDEA is an open-source, self-hosted multi-factor authentication (MFA) server that centrally manages authentication tokens—OTP (HOTP/… | 92 | 1777 | stable |
| quentinhardy/odat ODAT (Oracle Database Attacking Tool) is an open-source Python penetration testing tool for assessing the security of remote Oracle Databas… | 52 | 1776 | active |
| GrimAnticheat/Grim GrimAC is an open-source Minecraft anticheat plugin that detects cheats by simulating real client movement with fully asynchronous, multith… | 80 | 1775 | active |
| ShenaniganDApp/brightid-discord-bot A Discord bot that integrates BrightID identity verification into Discord servers, letting communities verify users are unique humans and m… | 66 | 1775 | active |
| EteSync (Etebase) The Etebase (EteSync 2.0) server, a Django-based backend that lets you self-host end-to-end encrypted synchronization of contacts, calendar… | 32 | 1774 | stable |
| requests/requests-oauthlib A Python library that adds OAuth 1 and OAuth 2 authentication support to the Requests HTTP library. It wraps OAuthlib to provide simple ses… | 31 | 1774 | stable |
| Fr4nkFletcher/ESP32-Marauder-Cheap-Yellow-Display A port of the ESP32-Marauder WiFi/Bluetooth testing firmware to the Cheap Yellow Display (CYD) family of ESP32 boards with ILI9341/ST7789/S… | 44 | 1773 | active |
| Apache Casbin PyCasbin is the Python implementation of Apache Casbin, an authorization library that enforces access control via configurable models such … | 85 | 1771 | stable |
| google/sandboxed-api Google's Sandboxed API (SAPI) automatically generates sandboxes for individual C/C++ libraries, isolating them from the host program using … | 86 | 1769 | active |
| pwn20wndstuff/Undecimus Undecimus is the open-source iOS app behind the unc0ver jailbreak, supporting iOS 11.0 through 12.4 on ARM64 devices. It applies kernel and… | 23 | 6614 | maintenance |
| Septrum101/zteOnu A Go CLI tool that opens factory/telnet mode on ZTE ONU (fiber optic modem) devices via their webFac interface. It authenticates with facto… | 88 | 1767 | active |
| j3ers3/Hello-Java-Sec A deliberately vulnerable Java Spring Boot application demonstrating common web vulnerabilities (SQLi, XSS, RCE, deserialization, SSTI, SSR… | 24 | 1767 | active |
| orhun/gpg-tui gpg-tui is a terminal user interface for GnuPG written in Rust, built on tui-rs and GPGME bindings. It simplifies key management operations… | 77 | 1763 | active |
| xmendez/wfuzz Wfuzz is a Python-based command-line web application fuzzer that replaces a FUZZ keyword in HTTP requests with values from configurable pay… | 54 | 6588 | maintenance |
| Symfony Security The Symfony Security CSRF component provides a CsrfTokenManager class for generating and validating cross-site request forgery (CSRF) token… | 86 | 1761 | stable |
| ronf/asyncssh AsyncSSH is a Python library providing asynchronous client and server implementations of the SSHv2 protocol, including SFTP and SCP, built … | 76 | 1760 | stable |
| laravel/fortify Laravel Fortify is a frontend-agnostic authentication backend for Laravel that registers the routes and controllers needed for login, regis… | 99 | 1759 | active |
| qi4L/JYso JYso is a Java-based offensive security tool that combines the capabilities of ysoserial (Java deserialization gadget generation) and JNDIE… | 77 | 1759 | active |
| mpdavis/python-jose python-jose is a Python implementation of the JOSE (JavaScript Object Signing and Encryption) standards, including JWS, JWE, JWK, and JWT. … | 57 | 1759 | stable |
| bradtraversy/node_passport_login A Node.js starter application demonstrating user registration, login, and access control using Express, Passport, MongoDB/Mongoose, EJS, an… | 71 | 1757 | active |
| ghostery/ghostery-extension Ghostery is a browser extension that blocks ads, trackers, and cookie pop-ups across Firefox, Chrome, Opera, Edge, Safari, and Yandex. It p… | 95 | 1755 | active |
| philhagen/sof-elk SOF-ELK is a pre-built virtual appliance based on the Elastic stack (Elasticsearch, Logstash, Kibana, Filebeat) tailored for computer foren… | 75 | 1755 | active |
| murphysecurity/murphysec MurphySec CLI is an open-source software composition analysis (SCA) tool that detects vulnerable dependencies in projects from the command … | 53 | 1755 | active |
| justinas/nosurf nosurf is a Go HTTP package that provides CSRF protection via a CSRFHandler middleware wrapping any http.Handler. It validates tokens on un… | 29 | 1754 | stable |
| vfsfitvnm/frida-il2cpp-bridge A Frida module written in TypeScript for dumping, tracing, and hijacking IL2CPP (Unity) applications at runtime without needing the global-… | 90 | 1753 | active |
| bytedance/appshark AppShark is a static taint analysis platform written in Kotlin that scans Android APKs for security vulnerabilities and compliance issues. … | 66 | 1753 | active |
| facebookarchive/fbctf FBCTF is a self-hosted platform for running Jeopardy and King of the Hill style Capture the Flag security competitions. It supports team re… | 10 | 6539 | maintenance |
| wiire-a/pixiewps Pixiewps is a C command-line utility that brute-forces Wi-Fi Protected Setup (WPS) PINs offline, exploiting low- or non-entropy software im… | 54 | 1750 | active |
| Tokeii0/LovelyMem Lovelymem V2 is a Windows desktop memory forensics workbench built with Rust, Tauri 2, and TypeScript. It integrates MemProcFS, Volatility … | 81 | 1749 | active |
| Django Hijack Django Hijack is a Django app that lets admins log in and work on behalf of other users without knowing their credentials. It provides secu… | 95 | 1746 | stable |
| hwdsl2/openvpn-install A Bash script that automates setting up an OpenVPN server on a wide range of Linux distributions, including Ubuntu, Debian, CentOS, Fedora,… | 76 | 1745 | active |
| IvanGlinkin/Fast-Google-Dorks-Scan A shell-based OSINT tool that automates Google dork searches against a target website to uncover admin panels, exposed file types, and path… | 42 | 1745 | active |
| succinctlabs/sp1 SP1 is a zero-knowledge virtual machine (zkVM) that proves the correct execution of arbitrary programs compiled to RISC-V, written in Rust … | 93 | 1743 | active |
| jaksi/sshesame sshesame is an SSH honeypot written in Go that runs a fake SSH server accepting any connection and logging all activity without executing a… | 23 | 1742 | active |
| sigalor/whatsapp-web-reveng A reverse-engineered description and Node.js re-implementation of the WhatsApp Web API, communicating over WebSockets with the same encrypt… | 32 | 6496 | maintenance |
| AWS Config Rules Development Kit (RDK) A community repository of sample custom AWS Config rules written in Python, Node.js, and Java. These Lambda-based rules evaluate AWS resour… | 76 | 1739 | active |
| revng rev.ng is an open-source binary analysis framework and decompiler built on LLVM and QEMU, supporting over 20 CPU architectures. It automati… | 75 | 1739 | active |
| Watfaq/clash-rs ClashRS is a rule-based network proxy written in Rust supporting many custom protocols (Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireG… | 99 | 1738 | active |
| cmu-sei/pharos Pharos is a static binary analysis framework from Carnegie Mellon's Software Engineering Institute built on the ROSE compiler infrastructur… | 75 | 1738 | active |
| polymorf/findcrypt-yara An IDA Pro plugin that uses YARA rules to scan binaries for known cryptographic constants and other recognizable byte patterns. It helps re… | 32 | 1737 | active |
| samyk/poisontap PoisonTap is a USB-based attack tool built on a Raspberry Pi Zero and Node.js that exploits locked, password-protected computers by emulati… | 32 | 6476 | maintenance |
| elder-plinius/V3SP3R V3SP3R (Vesper) is an Android application that turns a Flipper Zero into an AI-controlled hardware hacking tool, driven by natural language… | 45 | 1735 | active |
| ev-flow/quark-engine Quark Engine is an Android malware scoring and analysis system that inspects APKs using rule-based behavioral detection on Dalvik bytecode.… | 99 | 1733 | active |
| CodingGay/BlackDex BlackDex is an Android app that unpacks DEX files from installed or uninstalled APKs on Android 5.0-12 without requiring root, Xposed, Frid… | 23 | 6459 | maintenance |
| cleverhans-lab/cleverhans CleverHans is a Python library for benchmarking machine learning systems' vulnerability to adversarial examples, providing reference implem… | 23 | 6455 | maintenance |
| apple/swift-crypto Swift Crypto is an open-source Swift library implementing a substantial portion of Apple CryptoKit's API for use on Linux, Windows, and oth… | 96 | 1731 | active |
| sudo-project/sudo Sudo is a Unix utility that allows a system administrator to delegate limited root or other-user privileges to users on a per-command basis… | 79 | 1730 | stable |
| The Update Framework (TUF) Python reference implementation of The Update Framework (TUF), a CNCF-graduated specification for securing software update systems against … | 85 | 1728 | stable |
| cloudflare/circl CIRCL is Cloudflare's Go library of cryptographic primitives covering post-quantum algorithms (ML-KEM/Kyber, ML-DSA/Dilithium, SIKE/CSIDH),… | 91 | 1727 | active |
| mandatoryprogrammer/CursedChrome CursedChrome is a Chrome extension implant that converts a victim's Chrome browser into a fully-functional HTTP proxy, letting an operator … | 32 | 1727 | active |
| davrodpin/mole Mole is a Go-based CLI application for creating SSH tunnels with a focus on resiliency and user experience. It supports automatic port sele… | 23 | 1727 | stable |
| zalexdev/strykerapp StrykerOSS is a free, open-source mobile penetration testing suite for rooted Android devices that bundles network, wireless, and web secur… | 98 | 1726 | active |
| jimmy201602/webterminal A Django-based web bastion (jump server) that lets users connect to servers via SSH, SFTP, RDP, VNC, and Telnet directly from the browser. … | 68 | 1724 | active |
| better-auth-ui/better-auth-ui Better Auth UI is a collection of beautiful, ready-to-use authentication UI components and data utilities built specifically for the Better… | 84 | 1723 | active |
| apache/guacamole-client Apache Guacamole client is the Maven-based superproject containing the HTML5 web application, official authentication extensions, and JavaS… | 76 | 1723 | active |
| cr0hn/dockerscan DockerScan is a comprehensive Docker security scanner written in Go that scans containers, images, and registries using multiple techniques… | 90 | 1722 | active |
| WildKernels/GKI_KernelSU_SUSFS Prebuilt Android GKI (Generic Kernel Image) kernels for Android 5.10+ devices with KernelSU root support and SUSFS root-hiding patches inte… | 88 | 1721 | active |
| upspin/upspin Upspin is an experimental framework of protocols and reference implementations providing a secure, global naming system for sharing files a… | 43 | 6405 | maintenance |
| Pentest AI pentest-ai is an MIT-licensed local CLI and MCP server that turns Claude Code (or any LLM) into an offensive security assistant, pairing 50… | 79 | 1717 | active |
| Rob--W/crxviewer A browser add-on and web app for viewing the source code of Chrome, Firefox, Opera, Edge, and Thunderbird extensions without installing the… | 74 | 1716 | active |
| ueberauth/ueberauth Ueberauth is an Elixir authentication framework for Plug-based web applications, providing a two-phase authentication API inspired by Omnia… | 66 | 1716 | stable |
| lasting-yang/frida_hook_libart A collection of Frida hook scripts for intercepting Android ART JNI functions, most notably RegisterNatives. It reveals native method regis… | 50 | 1716 | active |
| kdrag0n/safetynet-fix A Magisk module (Zygisk-based, with an older Riru version) that works around Google's SafetyNet and Play Integrity hardware attestation che… | 23 | 6387 | maintenance |
| Safe3/uusec-waf UUSEC WAF is a free, high-performance web application firewall and API security gateway (WAAP) that combines AI/semantic detection engines … | 95 | 1715 | active |
| openappsec/openappsec open-appsec is an open-source machine learning security engine that provides preemptive web application and API threat protection against O… | 90 | 1715 | active |
| MorDavid/BruteForceAI BruteForceAI is a Python-based penetration testing tool that uses LLMs (via Ollama or Groq) to automatically analyze login page HTML and id… | 56 | 1715 | active |
| SVF-tools/SVF SVF is a C++ static analysis framework built on LLVM that provides scalable and precise value-flow analysis and pointer analysis for source… | 83 | 1714 | active |
| keepassium/KeePassium KeePassium is a KeePass-compatible password manager app for iOS and macOS, written in Swift. It supports all KeePass database formats (kdb,… | 68 | 1714 | active |
| trailofbits/buttercup Buttercup is a Cyber Reasoning System (CRS) developed by Trail of Bits for the DARPA AI Cyber Challenge that automatically finds and patche… | 56 | 1714 | active |
| dolevf/Damn-Vulnerable-GraphQL-Application Damn Vulnerable GraphQL Application (DVGA) is an intentionally insecure GraphQL service built for learning and practicing GraphQL security … | 30 | 1714 | active |
| project-copacetic/copacetic Copa (Project Copacetic) is a Go CLI tool built on BuildKit that directly patches OS package vulnerabilities in container images without re… | 91 | 1712 | active |