Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| legba Legba is a fast, multiprotocol credentials bruteforcer, password sprayer, and enumerator written in Rust on top of the Tokio async runtime.… | 78 | 1950 | active |
| vxunderground/VX-API VX-API is a C++ collection of functions implementing malicious functionality to aid in malware development, maintained by vx-underground. I… | 32 | 1949 | active |
| varnish/hitch Hitch is a scalable TLS/SSL termination proxy written in C by Varnish Software. It decrypts TLS connections and forwards unencrypted traffi… | 65 | 1944 | active |
| BasicProtein/AugmentCode-Free A Python-based maintenance toolkit that patches the AugmentCode extension across VS Code, Cursor, Windsurf, and JetBrains IDEs to enable un… | 34 | 1944 | active |
| editso/fuso Fuso is a lightweight, fast, cross-platform intranet penetration (NAT traversal) and port forwarding tool written in Rust. It supports mult… | 54 | 1943 | active |
| microsoft/openvmm OpenVMM is a modular, cross-platform Virtual Machine Monitor (VMM) written in Rust, developed by Microsoft. It also hosts OpenHCL, a paravi… | 93 | 1942 | active |
| ERC-4337 Account Abstraction reference implementation The reference implementation of ERC-4337 account abstraction for Ethereum, providing the singleton EntryPoint contract, base classes for sm… | 52 | 1942 | active |
| Xposed-Modules-Repo/com.luckyzyx.luckytool LuckyTool is a free Xposed module that extends and optimizes ColorOS-based Android systems (OPPO, OnePlus, Realme). It provides hundreds of… | 74 | 1941 | active |
| moul/sshportal sshportal is a transparent SSH bastion (jump host) server written in Go that manages users, hosts, and access control without requiring a t… | 66 | 1941 | active |
| SleepingBag945/dddd dddd is a Go-based batch information gathering and supply-chain vulnerability detection CLI tool designed to streamline red team workflows.… | 19 | 1937 | active |
| OP-TEE OP-TEE Trusted OS is the secure-world operating system implementation of the OP-TEE project, running on ARM TrustZone-enabled hardware. It … | 75 | 1935 | active |
| hackerschoice/gsocket Global Socket (gsocket) is a C-based toolkit that lets two machines behind NAT or firewalls establish secure, end-to-end encrypted TCP conn… | 63 | 1934 | active |
| deepfence/PacketStreamer PacketStreamer is a distributed, high-performance remote packet capture tool that runs lightweight sensors on target hosts to stream filter… | 10 | 1934 | active |
| JustasMasiulis/lazy_importer A header-only C++ library for resolving Windows DLL exports at runtime in a way that hides imports from static analysis tools. It uses comp… | 32 | 1930 | stable |
| bee-san/pyWhat pyWhat is a Python CLI tool that identifies what arbitrary text, files, or pcap network captures contain - emails, IP addresses, API keys, … | 67 | 7322 | maintenance |
| Sathvik-Rao/ClipCascade ClipCascade is a lightweight, open-source utility that automatically syncs the clipboard across multiple devices without any key press. It … | 70 | 1925 | active |
| nelmio/NelmioCorsBundle A Symfony bundle that adds Cross-Origin Resource Sharing (CORS) headers to responses with ACL-style per-URL configuration. It handles CORS … | 60 | 1925 | stable |
| fideloper/TrustedProxy A Laravel package that configures trusted proxies so applications behind load balancers or reverse proxies correctly interpret X-Forwarded … | 23 | 7304 | maintenance |
| Tuya Cloudcutter Tuya Cloudcutter is a Python-based toolchain that exploits a wireless vulnerability in Tuya smart devices using Beken BK7231 and Realtek ch… | 75 | 1919 | active |
| zarfadev/MobaXterm-Keygen A browser-based web tool that generates MobaXterm license key files (.mxtpro) and merges custom MobaXterm settings, running entirely client… | 69 | 1916 | active |
| aj3423/SpamBlocker SpamBlocker is an Android app that blocks spam calls and SMS messages without replacing your default call or messaging apps. It works as a … | 93 | 1915 | active |
| box4magisk A Magisk/KernelSU/APatch module that deploys proxy cores such as sing-box, clash/mihomo, v2ray, xray, and hysteria on rooted Android device… | 72 | 1914 | active |
| FGRibreau/mailchecker MailChecker is a cross-language library for validating email format and detecting temporary/disposable email addresses, backed by a databas… | 77 | 1913 | active |
| evildevill/instahack Instahack is a Bash and Python-based brute-force tool for testing Instagram account password strength, routing traffic through Tor for anon… | 58 | 1913 | active |
| Yurii0307/yurikey YuriKey is a systemless root module (for Magisk, APatch, KernelSU and forks) that helps rooted Android devices pass Google Play Integrity's… | 78 | 1911 | active |
| cisagov/cset CSET is a free desktop application from CISA and Idaho National Laboratory that guides organizations through step-by-step cybersecurity ass… | 87 | 1909 | active |
| atmoz/sftp A Docker image providing an easy-to-use SFTP server based on OpenSSH. Users can be defined via command arguments, environment variables, or… | 56 | 1909 | active |
| ECTO-1A/AppleJuice AppleJuice is a Python proof-of-concept tool that spoofs Apple BLE proximity pairing messages to trigger pairing popups on nearby Apple dev… | 29 | 1909 | active |
| sleeyax/burp-awesome-tls A Burp Suite extension that hijacks Burp's HTTP and TLS stack to spoof any browser's TLS fingerprint (JA3). It helps evade WAF bot detectio… | 87 | 1908 | active |
| netero1010/EDRSilencer A C-based Windows command-line tool that uses Windows Filtering Platform (WFP) APIs to block outbound traffic of running EDR agents, preven… | 17 | 1906 | active |
| joaoviictorti/RustRedOps RustRedOps is a collection of red team tools and technique implementations written in Rust, primarily targeting Windows. It provides workin… | 50 | 1904 | active |
| AdguardTeam/AdguardForAndroid AdGuard for Android is a system-wide content blocker for Android that blocks ads, trackers, and malvertising across browsers and apps. This… | 97 | 1903 | active |
| Dyneteq/reconya reconYa is a self-hosted network reconnaissance and asset discovery tool written in Go that scans local networks via ICMP, TCP, and ARP to … | 81 | 1902 | active |
| PolyHook PolyHook 2.0 is a C++20 library for hooking functions at runtime on x86 and x64 architectures. It supports multiple hooking techniques (inl… | 69 | 1902 | active |
| valqore/valqore Valqore is a deterministic infrastructure governance engine that scans Kubernetes manifests, Terraform, Helm, and cloud resources against 1… | 77 | 1900 | active |
| federicodotta/Brida Brida is a Burp Suite extension that bridges Burp Suite and Frida, letting testers invoke and manipulate an application's own methods while… | 43 | 1899 | active |
| Eugeny/russh Russh is a low-level, Tokio-based SSH2 client and server library for Rust, forked from Thrussh. It supports a wide range of ciphers, key ex… | 98 | 1898 | active |
| Rabby Wallet Rabby Wallet is an open-source browser extension wallet for Ethereum and all EVM-compatible chains, aimed at DeFi users. It injects a stand… | 93 | 1898 | active |
| anddea/revanced-patches ReVanced Extended (RVX) is a collection of patches for modifying Android apps, primarily YouTube, to add features like ad blocking, backgro… | 92 | 1897 | active |
| trustedsec/CS-Situational-Awareness-BOF A collection of situational awareness commands implemented as Cobalt Strike Beacon Object Files (BOFs) in C, letting operators run low-foot… | 97 | 1896 | active |
| devploit/nomore403 NoMore403 is a Go command-line tool that automates testing of HTTP 401/403 access-control bypasses via request path, method, header, and wi… | 81 | 1894 | active |
| cifertech/RF-Clown RF-Clown is an open-source BLE and Bluetooth jammer built on ESP32 and multiple nRF24L01 radio modules, with an OLED display, NeoPixel feed… | 60 | 1894 | active |
| nsonaniya2010/SubDomainizer SubDomainizer is a Python CLI tool that discovers hidden subdomains and secrets in webpages, external JavaScript files, GitHub, and local f… | 65 | 1893 | active |
| web-push-libs/web-push-php A PHP library implementing the Web Push protocol (RFC 8030) for sending push notifications to browsers via service workers. It handles subs… | 88 | 1892 | active |
| liamg/traitor Traitor is a Go-based CLI tool that automatically exploits common Linux misconfigurations and known vulnerabilities (GTFOBins, pwnkit, dirt… | 23 | 7161 | maintenance |
| younesaassila/ttv-lol-pro TTV LOL PRO is a browser extension that removes most livestream ads from Twitch by routing streams through standard HTTP proxies. It is a f… | 78 | 1889 | active |
| pentestfunctions/BlueDucky BlueDucky is a Python tool that exploits CVE-2023-45866, an unauthenticated Bluetooth peering vulnerability, to execute keystroke injection… | 53 | 1885 | active |
| srixivas/PcapXray PcapXray is a Python-based network forensics tool that visualizes PCAP files or live traffic as an annotated network diagram. It identifies… | 78 | 1884 | active |
| Chleba/netscanner netscanner is a terminal-based network scanner and diagnostic tool with a modern TUI, written in Rust. It supports WiFi network scanning, C… | 73 | 1884 | active |
| sarperavci/GoogleRecaptchaBypass A Python library that automatically solves Google reCAPTCHA v2 challenges in under five seconds using browser automation with DrissionPage … | 65 | 1883 | active |
| zhlynn/zsign zsign is a fast, cross-platform open-source alternative to Apple's codesign tool for re-signing iOS .ipa packages, Mach-O binaries, and .ap… | 92 | 1882 | active |
| abc123info/BlueTeamTools BlueTeamTools is a Java-based GUI toolbox that aggregates utilities for blue-team security analysts, covering memory-shell decompilation, w… | 85 | 1882 | active |
| tls-client A Go HTTP client library with a net/http-like interface that lets you select specific browser TLS fingerprints (Chrome, Firefox, Safari, et… | 90 | 1879 | active |
| jazzband/django-two-factor-auth A Django package providing complete two-factor authentication built on top of django-otp and Django's built-in auth framework. It supports … | 79 | 1879 | active |
| Symfony Security The core library of the Symfony Security component, providing infrastructure for authentication tokens, user providers, role hierarchies, a… | 93 | 1877 | stable |
| emsec/ChameleonMini ChameleonMini is a freely programmable, portable NFC device that can emulate and clone contactless smartcards, read RFID tags, and sniff/lo… | 23 | 1877 | active |
| sbabic/swupdate SWUpdate is a Linux update agent for safely updating embedded Linux devices in the field, supporting local and OTA updates with multiple st… | 81 | 1876 | stable |
| initstring/linkedin2username A Python OSINT tool that scrapes LinkedIn employee lists for a target company and generates multiple probable username formats (e.g., first… | 70 | 1876 | active |
| airbus-seclab/bincat BinCAT is a static binary code analysis toolkit that performs value analysis, taint analysis, type reconstruction, and use-after-free/doubl… | 23 | 1876 | active |
| essensoft/paylinks Paylinks is a modern .NET SDK for integrating third-party payment platforms, supporting Alipay and WeChat Pay with cross-platform and multi… | 58 | 1875 | active |
| tanrax/maza-ad-blocking Maza is a local ad blocker written as a single Bash script that blocks ads at the DNS level by editing the operating system's hosts file, w… | 72 | 1872 | active |
| niklasb/libc-database A shell-based tool that builds a searchable database of libc symbol offsets from Ubuntu, Debian, and other distributions to simplify binary… | 72 | 1872 | active |
| lazaronixon/authentication-zero A Rails generator that scaffolds a complete, pre-built authentication system directly into a Rails application (web or API-only), following… | 34 | 1872 | active |
| iliyami/MacSai Mac Sai is a free, open-source macOS application that cleans junk files, scans for malware, uninstalls apps completely, and visualizes disk… | 82 | 1870 | active |
| Sourcery Sourcery is an AI-powered automated code review service that reviews pull requests on GitHub and GitLab, posting summaries, inline comments… | 96 | 1869 | active |
| DosX-dev/obfus.h A macro-only C header library that obfuscates code at compile time, designed for the Tiny C Compiler on Windows x86/x64. It provides contro… | 70 | 1867 | active |
| ninoseki/mitaka Mitaka is a browser extension for Chrome and Firefox that simplifies OSINT (Open Source Intelligence) searches. It automatically detects an… | 91 | 1864 | active |
| 0xKayala/NucleiFuzzer NucleiFuzzer is a Python-based automation tool that combines URL discovery tools (ParamSpider, Waybackurls, Gauplus, Hakrawler, Katana) wit… | 63 | 1863 | active |
| trustedsec/hate_crack hate_crack is a Python tool by TrustedSec that automates password cracking methodologies on top of Hashcat, orchestrating wordlists, masks,… | 93 | 1862 | active |
| alfiecg24/TrollInstallerX TrollInstallerX is a universal TrollStore installer for iOS 14.0 through 16.6.1, supporting both arm64 and arm64e devices. It uses the kfd … | 16 | 1861 | active |
| superagent-ai/vibekit VibeKit is a CLI tool that wraps AI coding agents such as Claude Code, Gemini CLI, Grok CLI, and Codex in isolated Docker sandboxes with au… | 46 | 1860 | active |
| complexorganizations/wireguard-manager A shell-based tool that automates the installation, configuration, and management of WireGuard VPN servers. It provides a user-friendly way… | 45 | 1860 | active |
| nix-community/lanzaboote Lanzaboote is Rust tooling that brings UEFI Secure Boot and Measured Boot support to NixOS. Its lzbt tool signs boot components, builds Uni… | 80 | 1858 | active |
| selinuxG/Golin Golin is a Go-based security assessment tool combining asset discovery, port/service scanning, weak password brute-forcing for 40+ services… | 62 | 1856 | active |
| j3ssie/metabigor Metabigor is a Go-based command-line OSINT tool that maps a target's infrastructure—IP ranges, subdomains, related domains, open ports, and… | 80 | 1853 | active |
| Automattic/jetpack Jetpack is a suite of WordPress plugins and packages providing security, performance, marketing, and site-management tools for WordPress si… | 68 | 1850 | active |
| DroidPluginTeam/DroidPlugin DroidPlugin is an Android plugin framework that lets a host app run any third-party APK without installation, modification, or repackaging.… | 23 | 6972 | maintenance |
| iRedMail iRedMail is an open source, full-featured mail server solution that installs and configures SMTP, IMAP/POP3, webmail (Roundcube/SOGo), and … | 77 | 1848 | active |
| anhskohbo/no-captcha A Laravel package integrating Google's No CAPTCHA reCAPTCHA into forms. It provides Blade helpers for rendering the widget and a validation… | 63 | 1848 | active |
| mailvelope/mailvelope Mailvelope is a browser extension for Chrome and Firefox that adds OpenPGP end-to-end email encryption to arbitrary webmail providers. It u… | 85 | 1847 | active |
| Tencent/CodeAnalysis Tencent Cloud Code Analysis (TCA, code-named CodeDog) is a self-hosted static code analysis platform consisting of server, web, and client … | 42 | 1847 | active |
| sniptt-official/ots OTS is a Go CLI tool for sharing end-to-end encrypted secrets (API keys, passwords, signing secrets) via one-time URLs. Secrets are destroy… | 34 | 1845 | active |
| LoseNine/ruyipage RuyiPage is a Python browser automation framework built on Firefox and the WebDriver BiDi protocol, shipping with an anti-detection Firefox… | 82 | 1844 | active |
| scipag/HardeningKitty HardeningKitty is a PowerShell module that audits and hardens Windows system configurations against a predefined finding list. It reads reg… | 77 | 1844 | active |
| Jrohy/multi-v2ray A Python-based management script for deploying and administering multi-user V2Ray/Xray proxy servers on Linux. It provides a wizard-driven … | 23 | 6944 | maintenance |
| enetx/surf Surf is an advanced HTTP client library for Go with fluent, chainable API design. It supports browser impersonation (Chrome/Firefox), JA3/J… | 81 | 1840 | active |
| hacl-star/hacl-star HACL* is a formally verified cryptographic library written in F* (Low*) and compiled to efficient standalone C code, covering algorithms li… | 58 | 1840 | active |
| trezor/trezor-firmware The official open-source firmware monorepo for Trezor hardware wallets, containing firmware for Trezor One and Trezor T/Safe devices, a sta… | 76 | 1837 | active |
| bvcyber/CVE-2020-1472 A Python CLI script that tests domain controllers for the ZeroLogon vulnerability (CVE-2020-1472) using the Impacket library. It attempts t… | 41 | 1837 | stable |
| pirxthepilot/wtfis wtfis is a Python command-line tool that performs passive lookups of hostnames, domains, and IP addresses using OSINT services like VirusTo… | 72 | 1836 | active |
| pandasec888/taowu-cobalt_strike Taowu is a red team automation plugin (Aggressor script) for the Cobalt Strike platform, bundling a large collection of post-exploitation m… | 52 | 1836 | active |
| OpenAEV-Platform/openaev OpenAEV is an open-source platform for planning, scheduling, and running cyber adversary simulation campaigns and security exercises, from … | 95 | 1834 | active |
| any1/wayvnc wayvnc is a VNC server for wlroots-based Wayland compositors such as sway. It attaches to a running Wayland session, exposes the display vi… | 93 | 1834 | active |
| 78778443/QingScan QingScan is a self-hosted, open-source security operations platform that unifies vulnerability scanning, code auditing, asset inventory, an… | 62 | 1831 | active |
| HMBSbige/ShadowsocksR-Android A ShadowsocksR proxy client for Android written in Kotlin, forked from the shadowsocks-android codebase. It lets Android users route traffi… | 10 | 1830 | active |
| White-hua/Apt_t00ls A Java-based exploitation tool that aggregates proof-of-concept and weaponized exploits for high-severity vulnerabilities in Chinese enterp… | 23 | 1828 | active |
| nilsteampassnet/TeamPass TeamPass is a free, self-hosted collaborative password manager written in PHP/MySQL, offering folder-level access control, AES-256-GCM auth… | 92 | 1827 | active |
| HoShiMin/Kernel-Bridge Kernel-Bridge is a C++20 Windows kernel driver template, development framework, and kernel-mode API with wrappers, including a hypervisor s… | 23 | 1827 | active |
| Tai-e Tai-e is an easy-to-learn, developer-friendly static analysis framework for Java and Android programs, offering pointer analysis, taint ana… | 82 | 1825 | active |
| MatheuZSecurity/Singularity Singularity is a stealthy Linux kernel module (LKM) rootkit targeting modern 6.x kernels, using ftrace-based syscall hooking to hide proces… | 62 | 1825 | active |