Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Roave/SecurityAdvisories A Composer package that acts as an exclusion list of known security vulnerabilities, preventing installation of dependency versions with do… | 75 | 2918 | active |
| zinja-coder/jadx-ai-mcp A JADX plugin that bundles an MCP server, allowing LLM clients like Claude to interact with the JADX decompiler for Android APK analysis. I… | 88 | 2915 | active |
| FiloSottile/yubikey-agent yubikey-agent is a seamless ssh-agent that stores SSH keys on YubiKey hardware via the PIV smartcard interface. It runs in the background, … | 32 | 2913 | stable |
| calebstewart/pwncat pwncat is a post-exploitation platform and handler for reverse and bind shells, written in Python. It wraps raw shell communication with an… | 10 | 2913 | active |
| destan19/OpenAppFilter OpenAppFilter (OAF) is a parental control and application filtering plugin for OpenWrt routers, built as a kernel module, service daemon, a… | 91 | 2904 | active |
| rs/cors rs/cors is a Go library providing a configurable net/http handler that implements the Cross Origin Resource Sharing (CORS) W3C specificatio… | 67 | 2898 | stable |
| pwndoc/pwndoc PwnDoc is a self-hosted web application for writing penetration test findings and generating customizable Docx reports. It supports multi-u… | 94 | 2895 | active |
| pyllyukko/user.js A hardened user.js configuration template for Mozilla Firefox that enforces security and privacy settings. It limits tracking, fingerprinti… | 63 | 2893 | active |
| Pryaxis/TShock TShock is a server-side toolbox for Terraria servers providing anti-cheat, server-side characters, groups, permissions, item bans, and exte… | 82 | 2891 | active |
| flozz/p0wny-shell p0wny@shell is a single-file PHP webshell that provides a browser-based terminal for executing commands on a remote server. It is designed … | 35 | 2891 | active |
| Patterniha Internet Freedom Suite A method and configuration toolkit that intercepts unencrypted browser traffic via a man-in-the-middle local proxy and forwards it to block… | 69 | 2890 | active |
| projectdiscovery/dnsx dnsx is a fast, multi-purpose DNS toolkit from ProjectDiscovery for running DNS queries (A, AAAA, CNAME, PTR, NS, MX, TXT, SRV, SOA) with u… | 84 | 2880 | active |
| gzu-liyujiang/Android_CN_OAID An open-source Android library providing a unified solution for obtaining unique device identifiers, serving as an open alternative to the … | 77 | 2877 | active |
| mrexodia/TitanHide TitanHide is a Windows kernel driver that hides debuggers from selected processes by hooking Nt* kernel functions via SSDT hooks and alteri… | 68 | 2872 | active |
| voidauth/voidauth VoidAuth is an open-source single sign-on (SSO) and user management provider for self-hosted applications, acting as an OIDC provider, prox… | 86 | 2870 | active |
| LimerBoy/Impulse Impulse is a Python-based denial-of-service toolkit that bundles multiple attack methods including SYN, UDP, ICMP, HTTP floods, Slowloris, … | 35 | 2864 | active |
| Minisign Minisign is a dead simple command-line tool for signing files and verifying digital signatures using the Ed25519 public-key signature syste… | 67 | 2858 | stable |
| glauth/glauth GLAuth is a lightweight, secure LDAP authentication server written in Go with configurable backends. It serves as a simple alternative to O… | 92 | 2857 | active |
| Shadowsocks A SIP003 plugin for Shadowsocks built on v2ray, tunneling traffic over WebSocket (HTTP/HTTPS) or QUIC to obfuscate proxy traffic. Written i… | 60 | 2847 | active |
| OpenCVE OpenCVE is a self-hostable Vulnerability Intelligence Platform that aggregates CVE data from sources like MITRE, NVD, CISA KEV, Vulnrichmen… | 90 | 2841 | active |
| yujincheng08/BiliRoaming BiliRoaming is an Xposed module for rooted Android devices that removes regional restrictions on anime (bangumi) content in the Bilibili ap… | 10 | 11548 | maintenance |
| quay/quay Project Quay is an open-source container image registry that builds, stores, and distributes container images. It implements the Docker Reg… | 95 | 2835 | active |
| eycorsican/leaf Leaf is a versatile and efficient proxy framework written in Rust, supporting multiple proxy protocols such as Shadowsocks, Trojan, VMess, … | 86 | 2833 | active |
| evi0s/WMPFDebugger A debugger tweak for WeChat's Mini-Program Framework (WMPF) that exploits the remote debug feature of WeChat devtools to enable full Chrome… | 64 | 2832 | active |
| Lens Protocol Lens Protocol is a decentralized, non-custodial social graph built as a set of Solidity smart contracts, enabling on-chain social interacti… | 38 | 2832 | active |
| visa/visa-vulnerability-agentic-harness VVAH is Visa's open-source agentic harness for autonomous vulnerability discovery, remediation, and validation using frontier AI models. It… | 77 | 2830 | active |
| screetsec/TheFatRat TheFatRat is a menu-driven exploiting tool that automates MSFvenom and Metasploit to generate backdoors and payloads for Windows, Linux, Ma… | 23 | 11505 | maintenance |
| Gedsh/InviZible InviZible Pro is an Android application that combines Tor, DNSCrypt, and Purple I2P modules to provide online privacy, anonymity, and acces… | 99 | 2827 | active |
| Piston Piston is a high performance general purpose code execution engine that safely runs untrusted and potentially malicious code in isolated en… | 62 | 2827 | active |
| shatyuka/Zhiliao Zhiliao is an Xposed module that removes ads and cleans up the interface of the Zhihu Android app. It also offers content filtering, UI sim… | 56 | 2819 | active |
| ARMmbed/DAPLink Arm Mbed DAPLink is open-source interface firmware that runs on a secondary MCU attached to the SWD/JTAG port of an Arm Cortex application … | 63 | 2816 | active |
| zema1/suo5 Suo5 is a high-performance HTTP tunneling tool that creates a local SOCKS5 forward proxy by tunneling traffic through a compromised web ser… | 80 | 2815 | active |
| coreboot/coreboot coreboot is an open-source firmware project that replaces proprietary BIOS/UEFI on computers, performing hardware initialization and then h… | 67 | 2807 | active |
| ALTCHA ALTCHA is an open-source, privacy-first CAPTCHA alternative that protects websites, forms, and APIs from bots and spam using a proof-of-wor… | 94 | 2804 | active |
| Tecnativa/docker-socket-proxy A security-enhanced HAProxy-based proxy that sits in front of the Docker socket and restricts which Docker API requests are allowed. It ret… | 83 | 2804 | active |
| straight-tamago/misaka Misaka is an iOS and tvOS customisation application that lets users apply tweaks without jailbreaking, exploiting KFD and MacDirtyCow (MDC)… | 21 | 2803 | active |
| libkrun/libkrun libkrun is a dynamic library that lets programs run processes in partially isolated environments using KVM virtualization on Linux and HVF … | 99 | 2802 | active |
| sam1am/anyapk anyapk is a lightweight Android app that installs any APK on your own device by using local ADB (wireless debugging) connections, bypassing… | 81 | 2802 | active |
| authpass/authpass AuthPass is a free, open-source password manager built with Flutter that is compatible with KeePass 2.x (KDBX 3 and KDBX 4) databases. It r… | 65 | 2802 | active |
| hasherezade/pe_to_shellcode A C++ command-line tool that converts Windows PE executables into shellcode-compatible form, adding a reflective loading stub post-compilat… | 37 | 2797 | active |
| panda-re/panda PANDA is an open-source Platform for Architecture-Neutral Dynamic Analysis built on the QEMU whole-system emulator, supporting record and r… | 91 | 2782 | active |
| Impact-I/reFlutter reFlutter is a Python CLI framework for reverse engineering Flutter mobile apps by repacking APK/IPA files with a specially patched, precom… | 98 | 2776 | active |
| runkids/skillshare skillshare is a Go-based CLI tool that keeps AI CLI skills, agents, rules, and commands in sync across 60+ AI coding assistants (Claude Cod… | 79 | 2775 | active |
| protectai/vulnhuntr Vulnhuntr is a Python CLI tool that uses large language models combined with static code analysis to autonomously discover exploitable vuln… | 23 | 2775 | active |
| hfiref0x/KDU KDU (Kernel Driver Utility) is a Windows command-line tool that abuses known vulnerable drivers to load unsigned kernel drivers, bypass Dri… | 93 | 2770 | active |
| MeowDump/Integrity-Box Integrity Box is a Magisk module toolkit for rooted Android devices that manages Play Integrity attestation and system environment signals.… | 88 | 2769 | active |
| pucherot/Pi.Alert Pi.Alert is a self-hosted WIFI/LAN intruder detector that scans the local network for connected devices using arp-scan, Pi-hole, and dnsmas… | 23 | 2768 | active |
| xnl-h4ck3r/waymore waymore is a Python CLI tool that retrieves URLs from multiple web archive and intelligence sources (Wayback Machine, Common Crawl, Alien V… | 83 | 2762 | active |
| rubysec/bundler-audit bundler-audit is a command-line tool that audits a Ruby project's Gemfile.lock for gems with known vulnerabilities using the ruby-advisory-… | 70 | 2760 | active |
| awnumar/memguard MemGuard is a pure Go library that securely stores sensitive information in memory, encrypting it with XSalsa20Poly1305 and bypassing the g… | 67 | 2760 | active |
| pongoOS PongoOS is a pre-boot execution environment for Apple boards, built on top of the checkra1n jailbreak tool. It provides an interactive shel… | 32 | 2759 | active |
| Bearer/bearer Bearer CLI is an open-source static application security testing (SAST) tool written in Go that scans source code and analyzes data flows t… | 92 | 2758 | active |
| salarcode/SmartProxy SmartProxy is a Firefox, Chrome, and Edge browser extension that automatically enables or disables proxy usage per website based on customi… | 88 | 2748 | active |
| asLody/VirtualApp VirtualApp is an Android virtualization/sandbox engine that lets apps run inside a host app without being installed on the system, acting a… | 76 | 11104 | maintenance |
| calebmadrigal/trackerjacker A Python CLI tool that maps nearby WiFi networks and their connected devices via raw 802.11 monitor-mode packet capture, similar to nmap bu… | 52 | 2743 | active |
| f0rb1dd3n/Reptile Reptile is a Linux kernel module (LKM) rootkit written in C that provides privilege escalation, file/process/network connection hiding, per… | 63 | 2742 | active |
| sheeki03/tirith Tirith is a Rust-based terminal security tool that intercepts shell commands, pasted content, and files to block threats like homograph URL… | 76 | 2741 | active |
| NetSPI/PowerUpSQL PowerUpSQL is a PowerShell toolkit for attacking and auditing SQL Server instances, supporting discovery, weak configuration auditing, priv… | 32 | 2741 | active |
| ROADtools ROADtools is a Python framework for interacting with Azure AD/Entra ID, comprising the roadlib authentication library, the ROADrecon explor… | 72 | 2737 | active |
| aboul3la/Sublist3r Sublist3r is a Python command-line tool that enumerates subdomains of a target domain using OSINT sources such as Google, Bing, Yahoo, Baid… | 23 | 11051 | maintenance |
| securing/IOSSecuritySuite iOS Security Suite is a Swift library for iOS platform security and anti-tampering checks. It detects jailbroken devices, attached debugger… | 80 | 2733 | active |
| ankit0183/Wifi-Hacking A Python-based menu-driven CLI tool that automates Wi-Fi penetration testing by wrapping built-in Kali Linux wireless tools. It supports mo… | 56 | 2733 | active |
| I2P I2P (Invisible Internet Project) is the reference Java implementation of a decentralized, anonymizing peer-to-peer overlay network that rou… | 91 | 2730 | stable |
| ComodoSecurity/openedr OpenEDR is an open-source Endpoint Detection and Response (EDR) agent written in C++ that records endpoint telemetry, process hierarchies, … | 57 | 2730 | active |
| AxtMueller/Windows-Kernel-Explorer Windows Kernel Explorer (WKE) is a free Windows kernel research and inspection tool supporting Windows XP through Windows 11. It loads a ke… | 54 | 2724 | active |
| patterniha/SNI-Spoofing A Python CLI tool that bypasses Deep Packet Inspection (DPI) by manipulating IP and TCP headers, such as spoofing SNI fields. It is used to… | 48 | 2719 | active |
| Checkmarx/kics KICS (Keeping Infrastructure as Code Secure) is an open-source static analysis tool by Checkmarx that scans IaC files for security vulnerab… | 97 | 2717 | active |
| decompiler-explorer/decompiler-explorer A web service (like Compiler Explorer in reverse) that lets users upload small binaries and compare the decompiled C-like output from many … | 77 | 2711 | active |
| cisagov/ScubaGear ScubaGear is a PowerShell-based assessment tool that checks whether a Microsoft 365 tenant's configuration conforms to CISA's Secure Config… | 82 | 2707 | active |
| 7h30th3r0n3/Evil-M5Project Evil-M5Project is a C++ firmware/tool for M5Stack devices (Cardputer, AtomS3, Fire, Core2) that scans, monitors, and interacts with WiFi ne… | 71 | 2703 | active |
| TermuxHackz/X-osint X-osint is an open-source Python-based OSINT framework for gathering information about phone numbers, email addresses, IP addresses, VINs, … | 69 | 2701 | active |
| Submariner Submariner is a CNCF sandbox tool that interconnects the overlay networks of multiple Kubernetes clusters, enabling direct Pod-to-Pod and S… | 98 | 2697 | active |
| Bouncy Castle Bouncy Castle is a comprehensive open-source cryptographic library for Java (and C#/.NET) implementing a wide range of algorithms, a JCA/JC… | 76 | 2697 | stable |
| lissy93/networking-toolbox Networking Toolbox is a collection of 100+ free, open-source networking utilities for system administrators and network engineers, covering… | 67 | 2696 | active |
| MetapriseAI/OrgKernel OrgKernel is an open-source trust layer for AI agents providing cryptographic agent identity (Ed25519), scoped execution tokens, SHA-256 ha… | 53 | 2685 | active |
| bestK/cursor-fake-machine A VS Code/Cursor editor extension that fakes or resets the machine ID used by the Cursor editor for device identification. It is distribute… | 10 | 2685 | active |
| Elkeid Elkeid is an open-source cloud workload protection platform from ByteDance that provides host intrusion detection (HIDS), runtime applicati… | 67 | 2683 | active |
| re-zero001/LSPosed-Irena LSPosed-Irena is a maintained fork of the LSPosed framework, a Zygisk module providing an ART hooking framework with Xposed-compatible APIs… | 61 | 2683 | active |
| OnionBrowser/OnionBrowser Onion Browser is a free, open-source privacy-focused web browser for iPhone and iPad that tunnels web traffic through the Tor anonymity net… | 95 | 2681 | active |
| rthalley/dnspython dnspython is a DNS toolkit for Python supporting nearly all record types, queries, zone transfers, dynamic updates, TSIG, EDNS0, DNSSEC, an… | 87 | 2680 | stable |
| ihciah/shadow-tls ShadowTLS is a TLS camouflage proxy written in Rust that relays a real TLS handshake with a valid certificate of your choice to the firewal… | 27 | 2680 | active |
| arthaud/git-dumper git-dumper is a Python CLI tool that reconstructs a full git repository from a website that exposes its .git directory, even when directory… | 83 | 2678 | stable |
| aforensics/HiddenVM HiddenVM is a free, open-source Linux application that lets you run Oracle VirtualBox on the Tails operating system, so almost any desktop … | 23 | 2678 | active |
| caido/caido Caido is a lightweight web security auditing toolkit and HTTP proxy for intercepting, viewing, and modifying traffic between browsers and w… | 94 | 2672 | active |
| Moham3dRiahi/Th3inspector Th3inspector is an all-in-one Perl CLI tool for information gathering (OSINT reconnaissance). It bundles lookups such as website info, whoi… | 36 | 2668 | active |
| TrackerControl/tracker-control-android TrackerControl is an Android app that monitors and blocks hidden tracking and ads in mobile apps using a local VPN to analyze network traff… | 95 | 2666 | active |
| Mongoose OS Mongoose OS is an open-source IoT firmware development framework and operating system for low-power microcontrollers such as ESP32, ESP8266… | 66 | 2666 | stable |
| 0x6d69636b/windows_hardening HardeningKitty is a PowerShell module that audits and hardens Windows systems against security baselines such as CIS Benchmarks, Microsoft … | 80 | 2665 | active |
| kboghdady/youTube_ads_4_pi-hole A shell script and maintained DNS blocklist for blocking YouTube ads via Pi-hole. It provides a regularly updated blacklist file to add to … | 77 | 2660 | active |
| cve-search cve-search is a tool-set that imports CVE and CPE data into a local MongoDB to enable fast, private searching of known software vulnerabili… | 82 | 2656 | active |
| thewhiteh4t/pwnedOrNot pwnedOrNot is a Python command-line OSINT tool that checks email addresses against the HaveIBeenPwned v3 API for past breaches and then sea… | 62 | 2656 | active |
| bug-bit/fckvip An Android module (likely Magisk/LSPosed-based) that unlocks paid VIP memberships and enhances extended features in certain apps. It requir… | 79 | 2654 | active |
| Apache Casbin jCasbin is an Apache-licensed Java authorization library that enforces access control using models such as ACL, RBAC, and ABAC defined in c… | 86 | 2650 | stable |
| LibAFL LibAFL is a Rust library of reusable building blocks for constructing custom coverage-guided fuzzers, developed by the AFL++ team. It scale… | 90 | 2649 | active |
| Keystone Assembler Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework implemented in C/C++ with bindings for many languages. It … | 67 | 2649 | active |
| musana/CF-Hero CF-Hero is a Go-based reconnaissance CLI tool that discovers the real origin IP addresses of Cloudflare-protected web applications. It aggr… | 63 | 2640 | active |
| brianshea2/addr.tools A collection of free DNS-based Internet utilities (dynamic DNS, public IP lookup, ACME dns-01 challenge helper, DNS resolver testing) plus … | 69 | 2637 | active |
| paypal/junodb JunoDB is PayPal's open-source secure, consistent, and highly available distributed key-value store delivering single-digit millisecond lat… | 31 | 2636 | active |
| ScanCode ScanCode Toolkit is a command-line tool and Python library that scans codebases to detect licenses, copyrights, package manifests, dependen… | 91 | 2635 | active |
| botswin/BotBrowser BotBrowser is a privacy-focused browser core (Chromium-based) that unifies and controls browser fingerprint signals across platforms, integ… | 85 | 2632 | active |