Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| romanvht/ByeByeDPI An Android application that runs ByeDPI locally and routes all device traffic through it via Android's VPN mode to bypass DPI-based blockin… | 87 | 6710 | active |
| Suricata Suricata is a high-performance network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring… | 93 | 6683 | stable |
| rust-lang/miri Miri is an interpreter for Rust's mid-level intermediate representation (MIR) that detects undefined behavior in Rust programs. It runs bin… | 77 | 6660 | active |
| iorate/ublacklist uBlacklist is a browser extension that blocks specified sites from appearing in Google and other major search engine results. It supports m… | 99 | 6657 | active |
| The-Z-Labs/linux-exploit-suggester A shell-based auditing tool that assesses a Linux system's exposure to publicly known kernel privilege escalation exploits based on kernel … | 62 | 6626 | active |
| SukiSU-Ultra/SukiSU-Ultra SukiSU-Ultra is a kernel-based Android root solution providing kernel-level su and root access management, with support for KPM kernel modu… | 88 | 6601 | active |
| Mebus/cupp CUPP is a Python CLI tool that generates targeted password wordlists by profiling personal information about a user, such as birthdays, nic… | 70 | 6597 | active |
| Cowrie Cowrie is a medium-to-high interaction SSH and Telnet honeypot that logs brute-force attacks and full attacker shell sessions, capturing up… | 99 | 6594 | active |
| bmrf/tron Tron is an automated Windows PC cleanup and disinfection script, implemented as a collection of batch files that orchestrate many community… | 85 | 6589 | active |
| EnableSecurity/wafw00f WAFW00F is a Python command-line tool that identifies and fingerprints Web Application Firewall (WAF) products protecting a website. It sen… | 72 | 6574 | stable |
| MISP MISP is an open source threat intelligence platform for collecting, storing, correlating, and sharing cyber security indicators, malware an… | 96 | 6546 | stable |
| palera1n palera1n is an open-source jailbreak tool for Apple devices using the checkm8 bootrom exploit, supporting A8 through A11 chips and T2 secur… | 89 | 6528 | active |
| elder-plinius/T3MP3ST T3MP3ST is a multi-agent offensive-security framework that turns existing AI coding agents (Claude Code, Codex, Ollama, etc.) into autonomo… | 65 | 6496 | active |
| Mygod/VPNHotspot An Android app that shares your device's VPN connection over a Wi-Fi hotspot, repeater, or USB/Bluetooth tethering. It requires root access… | 88 | 6472 | active |
| Tock OS Tock is an embedded operating system for low-power, low-memory microcontrollers that runs multiple concurrent, mutually distrustful applica… | 88 | 6467 | active |
| ikarus23/MifareClassicTool An Android NFC application for reading, writing, analyzing, and cloning MIFARE Classic RFID tags. It includes dictionary-based key manageme… | 86 | 6466 | active |
| microsoft/Detours Microsoft Detours is a C++ library for intercepting, monitoring, and instrumenting Win32 API calls on Windows via function hooking and bina… | 67 | 6412 | stable |
| cloud-hypervisor/cloud-hypervisor Cloud Hypervisor is an open source Virtual Machine Monitor (VMM) written in Rust that runs on top of KVM or Microsoft's MSHV hypervisor. It… | 95 | 6405 | active |
| s0md3v/Arjun Arjun is a Python command-line tool that discovers hidden HTTP query parameters for URL endpoints using a large dictionary of over 25,000 p… | 23 | 6402 | active |
| derailed/popeye Popeye is a read-only CLI tool that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations.… | 56 | 6397 | active |
| 5ec1cff/TrickyStore Tricky Store is a Magisk module for Android 10+ that modifies the certificate chain generated during Android key attestation to spoof devic… | 41 | 6391 | active |
| zmap/zmap ZMap is a fast, stateless single-packet network scanner written in C, designed for Internet-wide network surveys such as scanning the entir… | 84 | 6390 | active |
| Gitleaks Gitleaks is an open-source CLI tool for detecting secrets like passwords, API keys, and tokens in git repositories, files, directories, and… | 87 | 29941 | maintenance |
| crytic/slither Slither is a Python-based static analysis framework for Solidity and Vyper smart contracts. It runs vulnerability detectors, prints contrac… | 90 | 6374 | active |
| BrowserWorks/waterfox Waterfox is a free, open-source web browser built on the Mozilla Firefox/Gecko platform with telemetry and data collection disabled at buil… | 98 | 6352 | active |
| google/syzkaller syzkaller is an unsupervised coverage-guided kernel fuzzer originally built for the Linux kernel and now supporting FreeBSD, Fuchsia, gViso… | 77 | 6352 | active |
| AzeemIdrisi/PhoneSploit-Pro PhoneSploit Pro is an all-in-one Python CLI tool for remotely exploiting and testing Android devices using ADB and the Metasploit Framework… | 90 | 6343 | active |
| sigstore/cosign Cosign is a CLI tool from the Sigstore project for signing and verifying OCI containers and other software artifacts, with support for keyl… | 95 | 6339 | stable |
| dnSpy dnSpy is a Windows GUI application for debugging and editing .NET and Unity assemblies without needing source code. It combines a debugger,… | 10 | 29672 | maintenance |
| Bjorn Bjorn is an autonomous network scanning and offensive security tool that runs on a Raspberry Pi with a 2.13-inch e-Paper HAT. It discovers … | 58 | 6328 | active |
| androguard/androguard Androguard is a full Python tool and library for reverse engineering and analyzing Android files, including DEX/ODEX bytecode disassembly a… | 80 | 6323 | active |
| DanTheMan827/ios-app-signer A macOS GUI application that re-signs iOS/tvOS apps and bundles them into installable ipa files. It accepts ipa, deb, app, and xcarchive in… | 66 | 6323 | active |
| projectdiscovery/naabu Naabu is a fast, lightweight port scanner written in Go that performs SYN, CONNECT, and UDP scans to enumerate open ports on hosts. It is d… | 87 | 6320 | active |
| mviereck/x11docker x11docker is a shell-based CLI tool that runs graphical applications and entire desktop environments inside Docker, podman, or nerdctl cont… | 78 | 6320 | stable |
| anthropics/claude-code-security-review A GitHub Action that uses Anthropic's Claude to perform AI-powered security reviews of pull requests, analyzing code diffs for vulnerabilit… | 45 | 6319 | active |
| PeerBanHelper PeerBanHelper is a self-hosted Java application that automatically bans unwanted, leeching, and abnormal BitTorrent peers by connecting to … | 85 | 6284 | active |
| capa capa is Mandiant FLARE's open-source tool that identifies capabilities in executable files (PE, ELF, .NET, shellcode) by matching expert-wr… | 95 | 6261 | active |
| dehydrated-io/dehydrated Dehydrated is an ACME client for signing TLS certificates from CAs like Let's Encrypt and ZeroSSL, implemented as a single bash/zsh-compati… | 55 | 6259 | active |
| Outline Outline is a pair of open-source applications from Jigsaw (Google) for creating and using your own VPN server: Outline Manager sets up and … | 67 | 6254 | active |
| Trusted-AI/adversarial-robustness-toolbox Adversarial Robustness Toolbox (ART) is a Python library for machine learning security covering evasion, poisoning, extraction, and inferen… | 56 | 6250 | stable |
| PhilippC/keepass2android Keepass2android is an open-source password manager app for Android, compatible with the KeePass 2.x database format. It stores credentials … | 96 | 6247 | active |
| auth0/java-jwt A Java library for creating and verifying JSON Web Tokens (JWT) per RFC 7519, supporting HMAC, RSA, and ECDSA signing algorithms. It is mai… | 92 | 6237 | active |
| k8gege/K8tools K8tools is a large curated collection of penetration testing and offensive security tools covering internal network penetration, privilege … | 32 | 6234 | active |
| express-validator/express-validator express-validator is an Express.js middleware wrapping the validator.js library for request validation and sanitization. It lets you declar… | 80 | 6233 | stable |
| mishakorzik/AllHackingTools AllHackingTools is an all-in-one installer and menu system for Termux that automates downloading and installing a large collection of penet… | 75 | 6215 | active |
| DominicBreuker/pspy pspy is a command line tool that snoops on Linux processes without root permissions by combining procfs scans with inotify watchers to catc… | 50 | 6211 | stable |
| Dicklesworthstone/destructive_command_guard A high-performance Rust CLI hook that intercepts and blocks destructive git and shell commands before AI coding agents execute them. It int… | 79 | 6200 | active |
| expressjs/cors A Node.js middleware for Express and Connect that sets CORS response headers, telling browsers which origins may read responses from your s… | 64 | 6193 | stable |
| Azure/Azure-Sentinel The official community repository for Microsoft Sentinel, a cloud-native SIEM, containing out-of-the-box detections, hunting queries, workb… | 77 | 6189 | active |
| GhostTroops/scan4all scan4all is a Go-based automated vulnerability scanning and reconnaissance tool that integrates vscan, nuclei, ksubdomain, and subfinder. I… | 23 | 6178 | active |
| GmSSL GmSSL is an open-source cryptographic toolkit developed at Peking University implementing Chinese national commercial cryptography standard… | 74 | 6166 | stable |
| Passbolt Passbolt Community Edition API is the JSON backend for the open source, security-first password manager for teams, built in PHP on CakePHP.… | 96 | 6136 | stable |
| AutoRecon/AutoRecon AutoRecon is a multi-threaded Python CLI tool that automates network reconnaissance by performing port and service detection scans, then la… | 57 | 6128 | active |
| qilingframework/qiling Qiling is a Python-based binary emulation framework built on Unicorn Engine that emulates executables across multiple platforms (Windows, m… | 85 | 6110 | active |
| foxcpp/maddy Maddy is a composable all-in-one mail server written in Go that combines an SMTP MTA/MX, IMAP storage, and email security protocols (DKIM, … | 98 | 6107 | active |
| FATE FATE (Federated AI Technology Enabler) is an industrial-grade open-source federated learning framework hosted by the Linux Foundation. It e… | 23 | 6107 | active |
| Proxmark3 The Iceman fork of Proxmark3, the client software for the Proxmark3 RFID analysis device, supporting reading, cloning, simulating, and snif… | 88 | 6100 | active |
| cloud-custodian/cloud-custodian Cloud Custodian (c7n) is a Python-based stateless rules engine for managing public cloud accounts and resources via YAML policy DSLs with f… | 95 | 6088 | stable |
| agentcodee/cursor-free-everyday A desktop application written in Rust that automates resetting free trial quotas for AI code editors like Cursor, Windsurf, Kiro, and Codex… | 56 | 6083 | active |
| ESP32 Bit Pirate ESP32 Bit Pirate is open-source C++ firmware that turns an ESP32-S3 board into a multi-protocol hardware debugging and analysis workbench, … | 86 | 6078 | active |
| undergroundwires/privacy.sexy privacy.sexy is an open-source desktop application that enforces privacy and security best practices on Windows, macOS, and Linux. It provi… | 56 | 6075 | active |
| lesspass/lesspass LessPass is a stateless, open-source password manager that deterministically generates site-specific passwords from a single master passwor… | 77 | 6065 | active |
| gerardog/gsudo gsudo is a sudo equivalent for Windows that lets users run commands or relaunch shells with elevated permissions from the current console. … | 64 | 6059 | active |
| langren1353/GM_script A collection of Tampermonkey/Greasemonkey userscripts, most notably AC-baidu, which removes redirects and ads from Baidu, Sogou, Google, Bi… | 73 | 6058 | active |
| alpkeskin/mosint Mosint is an automated email OSINT tool written in Go that investigates target email addresses by consolidating multiple services. It check… | 23 | 6048 | active |
| TsudaKageyu/minhook MinHook is a minimalistic, lightweight C library for intercepting (hooking) x86 and x64 function calls on Windows, using a trampoline/detou… | 65 | 6012 | stable |
| Recon-ng Recon-ng is a full-featured, modular reconnaissance framework for conducting web-based open source intelligence (OSINT) gathering. It offer… | 76 | 6003 | active |
| Ackites/KillWxapkg A Go-based CLI tool that automatically decrypts, unpacks, and decompiles WeChat mini-program .wxapkg packages, restoring the original proje… | 14 | 5995 | active |
| samolego/Canta Canta is an Android app that lets users uninstall any app without root access, powered by Shizuku. It includes community-powered recommenda… | 82 | 5987 | active |
| FluxionNetwork/fluxion Fluxion is a security auditing and social-engineering research tool that retrieves WPA/WPA2 keys via phishing attacks using rogue access po… | 91 | 5985 | active |
| openpgpjs/openpgpjs OpenPGP.js is a pure JavaScript implementation of the OpenPGP protocol (RFC 9580), maintained by Proton Mail. It lets applications encrypt,… | 87 | 5966 | stable |
| EFForg/rayhunter Rayhunter is an EFF-developed Rust tool that detects IMSI catchers (cell-site simulators, also known as stingrays) used for cellular survei… | 93 | 5945 | active |
| garinasset/leak-check A self-hostable personal information leak detection service that checks whether your personal data (name, phone, email, address, QQ, etc.) … | 45 | 5921 | active |
| vimeo/psalm Psalm is an open-source static analysis tool for PHP that finds type-related bugs and security vulnerabilities through type inference and t… | 98 | 5896 | active |
| NetExec NetExec (nxc) is a community-maintained, open-source network execution tool and successor to CrackMapExec, used for pentesting and red-team… | 73 | 5882 | active |
| commix Commix (short for command injection exploiter) is an open-source penetration testing tool that automates the detection and exploitation of … | 72 | 5874 | active |
| microsoft/sudo Sudo for Windows is a Windows-specific implementation of the sudo concept, letting users run elevated commands directly from unelevated ter… | 70 | 5862 | active |
| RedSiege/EyeWitness EyeWitness is a Python CLI tool that takes screenshots of websites using headless Chromium, captures server header information, and identif… | 46 | 5858 | active |
| OpenFGA OpenFGA is a high-performance, open-source fine-grained authorization and permission engine inspired by Google's Zanzibar, owned by the CNC… | 97 | 5846 | stable |
| seL4/seL4 seL4 is a formally verified microkernel operating system kernel written in C, providing high-assurance isolation and capability-based secur… | 87 | 5821 | active |
| RIOT OS RIOT is an open-source, vendor-independent operating system for Internet of Things and embedded devices, supporting 8/16/32-bit microcontro… | 93 | 5820 | active |
| jedisct1/dsvpn DSVPN is a dead-simple, single-binary VPN tool written in C that tunnels traffic over TCP with modern, formally verified cryptography. It r… | 70 | 5817 | stable |
| fscarmen/sing-box A one-click shell script that deploys and manages a sing-box multi-protocol proxy server on a VPS, supporting protocols like Reality, Hyste… | 73 | 5809 | active |
| win-acme/win-acme win-acme is an ACMEv2 client for Windows that automates obtaining and installing SSL/TLS certificates from Let's Encrypt, ZeroSSL, and othe… | 58 | 5806 | active |
| freedomofpress/dangerzone Dangerzone is a desktop application from Freedom of the Press Foundation that converts untrusted documents (PDFs, office files, images) int… | 86 | 5785 | active |
| cinit/QAuxiliary QAuxiliary is an open-source Xposed module based on QNotified that adds extra features and tweaks to the QQ and TIM Android messaging clien… | 89 | 5780 | active |
| letsencrypt/boulder Boulder is the Go implementation of an ACME-based certificate authority that powers Let's Encrypt. It automates domain validation and issua… | 95 | 5764 | active |
| rack/rack-attack Rack::Attack is Rack middleware for protecting Ruby and Rails web applications from abusive clients. It lets you define rules to allow, blo… | 66 | 5764 | stable |
| OpenSSF Scorecard OpenSSF Scorecard is an automated tool that scores open source projects on security best practices through a series of checks. It can be ru… | 91 | 5761 | active |
| elceef/dnstwist dnstwist is a Python command-line tool that generates permutations of a domain name (typos, homoglyphs, IDN tricks) and checks which ones r… | 26 | 5758 | active |
| burrowers/garble Garble is a CLI tool that obfuscates Go binaries by wrapping the Go toolchain's compiler and linker. It replaces identifiers, package paths… | 93 | 5749 | active |
| pfSense pfSense is a free, open-source network firewall and router distribution based on FreeBSD with a custom kernel, managed entirely through a w… | 62 | 5742 | stable |
| telemt/telemt Telemt is a high-performance MTProxy server for Telegram written in Rust with Tokio, implementing all official MTProto proxy modes includin… | 78 | 5705 | active |
| Piko Piko is a collection of Morphe patches that modify the Twitter/X and Instagram Android apps to add features like ad blocking, download capa… | 94 | 5691 | active |
| CookieConsent CookieConsent is a lightweight, GDPR and CCPA compliant cookie consent management plugin written in vanilla JavaScript with no dependencies… | 61 | 5683 | active |
| Snyk CLI The Snyk CLI is a command-line tool that scans projects for security vulnerabilities across open-source dependencies, application code, con… | 97 | 5668 | active |
| bethington/ghidra-mcp A Model Context Protocol (MCP) server and Ghidra plugin exposing 250+ tools that let AI agents drive Ghidra's reverse engineering capabilit… | 81 | 5661 | active |
| next-terminal/next-terminal Next Terminal is an open-source bastion host (jump server) and interactive session auditing system supporting SSH, RDP, VNC, Telnet, HTTP, … | 96 | 5647 | active |
| OWASP/Nettacker OWASP Nettacker is a Python-based automated penetration testing and information-gathering framework for reconnaissance, vulnerability scann… | 84 | 5616 | active |
| google/clusterfuzz ClusterFuzz is Google's scalable fuzzing infrastructure that finds security and stability bugs in software, serving as the backend for OSS-… | 95 | 5613 | active |