Open-source security software
4909 open-source libraries, tools and applications tagged security, ranked by how closely security is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
4909 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| cartography-cncf/cartography Cartography is a Python CLI tool that ingests infrastructure assets and their relationships from 30+ platforms (AWS, GCP, Azure, Kubernetes… | 99 | 4147 | active |
| cifertech/ESP32-DIV ESP32-DIV is open-source firmware (with open schematics and PCB files) for a custom ESP32-S3 handheld device that bundles Wi-Fi, BLE, 2.4GH… | 86 | 4146 | active |
| mlabouardy/komiser Komiser is an open-source, cloud-agnostic inspector that builds an inventory of cloud resources across AWS, GCP, Azure, DigitalOcean, and m… | 76 | 4144 | active |
| app2smile/rules A collection of ad-blocking rule modules and rewrite scripts for iOS proxy tools like Surge, Loon, and Quantumult X. It removes in-app adve… | 60 | 4138 | active |
| HyperDbg HyperDbg is an open-source, hypervisor-assisted debugger for Windows (with Linux support in development) that uses Intel VT-x and EPT to de… | 94 | 4137 | active |
| alexandreborges/malwoverview Malwoverview is a Python command-line first-response tool for threat hunting that queries many threat intelligence sources such as VirusTot… | 97 | 4120 | active |
| r0oth3x49/ghauri Ghauri is a cross-platform Python CLI tool that automates detection and exploitation of SQL injection vulnerabilities in web applications. … | 48 | 4079 | active |
| theori-io/copy-fail-CVE-2026-31431 A proof-of-concept exploit for CVE-2026-31431, a Linux kernel local privilege escalation bug in the authencesn cryptographic template that … | 47 | 4075 | active |
| 0dayCTF/reverse-shell-generator A web-based reverse shell generator that produces common reverse shell payloads, listeners, MSFVenom commands, and HoaxShell integrations w… | 64 | 4073 | active |
| yonggekkk/x-ui-yg A one-click shell installer script for a streamlined fork of the x-ui proxy panel, deploying Xray-based proxy protocols (Reality, Hysteria2… | 64 | 4071 | active |
| urllib3/urllib3 urllib3 is a user-friendly, powerful HTTP client library for Python with thread-safe connection pooling, SSL/TLS verification, retries, and… | 93 | 4068 | stable |
| Boundary HashiCorp Boundary is an identity-aware proxy that provides secure, least-privilege access to hosts and critical systems across clouds and … | 10 | 4067 | active |
| Microsoft SEAL Microsoft SEAL is an open-source homomorphic encryption library written in modern C++, with a .NET wrapper, supporting BFV/BGV and CKKS sch… | 100 | 4054 | active |
| openthread/openthread OpenThread is Google's open-source, Thread Certified implementation of the Thread networking protocol, covering all Thread networking layer… | 99 | 4051 | stable |
| sobolevn/git-secret git-secret is a bash-based command-line tool that encrypts private files with GPG public keys and stores them safely inside a git repositor… | 66 | 4048 | active |
| openssh/openssh-portable Portable OpenSSH is a complete implementation of the SSH protocol version 2 for secure remote login, command execution, and file transfer. … | 77 | 4043 | stable |
| dekuNukem/daytripper Daytripper is an open-source hardware laser tripwire consisting of a wireless transmitter and a USB receiver that hides windows, locks the … | 46 | 4041 | active |
| HdShare/WAuxiliary_Public WAuxiliary is an Xposed/LSPosed module written in Kotlin that adds auxiliary features to the WeChat Android client (versions roughly 8.0.44… | 82 | 4035 | active |
| straight-tamago/misaka26 A macOS application that customizes iOS/iPadOS devices (16.0-26.1) by exploiting the bug used by TrollRestore to modify MobileGestalt and s… | 42 | 4030 | active |
| PerformanC/ReZygisk ReZygisk is an open-source, standalone implementation of Zygisk providing Zygisk API support for KernelSU, APatch, and Magisk on rooted And… | 83 | 4029 | active |
| Kuma Kuma is a CNCF Sandbox, Envoy-based service mesh that provides L4-L7 connectivity, discovery, security (mTLS), observability, and traffic c… | 95 | 4015 | stable |
| APKLab/APKLab APKLab is a VS Code extension that turns the editor into an Android reverse-engineering workbench by integrating Apktool, Jadx, uber-apk-si… | 70 | 4002 | active |
| schwabe/ics-openvpn An open-source OpenVPN client for Android that uses the Android VPNService API to provide VPN connectivity without root access. It is a sta… | 90 | 3999 | active |
| diego-treitos/linux-smart-enumeration A POSIX-compliant shell script that enumerates a local Linux system's security posture to help escalate privileges during pentesting and CT… | 55 | 3992 | active |
| itm4n/PrivescCheck A PowerShell enumeration script that identifies common Windows privilege escalation vulnerabilities and misconfigurations. It also collects… | 98 | 3987 | active |
| SpotBugs SpotBugs is a static analysis tool that finds bugs in Java bytecode, serving as the community-maintained successor to the abandoned FindBug… | 99 | 3954 | active |
| abcz316/SKRoot-linuxKernelRoot SKRoot is a kernel-level hidden root solution for Android that patches stock kernel images without source code, granting root privileges wh… | 93 | 3953 | active |
| speed47/spectre-meltdown-checker A self-contained shell script that checks Linux and BSD systems for vulnerability to transient execution CPU vulnerabilities such as Spectr… | 96 | 3951 | active |
| trustedsec/unicorn Magic Unicorn is a Python CLI tool that generates PowerShell downgrade-attack commands to inject shellcode directly into memory. It support… | 75 | 3950 | active |
| masterking32/MasterHttpRelayVPN A local HTTP/SOCKS5 proxy that tunnels browser traffic through a Google Apps Script relay using domain fronting, making the connection appe… | 50 | 3945 | active |
| leebaird/discover A collection of custom Bash and Python scripts that automate penetration testing tasks including reconnaissance, scanning, enumeration, and… | 77 | 3944 | active |
| a0rtega/pafish Pafish is a Windows testing tool that applies the same VM and sandbox detection techniques used by malware families to check whether an ana… | 10 | 3942 | active |
| M66B/NetGuard NetGuard is a free and open-source no-root firewall application for Android that blocks internet access per app using a local VPN. It allow… | 86 | 3941 | active |
| lanjelot/patator Patator is a multi-purpose, multi-threaded brute-forcing tool written in Python with a modular design supporting dozens of protocols (SSH, … | 39 | 3935 | active |
| oasisfeng/island Island is an Android app that leverages the Android device-owner/profile-owner (DPC) APIs to create isolated 'islands' for cloning or freez… | 38 | 3931 | active |
| hasherezade/pe-sieve PE-sieve is a lightweight Windows tool that scans a given process for malicious implants such as replaced or injected PE files, shellcodes,… | 65 | 3923 | active |
| BrowserBox/BrowserBox BrowserBox is a commercial Remote Browser Isolation (RBI) platform that streams a full modern browser to any client at 60 FPS, keeping web … | 98 | 3920 | active |
| Raptor RAPTOR is an autonomous offensive/defensive security research framework built on top of Claude Code, chaining static analysis, binary analy… | 74 | 3916 | active |
| openbsd/src A read-only Git mirror of OpenBSD's official CVS source repository containing the complete operating system source tree, including the kern… | 77 | 3902 | active |
| ambionics/phpggc PHPGGC is a library of PHP unserialize() payloads (gadget chains) with a command-line tool to generate them, covering frameworks like Larav… | 48 | 3895 | active |
| OWASP Coraza WAF OWASP Coraza is an open-source, enterprise-grade Web Application Firewall (WAF) library written in Go, compatible with ModSecurity SecLang … | 99 | 3894 | stable |
| 1024-lab/smart-admin SmartAdmin is a rapid development platform (scaffold/admin framework) built on SpringBoot 2/3 + Sa-Token + MyBatis-Plus for the backend and… | 80 | 3893 | active |
| SecureDrop SecureDrop is an open-source whistleblower submission system that lets media organizations and NGOs securely accept documents from and comm… | 94 | 3887 | stable |
| Sysbox Sysbox is an open-source container runtime (a specialized runc) that improves container isolation via Linux user-namespaces and procfs/sysf… | 85 | 3881 | active |
| sebaxakerhtc/rdpwrap.ini A community-maintained rdpwrap.ini configuration file for the RDP Wrapper Library by Stas'M, adding support for new Windows builds after ea… | 75 | 3876 | active |
| Pocsuite pocsuite3 is an open-source remote vulnerability testing and proof-of-concept development framework by Knownsec's 404 Team. It provides a P… | 23 | 3876 | active |
| Privacy Badger Privacy Badger is a free browser extension by EFF that automatically learns to block hidden third-party trackers as you browse. It sends Gl… | 93 | 3865 | active |
| acidanthera/Lilu Lilu is an open-source macOS kernel extension (kext) providing a platform for arbitrary kext, library, and process patching. It offers a un… | 62 | 3862 | active |
| trimstray/htrace.sh htrace.sh is a shell-script CLI that combines HTTP/HTTPS request troubleshooting (redirect tracing, headers, body, SSL parameters, custom m… | 32 | 3862 | active |
| HookVip (NewHookVip) NewHookVip is an Xposed module for Android that hooks into target apps to unlock certain membership/VIP features, remove some restrictions,… | 69 | 3855 | active |
| ax/apk.sh A Bash script that automates Android APK reverse engineering tasks such as pulling, decoding, rebuilding, and patching APKs. It wraps apkto… | 66 | 3840 | active |
| uBlock Origin uBO Lite is an efficient, permission-free content blocker browser extension built on the Manifest V3 API, from the uBlock Origin team. It o… | 93 | 3836 | active |
| LifeArchiveProject/WeChatDataAnalysis A desktop application that decrypts WeChat 4.x's encrypted local databases (SQLCipher/WCDB) by scanning memory for the key, then lets users… | 87 | 3833 | active |
| BiliRoamingX/BiliRoamingX BiliRoamingX is a set of ReVanced-powered integrations and patches for the Bilibili Android app, unlocking extra features such as region-re… | 61 | 3831 | active |
| casualsnek/waydroid_script A Python CLI script that installs extras like OpenGapps, Magisk, microG, and ARM translation libraries (libhoudini/libndk) into Waydroid co… | 75 | 3824 | active |
| Serverless DNS Resolver A serverless, Pi-hole-style DNS-over-HTTPS and DNS-over-TLS resolver with configurable blocklists. It deploys to Cloudflare Workers, Deno D… | 58 | 3815 | active |
| ipsw ipsw is a Go-based command-line research framework for downloading, parsing, and analyzing Apple iOS and macOS firmware (IPSW/OTA files), M… | 95 | 3811 | active |
| FossifyOrg/Gallery Fossify Gallery is an open-source, ad-free Android app for browsing, organizing, and editing photos and videos locally. It includes a basic… | 100 | 3810 | stable |
| dcodeIO/bcrypt.js A zero-dependency, pure JavaScript implementation of the bcrypt password hashing algorithm with TypeScript support. It is API-compatible wi… | 80 | 3797 | stable |
| Findomain/Findomain Findomain is a fast subdomain enumeration tool written in Rust that discovers subdomains via Certificate Transparency logs and APIs without… | 78 | 3793 | active |
| pwntester/ysoserial.net ysoserial.net is a proof-of-concept command-line tool that generates deserialization payloads exploiting unsafe .NET object deserialization… | 65 | 3793 | active |
| edoardottt/cariddi Cariddi is a fast command-line web crawler written in Go that takes a list of domains, crawls URLs, and scans for endpoints, secrets, API k… | 84 | 3786 | active |
| scipag/vulscan Vulscan is an Nmap NSE script that turns Nmap into a vulnerability scanner by matching version-detected services against offline vulnerabil… | 49 | 3786 | active |
| getaurora/download Aurora (极光) is a commercial VPN/circumvention client for Android, Windows, and macOS, and this repository serves as its official anti-block… | 32 | 3785 | active |
| nabla-c0d3/sslyze SSLyze is a fast SSL/TLS scanning tool and Python library that analyzes a server's TLS configuration, including certificates, cipher suites… | 77 | 3780 | stable |
| TheMythologist/GenP GenP is an open-source AutoIt patcher that applies binary hex patches to Adobe Creative Cloud applications on Windows to modify their licen… | 72 | 3780 | active |
| aquasecurity/cloudsploit CloudSploit by Aqua is an open-source Cloud Security Posture Management (CSPM) tool that scans cloud infrastructure accounts for misconfigu… | 66 | 3777 | active |
| AdventDevInc/kudu Kudu is a free, open-source (MIT) system maintenance suite for Windows, macOS, and Linux offering 15+ tools including a system cleaner, mal… | 77 | 3760 | active |
| zxcvbn zxcvbn is a JavaScript password strength estimator inspired by password crackers, using pattern matching and conservative estimation agains… | 23 | 16071 | maintenance |
| VirtualXposed VirtualXposed is an Android app that runs apps and Xposed modules inside a virtual environment, enabling Xposed module functionality withou… | 23 | 16067 | maintenance |
| sozu-proxy/sozu Sōzu is a fast, always-up HTTP and TCP reverse proxy written in Rust that can be reconfigured at runtime without reloads and upgrades itsel… | 99 | 3742 | active |
| linuxserver/docker-swag SWAG is a Docker image from LinuxServer.io bundling an Nginx webserver/reverse proxy with PHP support, a built-in Certbot client for automa… | 96 | 3742 | active |
| RhinoSecurityLabs/cloudgoat CloudGoat is Rhino Security Labs' 'Vulnerable by Design' AWS deployment tool that provisions intentionally vulnerable cloud environments fo… | 72 | 3738 | active |
| Mouseww/anything-analyzer An Electron-based all-in-one protocol analysis toolkit that captures HTTP(S) traffic from browsers, desktop apps, terminals, scripts, and m… | 77 | 3734 | active |
| ip-scanner/cloudflare A tool for scanning and discovering Cloudflare IP ranges and hosts, distributed via the ip-scanner organization with an associated Telegram… | 40 | 3732 | active |
| Rabbit-Spec/Surge A personal collection of Surge proxy client configurations, modules, and JavaScript scripts maintained as a self-use backup. It aggregates … | 77 | 3729 | active |
| microcosm-cc/bluemonday bluemonday is a fast, highly configurable HTML sanitizer library for Go, inspired by the OWASP Java HTML Sanitizer. It takes untrusted user… | 26 | 3727 | stable |
| sismo-core/sismo-badges Sismo Badges is the set of Solidity smart contracts powering the Sismo Badge Minting Protocol on Ethereum. It provides an attestations regi… | 23 | 15872 | maintenance |
| mollyim/mollyim-android Molly is a hardened, security-focused fork of the Signal messaging app for Android, adding features like passphrase-encrypted databases at … | 94 | 3717 | active |
| es3n1n/defendnot defendnot is a C++ Windows utility that disables Windows Defender by registering a fake antivirus product through the Windows Security Cent… | 79 | 3713 | active |
| lowRISC/opentitan OpenTitan is an open-source silicon Root of Trust (RoT) project providing commercial-grade, security-certified hardware IP blocks written i… | 81 | 3707 | stable |
| oblador/hush Hush is a free, open-source Safari content blocker for iOS and macOS that blocks cookie consent banners and privacy-invasive tracking scrip… | 62 | 3704 | active |
| ly4k/Certipy Certipy is a Python CLI toolkit for enumerating and abusing Active Directory Certificate Services (AD CS) misconfigurations. It detects and… | 87 | 3702 | active |
| EMBA EMBA is an open-source firmware security analyzer for embedded Linux devices, written in Bash. It automates firmware extraction, static and… | 94 | 3701 | active |
| webhintio/hint webhint is a customizable linting engine for the web that checks sites and code for accessibility, performance, security, cross-browser com… | 61 | 3698 | active |
| S3cur3Th1sSh1t/WinPwn WinPwn is a PowerShell-based automation framework for internal Windows penetration testing and Active Directory security assessment. It bun… | 37 | 3695 | active |
| jwt/ruby-jwt A Ruby gem implementing the RFC 7519 OAuth JSON Web Token (JWT) standard, supporting encoding and decoding of signed tokens with HMAC, RSAS… | 98 | 3687 | stable |
| apple-oss-distributions/xnu The XNU kernel source code, the core of Apple's Darwin operating system used in macOS and iOS. It is a hybrid kernel combining the Mach mic… | 68 | 3685 | active |
| doitintl/kube-no-trouble kubent (Kube-No-Trouble) is a Go CLI tool that scans Kubernetes clusters for usage of deprecated API versions. It detects deprecated resour… | 77 | 3683 | active |
| WithSecureLabs/chainsaw Chainsaw is a Rust-based CLI tool for rapidly searching and hunting through Windows forensic artefacts such as Event Logs, MFT, and registr… | 95 | 3680 | active |
| 9seconds/mtg mtg is a highly opinionated MTPROTO proxy server for Telegram written in Go, designed to let users access Telegram from censored or restric… | 89 | 3680 | active |
| ProGuard ProGuard is a free shrinker, optimizer, obfuscator, and preverifier for Java bytecode. It removes unused code, optimizes bytecode, and rena… | 85 | 3676 | active |
| rage rage is a Rust implementation of the age file encryption format, providing a simple, secure CLI tool and library with small explicit keys, … | 90 | 3672 | active |
| AdaptixC2 AdaptixC2 is an extensible post-exploitation and adversarial emulation (C2) framework for authorized penetration testing, with a Golang tea… | 67 | 3666 | active |
| Lessica/TrollFools TrollFools is an iOS application for TrollStore that performs in-place tweak injection into installed apps using insert_dylib and ChOma. It… | 91 | 3656 | active |
| blechschmidt/massdns MassDNS is a high-performance DNS stub resolver written in C, capable of resolving millions to billions of domain names at over 350,000 loo… | 66 | 3652 | stable |
| tnodir/fort Fort Firewall is a standalone firewall application for Windows 7+ with its own kernel driver. It provides per-application network rules, ba… | 96 | 3634 | active |
| swisskyrepo/SSRFmap SSRFmap is a Python CLI framework that automatically detects and exploits Server-Side Request Forgery vulnerabilities. It takes a Burp Suit… | 72 | 3630 | active |
| momo5502/sogen Sogen is a C++ userspace emulator that runs Windows and Linux binaries at the CPU and syscall level without a real operating system, execut… | 66 | 3625 | active |
| zc-zhangchen/any-auto-register A multi-platform automated account registration and management system with a Web UI, plugin-based extensibility, and batch registration sup… | 58 | 3625 | active |