Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| hybridgroup/go-haystack A Go/TinyGo library and toolset for tracking personal Bluetooth devices through Apple's Find My network, using OpenHaystack and Macless-Hay… | 66 | 1529 | active |
| webpwnized/mutillidae OWASP Mutillidae II is a deliberately vulnerable PHP web application used as a target for web-security training and practice. It includes o… | 75 | 1527 | active |
| cartalyst/sentinel Sentinel is a PHP 8.3+ framework-agnostic authentication and authorization library by Cartalyst. It provides user authentication, roles, pe… | 57 | 1527 | active |
| nikitastupin/clairvoyance Clairvoyance is a Python CLI tool that recovers a GraphQL API's schema even when introspection is disabled, by probing field and type names… | 51 | 1527 | active |
| FOSSA CLI FOSSA CLI is a zero-configuration, language-agnostic dependency analysis tool that detects dependencies in any codebase across 20+ build sy… | 96 | 1526 | active |
| polhenarejos/pico-fido Open-source firmware that turns a Raspberry Pi Pico (RP2040/RP2350) or ESP32-S3 microcontroller into a FIDO2 passkey authenticator, support… | 91 | 1526 | active |
| kkapsner/CanvasBlocker A Firefox browser extension that protects users from browser fingerprinting by blocking or faking readouts of JavaScript APIs such as canva… | 73 | 1525 | active |
| Danny-Dasilva/CycleTLS CycleTLS is a Go library with a JavaScript/TypeScript wrapper that lets clients spoof TLS/JA3 (and JA4) fingerprints when making HTTP reque… | 70 | 1525 | active |
| raspberrypi/rpi-eeprom Official Raspberry Pi tooling of shell scripts and pre-compiled binaries for updating and configuring the bootloader EEPROM on Raspberry Pi… | 90 | 1524 | active |
| twofas/2fas-android The official open-source Android app for 2FAS, a two-factor authentication service that generates one-time passwords (TOTP and HOTP) for se… | 89 | 1524 | active |
| globaleaks/globaleaks-whistleblowing-software GlobaLeaks is a free, open-source whistleblowing platform that lets any organization set up and maintain a secure, anonymous reporting syst… | 91 | 1521 | stable |
| salvogiangri/KnoxPatch An LSPosed/Xposed module written in Kotlin that restores Samsung apps and features (Samsung Health, Samsung Cloud, Samsung Flow, etc.) on r… | 81 | 1521 | active |
| overspace-labs/CaA CaA is a BurpSuite extension (Montoya API) that analyzes HTTP traffic to extract parameters, paths, files, and parameter values with freque… | 76 | 1521 | active |
| anytls/anytls-go anytls-go is the Go reference implementation of the AnyTLS protocol, a proxy protocol designed to mitigate TLS-in-TLS nested handshake fing… | 73 | 1521 | active |
| mike-engel/jwt-cli jwt-cli is a fast command-line tool written in Rust for decoding and encoding JSON Web Tokens (JWTs). It supports custom headers, arbitrary… | 68 | 1520 | active |
| nemesida-waf/waf-bypass WAF Bypass Tool is an open-source Python CLI tool that tests web application firewalls for false positives and false negatives using predef… | 77 | 1519 | active |
| Goby Goby is a network security assessment tool that maps an organization's attack surface and scans for known vulnerabilities and weak password… | 23 | 1519 | active |
| assetnote/nowafpls nowafpls is a Jython-based Burp Suite plugin that bypasses web application firewalls (WAFs) by inserting junk data into HTTP request bodies… | 35 | 1518 | active |
| six2dez/burp-ai-agent Custom AI Agent (formerly Burp AI Agent) is a Burp Suite extension written in Kotlin that integrates LLMs into web security workflows via l… | 77 | 1517 | stable |
| ray-lothian/UserAgent-Switcher A highly configurable browser extension that spoofs the User-Agent string across Chrome, Firefox, Edge, and Opera. It overrides HTTP reques… | 75 | 1517 | active |
| deathmemory/FridaContainer FridaContainer is a modular collection of popular and custom Frida scripts written in TypeScript to speed up reverse engineering work on An… | 52 | 1517 | active |
| ztgrace/changeme changeme is a Python CLI tool that scans networks for devices and services using default or backdoor credentials. Credential definitions ar… | 33 | 1517 | active |
| skyjake/lagrange Lagrange is a cross-platform desktop and mobile client for browsing Geminispace, written in C with SDL for graphics and OpenSSL for TLS. It… | 96 | 1516 | active |
| jaraco/keyring A Python library providing a simple API to access the operating system's native keyring service for safe password storage and retrieval. It… | 71 | 1514 | stable |
| rfxn/linux-malware-detect Linux Malware Detect (LMD) is a bash-based malware scanner for Linux servers featuring a multi-stage detection pipeline (MD5/SHA-256 hashin… | 80 | 1512 | active |
| cmontage/mas-cn A Chinese-localized fork of Microsoft Activation Scripts (MAS), an open-source tool for activating Windows and Office via methods like HWID… | 74 | 1511 | active |
| 0xsp-SRD/mortar Mortar Loader is a red team evasion tool that encrypts PE binaries and shellcode and executes them in memory using various injection techni… | 23 | 1511 | active |
| DarthTon/Blackbone Blackbone is a C++ library for Windows memory hacking, providing APIs for process memory manipulation, DLL injection, manual PE image mappi… | 32 | 5499 | maintenance |
| awslabs/aws-support-tools A curated collection of diagnostic and troubleshooting scripts and sample code for AWS services, maintained by AWS Premium Support. Tools a… | 92 | 1510 | active |
| pallets-eco/flask-wtf Flask-WTF is a Python library that integrates WTForms with the Flask web framework, providing form rendering, validation, CSRF protection, … | 74 | 1510 | stable |
| project-oak/oak Oak is a Rust-based platform for building distributed systems whose components can produce externally verifiable claims about their behavio… | 75 | 1504 | active |
| Greenwolf/ntlm_theft ntlm_theft is a Python3 CLI tool that generates 21 different types of NTLMv2 hash theft files (e.g., .url, .scf, .docx, .pdf, .jnlp) that t… | 74 | 1503 | active |
| Meckazin/ChromeKatz ChromeKatz is a set of offensive security tools (CookieKatz, ElevationKatz) written in C that dump cookies and decryption keys directly fro… | 62 | 1503 | active |
| T4y1oR/RingQ RingQ is a post-exploitation antivirus evasion tool that obfuscates and loads arbitrary Windows executables or shellcode (e.g., Cobalt Stri… | 25 | 1503 | active |
| duckduckgo/duckduckgo-privacy-extension DuckDuckGo Privacy Essentials is a browser extension for Firefox, Chrome, Edge, and Opera that blocks third-party trackers and ads, manages… | 98 | 1501 | active |
| pyca/bcrypt pyca/bcrypt is a Python library providing bcrypt password hashing and a bcrypt_pbkdf key derivation function. It offers salted hashing with… | 75 | 1501 | active |
| libressl/portable LibreSSL Portable is the portable build of LibreSSL, a TLS and cryptography stack forked from OpenSSL 1.0.1g by the OpenBSD project. It pro… | 99 | 1500 | stable |
| ChendoChap/pOOBs4 A kernel exploit for PlayStation 4 firmware 9.00 that leverages a filesystem (exfat) bug triggered via a specially formatted USB drive, com… | 32 | 1500 | stable |
| ioi/isolate Isolate is a Linux sandbox for securely executing untrusted programs, originally built for programming contest judges. It uses kernel featu… | 73 | 1499 | stable |
| usbarmory/usbarmory USB armory is an open source hardware design for a compact secure computer built into a USB stick form factor, based on ARM SoCs. This repo… | 73 | 1499 | active |
| pass-with-high-score/universal-installer Universal Installer is an open-source Android package manager app built with Kotlin and Jetpack Compose that installs APK, APKS, XAPK, and … | 83 | 1498 | active |
| pass-extension/pass-otp pass-otp is an extension for the pass password manager that stores and manages one-time-password (OTP) tokens as otpauth:// URIs. It genera… | 35 | 1498 | active |
| stealthcopter/AndroidNetworkTools A Java library for Android providing handy networking utilities such as port scanning, subnet device discovery, ping, and Wake-on-LAN. It f… | 23 | 1497 | active |
| facebook/fishhook fishhook is a small C library from Facebook that dynamically rebinds symbols in Mach-O binaries running on iOS, similar to DYLD_INTERPOSE o… | 32 | 5432 | maintenance |
| Batfish Batfish is an open-source network configuration analysis tool that builds complete models of network behavior from device configurations to… | 85 | 1495 | active |
| ergrelet/unlicense A Python 3 command-line tool that dynamically unpacks executables protected with Themida/WinLicense 2.x and 3.x. It automatically recovers … | 23 | 1495 | active |
| Gezine/Y2JB Y2JB is a PS5 exploit that achieves userland code execution through the console's YouTube app. It supports firmware 4.03+ via a payload del… | 72 | 1494 | active |
| coder/wush wush is a command-line tool for transferring files and opening remote shells between computers over peer-to-peer WireGuard connections. It … | 37 | 1494 | active |
| JJTech0130/TrollRestore TrollRestore is a Python-based installer that installs TrollStore on iOS/iPadOS 15.2 through 16.7 RC and 17.0 by exploiting CVE-2024-44252 … | 14 | 1494 | active |
| vinkla/hashids A small PHP library that generates YouTube-like short, URL-safe IDs from numbers, so numeric database IDs are not exposed to users. It supp… | 54 | 5423 | maintenance |
| cossacklabs/acra Acra is a database security suite that provides field-level encryption, searchable encryption, tokenization, data masking, SQL firewalling,… | 54 | 1493 | active |
| google/go-safeweb go-safeweb is a collection of Go libraries for building secure-by-default HTTP servers. It applies security mechanisms like XSS and CSRF pr… | 10 | 1493 | active |
| Spomky-Labs/otphp A PHP library for generating one-time passwords according to RFC 4226 (HOTP) and RFC 6238 (TOTP). It is compatible with Google Authenticato… | 89 | 1492 | stable |
| dekuNukem/bob_cassette_rewinder An open-source hardware/firmware project that defeats the DRM on Bob dishwasher detergent cassettes, allowing users to reset and refill the… | 28 | 1492 | active |
| hellman/xortool xortool is a Python command-line tool for cryptanalysis of multi-byte XOR ciphers. It guesses the key length based on character frequency s… | 39 | 1491 | active |
| halo/LinkLiar LinkLiar is a free, open-source macOS status menu application written in Swift for spoofing the MAC addresses of Wi-Fi and Ethernet interfa… | 35 | 1491 | active |
| TheresAFewConors/Sooty Sooty is a Python CLI tool that automates routine tasks for SOC (Security Operations Center) analysts, such as URL sanitization, DNS and Wh… | 32 | 1491 | active |
| Kubesec Kubesec is a static analysis tool that performs security risk analysis on Kubernetes resource manifests, assigning a security score and det… | 87 | 1490 | active |
| MonwF/customiuizer Pengeek (CustoMIUIzer fork) is an LSPosed/Xposed module that deeply customizes Xiaomi HyperOS and MIUI system behavior. It offers tweaks fo… | 56 | 1489 | active |
| securitybunker/databunker Databunker is a self-hosted, Go-based secure vault for tokenizing and storing personal records such as PII, PHI, KYC, and PCI data. It expo… | 71 | 1487 | active |
| hectorm/otpauth A JavaScript One-Time Password library implementing HOTP (RFC 4226) and TOTP (RFC 6238) for generating and validating 2FA tokens. It runs i… | 89 | 1485 | stable |
| inguardians/peirates Peirates is a Go-based, interactive Kubernetes penetration testing tool that automates privilege escalation, lateral movement, and cluster … | 99 | 1483 | active |
| kalessil/phpinspectionsea Php Inspections (EA Extended) is an open-source static code analysis tool distributed as a PhpStorm/IntelliJ IDEA plugin. It detects archit… | 73 | 1483 | active |
| asz798838958/aBaiFreeGPT A self-hosted account registration and lifecycle management platform that automates bulk account signup, email verification, TOTP 2FA bindi… | 55 | 1482 | active |
| Schira4396/VcenterKiller A Go-based all-in-one exploitation and verification tool targeting VMware vCenter, covering major CVEs such as CVE-2021-21972, CVE-2021-219… | 23 | 1482 | active |
| Shopify/ejson EJSON is a Go CLI utility for managing encrypted secrets in JSON files using asymmetric elliptic-curve (NaCl Box) encryption. It lets teams… | 80 | 1481 | stable |
| Fuzion24/JustTrustMe An Xposed module for rooted Android devices that disables SSL certificate pinning in apps, enabling traffic interception during security au… | 23 | 5368 | maintenance |
| LionSec/katoolin A Python CLI tool that lets users add or remove Kali Linux repositories on other Debian-based systems (like Ubuntu) and install Kali Linux … | 32 | 5367 | maintenance |
| urbanadventurer/username-anarchy Username Anarchy is a Ruby command-line tool that generates lists of likely usernames from people's first and last names for use in penetra… | 23 | 1480 | stable |
| vslavik/winsparkle WinSparkle is an app update framework for Windows desktop applications, inspired by Sparkle for macOS. It ships as a single dependency-free… | 84 | 1479 | stable |
| momosecurity/FindSomething FindSomething is a passive browser extension for Chrome and Firefox that extracts potentially sensitive information (like emails, API keys,… | 32 | 1476 | active |
| jvoisin/php-malware-finder PHP Malware Finder is a command-line tool that scans filesystems for potentially malicious PHP files using YARA rules. It detects obfuscate… | 10 | 1474 | active |
| lengjibo/RedTeamTools A collection of red team tools written and modified by the author, primarily in C++ and Python. It includes utilities for AV bypass, privil… | 50 | 1473 | active |
| digitalbazaar/forge Forge is a pure-JavaScript implementation of the TLS protocol plus a broad set of cryptographic utilities including AES, RSA, X.509 certifi… | 75 | 5337 | maintenance |
| ultravnc/UltraVNC UltraVNC is a free, open-source VNC (Virtual Network Computing) suite for Windows comprising a VNC Server, Viewer, Repeater proxy, and Sing… | 75 | 1472 | active |
| roro2239/Stellar Stellar is a deeply customized fork of Shizuku, an Android framework that lets apps use system-level APIs via ADB wireless debugging or Roo… | 79 | 1471 | active |
| BlendLog/MinerSearch A free Windows utility that scans for and removes hidden cryptocurrency miners by checking processes, files, registry, WMI, services, and s… | 98 | 1470 | active |
| NHAS/reverse_ssh A Go-based SSH server and client that enables SSH-based reverse shells, letting operators manage and connect to remote targets with native … | 93 | 1470 | active |
| ssh-mitm/ssh-mitm SSH-MITM is an open-source man-in-the-middle SSH server for authorized security audits and malware analysis. It proxies SSH client-server c… | 84 | 1470 | active |
| epsylon/xsser XSSer is an automatic penetration testing framework for detecting, exploiting, and reporting cross-site scripting (XSS) vulnerabilities in … | 80 | 1470 | active |
| OUI-SPY Flock-You is ESP32-S3 firmware that turns a Seeed XIAO ESP32-S3 into a passive 2.4 GHz promiscuous-mode WiFi sniffer for detecting Flock su… | 61 | 1470 | active |
| t3l3machus/psudohash psudohash is a Python CLI tool that generates millions of keyword-based password mutations for brute-force attacks and hash cracking. It mi… | 30 | 1470 | active |
| shuanx/BurpAPIFinder BurpAPIFinder is a Burp Suite extension written in Java that passively analyzes HTTP traffic (HTML and JS files) to discover hidden API end… | 16 | 1469 | active |
| DualCoder/vgpu_unlock A Linux tool that patches the NVIDIA GRID vGPU driver to unlock vGPU functionality on consumer-grade GeForce and Quadro GPUs. It works by h… | 32 | 5317 | maintenance |
| FACT (Firmware Analysis and Comparison Tool) FACT (Firmware Analysis and Comparison Tool) is a self-hosted Python application that automates firmware security analysis for devices like… | 94 | 1468 | active |
| small (OpenWrt proxy plugin feed) A collection of commonly used OpenWrt package feeds (luci apps, themes, and proxy/DNS plugins) maintained for easy inclusion when compiling… | 94 | 1468 | active |
| tclahr/uac UAC (Unix-like Artifacts Collector) is a portable, dependency-free shell-based incident response tool that automates forensic artifact coll… | 86 | 1468 | active |
| Stebalien/tempfile A secure, cross-platform Rust library for creating and managing temporary files and directories. It supports anonymous temporary files, nam… | 75 | 1468 | stable |
| infrahq/infra Infra is an open-source authentication and access management service for servers, Kubernetes clusters, and databases. It provides identity-… | 67 | 1468 | active |
| tillson/git-hound GitHound is a Go-based CLI tool that hunts for exposed API keys, secrets, and credentials across all of GitHub using GitHub dorks, pattern … | 64 | 1468 | active |
| AhMyth/AhMyth-Android-RAT AhMyth is an open-source Android Remote Administration Tool (RAT) consisting of an Electron-based desktop control panel and an Android back… | 10 | 5312 | maintenance |
| OWASP/wrongsecrets OWASP WrongSecrets is a deliberately vulnerable Java application containing 50+ challenges that demonstrate how secrets are commonly miscon… | 97 | 1466 | active |
| fabriziosalmi/certmate CertMate is a self-hosted certificate lifecycle management platform that issues and renews TLS certificates via ACME/Let's Encrypt across 2… | 82 | 1466 | active |
| xtclovver/RKNHardering An Android application that detects VPN and proxy configurations on a device, implementing the methodology used by Roskomnadzor (RKN) to id… | 72 | 1466 | active |
| strongbox-password-safe/Strongbox Strongbox is a native password manager client for iOS and macOS that opens KeePass (KDB/KDBX) and Password Safe (v3) vault files. It encryp… | 70 | 1466 | active |
| One-Fox-Security-Team/One-Fox-T00ls One-Fox-T00ls is a curated collection of penetration testing and security toolboxes from the One-Fox security team, covering information ga… | 53 | 1466 | active |
| bindhosts/bindhosts A systemless hosts manager for rooted Android devices that works with APatch, KernelSU, and Magisk. It provides ad-blocking and hostname re… | 90 | 1464 | active |
| eljojo/rememory ReMemory is a tool that encrypts your files with age and splits the key using Shamir's Secret Sharing among trusted people, who each receiv… | 71 | 1464 | active |
| denandz/sourcemapper Sourcemapper is a Go CLI tool that parses JavaScript sourcemap (.map) files, whether from URLs or local directories, and reconstructs the o… | 70 | 1464 | stable |
| JailbrokenAI/wallbreaker Wallbreaker is a Claude-Code-style terminal harness for red-teaming LLMs, driving an autonomous agent loop that runs jailbreak attacks (PAI… | 53 | 1464 | active |