Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| upspin/upspin Upspin is an experimental framework of protocols and reference implementations providing a secure, global naming system for sharing files a… | 43 | 6405 | maintenance |
| Pentest AI pentest-ai is an MIT-licensed local CLI and MCP server that turns Claude Code (or any LLM) into an offensive security assistant, pairing 50… | 79 | 1717 | active |
| nix-community/nix-ld nix-ld is a shim dynamic linker that lets unpatched precompiled Linux binaries run on NixOS by installing itself at the conventional loader… | 69 | 1717 | active |
| Rob--W/crxviewer A browser add-on and web app for viewing the source code of Chrome, Firefox, Opera, Edge, and Thunderbird extensions without installing the… | 74 | 1716 | active |
| lasting-yang/frida_hook_libart A collection of Frida hook scripts for intercepting Android ART JNI functions, most notably RegisterNatives. It reveals native method regis… | 50 | 1716 | active |
| kdrag0n/safetynet-fix A Magisk module (Zygisk-based, with an older Riru version) that works around Google's SafetyNet and Play Integrity hardware attestation che… | 23 | 6387 | maintenance |
| Safe3/uusec-waf UUSEC WAF is a free, high-performance web application firewall and API security gateway (WAAP) that combines AI/semantic detection engines … | 95 | 1715 | active |
| openappsec/openappsec open-appsec is an open-source machine learning security engine that provides preemptive web application and API threat protection against O… | 90 | 1715 | active |
| MorDavid/BruteForceAI BruteForceAI is a Python-based penetration testing tool that uses LLMs (via Ollama or Groq) to automatically analyze login page HTML and id… | 56 | 1715 | active |
| keepassium/KeePassium KeePassium is a KeePass-compatible password manager app for iOS and macOS, written in Swift. It supports all KeePass database formats (kdb,… | 68 | 1714 | active |
| trailofbits/buttercup Buttercup is a Cyber Reasoning System (CRS) developed by Trail of Bits for the DARPA AI Cyber Challenge that automatically finds and patche… | 56 | 1714 | active |
| dolevf/Damn-Vulnerable-GraphQL-Application Damn Vulnerable GraphQL Application (DVGA) is an intentionally insecure GraphQL service built for learning and practicing GraphQL security … | 30 | 1714 | active |
| project-copacetic/copacetic Copa (Project Copacetic) is a Go CLI tool built on BuildKit that directly patches OS package vulnerabilities in container images without re… | 91 | 1712 | active |
| elasticdog/transcrypt A single Bash script that configures transparent encryption of sensitive files in a Git repository using Git's clean/smudge filters and Ope… | 74 | 1712 | stable |
| AdguardTeam/AdguardForiOS AdGuard for iOS is an open-source ad-blocking and privacy app for iPhone and iPad that blocks ads in Safari via content blocking rules. It … | 93 | 1711 | active |
| mganss/HtmlSanitizer A .NET library for cleaning HTML fragments and documents of constructs that can lead to XSS attacks, built on the AngleSharp parser. It is … | 97 | 1710 | active |
| pgaudit/pgaudit pgAudit is a PostgreSQL extension written in C that provides detailed session and object audit logging through the standard PostgreSQL logg… | 74 | 1709 | stable |
| hasherezade/tiny_tracer A Pin Tool built on Intel Pin for dynamic binary instrumentation that traces API calls, syscalls, selected instructions, and section transi… | 74 | 1709 | active |
| dafthack/MFASweep MFASweep is a PowerShell script that attempts to log in to multiple Microsoft services with provided credentials to detect whether MFA is e… | 63 | 1709 | active |
| ErwinM/acts_as_tenant A Ruby gem that adds fail-safe row-level multi-tenancy to Ruby on Rails applications using a shared database. It scopes models to a current… | 98 | 1708 | active |
| SiriusScan/Sirius Sirius is an open-source vulnerability scanner that automates network discovery via Nmap and performs CVE-based detection with CVSS scoring… | 82 | 1707 | active |
| S3cur3Th1sSh1t/PowerSharpPack PowerSharpPack wraps many useful offensive C# security projects (Seatbelt, Rubeus, SharpUp, winPEAS, etc.) into PowerShell scripts for easy… | 36 | 1707 | active |
| Moustachauve/cookie-editor Cookie-Editor is an open-source browser extension for creating, editing, deleting, importing and exporting cookies on the current tab. It w… | 64 | 1705 | active |
| inverse-inc/packetfence PacketFence is a free and open source network access control (NAC) solution with a captive portal for registration and remediation, 802.1X … | 86 | 1704 | stable |
| roothide/Bootstrap A full-featured bootstrap (package manager environment) for jailbroken iOS 15.0-17.0 on A8-A17 Pro and M1/M2 devices using the roothide jai… | 79 | 1704 | active |
| webprofusion/certify Certify The Web is an ACME v2 certificate management application with a Windows desktop UI and background renewal service, plus a cross-pla… | 76 | 1704 | stable |
| Gerenios/AADInternals AADInternals is a PowerShell module for administering and hacking Entra ID (Azure AD), Office 365, and related endpoints. It includes tools… | 48 | 1703 | active |
| Bromite Bromite is a Chromium fork for Android with a built-in ad-blocking engine and privacy enhancements such as anti-fingerprinting flags, DNS-o… | 23 | 6319 | maintenance |
| jazzband/django-axes django-axes is a Django plugin that tracks failed login attempts and blocks brute-force attacks on Django-powered sites. It supports monito… | 93 | 1699 | stable |
| duo-labs/cloudmapper CloudMapper is a tool for analyzing Amazon Web Services (AWS) environments, originally built to generate interactive network diagrams in th… | 23 | 6287 | maintenance |
| raodv/captcha AjPlus Captcha is an open-source behavioral CAPTCHA library providing sliding puzzle and click-word verification challenges with frontend U… | 35 | 1693 | active |
| BC-SECURITY/Starkiller Starkiller is a web-based graphical frontend for PowerShell Empire, a post-exploitation C2 framework. It is written in VueJS and ships prep… | 91 | 1692 | active |
| ellermister/mtproxy A one-click shell script and Docker image for installing MTProxy (MTProto proxy) with Fake TLS disguise for Telegram clients. It fronts MTP… | 70 | 1692 | active |
| BigBoiCJ/SteamAutoCracker An open-source Python tool with a GUI that automatically removes Steam DRM from games by configuring Steam emulators and applying Steamless… | 23 | 1692 | active |
| wireghoul/graudit graudit is a shell-based source code auditing tool that uses GNU grep with signature databases of extended regular expressions to find pote… | 91 | 1691 | active |
| whwlsfb/JDumpSpider JDumpSpider is a Java CLI tool that extracts sensitive information (datasource credentials, config properties, Redis configs, Shiro keys, u… | 66 | 1690 | active |
| Forward Email Forward Email is a 100% open-source, privacy-focused email service providing free email forwarding for custom domains, plus outbound SMTP, … | 95 | 1686 | active |
| miscusi-peek/cheatengine-mcp-bridge A bridge that connects AI coding assistants (Claude, Cursor, Copilot) to Cheat Engine via the Model Context Protocol, letting agents read/w… | 57 | 1684 | active |
| B16f00t/whapa Whapa is a Python-based forensic toolset for parsing and analyzing WhatsApp databases from Android and iOS devices. It includes tools for d… | 71 | 1683 | active |
| KeenSecurityLab/BinAbsInspector BinAbsInspector is a static analyzer for automated reverse engineering and vulnerability scanning in binaries, built on abstract interpreta… | 23 | 1682 | active |
| php-cors A Laravel package that adds Cross-Origin Resource Sharing (CORS) headers support via middleware, handling pre-flight OPTIONS requests and c… | 10 | 6226 | maintenance |
| vladko312/SSTImap SSTImap is a Python-based penetration testing tool that automatically detects and exploits Server-Side Template Injection (SSTI) and code i… | 82 | 1679 | active |
| NoDPI NoDPI is a Python utility that bypasses Deep Packet Inspection (DPI) censorship by running a local proxy server that fragments TLS ClientHe… | 78 | 1679 | active |
| secluso/core Secluso is an open-source, privacy-preserving home security camera system built for Raspberry Pi, featuring end-to-end encrypted remote acc… | 69 | 1678 | active |
| sickcodes/osx-serial-generator A shell-based tool that generates valid macOS serial numbers, UUIDs, and board serials for use with OpenCore, OSX-KVM, and Docker-OSX. It i… | 34 | 1678 | stable |
| fire-keeper/BlindWatermark A Python library and CLI/GUI tool that embeds invisible blind watermarks into images using discrete wavelet transforms, protecting creators… | 23 | 1678 | active |
| reek/anti-adblock-killer Anti-Adblock Killer is a userscript (AakScript) plus an AdBlock-style filter list (AakList) that together prevent websites from detecting a… | 23 | 6214 | maintenance |
| freeotp/freeotp-android FreeOTP is an open-source two-factor authentication app for Android that generates one-time passwords using the HOTP and TOTP standards. To… | 74 | 1676 | active |
| mikespook/gorbac goRBAC is a lightweight role-based access control (RBAC) library for Go, supporting many-to-many role/permission mappings and hierarchical … | 61 | 1676 | active |
| dirkjanm/krbrelayx A Python toolkit for abusing Kerberos in Active Directory environments, including Kerberos relaying and unconstrained delegation attacks. I… | 61 | 1676 | active |
| Asuswrt-Merlin Asuswrt-Merlin is an enhanced third-party firmware for Asus routers, based on Asus's stock Asuswrt firmware, focusing on bug fixes, tweaks,… | 75 | 6207 | maintenance |
| hyprwm/hyprlock hyprlock is a GPU-accelerated, multi-threaded screen locking utility built for the Hyprland Wayland compositor. It uses the ext-session-loc… | 84 | 1674 | active |
| WangYihang/GitHacker GitHacker is a multi-threaded Python CLI tool that exploits exposed `.git` directories on web servers to reconstruct the entire Git reposit… | 75 | 1673 | active |
| rebeyond/Behinder Behinder ('冰蝎') is a cross-platform Java client for managing encrypted webshells on compromised web servers running PHP, Java, or .NET. It … | 23 | 6199 | maintenance |
| michenriksen/gitrob Gitrob is a Go-based reconnaissance tool that scans GitHub users' and organizations' public repositories for potentially sensitive files by… | 10 | 6197 | maintenance |
| projectdiscovery/shuffledns shuffleDNS is a Go wrapper around massDNS for fast active subdomain enumeration via bruteforce and DNS resolution with smart wildcard filte… | 82 | 1672 | active |
| cddmp/enum4linux-ng enum4linux-ng is a Python rewrite of the enum4linux.pl Windows/Samba enumeration tool, wrapping Samba utilities like nmblookup, net, rpccli… | 69 | 1672 | active |
| bee-san/Name-That-Hash Name That Hash is a Python CLI tool and web app that identifies the type of an unknown hash string, supporting 300+ hash types like MD5 and… | 45 | 1672 | active |
| Lozy/danted A shell script that automates installing and configuring the Dante SOCKS5 proxy server on Linux systems, with Docker support. It auto-detec… | 32 | 1672 | active |
| FairwindsOps/rbac-manager RBAC Manager is a Kubernetes operator that simplifies authorization management by allowing declarative configuration of Role Bindings and S… | 91 | 1670 | active |
| kenryu42/cc-safety-net CC Safety Net is a pre-execution hook for AI coding agent CLIs (Claude Code, Codex, Cursor, Gemini CLI, and many others) that blocks destru… | 80 | 1669 | active |
| scito/extract_otp_secrets A Python CLI tool that extracts one-time password (TOTP/HOTP) secrets from QR codes exported by two-factor authentication apps like Google … | 89 | 1668 | active |
| Mpush An Xposed/LSPosed module written in Java that lets Firebase Cloud Messaging (FCM/GCM) wake fully stopped Android apps so push notifications… | 80 | 1668 | active |
| zama-ai/tfhe-rs TFHE-rs is a pure Rust implementation of the TFHE fully homomorphic encryption scheme, enabling boolean and integer arithmetic over encrypt… | 97 | 1667 | active |
| klezVirus/SysWhispers3 SysWhispers3 is a Python command-line tool that generates header and assembly (ASM) file pairs for direct system calls to the Windows kerne… | 32 | 1667 | active |
| 0xdea/frida-scripts A collection of Frida instrumentation scripts for reverse engineering mobile apps and native binaries, including tracers and enumerators fo… | 74 | 1666 | active |
| slackhq/go-audit go-audit is a Go-based replacement for the auditd daemon that consumes Linux kernel audit events via netlink and outputs them as JSON. It s… | 81 | 1665 | active |
| zhaodice/qemu-anti-detection A collection of patches for various QEMU versions that modify emulator-reported data (device names, serial numbers, UEFI VM bit, BGRT) to p… | 54 | 1665 | active |
| Air14/HyperHide HyperHide is a hypervisor-based anti-anti-debug plugin for x64dbg/x32dbg that hides debuggers from detection. It uses Intel EPT to hook sys… | 23 | 1664 | active |
| longld/peda PEDA is a Python plugin for GDB that enhances the debugger's display and adds exploit development commands. It provides colorized disassemb… | 23 | 6157 | maintenance |
| tabby-sec/tabby Tabby is a Java static code analysis tool built on the Soot framework that converts JAR/WAR/CLASS files into a code property graph stored i… | 47 | 1661 | active |
| summitt/Nope-Proxy NoPE Proxy is a Burp Suite extension that adds TCP and UDP traffic interception, a configurable DNS server, and a non-HTTP man-in-the-middl… | 23 | 1660 | active |
| coral-xyz/backpack Backpack is an open-source crypto wallet browser extension built in TypeScript, serving as a home for xNFTs and supporting Solana, Ethereum… | 23 | 1660 | active |
| WangYihang/Platypus Platypus is a cross-platform reverse-shell and host management hub written in Go. Agents on managed machines dial back to a central server … | 68 | 1659 | active |
| C0nw0nk/Nginx-Lua-Anti-DDoS A Lua-based Anti-DDoS script for Nginx that presents a Cloudflare-style JavaScript authentication puzzle to filter out bots and mitigate La… | 98 | 1658 | active |
| tevador/RandomX RandomX is a proof-of-work algorithm optimized for general-purpose CPUs that uses random code execution and memory-hard techniques to resis… | 89 | 1655 | stable |
| x-falcon/Virtual-Hosts An Android app that lets users customize the hosts file on their device without root access by implementing a local VPN service. It support… | 46 | 1655 | active |
| geiger-rs/cargo-geiger cargo-geiger is a cargo plugin that scans a Rust crate and its dependency tree to report statistics on unsafe Rust code usage. It provides … | 88 | 1653 | active |
| OWASP Threat Dragon OWASP Threat Dragon is a free, open-source, cross-platform threat modeling application for drawing data flow diagrams and listing threats f… | 87 | 1653 | active |
| ScopeSentry ScopeSentry is a self-hosted attack surface and asset mapping platform that combines subdomain enumeration, port scanning, fingerprinting, … | 83 | 1653 | active |
| veinmind veinmind-tools is a container security toolkit by Chaitin Tech built on the veinmind-sdk, providing scanners for malicious files, weak pass… | 23 | 1653 | active |
| whwlsfb/BurpCrypto BurpCrypto is a Burp Suite extension that encrypts Intruder payloads with algorithms like AES, RSA, and DES, or by executing arbitrary Java… | 23 | 1652 | active |
| rust-openssl/rust-openssl Rust bindings to the OpenSSL cryptography and TLS library, exposing its APIs (certificates, keys, hashing, SSL/TLS connections) to Rust pro… | 92 | 1650 | stable |
| shekyan/slowhttptest SlowHTTPTest is a highly configurable command-line tool that simulates Application Layer Denial of Service attacks by prolonging HTTP conne… | 84 | 1650 | active |
| AltraMayor/gatekeeper Gatekeeper is the first open-source DDoS protection system, built on DPDK for high-performance packet processing. It uses a geographically … | 66 | 1649 | active |
| zardus/preeny Preeny is a collection of LD_PRELOAD libraries written in C that help with binary exploitation and CTF-style challenges. It disables functi… | 64 | 1649 | active |
| mssun/passforios Pass for iOS is an iOS password manager client compatible with ZX2C4's Pass command line application. It encrypts password entries with GPG… | 74 | 1645 | active |
| fabiocaccamo/FCUUID An Objective-C iOS library providing universally unique identifiers with different persistence levels (session, installation, device, user)… | 54 | 1644 | stable |
| AdGuard Home For Android (Magisk Module) A Magisk module that runs AdGuard Home on rooted Android devices to block ads by redirecting and filtering DNS requests. It ships with buil… | 87 | 1638 | active |
| YanCchen/YCursor YCursor is a free desktop GUI tool for Windows and macOS that automates resetting Cursor IDE machine IDs and auto-registering new trial acc… | 33 | 1638 | active |
| ADD-SP/ngx_waf ngx_waf is a high-performance Nginx firewall module written in C that provides web application firewall capabilities. It is compatible with… | 66 | 1635 | active |
| monkeyWie/proxyee Proxyee is a Java library built on Netty that implements an HTTP proxy server supporting HTTP, HTTPS, and WebSocket protocols. It provides … | 26 | 1635 | active |
| SELinuxProject/selinux The upstream userspace repository for Security Enhanced Linux (SELinux), providing the libraries and tools that complement SELinux support … | 84 | 1634 | stable |
| illera88/Ponce Ponce is an IDA Pro plugin that adds one-click symbolic execution and taint analysis over binaries, built on the Triton engine and written … | 31 | 1634 | active |
| AfterShip/email-verifier A Go library for verifying email addresses without sending any emails. It validates syntax, checks DNS MX records, performs SMTP verificati… | 84 | 1633 | active |
| outtable/confuse-9live A macOS GUI application (distributed as a DMG, not source code) that obfuscates iOS app binaries and resources to bypass App Store review i… | 76 | 1633 | active |
| cathugger/mkp224o mkp224o is a C command-line tool that generates vanity ed25519 onion service (Tor hidden service v3) addresses by brute-forcing keypairs ma… | 23 | 1632 | active |
| jakehildreth/Locksmith Locksmith is a PowerShell module and script that audits Active Directory Certificate Services (AD CS) for common misconfigurations. It can … | 73 | 1630 | active |
| ultrasecurity/Storm-Breaker Storm-Breaker is a social engineering tool that generates phishing-style web pages to capture device information, location, webcam, and mic… | 32 | 6009 | maintenance |
| WireGuard/wireguard-android The official Android GUI application for WireGuard, a fast and modern VPN. It opportunistically uses the in-kernel WireGuard implementation… | 69 | 1628 | stable |