Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| GiacomoLaw/Keylogger A simple, bare-bones keylogger that records keystrokes and saves them to a local log file, with separate implementations for Windows, Linux… | 35 | 2447 | active |
| NetSPI/MicroBurst MicroBurst is a PowerShell toolkit for assessing Microsoft Azure security, including service discovery, weak configuration auditing, and po… | 69 | 2442 | active |
| cloudflare/gokey gokey is a vaultless password manager written in Go that deterministically derives passwords and cryptographic keys on the fly from a maste… | 73 | 2436 | stable |
| RevylAI/greenlight Greenlight is an offline CLI compliance scanner that checks mobile apps against Apple App Store Review Guidelines and Google Play Developer… | 65 | 2436 | active |
| GoCaptcha GoCaptcha is a high-performance, modular behavioral CAPTCHA library for Go that generates interactive challenges including click, slide, dr… | 63 | 2435 | active |
| yjeanrenaud/yj_nearbyglasses Nearby Glasses is a mobile app that scans Bluetooth LE advertisements to detect smart glasses (like Ray-Ban Meta) nearby and warns the user… | 80 | 2433 | active |
| drk1wi/Portspoof Portspoof is a lightweight C++ tool that emulates open TCP ports and convincing service signatures across all 65535 ports, making port scan… | 78 | 2425 | active |
| assafdori/bypass-mdm A shell script that bypasses Mobile Device Management (MDM) enrollment during macOS setup, supporting versions up to macOS Tahoe 26.3. It r… | 52 | 2425 | active |
| DataDog/stratus-red-team Stratus Red Team is a self-contained Go CLI that emulates granular, actionable cloud attack techniques mapped to MITRE ATT&CK, against AWS,… | 98 | 2421 | active |
| hasherezade/hollows_hunter Hollows Hunter is a Windows command-line tool built on the PE-sieve passive memory scanner that scans running processes for malicious impla… | 65 | 2419 | active |
| LoRexxar/Kunlun-M Kunlun-M is an open-source static code analysis (SAST) tool that detects security vulnerabilities in PHP, JavaScript/Node.js, Python, Golan… | 100 | 2418 | active |
| bytedance/android-inline-hook Shadowhook is an Android inline hook library written in C, supporting armeabi-v7a (thumb/arm32) and arm64-v8a architectures on Android 4.1 … | 78 | 2415 | active |
| anticensority/runet-censorship-bypass A browser extension for Chromium and Firefox that bypasses internet censorship in Russia using PAC (Proxy Auto-Config) scripts. It keeps th… | 62 | 2415 | active |
| CrawlerDetect CrawlerDetect is a zero-dependency PHP library that detects bots, crawlers, and spiders by matching User-Agent and HTTP_FROM headers agains… | 94 | 2408 | active |
| dndx/phantun Phantun is a lightweight, high-performance UDP-to-TCP obfuscator written in safe Rust that disguises UDP packets as TCP streams to pass thr… | 66 | 2408 | active |
| mkj/dropbear Dropbear is a small SSH server and client written in C, designed for low memory and disk footprints. It is widely used on embedded Linux sy… | 88 | 2407 | stable |
| kubeovn/kube-ovn Kube-OVN is a CNCF Sandbox CNI plugin that integrates OVN-based network virtualization with Kubernetes, providing an advanced container net… | 95 | 2406 | active |
| jorhelp/Ingram Ingram is a Python-based vulnerability scanning framework targeting network cameras (IP/CCTV devices). It integrates known exploits for com… | 67 | 2400 | active |
| htrgouvea/nipe Nipe is a Perl-based command-line engine that routes all of a machine's network traffic through the Tor network by manipulating iptables/ip… | 75 | 2398 | active |
| XZB-1248/Spark Spark is a web-based, cross-platform Remote Administration Tool (RAT) written in Go that lets you monitor and control devices from a browse… | 52 | 2395 | active |
| bootleg/ret-sync ret-sync is a set of plugins that synchronize a debugging session (WinDbg, GDB, LLDB, OllyDbg, x64dbg) with disassemblers (IDA, Ghidra, Bin… | 49 | 2395 | active |
| OPCFoundation/UA-.NETStandard The official OPC Foundation reference implementation of the OPC Unified Architecture (OPC UA) protocol for .NET, providing client, server, … | 92 | 2393 | stable |
| acidicoala/SmokeAPI SmokeAPI is a C++ library that hooks the Steamworks SDK to emulate DLC and inventory item ownership in Steam games the user legitimately ow… | 77 | 2393 | active |
| zfl9/ss-tproxy A shell script that sets up transparent proxying on Linux using iptables/nftables TPROXY and REDIRECT rules, working with clients like ss-l… | 47 | 2393 | active |
| hzqst/VmwareHardenedLoader A Windows kernel driver that mitigates VMware VM detection by filtering VMware-related firmware strings and blocking VMware PnP registry en… | 94 | 2392 | active |
| LSPosed/LSPatch LSPatch is a non-root implementation of the LSPosed Xposed framework that integrates the Xposed API into target Android APKs by inserting d… | 10 | 9439 | maintenance |
| slimm609/checksec A Go rewrite of the classic checksec tool that inspects security hardening properties (RELRO, stack canaries, NX, PIE, FORTIFY_SOURCE, CFI)… | 83 | 2387 | active |
| int128/kubelogin kubelogin is a kubectl plugin (kubectl oidc-login) for Kubernetes OpenID Connect authentication, running as a client-go credential plugin. … | 93 | 2378 | active |
| eslint-community/eslint-plugin-security An ESLint plugin providing security-focused linting rules for Node.js code. It flags potential security hotspots like eval usage, unsafe ch… | 89 | 2378 | active |
| NFCGate NFCGate is an Android application for capturing, analyzing, modifying, relaying, replaying, and cloning NFC traffic. It is a security resea… | 77 | 2378 | active |
| lijiejie/BBScan BBScan is a fast, lightweight, high-concurrency web vulnerability scanner written in Python. It helps penetration testers quickly identify … | 23 | 2374 | active |
| bigbrodude6119/flipper-zero-evil-portal A Flipper Zero application that turns the Wi-Fi dev board (ESP32) into an open access point serving a fake captive portal login page. Captu… | 20 | 2373 | active |
| MasterKale/SimpleWebAuthn SimpleWebAuthn is a collection of TypeScript-first libraries (@simplewebauthn/server and @simplewebauthn/browser) that simplify adding WebA… | 98 | 2372 | active |
| Impostor/Impostor Impostor is an open-source reimplementation of the Among Us game server, written in C#. It fully replaces the official server, supports plu… | 94 | 2372 | active |
| bk138/droidVNC-NG droidVNC-NG is a VNC server app for Android that lets you view and remotely control an Android device from any VNC client or web browser, w… | 97 | 2368 | active |
| FiloSottile/whoami.filippo.io A public SSH server (written in Go) that identifies visitors by enumerating the public keys their SSH client offers and matching them again… | 63 | 2367 | stable |
| mojocn/base64Captcha A Go library that generates various types of captchas (digits, strings, math, Chinese, audio) and returns them as base64-encoded image or a… | 50 | 2366 | stable |
| jtpereyda/boofuzz boofuzz is a Python-based network protocol fuzzing framework and the successor to the Sulley Fuzzing Framework. It provides data generation… | 66 | 2365 | active |
| MikeMcQuaid/strap Strap is a bash script (with a small companion web app) that bootstraps a minimal macOS development system. It applies security settings, i… | 77 | 2364 | active |
| Infisical/agent-vault Agent Vault is an open-source HTTP credential proxy and vault by Infisical that sits between AI agents and the APIs they call. It stores cr… | 81 | 2362 | active |
| david942j/one_gadget A Ruby command-line tool that finds one-gadget RCE candidates (execve('/bin/sh',...) call sites) in libc binaries for CTF pwn challenges. I… | 97 | 2359 | active |
| alangrainger/immich-public-proxy A stateless proxy that sits in front of a self-hosted Immich instance and serves only explicitly shared photos, videos, and albums to the p… | 85 | 2359 | active |
| keepassxreboot/keepassxc-browser KeePassXC-Browser is a WebExtension that integrates the KeePassXC password manager with Firefox, Chrome/Chromium, and Edge via native messa… | 99 | 2358 | active |
| unrolled/secure Secure is an HTTP middleware library for Go that adds quick security wins to web applications. It works as a standard net/http Handler and … | 55 | 2358 | stable |
| gnuton/asuswrt-merlin.ng A fork of the Asuswrt-Merlin third-party firmware that extends support to additional ASUS routers, including DSL and WiFi 6/7 models. It pr… | 87 | 2357 | active |
| UMSKT/UMSKT UMSKT (Universal MS Key Toolkit) is an open-source C++ CLI toolkit for researching and experimenting with Microsoft's pre-Vista (pre-2012) … | 75 | 2357 | active |
| googleprojectzero/fuzzilli Fuzzilli is a coverage-guided fuzzer for JavaScript engines, built in Swift by Google Project Zero. It generates test programs via a custom… | 67 | 2354 | active |
| BeichenDream/GodPotato GodPotato is a C# Windows privilege escalation tool that abuses a DCOM/RPCSS oxid resolution defect to elevate from a service account with … | 23 | 2353 | stable |
| RKE2 RKE2 (RKE Government) is Rancher's fully conformant, next-generation Kubernetes distribution focused on security and compliance, particular… | 92 | 2352 | active |
| MEDUSA MEDUSA is a modular automation framework and script repository for runtime testing and investigating Android and iOS apps, built on FRIDA. … | 79 | 2352 | active |
| AabyssZG/SpringBoot-Scan SpringBoot-Scan is an open-source penetration testing framework targeting Spring Boot applications, written in Python. It scans for sensiti… | 47 | 2352 | active |
| MegaManSec/SSH-Snake SSH-Snake is a self-propagating, file-less bash script that automatically discovers SSH private keys on a system, attempts to connect to re… | 10 | 2345 | active |
| rabobank-cdc/DeTTECT DeTT&CT is a Python CLI tool and framework that helps blue teams score and map data source quality, visibility, detection coverage, and thr… | 72 | 2341 | active |
| googleprojectzero/sandbox-attacksurface-analysis-tools A suite of PowerShell tools and .NET libraries from Google Project Zero for analyzing Windows sandbox attack surfaces. It includes NtCoreLi… | 42 | 2341 | active |
| crev-dev/cargo-crev cargo-crev is a cryptographically verifiable, distributed code review system for the Rust cargo package manager. It lets developers review … | 79 | 2340 | active |
| ssl/ezXSS ezXSS is a self-hosted PHP application that helps penetration testers and bug bounty hunters detect and exploit (blind) cross-site scriptin… | 60 | 2339 | active |
| dnakov/little-rat A small Chrome extension that monitors and optionally blocks network calls made by other browser extensions. It requires the extensions-on-… | 31 | 2338 | active |
| kubernetes-sigs/aws-iam-authenticator A tool that lets users authenticate to Kubernetes clusters using AWS IAM credentials instead of separate certificates or tokens. It runs as… | 100 | 2337 | active |
| safebuffer/vulnerable-AD A PowerShell script that configures a Windows Server domain controller into a deliberately vulnerable Active Directory environment for prac… | 32 | 2333 | active |
| onury/accesscontrol A Node.js library implementing Role-Based Access Control (RBAC) merged with Attribute-Based Access Control (ABAC), including role inheritan… | 93 | 2330 | active |
| quenhus/uBlock-Origin-dev-filter A set of uBlock Origin filter lists that hide copycat and SEO-spam websites from search results on Google, DuckDuckGo, and other engines. I… | 37 | 2324 | active |
| gjtorikian/html-pipeline A Ruby library providing a small framework of chainable filters for processing user-supplied content into HTML. It supports text filters, c… | 63 | 2323 | active |
| p0dalirius/Coercer Coercer is a Python CLI tool that automatically coerces Windows servers to authenticate to an arbitrary machine via multiple RPC methods ov… | 54 | 2323 | active |
| AhmetCanArslan/ShizuWall ShizuWall is a lightweight Android firewall app that controls per-app network access without using a VPN tunnel. It works on Android 11+ by… | 83 | 2321 | active |
| V2Ray for OpenWrt OpenWrt/LEDE package definitions (Makefiles) for building and installing V2Ray core on OpenWrt routers, distributed via opkg feeds or prebu… | 92 | 2319 | active |
| Encryqed/Dumper-7 Dumper-7 is a C++ DLL that, when injected into an Unreal Engine game, generates a full C++ SDK (headers for engine classes, functions, and … | 95 | 2318 | active |
| wasmi-labs/wasmi Wasmi is an efficient, lightweight WebAssembly interpreter written in Rust, focused on constrained and embedded (no_std) environments. It o… | 95 | 2317 | active |
| bjdgyc/anylink AnyLink is an enterprise-grade SSL VPN server written in Go that supports many concurrent remote-access users. It implements the OpenConnec… | 90 | 2316 | active |
| Kritt-ai/open-kritt open·kritt is an open-source, self-hosted AI vulnerability research platform that decomposes a codebase into focused security tasks, runs A… | 77 | 2316 | active |
| kylemanna/docker-openvpn A Docker image and shell tooling that runs an OpenVPN server in a container, bundled with an EasyRSA PKI certificate authority. It automate… | 29 | 9086 | maintenance |
| httptoolkit/frida-interception-and-unpinning A collection of Frida scripts that rewrite mobile applications at runtime to bypass certificate pinning and route all HTTPS traffic through… | 77 | 2315 | active |
| CravateRouge/bloodyAD bloodyAD is a Python CLI tool for Active Directory privilege escalation that performs specific LDAP calls against domain controllers. It su… | 95 | 2314 | active |
| owerdogan/whoami-project Whoami is a user-friendly privacy and anonymity CLI tool for Debian and Arch-based Linux distributions. It bundles 9+ modules such as IP ch… | 40 | 2313 | active |
| Zouuup/landrun Landrun is a lightweight CLI tool that sandboxes arbitrary Linux processes using the kernel's Landlock security module, with no root privil… | 77 | 2312 | active |
| 1N3/BruteX BruteX is a shell-based CLI tool that automatically brute forces all services running on a target, enumerating open ports, usernames, and p… | 23 | 2309 | active |
| jofpin/trape Trape is an OSINT analysis and research tool for tracking people online and executing real-time social engineering attacks, built in Python… | 32 | 9055 | maintenance |
| xrpcommunity/XRP-community-wallet A non-custodial, open-source web wallet for XRP Ledger and EVM networks, built by the community. Keys and seed phrases are encrypted and st… | 69 | 2305 | active |
| ckcr4lyf/EvilAppleJuice-ESP32 An ESP32 firmware written in C++ that spams Apple Continuity BLE advertisements to flood nearby iPhones with pop-up notifications. It is ba… | 64 | 2305 | active |
| ggwave A collection of command-line and GUI tools that capture and analyze microphone audio to recover keyboard keystrokes acoustically. Its Keyta… | 23 | 9038 | maintenance |
| n1nj4sec/pupy Pupy is an open-source, cross-platform (Windows, Linux, macOS, Android) command-and-control and post-exploitation framework written in Pyth… | 10 | 9000 | maintenance |
| jdx/fnox fnox is a Rust CLI tool for managing secrets via encryption or cloud secret providers, storing them in a git-committed fnox.toml file. It s… | 81 | 2296 | active |
| squat/kilo Kilo is a multi-cloud network overlay for Kubernetes built on WireGuard, providing an encrypted layer 3 network that connects nodes across … | 74 | 2294 | active |
| yeojz/otplib otplib is a TypeScript-first library for generating and verifying one-time passwords (HOTP and TOTP) for two-factor authentication, compati… | 96 | 2292 | active |
| gautamkrishnar/nothing-private Nothing Private is a proof-of-concept website demonstrating that browser fingerprinting can identify and track users even in private browsi… | 66 | 2292 | active |
| DanOps-1/Gpt-Agreement-Payment A Python toolkit that reverse-engineers and replays the end-to-end ChatGPT Plus/Team/Pro subscription payment flow (Stripe Checkout, PayPal… | 50 | 2288 | active |
| allenymt/PrivacySentry PrivacySentry is an Android privacy compliance toolkit combining a Gradle plugin with a runtime SDK, using annotations plus ASM bytecode in… | 46 | 2288 | active |
| Railgun Railgun is a GUI-based penetration testing tool that automates common tasks from manual pentesting experience. It integrates port scanning,… | 30 | 2286 | active |
| sh-dv/hat.sh Hat.sh is a browser-based web application for secure local file encryption and decryption using XChaCha20-Poly1305 with chunked streaming v… | 23 | 2286 | active |
| API-Security/APIKit APIKit is a BurpSuite extension (Java plugin) that discovers, scans, and audits leaked API documentation such as GraphQL, OpenAPI/Swagger, … | 23 | 2286 | active |
| google/boringssl BoringSSL is Google's fork of OpenSSL, serving as the TLS/SSL library in Chrome, Chromium, and Android. It is open source but explicitly no… | 98 | 2282 | active |
| Alarmo Alarmo is a Home Assistant custom integration that turns existing sensors into a full-featured home alarm system, configurable entirely thr… | 89 | 2276 | active |
| Bank-Vaults Bank-Vaults is a CNCF Sandbox umbrella project of tools for cloud-native secret management with Hashicorp Vault. This repository provides t… | 88 | 2276 | active |
| Foxboron/sbctl sbctl is a user-friendly Secure Boot key manager for Linux written in Go. It creates and enrolls UEFI Secure Boot keys, tracks files that n… | 69 | 2276 | active |
| OpenSteam001/OpenSteamTool OpenSteamTool is an open-source Windows-only Steam unlocker written in C++ that unlocks unowned games and DLCs via Lua configuration, manif… | 68 | 2276 | active |
| RustCrypto Hashes A collection of cryptographic hash function implementations written in pure Rust, organized as separate crates built on the digest crate's … | 77 | 2274 | active |
| 11notes KMS A Dockerized KMS (Key Management Service) server that can activate Windows and volume-licensed Microsoft Office products indefinitely. It s… | 51 | 2272 | active |
| spyboy-productions/CloakQuest3r CloakQuest3r is a Python-based open-source security research tool that identifies potential origin IP exposure of websites protected by Clo… | 51 | 2269 | active |
| Caligatio/jsSHA jsSHA is a pure TypeScript/JavaScript library implementing the complete SHA hash family (SHA-1, SHA-2, SHA-3, SHAKE, cSHAKE, KMAC) plus HMA… | 79 | 2266 | stable |
| Runnin4ik/dpi-detector A Python CLI tool that detects and classifies Deep Packet Inspection (DPI) based internet censorship, including TCP 16-20KB connection drop… | 79 | 2262 | active |
| ARM-software/arm-trusted-firmware Trusted Firmware-A (TF-A) is a reference implementation of secure world software (EL3 firmware, trusted boot, and a small trusted runtime) … | 76 | 2262 | active |