function: security
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| MinaMichita/AntiAntiDefraud An Xposed/LSPosed module for MIUI 14 that prevents Xiaomi's Security app (GuardProvider/AntiDefraud) from silently uploading the user's ins… | 21 | 1138 | active |
| GJDuck/e9patch E9Patch is a static binary rewriting tool for x86_64 Linux ELF executables and shared objects, producing patched binaries that work as drop… | 83 | 1137 | active |
| ElDavoo/wa-crypt-tools A Python CLI tool suite for decrypting and encrypting WhatsApp and WhatsApp Business backup files in .crypt12, .crypt14, and .crypt15 forma… | 68 | 1136 | active |
| projectdiscovery/tlsx TLSX is a fast and configurable TLS grabber written in Go that collects and analyzes TLS-based data from hosts. It supports multiple TLS co… | 90 | 1135 | active |
| thumbmarkjs/thumbmarkjs ThumbmarkJS is a free, MIT-licensed JavaScript browser fingerprinting library that generates a unique visitor identifier entirely client-si… | 93 | 1134 | active |
| meganz/webclient The official MEGA (mega.nz) web client, a browser-based front end for MEGA's zero-knowledge encrypted cloud storage service. It implements … | 77 | 1134 | active |
| AloneMonkey/frida-ios-dump A Python CLI script that uses Frida to dump decrypted iOS app binaries from a jailbroken device and packages them into an IPA. It connects … | 32 | 3921 | maintenance |
| pendulum-project/ntpd-rs ntpd-rs is a memory-safe Rust implementation of the Network Time Protocol (NTP) with support for the authenticated NTS extension, providing… | 91 | 1133 | stable |
| samba-team/samba Samba is the standard open-source Windows interoperability suite for Linux and Unix, implementing the SMB/CIFS protocol for file and print … | 77 | 1133 | stable |
| the-useless-one/pywerview PywerView is a partial Python rewrite of PowerSploit's PowerView for Active Directory enumeration, built on impacket. It lets pentesters ru… | 76 | 1133 | active |
| greatscottgadgets/luna LUNA is an Amaranth HDL (Python) framework providing FPGA gateware and software for working with USB, from passive protocol analysis to bui… | 75 | 1133 | active |
| Arinerron/CVE-2022-0847-DirtyPipe-Exploit A C-based root privilege escalation exploit for CVE-2022-0847 (Dirty Pipe), a Linux kernel vulnerability. It modifies Max Kellermann's proo… | 32 | 1133 | stable |
| master131/iFakeLocation A cross-platform desktop application that simulates GPS locations on connected iOS devices via the Developer Mode disk image mechanism. It … | 23 | 1133 | active |
| ricochet-im/ricochet Ricochet is a cross-platform desktop instant messaging application that provides anonymous, metadata-resistant chat over Tor hidden service… | 23 | 3919 | maintenance |
| david942j/seccomp-tools A Ruby-based CLI toolkit for analyzing seccomp BPF filters, supporting dumping, disassembling, assembling, emulating, and auditing seccomp … | 88 | 1132 | active |
| hasanfirnas/symbiote Symbiote is a Python-based social engineering tool that generates a phishing page to trick a target into granting camera permission, then c… | 37 | 1132 | active |
| open-obfuscator/o-mvll O-MVLL is an LLVM-based code obfuscator for native code that integrates with Clang and the Swift compiler via the LLVM pass manager, with o… | 97 | 1129 | active |
| TongchengOpenSource/AppScan AppScan is a free, enterprise-grade automated privacy compliance detection tool for Android apps, based on dynamic analysis. It identifies … | 26 | 1128 | active |
| GameTec-live/ChameleonUltraGUI A cross-platform GUI application for the Chameleon Ultra and Chameleon Lite RFID emulation devices, written in Flutter. It lets users manag… | 78 | 1127 | active |
| zkcrypto/bellman bellman is a Rust crate for building zk-SNARK circuits, providing circuit traits, primitive structures, and gadgets like booleans and numbe… | 63 | 1127 | stable |
| protofire/solhint Solhint is an open-source linter for Solidity smart contracts that provides both security and style guide validations. It runs as an npm-di… | 93 | 1126 | active |
| XmirrorSecurity/OpenSCA-cli OpenSCA-cli is an open-source Software Composition Analysis (SCA) command-line tool that scans projects to detect third-party open-source d… | 82 | 1125 | active |
| tejado/android-usb-gadget An Android app that uses the Linux kernel's ConfigFS API to create and activate arbitrary USB gadget device roles, such as keyboard, mouse,… | 23 | 1125 | active |
| ErosZy/sablejs sablejs is a JavaScript sandbox library that safely executes untrusted, user-authored, or AI-generated JavaScript by AOT-compiling ES5.1 pr… | 99 | 1124 | active |
| cloudflare/sandbox-sdk A TypeScript SDK for running secure, sandboxed code execution environments on Cloudflare Workers. It lets developers execute commands, mana… | 82 | 1124 | active |
| RedSiege/C2concealer C2concealer is a Python command line tool that generates randomized Cobalt Strike malleable C2 profiles. It builds profile blocks from rand… | 67 | 1124 | active |
| sigstore/gitsign Gitsign is a CLI tool that signs Git commits and tags using Sigstore's keyless signing, backed by your GitHub or other OIDC identity instea… | 94 | 1123 | active |
| apparition47/MailTrackerBlocker MailTrackerBlocker is a mail bundle plugin and extension for Apple Mail on macOS that strips email trackers, read receipts, and spy pixels … | 73 | 1123 | active |
| CodingGay/BlackObfuscator BlackObfuscator is a Java-based obfuscator for Android DEX files that applies control flow flattening to make decompiled code hard to analy… | 31 | 1123 | active |
| Endermanch/XPKeygen A C++ tool that generates valid Windows XP and Windows Server 2003 VLK product keys from a raw product key, based on reverse-engineered ell… | 62 | 1122 | active |
| duo-labs/parliament Parliament is a Python library and CLI tool that lints AWS IAM policies, detecting malformed JSON, invalid actions and resources, type mism… | 50 | 1122 | active |
| RuoJi6/CACM CACM is a Linux post-exploitation and privilege persistence tool that bundles port scanning, sensitive information gathering, EDR/AV identi… | 85 | 1121 | active |
| termux/proot Termux's patched fork of PRoot, a user-space implementation of chroot, mount --bind, and binfmt_misc built on ptrace. It lets unprivileged … | 77 | 1121 | active |
| Adversis/tailsnitch Tailsnitch is a Go-based CLI security auditor for Tailscale configurations that scans a tailnet for 50+ misconfigurations, overly permissiv… | 74 | 1121 | active |
| projectdiscovery/asnmap asnmap is a Go CLI tool and library that maps organizations to their network ranges (CIDR blocks) using ASN information. It supports lookup… | 67 | 1121 | active |
| defuse/php-encryption A PHP library for symmetric encryption of strings and files using a key or password, built on OpenSSL. Its API is deliberately designed to … | 23 | 3867 | maintenance |
| microsoft/avml AVML is a portable X86_64 userland volatile memory acquisition tool for Linux, written in Rust and distributed as a static binary. It captu… | 92 | 1118 | active |
| vndee/llm-sandbox LLM Sandbox is a lightweight Python library for safely executing LLM-generated code in isolated container environments with support for Doc… | 90 | 1118 | active |
| spyboy-productions/CamXploit CamXploit is a Python-based security reconnaissance tool that checks whether an IP address hosts a potentially exposed IP camera or CCTV se… | 48 | 1118 | active |
| dokku/dokku-letsencrypt The official Dokku plugin for automatically retrieving and installing free Let's Encrypt TLS certificates using the lego ACME client. It ke… | 93 | 1117 | active |
| AvillaDaniel/AvillaForensics Avilla Forensics is a free Windows-based mobile forensic application for logical data extraction from Android and iOS devices, built in C# … | 70 | 1116 | active |
| luoyesiqiu/dpt-shell dpt-shell is an Android Dex protection shell that hollows out DEX method implementations and reconstructs them at runtime to protect APK/AA… | 100 | 1115 | active |
| io12/pwninit pwninit is a Rust CLI tool that automates the setup of binary exploitation challenges, typically for CTF competitions. It detects the chall… | 84 | 1115 | stable |
| cyberus-technology/virtualbox-kvm A KVM backend for VirtualBox that replaces VirtualBox's own hypervisor with the Linux kernel's KVM. It lets users run their existing Virtua… | 62 | 1115 | active |
| mrwadams/stride-gpt STRIDE GPT is an AI-powered threat modeling tool that uses LLMs to generate STRIDE-based threat models, attack trees, and MITRE ATT&CK/ATLA… | 84 | 1112 | active |
| curvefi/curve-contract The official Vyper smart contracts powering Curve.fi's exchange liquidity pools on Ethereum. It includes pool templates, per-pool contract … | 43 | 1112 | active |
| libriscv/libriscv libriscv is an embeddable C++20 RISC-V (RVA23) userspace emulator and sandboxing library focused on ultra-low-latency VM function calls and… | 95 | 1111 | active |
| KJCracks/Clutch Clutch is a fast iOS executable decryption and dumping tool that extracts decrypted binaries and .ipa files from installed apps on jailbrok… | 23 | 3824 | maintenance |
| diffblue/cbmc CBMC (C Bounded Model Checker) is a formal verification tool for C and C++ programs that explores all possible execution paths on bounded i… | 94 | 1109 | active |
| outlaws-bai/Galaxy Galaxy is a Burp Suite extension that automatically decrypts and re-encrypts HTTP traffic whose payloads are encrypted, letting testers wor… | 88 | 1109 | active |
| wstrange/GoogleAuth GoogleAuth is a Java server-side library implementing the Time-based One-Time Password (TOTP) algorithm from RFC 6238, compatible with Goog… | 66 | 1108 | stable |
| fuzzland/ityfuzz ItyFuzz is a blazing-fast bytecode-level hybrid fuzzer for EVM and MoveVM smart contracts that combines symbolic (concolic) execution with … | 55 | 1108 | active |
| vet-run/vet vet is a command-line tool that acts as a safety net for the risky `curl | bash` pattern. It fetches remote scripts, diffs them against pre… | 37 | 1108 | active |
| TheOfficialFloW/h-encore h-encore is a fully chained kernel exploit (jailbreak) for the PlayStation Vita on firmwares 3.65-3.68. It enables kernel and user modifica… | 23 | 1108 | stable |
| PortSwigger/mcp-server A Burp Suite extension by PortSwigger that exposes Burp's capabilities to AI clients via the Model Context Protocol (MCP). It includes an S… | 70 | 1107 | active |
| mgeeky/cobalt-arsenal A collection of battle-tested Aggressor Scripts (CNA) for Cobalt Strike 4.0+ that extend and enhance the red team operator's workflow. It i… | 32 | 1107 | active |
| gamehublite/gamehub-oss A privacy-focused modification of the GameHub Android game launcher that strips tracking, authentication, and bloat from the official APK. … | 10 | 1107 | active |
| CuriousLearnerDev/Online_tools A security tool marketplace application that lets users download, update, and automatically install a large catalog of penetration testing … | 96 | 1106 | active |
| dromara/dongle Dongle is a simple, semantic, and developer-friendly cryptography library for Go, offering a fluent API for encryption, hashing, and encodi… | 83 | 1106 | active |
| moshowgame/Navicat_Keygen_Patch A collection of keygen, patch, and trial-reset tools for bypassing activation of Navicat database client versions 15-17, distributed as DLL… | 47 | 1105 | active |
| safedep/vet vet is an open-source CLI tool for software composition analysis that scans open-source dependencies for malicious packages and vulnerabili… | 93 | 1103 | active |
| D00Movenok/BounceBack BounceBack is a stealth reverse proxy with WAF-like filtering designed to hide red team C2 and phishing infrastructure from blue teams, san… | 73 | 1103 | active |
| lepture/captcha A Python library that generates image and audio CAPTCHAs with customizable fonts, colors, and voice data. It provides simple APIs (ImageCap… | 56 | 1102 | stable |
| juicity/juicity Juicity is a QUIC-based proxy protocol implementation written in Go, inspired by tuic. It ships both a server and a CLI client, with suppor… | 32 | 1102 | active |
| tracelabs/tlosint-vm Trace Labs OSINT VM is a Kali Linux-based virtual machine distribution pre-loaded with open-source intelligence (OSINT) tools and Firefox h… | 87 | 1101 | active |
| hakluke/hakoriginfinder hakoriginfinder is a Go CLI tool that discovers the origin host behind a reverse proxy or WAF. It sends requests with the original Host hea… | 75 | 1101 | active |
| yourtablecloth/TableCloth TableCloth is a Windows application that launches Windows Sandbox to run security programs required by internet banking and e-government si… | 99 | 1100 | active |
| dafthack/MSOLSpray MSOLSpray is a PowerShell-based password spraying tool for Microsoft Online (Azure AD/O365) accounts. It leverages Azure AD OAuth2 error co… | 32 | 1100 | stable |
| Loki LOKI is a free, open-source IOC and YARA scanner written in Python for triaging compromised systems. It detects indicators of compromise vi… | 51 | 3783 | maintenance |
| requireCool/stealth.min.js A repository that automatically generates and publishes the newest stealth.min.js file every Monday at 6 AM UTC. The file is a drop-in Java… | 77 | 1099 | active |
| rhboot/shim shim is a small first-stage UEFI bootloader written in C that loads and validates a second-stage bootloader, enabling Secure Boot on Linux … | 69 | 1099 | active |
| aiqinxuancai/discord-proxy A Windows tool that adds per-application proxy support to the Discord desktop client via DLL injection (version.dll hijacking), avoiding th… | 52 | 1099 | active |
| EnableSecurity/sipvicious SIPVicious OSS is a Python-based toolset for auditing SIP-based VoIP systems, including tools to scan for SIP servers (svmap), enumerate ex… | 89 | 1098 | active |
| prompt-security/clawsec ClawSec is an AGPL-licensed suite of security skills for AI agent runtimes such as OpenClaw, NanoClaw, Hermes, and Picoclaw. It verifies sk… | 80 | 1097 | active |
| mgeeky/ProtectMyTooling A multi-packer wrapper script that daisy-chains various packers, obfuscators, and shellcode loaders to produce obfuscated Red Team implants… | 53 | 1097 | active |
| martin-olivier/airgorah Airgorah is a WiFi security auditing application built in Rust with a GTK4 graphical interface, wrapping the aircrack-ng tools suite. It ca… | 90 | 1096 | active |
| pashov/skills A collection of AI-powered Solidity security skills built by Pashov Audit Group, packaged for use with AI coding assistants like Claude Cod… | 75 | 1096 | active |
| c3c/ADExplorerSnapshot A Python CLI tool that parses AD Explorer snapshot (.dat) files and converts them to BOFHound, BloodHound-compatible JSON, or NDJSON format… | 73 | 1096 | active |
| serjs/socks5-server A lightweight SOCKS5 proxy server written in Go, packaged as a Docker container, built on go-socks5. It supports username/password authenti… | 55 | 1095 | stable |
| deezertidal module collection A curated collection of configuration files, modules, and scripts for the iOS proxy clients Shadowrocket, QuantumultX, and Surge. It provid… | 77 | 1094 | active |
| mcginty/snow Snow is a pure-Rust implementation of the Noise Protocol Framework for building encrypted, authenticated channel handshakes. It supports No… | 64 | 1094 | stable |
| apache/mina-sshd Apache MINA SSHD is a pure-Java library implementing the SSH protocol on both client and server sides, with pluggable I/O back-ends (built-… | 89 | 1093 | stable |
| CYQawa/YunX YunX (云析) is an Android app that parses cloud drive (netdisk) share links from services like Quark, UC, Thunder, Baidu, 139, and 123 Cloud,… | 79 | 1093 | active |
| projectdiscovery/wappalyzergo A high-performance Go library that ports the Wappalyzer technology detection stack, identifying web technologies from HTTP headers and HTML… | 95 | 1092 | active |
| RibShark/OmniDrive OmniDrive is a custom firmware modification for MediaTek MT1959-based Hitachi-LG optical disc drives that unlocks raw sector reading, lead-… | 78 | 1092 | active |
| andrew-d/static-binaries A collection of common *nix tools (nmap, tcpdump, strace, socat, python, etc.) prebuilt as statically-linked binaries, with the Dockerfiles… | 32 | 3753 | maintenance |
| chr233/PureNGA PureNGA is an Xposed module that removes ads and adds quality-of-life features to the NGA (NGA玩家论坛) Android forum client. It supports both … | 98 | 1091 | active |
| google/trillian Trillian is a transparent, cryptographically verifiable append-only data store built on Merkle trees, backed by scalable storage like MySQL… | 83 | 3746 | maintenance |
| lxc/incus-os IncusOS is an immutable, Debian-based Linux operating system purpose-built for running Incus container and virtual machine servers. It leve… | 68 | 1090 | active |
| LyraVoid/FolkPatch FolkPatch is an Android root management application built on KernelPatch that grants root access by patching the boot partition, without re… | 80 | 1088 | active |
| bkerler/mtkclient A Python utility for exploiting, reading, and writing flash memory on MediaTek (MTK) smartphones via the BootROM or preloader. It supports … | 72 | 1088 | active |
| builtbybel/privatezilla Privatezilla is a Windows 10 desktop application that performs a privacy and security check against about 60 critical privacy settings, let… | 23 | 3736 | maintenance |
| memflow/memflow memflow is a Rust library providing a modular framework for physical memory introspection of machines, including live hardware, virtual mac… | 58 | 1087 | active |
| softhsm/SoftHSMv2 SoftHSMv2 is a software implementation of a cryptographic store accessible through the PKCS#11 interface, originally developed as part of t… | 74 | 1085 | active |
| DSE-MSU/DeepRobust DeepRobust is a PyTorch library for adversarial robustness research, providing implementations of attack and defense methods for both image… | 45 | 1085 | active |
| 7thSamurai/steganography A C++ command-line tool that encrypts files with password-protected AES-256-CBC and hides them inside images using Least-Significant-Bit pi… | 32 | 1085 | stable |
| kunai-project/kunai Kunai is an eBPF-based threat-hunting and security-monitoring tool for Linux, often described as the Linux counterpart to Sysmon on Windows… | 81 | 1084 | active |
| bitdefender/bddisasm bddisasm is a fast, lightweight x86/x64 instruction decoder library written in C with no external dependencies, no memory allocation, and t… | 74 | 1084 | active |
| dozoisch/react-google-recaptcha A React component wrapper around Google reCAPTCHA v2, supporting normal, compact, and invisible captcha modes. It handles async loading of … | 32 | 1084 | stable |
| builtbybel/xd-AntiSpy xd-AntiSpy is a Windows 11 privacy utility that lets users disable telemetry and spy-related settings through a simple interface, continuin… | 14 | 1084 | active |