Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| DevSec Hardening Framework An Ansible collection of battle-tested hardening roles for Linux operating systems, SSH, nginx, and MySQL/MariaDB. It automates secure conf… | 95 | 5499 | active |
| 3proxy/3proxy 3proxy is a tiny, free proxy server written in C supporting SOCKS, HTTP, HTTPS, FTP, and TLS proxying with traffic shaping, port mapping, a… | 96 | 5498 | stable |
| USArmyResearchLab/Dshell Dshell is an extensible network forensic analysis framework written in Python for dissecting network packet captures (pcap/pcapng). It supp… | 23 | 5496 | active |
| binpash/try try is a command-line tool that lets you run a command and inspect its effects before committing changes to your live system. It uses Linux… | 84 | 5495 | active |
| kanidm/kanidm Kanidm is a simple, secure, and fast identity management platform written in Rust that acts as a complete identity provider for other appli… | 98 | 5481 | active |
| PortaPack Mayhem Mayhem is open-source firmware for the HackRF One combined with the PortaPack H1/H2/H4/H4M add-on, turning the SDR into a standalone touchs… | 80 | 5475 | active |
| scribejava/scribejava ScribeJava is a simple, threadsafe OAuth client library for Java supporting OAuth 1.0a and OAuth 2.0 flows. It ships prebuilt API integrati… | 57 | 5453 | stable |
| hickory-dns/hickory-dns Hickory DNS (formerly Trust-DNS) is a Rust-based DNS client, server, and resolver library suite built for safety and security. It supports … | 98 | 5445 | active |
| Authlib Authlib is a Python library for building OAuth 1.0/2.0 and OpenID Connect clients, authorization servers, and protected resource servers, w… | 97 | 5430 | stable |
| Speykious/cve-rs cve-rs is a joke/educational Rust crate that reproduces classic memory vulnerabilities (use-after-free, buffer overflow, segfault) using on… | 33 | 5428 | active |
| drk1wi/Modlishka Modlishka is an open-source penetration testing tool written in Go that acts as a transparent man-in-the-middle reverse proxy. It can proxy… | 63 | 5427 | active |
| kaifcodec/user-scanner A 2-in-1 Python CLI OSINT suite that performs email and username intelligence across 440+ scan vectors (170+ email sites, 270+ username pla… | 83 | 5425 | active |
| cjdelisle/cjdns Cjdns is an encrypted IPv6 networking implementation that uses public-key cryptography for address allocation and a distributed hash table … | 75 | 5416 | active |
| ory/keto Ory Keto is an open-source authorization server implementing Google's Zanzibar model for scalable, low-latency permission checks. It suppor… | 74 | 5402 | active |
| P-H-C/phc-winner-argon2 The reference C implementation of Argon2, the winner of the Password Hashing Competition, providing memory-hard password hashing with Argon… | 23 | 5375 | stable |
| microsoft/azurelinux Azure Linux is an open-source, general-purpose Linux distribution built and optimized for Microsoft Azure, with sources derived from Fedora… | 99 | 5355 | active |
| RhinoSecurityLabs/pacu Pacu is an open-source AWS exploitation framework for offensive security testing of Amazon Web Services environments. It provides a modular… | 67 | 5345 | active |
| Ladon Ladon is a large-scale internal network penetration scanner written in C#, offering port scanning, service identification, network asset di… | 25 | 5333 | active |
| FunnyWolf/Viper VIPER is a self-hosted red teaming and adversary simulation platform with a web UI, 100+ post-exploitation modules covering MITRE ATT&CK, a… | 79 | 5327 | active |
| hahwul/dalfox Dalfox is an open-source XSS vulnerability scanner written in Rust that automates discovery, injection, and DOM/AST-level verification of r… | 99 | 5326 | active |
| ThreatMapper Deepfence ThreatMapper is an open-source Cloud Native Application Protection Platform (CNAPP) that hunts threats in production cloud, Kuber… | 78 | 5324 | active |
| CreditTone/hooker hooker is a Frida-based reverse engineering toolkit for Android that provides a comfortable command-line interface with universal hooking s… | 75 | 5322 | active |
| leizongmin/js-xss A JavaScript library for sanitizing untrusted HTML to prevent XSS attacks using a configurable whitelist of allowed tags and attributes. It… | 65 | 5308 | stable |
| Awarexone/Agentic-Bug-Hunter An AI-powered bug bounty hunting toolkit that automates reconnaissance, vulnerability testing, finding validation, and report generation fo… | 75 | 5294 | active |
| mentebinaria/retoolkit An Inno Setup-based installer that bundles a curated collection of reverse engineering and malware analysis tools for x86/x64 Windows syste… | 78 | 5289 | active |
| Naituw/IPAPatch IPAPatch is an Xcode project template that lets you patch decrypted iOS app IPA files by injecting your own dynamic libraries, without requ… | 50 | 5285 | active |
| OpenIddict OpenIddict is a flexible OAuth 2.0/OpenID Connect framework for .NET, providing server, client, and token validation stacks. It supports st… | 96 | 5257 | stable |
| martin-ger/esp_wifi_repeater Firmware for the ESP8266/ESP8285 that turns the chip into a full WiFi NAT router and, in a separate edition, a true L2-bridge WiFi repeater… | 67 | 5257 | active |
| zhkl0228/unidbg A Java-based framework that emulates Android (and experimentally iOS) native libraries on non-ARM hosts, including JNI, syscalls, and ARM32… | 76 | 5244 | active |
| Ullaakut/cameradar Cameradar is a Go-based command-line tool that scans targets for open RTSP video surveillance endpoints and uses dictionary attacks to disc… | 94 | 5234 | active |
| Pyarmor Pyarmor is a command-line tool for obfuscating Python scripts, making them hard to reverse-engineer. It also supports binding obfuscated sc… | 96 | 5209 | active |
| GhostPack/Rubeus Rubeus is a C# command-line toolset for raw Kerberos interaction and abuse on Windows, adapted from Kekeo and MakeMeEnterpriseAdmin. It sup… | 57 | 5195 | active |
| gommzystudio/device-activity-tracker A proof-of-concept application that tracks device activity of phone numbers on WhatsApp and Signal by measuring round-trip times of silent … | 40 | 5166 | active |
| SpaceTimee/Sheas-Cealer Sheas Cealer is a WPF (.NET 8) Windows desktop tool that forges the SNI extension field in Chromium's launch parameters, allowing users to … | 64 | 5159 | active |
| ngoduykhanh/wireguard-ui A self-hosted web user interface for managing WireGuard VPN setups, written in Go. It provides authentication, client management with extra… | 23 | 5151 | active |
| techchipnet/CamPhish CamPhish is a bash-based penetration-testing tool that hosts a fake webpage on a built-in PHP server and exposes it via ngrok or CloudFlare… | 37 | 5147 | active |
| hakluke/hakrawler Hakrawler is a fast command-line web crawler written in Go, built on the Gocolly library, that discovers URLs and JavaScript file locations… | 62 | 5146 | active |
| angryip/ipscan Angry IP Scanner is a fast, open-source IP address and port scanner with a friendly GUI built on Eclipse SWT. It scans networks for hosts, … | 83 | 5140 | active |
| jinwyp/one_click_script A collection of one-click shell scripts for Linux servers that install latest or LTS Linux kernels and enable BBR or BBR Plus congestion co… | 67 | 5136 | active |
| domcyrus/rustnet RustNet is a cross-platform terminal-based network monitoring tool that maps live TCP, UDP, and QUIC connections to their owning processes … | 86 | 5131 | active |
| lc/gau gau (getallurls) is a Go CLI tool that fetches known URLs for a given domain from AlienVault's Open Threat Exchange, the Wayback Machine, C… | 67 | 5127 | active |
| yrutschle/sslh sslh is a protocol multiplexer daemon written in C that accepts connections on a single port and forwards them to different backend service… | 76 | 5120 | stable |
| niklashigi/apk-mitm A Node.js CLI application that automatically patches Android APK files to allow HTTPS traffic inspection through a man-in-the-middle proxy.… | 23 | 5112 | stable |
| Grin Grin is a minimal, open-source implementation of the Mimblewimble blockchain protocol, providing a privacy-preserving digital currency with… | 90 | 5098 | active |
| GRR Rapid Response GRR Rapid Response is an incident response framework focused on remote live forensics. It consists of a Python agent installed on target sy… | 74 | 5090 | active |
| atom0s/Steamless Steamless is a C# tool that removes the SteamStub DRM protection layer applied to Steam game executables via the Steamworks SDK DRM tool. I… | 23 | 5071 | active |
| cilium/tetragon Tetragon is an eBPF-based security observability and runtime enforcement tool from the Cilium project. It monitors process execution, sysca… | 88 | 5067 | active |
| ossec/ossec-hids OSSEC is an open-source host-based intrusion detection system (HIDS) that combines log analysis, file integrity monitoring, rootkit detecti… | 94 | 5062 | stable |
| ClearURLs ClearURLs is a browser extension built on WebExtensions technology that automatically removes tracking parameters (like utm_source) from UR… | 34 | 5062 | active |
| Pomerium Pomerium is an open-source, identity- and context-aware reverse proxy that provides clientless, zero-trust access to internal applications … | 99 | 5056 | active |
| certd/certd Certd is a free, open-source, fully automated SSL certificate management system that applies for, renews, and deploys certificates via conf… | 94 | 5054 | active |
| torproject/tor Tor is the core implementation of the Tor anonymity network, routing internet traffic through onion circuits to hide a user's IP address an… | 32 | 5052 | active |
| DedSecInside/TorBot TorBot is a Python CLI tool for OSINT on the dark web, crawling .onion sites over the Tor network and building link trees. It can save craw… | 95 | 5045 | active |
| elementalsouls/Claude-BugHunter A Claude Code skill bundle that turns Claude into a bug-hunting and red-team assistant, with 83 skills, 15 slash commands, and 681 disclose… | 75 | 5041 | active |
| perplexityai/bumblebee Bumblebee is a read-only Go CLI that scans developer endpoints for on-disk package, extension, and developer-tool metadata (lockfiles, pack… | 74 | 5038 | active |
| pritunl/pritunl Pritunl is a distributed enterprise VPN server built on the OpenVPN protocol (with WireGuard support), managed through a web interface and … | 93 | 5026 | active |
| DefectDojo DefectDojo is an open-source vulnerability management, DevSecOps, and ASPM platform built on Django. It aggregates findings from hundreds o… | 96 | 5018 | active |
| V4bel/dirtyfrag Dirty Frag is a proof-of-concept Linux kernel local privilege escalation exploit written in C. It chains the xfrm-ESP (CVE-2026-43284) and … | 47 | 5018 | active |
| kokke/tiny-AES-c A small, portable implementation of AES encryption (128/192/256-bit) in C99, supporting ECB, CBC, and CTR modes. It is designed for minimal… | 23 | 5017 | stable |
| Ligolo-ng Ligolo-ng is a tunneling and pivoting tool written in Go that establishes tunnels over reverse TCP/TLS connections using a TUN interface in… | 92 | 5008 | active |
| bitsadmin/wesng WES-NG is a Python command-line tool that parses Windows `systeminfo` output (or missing KB listings) and cross-references it against a reg… | 76 | 4951 | active |
| NLnetLabs/unbound Unbound is a validating, recursive, and caching DNS resolver written in C, designed to be fast and lean while implementing modern open stan… | 92 | 4932 | stable |
| Nyr/wireguard-install A Bash installer script that sets up a WireGuard VPN server on Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS, and Fedora in about a minute… | 75 | 4928 | active |
| aloshdenny/reverse-SynthID A research tool that reverse-engineers Google's SynthID watermark embedded in Gemini-generated images using spectral analysis and signal pr… | 64 | 4913 | active |
| Security Onion Security Onion is a free and open Linux distribution and platform for threat hunting, enterprise security monitoring, and log management. I… | 92 | 4906 | stable |
| PCAPdroid PCAPdroid is a privacy-friendly open source Android app that monitors, analyzes, and blocks network connections made by other apps without … | 97 | 4904 | active |
| SocialFish SocialFish is a Python-based phishing toolkit that clones modern login pages using Playwright browser automation and captures credentials, … | 70 | 4892 | active |
| Greenbone Community Edition OpenVAS Scanner is the scan engine of the Greenbone Community Edition, executing a continuously updated feed of vulnerability tests against… | 95 | 4868 | active |
| jmpews/Dobby Dobby is a lightweight, modular function hooking framework supporting multiple platforms (Windows, macOS, iOS, Android, Linux) and architec… | 23 | 4857 | active |
| duckduckgo/Android The official DuckDuckGo Android app, a privacy-focused mobile browser and search client written in Kotlin. It blocks trackers, enforces enc… | 95 | 4855 | active |
| charles2gan/GDA-android-reversing-Tool GDA (GJoy Dex Analyzer) is a fast, native C++ Dalvik bytecode decompiler and reverse analysis platform for Android binaries such as APK, DE… | 64 | 4852 | active |
| google/wuffs Wuffs is a memory-safe programming language plus a standard library for safely parsing, decoding and encoding untrusted file formats such a… | 76 | 4851 | active |
| Aya Aya is a Rust library for building and loading eBPF programs on Linux, implemented entirely in Rust without libbpf or BCC. It provides BTF-… | 93 | 4846 | active |
| its-a-feature/Mythic Mythic is a collaborative, multi-platform post-exploitation red teaming framework built with Go, Docker, and a web browser UI. It provides … | 76 | 4837 | active |
| immunant/c2rust C2Rust is a transpiler that converts C99-compliant C code into semantically equivalent but unsafe, unidiomatic Rust code, preserving functi… | 79 | 4821 | active |
| rivet-dev/agentos agentOS is a library that gives AI agents a lightweight operating system running inside your existing backend process, using WebAssembly an… | 94 | 4809 | active |
| OpenWiFi Open-source full-stack IEEE 802.11/Wi-Fi design based on Software Defined Radio, including a Linux mac80211-compatible driver and software,… | 66 | 4809 | active |
| mitchellkrogza/nginx-ultimate-bad-bot-blocker A drop-in Nginx configuration package that blocks bad bots, spam referrers, vulnerability scanners, malware, adware, and fake Googlebots, w… | 75 | 4792 | active |
| HotCakeX/Harden-Windows-Security A suite of tools (Harden System Security app and AppControl Manager) that hardens Windows using only official, supported Microsoft methods,… | 95 | 4791 | active |
| microsoft/msquic MsQuic is Microsoft's cross-platform C implementation of the IETF QUIC transport protocol (RFC 9000), with API wrappers for C++, C#, and Ru… | 98 | 4781 | stable |
| aws/s2n-tls s2n-tls is a C99 implementation of the TLS/SSL protocols designed to be simple, small, fast, and security-focused, maintained by AWS. It pr… | 98 | 4769 | stable |
| diafygi/acme-tiny A tiny, auditable Python script (under 200 lines) that issues and renews TLS certificates from Let's Encrypt using the ACME protocol. It re… | 64 | 4767 | stable |
| cdk-team/CDK CDK is a zero-dependency container penetration toolkit written in Go for security testing of Kubernetes, Docker, and Containerd environment… | 64 | 4767 | active |
| IntelOwl IntelOwl is an open-source, self-hosted application for managing threat intelligence at scale, querying many online analyzers and malware a… | 93 | 4759 | active |
| MlgmXyysd/Xiaomi-HyperOS-BootLoader-Bypass A proof-of-concept PHP tool that exploits a vulnerability to bypass Xiaomi HyperOS community account restrictions on BootLoader unlock bind… | 37 | 4759 | active |
| openziti/zrok zrok is an open-source tool for securely sharing local web services, files, and TCP/UDP resources over the internet without firewall or NAT… | 98 | 4751 | active |
| Hyperlight Hyperlight is a lightweight Virtual Machine Manager (VMM) library, written in Rust, that embeds micro virtual machines into applications fo… | 90 | 4740 | active |
| GhostPack/Seatbelt Seatbelt is a C# command-line tool that performs security-oriented host-survey 'safety checks' on Windows systems. It enumerates system and… | 32 | 4738 | active |
| AntSword AntSword is a cross-platform, open-source website administration toolkit built with Electron, designed for penetration testers, security re… | 67 | 4725 | active |
| motioneye-project/motioneye motionEye is a web-based frontend for the motion video surveillance daemon, providing a browser interface for configuring and viewing camer… | 82 | 4716 | active |
| TheWover/donut Donut is a shellcode generator that converts VBScript, JScript, EXE, DLL files, and .NET assemblies into x86, x64, or AMD64+x86 position-in… | 33 | 4716 | stable |
| M66B/FairEmail FairEmail is a fully featured, open source, privacy oriented email client for Android. It supports unlimited accounts via standard protocol… | 95 | 4714 | active |
| Authenticator A browser extension that generates two-factor authentication (2FA) codes, acting as a software TOTP authenticator. It is available for Chro… | 66 | 4705 | active |
| dmno-dev/varlock Varlock is a CLI tool and library for managing environment variables and secrets via a typed .env.schema file, serving as a drop-in dotenv … | 83 | 4696 | active |
| OPNsense OPNsense is an open-source, FreeBSD-based firewall and routing platform with a web GUI, REST API, and extensible plugin system. It provides… | 75 | 4696 | active |
| SteveLTN/https-portal HTTPS-PORTAL is a Dockerized reverse proxy that automatically obtains and renews Let's Encrypt TLS certificates and serves any web applicat… | 82 | 4694 | active |
| vaibhavpandeyvpz/apkstudio APK Studio is an open-source, cross-platform Qt6 IDE for reverse-engineering Android application packages. It bundles decompiling, recompil… | 63 | 4665 | active |
| microsoft/PyRIT PyRIT is Microsoft's open-source Python framework for identifying security and safety risks in generative AI systems. It provides automatio… | 88 | 4664 | active |
| Heeexy/SpringBoot-Shiro-Vue A full-stack reference project demonstrating fine-grained RBAC permission management using Spring Boot on the backend and Vue with ElementU… | 65 | 4654 | active |
| detect-secrets detect-secrets is a Python CLI tool from Yelp that detects secrets (API keys, passwords, tokens) in codebases using regex and entropy heuri… | 53 | 4649 | active |