Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Heimdall Heimdall is a Rust-based EVM smart contract toolkit for bytecode analysis, decompilation, disassembly, control flow graph generation, stora… | 87 | 1627 | active |
| kkHAIKE/fake115 A Tampermonkey userscript that disguises the browser as the official 115 client to bypass login and download restrictions on the 115 cloud … | 64 | 1625 | active |
| hashcat/hashcat-utils A collection of small standalone C utilities that assist with advanced password cracking tasks, complementing the hashcat tool. Each utilit… | 42 | 1625 | active |
| Jelmerro/Vieb Vieb is a free, open-source web browser built on Electron/Chromium that provides Vim-style modal keyboard bindings for navigating the web. … | 86 | 1624 | active |
| nikaiw/VMkatz VMkatz is a Rust CLI tool that extracts Windows credentials (NTLM hashes, DPAPI keys, Kerberos tickets, LSA secrets, BitLocker keys) direct… | 81 | 1624 | active |
| alexazhou/VeryNginx VeryNginx is an enhanced Nginx distribution built on lua-nginx-module (OpenResty) that adds a web application firewall, request routing, ra… | 23 | 5979 | maintenance |
| wiredoor/wiredoor Wiredoor is a self-hosted ingress-as-a-service platform that exposes services running in private or local networks to the internet via reve… | 85 | 1622 | active |
| coffinxp/loxs Loxs is a Python-based multi-vulnerability scanner for web applications that detects SQL injection, XSS, LFI, open redirect, and CRLF injec… | 46 | 1622 | active |
| Proton Mail Proton Mail's official iOS client for end-to-end encrypted email, written in Swift/SwiftUI with core business logic in a Rust-based SDK. Th… | 63 | 1620 | active |
| SecurityRiskAdvisors/VECTR VECTR is a self-hosted web application for tracking red and blue team testing activities to measure detection and prevention capabilities a… | 92 | 1618 | active |
| uber/ADR ADR (Agentic AI Detection and Response) is an open-source enterprise security framework for AI agents, providing endpoint discovery of AI t… | 66 | 1618 | active |
| michenriksen/aquatone Aquatone is a Go CLI tool for visual inspection of websites across many hosts, taking screenshots via headless Chrome/Chromium and generati… | 10 | 5956 | maintenance |
| attify/firmware-analysis-toolkit Firmware Analysis Toolkit (FAT) is a Python-based automation wrapper around Firmadyne that emulates IoT and embedded device firmware images… | 99 | 1615 | active |
| DuendeSoftware/products Duende Products is a suite of identity and access management SDKs for ASP.NET Core, centered on Duende IdentityServer, a standards-complian… | 95 | 1614 | stable |
| Orange-Cyberdefense/ocd-mindmaps A collection of interactive mindmaps from Orange Cyberdefense covering offensive security and penetration testing methodologies, published … | 33 | 1614 | active |
| fofapro/fapro FaPro is a free, cross-platform, single-file mass network protocol server simulator written in Python. It can start or stop many fake netwo… | 23 | 1614 | active |
| miniupnp/miniupnp MiniUPnP is a lightweight ANSI C implementation of the UPnP Internet Gateway Device (IGD) specifications, comprising a client library (mini… | 96 | 1612 | stable |
| FossifyOrg/Messages Fossify Messages is an open-source Android SMS/MMS messenger app with no ads or tracking. It supports group messaging, spam blocking, messa… | 100 | 1611 | stable |
| ReaJason/MemShellParty MemShellParty is a self-hosted, visual tool for rapidly generating Java memory shells (fileless webshells) for mainstream web middleware an… | 88 | 1610 | active |
| repplus/rep-chrome rep+ is a Chrome DevTools extension inspired by Burp Suite's Repeater that captures and replays HTTP requests with modified methods, header… | 48 | 1610 | active |
| liamg/gitjacker Gitjacker is a Go CLI tool that downloads and reconstructs git repositories from websites where the .git directory has been mistakenly expo… | 44 | 1610 | active |
| ankane/lockbox Lockbox is a Ruby gem providing modern encryption for database fields, files, and strings in Ruby and Rails applications. It integrates wit… | 75 | 1609 | stable |
| FireHOL FireHOL is a Linux firewall management tool built on iptables/ipsets, paired with a repository of IP blocklists dynamically updated via the… | 52 | 1604 | active |
| Heads Heads is an open-source firmware and OS configuration that runs a minimal Linux as a coreboot or LinuxBoot ROM payload, moving the root of … | 68 | 1602 | active |
| KindleModding/WinterBreak WinterBreak is a jailbreak tool for Amazon Kindle e-readers, built on top of the Mesquito framework. It allows users to unlock their Kindle… | 81 | 1601 | active |
| ReVanced ReVanced Manager is an Android application for applying patches to other apps, continuing the legacy of Vanced. It lets users customize the… | 67 | 1600 | active |
| PentestPad/subzy Subzy is a Go-based command-line tool that checks subdomains for takeover vulnerabilities by matching HTTP response fingerprints from the c… | 32 | 1597 | active |
| libssh2/libssh2 libssh2 is a client-side C library implementing the SSH2 protocol, licensed under the revised BSD license. It provides session establishmen… | 68 | 1596 | stable |
| dyne/tomb Tomb is a minimalist command-line tool for GNU/Linux that creates and manages encrypted storage folders ('tombs') using dm-crypt and LUKS v… | 54 | 1596 | stable |
| xnl-h4ck3r/xnLinkFinder xnLinkFinder is a Python CLI tool that discovers endpoints, potential parameters, target-specific wordlists, and secrets for a given target… | 71 | 1594 | active |
| s0md3v/uro uro is a Python CLI tool that declutters URL lists for crawling and security testing without making any HTTP requests. It removes duplicate… | 26 | 1594 | stable |
| StamusNetworks/Clear-NDR-ISO Clear NDR Community (formerly SELKS) is a Debian-based Linux distribution for network detection and response built around Suricata, OpenSea… | 38 | 1592 | active |
| LeeeSe/MessAuto MessAuto is a free macOS menu bar application, built in Rust, that automatically extracts SMS and email verification codes from the built-i… | 64 | 1590 | active |
| gurnec/btcrecover btcrecover is an open-source Python command-line tool for recovering Bitcoin (and altcoin) wallet passwords and seed phrases when most of t… | 32 | 1589 | active |
| OWASP/crAPI crAPI (completely ridiculous API) is an intentionally vulnerable web application built by OWASP to demonstrate the OWASP API Security Top 1… | 65 | 1588 | active |
| samwafgo/SamWaf SamWaf is a lightweight, open-source web application firewall (WAF) written in Go, designed for small companies, studios, and personal webs… | 90 | 1587 | active |
| cyberark/FuzzyAI FuzzyAI is an automated LLM fuzzing tool from CyberArk that tests LLM APIs for jailbreak vulnerabilities. It ships as a Python CLI with a w… | 48 | 1587 | active |
| DimensionDev/Maskbook Mask Network is a browser extension that bridges Web2 social media platforms (X, Facebook, Instagram, Minds, Mirror) with Web3 services. It… | 97 | 1586 | active |
| nzymeorg/nzyme Nzyme is an open-source intrusion detection system that monitors WiFi, Bluetooth, and Ethernet networks for threats such as rogue access po… | 79 | 1586 | active |
| ZimengXiong/tinyTouch tinyTouch is an open-source DIY hardware and software project that lets you authenticate, sudo, and log in to your computer with a fingerpr… | 79 | 1584 | active |
| SimpleMobileTools/Simple-File-Manager Simple File Manager is an open-source, ad-free file and folder manager app for Android devices built in Kotlin. It offers file operations l… | 23 | 1583 | stable |
| Waujito/youtubeUnblock A C-based tool that bypasses YouTube's SNI-based detection systems, originally created to work around YouTube throttling in Russia. It runs… | 74 | 1582 | active |
| mukul975/cve-mcp-server A Python-based Model Context Protocol (MCP) server that gives Claude ~28 security intelligence tools across 20+ APIs, including CVE lookup,… | 70 | 1582 | active |
| zama-ai/concrete Concrete is an open-source fully homomorphic encryption (FHE) compiler built on TFHE and LLVM that converts Python programs into their FHE … | 52 | 1580 | active |
| nccgroup/PMapper Principal Mapper (PMapper) is a Python CLI tool and library that models AWS IAM users and roles as a directed graph to identify privilege e… | 23 | 1580 | active |
| nohajc/anylinuxfs A Rust CLI utility for macOS that mounts any Linux-supported filesystem (ext4, btrfs, xfs, ZFS, NTFS, exFAT, etc.) with full read-write acc… | 84 | 1579 | active |
| homeassistant-apps/app-cloudflared A Home Assistant add-on that runs Cloudflared to create a secure Cloudflare Tunnel to your Home Assistant instance. It enables remote acces… | 98 | 1578 | active |
| ChipWhisperer ChipWhisperer is an open-source toolchain for hardware security research, providing capture hardware designs, FPGA/USB firmware, and a Pyth… | 95 | 1578 | active |
| spatie/laravel-honeypot A Laravel package that prevents spam form submissions using honeypot fields and submission-time checks. It provides a Blade component and m… | 91 | 1578 | stable |
| Hard_Configurator ConfigureDefender is a small portable Windows GUI utility for viewing and configuring Windows Defender antivirus settings on Windows 10/11 … | 70 | 1578 | active |
| stealthcopter/deepce DEEPCE is a single-file pure-shell script for enumerating Docker environments and attempting privilege escalation and container escapes. It… | 55 | 1578 | active |
| pk-fr/yakpro-po YAK Pro - Php Obfuscator is a free, open-source CLI tool that obfuscates pure PHP source code using the PHP-Parser library. It removes comm… | 59 | 1577 | active |
| lqqyt2423/go-mitmproxy A Golang implementation of mitmproxy that intercepts, parses, monitors, and tampers with HTTP/HTTPS traffic via a man-in-the-middle proxy. … | 95 | 1576 | active |
| dwisiswant0/crlfuzz CRLFuzz is a fast command-line tool written in Go that scans websites for CRLF (carriage return/line feed) injection vulnerabilities. It su… | 64 | 1573 | active |
| aleskxyz/reality-ezpz A single-command bash installer that deploys sing-box or xray proxy servers (vless, TUIC, hysteria2, shadowtls) with reality or TLS encrypt… | 54 | 1573 | active |
| Leon406/SubCrawler A Kotlin-based tool that automatically crawls and health-checks (via Google ping) free public proxy nodes for protocols like V2Ray, Shadows… | 77 | 1570 | active |
| BLE-Research-Group/MetaRadar MetaRadar (BLE Radar) is an Android application for monitoring Bluetooth Low Energy environments. It scans for nearby BLE devices, analyzes… | 65 | 1570 | active |
| moom825/xeno-rat Xeno-RAT is an open-source remote access tool (RAT) written in C# for remotely controlling Windows 10/11 machines. It includes features suc… | 18 | 1570 | active |
| AD-Security/AD_Miner AD Miner is an Active Directory (on-premise and Entra ID) auditing tool that runs Cypher queries against a BloodHound Neo4j graph database … | 64 | 1569 | active |
| wikiZ/RedGuard RedGuard is a C2 front flow control tool written in Go that acts as a filtering reverse proxy in front of command-and-control servers. It h… | 23 | 1569 | active |
| OWASP/QRLJacking QRLJacking is an OWASP project documenting and exploiting the Quick Response Code Login Jacking attack vector, which hijacks user sessions … | 44 | 1567 | active |
| kubernetes-sigs/secrets-store-csi-driver A Kubernetes CSI driver that mounts secrets, keys, and certificates from external secrets stores (Vault, Azure Key Vault, AWS Secrets Manag… | 94 | 1565 | stable |
| Tsojan/TsojanScan TsojanScan is an integrated BurpSuite plugin for vulnerability detection that bundles multiple common vulnerability POCs into a single exte… | 84 | 1565 | active |
| drduh/pwd.sh pwd.sh is a single Bash script that manages text secrets such as passwords using GnuPG symmetric encryption. Secrets are stored in randomly… | 86 | 1563 | active |
| MikeWang000000/FakeHTTP FakeHTTP is a Linux command-line tool that obfuscates TCP connections by disguising them as HTTP traffic using Netfilter Queue (NFQUEUE). I… | 31 | 1563 | active |
| Gowtham-Darkseid/AutoPentestX AutoPentestX is a Python-based automated penetration testing toolkit that scans targets for vulnerabilities and generates security reports.… | 43 | 1562 | active |
| system-linux/FazJammer FazJammer is an ESP8266-based firmware project that turns a NodeMCU plus an NRF24L01+ radio module into a device that jams Wi-Fi, BLE, and … | 39 | 1562 | active |
| ThisSeanZhang/landscape Landscape is a Linux router application built in Rust with eBPF that routes traffic by domain rather than just IP. It uses a userspace DNS … | 87 | 1561 | active |
| XSS Hunter XSS Hunter Express is a self-hosted service for tracking and detecting blind cross-site scripting (XSS) vulnerabilities via injected payloa… | 32 | 1561 | active |
| v-byte-cpu/sx sx is a fast, UNIX-philosophy command-line network scanner written in Go that supports ARP/NDP host discovery, ICMP, TCP SYN/FIN/NULL/Xmas,… | 77 | 1559 | active |
| meskarune/i3lock-fancy A bash script wrapper around i3lock that takes a screenshot of the desktop, blurs or pixelates it, and overlays a lock icon and text to cre… | 23 | 1559 | stable |
| guacsec/guac GUAC (Graph for Understanding Artifact Composition) is an OpenSSF incubating project that ingests software security metadata such as SBOMs,… | 88 | 1557 | active |
| creazyboyone/FastGithub FastGithub is a local proxy tool that accelerates access to GitHub by resolving clean IPs, speed-testing them, and proxying HTTPS traffic t… | 29 | 1556 | active |
| AeonLucid/AndroidNativeEmu A Python library that partially emulates Android native (.so) libraries on a host machine using the Unicorn CPU emulator. It emulates the J… | 23 | 1555 | active |
| ProtonMail/proton-bridge Proton Mail Bridge is a desktop application that runs local IMAP and SMTP servers, allowing standard email clients to send and receive encr… | 95 | 1554 | active |
| X1a0He/X1a0HeWeChatPlugin A macOS WeChat client plugin providing features like message anti-revoke, multiple app instances, update disabling, and log reporting. It i… | 87 | 1552 | active |
| EdXposed EdXposed is a Riru-based Magisk module providing an ART hooking framework for Android 8.0-11, exposing the classic Xposed API so modules ca… | 23 | 5666 | maintenance |
| ServenScorpion/VirtualApp A fork of VirtualApp, an Android virtualization framework that runs apps inside a virtual container supporting app cloning (multi-instance)… | 75 | 1549 | active |
| ProxiFyre ProxiFyre is a Windows SOCKS5 proxifier that transparently routes TCP and UDP traffic of selected applications through SOCKS5 proxies using… | 93 | 1544 | active |
| rooootdev/lara LARA is an iOS customization toolbox application that leverages the DarkSword kernel exploit to modify system behavior on supported devices… | 73 | 1544 | active |
| LitterBox LitterBox is a self-hosted payload-analysis sandbox for red teams that runs static, dynamic, and EDR-based analysis on samples and produces… | 57 | 1544 | active |
| Profanity Profanity is a console-based XMPP chat client written in C using ncurses and libstrophe, inspired by Irssi. It supports MUC chat rooms, OTR… | 85 | 1542 | active |
| nfephp-org/sped-nfe A PHP library for generating, signing, and transmitting Brazilian electronic fiscal documents (NF-e model 55 and NFC-e model 65) to SEFAZ a… | 65 | 1542 | active |
| mysk-research/loupe Loupe is an open-source iOS and iPadOS app that demonstrates device fingerprinting by showing raw values from public iOS APIs that any thir… | 57 | 1542 | active |
| Alex313031/Mercury Mercury is a Firefox fork with compiler optimizations (AVX, AES, LTO, PGO) and privacy/security patches drawn from LibreWolf, Waterfox, Gho… | 62 | 1541 | active |
| Dreamland Pine is a dynamic Java method hooking framework for the Android ART runtime, allowing interception and modification of almost any Java meth… | 52 | 1541 | active |
| lucavallin/barco barco is a minimal Linux container runtime written in C, built from scratch using kernel features like namespaces, cgroups, seccomp, and ca… | 29 | 1541 | active |
| ReSo7200/InstaEclipse InstaEclipse is an LSPosed/Xposed module for Instagram that adds features like Ghost Mode, ad-free browsing, developer options, and distrac… | 89 | 1540 | active |
| Tongsuo-Project/Tongsuo Tongsuo (铜锁) is an open-source cryptographic library providing modern cryptographic primitives and secure communication protocols, includin… | 86 | 1540 | active |
| shirokhorshid/shirokhorshid-android Shir o Khorshid is an independently maintained, community fork of the open-source Psiphon Android VPN/circumvention client, adding extra co… | 66 | 1540 | active |
| MiForge/MiUnlockTool A cross-platform Python CLI tool that retrieves the encryptData(token) needed to unlock the bootloader on Xiaomi, Redmi, and Poco devices. … | 91 | 1537 | active |
| janmojzis/tinyssh TinySSH (tinysshd) is a minimalistic SSHv2 server written in C with under 100,000 words of code, implementing only a secure subset of the p… | 95 | 1535 | active |
| nefarius/HidHide HidHide is a Windows kernel-mode filter driver that acts as an 'input device firewall', allowing users to block individual applications' ac… | 60 | 1535 | active |
| occlum/occlum Occlum is a memory-safe, multi-process library OS (LibOS) written in Rust for Intel SGX enclaves. It lets legacy applications run inside se… | 48 | 1534 | active |
| xnl-h4ck3r/GAP-Burp-Extension GAP is a Burp Suite extension written in Python (Jython) that extracts potential endpoints, parameters, and links from Burp's site map, pro… | 60 | 1533 | active |
| contiki-ng/contiki-ng Contiki-NG is an open-source, cross-platform operating system for next-generation IoT devices, forked from the original Contiki OS. It focu… | 84 | 1532 | active |
| tirrenotechnologies/tirreno tirreno is an open-source, self-hosted security framework written in PHP/PostgreSQL that provides event tracking, threat detection, and ris… | 80 | 1532 | active |
| firedancer-io/firedancer Firedancer is Jump Crypto's from-scratch Solana validator client written in C, designed for extreme performance and security with a restric… | 95 | 1531 | active |
| spyboy-productions/r4ven R4ven is a security awareness and penetration testing tool that hosts a web page which, when a user grants browser permissions, captures GP… | 56 | 1531 | active |
| hybridgroup/go-haystack A Go/TinyGo library and toolset for tracking personal Bluetooth devices through Apple's Find My network, using OpenHaystack and Macless-Hay… | 66 | 1529 | active |