Open-source security software
4844 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4844 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| zhom/donutbrowser Donut Browser is an open-source anti-detect desktop browser for macOS, Windows, and Linux that creates unlimited isolated browser profiles,… | 83 | 4088 | active |
| r0oth3x49/ghauri Ghauri is a cross-platform Python CLI tool that automates detection and exploitation of SQL injection vulnerabilities in web applications. … | 48 | 4079 | active |
| theori-io/copy-fail-CVE-2026-31431 A proof-of-concept exploit for CVE-2026-31431, a Linux kernel local privilege escalation bug in the authencesn cryptographic template that … | 47 | 4075 | active |
| 0dayCTF/reverse-shell-generator A web-based reverse shell generator that produces common reverse shell payloads, listeners, MSFVenom commands, and HoaxShell integrations w… | 64 | 4073 | active |
| Boundary HashiCorp Boundary is an identity-aware proxy that provides secure, least-privilege access to hosts and critical systems across clouds and … | 10 | 4067 | active |
| OAuth2 Server A Node.js module for implementing a fully RFC 6749/6750 compliant OAuth2 server/provider, framework-agnostic with official wrappers for Exp… | 23 | 4063 | active |
| Microsoft SEAL Microsoft SEAL is an open-source homomorphic encryption library written in modern C++, with a .NET wrapper, supporting BFV/BGV and CKKS sch… | 100 | 4054 | active |
| Motion-Project/motion Motion is an open-source C++ program that monitors video camera signals and detects changes (motion) in the images. It is commonly used for… | 68 | 4052 | active |
| sobolevn/git-secret git-secret is a bash-based command-line tool that encrypts private files with GPG public keys and stores them safely inside a git repositor… | 66 | 4048 | active |
| openssh/openssh-portable Portable OpenSSH is a complete implementation of the SSH protocol version 2 for secure remote login, command execution, and file transfer. … | 77 | 4043 | stable |
| dekuNukem/daytripper Daytripper is an open-source hardware laser tripwire consisting of a wireless transmitter and a USB receiver that hides windows, locks the … | 46 | 4041 | active |
| snooppr/snoop Snoop is a Python-based OSINT CLI tool that searches for a given username/nickname across ~5400+ websites, with a focus on the CIS region. … | 70 | 4036 | active |
| PerformanC/ReZygisk ReZygisk is an open-source, standalone implementation of Zygisk providing Zygisk API support for KernelSU, APatch, and Magisk on rooted And… | 83 | 4029 | active |
| Rizin Cutter is a free and open-source graphical reverse engineering platform built on top of the Rizin framework, a Unix-friendly command-line t… | 86 | 4019 | active |
| APKLab/APKLab APKLab is a VS Code extension that turns the editor into an Android reverse-engineering workbench by integrating Apktool, Jadx, uber-apk-si… | 70 | 4002 | active |
| schwabe/ics-openvpn An open-source OpenVPN client for Android that uses the Android VPNService API to provide VPN connectivity without root access. It is a sta… | 90 | 3999 | active |
| diego-treitos/linux-smart-enumeration A POSIX-compliant shell script that enumerates a local Linux system's security posture to help escalate privileges during pentesting and CT… | 55 | 3992 | active |
| itm4n/PrivescCheck A PowerShell enumeration script that identifies common Windows privilege escalation vulnerabilities and misconfigurations. It also collects… | 98 | 3987 | active |
| cea-sec/miasm Miasm is a free and open source (GPLv2) reverse engineering framework written in Python for analyzing, modifying, and generating binary pro… | 66 | 3985 | active |
| SpotBugs SpotBugs is a static analysis tool that finds bugs in Java bytecode, serving as the community-maintained successor to the abandoned FindBug… | 99 | 3954 | active |
| abcz316/SKRoot-linuxKernelRoot SKRoot is a kernel-level hidden root solution for Android that patches stock kernel images without source code, granting root privileges wh… | 93 | 3953 | active |
| speed47/spectre-meltdown-checker A self-contained shell script that checks Linux and BSD systems for vulnerability to transient execution CPU vulnerabilities such as Spectr… | 96 | 3951 | active |
| trustedsec/unicorn Magic Unicorn is a Python CLI tool that generates PowerShell downgrade-attack commands to inject shellcode directly into memory. It support… | 75 | 3950 | active |
| leebaird/discover A collection of custom Bash and Python scripts that automate penetration testing tasks including reconnaissance, scanning, enumeration, and… | 77 | 3944 | active |
| a0rtega/pafish Pafish is a Windows testing tool that applies the same VM and sandbox detection techniques used by malware families to check whether an ana… | 10 | 3942 | active |
| M66B/NetGuard NetGuard is a free and open-source no-root firewall application for Android that blocks internet access per app using a local VPN. It allow… | 86 | 3941 | active |
| lanjelot/patator Patator is a multi-purpose, multi-threaded brute-forcing tool written in Python with a modular design supporting dozens of protocols (SSH, … | 39 | 3935 | active |
| oasisfeng/island Island is an Android app that leverages the Android device-owner/profile-owner (DPC) APIs to create isolated 'islands' for cloning or freez… | 38 | 3931 | active |
| hasherezade/pe-sieve PE-sieve is a lightweight Windows tool that scans a given process for malicious implants such as replaced or injected PE files, shellcodes,… | 65 | 3923 | active |
| BrowserBox/BrowserBox BrowserBox is a commercial Remote Browser Isolation (RBI) platform that streams a full modern browser to any client at 60 FPS, keeping web … | 98 | 3920 | active |
| django-guardian/django-guardian django-guardian is a Python library that implements per-object (row-level) permissions on top of Django's built-in authorization backend. I… | 97 | 3920 | stable |
| KuroLabs/stegcloak StegCloak is a pure JavaScript steganography module that hides secrets inside plain text using invisible zero-width unicode characters, enc… | 23 | 3919 | stable |
| Raptor RAPTOR is an autonomous offensive/defensive security research framework built on top of Claude Code, chaining static analysis, binary analy… | 74 | 3916 | active |
| openbsd/src A read-only Git mirror of OpenBSD's official CVS source repository containing the complete operating system source tree, including the kern… | 77 | 3902 | active |
| ambionics/phpggc PHPGGC is a library of PHP unserialize() payloads (gadget chains) with a command-line tool to generate them, covering frameworks like Larav… | 48 | 3895 | active |
| OWASP Coraza WAF OWASP Coraza is an open-source, enterprise-grade Web Application Firewall (WAF) library written in Go, compatible with ModSecurity SecLang … | 99 | 3894 | stable |
| SecureDrop SecureDrop is an open-source whistleblower submission system that lets media organizations and NGOs securely accept documents from and comm… | 94 | 3887 | stable |
| Sysbox Sysbox is an open-source container runtime (a specialized runc) that improves container isolation via Linux user-namespaces and procfs/sysf… | 85 | 3881 | active |
| unikraft/unikraft Unikraft is an open-source Unikernel Development Kit for building custom, specialized operating system kernels tailored to individual appli… | 82 | 3881 | active |
| Pocsuite pocsuite3 is an open-source remote vulnerability testing and proof-of-concept development framework by Knownsec's 404 Team. It provides a P… | 23 | 3876 | active |
| Privacy Badger Privacy Badger is a free browser extension by EFF that automatically learns to block hidden third-party trackers as you browse. It sends Gl… | 93 | 3865 | active |
| trimstray/htrace.sh htrace.sh is a shell-script CLI that combines HTTP/HTTPS request troubleshooting (redirect tracing, headers, body, SSL parameters, custom m… | 32 | 3862 | active |
| HookVip (NewHookVip) NewHookVip is an Xposed module for Android that hooks into target apps to unlock certain membership/VIP features, remove some restrictions,… | 69 | 3855 | active |
| hasherezade/pe-bear PE-bear is a multiplatform GUI reversing tool for Windows PE (Portable Executable) files, built on bearparser and capstone. It gives malwar… | 81 | 3849 | active |
| TracecatHQ/tracecat Tracecat is an open-source, AI-native security automation (SOAR) platform that combines low-code workflows, tool-calling agents, case manag… | 90 | 3844 | active |
| ax/apk.sh A Bash script that automates Android APK reverse engineering tasks such as pulling, decoding, rebuilding, and patching APKs. It wraps apkto… | 66 | 3840 | active |
| thephpleague/oauth2-client A PHP library providing a base client for integrating with OAuth 2.0 service providers per RFC 6749. It includes a GenericProvider for Bear… | 85 | 3819 | stable |
| node-oidc-provider A Node.js library implementing an OpenID Certified OAuth 2.0 Authorization Server with full OpenID Connect support. It is highly configurab… | 95 | 3816 | active |
| Serverless DNS Resolver A serverless, Pi-hole-style DNS-over-HTTPS and DNS-over-TLS resolver with configurable blocklists. It deploys to Cloudflare Workers, Deno D… | 58 | 3815 | active |
| ipsw ipsw is a Go-based command-line research framework for downloading, parsing, and analyzing Apple iOS and macOS firmware (IPSW/OTA files), M… | 95 | 3811 | active |
| dcodeIO/bcrypt.js A zero-dependency, pure JavaScript implementation of the bcrypt password hashing algorithm with TypeScript support. It is API-compatible wi… | 80 | 3797 | stable |
| Orange-Cyberdefense/arsenal Arsenal is a Python-based terminal tool that provides a searchable inventory of hard-to-remember pentest commands, letting users pick one a… | 32 | 3797 | active |
| Findomain/Findomain Findomain is a fast subdomain enumeration tool written in Rust that discovers subdomains via Certificate Transparency logs and APIs without… | 78 | 3793 | active |
| pwntester/ysoserial.net ysoserial.net is a proof-of-concept command-line tool that generates deserialization payloads exploiting unsafe .NET object deserialization… | 65 | 3793 | active |
| shuaiplus/nodewarden NodeWarden is a Bitwarden-compatible password manager server that runs entirely on Cloudflare Workers, using D1 for data and R2/KV for atta… | 77 | 3789 | active |
| edoardottt/cariddi Cariddi is a fast command-line web crawler written in Go that takes a list of domains, crawls URLs, and scans for endpoints, secrets, API k… | 84 | 3786 | active |
| scipag/vulscan Vulscan is an Nmap NSE script that turns Nmap into a vulnerability scanner by matching version-detected services against offline vulnerabil… | 49 | 3786 | active |
| nabla-c0d3/sslyze SSLyze is a fast SSL/TLS scanning tool and Python library that analyzes a server's TLS configuration, including certificates, cipher suites… | 77 | 3780 | stable |
| TheMythologist/GenP GenP is an open-source AutoIt patcher that applies binary hex patches to Adobe Creative Cloud applications on Windows to modify their licen… | 72 | 3780 | active |
| aquasecurity/cloudsploit CloudSploit by Aqua is an open-source Cloud Security Posture Management (CSPM) tool that scans cloud infrastructure accounts for misconfigu… | 66 | 3777 | active |
| ibnaleem/gosearch GoSearch is a Go-based CLI OSINT tool that searches a username across 300+ websites to find a person's digital footprint, serving as a Sher… | 82 | 3775 | active |
| AdventDevInc/kudu Kudu is a free, open-source (MIT) system maintenance suite for Windows, macOS, and Linux offering 15+ tools including a system cleaner, mal… | 77 | 3760 | active |
| zxcvbn zxcvbn is a JavaScript password strength estimator inspired by password crackers, using pattern matching and conservative estimation agains… | 23 | 16071 | maintenance |
| VirtualXposed VirtualXposed is an Android app that runs apps and Xposed modules inside a virtual environment, enabling Xposed module functionality withou… | 23 | 16067 | maintenance |
| linuxserver/docker-swag SWAG is a Docker image from LinuxServer.io bundling an Nginx webserver/reverse proxy with PHP support, a built-in Certbot client for automa… | 96 | 3742 | active |
| RhinoSecurityLabs/cloudgoat CloudGoat is Rhino Security Labs' 'Vulnerable by Design' AWS deployment tool that provisions intentionally vulnerable cloud environments fo… | 72 | 3738 | active |
| WGDashboard/WGDashboard WGDashboard is a self-hosted web dashboard for managing WireGuard and AmneziaWG VPN servers, built with Python (Flask) and Vue.js. It auto-… | 87 | 3737 | active |
| thoughtbot/clearance Clearance is a Rails engine providing email and password authentication for Ruby on Rails applications. It offers opinionated defaults for … | 79 | 3735 | active |
| Mouseww/anything-analyzer An Electron-based all-in-one protocol analysis toolkit that captures HTTP(S) traffic from browsers, desktop apps, terminals, scripts, and m… | 77 | 3734 | active |
| ip-scanner/cloudflare A tool for scanning and discovering Cloudflare IP ranges and hosts, distributed via the ip-scanner organization with an associated Telegram… | 40 | 3732 | active |
| microcosm-cc/bluemonday bluemonday is a fast, highly configurable HTML sanitizer library for Go, inspired by the OWASP Java HTML Sanitizer. It takes untrusted user… | 26 | 3727 | stable |
| sismo-core/sismo-badges Sismo Badges is the set of Solidity smart contracts powering the Sismo Badge Minting Protocol on Ethereum. It provides an attestations regi… | 23 | 15872 | maintenance |
| mollyim/mollyim-android Molly is a hardened, security-focused fork of the Signal messaging app for Android, adding features like passphrase-encrypted databases at … | 94 | 3717 | active |
| es3n1n/defendnot defendnot is a C++ Windows utility that disables Windows Defender by registering a fake antivirus product through the Windows Security Cent… | 79 | 3713 | active |
| lowRISC/opentitan OpenTitan is an open-source silicon Root of Trust (RoT) project providing commercial-grade, security-certified hardware IP blocks written i… | 81 | 3707 | stable |
| pavel-odintsov/fastnetmon FastNetMon Community Edition is a high-performance DDoS detection sensor that analyzes traffic from NetFlow, IPFIX, sFlow, AF_PACKET, and o… | 78 | 3706 | active |
| Brave Browser Brave is a free, open-source web browser focused on privacy, security, and performance. It blocks ads and trackers by default and includes … | 77 | 3703 | active |
| ly4k/Certipy Certipy is a Python CLI toolkit for enumerating and abusing Active Directory Certificate Services (AD CS) misconfigurations. It detects and… | 87 | 3702 | active |
| EMBA EMBA is an open-source firmware security analyzer for embedded Linux devices, written in Bash. It automates firmware extraction, static and… | 94 | 3701 | active |
| S3cur3Th1sSh1t/WinPwn WinPwn is a PowerShell-based automation framework for internal Windows penetration testing and Active Directory security assessment. It bun… | 37 | 3695 | active |
| jwt/ruby-jwt A Ruby gem implementing the RFC 7519 OAuth JSON Web Token (JWT) standard, supporting encoding and decoding of signed tokens with HMAC, RSAS… | 98 | 3687 | stable |
| apple-oss-distributions/xnu The XNU kernel source code, the core of Apple's Darwin operating system used in macOS and iOS. It is a hybrid kernel combining the Mach mic… | 68 | 3685 | active |
| WithSecureLabs/chainsaw Chainsaw is a Rust-based CLI tool for rapidly searching and hunting through Windows forensic artefacts such as Event Logs, MFT, and registr… | 95 | 3680 | active |
| maxcountryman/flask-login Flask-Login is a Flask extension that provides user session management, handling login, logout, and persistent session tracking. It is stor… | 67 | 3678 | stable |
| ProGuard ProGuard is a free shrinker, optimizer, obfuscator, and preverifier for Java bytecode. It removes unused code, optimizes bytecode, and rena… | 85 | 3676 | active |
| rage rage is a Rust implementation of the age file encryption format, providing a simple, secure CLI tool and library with small explicit keys, … | 90 | 3672 | active |
| AdaptixC2 AdaptixC2 is an extensible post-exploitation and adversarial emulation (C2) framework for authorized penetration testing, with a Golang tea… | 67 | 3666 | active |
| Lessica/TrollFools TrollFools is an iOS application for TrollStore that performs in-place tweak injection into installed apps using insert_dylib and ChOma. It… | 91 | 3656 | active |
| blechschmidt/massdns MassDNS is a high-performance DNS stub resolver written in C, capable of resolving millions to billions of domain names at over 350,000 loo… | 66 | 3652 | stable |
| tnodir/fort Fort Firewall is a standalone firewall application for Windows 7+ with its own kernel driver. It provides per-application network rules, ba… | 96 | 3634 | active |
| swisskyrepo/SSRFmap SSRFmap is a Python CLI framework that automatically detects and exploits Server-Side Request Forgery vulnerabilities. It takes a Burp Suit… | 72 | 3630 | active |
| momo5502/sogen Sogen is a C++ userspace emulator that runs Windows and Linux binaries at the CPU and syscall level without a real operating system, execut… | 66 | 3625 | active |
| zc-zhangchen/any-auto-register A multi-platform automated account registration and management system with a Web UI, plugin-based extensibility, and batch registration sup… | 58 | 3625 | active |
| guardianproject/orbot-android Orbot is a free Android app that routes device internet traffic through the Tor network, acting as a VPN and proxy to encrypt and anonymize… | 99 | 3623 | active |
| go-oauth2/oauth2 A Go library for building OAuth 2.0 authorization servers that issue and manage access tokens. It supports the standard OAuth 2.0 protocol … | 83 | 3623 | stable |
| ory/oathkeeper Ory Oathkeeper is a cloud native Identity & Access Proxy (IAP) and Access Control Decision API written in Go that authenticates, authorizes… | 74 | 3605 | active |
| nmap/npcap Npcap is the Nmap Project's packet capture and injection library for Microsoft Windows, implementing the portable Pcap API via a custom NDI… | 91 | 3604 | active |
| allinssl/allinssl AllinSSL is a self-hosted, open-source SSL certificate lifecycle management platform with a web dashboard. It automates certificate applica… | 77 | 3604 | active |
| Pentest-Windows A pre-built Windows 11 penetration testing virtual machine image bundling 400+ security tools and scripts, distributed for VMware, Parallel… | 43 | 3599 | active |
| frknkrc44/HMA-OSS HMA-OSS is a Zygisk module that hides your app list, settings, and package installers from other apps on rooted Android devices. It is a Ko… | 84 | 3593 | active |