Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| One-Fox-Security-Team/One-Fox-T00ls One-Fox-T00ls is a curated collection of penetration testing and security toolboxes from the One-Fox security team, covering information ga… | 53 | 1466 | active |
| bindhosts/bindhosts A systemless hosts manager for rooted Android devices that works with APatch, KernelSU, and Magisk. It provides ad-blocking and hostname re… | 90 | 1464 | active |
| eljojo/rememory ReMemory is a tool that encrypts your files with age and splits the key using Shamir's Secret Sharing among trusted people, who each receiv… | 71 | 1464 | active |
| denandz/sourcemapper Sourcemapper is a Go CLI tool that parses JavaScript sourcemap (.map) files, whether from URLs or local directories, and reconstructs the o… | 70 | 1464 | stable |
| JailbrokenAI/wallbreaker Wallbreaker is a Claude-Code-style terminal harness for red-teaming LLMs, driving an autonomous agent loop that runs jailbreak attacks (PAI… | 53 | 1464 | active |
| Secretlint Secretlint is a pluggable linting tool that scans projects for committed credentials and secrets, reporting matches with explanations. It r… | 98 | 1463 | active |
| terraform-compliance/cli terraform-compliance is a lightweight, security-focused BDD test framework for Terraform that enables negative testing of infrastructure-as… | 84 | 1463 | active |
| Safe3/openresty-manager OpenResty Manager is a modern, web-based server control panel for managing OpenResty/Nginx reverse proxies, free SSL certificates, security… | 80 | 1463 | active |
| Sorcery/sorcery Sorcery is a stripped-down authentication library for Ruby on Rails supporting ActiveRecord, Mongoid, and other ORMs. It provides core auth… | 64 | 1463 | active |
| ViRb3/magisk-frida A Magisk/KernelSU/APatch module that automatically installs and runs frida-server on boot on rooted Android devices. It stays up to date by… | 93 | 1462 | active |
| JoasASantos/NeuroSploit NeuroSploit is an AI-powered penetration testing framework written in Rust that turns a URL, repository, app, or host into an autonomous se… | 86 | 1462 | active |
| Morsmalleo/AhMyth AhMyth is a cross-platform Android Remote Administration Tool (RAT) used to build APK payloads and remotely control Android devices through… | 67 | 1461 | active |
| PortSwigger/param-miner Param Miner is a Burp Suite extension that identifies hidden, unlinked HTTP parameters, headers, and cookies using diffing logic and binary… | 63 | 1461 | active |
| p2r3/beheader A command-line tool that generates polyglot files - single files that are simultaneously valid images, videos, PDFs, ZIP archives, and HTML… | 46 | 1461 | active |
| getprobo/probo Probo is an open-source, self-hostable governance, risk, and compliance (GRC) platform for engineering and security teams, covering risk ma… | 84 | 1460 | active |
| qpoint-io/qtap Qtap is an eBPF agent that hooks TLS/SSL functions in the Linux kernel to capture network traffic before and after encryption, with full pr… | 63 | 1460 | active |
| OpenClarity OpenClarity is an open-source platform for agentless detection and management of Virtual Machine SBOMs and security threats such as vulnera… | 10 | 1459 | active |
| owasp-noir/noir OWASP Noir is a static analysis (SAST) CLI tool that scans source code to extract every endpoint an application exposes, including shadow A… | 99 | 1458 | active |
| Internet-Architecture-and-Security/PacketScope PacketScope is an open-source, eBPF-based protocol stack analysis and debugging tool for server-side network observability and defense. It … | 71 | 1458 | active |
| c0ny1/passive-scan-client A Burp Suite extension written in Java that forwards passive scanning traffic to external passive vulnerability scanners (like xray, w13sca… | 23 | 1458 | stable |
| pritunl/pritunl-client Pritunl Client is a free, open-source cross-platform OpenVPN and WireGuard client with both graphical and command-line interfaces. It suppo… | 96 | 1457 | active |
| OWASP/SecurityShepherd OWASP Security Shepherd is a self-hosted web and mobile application security training platform built in Java. It presents lessons and chall… | 64 | 1457 | active |
| ossf/criticality_score A Go CLI tool from the OpenSSF that computes a criticality score (0 to 1) for open source projects based on parameters like contributor cou… | 64 | 1457 | active |
| passwordless-lib/fido2-net-lib A battle-tested .NET library implementing a FIDO2 server / WebAuthn relying party for passkey registration (attestation) and authentication… | 99 | 1456 | active |
| intel/confidential-computing.sgx Intel Software Guard Extensions (SGX) software stack for Linux, comprising the SGX driver, SDK, and Platform Software (PSW). It enables dev… | 87 | 1455 | active |
| GhostPack/SharpDPAPI SharpDPAPI is a C# port of Mimikatz's Windows DPAPI functionality, allowing triage of DPAPI masterkeys, credentials, vaults, certificates, … | 32 | 1455 | active |
| ossf/allstar Allstar is a GitHub App from OpenSSF that continuously monitors GitHub organizations and repositories for adherence to security best practi… | 84 | 1454 | active |
| NullArray/AutoSploit AutoSploit is a Python CLI tool that automates mass exploitation of remote hosts by combining target discovery from Shodan, Censys, and Zoo… | 23 | 5255 | maintenance |
| tuneinsight/lattigo Lattigo is a pure Go library implementing lattice-based (RLWE) homomorphic encryption schemes such as BFV/BGV and CKKS, along with their mu… | 73 | 1452 | active |
| SeeFlowerX/stackplz stackplz is an eBPF-based stack tracing tool for Android (arm64). It supports syscall tracing, uprobe hooking of 64-bit userspace libraries… | 60 | 1450 | active |
| bacher09/pwgen-for-bios A collection of master password generators for various BIOS/UEFI firmware from vendors like Dell, HP, Asus, Samsung, and Sony. It powers th… | 58 | 1450 | active |
| ThoughtfulDev/EagleEye EagleEye is a Python-based OSINT tool that identifies social media profiles (Instagram, Facebook, Twitter, YouTube) of a person using face … | 32 | 5231 | maintenance |
| Harmony The core protocol implementation of the Harmony blockchain, a sharded proof-of-stake network written in Go. It implements consensus (PBFT-b… | 89 | 1447 | active |
| sw33tLie/bbscope bbscope is a Go CLI tool that fetches, stores, and manages bug bounty program scopes from HackerOne, Bugcrowd, Intigriti, YesWeHack, and Im… | 74 | 1446 | active |
| crazy-max/WindowsSpyBlocker WindowsSpyBlocker is a Go application delivered as a single Windows executable that blocks spying and tracking on Windows systems. It captu… | 65 | 5217 | maintenance |
| shizunge/endlessh-go A Go implementation of endlessh, an SSH tarpit that traps brute-force attackers by sending an endless SSH banner, while exporting Prometheu… | 82 | 1444 | active |
| zodiacon/AllTools A collection of Pavel Yosifovich's reasonably stable Windows system tools, including process/driver monitors, kernel object viewers, PE fil… | 83 | 1443 | active |
| Superpowered SDK Superpowered is a commercial cross-platform C++ SDK suite providing low-latency interactive audio processing, HTTP/HTTPS networking, and cr… | 74 | 1443 | active |
| SlipNet SlipNet is an open-source anti-censorship VPN client for Android (Kotlin/Jetpack Compose) with a cross-platform Go CLI companion, supportin… | 71 | 1443 | active |
| tahoe-lafs/tahoe-lafs Tahoe-LAFS is a free and open-source decentralized storage system that distributes encrypted, erasure-coded file shares across multiple unt… | 59 | 1443 | active |
| google/oss-fuzz-gen A Google framework that uses large language models to automatically generate fuzz targets for real-world C/C++, Java, and Python projects, … | 55 | 1443 | active |
| t3l3machus/toxssin toxssin is an open-source penetration testing CLI tool that automates exploitation of Cross-Site Scripting (XSS) vulnerabilities. It pairs … | 32 | 1443 | active |
| EgeBalci/amber Amber is a reflective PE packer that converts Windows PE files (EXE, DLL, SYS) into position-independent shellcode payloads for in-memory e… | 23 | 1443 | active |
| AndroRAT AndroRAT is an Android remote administration tool (RAT) with a Java-based Android client APK and a Python server, communicating over socket… | 32 | 5206 | maintenance |
| omegaee/my-fingerprint A lightweight browser extension built on Manifest V3 that protects against browser fingerprinting across Chrome, Edge, and Firefox. It spoo… | 89 | 1441 | active |
| nowsecure/r2frida r2frida is a radare2 plugin that integrates the Frida dynamic instrumentation toolkit, letting users inspect and manipulate local or remote… | 91 | 1440 | active |
| Cloud SQL Auth Proxy The Cloud SQL Auth Proxy is a Go utility that provides secure, IAM-authorized, TLS 1.3-encrypted connections to Google Cloud SQL instances … | 99 | 1439 | active |
| antonioCoco/RunasCs RunasCs is an open-source C# utility for running processes with explicit credentials on Windows, serving as an improved alternative to the … | 23 | 1439 | stable |
| boku7/BokuLoader BokuLoader is a proof-of-concept User-Defined Reflective Loader (UDRL) for Cobalt Strike written in C and assembly. It recreates, integrate… | 32 | 1438 | active |
| beakthoven/TrickyStoreOSS A fully open-source Magisk module that spoofs Android hardware keystore attestation, serving as a FOSS rewrite of the proprietary TrickySto… | 83 | 1437 | active |
| Isaacdelly/Plutus Plutus is a Python CLI tool that brute-forces Bitcoin private keys by generating sequential keys via elliptic curve point addition and chec… | 56 | 1437 | active |
| Bitwise-01/Instagram- A Python CLI tool that performs brute-force password attacks against Instagram accounts using a supplied password list and rotating proxies… | 32 | 5183 | maintenance |
| twoone-3/AdGuardHomeForRoot A Magisk/KernelSU/APatch module that runs AdGuardHome on rooted Android devices, providing a local DNS server that blocks ads, malware, and… | 88 | 1436 | active |
| dirkjanm/ldapdomaindump A Python CLI tool that dumps Active Directory information (users, groups, computers, policies, trusts) via LDAP and renders it as human-rea… | 26 | 1436 | stable |
| redacted/XKCD-password-generator xkcdpass is a Python CLI tool and library that generates secure multi-word passphrases inspired by XKCD 936. It supports customizable wordl… | 57 | 1435 | stable |
| jawj/IKEv2-setup A Bash script that configures a fresh Ubuntu Server LTS install as an IKEv2 VPN server using strongSwan, with Let's Encrypt certificates an… | 53 | 1435 | active |
| simsong/bulk_extractor bulk_extractor is a high-performance digital forensics tool that rapidly scans disk images, files, and directories to extract structured in… | 85 | 1433 | active |
| rebrowser A collection of source-code patches for Puppeteer and Playwright that fix automation leaks and help avoid bot detection systems like Cloudf… | 31 | 1433 | active |
| cyberark/KubiScan KubiScan is a Python CLI tool that scans Kubernetes clusters for risky permissions in the RBAC authorization model. It identifies risky rol… | 30 | 1433 | active |
| SamuelTulach/VirusTotalUploader An open-source C# WinForms desktop application for uploading files to VirusTotal for malware scanning. It serves as a maintained replacemen… | 23 | 1433 | active |
| autoDecoder A Burp Suite extension (written in Java) that lets users plug in custom encryption/decryption logic so intercepted HTTP traffic can be view… | 68 | 1431 | active |
| login-securite/DonPAPI DonPAPI is a Python CLI tool that remotely dumps DPAPI-protected secrets (browser credentials, certificates, WiFi passwords, and more) from… | 65 | 1430 | active |
| BiZken/PhishMailer A Python CLI tool that generates professional-looking phishing email templates for popular services like Instagram, PayPal, and Discord, ou… | 37 | 1430 | active |
| rubyzip/rubyzip Rubyzip is a Ruby library (gem) for reading and writing zip archives, including support for AES encryption. It provides both high-level Zip… | 96 | 1429 | stable |
| tilfinltd/aws-extend-switch-roles A browser extension for Chrome, Firefox, and Edge that extends the AWS Management Console's built-in IAM role switching. It lets users conf… | 89 | 1429 | active |
| enarx/enarx Enarx is an open-source command-line tool and runtime for running applications inside hardware Trusted Execution Environments (TEEs) such a… | 48 | 1429 | active |
| dockovpn/dockovpn DockOvpn is a stateless, out-of-the-box OpenVPN server packaged as a Docker image that starts in under two seconds and requires no persiste… | 23 | 1429 | active |
| blacklanternsecurity/MANSPIDER MANSPIDER is a Python CLI tool that crawls SMB shares across entire networks to find files by filename or content, with regex support and t… | 77 | 1428 | active |
| netsniff-ng/netsniff-ng netsniff-ng is a free, high-performance Linux networking toolkit written in C, often described as a Swiss army knife for network packets. I… | 30 | 1426 | stable |
| ankane/pretender Pretender is a lightweight Ruby gem that lets admins log in as (impersonate) another user in Rails applications. It works with any authenti… | 62 | 1425 | stable |
| tyranid/oleviewdotnet OleView.NET is a .NET application that merges the classic SDK tools OleView and Test Container into one COM/OLE viewer and inspector. It le… | 23 | 1425 | active |
| ahmedkhlief/APT-Hunter APT-Hunter is a Python-based threat hunting tool that analyzes Windows event logs (EVTX) to detect APT activity using predefined detection … | 85 | 1424 | active |
| backslashxx/mountify Mountify is a shell-based module for rooted Android that mounts other root modules globally via OverlayFS instead of Magic Mount. It works … | 82 | 1423 | active |
| WPeGPT WPeGPT is an IDA Pro plugin that integrates LLM models (OpenAI, DeepSeek, or any OpenAI-compatible API) into binary analysis workflows. It … | 69 | 1423 | active |
| Metarget/metarget Metarget is a Python-based framework that automatically builds vulnerable cloud-native infrastructures, installing vulnerable versions of D… | 61 | 1423 | active |
| wetox-team/flipperzero-goodies A collection of useful data and scripts for the Flipper Zero multi-tool device, including intercom keys and Python scripts. It is maintaine… | 40 | 1423 | active |
| xaitax/SploitScan SploitScan is a Python CLI cybersecurity utility that aggregates detailed vulnerability information for CVEs from sources like EPSS, CISA K… | 74 | 1422 | active |
| openwpm/OpenWPM OpenWPM is a web privacy measurement framework built on Firefox with Selenium automation, designed to collect data from thousands to millio… | 91 | 1420 | active |
| cr-marcstevens/sha1collisiondetection A C library and command-line tool that computes SHA-1 hashes while detecting known cryptanalytic collision attacks against SHA-1 with proba… | 41 | 1420 | stable |
| mbi/django-simple-captcha A Django application that adds customizable captcha image challenges to any Django form. It supports custom challenge generators, image sty… | 78 | 1419 | stable |
| Horcrux A Go CLI tool that splits a file into encrypted fragments using Shamir's Secret Sharing, requiring only a threshold of fragments to reconst… | 23 | 5105 | maintenance |
| RythmStick/AMSITrigger AMSITrigger is a C# command-line tool that identifies the specific strings in PowerShell scripts that trigger Microsoft's Antimalware Scan … | 29 | 1418 | active |
| rosenpass/rosenpass Rosenpass is a post-quantum-secure key exchange tool written in Rust that establishes symmetric keys and feeds them to WireGuard via its pr… | 82 | 1417 | active |
| Outflank C2 Tool Collection A collection of C-based offensive security tools that integrate with Cobalt Strike and other C2 frameworks via Beacon Object Files (BOF) an… | 32 | 1417 | active |
| danny0838/content-farm-terminator Content Farm Terminator is a cross-platform browser extension that identifies content farms by marking hyperlinks pointing to them and bloc… | 76 | 1415 | active |
| mufeedvh/pdfrip pdfrip is a multithreaded PDF password cracking utility written in Rust. It supports dictionary attacks, mask and pattern-based brute force… | 62 | 1415 | active |
| proyecto26/react-native-inappbrowser A React Native library providing an in-app browser using Chrome Custom Tabs on Android and SafariServices/AuthenticationServices on iOS. It… | 62 | 1414 | active |
| ct-Open-Source/tuya-convert A collection of Python scripts that flash Tuya-based smart home IoT devices (mostly ESP8266-based) with alternative open-source firmware ov… | 23 | 5084 | maintenance |
| NotRequiem/VMAware VMAware is a cross-platform, header-only C++ library for detecting virtual machines, hypervisors, emulators, containers, and sandboxes usin… | 89 | 1413 | active |
| Dropnation/contract-fuzzer A Python-based fuzzer for Ethereum smart contracts that compiles Solidity sources and executes random sequences of public/external calls to… | 75 | 1413 | active |
| Flangvik/TeamFiltration TeamFiltration is a cross-platform penetration testing framework for enumerating, password spraying, exfiltrating data from, and backdoorin… | 51 | 1413 | active |
| nuvious/pam-duress A Linux Pluggable Authentication Module (PAM) that lets users configure alternate 'duress' passwords which, when used under coercion, authe… | 70 | 1412 | active |
| daboynb/Safetycore-placeholder A placeholder Android APK that occupies the com.google.android.safetycore package name so Google cannot install or update the real SafetyCo… | 66 | 1412 | active |
| superhedgy/AttackSurfaceMapper AttackSurfaceMapper is a Python CLI reconnaissance tool that expands a target's attack surface using OSINT and active techniques like subdo… | 32 | 1412 | active |
| WireGuard/wireguard-apple The official WireGuard VPN client application for iOS and macOS, written in Swift, including the WireGuardKit Swift package for integrating… | 32 | 1411 | active |
| Jayy001/Search-That-Hash Search-That-Hash is a Python CLI tool that automatically submits hashes to popular online hash-cracking APIs to crack them in seconds. If n… | 23 | 1411 | active |
| PrimiHub PrimiHub is an open-source privacy-preserving computing platform built by a team of cryptography experts, supporting secure multi-party com… | 40 | 1409 | active |
| tihanyin/PSSW100AVB A curated collection of PowerShell scripts demonstrating antivirus evasion techniques, most notably reverse shells that go undetected by AV… | 67 | 1406 | active |
| corna/me_cleaner A Python script that modifies Intel ME/TXE firmware images to reduce the co-processor's ability to interact with the system, disabling it d… | 66 | 5051 | maintenance |
| syssec-utd/pylingual PyLingual is a CPython bytecode decompiler that recovers Python source code from .pyc files for all Python versions since 3.6. It can be ru… | 74 | 1405 | active |