Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| fuatakgun/eufy_security A Home Assistant integration that connects Eufy Security devices (cameras, doorbells, home base stations, motion and contact sensors) to Ho… | 93 | 1403 | active |
| facebook/ThreatExchange A collection of Trust & Safety tools from Meta for fighting digital harms, including perceptual hashing algorithms (PDQ for images, TMK and… | 100 | 1402 | active |
| itsreyi/BlockSuite Block-Suite is a modular JavaFX desktop application for authorized Minecraft server security assessments. It deploys a transparent MITM pro… | 80 | 1402 | active |
| RedByte1337/GraphSpy GraphSpy is an initial access and post-exploitation tool for Microsoft Entra ID (Azure AD) and Microsoft 365, offering a browser-based GUI … | 67 | 1402 | active |
| googleapis/google-auth-library-php Google's officially supported PHP client library for OAuth 2.0 authentication and authorization with Google APIs. It implements Application… | 97 | 1401 | stable |
| cisco/libsrtp libSRTP is Cisco's open-source C library implementing the Secure Real-time Transport Protocol (SRTP, RFC 3711) along with a supporting cryp… | 86 | 1401 | stable |
| google-github-actions/auth A GitHub Action that authenticates GitHub Actions workflows to Google Cloud, supporting Workload Identity Federation and Service Account Ke… | 73 | 1400 | active |
| PeculiarVentures/PKI.js PKI.js is a pure TypeScript library implementing the common formats and protocols used in PKI applications, including X.509 certificates, P… | 96 | 1399 | stable |
| Guided Hacking DLL Injector A C++ DLL injection library supporting x86, WOW64, and x64 injection with five injection methods and six shellcode execution techniques. It… | 29 | 1398 | active |
| hasherezade/libpeconv libPeConv is a C++ library for loading, manipulating, and dumping Windows PE (Portable Executable) files. It provides a 'swiss army knife' … | 63 | 1393 | active |
| ChiChou/grapefruit Grapefruit is an open-source mobile security testing suite for iOS and Android that provides a browser-based GUI over Frida for runtime ins… | 88 | 1392 | active |
| XiebroC2 XiebroC2 is an open-source command-and-control (C2) framework for penetration testing, written in Go with a .NET teamserver. It supports Lu… | 24 | 1392 | active |
| aws-cloudformation/cloudformation-guard AWS CloudFormation Guard (cfn-guard) is a general-purpose policy-as-code evaluation tool with an expressive DSL for defining rules. It vali… | 83 | 1389 | active |
| moyuwa/ApkCheckPack A Go-based CLI tool that detects APK hardening/packing features from 40+ vendors, plus third-party SDKs, anti-environment checks (ROOT, emu… | 76 | 1389 | active |
| blacklanternsecurity/TREVORspray TREVORspray is a modular password spraying tool with threading, SSH/subnet proxy rotation, and loot modules targeting identity providers li… | 66 | 1389 | active |
| reveny/Android-Native-Root-Detector An Android application that detects whether a device is rooted, using native code checks. It is written in Kotlin and distributed as a down… | 65 | 1389 | active |
| jamesmcm/vopono Vopono is a Rust CLI tool that runs individual applications through VPN tunnels using temporary network namespaces on Linux. It supports mu… | 97 | 1388 | active |
| USBGuard/usbguard USBGuard is a C++ software framework for implementing USB device authorization policies on Linux, protecting against rogue USB devices (Bad… | 65 | 1388 | active |
| thalesgroup-cert/Watcher Watcher is an open-source, self-hosted cyber threat intelligence and hunting platform built with Django and React JS. It uses AI to analyze… | 96 | 1387 | active |
| Brandon7CC/mac-monitor Mac Monitor is a stand-alone macOS application that uses Apple's Endpoint Security and System Extension APIs to collect and enrich system e… | 80 | 1387 | active |
| jazzband/django-auditlog django-auditlog is a reusable Django app that logs changes made to model objects, including the user (actor) who made them. It stores chang… | 79 | 1387 | active |
| Jackalope Jackalope is a customizable, coverage-guided fuzzer for black-box binaries built on the TinyInst instrumentation library by Google Project … | 73 | 1386 | active |
| Yubico/yubioath-flutter Yubico Authenticator is a companion desktop and Android app for managing YubiKey hardware security keys and accessing OATH one-time passwor… | 92 | 1385 | stable |
| simeononsecurity/Windows-Optimize-Harden-Debloat A PowerShell script that automates optimization, hardening, and debloating of Windows 10 and Windows 11 systems. It applies security and pr… | 27 | 1385 | active |
| abrignoni/iLEAPP iLEAPP is an open-source iOS and iPadOS forensic artifact parser that extracts logs, events, and plists from device extractions and iTunes … | 98 | 1384 | active |
| CIRCL/AIL-framework AIL framework is an open-source Python platform for collecting, crawling, processing, and analyzing unstructured data from the clear web, T… | 67 | 1384 | active |
| xihan123/SignHook SignHook is an Xposed/LSPosed module for Android that spoofs app signature checks by returning a user-configured fake signature when a host… | 78 | 1383 | active |
| fasnow/fine Fine is a Chinese-language cyberspace asset mapping and reconnaissance tool integrating FOFA, Hunter, Quake, ZoomEye, and Shodan APIs, plus… | 76 | 1383 | active |
| Anubis Anubis is a Python CLI tool for subdomain enumeration and information gathering that aggregates results from sources like HackerTarget, Vir… | 62 | 1382 | active |
| hasherezade/exe_to_dll A command-line tool that converts a Windows EXE into a DLL that can be loaded like a library, exporting the original entry point as a 'Star… | 49 | 1382 | stable |
| rzcoder/node-rsa A pure TypeScript RSA cryptography library for Node.js and browsers supporting key generation, encryption/decryption, and signing/verificat… | 78 | 1380 | active |
| mishakorzik/UserFinder UserFinder is a shell-based OSINT tool that searches for user profiles across social networks and other sites by username. It runs as a sim… | 52 | 1380 | active |
| 0xacb/recollapse REcollapse is a Python CLI helper tool that generates fuzzing payloads for black-box regex fuzzing against web applications. It helps bypas… | 42 | 1380 | active |
| LSPosed/DisableFlagSecure An LSPosed/Xposed module that enables screenshots in apps that block them via FLAG_SECURE and disables screenshot and screen-record detecti… | 81 | 1379 | active |
| simondankelmann/Bluetooth-LE-Spam An Android app that uses built-in Bluetooth Low Energy to send phantom device advertisements mimicking services like Apple popups, Microsof… | 58 | 4937 | maintenance |
| glitchedgitz/cook COOK is a Go-based wordlist framework that generates, splits, merges, and finds wordlists, with support for permutations, combinations, and… | 60 | 1377 | active |
| emalderson/ThePhish ThePhish is an automated phishing email analysis web application built on TheHive, Cortex, and MISP. It extracts observables from email hea… | 32 | 1377 | stable |
| aws/s2n-quic s2n-quic is a Rust implementation of the IETF QUIC transport protocol, offering a simple API with configurable providers for TLS (s2n-tls o… | 99 | 1375 | active |
| LegacyUpdate/LegacyUpdate Legacy Update is a Windows application and companion web service that restores Windows Update functionality, online activation, and Interne… | 95 | 1375 | active |
| PentesterFlow/agent PentesterFlow is a terminal-based agentic AI CLI assistant for penetration testers and bug bounty hunters. It orchestrates LLM-driven recon… | 72 | 1375 | active |
| ClownQq/YDArk YDArk is a free x64 Windows kernel inspection tool similar to PCHunter, providing GUI views of processes, threads, handles, drivers, kernel… | 32 | 1375 | active |
| overtrue/socialite A framework-agnostic PHP OAuth2 authentication library inspired by laravel/socialite, supporting 20+ providers including GitHub, Google, Fa… | 92 | 1374 | active |
| Endava/cats CATS (Contract API Testing and Security) is a REST API fuzzer and negative testing tool for OpenAPI endpoints. It automatically generates, … | 92 | 1374 | active |
| w3af w3af is an open source web application attack and audit framework that scans web applications for over 200 vulnerability types, including X… | 23 | 4914 | maintenance |
| mullvad/gotatun GotaTun is a userspace WireGuard implementation in Rust, forked from Cloudflare's BoringTun, providing both a library and a standalone tunn… | 95 | 1373 | active |
| BullsEye0/shodan-eye Shodan Eye is a Python command-line tool that queries the Shodan search engine to collect information about all devices directly connected … | 76 | 1373 | active |
| Cracked5pider/Stardust Stardust is a modern 32/64-bit position independent shellcode (implant) template written in C++20. It provides compile-time FNV-1a hashing … | 67 | 1373 | active |
| cesanta/docker_auth A standalone authentication and authorization server implementing the Docker Registry 2 token-based auth protocol. It issues tokens for Doc… | 54 | 1373 | active |
| ossf/best-practices-badge The OpenSSF Best Practices Badge is a web application (BadgeApp) that lets Free/Libre and Open Source Software projects self-certify that t… | 96 | 1370 | active |
| pypa/pip-audit pip-audit is a command-line tool that scans Python environments, requirements files, and dependency trees for packages with known security … | 80 | 1370 | active |
| google/nftables A pure Go library for programmatically interacting with Linux nftables, the iptables successor, without wrapping libnftnl. It provides data… | 69 | 1370 | active |
| 61106960/adPEAS adPEAS is a single-file PowerShell tool that automates Active Directory security assessment, enumerating misconfigurations, vulnerabilities… | 98 | 1369 | active |
| Passepartout Passepartout is an OpenVPN and WireGuard VPN client app for iPhone, iPad, Mac, and Apple TV, built on the Partout tunnel framework. It offe… | 93 | 1368 | active |
| SpiderLabs/Responder Responder is a Python-based LLMNR, NBT-NS, and mDNS poisoner with built-in rogue authentication servers (SMB, HTTP/S, MSSQL, FTP, LDAP, POP… | 10 | 4889 | maintenance |
| yuanyuanxiang/SimpleRemoter SimpleRemoter (YAMA) is a C++ remote control suite derived from the Gh0st RAT codebase, providing remote desktop, file transfer, terminal, … | 56 | 1367 | active |
| boku7/Loki Loki is a stage-1 command and control (C2) framework written in Node.js that exploits script-jacking vulnerabilities in Electron applicatio… | 48 | 1367 | active |
| chili-chips-ba/wireguard-fpga An open-source, wire-speed hardware implementation of the WireGuard VPN protocol on a low-cost Artix-7 FPGA, written in Verilog with an ope… | 66 | 1366 | active |
| alphasoc/flightsim flightsim is a lightweight Go CLI utility that safely generates malicious network traffic patterns such as DNS tunneling, DGA domains, C2 c… | 23 | 1366 | active |
| MhmRdd/NoHello NoHello is a Zygisk module written in C++ that hides root and Zygisk from Android apps. It supports Magisk, KernelSU, KernelSU Next, and AP… | 30 | 1364 | active |
| aserto-dev/topaz Topaz is an open-source, cloud-native authorization service that provides fine-grained, real-time, policy-based access control for applicat… | 98 | 1363 | active |
| Authing Authing Guard is an embeddable SSO login form widget and UI component library from Authing, an enterprise identity provider. It ships frame… | 66 | 1361 | active |
| fkie-cad/cwe_checker cwe_checker is a Rust-based suite of checks that detects common bug classes (CWEs) such as null pointer dereferences and buffer overflows i… | 66 | 1361 | active |
| AEPKILL/devtools-detector A TypeScript browser library that detects whether browser DevTools is open. It lets developers trigger actions like crashing the page or lo… | 36 | 1361 | active |
| bivlked/amneziawg-installer A one-command Bash installer that turns a fresh Ubuntu or Debian VPS (x86_64, ARM64, Raspberry Pi) into a self-hosted AmneziaWG 2.0/3.x VPN… | 82 | 1356 | active |
| llm-attacks/llm-attacks Official research code for 'Universal and Transferable Adversarial Attacks on Aligned Language Models', implementing the GCG algorithm for … | 29 | 4839 | maintenance |
| go-pkgz/auth A Go library providing authentication via multiple oauth2 providers (GitHub, Google, Facebook, Discord, Telegram, and more), direct credent… | 99 | 1354 | active |
| wotschofsky/domain-digger Domain Digger is a web application for in-depth domain analysis, offering DNS lookups across global resolvers, WHOIS queries, IP geolocatio… | 75 | 1354 | active |
| JoySafety/JoySafety JoySafety is an open-source large language model safety framework from JD.com, written in Java, providing prompt injection detection, conte… | 42 | 1354 | active |
| Nuclei A Burp Suite plugin that helps generate Nuclei vulnerability scanner templates from HTTP requests and responses captured in Burp's Proxy, R… | 85 | 1353 | active |
| malaohu/MobaXterm-GenKey A small Python web application that generates license key files to activate MobaXterm, a commercial SSH/terminal client for Windows. It can… | 44 | 1353 | active |
| openconnect/openconnect-gui A graphical VPN client built on the OpenConnect library, supporting Cisco AnyConnect-compatible VPNs. It is a Qt5-based desktop application… | 10 | 1353 | active |
| urbanadventurer/Android-PIN-Bruteforce A shell script that turns a rooted Android device running Kali NetHunter into a USB HID keyboard that bruteforces the lockscreen PIN of a l… | 32 | 4829 | maintenance |
| appneta/tcpreplay Tcpreplay is a suite of GPLv3 command-line utilities for editing and replaying captured network traffic (pcap files) back onto the network … | 92 | 1352 | active |
| CERT-Polska/drakvuf-sandbox DRAKVUF Sandbox is an automated, agentless malware analysis system that runs suspicious files inside a hypervisor-level sandbox powered by … | 84 | 1352 | active |
| roottusk/vapi vAPI is a self-hostable deliberately vulnerable API that mimics the OWASP API Security Top 10 scenarios through hands-on exercises. It ship… | 23 | 1351 | active |
| silverhack/monkey365 Monkey365 is an open-source PowerShell-based security assessment framework for Microsoft 365, Azure, and Microsoft Entra ID. It collects te… | 97 | 1350 | active |
| yeswehack/PwnFox PwnFox is a Firefox extension paired with a Burp Suite extension that provides tools for web security audits, such as one-click Burp proxy … | 23 | 1350 | active |
| stripe/smokescreen Smokescreen is an HTTP CONNECT egress proxy written in Go, developed by Stripe to proxy outbound traffic such as webhooks. It enforces host… | 86 | 1349 | active |
| ltb-project/self-service-password Self Service Password is a PHP web application that lets users change and reset their own passwords in an LDAP directory, including Active … | 93 | 1347 | stable |
| cecio/USBvalve USBvalve is a firmware application for cheap RP2040-based hardware (Raspberry Pi Pico) that emulates a fake USB mass-storage filesystem and… | 83 | 1347 | active |
| dafthack/GraphRunner GraphRunner is a post-exploitation toolset for interacting with the Microsoft Graph API, written in PowerShell. It enables reconnaissance, … | 59 | 1347 | active |
| koajs/jwt koa-jwt is a Koa middleware for authenticating HTTP requests using JSON Web Tokens. It validates JWTs from headers or cookies and exposes t… | 23 | 1347 | stable |
| WKL-Sec/HiddenDesktop Hidden Desktop is a Cobalt Strike BOF implementation of HVNC (Hidden Virtual Network Computing), letting red team operators interact with a… | 21 | 1347 | active |
| go-webauthn/webauthn A FIDO2-conformant WebAuthn and passkey backend library for Go applications. It implements the Web Authentication specification to enable m… | 98 | 1346 | active |
| NeuVector NeuVector is an open-source full lifecycle container security platform providing vulnerability management and automated runtime security wi… | 94 | 1346 | active |
| sebadob/rauthy Rauthy is a lightweight, Rust-based Identity Provider offering Single Sign-On via OpenID Connect, OAuth 2, and PAM, with strong emphasis on… | 92 | 1346 | active |
| google/crosvm crosvm is a secure, lightweight Virtual Machine Monitor (VMM) written in Rust, originally built for ChromeOS to run Linux and Android guest… | 77 | 1343 | active |
| ION28/BLUESPAWN BLUESPAWN is an open-source active defense and endpoint detection and response (EDR) tool for Windows. It helps blue teams detect, identify… | 63 | 1343 | active |
| ZupIT/horusec Horusec is an open-source SAST (static application security testing) CLI that scans a project for vulnerabilities across many languages wit… | 66 | 1342 | active |
| adamyaxley/Obfuscate A header-only C++14 library that obfuscates string literals at compile time using constexpr XOR encryption with a random 64-bit key, preven… | 57 | 1342 | stable |
| mikker/passwordless Passwordless is a Rails engine that adds magic-link (email-based) authentication to Rails applications without passwords. It provides a ses… | 68 | 1341 | active |
| palantir/windows-event-forwarding A Palantir-maintained repository of Windows Event Forwarding (WEF) subscriptions and guidance for centrally collecting security-relevant ev… | 47 | 1341 | active |
| zalando/go-keyring A cross-platform Go library for setting, getting, and deleting secrets in the operating system's native keyring (macOS Keychain, Windows Cr… | 71 | 1340 | active |
| Shopify/remote-dom Remote DOM is a TypeScript library that synchronizes a tree of DOM elements created in a sandboxed JavaScript environment (like an iframe o… | 93 | 1339 | active |
| MomenSherif/react-oauth A collection of React libraries for OAuth2 authentication, including @react-oauth/google built on Google Identity Services and @react-oauth… | 75 | 1339 | active |
| php-casbin/php-casbin PHP-Casbin is a powerful and efficient open-source access control library for PHP projects that enforces authorization based on models like… | 94 | 1338 | active |
| Apache Casbin Casbin.NET is the .NET (C#) implementation of Apache Casbin, an open-source authorization library that enforces access control via models s… | 88 | 1338 | stable |
| erev0s/VAmPI VAmPI is a deliberately vulnerable REST API built with Flask that implements the OWASP Top 10 vulnerabilities for APIs. It is designed for … | 62 | 1338 | active |
| warrant-dev/warrant Warrant is a highly scalable, centralized fine-grained authorization service inspired by Google Zanzibar, written in Go. It lets applicatio… | 43 | 1337 | active |
| MrTuxx/SocialPwned SocialPwned is a Python-based OSINT tool that harvests emails published on Instagram, LinkedIn, and Twitter to find credential leaks via Pw… | 10 | 1337 | active |