Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Secretlint Secretlint is a pluggable linting tool that scans projects for committed credentials and secrets, reporting matches with explanations. It r… | 98 | 1463 | active |
| terraform-compliance/cli terraform-compliance is a lightweight, security-focused BDD test framework for Terraform that enables negative testing of infrastructure-as… | 84 | 1463 | active |
| Safe3/openresty-manager OpenResty Manager is a modern, web-based server control panel for managing OpenResty/Nginx reverse proxies, free SSL certificates, security… | 80 | 1463 | active |
| Sorcery/sorcery Sorcery is a stripped-down authentication library for Ruby on Rails supporting ActiveRecord, Mongoid, and other ORMs. It provides core auth… | 64 | 1463 | active |
| ViRb3/magisk-frida A Magisk/KernelSU/APatch module that automatically installs and runs frida-server on boot on rooted Android devices. It stays up to date by… | 93 | 1462 | active |
| Morsmalleo/AhMyth AhMyth is a cross-platform Android Remote Administration Tool (RAT) used to build APK payloads and remotely control Android devices through… | 67 | 1461 | active |
| PortSwigger/param-miner Param Miner is a Burp Suite extension that identifies hidden, unlinked HTTP parameters, headers, and cookies using diffing logic and binary… | 63 | 1461 | active |
| getprobo/probo Probo is an open-source, self-hostable governance, risk, and compliance (GRC) platform for engineering and security teams, covering risk ma… | 84 | 1460 | active |
| qpoint-io/qtap Qtap is an eBPF agent that hooks TLS/SSL functions in the Linux kernel to capture network traffic before and after encryption, with full pr… | 63 | 1460 | active |
| OpenClarity OpenClarity is an open-source platform for agentless detection and management of Virtual Machine SBOMs and security threats such as vulnera… | 10 | 1459 | active |
| owasp-noir/noir OWASP Noir is a static analysis (SAST) CLI tool that scans source code to extract every endpoint an application exposes, including shadow A… | 99 | 1458 | active |
| Internet-Architecture-and-Security/PacketScope PacketScope is an open-source, eBPF-based protocol stack analysis and debugging tool for server-side network observability and defense. It … | 71 | 1458 | active |
| c0ny1/passive-scan-client A Burp Suite extension written in Java that forwards passive scanning traffic to external passive vulnerability scanners (like xray, w13sca… | 23 | 1458 | stable |
| OWASP/SecurityShepherd OWASP Security Shepherd is a self-hosted web and mobile application security training platform built in Java. It presents lessons and chall… | 64 | 1457 | active |
| ossf/criticality_score A Go CLI tool from the OpenSSF that computes a criticality score (0 to 1) for open source projects based on parameters like contributor cou… | 64 | 1457 | active |
| passwordless-lib/fido2-net-lib A battle-tested .NET library implementing a FIDO2 server / WebAuthn relying party for passkey registration (attestation) and authentication… | 99 | 1456 | active |
| intel/confidential-computing.sgx Intel Software Guard Extensions (SGX) software stack for Linux, comprising the SGX driver, SDK, and Platform Software (PSW). It enables dev… | 87 | 1455 | active |
| GhostPack/SharpDPAPI SharpDPAPI is a C# port of Mimikatz's Windows DPAPI functionality, allowing triage of DPAPI masterkeys, credentials, vaults, certificates, … | 32 | 1455 | active |
| ossf/allstar Allstar is a GitHub App from OpenSSF that continuously monitors GitHub organizations and repositories for adherence to security best practi… | 84 | 1454 | active |
| NullArray/AutoSploit AutoSploit is a Python CLI tool that automates mass exploitation of remote hosts by combining target discovery from Shodan, Censys, and Zoo… | 23 | 5255 | maintenance |
| tuneinsight/lattigo Lattigo is a pure Go library implementing lattice-based (RLWE) homomorphic encryption schemes such as BFV/BGV and CKKS, along with their mu… | 73 | 1452 | active |
| SeeFlowerX/stackplz stackplz is an eBPF-based stack tracing tool for Android (arm64). It supports syscall tracing, uprobe hooking of 64-bit userspace libraries… | 60 | 1450 | active |
| bacher09/pwgen-for-bios A collection of master password generators for various BIOS/UEFI firmware from vendors like Dell, HP, Asus, Samsung, and Sony. It powers th… | 58 | 1450 | active |
| sw33tLie/bbscope bbscope is a Go CLI tool that fetches, stores, and manages bug bounty program scopes from HackerOne, Bugcrowd, Intigriti, YesWeHack, and Im… | 74 | 1446 | active |
| crazy-max/WindowsSpyBlocker WindowsSpyBlocker is a Go application delivered as a single Windows executable that blocks spying and tracking on Windows systems. It captu… | 65 | 5217 | maintenance |
| shizunge/endlessh-go A Go implementation of endlessh, an SSH tarpit that traps brute-force attackers by sending an endless SSH banner, while exporting Prometheu… | 82 | 1444 | active |
| SlipNet SlipNet is an open-source anti-censorship VPN client for Android (Kotlin/Jetpack Compose) with a cross-platform Go CLI companion, supportin… | 71 | 1443 | active |
| tahoe-lafs/tahoe-lafs Tahoe-LAFS is a free and open-source decentralized storage system that distributes encrypted, erasure-coded file shares across multiple unt… | 59 | 1443 | active |
| t3l3machus/toxssin toxssin is an open-source penetration testing CLI tool that automates exploitation of Cross-Site Scripting (XSS) vulnerabilities. It pairs … | 32 | 1443 | active |
| EgeBalci/amber Amber is a reflective PE packer that converts Windows PE files (EXE, DLL, SYS) into position-independent shellcode payloads for in-memory e… | 23 | 1443 | active |
| AndroRAT AndroRAT is an Android remote administration tool (RAT) with a Java-based Android client APK and a Python server, communicating over socket… | 32 | 5206 | maintenance |
| omegaee/my-fingerprint A lightweight browser extension built on Manifest V3 that protects against browser fingerprinting across Chrome, Edge, and Firefox. It spoo… | 89 | 1441 | active |
| nowsecure/r2frida r2frida is a radare2 plugin that integrates the Frida dynamic instrumentation toolkit, letting users inspect and manipulate local or remote… | 91 | 1440 | active |
| Cloud SQL Auth Proxy The Cloud SQL Auth Proxy is a Go utility that provides secure, IAM-authorized, TLS 1.3-encrypted connections to Google Cloud SQL instances … | 99 | 1439 | active |
| antonioCoco/RunasCs RunasCs is an open-source C# utility for running processes with explicit credentials on Windows, serving as an improved alternative to the … | 23 | 1439 | stable |
| akemin-dayo/AppSync AppSync Unified is a jailbreak tweak (dynamic library) for iOS 5 through 18 that lets users install ad-hoc signed, fakesigned, unsigned, or… | 23 | 1439 | active |
| boku7/BokuLoader BokuLoader is a proof-of-concept User-Defined Reflective Loader (UDRL) for Cobalt Strike written in C and assembly. It recreates, integrate… | 32 | 1438 | active |
| beakthoven/TrickyStoreOSS A fully open-source Magisk module that spoofs Android hardware keystore attestation, serving as a FOSS rewrite of the proprietary TrickySto… | 83 | 1437 | active |
| Isaacdelly/Plutus Plutus is a Python CLI tool that brute-forces Bitcoin private keys by generating sequential keys via elliptic curve point addition and chec… | 56 | 1437 | active |
| Bitwise-01/Instagram- A Python CLI tool that performs brute-force password attacks against Instagram accounts using a supplied password list and rotating proxies… | 32 | 5183 | maintenance |
| twoone-3/AdGuardHomeForRoot A Magisk/KernelSU/APatch module that runs AdGuardHome on rooted Android devices, providing a local DNS server that blocks ads, malware, and… | 88 | 1436 | active |
| WebOS Homebrew Channel An unofficial homebrew app store and root tooling for webOS TVs, providing package discovery, installation, and updates from independent re… | 68 | 1436 | active |
| dirkjanm/ldapdomaindump A Python CLI tool that dumps Active Directory information (users, groups, computers, policies, trusts) via LDAP and renders it as human-rea… | 26 | 1436 | stable |
| redacted/XKCD-password-generator xkcdpass is a Python CLI tool and library that generates secure multi-word passphrases inspired by XKCD 936. It supports customizable wordl… | 57 | 1435 | stable |
| jawj/IKEv2-setup A Bash script that configures a fresh Ubuntu Server LTS install as an IKEv2 VPN server using strongSwan, with Let's Encrypt certificates an… | 53 | 1435 | active |
| rebrowser A collection of source-code patches for Puppeteer and Playwright that fix automation leaks and help avoid bot detection systems like Cloudf… | 31 | 1433 | active |
| cyberark/KubiScan KubiScan is a Python CLI tool that scans Kubernetes clusters for risky permissions in the RBAC authorization model. It identifies risky rol… | 30 | 1433 | active |
| SamuelTulach/VirusTotalUploader An open-source C# WinForms desktop application for uploading files to VirusTotal for malware scanning. It serves as a maintained replacemen… | 23 | 1433 | active |
| autoDecoder A Burp Suite extension (written in Java) that lets users plug in custom encryption/decryption logic so intercepted HTTP traffic can be view… | 68 | 1431 | active |
| login-securite/DonPAPI DonPAPI is a Python CLI tool that remotely dumps DPAPI-protected secrets (browser credentials, certificates, WiFi passwords, and more) from… | 65 | 1430 | active |
| BiZken/PhishMailer A Python CLI tool that generates professional-looking phishing email templates for popular services like Instagram, PayPal, and Discord, ou… | 37 | 1430 | active |
| enarx/enarx Enarx is an open-source command-line tool and runtime for running applications inside hardware Trusted Execution Environments (TEEs) such a… | 48 | 1429 | active |
| dockovpn/dockovpn DockOvpn is a stateless, out-of-the-box OpenVPN server packaged as a Docker image that starts in under two seconds and requires no persiste… | 23 | 1429 | active |
| netsniff-ng/netsniff-ng netsniff-ng is a free, high-performance Linux networking toolkit written in C, often described as a Swiss army knife for network packets. I… | 30 | 1426 | stable |
| ahmedkhlief/APT-Hunter APT-Hunter is a Python-based threat hunting tool that analyzes Windows event logs (EVTX) to detect APT activity using predefined detection … | 85 | 1424 | active |
| backslashxx/mountify Mountify is a shell-based module for rooted Android that mounts other root modules globally via OverlayFS instead of Magic Mount. It works … | 82 | 1423 | active |
| cinit/TMoe TMoe is an open-source Xposed module that hooks into Telegram Android clients to add extra features and tweaks. It works with official and … | 70 | 1423 | active |
| Metarget/metarget Metarget is a Python-based framework that automatically builds vulnerable cloud-native infrastructures, installing vulnerable versions of D… | 61 | 1423 | active |
| wetox-team/flipperzero-goodies A collection of useful data and scripts for the Flipper Zero multi-tool device, including intercom keys and Python scripts. It is maintaine… | 40 | 1423 | active |
| xaitax/SploitScan SploitScan is a Python CLI cybersecurity utility that aggregates detailed vulnerability information for CVEs from sources like EPSS, CISA K… | 74 | 1422 | active |
| openwpm/OpenWPM OpenWPM is a web privacy measurement framework built on Firefox with Selenium automation, designed to collect data from thousands to millio… | 91 | 1420 | active |
| cr-marcstevens/sha1collisiondetection A C library and command-line tool that computes SHA-1 hashes while detecting known cryptanalytic collision attacks against SHA-1 with proba… | 41 | 1420 | stable |
| mbi/django-simple-captcha A Django application that adds customizable captcha image challenges to any Django form. It supports custom challenge generators, image sty… | 78 | 1419 | stable |
| Horcrux A Go CLI tool that splits a file into encrypted fragments using Shamir's Secret Sharing, requiring only a threshold of fragments to reconst… | 23 | 5105 | maintenance |
| RythmStick/AMSITrigger AMSITrigger is a C# command-line tool that identifies the specific strings in PowerShell scripts that trigger Microsoft's Antimalware Scan … | 29 | 1418 | active |
| rosenpass/rosenpass Rosenpass is a post-quantum-secure key exchange tool written in Rust that establishes symmetric keys and feeds them to WireGuard via its pr… | 82 | 1417 | active |
| Outflank C2 Tool Collection A collection of C-based offensive security tools that integrate with Cobalt Strike and other C2 frameworks via Beacon Object Files (BOF) an… | 32 | 1417 | active |
| BinTianqi/OwnDroid OwnDroid is an Android app that uses the DevicePolicyManager API with Device owner privileges to manage your own device. It provides system… | 86 | 1415 | active |
| solosky/pixl.js Pixl.js is an open-source hardware emulator for Nintendo Amiibo figures, based on a replica of the Espruino Pixl.js board. It emulates NTAG… | 77 | 1415 | active |
| danny0838/content-farm-terminator Content Farm Terminator is a cross-platform browser extension that identifies content farms by marking hyperlinks pointing to them and bloc… | 76 | 1415 | active |
| mufeedvh/pdfrip pdfrip is a multithreaded PDF password cracking utility written in Rust. It supports dictionary attacks, mask and pattern-based brute force… | 62 | 1415 | active |
| ct-Open-Source/tuya-convert A collection of Python scripts that flash Tuya-based smart home IoT devices (mostly ESP8266-based) with alternative open-source firmware ov… | 23 | 5084 | maintenance |
| NotRequiem/VMAware VMAware is a cross-platform, header-only C++ library for detecting virtual machines, hypervisors, emulators, containers, and sandboxes usin… | 89 | 1413 | active |
| Flangvik/TeamFiltration TeamFiltration is a cross-platform penetration testing framework for enumerating, password spraying, exfiltrating data from, and backdoorin… | 51 | 1413 | active |
| nuvious/pam-duress A Linux Pluggable Authentication Module (PAM) that lets users configure alternate 'duress' passwords which, when used under coercion, authe… | 70 | 1412 | active |
| daboynb/Safetycore-placeholder A placeholder Android APK that occupies the com.google.android.safetycore package name so Google cannot install or update the real SafetyCo… | 66 | 1412 | active |
| superhedgy/AttackSurfaceMapper AttackSurfaceMapper is a Python CLI reconnaissance tool that expands a target's attack surface using OSINT and active techniques like subdo… | 32 | 1412 | active |
| WireGuard/wireguard-apple The official WireGuard VPN client application for iOS and macOS, written in Swift, including the WireGuardKit Swift package for integrating… | 32 | 1411 | active |
| Jayy001/Search-That-Hash Search-That-Hash is a Python CLI tool that automatically submits hashes to popular online hash-cracking APIs to crack them in seconds. If n… | 23 | 1411 | active |
| haveno-dex/haveno Haveno is an open-source, non-custodial, peer-to-peer exchange platform for trading Monero against fiat currencies and other cryptocurrenci… | 100 | 1409 | active |
| PrimiHub PrimiHub is an open-source privacy-preserving computing platform built by a team of cryptography experts, supporting secure multi-party com… | 40 | 1409 | active |
| GrapheneOS/Camera GrapheneOS Camera is a modern Android camera app built on CameraX, focused on privacy and security. It includes QR and barcode scanning and… | 95 | 1408 | active |
| LSPosed/LSPlant LSPlant is a C++ library for hooking Java methods in the Android Runtime (ART), supporting hook/unhook and inline deoptimization. It is par… | 76 | 1406 | active |
| tihanyin/PSSW100AVB A curated collection of PowerShell scripts demonstrating antivirus evasion techniques, most notably reverse shells that go undetected by AV… | 67 | 1406 | active |
| corna/me_cleaner A Python script that modifies Intel ME/TXE firmware images to reduce the co-processor's ability to interact with the system, disabling it d… | 66 | 5051 | maintenance |
| facebook/ThreatExchange A collection of Trust & Safety tools from Meta for fighting digital harms, including perceptual hashing algorithms (PDQ for images, TMK and… | 100 | 1402 | active |
| itsreyi/BlockSuite Block-Suite is a modular JavaFX desktop application for authorized Minecraft server security assessments. It deploys a transparent MITM pro… | 80 | 1402 | active |
| RedByte1337/GraphSpy GraphSpy is an initial access and post-exploitation tool for Microsoft Entra ID (Azure AD) and Microsoft 365, offering a browser-based GUI … | 67 | 1402 | active |
| cisco/libsrtp libSRTP is Cisco's open-source C library implementing the Secure Real-time Transport Protocol (SRTP, RFC 3711) along with a supporting cryp… | 86 | 1401 | stable |
| google-github-actions/auth A GitHub Action that authenticates GitHub Actions workflows to Google Cloud, supporting Workload Identity Federation and Service Account Ke… | 73 | 1400 | active |
| PeculiarVentures/PKI.js PKI.js is a pure TypeScript library implementing the common formats and protocols used in PKI applications, including X.509 certificates, P… | 96 | 1399 | stable |
| Guided Hacking DLL Injector A C++ DLL injection library supporting x86, WOW64, and x64 injection with five injection methods and six shellcode execution techniques. It… | 29 | 1398 | active |
| curbox-app/curbox-android Curbox is a free, open-source Android app that blocks distracting apps, websites, and short-video feeds like Instagram Reels and YouTube Sh… | 88 | 1395 | active |
| hasherezade/libpeconv libPeConv is a C++ library for loading, manipulating, and dumping Windows PE (Portable Executable) files. It provides a 'swiss army knife' … | 63 | 1393 | active |
| ChiChou/grapefruit Grapefruit is an open-source mobile security testing suite for iOS and Android that provides a browser-based GUI over Frida for runtime ins… | 88 | 1392 | active |
| XiebroC2 XiebroC2 is an open-source command-and-control (C2) framework for penetration testing, written in Go with a .NET teamserver. It supports Lu… | 24 | 1392 | active |
| aws-cloudformation/cloudformation-guard AWS CloudFormation Guard (cfn-guard) is a general-purpose policy-as-code evaluation tool with an expressive DSL for defining rules. It vali… | 83 | 1389 | active |
| moyuwa/ApkCheckPack A Go-based CLI tool that detects APK hardening/packing features from 40+ vendors, plus third-party SDKs, anti-environment checks (ROOT, emu… | 76 | 1389 | active |
| blacklanternsecurity/TREVORspray TREVORspray is a modular password spraying tool with threading, SSH/subnet proxy rotation, and loot modules targeting identity providers li… | 66 | 1389 | active |
| reveny/Android-Native-Root-Detector An Android application that detects whether a device is rooted, using native code checks. It is written in Kotlin and distributed as a down… | 65 | 1389 | active |