Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| F6JO/RouteVulScan RouteVulScan is a Burp Suite extension written in Java that passively and recursively probes each path layer of web traffic for vulnerable … | 76 | 1336 | active |
| qdhenry/Claude-Command-Suite A collection of 216+ slash commands, 12 Claude Code Skills, and 54 specialized AI agents that add structured development workflows to Claud… | 57 | 1336 | active |
| x364e3ab6/DudeSuite DudeSuite is a lightweight, integrated web penetration testing toolkit distributed as a desktop application for Windows and macOS. It bundl… | 79 | 1335 | active |
| SAML-Toolkits/php-saml A PHP library that adds SAML 2.0 support to PHP applications, enabling them to act as a Service Provider for single sign-on with identity p… | 86 | 1334 | stable |
| ly4k/PwnKit A self-contained exploit for CVE-2021-4034 (PwnKit), a local privilege escalation vulnerability in polkit's pkexec. It ships as a prebuilt … | 32 | 1333 | stable |
| Covenant Covenant is a collaborative .NET command and control (C2) framework for red teamers, built as an ASP.NET Core cross-platform application wi… | 32 | 4741 | maintenance |
| sockysec/Telerecon Telerecon is a Python-based OSINT reconnaissance framework for researching and investigating Telegram. It scrapes user profiles, messages, … | 29 | 1331 | active |
| DNSveil DNSveil is a Windows-only secure DNS client supporting DNSCrypt, Anonymized DNSCrypt, DoH, DoT, and plain DNS over UDP/TCP, with built-in D… | 53 | 1330 | active |
| tg123/sshpiper sshpiper is a reverse proxy for SSH that routes incoming SSH/SCP connections to upstream servers, with pluggable authentication mapping and… | 91 | 1329 | active |
| platomav/MEAnalyzer ME Analyzer is a Python command-line tool that parses and identifies Intel Engine (CSME, TXE, SPS, GSC) and Graphics firmware images, repor… | 94 | 1327 | active |
| samyk/evercookie Evercookie is a JavaScript API that creates extremely persistent, respawning 'super' cookies by storing identifiers across a dozen-plus bro… | 36 | 4720 | maintenance |
| HaveIBeenPwned/PwnedPasswordsDownloader A .NET global tool that downloads the complete Pwned Passwords SHA1 and NTLM hash ranges for offline use, removing the need to query the k-… | 73 | 1326 | active |
| Upterm Upterm is an open-source CLI tool for instantly sharing terminal sessions over secure SSH tunnels to the public internet. It supports remot… | 100 | 1325 | active |
| DNSCrypt/encrypted-dns-server A high-performance Rust proxy that lets anyone run their own encrypted DNS server supporting DNSCrypt v2 (including post-quantum), Anonymiz… | 93 | 1325 | active |
| wafinfo/DecryptTools A comprehensive encryption/decryption tool for penetration testers, supporting 22+ decryption schemes for Chinese enterprise software (OA s… | 17 | 1325 | active |
| RedTeamPentesting/pretender Pretender is a Go-based penetration testing tool that gains machine-in-the-middle positions via spoofed local name resolution (mDNS, LLMNR,… | 86 | 1324 | active |
| cseroad/Webshell_Generate A JavaFX desktop tool that generates evasive (antivirus-bypassing) webshells in multiple languages, supporting cmd shells and clients like … | 52 | 1324 | active |
| kspearrin/Otp.NET Otp.NET is a C# library implementing TOTP (RFC 6238) and HOTP (RFC 4226) one-time password algorithms, available on NuGet. It supports conf… | 47 | 1324 | stable |
| sharkdp/binocle Binocle is a graphical tool that visualizes binary data by colorizing bytes according to configurable rules and rendering them as pixels in… | 23 | 1324 | stable |
| docker/docker-credential-helpers A suite of Go programs that store Docker login credentials in native platform keystores (e.g., macOS Keychain, Windows Credential Manager, … | 94 | 1323 | active |
| Vector35/binaryninja-api The public API, examples, and documentation for Binary Ninja, a commercial reverse engineering platform. It provides C++, Python, and Rust … | 92 | 1323 | active |
| test502git/awvs14-scan A Python batch-scanning script built on the Acunetix (AWVS) 14/15 API that automates bulk URL scanning with specialized templates for log4j… | 44 | 1323 | active |
| maqp/tfc Tinfoil Chat (TFC) is a peer-to-peer, end-to-end encrypted messaging system built on Tor onion services and high-assurance hardware archite… | 70 | 1322 | active |
| utkusen/sast-skills A collection of LLM agent skills that turn coding assistants like Claude Code, Codex, Opencode, and Cursor into a SAST (static application … | 46 | 1322 | active |
| RickdeJager/stegseek Stegseek is a lightning-fast command-line cracker for steghide steganography, built as a fork of the original steghide project that can tes… | 23 | 1322 | stable |
| google/longfellow-zk A C++ library from Google implementing zero-knowledge proof protocols for identity verification, supporting standards like ISO MDOC, JWT, a… | 73 | 1321 | active |
| nccgroup/singularity Singularity of Origin is a DNS rebinding attack framework that includes a DNS server, a web server, a management UI, and sample attack payl… | 70 | 1321 | active |
| hvac/hvac hvac is a Python 3.x client library for the HashiCorp Vault HTTP API. It lets Python applications authenticate to Vault and read, write, an… | 49 | 1321 | active |
| iGio90/Dwarf Dwarf is a full-featured multi-architecture, multi-OS debugger built on PyQt5 and Frida, aimed at reverse engineers, security analysts, and… | 32 | 1321 | active |
| 0x727/BypassPro BypassPro is a Burp Suite extension written in Java that automates bypass attempts against authorization controls (401/403) and WAFs. It co… | 73 | 1320 | active |
| dromara/orion-visor Orion Visor is a modern, self-hosted automation operations and lightweight bastion host platform built with Java and Vue. It provides unifi… | 64 | 1320 | active |
| mozilla/policy-templates A collection of policy templates for centrally deploying and managing Firefox in enterprise environments such as businesses, schools, and p… | 99 | 1319 | active |
| akitaonrails/ai-jail ai-jail is a Rust CLI that runs AI coding agents inside an OS-level sandbox using bubblewrap with Landlock, seccomp, and resource limits on… | 77 | 1319 | active |
| sardanioss/httpcloak httpcloak is a Go HTTP client library that reproduces browser-identical TLS, HTTP/2, and HTTP/3 fingerprints (JA3/JA4, Akamai, header order… | 58 | 1319 | active |
| getdns Stubby is a local DNS Privacy stub resolver daemon that encrypts DNS queries using DNS-over-TLS (RFC 7858), built on the getdns library. It… | 33 | 1319 | active |
| PlumHound/PlumHound PlumHound is a Python CLI reporting engine that wraps BloodHoundAD's Neo4j Cypher queries into consumable security reports for Blue and Pur… | 57 | 1318 | active |
| riverrun/comeonin Comeonin is a specification (behaviours) for password hashing libraries in Elixir, defining Comeonin and Comeonin.PasswordHash behaviours. … | 32 | 1318 | stable |
| gorhill/uMatrix uMatrix is a browser extension that lets users point-and-click filter network requests by source, destination, and type, acting as a firewa… | 10 | 4679 | maintenance |
| sulab999/AppMessenger AppMessenger is a free cross-platform (Windows/Mac/Linux, Java-based) GUI tool for analyzing mobile application packages including APK (And… | 91 | 1317 | active |
| freelabz/secator secator is a task and workflow runner for security assessments that unifies dozens of well-known security tools (subfinder, httpx, ffuf, nm… | 94 | 1316 | active |
| n0xa/m5stick-nemo NEMO is a firmware for M5Stack ESP32 devices (M5StickC, Cardputer) that implements high-tech pranks and digital self-defense tools such as … | 84 | 1316 | active |
| SanMuzZzZz/LuaN1aoAgent LuaN1aoAgent is an autonomous AI-driven penetration testing agent built in TypeScript on the Pi SDK, using graph-based cognitive reasoning … | 77 | 1316 | active |
| CalebFenton/simplify Simplify is a generic Android deobfuscator that virtually executes Dalvik methods in a sandbox (smalivm) and applies optimizations like con… | 23 | 4668 | maintenance |
| StackRox Kubernetes Security Platform StackRox is a Kubernetes security platform that performs risk analysis of container environments, delivers visibility and runtime alerts, a… | 96 | 1314 | active |
| DongTai IAST DongTai IAST is an open-source Interactive Application Security Testing platform that detects vulnerabilities in Java (and some Python) app… | 29 | 1314 | active |
| cseroad/Exp-Tools A Java-based integrated exploitation tool that bundles proof-of-concept exploits for high-risk vulnerabilities in Chinese enterprise softwa… | 22 | 1314 | active |
| hephaest0s/usbkill usbkill is a Python-based anti-forensic kill-switch daemon that monitors USB ports and immediately shuts down the computer when any USB cha… | 32 | 4665 | maintenance |
| Cortex XSOAR Content The official content repository for Cortex XSOAR (formerly Demisto), a security orchestration, automation and response (SOAR) platform. It … | 67 | 1313 | active |
| devise-two-factor/devise-two-factor A minimalist Ruby gem extending Devise with two-factor authentication via TOTP. It integrates with authenticator apps like Google Authentic… | 74 | 1312 | active |
| Albert-Weasker/niubi_guard An open-source defense system that protects GitHub repositories from spam, harassment, and coordinated abuse via configurable detection sig… | 59 | 1312 | active |
| codingo/VHostScan VHostScan is a Python-based virtual host scanner that discovers hidden vhosts on a web server using wordlists, reverse lookups, and catch-a… | 36 | 1312 | active |
| BehiSecc/VibeSec-Skill VibeSec-Skill is an AI skill (prompt/instruction pack) that teaches LLM coding assistants like Claude Code, Cursor, Codex, Copilot, and Ant… | 42 | 1311 | active |
| rootless-containers/rootlesskit RootlessKit is a Linux-native 'fake root' tool that uses user and mount namespaces to let unprivileged users run container engines like Doc… | 95 | 1310 | active |
| Marven11/Fenjing Fenjing is an automated Jinja2 SSTI (server-side template injection) exploitation tool designed for CTF competitions. It automatically anal… | 85 | 1310 | active |
| microsoft/win32-app-isolation Microsoft's repository of tools and documentation for Win32 app isolation, a Windows security feature that contains damage from compromised… | 26 | 1310 | active |
| AliyunContainerService/pouch PouchContainer is an open-source, OCI-compliant enterprise-class container engine created by Alibaba Group. It packs, delivers, and runs ap… | 23 | 4641 | maintenance |
| lanyi1998/DNSlog-GO DNSLog-GO is a self-hosted tool written in Go that monitors DNS resolution records, with a built-in web interface and API mode. It supports… | 85 | 1308 | active |
| camoufox-reverse-mcp An AI-powered 'Skill' package for JavaScript reverse engineering that plugs into AI coding tools like Claude Code, Cursor, and Codex. It pr… | 77 | 1308 | active |
| devcert A Node.js library that generates trusted SSL/TLS certificates for local HTTPS development. It creates a local certificate authority, regist… | 53 | 1308 | active |
| codingo/Interlace Interlace is a Python CLI tool that wraps single-threaded command-line applications and runs them in parallel across many targets, adding C… | 38 | 1308 | active |
| JFreegman/toxic Toxic is a terminal-based (ncurses) instant messaging client for the Tox peer-to-peer network, offering end-to-end encrypted text chat, fil… | 79 | 1307 | active |
| griffinmartin/opencode-claude-auth An OpenCode plugin that authenticates Anthropic API requests using existing Claude Code OAuth credentials, eliminating the need for a separ… | 79 | 1307 | active |
| xploitstech/Xteam Xteam is an all-in-one, menu-driven hacking toolkit written in Python and launched via bash scripts, bundling Instagram information gatheri… | 74 | 1307 | active |
| domainaware/parsedmarc parsedmarc is a Python module and CLI utility for parsing aggregate (rua), failure (ruf), and SMTP TLS reporting email authentication repor… | 94 | 1306 | active |
| 0xInfection/XSRFProbe XSRFProbe is a Python-based Cross Site Request Forgery (CSRF/XSRF) audit and exploitation toolkit. It crawls web applications, runs systema… | 76 | 1306 | stable |
| dwisiswant0/go-dork go-dork is a fast command-line dork scanner written in Go that automates Google dorking across multiple search engines. It supports Google,… | 23 | 1306 | stable |
| Rurik/Noriben Noriben is a Python script that wraps Sysinternals Procmon to automatically collect, analyze, and report runtime indicators of malware, pro… | 66 | 1304 | stable |
| GoogleCloudPlatform/berglas Berglas is a command line tool and Go library for managing secrets on Google Cloud, encrypting them with Cloud KMS and storing them in Clou… | 91 | 1302 | active |
| Bitcoin-ABC/bitcoin-abc Bitcoin ABC is the reference full-node software implementation for the eCash (XEC) cryptocurrency, forked from Bitcoin Core. It enables pee… | 98 | 1301 | active |
| hausec/PowerZure PowerZure is a PowerShell framework for assessing and exploiting resources in Microsoft Azure and Entra ID. It provides both reconnaissance… | 50 | 1301 | active |
| ProbiusOfficial/CTF-OS CTF-OS is a preconfigured virtual machine image purpose-built for Capture The Flag (CTF) competitions, bundling a curated set of security a… | 29 | 1301 | active |
| royhills/arp-scan arp-scan is a command-line network scanning tool that uses ARP requests to discover and fingerprint IPv4 hosts on a local network. It is wr… | 24 | 1301 | active |
| sighook/pixload pixload is a set of Perl CLI tools for creating and injecting payloads into image files (BMP, GIF, JPG, PNG, WebP). It is used in offensive… | 23 | 1301 | active |
| ZeroMount A native Rust daemon distributed as a root module (Magisk/KernelSU/APatch) that automatically manages TrickyStore and TEESimulator on roote… | 62 | 1300 | active |
| httpsok/httpsok httpsok is a shell-based SSL/TLS certificate auto-renewal tool designed for Nginx, OpenResty, and Apache servers, paired with a hosted web … | 51 | 1300 | active |
| knavesec/CredMaster CredMaster is a Python CLI tool for password spraying and brute-force attacks that rotates the source IP address on every authentication at… | 34 | 1300 | active |
| VirusTotal/yara-x YARA-X is a pure Rust rewrite of YARA, the pattern matching swiss knife for malware researchers, designed to be faster, safer, and more use… | 98 | 1299 | stable |
| wmiexec wmiexec-Pro is a Python CLI tool built on Impacket that provides an enhanced version of wmiexec.py for remote command execution on Windows … | 71 | 1299 | active |
| a2o/snoopy Snoopy is a small C library that logs every program execution on Linux/BSD systems, typically via a shared library loaded through the dynam… | 51 | 1298 | stable |
| pahaz/sshtunnel A pure Python library for creating SSH tunnels and TCP port forwarding through remote servers, built on paramiko. It lets applications prog… | 36 | 1298 | stable |
| cherriesandmochi/gdmaim GDMaim is a Godot Engine plugin that obfuscates all GDScript source code when exporting a project, renaming identifiers, hardcoding constan… | 84 | 1296 | active |
| pillarjs/cookies A Node.js module for getting and setting HTTP(S) cookies, with optional signing to prevent tampering via Keygrip. It works with the built-i… | 84 | 1295 | stable |
| FreeIPA FreeIPA is an integrated security information management solution providing centralized identity, authentication, and access control for Li… | 77 | 1295 | stable |
| Te-k/harpoon Harpoon is a Python CLI tool that aggregates open source intelligence and threat intelligence lookups across many services (Censys, crt.sh,… | 74 | 1295 | active |
| h4r5h1t/webcopilot WebCopilot is a Bash-based automation script for bug bounty reconnaissance that enumerates subdomains using multiple tools, filters paramet… | 23 | 1294 | active |
| qwqdanchun/Pillager Pillager is a C# post-exploitation information gathering tool that exports and decrypts sensitive data from target Windows machines, includ… | 21 | 1294 | active |
| BishopFox/eyeballer Eyeballer is a convolutional neural network tool that classifies screenshots of web hosts taken during large-scope penetration tests. It la… | 51 | 1293 | active |
| waiting-for-dev/devise-jwt A Ruby gem that extends Devise to authenticate Rails users with JWT tokens instead of cookies, built as a thin layer over warden-jwt_auth. … | 65 | 1292 | active |
| Nette Framework Latte is a secure, intuitive templating engine for PHP featuring context-sensitive escaping that automatically protects against XSS vulnera… | 100 | 1291 | stable |
| marvinvr/docktail DockTail is a Go-based Docker sidecar that watches container events, reads docktail.* labels, and exposes matching containers as native Tai… | 84 | 1291 | active |
| mozillazg/ptcpdump ptcpdump is a tcpdump-compatible packet analyzer built on eBPF that automatically annotates captured packets with process, container, and K… | 75 | 1291 | active |
| gaasedelen/patching An interactive binary patching plugin for IDA Pro that adds a robust in-disassembler workflow for editing assembly instructions. It support… | 23 | 1291 | active |
| miguelgrinberg/Flask-HTTPAuth Flask-HTTPAuth is a Flask extension that adds HTTP authentication to routes, supporting Basic, Digest, and Token schemes. It provides decor… | 74 | 1290 | stable |
| passff/passff PassFF is a Mozilla Firefox extension that provides browser access to a zx2c4 pass password store. It can list, fill, and submit login form… | 64 | 1290 | active |
| jvdsn/crypto-attacks A collection of Python implementations of cryptographic attacks and utilities, built on SageMath and PyCryptodome. It covers attacks agains… | 56 | 1290 | active |
| corkami/mitra Mitra is a Python CLI tool that generates weird files such as binary polyglots, near-polyglots, polymocks, parasites, and zippers across ma… | 32 | 1290 | active |
| google/secrets-gradle-plugin A Gradle plugin by Google that injects secrets from a properties file (like local.properties) not checked into version control into BuildCo… | 23 | 1288 | stable |
| zhuifengshaonianhanlu/pikachu Pikachu is a deliberately vulnerable PHP/MySQL web application designed as a practice range for learning web security and penetration testi… | 67 | 4556 | maintenance |
| P1-Team/AlliN AlliN is a flexible, dependency-free Python scanner designed to assist penetration testing projects, especially lateral movement and intran… | 36 | 1287 | active |
| SafeBreach-Labs/PoolParty PoolParty is a C++ command-line tool implementing eight novel, fully-undetectable process injection techniques that abuse Windows Thread Po… | 21 | 1287 | active |