Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| honmashironeko/ProxyCat ProxyCat is a self-hosted tunnel proxy pool middleware that turns short-lived proxy IPs into a stable fixed tunnel endpoint over HTTP/SOCKS… | 85 | 2632 | active |
| KubeArmor KubeArmor is a cloud-native runtime security enforcement system that restricts process execution, file access, and networking behavior of p… | 100 | 2631 | active |
| SummerSec/ShiroAttack2 A Java-based exploitation tool for the Apache Shiro-550 rememberMe deserialization vulnerability, offering both a JavaFX GUI and a CLI. It … | 82 | 2630 | active |
| rbsec/sslscan sslscan is a command-line tool that tests SSL/TLS enabled services to discover supported cipher suites, protocols, key exchange groups, and… | 88 | 2628 | active |
| JingMatrix/TEESimulator TEESimulator is an Android module that defeats hardware-backed key attestation by running AOSP's reference KeyMint trusted application insi… | 81 | 2627 | active |
| massgravel/TSforge TSforge is a C# command-line tool implementing a collection of activation and evaluation extension methods for Windows Vista through 11, in… | 56 | 2626 | active |
| TestDisk & PhotoRec TestDisk and PhotoRec are free, open-source data recovery utilities written in C. TestDisk recovers lost partitions and repairs boot sector… | 76 | 2625 | stable |
| anhkgg/SuperRDP SuperRDP is a C++ rework of the rdpwrap project that patches and hooks the Windows termsrv.dll to enable Remote Desktop connections on edit… | 50 | 2625 | active |
| Wasabi Wallet Wasabi Wallet is an open-source, non-custodial, privacy-focused Bitcoin desktop wallet built in C# on .NET. It routes all traffic through T… | 94 | 2621 | active |
| apify/fingerprint-suite A modular TypeScript toolkit by Apify for generating realistic browser fingerprints and HTTP headers and injecting them into Playwright or … | 95 | 2619 | active |
| ory/fosite Fosite is a security-first, extensible OAuth 2.0 and OpenID Connect SDK for Go, implementing RFC 6749, RFC 6819, PKCE, and OpenID Connect C… | 54 | 2618 | active |
| snake-4/Zygisk-Assistant A Zygisk module written in C++ that hides the existence of root and Zygisk from apps on Android 5.0 and above. It works with KernelSU, Magi… | 49 | 2618 | active |
| imbushuo/mac-precision-touchpad A Windows Precision Touchpad driver implementation for Apple MacBook trackpads and Magic Trackpad 2, written in C. It supports USB (includi… | 23 | 10494 | maintenance |
| segmentio/chamber Chamber is a Go CLI tool for managing application secrets by storing them in AWS SSM Parameter Store (with S3 backend support). It lets tea… | 71 | 2615 | active |
| legendsayantan/ShizuTools ShizuTools is an Android app that provides a suite of tools for controlling the Android system beyond normal user permissions, using the Sh… | 62 | 2613 | active |
| googleprojectzero/winafl WinAFL is a Windows fork of American Fuzzy Lop (AFL) for coverage-guided fuzzing of Windows binaries, including closed-source black-box tar… | 61 | 2612 | active |
| EDL (Qualcomm Sahara/Firehose Tools) A Python CLI tool for communicating with Qualcomm devices in EDL (Emergency Download) mode via the Sahara, Firehose, Streaming, and Diag pr… | 66 | 2611 | active |
| shaka-project/shaka-packager Shaka Packager is a media packaging tool and SDK for preparing video content for online streaming via DASH and HLS. It supports VOD and liv… | 91 | 2610 | active |
| proot-me/proot PRoot is a user-space implementation of chroot, mount --bind, and binfmt_misc for Linux that requires no privileges or setup, built on ptra… | 84 | 2609 | active |
| gaasedelen/lighthouse Lighthouse is a code coverage explorer plugin for IDA Pro and Binary Ninja that lets reverse engineers interactively visualize execution co… | 49 | 2609 | stable |
| lexik/LexikJWTAuthenticationBundle A Symfony bundle that provides JSON Web Token (JWT) authentication for Symfony APIs. It handles token creation, validation, and integration… | 65 | 2605 | stable |
| sarperavci/CloudflareBypassForScraping A Python library that bypasses Cloudflare's anti-bot verification for web scraping, supporting cookie generation and request mirroring for … | 68 | 2603 | active |
| mas-bandwidth/netcode A C library implementing a secure, connection-oriented client/server protocol on top of UDP for real-time multiplayer games. It handles enc… | 98 | 2599 | active |
| BishopFox/cloudfox CloudFox is an open-source command line tool by Bishop Fox that automates situational awareness and enumeration in cloud environments, prim… | 88 | 2598 | active |
| sidex15/susfs4ksu-module A KernelSU addon module that installs userspace helpers (ksu_susfs, sus_su) to communicate with a SUSFS-patched kernel for kernel-level roo… | 83 | 2597 | active |
| bytedance/bhook ByteHook is a production-grade Android PLT hook library written in C, supporting armeabi-v7a, arm64-v8a, x86, and x86_64. It lets native co… | 73 | 2597 | active |
| beenuar/AiSOC AiSOC is an open-source, self-hostable AI-powered Security Operations Center that fuses alerts, performs agent-assisted triage, purple-team… | 82 | 2594 | active |
| mewebstudio/captcha A Laravel service provider package that generates CAPTCHA images for form protection, supporting Laravel 5 through 12. It offers session-ba… | 89 | 2589 | active |
| hmgle/graftcp graftcp is a Linux command-line tool that redirects TCP, UDP, and DNS traffic of arbitrary processes to SOCKS5 or HTTP proxies using ptrace… | 91 | 2587 | active |
| cisco-ai-defense/skill-scanner A security scanner for AI agent skills that detects prompt injection, data exfiltration, and malicious code patterns using pattern-based de… | 82 | 2587 | active |
| nelenkov/android-backup-extractor A Java command-line utility that extracts and repacks Android backup archives created with adb backup, based on AOSP's BackupManagerService… | 82 | 2585 | active |
| boxlite-ai/boxlite BoxLite is an embeddable micro-VM runtime written in Rust that runs any OCI image inside hardware-isolated virtual machines (KVM on Linux, … | 84 | 2583 | active |
| refraction-networking/utls uTLS is a fork of Go's crypto/tls library that provides low-level access to the TLS ClientHello message, enabling fingerprint mimicry and r… | 79 | 2582 | active |
| pythops/oryx Oryx is a terminal user interface (TUI) application for sniffing and inspecting network traffic in real time using eBPF on Linux. It also p… | 70 | 2581 | active |
| rednaga/APKiD APKiD is a command-line tool that identifies how an Android APK was built, detecting compilers, packers, obfuscators, and app-shielding/RAS… | 75 | 2577 | active |
| lgandx/PCredz PCredz is a Python CLI tool that extracts credentials and authentication tokens (NTLM, Kerberos, HTTP Basic, FTP, SMTP, IMAP, POP3, LDAP, S… | 60 | 2577 | active |
| ajinabraham/nodejsscan nodejsscan is a static application security testing (SAST) scanner for Node.js applications, built on libsast and semgrep. It provides a we… | 66 | 2575 | active |
| s0lst1c3/eaphammer EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks, including credential stealing and hostil… | 23 | 2572 | active |
| YeQing17-2026/OmniAgent OmniAgent is an open-source Python agent framework that self-evolves across skills, context, memory, and its underlying model during intera… | 54 | 2570 | active |
| madeye/proxydroid ProxyDroid is an Android app that routes all device traffic through an upstream SOCKS5 or HTTP proxy without root, using a VpnService-based… | 63 | 2566 | active |
| NVISOsecurity/AlwaysTrustUserCerts A Magisk/KernelSU module that automatically copies user-installed certificates into the Android system root CA store. It enables TLS traffi… | 43 | 2565 | active |
| ungoogled-software/ungoogled-chromium-windows Windows packaging and build scripts for ungoogled-chromium, a Chromium variant with all Google services and tracking removed. It provides b… | 93 | 2564 | active |
| splunk/attack_range Splunk Attack Range is a tool that builds instrumented, vulnerable lab environments in the cloud (AWS, Azure, GCP) or locally using Terrafo… | 81 | 2562 | active |
| SPIFFE SPIFFE is a framework and set of standards for issuing cryptographic identities to workloads, and SPIRE (the SPIFFE Runtime Environment) is… | 96 | 2559 | stable |
| mullvad/mullvad-browser Mullvad Browser is a privacy-focused desktop web browser developed jointly by Mullvad VPN and the Tor Project, essentially a Tor Browser de… | 96 | 2554 | active |
| kpcyrd/sn0int sn0int is a semi-automatic OSINT framework and package manager written in Rust that enumerates attack surface by processing public informat… | 66 | 2553 | active |
| rabbitstack/fibratus Fibratus is a Windows security sensor that performs realtime threat detection by analyzing kernel and system telemetry (including ETW event… | 87 | 2552 | active |
| Mattiwatti/EfiGuard EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader, and kernel at boot time to disable PatchGuard a… | 58 | 2551 | active |
| monoxgas/sRDI sRDI is a shellcode implementation of Reflective DLL Injection that converts DLL files into position-independent shellcode via a compiled P… | 32 | 2550 | stable |
| LSPosed/AndroidHiddenApiBypass A pure-Java Android library that bypasses restrictions on non-SDK (hidden) interfaces, offering two variants: HiddenApiBypass (Unsafe-based… | 77 | 2547 | active |
| DidierStevens/DidierStevensSuite A bundled collection of Didier Stevens' security research tools, distributed as a ZIP and GitHub repository of Python scripts and utilities… | 75 | 2546 | active |
| x90skysn3k/brutespray Brutespray is a fast, multi-protocol credential brute-forcing tool written in Go. It parses scan output from Nmap, Nessus, Nexpose, JSON, a… | 92 | 2541 | active |
| Barre/privaxy Privaxy is a MITM HTTP(S) proxy written in Rust that blocks ads and trackers at the network level, supporting Adblock Plus and uBlock Origi… | 23 | 2537 | active |
| epsylon/ufonet UFONet is a free, P2P and cryptographic 'disruptive toolkit' written in Python for performing DoS and DDoS attacks at Layer 7 (HTTP) via Op… | 79 | 2535 | active |
| pac4j pac4j is a Java security engine for authenticating users, managing profiles, and enforcing authorizations across web applications and servi… | 77 | 2535 | stable |
| rspamd/rspamd Rspamd is an advanced spam filtering system and email processing framework written in C with an extensive Lua plugin API. It evaluates mess… | 96 | 2534 | active |
| Nidhogg Nidhogg is an open-source Windows x64 kernel rootkit written in C++ that demonstrates a wide range of rootkit techniques such as process, t… | 84 | 2534 | active |
| m4ll0k/SecretFinder SecretFinder is a Python CLI script based on LinkFinder that discovers sensitive data like API keys, access tokens, and JWTs in JavaScript … | 32 | 2534 | active |
| Proton VPN client Official open-source Proton VPN client apps for Android and Windows, built by Proton AG to route traffic through Proton's VPN servers. The … | 93 | 2532 | active |
| tobiabocchi/flipperzero-bruteforce A Python script that generates .sub files for brute-forcing fixed OOK code subghz protocols using a Flipper Zero device. It supports multip… | 32 | 2529 | active |
| CTurt/FreeDVDBoot FreeDVDBoot is a PlayStation 2 DVD Player exploit written in C that lets users burn homebrew discs which boot on unmodified PS2 consoles. I… | 32 | 2526 | stable |
| jedisct1/piknik Piknik is a command-line tool that securely copies and pastes clipboard content between arbitrary hosts over the network, using end-to-end … | 54 | 2524 | stable |
| Box for Magisk Box for Root (BFR) is a Magisk/KernelSU/APatch module that bundles proxy cores such as clash, sing-box, v2ray, hysteria, and xray to set up… | 77 | 2523 | active |
| abrahamjuliot/creepjs CreepJS is a web application that performs advanced device and browser fingerprinting to expose weaknesses in anti-fingerprinting browsers … | 67 | 2520 | active |
| AirGuard AirGuard is an Android app that protects users from unwanted tracking via AirTags and other Apple Find My accessories. It periodically scan… | 92 | 2516 | active |
| OpenMPTCProuter OpenMPTCProuter is an OpenWrt-based router distribution that aggregates multiple internet connections (fiber, ADSL, 4G/5G, etc.) using Mult… | 75 | 2513 | active |
| h9zdev/WireTapper WireTapper is a wireless OSINT tool that passively detects and maps nearby radio-emitting devices such as Wi-Fi access points, Bluetooth de… | 56 | 2504 | active |
| builtbybel/CrapFixer CrapFixer is a lightweight Windows utility that cleans up junk, removes ads and preinstalled bloatware, and tweaks privacy settings on Wind… | 84 | 2500 | active |
| mCaptcha/mCaptcha mCaptcha is a self-hosted, privacy-respecting CAPTCHA system that uses SHA-256 proof-of-work to rate-limit users instead of image puzzles. … | 39 | 2495 | active |
| usnistgov/macos_security The macOS Security Compliance Project (mSCP) is an open-source tool from NIST that generates security baselines, configuration profiles, co… | 96 | 2493 | active |
| nil0x42/phpsploit PhpSploit is a full-featured command-and-control (C2) framework that persists on a webserver via a stealthy single-line PHP backdoor. It is… | 23 | 2492 | active |
| quasar/Quasar Quasar is a free, open-source remote administration tool (RAT) for Windows written in C#, offering remote desktop, shell, file management, … | 10 | 9906 | maintenance |
| Symfony Security SecurityBundle is the official Symfony bundle that integrates the Security component into the Symfony full-stack framework. It provides con… | 93 | 2490 | stable |
| coreos/go-oidc go-oidc is a mature Go client library for OpenID Connect, built on top of golang.org/x/oauth2. It enables verifying ID tokens and identifyi… | 90 | 2489 | stable |
| sabri-zaki/EasY_HaCk EasY_HaCk is a Termux-based penetration testing menu tool that bundles and installs tools like Metasploit, Nmap, SQLmap, and recon-ng for n… | 39 | 2487 | active |
| MatinSenPai/SenPaiScanner SenPai Scanner is a lightweight, cross-platform Cloudflare IP and endpoint scanner written in Go. It probes Cloudflare edge IPs, validates … | 80 | 2484 | active |
| TH3xACE/SUDO_KILLER SUDO_KILLER is a Shell-based security tool that audits Linux systems for sudo-related privilege escalation vectors, including misconfigurat… | 61 | 2484 | active |
| HACKERALERT/Picocrypt Picocrypt is a very small, simple, and secure file encryption tool written in Go, using modern cryptography like XChaCha20, Argon2, and SHA… | 10 | 2482 | active |
| unode/firefox_decrypt Firefox Decrypt is a Python command-line tool that extracts saved passwords from Mozilla product profiles (Firefox, Waterfox, Thunderbird, … | 76 | 2481 | active |
| m0nad/Diamorphine Diamorphine is a loadable kernel module (LKM) rootkit for Linux kernels 2.6.x through 6.x on x86/x86_64 and ARM64. It demonstrates rootkit … | 64 | 2481 | active |
| archerysec/archerysec ArcherySec is an open-source application security orchestration and correlation (ASOC) and vulnerability management platform that integrate… | 31 | 2478 | active |
| ChrispyBacon-dev/DockFlare DockFlare is a self-hosted Python/Flask application that watches Docker container events and automatically manages Cloudflare Tunnel ingres… | 85 | 2475 | active |
| JingMatrix/NeoZygisk NeoZygisk is a Zygote injection module implemented via ptrace that provides Zygisk API support for APatch and KernelSU, and can replace Mag… | 82 | 2470 | active |
| OneKey OneKey is an open-source, multi-chain cryptocurrency wallet application supporting Bitcoin, Ethereum, Solana, Tron, and many other networks… | 99 | 2468 | active |
| noob-hackers/hacklock Hacklock is a bash-based Termux tool that generates pattern phishing pages to capture an Android victim's unlock pattern via a shared link … | 49 | 2468 | active |
| DNSCrypt/SimpleDnsCrypt Simple DNSCrypt is a Windows GUI management tool for configuring dnscrypt-proxy. It simplifies setting up encrypted DNS on Windows systems. | 52 | 2467 | active |
| Notselwyn/CVE-2024-1086 A proof-of-concept local privilege escalation exploit for CVE-2024-1086, a double-free vulnerability in the Linux kernel's nf_tables subsys… | 16 | 2457 | stable |
| Dewalt-arch/pimpmykali A shell script that applies a collection of fixes and configuration tweaks to freshly imported Kali Linux virtual machines. It offers an in… | 42 | 2456 | active |
| square/certstrap certstrap is a Go-based CLI tool for bootstrapping your own certificate authorities and managing a simple public key infrastructure. It ini… | 48 | 2455 | active |
| ZerBea/hcxtools A set of C command-line tools that convert WiFi packet captures (pcap/pcapng) into hash formats compatible with Hashcat and John the Ripper… | 77 | 2454 | active |
| assetnote/react2shell-scanner A Python command-line scanner that detects RCE vulnerabilities CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server… | 38 | 2453 | active |
| hisxo/gitGraber gitGraber is a Python3 command-line tool that monitors GitHub search results in real time to find leaked sensitive data such as API keys an… | 62 | 2452 | active |
| ramonvermeulen/whosthere Whosthere is a Local Area Network discovery tool with an interactive Terminal User Interface, written in Go. It discovers devices via mDNS,… | 80 | 2451 | active |
| 7723mod/NPatch NPatch is a rootless Xposed framework forked from LSPatch, based on LSPosed, that injects Xposed modules into target APKs by inserting dex … | 79 | 2450 | active |
| lihenggui/blocker Blocker is an Android application that manages app components (activities, services, receivers, providers) using PackageManager and Intent … | 70 | 2450 | active |
| find-sec-bugs/find-sec-bugs Find Security Bugs is a SpotBugs plugin that performs static security analysis of Java bytecode, detecting 144 vulnerability patterns inclu… | 52 | 2450 | active |
| mandiant/flare-ida A collection of IDA Pro plugins and IDAPython scripts from Mandiant's FLARE team for reverse engineering and malware analysis. It includes … | 10 | 2450 | active |
| vpnhood/VpnHood VpnHood is an open-source, cross-platform VPN client and server built entirely from scratch in C#/.NET, designed to be undetectable by deep… | 96 | 2449 | active |
| EmbarkStudios/cargo-deny cargo-deny is a Cargo plugin (cargo subcommand) for linting Rust dependency graphs. It checks crate licenses against allow/deny lists, bans… | 94 | 2449 | active |
| dirkjanm/BloodHound.py BloodHound.py is a Python-based data ingestor for BloodHound that enumerates Active Directory domains, collecting users, groups, computers,… | 50 | 2447 | active |