function: security
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| ezyang/htmlpurifier HTML Purifier is a PHP library that filters HTML input using whitelists and aggressive parsing to remove XSS attacks while producing standa… | 71 | 3349 | maintenance |
| stephenfewer/ReflectiveDLLInjection A C library implementing reflective DLL injection, a technique for loading a library from memory into a host Windows process without touchi… | 32 | 3343 | maintenance |
| gwen001/pentest-tools A collection of small custom security scripts in Bash, Python, and PHP for penetration testing and bug bounty quick tasks, covering DNS enu… | 23 | 3323 | maintenance |
| nabla-c0d3/ssl-kill-switch2 SSL Kill Switch 2 is a blackbox Cydia Substrate tweak that disables SSL/TLS certificate validation, including certificate pinning, in iOS a… | 23 | 3311 | maintenance |
| EasyHook/EasyHook EasyHook is a Windows API hooking library that lets you intercept and extend unmanaged code APIs with managed (.NET) or native hook handler… | 23 | 3292 | maintenance |
| s-rah/onionscan OnionScan is a free and open source Go CLI tool for investigating Tor hidden services (.onion sites) on the Dark Web. It scans sites for op… | 23 | 3290 | maintenance |
| notaryproject/notary Notary is a Go implementation of The Update Framework (TUF), providing a client and server for signing and verifying trusted collections of… | 10 | 3286 | maintenance |
| SpacehuhnTech/WiFiDuck WiFi Duck is an open-source firmware for ESP8266 + ATmega32u4 hardware that emulates a USB keyboard to perform keystroke injection (BadUSB)… | 23 | 3274 | maintenance |
| jbtronics/CrookedStyleSheets A proof-of-concept demonstrating website tracking and analytics using only CSS, without any JavaScript. It detects browser type, screen res… | 32 | 3270 | maintenance |
| Ignitetch/AdvPhishing A command-line phishing toolkit that hosts fake login pages for popular services (Facebook, Google, Paytm, Zomato, etc.) and performs real-… | 50 | 3268 | maintenance |
| DhavalKapil/icmptunnel icmptunnel is a C command-line tool that transparently encapsulates IP traffic inside ICMP echo and reply packets, tunneling it through a p… | 23 | 3254 | maintenance |
| MaximeBeasse/KeyDecoder KeyDecoder is a Flutter mobile app that lets pentesters and security enthusiasts measure the bitting of a mechanical key from a photo, usin… | 23 | 3193 | maintenance |
| reactos/reactos ReactOS is a free, open-source operating system written from scratch that is binary-compatible with applications and drivers written for th… | 67 | 17967 | experimental |
| sensepost/reGeorg reGeorg is a Python tool that creates a SOCKS proxy through a compromised bastion webserver by tunneling traffic over HTTP(S) via uploaded … | 37 | 3183 | maintenance |
| Tencent/VasDolly VasDolly is a Gradle plugin and helper library from Tencent for fast multi-channel APK packaging on Android, writing channel metadata into … | 23 | 3160 | maintenance |
| fancycode/MemoryModule A C library that loads Windows DLLs entirely from memory without writing them to disk, bypassing the filesystem-only limitation of LoadLibr… | 32 | 3159 | maintenance |
| ChatSecure/ChatSecure-iOS ChatSecure is a free and open source encrypted chat client for iOS that supports OTR and OMEMO end-to-end encryption over XMPP, with option… | 23 | 3155 | maintenance |
| tiann/FreeReflection FreeReflection is an Android library that removes the reflection restrictions introduced in Android P (and later), letting apps use hidden/… | 23 | 3152 | maintenance |
| sdushantha/wifi-password A Python command-line tool that quickly retrieves the password of the WiFi network you are connected to (or a previously connected SSID). I… | 23 | 3152 | maintenance |
| Hax4us/Nethunter-In-Termux A shell script that installs Kali NetHunter (Kali Linux) inside the Termux app on Android without requiring a rooted phone. It provides com… | 32 | 3128 | maintenance |
| Kyle-Ye/XcodeLLMEligible A shell-based utility that overrides macOS eligibility checks to enable Xcode LLM, Apple Intelligence, and iPhone Mirroring on unsupported … | 10 | 3121 | maintenance |
| salesforce/ja3 JA3 is a standard and set of scripts (Python and Zeek) for generating SSL/TLS client fingerprints that are easy to produce and share for th… | 10 | 3103 | maintenance |
| kishikawakatsumi/UICKeyChainStore UICKeyChainStore is an Objective-C wrapper library for the Apple Keychain on iOS, watchOS, tvOS, and macOS, making Keychain APIs as simple … | 23 | 3085 | maintenance |
| WindySha/Xpatch Xpatch is a Java CLI tool that repackages and re-signs Android APK files so the resulting APK can load installed Xposed modules. It enables… | 50 | 3057 | maintenance |
| risinek/esp32-wifi-penetration-tool An extensible Wi-Fi penetration testing framework for the ESP32 microcontroller, implementing attacks such as PMKID capture, WPA/WPA2 hands… | 23 | 3050 | maintenance |
| momosecurity/aswan Aswan is Momo's open-source risk-control static rule engine, a self-hosted Python/Django service for configuring blacklist/whitelist, boole… | 32 | 3046 | maintenance |
| kkkgo/KMS_VL_ALL KMS_VL_ALL is a batchfile-based smart activation script for Windows and Microsoft Office volume-licensed products. It emulates a KMS server… | 23 | 3038 | maintenance |
| joestump/python-oauth2 A Python library providing a fully tested, abstract interface for building OAuth 1.0 clients and servers. It is a fork of the original pyth… | 32 | 3009 | maintenance |
| NYAN-x-CAT/AsyncRAT-C-Sharp AsyncRAT is an open-source Remote Access Tool (RAT) written in C# that lets an operator remotely monitor and control Windows client machine… | 23 | 3008 | maintenance |
| arthepsy/ssh-audit ssh-audit is a dependency-free Python CLI tool that audits SSH servers by grabbing banners and enumerating key exchange, host key, encrypti… | 32 | 2995 | maintenance |
| noob-hackers/infect Infect is a Bash-based Termux script that generates a link which, when opened on an Android device, executes a destructive payload that for… | 50 | 2984 | maintenance |
| rajkumardusad/IP-Tracer IP-Tracer is a command-line tool for Linux and Termux that retrieves geolocation and information about any IP address using the ip-api serv… | 23 | 2983 | maintenance |
| ac-pm/Inspeckage Inspeckage is an Xposed module that performs dynamic analysis of Android applications by hooking Android API functions to observe runtime b… | 23 | 2982 | maintenance |
| christophetd/CloudFlair CloudFlair is a Python CLI tool that finds the origin servers of websites protected by Cloudflare or CloudFront by searching Censys interne… | 41 | 2972 | maintenance |
| google/nogotofail Nogotofail is an on-path (man-in-the-middle) blackbox network traffic security testing tool built in Python. It detects weak TLS/SSL connec… | 10 | 2951 | maintenance |
| andrewyng/openworker OpenWorker is an open-source desktop AI agent application that completes real work end-to-end — code security reviews with fix branches, cl… | 80 | 16241 | experimental |
| Ekultek/WhatWaf WhatWaf is a Python command-line tool that detects web application firewalls (WAFs) protecting a target web application and attempts to fin… | 23 | 2924 | maintenance |
| matthewpalmer/Locksmith Locksmith is a protocol-oriented Swift library for interacting with the iOS, macOS, watchOS, and tvOS keychain. It provides a simple API fo… | 23 | 2913 | maintenance |
| lastpass/lastpass-cli lastpass-cli is an official command line interface to the LastPass password manager, written in C. It lets users log in, list, add, edit, c… | 30 | 2910 | maintenance |
| laverdet/isolated-vm A Node.js library providing access to V8 isolates to create completely isolated JavaScript environments. It lets you run untrusted or sandb… | 79 | 2906 | maintenance |
| nic-delhi/AarogyaSetu_Android The open-source native Android code of Aarogya Setu, the Government of India's COVID-19 contact-tracing mobile application. It uses Bluetoo… | 32 | 2905 | maintenance |
| mrd0x/BITB A collection of HTML/JavaScript templates implementing the Browser In The Browser (BITB) phishing technique, which renders fake browser win… | 32 | 2897 | maintenance |
| seemoo-lab/nexmon Nexmon is a C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables custom firmware modifications such as monitor … | 64 | 2876 | maintenance |
| pentestmonkey/php-reverse-shell A PHP script that opens an interactive reverse shell connection back to an attacker-controlled listener. It is a well-known utility for pen… | 32 | 2853 | maintenance |
| seclab-ucr/INTANG INTANG is a Linux daemon that evades the Great Firewall of China's TCP reset attacks by desynchronizing the TCP Control Block on censorship… | 44 | 2835 | maintenance |
| AntSwordProject/AntSword-Loader AntSword Loader is the official Electron-based launcher for AntSword, a cross-platform webshell management and post-exploitation tool used … | 23 | 2835 | maintenance |
| tiagorlampert/CHAOS CHAOS is a free and open-source Remote Administration Tool written in Go that generates cross-platform binaries (Windows and Linux) for con… | 23 | 2830 | maintenance |
| grayddq/GScan GScan is a Python-based CLI security tool that automates comprehensive Linux host security checks for incident response. It scans for backd… | 23 | 2826 | maintenance |
| welk1n/JNDI-Injection-Exploit A Java-based penetration testing tool that generates workable JNDI links and starts RMI, LDAP, and HTTP servers to exploit JNDI injection v… | 23 | 2823 | maintenance |
| ohpe/juicy-potato Juicy Potato is a C++ Windows local privilege escalation tool that abuses COM/DCOM activation and impersonation privileges (SeImpersonate/S… | 23 | 2820 | maintenance |
| aydinnyunus/Keylogger A Python-based keylogger that captures keyboard, mouse, screenshot, and microphone inputs from a target computer and emails the data via SM… | 32 | 2811 | maintenance |
| esc0rtd3w/wifi-hacker A shell script that automates attacking wireless connections using the built-in tools of Kali Linux. It supports WEP, WPS, WPA, and WPA2 se… | 23 | 2799 | maintenance |
| lifting-bits/mcsema McSema is a framework that lifts native x86, amd64, aarch64, sparc32, and sparc64 executable binaries (ELF and PE) into LLVM bitcode. It wo… | 10 | 2787 | maintenance |
| Ettercap/ettercap Ettercap is a comprehensive open-source suite for man-in-the-middle attacks on local networks. It supports live connection sniffing, on-the… | 81 | 2784 | maintenance |
| bhavsec/reconspider ReconSpider is an open-source OSINT framework written in Python for scanning IP addresses, emails, websites, and organizations to gather in… | 23 | 2778 | maintenance |
| ShadowsocksR-Live/shadowsocksr-native A lightweight ShadowsocksR (SSRoT) proxy client and server written in pure C, adding TLS-based obfuscation to evade deep packet inspection … | 53 | 2773 | maintenance |
| zodiacon/WindowsInternals Source code for custom tools written by Pavel Yosifovich and Alex Ionescu to accompany the Windows Internals 7th edition book. The tools de… | 23 | 2768 | maintenance |
| cisagov/RedEye RedEye is an open-source visual analytic tool from CISA and PNNL for visualizing and reporting Red Team command-and-control activities. It … | 10 | 2767 | maintenance |
| NextronSystems/APTSimulator APT Simulator is a Windows Batch script toolset that makes a system look as if it was the victim of an APT attack, using tools and output f… | 42 | 2764 | maintenance |
| 1y0n/AV_Evasion_Tool YanRi (AV_Evasion_Tool) is a Windows GUI tool for red teams that generates loaders to evade antivirus detection of shellcode payloads, supp… | 39 | 2763 | maintenance |
| rootm0s/WinPwnage WinPwnage is a Python tool and library that implements UAC bypass, privilege elevation, and persistence techniques for Windows. It can scan… | 32 | 2753 | maintenance |
| martinvigo/email2phonenumber A Python OSINT tool that discovers a target's phone number from just their email address by abusing password reset flows that leak masked p… | 32 | 2747 | maintenance |
| truedread/netflix-1080p A Chrome extension that unlocks 1080p video and 5.1 surround audio playback on Netflix in the desktop Chrome browser. It works by patching … | 23 | 2746 | maintenance |
| shack2/SNETCracker A Windows GUI tool for auditing weak passwords across many network services such as SSH, RDP, SMB, MySQL, Redis, and FTP. It supports batch… | 23 | 2740 | maintenance |
| FuzzySecurity/PowerShell-Suite A collection of PowerShell utilities for interacting with low-level Windows APIs, covering tasks like process creation, runas-style credent… | 32 | 2731 | maintenance |
| Aircoin-official/AirCash AirCash is a decentralized OTC (over-the-counter) platform implemented in Solidity that lets users buy and sell cryptocurrency with fiat mo… | 32 | 2727 | maintenance |
| hanbinglengyue/FART FART is an automated Android app unpacking (dex dumping) tool for ART environments, based on active invocation, implemented on Android 6.0/… | 33 | 2724 | maintenance |
| patrickfav/uber-apk-signer A Java-based command-line tool that signs, zipaligns, and verifies Android APK files using debug or release certificates, supporting v1-v4 … | 23 | 2720 | maintenance |
| nixzhu/MonkeyKing A Swift library for iOS that lets apps share text, URLs, images, audio, video, and files to Chinese social networks (WeChat, QQ, Weibo, Ali… | 23 | 2715 | maintenance |
| aritraroy/PatternLockView PatternLockView is an Android UI library providing a customizable, Material Design ready pattern lock view. It supports listener callbacks … | 32 | 2711 | maintenance |
| DominicBreuker/stego-toolkit A Docker image bundling many popular steganography tools and screening scripts for solving CTF challenges. It provides CLI scripts like che… | 32 | 2687 | maintenance |
| k4m4/kickthemout KickThemOut is a Python command-line tool that kicks devices off a local network by performing an ARP spoofing attack against selected targ… | 23 | 2674 | maintenance |
| everdox/InfinityHook InfinityHook is a Windows kernel library that hooks system calls, context switches, page faults, and DPCs by abusing ETW trace mechanics, r… | 32 | 2673 | maintenance |
| y9nhjy/Proxifier-Keygen A Python CLI keygen that generates registration keys for Proxifier (setup, portable, and Mac variants), based on a reverse-engineering anal… | 28 | 2664 | maintenance |
| flipkart-incubator/Astra Astra is an automated REST API security testing tool from Flipkart that detects vulnerabilities like SQL injection, XSS, broken authenticat… | 32 | 2658 | maintenance |
| b374k/b374k b374k is a single-file PHP webshell providing browser-based remote server management, including a file manager, command and script executio… | 23 | 2657 | maintenance |
| betterlockscreen/betterlockscreen Betterlockscreen is a shell-based lockscreen utility for Linux that wraps i3lock to provide fast, visually appealing lock screens with imag… | 53 | 2653 | maintenance |
| DarthTon/Xenos Xenos is a Windows DLL injector built on the Blackbone library, supporting x86/x64 processes, manual image mapping, managed image injection… | 23 | 2645 | maintenance |
| pointbiz/bitaddress.org A single-file, client-side Bitcoin wallet generator that creates addresses and private keys entirely in the browser with no network request… | 23 | 2639 | maintenance |
| ParrotSec/mimikatz mimikatz is a well-known Windows security tool that extracts plaintext passwords, hashes, PINs, and Kerberos tickets from memory, and suppo… | 32 | 2630 | maintenance |
| matterpreter/DefenderCheck A C# command-line tool that takes a binary as input and splits it iteratively to pinpoint the exact bytes that Microsoft Defender flags on.… | 59 | 2623 | maintenance |
| apple/HomeKitADK Apple's open-source HomeKit Accessory Development Kit implementing the HomeKit Accessory Protocol (HAP) in C. It lets developers prototype … | 10 | 2622 | maintenance |
| AlessandroZ/BeRoot BeRoot is a post-exploitation tool that checks common misconfigurations on Windows, Linux, and macOS hosts to identify potential privilege … | 23 | 2621 | maintenance |
| xoreaxeaxeax/rosenbridge Rosenbridge is a security research project that documents a hardware backdoor in some VIA C3 x86 processors, allowing userland code to bypa… | 32 | 2614 | maintenance |
| open-keychain/open-keychain OpenKeychain is an open-source OpenPGP implementation for Android that manages encryption keys and encrypts, decrypts, and signs messages a… | 32 | 2612 | maintenance |
| DavidBuchanan314/tweetable-polyglot-png A Python tool that packs up to 3MB of arbitrary data into a PNG polyglot file that survives upload to Twitter and other image hosts. It exp… | 32 | 2608 | maintenance |
| obheda12/GitDorker GitDorker is a Python CLI tool that uses the GitHub Search API with a curated list of over 200 dorks to find sensitive information exposed … | 32 | 2577 | maintenance |
| Tuhinshubhra/CMSeeK CMSeeK is a Python 3 command-line suite that detects the content management system (CMS) powering a website, supporting over 180 CMSs inclu… | 65 | 2571 | maintenance |
| gloxec/CrossC2 CrossC2 is a framework that generates cross-platform Cobalt Strike beacon payloads for Linux, macOS, and other Unix-like targets, extending… | 23 | 2568 | maintenance |
| DKJone/DKWechatHelper DKWechatHelper is a feature-rich WeChat tweak/plugin for iOS written in Objective-C, offering automatic red packet grabbing, anti-message-r… | 32 | 2567 | maintenance |
| dfd-tud/deda DEDA is a Python toolkit for extracting, decoding, and anonymising the yellow tracking dots that colour laser printers embed in printouts. … | 32 | 2565 | maintenance |
| brendan-rius/c-jwt-cracker A multi-threaded JWT brute-force secret key cracker written in C using OpenSSL. It attempts to recover the HMAC signing key of a JWT token … | 32 | 2559 | maintenance |
| duo001/evil.js Evil.js is a JavaScript prank library that, when imported into a project, subtly sabotages built-in behavior: Array.includes lies on certai… | 32 | 2548 | maintenance |
| chrisk44/Hijacker Hijacker is an Android GUI wrapper for wireless penetration testing tools including Aircrack-ng, Airodump-ng, MDK3, and Reaver. It lets use… | 10 | 2544 | maintenance |
| x2on/OpenSSL-for-iPhone A shell script and example Xcode project for compiling the OpenSSL library for Apple platforms including iPhone, iPad, Apple Watch, Apple T… | 23 | 2529 | maintenance |
| joaomatosf/jexboss JexBoss is a Python command-line tool for testing and exploiting JBoss Application Server and Java deserialization vulnerabilities. It supp… | 32 | 2518 | maintenance |
| sekey/sekey SeKey is a macOS SSH agent that lets users authenticate to SSH servers using keys stored in the Apple Secure Enclave, unlocked via Touch ID… | 23 | 2517 | maintenance |
| seemoo-lab/openhaystack OpenHaystack is a framework and macOS application for creating custom Bluetooth tracking tags that leverage Apple's Find My (offline findin… | 67 | 13467 | experimental |
| infosec-au/altdns Altdns is a Python CLI tool for DNS reconnaissance that generates permutations, alterations, and mutations of known subdomains using a word… | 32 | 2503 | maintenance |
| oasisfeng/condom Project Condom is an ultra-lightweight Android library that wraps the app Context before passing it to third-party SDKs, blocking harmful b… | 23 | 2480 | maintenance |