function: security
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| alexandreborges/malwoverview Malwoverview is a Python command-line first-response tool for threat hunting that queries many threat intelligence sources such as VirusTot… | 97 | 4075 | active |
| google/nsjail NsJail is a lightweight Linux process isolation tool that uses namespaces, cgroups, rlimits, and seccomp-bpf syscall filters (via the Kafel… | 91 | 4074 | stable |
| r0oth3x49/ghauri Ghauri is a cross-platform Python CLI tool that automates detection and exploitation of SQL injection vulnerabilities in web applications. … | 54 | 4070 | active |
| hashicorp/boundary HashiCorp Boundary is an identity-aware proxy that provides secure, least-privilege access to hosts and critical systems across clouds and … | 89 | 4056 | active |
| urllib3/urllib3 urllib3 is a user-friendly, powerful HTTP client library for Python with thread-safe connection pooling, SSL/TLS verification, retries, and… | 89 | 4051 | stable |
| theori-io/copy-fail-CVE-2026-31431 A proof-of-concept exploit for CVE-2026-31431, a Linux kernel local privilege escalation bug in the authencesn cryptographic template that … | 50 | 4049 | active |
| 0dayCTF/reverse-shell-generator A web-based reverse shell generator that produces common reverse shell payloads, listeners, MSFVenom commands, and HoaxShell integrations w… | 68 | 4047 | active |
| dekuNukem/daytripper Daytripper is an open-source hardware laser tripwire consisting of a wireless transmitter and a USB receiver that hides windows, locks the … | 50 | 4040 | active |
| sobolevn/git-secret git-secret is a bash-based command-line tool that encrypts private files with GPG public keys and stores them safely inside a git repositor… | 67 | 4038 | active |
| wux1an/wxapkg A cross-platform desktop GUI tool built with Wails for scanning, decrypting, and unpacking WeChat mini-program .wxapkg files. It restores t… | 69 | 4037 | active |
| cartography-cncf/cartography Cartography is a Python CLI tool that ingests infrastructure assets and their relationships from 30+ platforms (AWS, GCP, Azure, Kubernetes… | 98 | 4028 | active |
| openthread/openthread OpenThread is Google's open-source, Thread Certified implementation of the Thread networking protocol, covering all Thread networking layer… | 98 | 4020 | stable |
| straight-tamago/misaka26 A macOS application that customizes iOS/iPadOS devices (16.0-26.1) by exploiting the bug used by TrollRestore to modify MobileGestalt and s… | 48 | 4017 | active |
| microsoft/SEAL Microsoft SEAL is an open-source homomorphic encryption library written in modern C++, with a .NET wrapper, supporting BFV/BGV and CKKS sch… | 97 | 4016 | active |
| HyperDbg/HyperDbg HyperDbg is an open-source, hypervisor-assisted debugger for Windows (with Linux support in development) that uses Intel VT-x and EPT to de… | 94 | 4012 | active |
| yonggekkk/x-ui-yg A one-click shell installer script for a streamlined fork of the x-ui proxy panel, deploying Xray-based proxy protocols (Reality, Hysteria2… | 64 | 4010 | active |
| kumahq/kuma Kuma is a CNCF Sandbox, Envoy-based service mesh that provides L4-L7 connectivity, discovery, security (mTLS), observability, and traffic c… | 94 | 3995 | stable |
| HdShare/WAuxiliary_Public WAuxiliary is an Xposed/LSPosed module written in Kotlin that adds auxiliary features to the WeChat Android client (versions roughly 8.0.44… | 76 | 3979 | active |
| openssh/openssh-portable Portable OpenSSH is a complete implementation of the SSH protocol version 2 for secure remote login, command execution, and file transfer. … | 76 | 3970 | stable |
| schwabe/ics-openvpn An open-source OpenVPN client for Android that uses the Android VPNService API to provide VPN connectivity without root access. It is a sta… | 85 | 3967 | active |
| diego-treitos/linux-smart-enumeration A POSIX-compliant shell script that enumerates a local Linux system's security posture to help escalate privileges during pentesting and CT… | 59 | 3962 | active |
| APKLab/APKLab APKLab is a VS Code extension that turns the editor into an Android reverse-engineering workbench by integrating Apktool, Jadx, uber-apk-si… | 74 | 3952 | active |
| speed47/spectre-meltdown-checker A self-contained shell script that checks Linux and BSD systems for vulnerability to transient execution CPU vulnerabilities such as Spectr… | 94 | 3947 | active |
| a0rtega/pafish Pafish is a Windows testing tool that applies the same VM and sandbox detection techniques used by malware families to check whether an ana… | 10 | 3946 | active |
| trustedsec/unicorn Magic Unicorn is a Python CLI tool that generates PowerShell downgrade-attack commands to inject shellcode directly into memory. It support… | 70 | 3938 | active |
| itm4n/PrivescCheck A PowerShell enumeration script that identifies common Windows privilege escalation vulnerabilities and misconfigurations. It also collects… | 98 | 3928 | active |
| leebaird/discover A collection of custom Bash and Python scripts that automate penetration testing tasks including reconnaissance, scanning, enumeration, and… | 77 | 3928 | active |
| spotbugs/spotbugs SpotBugs is a static analysis tool that finds bugs in Java bytecode, serving as the community-maintained successor to the abandoned FindBug… | 99 | 3925 | active |
| lanjelot/patator Patator is a multi-purpose, multi-threaded brute-forcing tool written in Python with a modular design supporting dozens of protocols (SSH, … | 42 | 3923 | active |
| masterking32/MasterHttpRelayVPN A local HTTP/SOCKS5 proxy that tunnels browser traffic through a Google Apps Script relay using domain fronting, making the connection appe… | 53 | 3906 | active |
| BrowserBox/BrowserBox BrowserBox is a commercial Remote Browser Isolation (RBI) platform that streams a full modern browser to any client at 60 FPS, keeping web … | 99 | 3901 | active |
| abcz316/SKRoot-linuxKernelRoot SKRoot is a kernel-level hidden root solution for Android that patches stock kernel images without source code, granting root privileges wh… | 85 | 3897 | active |
| cifertech/ESP32-DIV ESP32-DIV is open-source firmware (with open schematics and PCB files) for a custom ESP32-S3 handheld device that bundles Wi-Fi, BLE, 2.4GH… | 89 | 3890 | active |
| oasisfeng/island Island is an Android app that leverages the Android device-owner/profile-owner (DPC) APIs to create isolated 'islands' for cloning or freez… | 42 | 3884 | active |
| freedomofpress/securedrop SecureDrop is an open-source whistleblower submission system that lets media organizations and NGOs securely accept documents from and comm… | 97 | 3878 | stable |
| ambionics/phpggc PHPGGC is a library of PHP unserialize() payloads (gadget chains) with a command-line tool to generate them, covering frameworks like Larav… | 52 | 3876 | active |
| Pocsuite pocsuite3 is an open-source remote vulnerability testing and proof-of-concept development framework by Knownsec's 404 Team. It provides a P… | 27 | 3872 | active |
| hasherezade/pe-sieve PE-sieve is a lightweight Windows tool that scans a given process for malicious implants such as replaced or injected PE files, shellcodes,… | 71 | 3867 | active |
| openbsd/src A read-only Git mirror of OpenBSD's official CVS source repository containing the complete operating system source tree, including the kern… | 77 | 3864 | active |
| trimstray/htrace.sh htrace.sh is a shell-script CLI that combines HTTP/HTTPS request troubleshooting (redirect tracing, headers, body, SSL parameters, custom m… | 32 | 3860 | active |
| PerformanC/ReZygisk ReZygisk is an open-source, standalone implementation of Zygisk providing Zygisk API support for KernelSU, APatch, and Magisk on rooted And… | 85 | 3857 | active |
| acidanthera/Lilu Lilu is an open-source macOS kernel extension (kext) providing a platform for arbitrary kext, library, and process patching. It offers a un… | 68 | 3852 | active |
| M66B/NetGuard NetGuard is a free and open-source no-root firewall application for Android that blocks internet access per app using a local VPN. It allow… | 92 | 3849 | active |
| nestybox/sysbox Sysbox is an open-source container runtime (a specialized runc) that improves container isolation via Linux user-namespaces and procfs/sysf… | 89 | 3840 | active |
| 1024-lab/smart-admin SmartAdmin is a rapid development platform (scaffold/admin framework) built on SpringBoot 2/3 + Sa-Token + MyBatis-Plus for the backend and… | 86 | 3836 | active |
| nolabs-ai/nono nono is a Rust-based CLI and SDK that runs AI coding agents and their tool invocations in ephemeral, kernel-enforced micro sandboxes with c… | 78 | 3830 | active |
| sebaxakerhtc/rdpwrap.ini A community-maintained rdpwrap.ini configuration file for the RDP Wrapper Library by Stas'M, adding support for new Windows builds after ea… | 77 | 3824 | active |
| EFForg/privacybadger Privacy Badger is a free browser extension by EFF that automatically learns to block hidden third-party trackers as you browse. It sends Gl… | 94 | 3822 | active |
| ax/apk.sh A Bash script that automates Android APK reverse engineering tasks such as pulling, decoding, rebuilding, and patching APKs. It wraps apkto… | 73 | 3822 | active |
| elementalsouls/Claude-BugHunter A Claude Code skill bundle that turns Claude into a bug-hunting and red-team assistant, with 83 skills, 15 slash commands, and 681 disclose… | 77 | 3801 | active |
| dcodeIO/bcrypt.js A zero-dependency, pure JavaScript implementation of the bcrypt password hashing algorithm with TypeScript support. It is API-compatible wi… | 81 | 3799 | stable |
| serverless-dns/serverless-dns A serverless, Pi-hole-style DNS-over-HTTPS and DNS-over-TLS resolver with configurable blocklists. It deploys to Cloudflare Workers, Deno D… | 75 | 3794 | active |
| BiliRoamingX/BiliRoamingX BiliRoamingX is a set of ReVanced-powered integrations and patches for the Bilibili Android app, unlocking extra features such as region-re… | 64 | 3789 | active |
| Findomain/Findomain Findomain is a fast subdomain enumeration tool written in Rust that discovers subdomains via Certificate Transparency logs and APIs without… | 76 | 3786 | active |
| pwntester/ysoserial.net ysoserial.net is a proof-of-concept command-line tool that generates deserialization payloads exploiting unsafe .NET object deserialization… | 62 | 3782 | active |
| scipag/vulscan Vulscan is an Nmap NSE script that turns Nmap into a vulnerability scanner by matching version-detected services against offline vulnerabil… | 52 | 3780 | active |
| nabla-c0d3/sslyze SSLyze is a fast SSL/TLS scanning tool and Python library that analyzes a server's TLS configuration, including certificates, cipher suites… | 83 | 3775 | stable |
| getaurora/download Aurora (极光) is a commercial VPN/circumvention client for Android, Windows, and macOS, and this repository serves as its official anti-block… | 32 | 3775 | active |
| aquasecurity/cloudsploit CloudSploit by Aqua is an open-source Cloud Security Posture Management (CSPM) tool that scans cloud infrastructure accounts for misconfigu… | 72 | 3768 | active |
| corazawaf/coraza OWASP Coraza is an open-source, enterprise-grade Web Application Firewall (WAF) library written in Go, compatible with ModSecurity SecLang … | 92 | 3761 | stable |
| VirtualXposed VirtualXposed is an Android app that runs apps and Xposed modules inside a virtual environment, enabling Xposed module functionality withou… | 23 | 16053 | maintenance |
| edoardottt/cariddi Cariddi is a fast command-line web crawler written in Go that takes a list of domains, crawls URLs, and scans for endpoints, secrets, API k… | 84 | 3753 | active |
| dropbox/zxcvbn zxcvbn is a JavaScript password strength estimator inspired by password crackers, using pattern matching and conservative estimation agains… | 23 | 16037 | maintenance |
| ip-scanner/cloudflare A tool for scanning and discovering Cloudflare IP ranges and hosts, distributed via the ip-scanner organization with an associated Telegram… | 44 | 3742 | active |
| casualsnek/waydroid_script A Python CLI script that installs extras like OpenGapps, Magisk, microG, and ARM translation libraries (libhoudini/libndk) into Waydroid co… | 59 | 3734 | active |
| sozu-proxy/sozu Sōzu is a fast, always-up HTTP and TCP reverse proxy written in Rust that can be reconfigured at runtime without reloads and upgrades itsel… | 97 | 3722 | active |
| sismo-core/sismo-badges Sismo Badges is the set of Solidity smart contracts powering the Sismo Badge Minting Protocol on Ethereum. It provides an attestations regi… | 23 | 15880 | maintenance |
| linuxserver/docker-swag SWAG is a Docker image from LinuxServer.io bundling an Nginx webserver/reverse proxy with PHP support, a built-in Certbot client for automa… | 95 | 3714 | active |
| microcosm-cc/bluemonday bluemonday is a fast, highly configurable HTML sanitizer library for Go, inspired by the OWASP Java HTML Sanitizer. It takes untrusted user… | 29 | 3714 | stable |
| yuaotian/antigravity-proxy A Windows transparent proxy injector for the Antigravity editor that forces its traffic through SOCKS5/HTTP proxies via DLL injection and M… | 75 | 3711 | active |
| RhinoSecurityLabs/cloudgoat CloudGoat is Rhino Security Labs' 'Vulnerable by Design' AWS deployment tool that provisions intentionally vulnerable cloud environments fo… | 78 | 3708 | active |
| webhintio/hint webhint is a customizable linting engine for the web that checks sites and code for accessibility, performance, security, cross-browser com… | 65 | 3698 | active |
| HookVip (NewHookVip) NewHookVip is an Xposed module for Android that hooks into target apps to unlock certain membership/VIP features, remove some restrictions,… | 75 | 3696 | active |
| oblador/hush Hush is a free, open-source Safari content blocker for iOS and macOS that blocks cookie consent banners and privacy-invasive tracking scrip… | 65 | 3693 | active |
| S3cur3Th1sSh1t/WinPwn WinPwn is a PowerShell-based automation framework for internal Windows penetration testing and Active Directory security assessment. It bun… | 40 | 3693 | active |
| uBlockOrigin/uBOL-home uBO Lite is an efficient, permission-free content blocker browser extension built on the Manifest V3 API, from the uBlock Origin team. It o… | 95 | 3691 | active |
| jwt/ruby-jwt A Ruby gem implementing the RFC 7519 OAuth JSON Web Token (JWT) standard, supporting encoding and decoding of signed tokens with HMAC, RSAS… | 92 | 3687 | stable |
| doitintl/kube-no-trouble kubent (Kube-No-Trouble) is a Go CLI tool that scans Kubernetes clusters for usage of deprecated API versions. It detects deprecated resour… | 55 | 3682 | active |
| Rabbit-Spec/Surge A personal collection of Surge proxy client configurations, modules, and JavaScript scripts maintained as a self-use backup. It aggregates … | 77 | 3675 | active |
| gadievron/raptor RAPTOR is an autonomous offensive/defensive security research framework built on top of Claude Code, chaining static analysis, binary analy… | 66 | 3672 | active |
| mollyim/mollyim-android Molly is a hardened, security-focused fork of the Signal messaging app for Android, adding features like passphrase-encrypted databases at … | 97 | 3669 | active |
| blacktop/ipsw ipsw is a Go-based command-line research framework for downloading, parsing, and analyzing Apple iOS and macOS firmware (IPSW/OTA files), M… | 95 | 3669 | active |
| 9seconds/mtg mtg is a highly opinionated MTPROTO proxy server for Telegram written in Go, designed to let users access Telegram from censored or restric… | 86 | 3664 | active |
| WithSecureLabs/chainsaw Chainsaw is a Rust-based CLI tool for rapidly searching and hunting through Windows forensic artefacts such as Event Logs, MFT, and registr… | 99 | 3648 | active |
| ly4k/Certipy Certipy is a Python CLI toolkit for enumerating and abusing Active Directory Certificate Services (AD CS) misconfigurations. It detects and… | 94 | 3643 | active |
| kubernetes-sigs/agent-sandbox Agent Sandbox is a Kubernetes SIG project providing a Sandbox Custom Resource Definition (CRD) and controller for managing isolated, statef… | 84 | 3640 | active |
| Guardsquare/proguard ProGuard is a free shrinker, optimizer, obfuscator, and preverifier for Java bytecode. It removes unused code, optimizes bytecode, and rena… | 95 | 3638 | active |
| FossifyOrg/Gallery Fossify Gallery is an open-source, ad-free Android app for browsing, organizing, and editing photos and videos locally. It includes a basic… | 89 | 3637 | stable |
| es3n1n/defendnot defendnot is a C++ Windows utility that disables Windows Defender by registering a fake antivirus product through the Windows Security Cent… | 85 | 3636 | active |
| blechschmidt/massdns MassDNS is a high-performance DNS stub resolver written in C, capable of resolving millions to billions of domain names at over 350,000 loo… | 57 | 3635 | stable |
| str4d/rage rage is a Rust implementation of the age file encryption format, providing a simple, secure CLI tool and library with small explicit keys, … | 97 | 3633 | active |
| e-m-b-a/emba EMBA is an open-source firmware security analyzer for embedded Linux devices, written in Bash. It automates firmware extraction, static and… | 93 | 3614 | active |
| swisskyrepo/SSRFmap SSRFmap is a Python CLI framework that automatically detects and exploits Server-Side Request Forgery vulnerabilities. It takes a Burp Suit… | 76 | 3608 | active |
| lowRISC/opentitan OpenTitan is an open-source silicon Root of Trust (RoT) project providing commercial-grade, security-certified hardware IP blocks written i… | 83 | 3607 | stable |
| Lessica/TrollFools TrollFools is an iOS application for TrollStore that performs in-place tweak injection into installed apps using insert_dylib and ChOma. It… | 74 | 3599 | active |
| Mouseww/anything-analyzer An Electron-based all-in-one protocol analysis toolkit that captures HTTP(S) traffic from browsers, desktop apps, terminals, scripts, and m… | 77 | 3586 | active |
| Haivision/srt SRT (Secure Reliable Transport) is an open-source transport protocol and C++ library for ultra-low-latency live video and audio streaming o… | 95 | 3585 | stable |
| animir/node-rate-limiter-flexible A Node.js/Deno library for counting and limiting events with atomic rate limiting across many backends including Redis, Valkey, Memcached, … | 89 | 3581 | stable |
| nmap/npcap Npcap is the Nmap Project's packet capture and injection library for Microsoft Windows, implementing the portable Pcap API via a custom NDI… | 83 | 3580 | active |
| allinssl/allinssl AllinSSL is a self-hosted, open-source SSL certificate lifecycle management platform with a web dashboard. It automates certificate applica… | 75 | 3580 | active |