domain: security
4787 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| corazawaf/coraza OWASP Coraza is an open-source, enterprise-grade Web Application Firewall (WAF) library written in Go, compatible with ModSecurity SecLang … | 92 | 3761 | stable |
| VirtualXposed VirtualXposed is an Android app that runs apps and Xposed modules inside a virtual environment, enabling Xposed module functionality withou… | 23 | 16053 | maintenance |
| edoardottt/cariddi Cariddi is a fast command-line web crawler written in Go that takes a list of domains, crawls URLs, and scans for endpoints, secrets, API k… | 84 | 3753 | active |
| dropbox/zxcvbn zxcvbn is a JavaScript password strength estimator inspired by password crackers, using pattern matching and conservative estimation agains… | 23 | 16037 | maintenance |
| ip-scanner/cloudflare A tool for scanning and discovering Cloudflare IP ranges and hosts, distributed via the ip-scanner organization with an associated Telegram… | 44 | 3742 | active |
| thoughtbot/clearance Clearance is a Rails engine providing email and password authentication for Ruby on Rails applications. It offers opinionated defaults for … | 85 | 3736 | active |
| sismo-core/sismo-badges Sismo Badges is the set of Solidity smart contracts powering the Sismo Badge Minting Protocol on Ethereum. It provides an attestations regi… | 23 | 15880 | maintenance |
| zhom/donutbrowser Donut Browser is an open-source anti-detect desktop browser for macOS, Windows, and Linux that creates unlimited isolated browser profiles,… | 81 | 3720 | active |
| linuxserver/docker-swag SWAG is a Docker image from LinuxServer.io bundling an Nginx webserver/reverse proxy with PHP support, a built-in Certbot client for automa… | 95 | 3714 | active |
| microcosm-cc/bluemonday bluemonday is a fast, highly configurable HTML sanitizer library for Go, inspired by the OWASP Java HTML Sanitizer. It takes untrusted user… | 29 | 3714 | stable |
| RhinoSecurityLabs/cloudgoat CloudGoat is Rhino Security Labs' 'Vulnerable by Design' AWS deployment tool that provisions intentionally vulnerable cloud environments fo… | 78 | 3708 | active |
| WGDashboard/WGDashboard WGDashboard is a self-hosted web dashboard for managing WireGuard and AmneziaWG VPN servers, built with Python (Flask) and Vue.js. It auto-… | 92 | 3702 | active |
| HookVip (NewHookVip) NewHookVip is an Xposed module for Android that hooks into target apps to unlock certain membership/VIP features, remove some restrictions,… | 75 | 3696 | active |
| pavel-odintsov/fastnetmon FastNetMon Community Edition is a high-performance DDoS detection sensor that analyzes traffic from NetFlow, IPFIX, sFlow, AF_PACKET, and o… | 81 | 3695 | active |
| S3cur3Th1sSh1t/WinPwn WinPwn is a PowerShell-based automation framework for internal Windows penetration testing and Active Directory security assessment. It bun… | 40 | 3693 | active |
| jwt/ruby-jwt A Ruby gem implementing the RFC 7519 OAuth JSON Web Token (JWT) standard, supporting encoding and decoding of signed tokens with HMAC, RSAS… | 92 | 3687 | stable |
| maxcountryman/flask-login Flask-Login is a Flask extension that provides user session management, handling login, logout, and persistent session tracking. It is stor… | 40 | 3675 | stable |
| gadievron/raptor RAPTOR is an autonomous offensive/defensive security research framework built on top of Claude Code, chaining static analysis, binary analy… | 66 | 3672 | active |
| mollyim/mollyim-android Molly is a hardened, security-focused fork of the Signal messaging app for Android, adding features like passphrase-encrypted databases at … | 97 | 3669 | active |
| blacktop/ipsw ipsw is a Go-based command-line research framework for downloading, parsing, and analyzing Apple iOS and macOS firmware (IPSW/OTA files), M… | 95 | 3669 | active |
| WithSecureLabs/chainsaw Chainsaw is a Rust-based CLI tool for rapidly searching and hunting through Windows forensic artefacts such as Event Logs, MFT, and registr… | 99 | 3648 | active |
| ly4k/Certipy Certipy is a Python CLI toolkit for enumerating and abusing Active Directory Certificate Services (AD CS) misconfigurations. It detects and… | 94 | 3643 | active |
| kubernetes-sigs/agent-sandbox Agent Sandbox is a Kubernetes SIG project providing a Sandbox Custom Resource Definition (CRD) and controller for managing isolated, statef… | 84 | 3640 | active |
| ibnaleem/gosearch GoSearch is a Go-based CLI OSINT tool that searches a username across 300+ websites to find a person's digital footprint, serving as a Sher… | 84 | 3640 | active |
| Guardsquare/proguard ProGuard is a free shrinker, optimizer, obfuscator, and preverifier for Java bytecode. It removes unused code, optimizes bytecode, and rena… | 95 | 3638 | active |
| es3n1n/defendnot defendnot is a C++ Windows utility that disables Windows Defender by registering a fake antivirus product through the Windows Security Cent… | 85 | 3636 | active |
| blechschmidt/massdns MassDNS is a high-performance DNS stub resolver written in C, capable of resolving millions to billions of domain names at over 350,000 loo… | 57 | 3635 | stable |
| str4d/rage rage is a Rust implementation of the age file encryption format, providing a simple, secure CLI tool and library with small explicit keys, … | 97 | 3633 | active |
| go-oauth2/oauth2 A Go library for building OAuth 2.0 authorization servers that issue and manage access tokens. It supports the standard OAuth 2.0 protocol … | 44 | 3622 | stable |
| sooryathejas/METATRON METATRON is a CLI-based AI penetration testing assistant that runs a local LLM (via Ollama) entirely offline on Linux, primarily Parrot OS.… | 48 | 3616 | active |
| e-m-b-a/emba EMBA is an open-source firmware security analyzer for embedded Linux devices, written in Bash. It automates firmware extraction, static and… | 93 | 3614 | active |
| swisskyrepo/SSRFmap SSRFmap is a Python CLI framework that automatically detects and exploits Server-Side Request Forgery vulnerabilities. It takes a Burp Suit… | 76 | 3608 | active |
| lowRISC/opentitan OpenTitan is an open-source silicon Root of Trust (RoT) project providing commercial-grade, security-certified hardware IP blocks written i… | 83 | 3607 | stable |
| Lessica/TrollFools TrollFools is an iOS application for TrollStore that performs in-place tweak injection into installed apps using insert_dylib and ChOma. It… | 74 | 3599 | active |
| ory/oathkeeper Ory Oathkeeper is a cloud native Identity & Access Proxy (IAP) and Access Control Decision API written in Go that authenticates, authorizes… | 80 | 3597 | active |
| arxhr007/Aliens_eye Aliens Eye is an AI-powered OSINT CLI tool that scans 840+ social media and web platforms to find accounts associated with a given username… | 94 | 3587 | active |
| Mouseww/anything-analyzer An Electron-based all-in-one protocol analysis toolkit that captures HTTP(S) traffic from browsers, desktop apps, terminals, scripts, and m… | 77 | 3586 | active |
| animir/node-rate-limiter-flexible A Node.js/Deno library for counting and limiting events with atomic rate limiting across many backends including Redis, Valkey, Memcached, … | 89 | 3581 | stable |
| nmap/npcap Npcap is the Nmap Project's packet capture and injection library for Microsoft Windows, implementing the portable Pcap API via a custom NDI… | 83 | 3580 | active |
| allinssl/allinssl AllinSSL is a self-hosted, open-source SSL certificate lifecycle management platform with a web dashboard. It automates certificate applica… | 75 | 3580 | active |
| JosephSilber/bouncer Bouncer is a PHP library for managing roles and abilities on Eloquent models, with support for ownership checks, forbidden abilities, cachi… | 67 | 3579 | stable |
| zc-zhangchen/any-auto-register A multi-platform automated account registration and management system with a Web UI, plugin-based extensibility, and batch registration sup… | 59 | 3578 | active |
| s0md3v/XSStrike XSStrike is a Python command-line Cross Site Scripting (XSS) detection suite that uses hand-written HTML/JavaScript parsers, context analys… | 31 | 15151 | maintenance |
| google/recaptcha Google's official PHP client library for verifying reCAPTCHA responses server-side, supporting both reCAPTCHA v2 and v3. It wraps the verif… | 84 | 3574 | active |
| devise token auth A Ruby gem providing token-based authentication for Rails JSON APIs, built on Devise and OmniAuth. It supports multi-client sessions, token… | 75 | 3571 | active |
| microsoft/ebpf-for-windows eBPF for Windows is an MIT-licensed implementation of the eBPF runtime that runs on top of the Windows kernel, letting developers reuse fam… | 86 | 3553 | active |
| momo5502/sogen Sogen is a C++ userspace emulator that runs Windows and Linux binaries at the CPU and syscall level without a real operating system, execut… | 67 | 3553 | active |
| react-native-google-signin/google-signin A React Native library providing Google Sign-In (OAuth2) authentication for Android and iOS apps, including Expo support. It wraps the nati… | 96 | 3551 | active |
| abhinavsingh/proxy.py proxy.py is a fast, lightweight, zero-dependency Python library and CLI tool for building HTTP/HTTPS proxy servers and web servers, with pl… | 74 | 3550 | active |
| arch3rPro/Pentest-Windows A pre-built Windows 11 penetration testing virtual machine image bundling 400+ security tools and scripts, distributed for VMware, Parallel… | 47 | 3549 | active |
| bastillion-io/Bastillion Bastillion is a self-hosted, web-based SSH console and SSH key management platform that acts like a bastion host with a dashboard. It provi… | 99 | 3541 | active |
| Adaptix-Framework/AdaptixC2 AdaptixC2 is an extensible post-exploitation and adversarial emulation (C2) framework for authorized penetration testing, with a Golang tea… | 67 | 3541 | active |
| apple-oss-distributions/xnu The XNU kernel source code, the core of Apple's Darwin operating system used in macOS and iOS. It is a hybrid kernel combining the Mach mic… | 72 | 3539 | active |
| SpacehuhnTech/esp8266_deauther ESP8266 Deauther is open-source firmware that turns an ESP8266 microcontroller into a WiFi testing tool capable of scanning networks, sendi… | 23 | 14943 | maintenance |
| Brave Browser Brave is a free, open-source web browser built on Chromium with privacy protections enabled by default, including ad and tracker blocking, … | 77 | 3534 | active |
| epinna/weevely3 Weevely is a weaponized web shell for post-exploitation that generates a small obfuscated PHP agent to upload to a target web server, provi… | 46 | 3533 | active |
| tnodir/fort Fort Firewall is a standalone firewall application for Windows 7+ with its own kernel driver. It provides per-application network rules, ba… | 78 | 3529 | active |
| meshbird/meshbird Meshbird is an open-source cloud-native distributed private networking tool that creates encrypted peer-to-peer overlay networks across mul… | 54 | 3526 | active |
| gtworek/PSBits A collection of relatively simple C and PowerShell snippets for digging deeper into Windows internals, security, and forensics. Each folder… | 76 | 3519 | active |
| ueberauth/guardian Guardian is a token-based authentication library for Elixir applications, with JSON Web Tokens supported out of the box. It integrates with… | 87 | 3514 | stable |
| bethington/ghidra-mcp A Model Context Protocol (MCP) server and Ghidra plugin exposing 250+ tools that let AI agents drive Ghidra's reverse engineering capabilit… | 83 | 3508 | active |
| theajack/disable-devtool A lightweight TypeScript library that disables browser developer tools with one line of code, blocking F12, right-click, and browser menu a… | 61 | 3504 | active |
| wifiphisher/wifiphisher Wifiphisher is a rogue Access Point framework for Wi-Fi security testing and red team engagements, enabling man-in-the-middle positioning v… | 60 | 14788 | maintenance |
| stackrox/kube-linter KubeLinter is a static analysis CLI tool that checks Kubernetes YAML files, Helm charts, and Kustomize manifests against security and produ… | 86 | 3501 | active |
| guardianproject/orbot-android Orbot is a free Android app that routes device internet traffic through the Tor network, acting as a VPN and proxy to encrypt and anonymize… | 97 | 3497 | active |
| sentient-agi/OML-1.0-Fingerprinting A Python library for embedding secret cryptographic fingerprints into LLMs via fine-tuning, so model owners can prove ownership and detect … | 13 | 3497 | active |
| fofapro/vulfocus Vulfocus is a self-hosted vulnerability integration platform that runs vulnerability environments as Docker images with one-click startup. … | 41 | 3492 | active |
| t3l3machus/hoaxshell Hoaxshell is a Windows reverse shell payload generator and handler that abuses the HTTP(S) protocol to establish a beacon-like reverse shel… | 33 | 3487 | active |
| BlackArch Linux BlackArch Linux is an Arch Linux-based penetration testing distribution bundling over 2,800 security tools for penetration testers and secu… | 77 | 3474 | active |
| oblador/react-native-keychain A React Native library providing access to the iOS Keychain and Android Keystore for securely storing credentials such as passwords, tokens… | 70 | 3473 | stable |
| QData/TextAttack TextAttack is a Python framework for generating adversarial examples against NLP models, as well as for data augmentation and model trainin… | 87 | 3469 | active |
| sigp/lighthouse Lighthouse is an open-source Ethereum consensus (beacon chain) client written in Rust, maintained by Sigma Prime. It implements the Ethereu… | 99 | 3466 | stable |
| JusticeRage/Gepetto Gepetto is an IDA Pro plugin that queries large language models (OpenAI, Anthropic, Gemini, Ollama, and others) to explain decompiled funct… | 79 | 3461 | active |
| osqzss/gps-sdr-sim A C-based software-defined GPS signal simulator that generates GPS baseband I/Q sample streams from user-defined trajectories and broadcast… | 10 | 3461 | active |
| owen-it/laravel-auditing A Laravel/Lumen package that keeps a history of Eloquent model changes by adding a trait to models, storing audit records via configurable … | 93 | 3458 | stable |
| ukanth/afwall AFWall+ is an open-source firewall application for rooted Android devices built on Linux iptables. It provides per-app granular control ove… | 93 | 3455 | active |
| joernio/joern Joern is an open-source code analysis platform that generates code property graphs (CPGs) from source code, bytecode, and binaries for C/C+… | 95 | 3453 | active |
| kevoreilly/CAPEv2 CAPEv2 is a malware sandbox derived from Cuckoo that executes malicious files in isolated environments while instrumenting their behavior a… | 77 | 3451 | active |
| shuaiplus/nodewarden NodeWarden is a Bitwarden-compatible password manager server that runs entirely on Cloudflare Workers, using D1 for data and R2/KV for atta… | 79 | 3438 | active |
| roflcoopter/viseron Viseron is a self-hosted, local-only network video recorder (NVR) with built-in AI computer vision capabilities. It supports object detecti… | 98 | 3431 | active |
| TrustTunnel/TrustTunnel TrustTunnel is a modern open-source VPN protocol originally developed by AdGuard VPN, with this repository containing the VPN endpoint (ser… | 76 | 3431 | active |
| ropnop/kerbrute Kerbrute is a Go-based CLI tool for brute-forcing and enumerating valid Active Directory accounts through Kerberos Pre-Authentication. It o… | 23 | 3429 | stable |
| vulnersCom/nmap-vulners A collection of Nmap NSE scripts that enrich service scans with CVEs, CVSS scores and known exploits from the Vulners database. It fingerpr… | 98 | 3415 | active |
| onecli/onecli OneCLI is an open-source platform that gives every employee a personal, sandboxed AI agent, with all tool calls routed through a gateway th… | 77 | 3415 | active |
| laravel/passport Laravel Passport is an OAuth2 server package for Laravel applications, built on the League OAuth2 server. It issues and manages access toke… | 98 | 3413 | active |
| ph4ntonn/Stowaway Stowaway is a multi-hop proxy tool written in Go, designed for penetration testers to route external traffic through chains of nodes into r… | 54 | 3411 | active |
| connectbot/connectbot ConnectBot is an open-source Secure Shell (SSH) client for Android that lets users open encrypted shell sessions and transfer files with re… | 95 | 3410 | active |
| snort3/snort3 Snort 3 (Snort++) is the next-generation open-source intrusion prevention system (IPS) written in C++17, supporting multi-threaded packet p… | 83 | 3409 | active |
| openwrt-xiaomi/xmir-patcher XMiR-Patcher is a Python-based firmware patcher for Xiaomi routers that exploits vulnerabilities to unlock SSH and install custom firmware … | 77 | 3408 | active |
| iann0036/iamlive A Go CLI tool that generates IAM policies by monitoring AWS, Azure, or GCP API calls via client-side monitoring or an embedded proxy. It ob… | 83 | 3407 | active |
| KOWX712/Tricky-Addon-Update-Target-List A KernelSU/Apatch/Magisk WebUI addon for configuring Tricky Store's target.txt on rooted Android devices. It provides a graphical interface… | 86 | 3404 | active |
| google/OpenSK OpenSK is an open-source Rust implementation of a FIDO2/FIDO U2F security key, developed by Google as a research platform. It can run as fi… | 66 | 3404 | active |
| decalage2/oletools oletools is a Python package of tools for analyzing Microsoft OLE2 (Structured Storage/Compound File Binary Format) files and MS Office doc… | 53 | 3404 | active |
| L-codes/Neo-reGeorg Neo-reGeorg is a Python CLI tool that generates encrypted tunnel server files (aspx/jsp/php/etc.) to be uploaded to a compromised web serve… | 75 | 3401 | active |
| paragonie/paseto A PHP reference implementation of PASETO (Platform-Agnostic Security Tokens), a secure alternative to JWT/JWS/JWE. It supports PASETO proto… | 40 | 3398 | stable |
| google/timesketch Timesketch is an open-source web application for collaborative forensic timeline analysis, developed by Google. It lets DFIR investigators … | 92 | 3396 | active |
| auth0/jwt-decode A small TypeScript library that decodes JWT tokens (Base64Url-encoded JSON) in browser and Node environments. It does not validate signatur… | 67 | 3395 | stable |
| adrienverge/openfortivpn openfortivpn is a command-line client for PPP+TLS VPN tunnel services, compatible with Fortinet VPN gateways. It spawns a pppd process and … | 77 | 3394 | active |
| paralleldrive/cuid2 Cuid2 is a JavaScript library and CLI for generating secure, collision-resistant unique identifiers optimized for horizontal scaling and pe… | 75 | 3394 | active |
| EntySec/Ghost Ghost Framework is a Python-based Android post-exploitation framework that leverages the Android Debug Bridge (ADB) to gain remote access t… | 54 | 3392 | active |