Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| project-copacetic/copacetic Copa (Project Copacetic) is a Go CLI tool built on BuildKit that directly patches OS package vulnerabilities in container images without re… | 91 | 1712 | active |
| elasticdog/transcrypt A single Bash script that configures transparent encryption of sensitive files in a Git repository using Git's clean/smudge filters and Ope… | 74 | 1712 | stable |
| AdguardTeam/AdguardForiOS AdGuard for iOS is an open-source ad-blocking and privacy app for iPhone and iPad that blocks ads in Safari via content blocking rules. It … | 93 | 1711 | active |
| mganss/HtmlSanitizer A .NET library for cleaning HTML fragments and documents of constructs that can lead to XSS attacks, built on the AngleSharp parser. It is … | 97 | 1710 | active |
| almeidapaulopt/tsdproxy TSDProxy is a self-hosted service that automatically exposes Docker containers on a Tailscale network via a single reverse proxy. Container… | 89 | 1710 | active |
| hasherezade/tiny_tracer A Pin Tool built on Intel Pin for dynamic binary instrumentation that traces API calls, syscalls, selected instructions, and section transi… | 74 | 1709 | active |
| pgaudit/pgaudit pgAudit is a PostgreSQL extension written in C that provides detailed session and object audit logging through the standard PostgreSQL logg… | 73 | 1709 | stable |
| dafthack/MFASweep MFASweep is a PowerShell script that attempts to log in to multiple Microsoft services with provided credentials to detect whether MFA is e… | 63 | 1709 | active |
| SiriusScan/Sirius Sirius is an open-source vulnerability scanner that automates network discovery via Nmap and performs CVE-based detection with CVSS scoring… | 82 | 1707 | active |
| S3cur3Th1sSh1t/PowerSharpPack PowerSharpPack wraps many useful offensive C# security projects (Seatbelt, Rubeus, SharpUp, winPEAS, etc.) into PowerShell scripts for easy… | 36 | 1707 | active |
| inverse-inc/packetfence PacketFence is a free and open source network access control (NAC) solution with a captive portal for registration and remediation, 802.1X … | 86 | 1704 | stable |
| webprofusion/certify Certify The Web is an ACME v2 certificate management application with a Windows desktop UI and background renewal service, plus a cross-pla… | 76 | 1704 | stable |
| Gerenios/AADInternals AADInternals is a PowerShell module for administering and hacking Entra ID (Azure AD), Office 365, and related endpoints. It includes tools… | 48 | 1703 | active |
| Symfony Security The Symfony Security HTTP component provides HTTP integration of the Symfony Security Core component. It secures (parts of) applications us… | 93 | 1701 | stable |
| utkusen/urlhunter urlhunter is a Go-based recon CLI tool that searches URLs exposed via shortener services like bit.ly and goo.gl. It downloads daily URLTeam… | 23 | 1701 | active |
| matanolabs/matano Matano is an open-source, cloud-native security data lake that runs in your AWS account, normalizing unstructured security logs into a stru… | 23 | 1701 | active |
| Bromite Bromite is a Chromium fork for Android with a built-in ad-blocking engine and privacy enhancements such as anti-fingerprinting flags, DNS-o… | 23 | 6319 | maintenance |
| jazzband/django-axes django-axes is a Django plugin that tracks failed login attempts and blocks brute-force attacks on Django-powered sites. It supports monito… | 93 | 1700 | stable |
| chainguard-dev/apko apko is a Go CLI tool that builds and publishes OCI container images directly from Alpine apk packages using declarative YAML configuration… | 95 | 1694 | active |
| liftoff/GateOne Gate One is an HTML5 web-based terminal emulator and SSH client that runs in the browser without plugins. It supports many simultaneous use… | 32 | 6287 | maintenance |
| duo-labs/cloudmapper CloudMapper is a tool for analyzing Amazon Web Services (AWS) environments, originally built to generate interactive network diagrams in th… | 23 | 6287 | maintenance |
| raodv/captcha AjPlus Captcha is an open-source behavioral CAPTCHA library providing sliding puzzle and click-word verification challenges with frontend U… | 35 | 1693 | active |
| BC-SECURITY/Starkiller Starkiller is a web-based graphical frontend for PowerShell Empire, a post-exploitation C2 framework. It is written in VueJS and ships prep… | 90 | 1692 | active |
| wireghoul/graudit graudit is a shell-based source code auditing tool that uses GNU grep with signature databases of extended regular expressions to find pote… | 91 | 1691 | active |
| murraco/spring-boot-jwt A JWT authentication service built with Spring Boot and Spring Security, backed by MySQL, featuring short-lived access tokens and rotating,… | 77 | 1691 | active |
| whwlsfb/JDumpSpider JDumpSpider is a Java CLI tool that extracts sensitive information (datasource credentials, config properties, Redis configs, Shiro keys, u… | 66 | 1690 | active |
| google/atheris Atheris is a coverage-guided fuzzing engine for Python code and native CPython extensions, built on top of libFuzzer. It instruments Python… | 68 | 1688 | active |
| FastAPI Users FastAPI Users is a ready-to-use and customizable user management library for FastAPI applications. It provides registration, login, passwor… | 80 | 6254 | maintenance |
| miscusi-peek/cheatengine-mcp-bridge A bridge that connects AI coding assistants (Claude, Cursor, Copilot) to Cheat Engine via the Model Context Protocol, letting agents read/w… | 57 | 1685 | active |
| B16f00t/whapa Whapa is a Python-based forensic toolset for parsing and analyzing WhatsApp databases from Android and iOS devices. It includes tools for d… | 71 | 1683 | active |
| palark/ovpn-admin A self-hosted web UI for managing OpenVPN users, certificates, and client routes on Linux servers. It is written in Go with a Vue.js fronte… | 76 | 1682 | active |
| myfanhua/turb-gpt-free-register A Python tool that bulk-registers ChatGPT/OpenAI accounts using pure-protocol requests or anti-fingerprint browser automation (RoxyBrowser,… | 59 | 1682 | active |
| KeenSecurityLab/BinAbsInspector BinAbsInspector is a static analyzer for automated reverse engineering and vulnerability scanning in binaries, built on abstract interpreta… | 23 | 1682 | active |
| Ge0rg3/requests-ip-rotator A Python library that mounts AWS API Gateway as a proxy onto requests sessions, rotating source IPs on every request using AWS's large IP p… | 84 | 1680 | active |
| vladko312/SSTImap SSTImap is a Python-based penetration testing tool that automatically detects and exploits Server-Side Template Injection (SSTI) and code i… | 82 | 1679 | active |
| secluso/core Secluso is an open-source, privacy-preserving home security camera system built for Raspberry Pi, featuring end-to-end encrypted remote acc… | 69 | 1678 | active |
| sickcodes/osx-serial-generator A shell-based tool that generates valid macOS serial numbers, UUIDs, and board serials for use with OpenCore, OSX-KVM, and Docker-OSX. It i… | 34 | 1678 | stable |
| fire-keeper/BlindWatermark A Python library and CLI/GUI tool that embeds invisible blind watermarks into images using discrete wavelet transforms, protecting creators… | 23 | 1678 | active |
| freeotp/freeotp-android FreeOTP is an open-source two-factor authentication app for Android that generates one-time passwords using the HOTP and TOTP standards. To… | 74 | 1676 | active |
| mikespook/gorbac goRBAC is a lightweight role-based access control (RBAC) library for Go, supporting many-to-many role/permission mappings and hierarchical … | 61 | 1676 | active |
| dirkjanm/krbrelayx A Python toolkit for abusing Kerberos in Active Directory environments, including Kerberos relaying and unconstrained delegation attacks. I… | 61 | 1676 | active |
| Asuswrt-Merlin Asuswrt-Merlin is an enhanced third-party firmware for Asus routers, based on Asus's stock Asuswrt firmware, focusing on bug fixes, tweaks,… | 75 | 6207 | maintenance |
| hyprwm/hyprlock hyprlock is a GPU-accelerated, multi-threaded screen locking utility built for the Hyprland Wayland compositor. It uses the ext-session-loc… | 84 | 1674 | active |
| WangYihang/GitHacker GitHacker is a multi-threaded Python CLI tool that exploits exposed `.git` directories on web servers to reconstruct the entire Git reposit… | 75 | 1673 | active |
| rebeyond/Behinder Behinder ('冰蝎') is a cross-platform Java client for managing encrypted webshells on compromised web servers running PHP, Java, or .NET. It … | 23 | 6199 | maintenance |
| michenriksen/gitrob Gitrob is a Go-based reconnaissance tool that scans GitHub users' and organizations' public repositories for potentially sensitive files by… | 10 | 6197 | maintenance |
| projectdiscovery/shuffledns shuffleDNS is a Go wrapper around massDNS for fast active subdomain enumeration via bruteforce and DNS resolution with smart wildcard filte… | 82 | 1672 | active |
| cddmp/enum4linux-ng enum4linux-ng is a Python rewrite of the enum4linux.pl Windows/Samba enumeration tool, wrapping Samba utilities like nmblookup, net, rpccli… | 69 | 1672 | active |
| bee-san/Name-That-Hash Name That Hash is a Python CLI tool and web app that identifies the type of an unknown hash string, supporting 300+ hash types like MD5 and… | 45 | 1672 | active |
| FairwindsOps/rbac-manager RBAC Manager is a Kubernetes operator that simplifies authorization management by allowing declarative configuration of Role Bindings and S… | 91 | 1670 | active |
| rmyndharis/antigravity-skills A curated vault of 300+ Agent Skills for Google Antigravity, ported from the Claude Code Agents ecosystem. Each skill is a directory-based … | 78 | 1669 | active |
| invertase/react-native-apple-authentication A well-typed React Native library providing Sign In with Apple support on iOS and Android, including all AppleButton UI variants. It suppor… | 60 | 1669 | active |
| scito/extract_otp_secrets A Python CLI tool that extracts one-time password (TOTP/HOTP) secrets from QR codes exported by two-factor authentication apps like Google … | 89 | 1668 | active |
| Pow Pow is a robust, modular, and extendable authentication and user management library for Elixir, built for Phoenix and Plug-based applicatio… | 23 | 1668 | stable |
| zama-ai/tfhe-rs TFHE-rs is a pure Rust implementation of the TFHE fully homomorphic encryption scheme, enabling boolean and integer arithmetic over encrypt… | 97 | 1667 | active |
| userfrosting/UserFrosting UserFrosting is a modern PHP user management framework built on Slim, Twig, Eloquent ORM, Vite, and Vue, providing login, registration, and… | 93 | 1667 | active |
| devnied/EMV-NFC-Paycard-Enrollment A Java library for reading and extracting public data from NFC EMV credit cards over Android NFC or PCSC readers. It parses card details su… | 82 | 1667 | active |
| klezVirus/SysWhispers3 SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kerne… | 32 | 1667 | active |
| 0xdea/frida-scripts A collection of Frida instrumentation scripts for reverse engineering mobile apps and native binaries, including tracers and enumerators fo… | 74 | 1666 | active |
| slackhq/go-audit go-audit is a Go-based replacement for the auditd daemon that consumes Linux kernel audit events via netlink and outputs them as JSON. It s… | 81 | 1665 | active |
| nshalabi/SysmonTools Sysmon Tools is a collection of utilities for analyzing, visualizing, and managing Microsoft Sysmon logs, centered on Sysmon View, an open-… | 75 | 1665 | active |
| zhaodice/qemu-anti-detection A collection of patches for various QEMU versions that modify emulator-reported data (device names, serial numbers, UEFI VM bit, BGRT) to p… | 54 | 1665 | active |
| Air14/HyperHide HyperHide is a hypervisor-based anti-anti-debug plugin for x64dbg/x32dbg that hides debuggers from detection. It uses Intel EPT to hook sys… | 23 | 1664 | active |
| longld/peda PEDA is a Python plugin for GDB that enhances the debugger's display and adds exploit development commands. It provides colorized disassemb… | 23 | 6157 | maintenance |
| tabby-sec/tabby Tabby is a Java static code analysis tool built on the Soot framework that converts JAR/WAR/CLASS files into a code property graph stored i… | 47 | 1661 | active |
| summitt/Nope-Proxy NoPE Proxy is a Burp Suite extension that adds TCP and UDP traffic interception, a configurable DNS server, and a non-HTTP man-in-the-middl… | 23 | 1660 | active |
| WangYihang/Platypus Platypus is a cross-platform reverse-shell and host management hub written in Go. Agents on managed machines dial back to a central server … | 67 | 1659 | active |
| C0nw0nk/Nginx-Lua-Anti-DDoS A Lua-based Anti-DDoS script for Nginx that presents a Cloudflare-style JavaScript authentication puzzle to filter out bots and mitigate La… | 98 | 1658 | active |
| collinbarrett/FilterLists FilterLists is an independent, comprehensive web directory and REST API cataloging filter and host lists for blocking advertisements, track… | 76 | 1657 | active |
| tevador/RandomX RandomX is a proof-of-work algorithm optimized for general-purpose CPUs that uses random code execution and memory-hard techniques to resis… | 89 | 1655 | stable |
| geiger-rs/cargo-geiger cargo-geiger is a cargo plugin that scans a Rust crate and its dependency tree to report statistics on unsafe Rust code usage. It provides … | 88 | 1653 | active |
| OWASP Threat Dragon OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application for drawing data flow diagrams and listing threats f… | 87 | 1653 | active |
| P1sec/QCSuper QCSuper is a Python CLI tool that communicates with Qualcomm-based phones and modems via the Diag (QCDM) protocol to capture raw 2G/3G/4G (… | 84 | 1653 | active |
| ScopeSentry ScopeSentry is a self-hosted attack surface and asset mapping platform that combines subdomain enumeration, port scanning, fingerprinting, … | 82 | 1653 | active |
| veinmind veinmind-tools is a container security toolkit by Chaitin Tech built on the veinmind-sdk, providing scanners for malicious files, weak pass… | 23 | 1653 | active |
| whwlsfb/BurpCrypto BurpCrypto is a Burp Suite extension that encrypts Intruder payloads with algorithms like AES, RSA, and DES, or by executing arbitrary Java… | 23 | 1652 | active |
| rust-openssl/rust-openssl Rust bindings to the OpenSSL cryptography and TLS library, exposing its APIs (certificates, keys, hashing, SSL/TLS connections) to Rust pro… | 91 | 1650 | stable |
| shekyan/slowhttptest SlowHTTPTest is a highly configurable command-line tool that simulates Application Layer Denial of Service attacks by prolonging HTTP conne… | 84 | 1650 | active |
| mssun/passforios Pass for iOS is an iOS password manager client compatible with ZX2C4's Pass command line application. It encrypts password entries with GPG… | 77 | 1649 | active |
| AltraMayor/gatekeeper Gatekeeper is the first open-source DDoS protection system, built on DPDK for high-performance packet processing. It uses a geographically … | 66 | 1649 | active |
| zardus/preeny Preeny is a collection of LD_PRELOAD libraries written in C that help with binary exploitation and CTF-style challenges. It disables functi… | 64 | 1649 | active |
| 4lbH4cker/ALHacking ALHacking is a shell-script-based toolkit bundling a menu of so-called ethical hacking utilities, including social media account attacks, p… | 32 | 1648 | active |
| MayersScott/rkn-block-checker A Python CLI tool that diagnoses whether your connection is in an RKN/TSPU-blocked zone and classifies the type of block (DNS poisoning, TC… | 79 | 1646 | active |
| lelylan/simple-oauth2 simple-oauth2 is a Node.js client library for the OAuth 2.0 authorization framework. It supports the authorization code, resource owner pas… | 32 | 1639 | active |
| AdGuard Home For Android (Magisk Module) A Magisk module that runs AdGuard Home on rooted Android devices to block ads by redirecting and filtering DNS requests. It ships with buil… | 87 | 1638 | active |
| cloudfoundry/uaa Cloud Foundry's User Account and Authentication (UAA) server, a multi-tenant identity management service that acts as an OAuth2 provider an… | 98 | 1637 | active |
| za515217965/OKBrowser OKBrowser is a free Chromium-based anti-fingerprint browser for Windows that lets users create and manage multiple isolated browser profile… | 45 | 1636 | active |
| ghostop14/sparrow-wifi Sparrow-WiFi is a Python 3 GUI-based WiFi and Bluetooth analyzer for Linux that combines 2.4/5 GHz scanning, BLE/Classic discovery, SDR spe… | 75 | 1635 | active |
| mukul975/cve-mcp-server A Python-based Model Context Protocol (MCP) server that gives Claude ~28 security intelligence tools across 20+ APIs, including CVE lookup,… | 71 | 1635 | active |
| ADD-SP/ngx_waf ngx_waf is a high-performance Nginx firewall module written in C that provides web application firewall capabilities. It is compatible with… | 66 | 1635 | active |
| monkeyWie/proxyee Proxyee is a Java library built on Netty that implements an HTTP proxy server supporting HTTP, HTTPS, and WebSocket protocols. It provides … | 26 | 1635 | active |
| SELinuxProject/selinux The upstream userspace repository for Security Enhanced Linux (SELinux), providing the libraries and tools that complement SELinux support … | 84 | 1634 | stable |
| illera88/Ponce Ponce is an IDA Pro plugin that adds one-click symbolic execution and taint analysis over binaries, built on the Triton engine and written … | 30 | 1634 | active |
| outtable/confuse-9live A macOS GUI application (distributed as a DMG, not source code) that obfuscates iOS app binaries and resources to bypass App Store review i… | 76 | 1633 | active |
| cathugger/mkp224o mkp224o is a C command-line tool that generates vanity ed25519 onion service (Tor hidden service v3) addresses by brute-forcing keypairs ma… | 23 | 1632 | active |
| OpenOSINT/OpenOSINT OpenOSINT is an AI-powered OSINT framework offering 19 investigation tools behind a natural-language agent, usable as an interactive REPL, … | 78 | 1631 | active |
| Finbuckle/Finbuckle.MultiTenant Finbuckle.MultiTenant is an open source multi-tenancy library for modern .NET, primarily targeting ASP.NET Core and Entity Framework Core a… | 97 | 1630 | stable |
| roryclear/clearcam Clearcam is a self-hosted Python NVR that adds AI object detection, tracking, mobile notifications, and semantic search to any RTSP securit… | 80 | 1630 | active |
| jakehildreth/Locksmith Locksmith is a PowerShell module and script that audits Active Directory Certificate Services (AD CS) for common misconfigurations. It can … | 73 | 1630 | active |
| ultrasecurity/Storm-Breaker Storm-Breaker is a social engineering tool that generates phishing-style web pages to capture device information, location, webcam, and mic… | 32 | 6009 | maintenance |