domain: security
4787 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| client9/libinjection A C library that tokenizes and analyzes input strings to detect SQL injection (SQLi) attacks using fingerprint matching. It has bindings fo… | 32 | 1033 | maintenance |
| olyble/callPhoneBoom A Python script that automates browser-based form submissions (via Selenium/DrissionPage) against scraped business websites to spam a targe… | 22 | 1033 | maintenance |
| Tylous/ZipExec ZipExec is a Go-based proof-of-concept tool that wraps binaries into a password-protected zip file, base64 encodes it into a JScript loader… | 32 | 1032 | maintenance |
| WithSecureLabs/doublepulsar-detection-script A Python 2 script that sweeps networks to detect Windows systems compromised with the DOUBLEPULSAR implant (SMB and RDP variants) released … | 32 | 1030 | maintenance |
| luantak/ToRat ToRat is a cross-platform remote administration tool written in Go that uses the Tor network as its transport mechanism and RPC for communi… | 10 | 1030 | maintenance |
| admintony/svnExploit SvnExploit is a Python CLI tool that exploits SVN source code disclosure vulnerabilities, supporting both SVN <1.7 and >1.7 repository form… | 32 | 1029 | maintenance |
| mzjdy/MobaXterm-Keygen A Python script that generates a license file (Custom.mxtpro) to unlock the Professional edition of MobaXterm, based on the original work b… | 32 | 1027 | maintenance |
| raineorshine/solgraph A Node.js CLI tool that parses Solidity smart contracts and generates DOT graphs visualizing function control flow, highlighting potential … | 23 | 1026 | maintenance |
| asvd/jailed Jailed is a small dependency-free JavaScript library for executing untrusted code in a sandbox with custom permissions. It runs code as a r… | 23 | 1026 | maintenance |
| d35ha/CallObfuscator CallObfuscator is a C++ library and CLI tool that hides Windows PE imports by rewriting the Import Address Table so sensitive APIs appear a… | 23 | 1025 | maintenance |
| F8LEFT/SoFixer SoFixer is a command-line tool that repairs ELF shared object (.so) files dumped from process memory, fixing section headers, program heade… | 10 | 1025 | maintenance |
| Malfrats/xeuledoc A Python CLI tool that fetches information about public Google documents across Drive, Docs, Sheets, Slides, and other Google Workspace ser… | 32 | 1024 | maintenance |
| blasty/CVE-2021-3156 A proof-of-concept exploit for CVE-2021-3156 (Baron Samedit), a heap-based buffer overflow in sudo. It is a C command-line tool that escala… | 32 | 1022 | maintenance |
| Ridter/noPac A Python CLI exploit tool that chains CVE-2021-42278 and CVE-2021-42287 to escalate from a standard Active Directory domain user to Domain … | 32 | 1022 | maintenance |
| b4rtik/SharpKatz SharpKatz is a C# port of mimikatz's credential extraction commands, including sekurlsa::logonpasswords, sekurlsa::ekeys, and lsadump::dcsy… | 32 | 1021 | maintenance |
| fO-000/bluing Bluing is a Python-based Bluetooth intelligence gathering tool (successor to bluescan) for scanning and probing Bluetooth Classic (BR/EDR) … | 23 | 1020 | maintenance |
| ryhanson/phishery Phishery is an SSL-enabled HTTP server written in Go that harvests credentials via Basic Authentication prompts, plus a tool to inject phis… | 23 | 1020 | maintenance |
| tern-tools/tern Tern is a Python-based software composition analysis tool and library that generates a Software Bill of Materials (SBOM) for container imag… | 23 | 1020 | maintenance |
| mdsecactivebreach/CACTUSTORCH CACTUSTORCH is a payload generation tool that produces JavaScript, VBScript, and VBA shellcode launchers for adversary simulations. It spaw… | 32 | 1018 | maintenance |
| b3-v3r/Hunner Hunner is a Python-based hacking framework for penetration testing that combines vulnerability scanning (SQL injection, XSS), denial-of-sit… | 32 | 1018 | maintenance |
| ReversecLabs/awspx awspx is a graph-based security tool that visualizes effective access and resource relationships in AWS environments. It resolves IAM polic… | 23 | 1018 | maintenance |
| maaaaz/impacket-examples-windows A repository of pre-compiled Windows binaries of the Impacket example scripts, a collection of network protocol tools for security testing.… | 23 | 1018 | maintenance |
| quentinhardy/msdat MSDAT is an open-source Python penetration testing tool for remotely testing the security of Microsoft SQL Server databases. It supports cr… | 32 | 1017 | maintenance |
| hackerxphantom/HACK-CAMERA A Bash-based penetration-testing tool that hosts a phishing page which requests camera access and captures webcam shots from targets who op… | 23 | 1017 | maintenance |
| bit4woo/teemo Teemo is a Python command-line reconnaissance tool that collects domains, subdomains, and email addresses for a target organization. It agg… | 32 | 1016 | maintenance |
| secretsquirrel/BDFProxy BDFProxy is a man-in-the-middle proxy that patches downloaded binaries on the fly by embedding payloads, combining the Backdoor Factory wit… | 32 | 1016 | maintenance |
| sytelus/CryptoJS CryptoJS is a JavaScript collection of standard cryptographic algorithms such as MD5, SHA-3, and AES, with a consistent and simple interfac… | 32 | 1016 | maintenance |
| rwfpl/rewolf-wow64ext A C++ helper library enabling 32-bit (x86) applications running under the WOW64 layer on 64-bit Windows to interact with native x64 process… | 23 | 1015 | maintenance |
| WithSecureLabs/python-exe-unpacker A Python CLI script that unpacks and decompiles Windows EXEs compiled from Python code, supporting executables built with py2exe and PyInst… | 32 | 1014 | maintenance |
| c0ny1/java-memshell-scanner A JSP-based scanner that detects and helps remove Java web memory shells (memshells) such as Filter, Servlet, and Listener types in middlew… | 32 | 1014 | maintenance |
| ajayrandhawa/Keylogger A Windows keylogger written in Visual C++ that invisibly captures keystrokes, mouse clicks, and periodic screenshots, uploading them to an … | 49 | 1012 | maintenance |
| everestpipkin/image-scrubber A browser-based tool for anonymizing photographs taken at protests by stripping Exif metadata and letting users paint over or blur faces an… | 32 | 1012 | maintenance |
| zhovner/OneFileLinux A minimal live Linux distribution packed into a single ~20MB EFI executable that boots directly from any UEFI computer's firmware without i… | 23 | 1012 | maintenance |
| felix-pb/kfd kfd is a C library that provides kernel memory read/write on Apple devices by exploiting physical use-after-free (PUAF) vulnerabilities to … | 28 | 1011 | maintenance |
| thirtythreeforty/neolink Neolink is a Rust application that acts as an RTSP bridge for Reolink IP cameras that only speak the proprietary Baichuan protocol on port … | 23 | 1011 | maintenance |
| facebookexperimental/MIRAI MIRAI is an abstract interpreter for Rust's mid-level intermediate representation (MIR) that performs static analysis to detect potential b… | 10 | 1011 | maintenance |
| atc-project/atomic-threat-coverage Atomic Threat Coverage is a Python framework that automatically generates actionable security analytics from Detection, Response, Mitigatio… | 32 | 1010 | maintenance |
| ryancdotorg/brainflayer Brainflayer is a proof-of-concept command-line cracker for cryptocurrency brainwallets and other low-entropy key derivation schemes, using … | 32 | 1010 | maintenance |
| s7ckTeam/Glass Glass is a Python CLI tool for rapid fingerprint identification of asset lists, querying Fofa, ZoomEye, Shodan, and 360 Quake APIs to gathe… | 32 | 1010 | maintenance |
| TideSec/FuzzScanner FuzzScanner is a Ruby/Python-based reconnaissance toolset that batch-collects information about target websites, including subdomains, open… | 32 | 1008 | maintenance |
| feihong-cs/Java-Rce-Echo A collection of Java test code for achieving command output echo after remote code execution (RCE) across common application servers and pl… | 32 | 1008 | maintenance |
| Snorby/snorby Snorby is a Ruby on Rails web application for network security monitoring that interfaces with intrusion detection systems such as Snort, S… | 23 | 1007 | maintenance |
| gbraad-apps/gauth GAuth is a browser-based multi-factor authentication app that implements the TOTP (RFC6238) algorithm to generate one-time passwords, built… | 23 | 1007 | maintenance |
| stormshadow07/HackTheWorld A Python CLI script that generates Windows payloads designed to evade antivirus detection, integrating with Metasploit and mingw-w64 for co… | 32 | 1006 | maintenance |
| maaaaz/thc-hydra-windows A Windows-compiled distribution of THC-HYDRA, the popular network login brute-forcing tool, bundled with Cygwin DLLs and optional SSH, MySQ… | 23 | 1004 | maintenance |
| TheKingOfDuck/ApkAnalyser A Python-based command-line tool that extracts potentially sensitive information from Android APK files, including URLs, IPs, hashes, acces… | 23 | 1004 | maintenance |
| ddz/whatsapp-media-decrypt A Go command-line tool that decrypts WhatsApp encrypted media files (.enc) using the media key extracted from WhatsApp's local databases on… | 32 | 1003 | maintenance |
| Mattiwatti/PPLKiller PPLKiller is a Windows kernel-mode driver that removes Protected Process Light (PPL) protection from all running processes on Windows 8.1 a… | 32 | 1000 | maintenance |
| Cyb3rWard0g/HELK The Hunting ELK (HELK) is an open-source threat hunting platform built on the ELK stack (Elasticsearch, Logstash, Kibana) with advanced ana… | 23 | 3931 | experimental |
| snyk/agent-scan Snyk Agent Scan is a Python-based CLI security scanner that discovers installed AI agent components (agent harnesses, MCP servers, and agen… | 83 | 3003 | experimental |
| arcboxlabs/arcbox ArcBox is an open-source container and VM runtime for macOS written from scratch in Rust, providing a drop-in Docker engine, native Kuberne… | 78 | 2892 | experimental |
| microsoft/litebox LiteBox is a security-focused library OS written in Rust that drastically reduces the interface exposed to the host, minimizing attack surf… | 66 | 2686 | experimental |
| Armur-Ai/Pentest-Swarm-AI An open-source autonomous penetration testing application that orchestrates a swarm of AI agents (recon, classification, exploitation, repo… | 75 | 2449 | experimental |
| zerobootdev/zeroboot Zeroboot is an open-source sandboxing service that spawns sub-millisecond KVM virtual machines for AI agent code execution by forking Firec… | 47 | 2441 | experimental |
| nebulet/nebulet Nebulet is a proof-of-concept microkernel written in Rust that executes WebAssembly modules in Ring 0 within a single address space. It use… | 10 | 2356 | experimental |
| memorysafety/river River is a reverse proxy application written in Rust, built on Cloudflare's Pingora library and developed under ISRG's Prossimo initiative … | 16 | 2351 | experimental |
| s0md3v/Striker Striker is a Python-based offensive reconnaissance and vulnerability scanning suite that discovers subdomains, scans common ports, detects … | 23 | 2341 | experimental |
| cryfs/cryfs CryFS is a cryptographic filesystem that encrypts files locally so they can be safely stored in cloud services like Dropbox, iCloud, or One… | 85 | 2304 | experimental |
| accrescent/accrescent Accrescent is a security- and privacy-focused Android app store client built in Kotlin with Jetpack Compose. It enforces signed repository … | 84 | 2230 | experimental |
| can1357/NoVmp NoVmp is a static devirtualizer that translates VMProtect x64 3.x-virtualized binaries into optimized VTIL intermediate code, optionally re… | 23 | 2190 | experimental |
| Jigsaw-Code/Intra Intra is an experimental Android app from Jigsaw (Google) that routes DNS lookups over DNS-over-HTTPS to encrypt them and prevent network-l… | 75 | 2187 | experimental |
| vgough/encfs EncFS is a userspace encrypted virtual filesystem built on FUSE, originally released in 2003 and recently rewritten in Rust. It transparent… | 83 | 2161 | experimental |
| kyren/piccolo Piccolo is an experimental stackless Lua interpreter implemented in pure Rust, designed to safely run and sandbox untrusted Lua scripts. It… | 36 | 2149 | experimental |
| earendil-works/gondolin Gondolin is a TypeScript library and CLI that runs untrusted AI-agent code inside fast local Linux micro-VMs (QEMU by default, optional lib… | 73 | 2097 | experimental |
| saljam/webwormhole WebWormhole is a tool that creates ephemeral, peer-authenticated WebRTC pipes between computers for sending files or data, secured with a P… | 58 | 2084 | experimental |
| xoreaxeaxeax/skitter-creek-bath-salts A security research tool written in C that reprograms AMD Family 16h DRAM controller address translation registers to scramble physical mem… | 56 | 1982 | experimental |
| ShieldMnt/invisible-watermark A Python library and command line tool for embedding and decoding invisible (blind) image watermarks that do not require the original image… | 23 | 1974 | experimental |
| google/rune Rune is an experimental, Python-inspired systems programming language from Google that compiles to C and emphasizes memory safety and const… | 73 | 1929 | experimental |
| JSREI/ast-hook-for-js-RE A browser memory roaming tool for JavaScript reverse engineering that hooks variable assignments via AST-transformed proxy responses. It le… | 23 | 1912 | experimental |
| m4ll0k/BBTz A collection of bug bounty tools and example scripts written in Python by security researcher m4ll0k. It serves as a set of ideas and refer… | 32 | 1911 | experimental |
| nmikhailov/Validity90 A reverse-engineering project for Validity/Synaptics fingerprint readers (USB IDs 138a:0090, 138a:0094, 138a:0097, 06cb:0081, 06cb:009a), p… | 32 | 1876 | experimental |
| scottlamb/moonfire-nvr Moonfire NVR is an open-source security camera network video recorder written in Rust. It records H.264-over-RTSP streams from IP cameras t… | 98 | 1743 | experimental |
| PedroHBessa/backscan A Node.js web application that serves a fake 'Comprovante' (payment receipt) page and exfiltrates the visitor's geolocation to an attacker-… | 27 | 1690 | experimental |
| MSNightmare/RoguePlanet RoguePlanet is a proof-of-concept exploit for a Windows Defender vulnerability written in C++. It uses a race condition (triggered via ISO … | 52 | 1638 | experimental |
| TarlogicSecurity/BlueSpy BlueSpy is a Python proof-of-concept tool that records and replays audio from vulnerable Bluetooth devices by exploiting pairing without us… | 60 | 1614 | experimental |
| vtil-project/VTIL-Core VTIL-Core is the core library of the Virtual-machine Translation Intermediate Language project, an optimizing compiler infrastructure built… | 75 | 1583 | experimental |
| punkpeye/mcp-remote A Node.js CLI proxy that lets MCP clients which only support local stdio servers connect to remote MCP servers over HTTP/SSE, including OAu… | 87 | 1575 | experimental |
| google/keytransparency A Google open-source key transparency service that provides a lookup service for public keys backed by a publicly auditable, tamper-proof l… | 10 | 1569 | experimental |
| danielmiessler/Telos Telos is an open-source framework for creating 'Deep Context' about things that matter to humans, providing a structured format (Telos Cont… | 49 | 1536 | experimental |
| protectai/rebuff Rebuff is a self-hardening prompt injection detector that protects LLM-powered applications through multi-layered defenses: heuristics, a d… | 10 | 1521 | experimental |
| JonathanSalwan/VMProtect-devirtualization An experimental research project demonstrating a dynamic approach to devirtualize pure functions protected by VMProtect 3.x using symbolic … | 32 | 1515 | experimental |
| opa334/darksword-kexploit A reimplementation of the DarkSword kernel exploit in Objective-C, targeting iOS 15.0 through 26.0.1. It is a security research artifact ba… | 47 | 1495 | experimental |
| whitequark/unfork unfork(2) is a proof-of-concept Linux technique and library that joins two process address spaces into one, the inverse of fork(2), by comb… | 32 | 1486 | experimental |
| faizann24/wifi-bruteforcer-fsecurify An Android application that attempts to brute force WiFi passwords without requiring a rooted device. It is written in Java and distributed… | 32 | 1484 | experimental |
| achuna33/MYExploit MYExploit is a Java-based one-click scanning and exploitation tool targeting OA (office automation) enterprise products, built as an extens… | 23 | 1484 | experimental |
| cyphar/paperback paperback is a Rust CLI tool that creates encrypted paper backups suitable for long-term storage. It encrypts data and splits the secret ke… | 54 | 1480 | experimental |
| alephsecurity/xnu-qemu-arm64 A fork of QEMU that emulates an iPhone (iPhone 6s Plus) well enough to boot a fully functional iOS 12.1 system, including launchd, bash, SS… | 32 | 1460 | experimental |
| ostafen/digler Digler is a forensic disk analysis and file recovery tool written in Go, offering both a CLI and a desktop application. It scans disk image… | 68 | 1449 | experimental |
| bulwarkid/virtual-fido Virtual FIDO is a software-emulated FIDO2/U2F USB security key (like a YubiKey) that attaches to the host via a USB/IP server over local TC… | 32 | 1396 | experimental |
| chompie1337/SMBGhost_RCE_PoC A Python proof-of-concept exploit for CVE-2020-0796 (SMBGhost), achieving pre-authentication remote code execution against vulnerable Windo… | 32 | 1395 | experimental |
| darkrenaissance/darkfi DarkFi is an anonymous Layer 1 blockchain built in Rust that uses zero-knowledge cryptography (zk-SNARKs, halo2, a zkVM) to enable fully pr… | 76 | 1368 | experimental |
| iPower/KasperskyHook A Windows research project that hooks system calls by loading Kaspersky's hypervisor driver (klhk.sys) and a custom kernel driver that subv… | 66 | 1316 | experimental |
| amimo/dcc DCC (Dex-to-C Compiler) is a method-based ahead-of-time compiler that translates Android DEX bytecode into C code compiled via the NDK. It … | 32 | 1312 | experimental |
| microsoft/mxc MXC (Microsoft eXecution Container) is a sandboxed code execution system for safely running untrusted code such as model output, plugins, a… | 69 | 1283 | experimental |
| nethical6/conversation-steganography A Go CLI tool that hides encrypted secret messages inside natural-looking chat text generated by a local LLM (GPT-2), enabling covert commu… | 54 | 1243 | experimental |
| NoDataFound/hackGPT hackGPT is a Python/Jupyter-based chatbot application that leverages OpenAI and ChatGPT APIs for security-oriented tasks like malware analy… | 75 | 1202 | experimental |
| lem0nSec/ShellGhost ShellGhost is a proof-of-concept memory-based evasion technique written in C that keeps shellcode invisible in memory from process start to… | 29 | 1200 | experimental |
| blackhillsinfosec/WifiForge WifiForge is a Python-based training framework from Black Hills InfoSec that simulates Wi-Fi networks using mininet-wifi so pentesters can … | 70 | 1190 | experimental |
| hanselime/paqet paqet is a raw-packet proxy written in Go that tunnels traffic inside hand-crafted TCP packets, bypassing the host's TCP/IP stack using pca… | 82 | 1185 | experimental |
| robert/PySkyWiFi PySkyWiFi is a humorous Python proof-of-concept that tunnels internet requests through the free-to-edit 'name' field of an airline airmiles… | 24 | 1185 | experimental |