Open Source Python Cybersecurity Tools
Sort By:
Python Cybersecurity Tools
View 564 business solutionsBrowse free open source Python Cybersecurity Tools and projects below. Use the toggles on the left to filter open source Python Cybersecurity Tools by OS, license, language, programming language, and project status.
-
$300 Free Credits to Build on Google CloudPut your $300 in credit toward real workloads, then keep building with free monthly usage for 20+ products. No commitment and no charge until you upgrade.
-
Already Paying for an RMM? Get 50% Off Splashtop AEMAutomated OS and third-party patching for Windows and macOS, CVE prioritization with AI patch summaries, and built-in remote control that also supports Linux. Qualifying organizations switching from another RMM get up to 50% off year one.
-
1
GhostTrack
Useful tool to track location or mobile number
GhostTrack is an open-source OSINT utility designed to help users gather publicly available intelligence related to IP addresses, phone numbers, and online usernames through a command-line workflow. The project is implemented in Python and targets cybersecurity researchers, ethical hackers, and investigators who need a lightweight reconnaissance tool for digital footprint analysis. It provides a menu-driven interface that allows users to select different tracking modes, making the tool accessible even to those with limited scripting experience. GhostTrack can be combined with complementary tools such as Seeker to enhance IP capture workflows and improve investigative coverage. Because it focuses on aggregating open data rather than exploiting systems, the tool positions itself within the information-gathering phase of security assessments and OSINT research. -
2
Maigret
Collect a dossier on a person by username from thousands of sites
Maigret is an open-source OSINT tool designed to collect a dossier on a person by username from thousands of sites. It automates the process of checking for a user's presence across various platforms, aiding in digital investigations. -
3
SpiderFoot
SpiderFoot automates OSINT for threat intelligence and mapping
SpiderFoot is an open-source OSINT automation platform for reconnaissance, threat intelligence, and attack-surface discovery. It collects and correlates data from more than 200 modules and numerous public or API-based sources. Users can investigate domains, IP addresses, subnets, ASNs, email addresses, usernames, phone numbers, people, and cryptocurrency addresses. It runs through a web interface or command line and stores results in SQLite for custom querying. Scans can uncover infrastructure, breaches, exposed services, social accounts, metadata, and dark-web references. Results can be visualized, correlated with configurable rules, and exported in formats such as CSV, JSON, and GEXF. -
4
BerserkArch
A bleeding-edge, security-centric Arch-based Linux distribution.
BerserkArch is a security-focused, performance-tuned Linux operating system (OS) based on Arch Linux, designed for developers, hackers, and technical users. A bleeding-edge, security-centric Arch-based Linux distribution crafted for hackers, developers, and nerds alike. Following the Arch Linux philosophy, it is designed to be highly customizable, allowing users to build their environment with only the components they need, rather than having a lot of pre-installed software like some other security distributions (e.g., Kali Linux). As an Arch-based distribution, it benefits from the rolling release model, providing users with the latest software versions and kernel updates. BerserkArch is a dist "designed to make you powerful" for specific use cases like reverse-engineering binaries and automating exploits, rather than being an easy-to-use distribution for general beginners. -
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
5
Watcher
Open Source Cybersecurity Threat Hunting Platform
Watcher is a file integrity monitoring tool that detects unauthorized changes to files, helping organizations maintain compliance and security. -
6
pyWhat
Identify emails, IP addresses, and more
pyWhat is a Python-based identification tool designed to figure out “what” a piece of text or file content represents, especially in security and OSINT workflows. Given inputs such as hex strings, URLs, email addresses, IP addresses, credit card numbers, cryptocurrency wallets, or entire .pcap capture files, it scans for structured patterns and tells you what it finds. The tool is recursive: it can traverse files and directories to extract meaningful entities, which is useful when analyzing malware samples, network captures, or code repositories at scale. It offers powerful filters called “tags” and distributions that let you narrow results to specific categories like bug bounties, cryptocurrencies, or AWS-related artifacts. For automation and integration, pyWhat provides a CLI with options for rarity filtering, sorting, and JSON export, as well as an API that can be imported into other Python programs. -
7
REDACT
Erase everything. Leave nothing.
REDACT 4.0.0 is an open-source Windows anti-forensics & artifact sanitization suite that permanently destroys 285 system artifacts — browser history, registry traces, NTFS change journals, Windows Recall AI snapshots, live RAM, and encrypted volume key material. New in 4.0.0: Auto-Trigger Engine — 7 triggers: USB Panic, Login Failure, Dead Man's Switch, VPN Disconnect, WiFi Change, Time Window, Forensic Tool Detection. BitLocker and VeraCrypt header destruction renders encrypted volumes permanently unrecoverable. EFS key wipe and Windows Hello NGC store included. Zero-footprint: Transient Execution Splitting, NTFS File Cliff Masking, Registry LastWrite Spoofing. 8 wipe standards: 1-Pass Quick, NIST SP 800-88, HMG IS5, AFSSI-5020, NAVSO P-5239-26, VSITR, 7-Pass DoD 5220.22-M, 35-Pass Gutmann. 13 browsers: Chrome, Edge, Firefox, Brave, Vivaldi, Arc, Zen, Pale Moon, Tor & more. Pro 5: eBay — https://ebay.de/itm/206609583195 | Gumroad — yonaabe.gumroad.com/l/redactpro5 -
8
HunterX AI-Assisted Offensive Security Engine Discover. Validate. Prove. Report. HunterX is not merely a vulnerability scanner. It is an open-source, AI-assisted offensive security engine for planning and running authorized security-assessment missions. It combines reconnaissance, security-tool orchestration, AI-assisted reasoning, hypothesis-driven investigation, vulnerability validation, evidence collection, proof / PoC engineering, replay / reproducibility, correlation, impact assessment and professional reporting into a single workflow. The core message. HunterX does not stop at finding a possible vulnerability. It is built to investigate the hypothesis, validate the behavior, prove the finding, reproduce the evidence, assess the impact, and turn the result into a report-ready security finding. Vulnerability + Evidence + Reproducibility + Proof / PoC + Impact ================ Validated Finding
-
9
ODS3 Virtual Machine Challenge
Virtual Machine Image To Test Penetration Skills
The ODS3 Virtual Machine Challenge are downloadable images that can be run as VMWare or VirtualBox instances. The Idea behind the challenge is to test and exercise web application penetration testing in a controlled environment. These images are great for cyber security students, penetration testers and hobbyist. Care should be taken if installed on an Internet access host as the application are purposely vulnerable to attack and exploitation. -
99.99% Uptime for MySQL and PostgreSQL DatabasesCloud SQL Enterprise Plus delivers near-zero downtime with 35 days of point-in-time recovery. Supports MySQL, PostgreSQL, and SQL Server.
-
10
NeuryxIQ
The Autonomous Security Platform for medical and dental practices
NeuryxIQ. The Autonomous Security Platform for medical and dental practices. Powered by AI Superintelligence. Answers, not alerts. Enterprise security operations and HIPAA posture in one console for practices without a security team: detections ranked by real risk, device inventory, compliance scoring, an automated Security Risk Assessment and 22 HIPAA policy templates. The AI Swarm: eight AI specialists in three tiers (triage, investigation, threat hunting) hand cases to each other across the NIST CSF functions. Each carries a security body of knowledge built from public standards and the published objectives behind the major security certifications, and cites its sources. A person approves actions. Free On-Premises Edition, GPLv2: Windows installer, virtual appliance, Docker Compose. Data stays in the building. Manuals included. Support $199/mo, Install $499, Managed Cloud $500/mo. By Amhage Technology Group LLC. #cybersecurity #HIPAA #healthcare #dental #SIEM #SOC #AI -
11
ENCRYPT
Exchange messages without worrying about the security of information
ENCRYPT is your personal guardian for private conversations. The app lets you encrypt and decrypt messages with a single click. Your secrets remain yours alone, thanks to the powerful `cryptography` library. Why do you need it? Сomplete privacy: No one else can read your secrets. Convenient address book: Easily add recipients and send them encrypted messages. Robust protection: Cutting-edge security algorithms safeguard your data. Simple interface: Easy for anyone to use—no complex settings. Protect your words right now! -
12
KFishMonger O anonimato em primeiro lugar Build Status Enquanto a sociedade evolui, a liberdade se apaga, KFishMonger é uma solução para um cenário perverso, permite. Automação em montagem de ambientes anônimos Um projeto para se discutir e evoluir o anonimato ✨MNONIMATO✨ Recursos Automação em inicialização de VPN Montagem automática de serviços TOR Configuração de DNSCrypt Layout moderno para monitorar o ambiente De fácil customização PARA INSTALAR veja essa playlist: https://www.youtube.com/playlist?list=PLzoythjsH3QPj762VSc8SHlk25Zfw0bQk
-
13
Midbar ESP32 CYD Firebase Edition
A version of Midbar data vault adapted for the ESP32 CYD and WebFlash.
A version of Midbar data vault adapted for the ESP32 CYD and WebFlash. It keeps the cryptographic keys in the ESP32 RAM and stores the ciphertexts (encrypted data) in the Google Firebase. The tutorial is available at: https://www.instructables.com/How-to-Turn-ESP32-CYD-Into-a-Secure-IoT-Data-Vault/ WebFlash for ESP32-CYD: https://northstrix.github.io/Midbar-ESP32-CYD-Firebase-Edition/flash WebFlash for ESP32-CYD2USB: https://northstrix.github.io/Midbar-ESP32-CYD2USB-Firebase-Edition/flash -
14
Midbar Firebase Edition
Midbar Firebase Edition stores data in the cloud, keeps keys on device
Midbar Firebase Edition - is the edition of Midbar that stores the encrypted data in the cloud while keeping the cryptographic keys on the device! It comes with the firmware for the hardware IoT data vault and the desktop app that's synced with the vault via the Google Firebase. A vault and an app can be used without one another. The GitHub repository is available at github.com/Northstrix/Midbar-Firebase-Edition Tutorial for V1 https://www.instructables.com/DIY-IoT-Data-Vault-With-Google-Firebase/ Tutorial for V2 https://medium.com/@Northstrix/syncing-mcu-password-vault-with-desktop-app-using-google-firebase-28963e060444 Tutorial for V3 https://www.instructables.com/DIY-Advanced-IoT-Password-Vault-Synced-With-Deskto/ GitHub Repository: https://github.com/Northstrix/Midbar-Firebase-Edition -
15
NukeRat Framework
Post exploitation framework for advanced Red Team operations
Post exploitation framework for advanced Red Team operations, focused on modern and complex environments. Installation: git clone https://github.com/nukeratframework/nukerat && cd nukerat && sudo bash install.sh all Create operator key: ./nukerat.py server key add operator Server start: ./nukerat.py server start -
16
ProcessFilterExample
EaseFilter Process Filter Driver SDK
The EaseFilter Process Filter Driver SDK is a kernel-mode development kit designed to help developers monitor and control Windows process and thread activities. By intercepting process and thread operations at the kernel level, it enables the development of robust security applications that can prevent unauthorized or malicious processes from executing. With the Process Filter Driver, it allows you to prevent the untrusted executable binaries (malwares) from being launched, protect your data being damaged by the untrusted processes. It also enables your application to get the callback notification for the process/thread creation or termination, from the new process information you can get the parent process Id and thread Id of the new created process, you also can get the exact file name that is used to open the executable file and the command line that is used to execute the process if it is available. -
17
RegistryFilterExample
Registry Filter Driver SDK
The EaseFilter Registry Filter Driver SDK is a powerful, kernel-mode development toolkit designed to help developers monitor, control, and protect Windows registry operations in real time. It enables the development of robust security, compliance, and system integrity solutions by intercepting and managing registry access before it reaches the Windows registry subsystem. The SDK allows your application to receive notifications before any registry operation is processed by the Windows Configuration Manager. By registering a RegistryCallback routine, your application can detect: Registry key creation, deletion, renaming Registry value changes Query operations -
18
SENTINEL
Open-source behavioral intelligence platform for detecting child groom
SENTINEL is an open-source behavioral intelligence platform for detecting child grooming on digital platforms. Released by Sentinel Foundation in April 2026, it analyzes patterns of user behavior over time rather than scanning message content for keywords, identifying grooming sequences before direct harm occurs. Key capabilities: - Behavioral scoring across four signal types: linguistic register shifts, relationship graph evolution, temporal escalation patterns, and fairness gates - Tamper-evident audit logs (cryptographically chained, 7-year retention) for legal proceedings and regulatory compliance - Privacy-preserving federation: platforms share encrypted threat signatures without exposing raw messages or user identities - Demographic parity audits enforced as a deployment gate before any detection model goes live - Built-in compliance for EU Digital Services Act, UK Online Safety Act, COPPA, and GDPR Free for organizations under $100k annual revenue and all non-commerci -
19
Secure VPC Network Generator
Secure VPC Network Generator
Deploys a secure VPC on AWS with public/private subnets using Terraform. This tool provides a calculator and generator for AWS VPC Terraform configurations. It allows you to quickly scaffold a secure VPC with multiple subnets. Quick Start To use this tool, run the generator: bash # Generate a VPC with 3 subnets python lab_runner.py vpc-gen --cidr 10.10.0.0/16 --subnets 3 --output my_vpc.tf -
20
SecureSandbox
EaseFilter Secure Sandbox Example
EaseFilter Secure Sandbox was developed by a set of file system filter driver software development kit which includes file access control filter driver, transparent file encryption filter driver and process filter driver. The EaseFilter Secure Sandbox encompasses file security, file encryption, file monitoring, data loss prevention and process monitoring and protection. EaseFilter file system filter driver is a kernel-mode component that runs as part of the Windows executive above the file system. The EaseFilter file system filter driver can intercept requests targeted at a file system or another file system filter driver. By intercepting the request before it reaches its intended target, the filter driver can extend or replace functionality provided by the original target of the request. The EaseFilter file system filter driver can log, observe, modify, or even prevent the I/O operations for one or more file systems or file system volumes. -
21
VerifyVault
A private, secure, and open source 2 factor authenticator for Windows
VerifyVault is a free and open source 2-Factor Authenticatior for Windows and Linux. The objective of this project is to provide users with a private and transparent 2FA application to secure their accounts. Although this application is in early development, the aim is to provide the most secure 2FA application for users on Windows and Linux. -
22
boundman
Add rule to windows firewall to block inbound and outbound traffic
Boundman is an advanced, user-friendly, and sleek application designed to take control over your network connections. It allows you to efficiently manage and block incoming and outgoing traffic for specific .exe files contained within a chosen folder and its subfolders. With its intuitive PyQt5 graphical interface and robust PowerShell scripts, Boundman provides seamless integration with the Windows Firewall for a powerful network management experience. -
23
cve-2026-82329-jfrog-artifactory
CVE-2026-82329 PoC for JFrog Artifactory
PoC and technical research for CVE-2026-82329 affecting JFrog Artifactory. Includes technical details, exploitation analysis, and reproduction steps for authorized security research and testing. Full technical write-up and analysis available at: https://hackita.it/articoli/cve-2026-82329/ -
24
justniffer is a TCP sniffer. It reassembles and reorders packets and displays the tcp flow in a customizable way. It can log network traffic in web server log format. It can also log network services performances (e.g. web server response times) and extract http content (images, html, scripts, etc)
-
25
kavach
Self-hosted, multi-user password manager that tells you which secrets
