Open Source Windows Cybersecurity Tools
Sort By:
Cybersecurity Tools for Windows
View 164 business solutionsBrowse free open source Cybersecurity tools and projects for Windows below. Use the toggles on the left to filter open source Cybersecurity tools by OS, license, language, programming language, and project status.
-
Build Agents and Models on One PlatformGemini Enterprise Agent Platform is Google Cloud's comprehensive platform for developers to build, scale, govern, and optimize agents and models. Choose from Google's most advanced models and third-party models like Anthropic's Claude Model Family.
-
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
1
Ghidra
Ghidra is a software reverse engineering (SRE) framework
Ghidra is a free and open-source reverse engineering framework developed by the NSA for analyzing compiled software. It supports a wide array of instruction sets and executable formats, offering features such as decompilation, disassembly, scripting, and interactive graphing. Designed for security researchers and analysts, Ghidra provides a robust environment for understanding malware, auditing code, and performing software forensics. It includes both GUI-based and headless analysis modes. -
2
Maigret
Collect a dossier on a person by username from thousands of sites
Maigret is an open-source OSINT tool designed to collect a dossier on a person by username from thousands of sites. It automates the process of checking for a user's presence across various platforms, aiding in digital investigations. -
3
SpiderFoot
SpiderFoot automates OSINT for threat intelligence and mapping
SpiderFoot is an open-source OSINT automation platform for reconnaissance, threat intelligence, and attack-surface discovery. It collects and correlates data from more than 200 modules and numerous public or API-based sources. Users can investigate domains, IP addresses, subnets, ASNs, email addresses, usernames, phone numbers, people, and cryptocurrency addresses. It runs through a web interface or command line and stores results in SQLite for custom querying. Scans can uncover infrastructure, breaches, exposed services, social accounts, metadata, and dark-web references. Results can be visualized, correlated with configurable rules, and exported in formats such as CSV, JSON, and GEXF. -
4
Greenplum Database
Massive parallel data platform for analytics, machine learning and AI
Rapidly create and deploy models for complex applications in cybersecurity, predictive maintenance, risk management, fraud detection, and many other areas. With its unique cost-based query optimizer designed for large-scale data workloads, Greenplum scales interactive and batch-mode analytics to large datasets in the petabytes without degrading query performance and throughput. Based on PostgreSQL, Greenplum provides you with more control over the software you deploy, reducing vendor lock-in, and allowing open influence on product direction. Greenplum reduces data silos by providing you with a single, scale-out environment for converging analytic and operational workloads, like streaming ingestion. All major Greenplum contributions are part of the Greenplum Database project and share the same database core, including the MPP architecture, analytical interfaces, and security capabilities. -
Train ML Models With SQL You Already KnowBuild and deploy ML models using familiar SQL. Automate data prep with built-in Gemini. Query 1 TB and store 10 GB free monthly.
-
5
cyborghawk v1.1
Latest-v1.1 of The World's most advanced pen testing distribution ever
updated version of The most advanced, powerful and yet beautiful penetration testing distribution ever created.Lined up with ultimate collection of tools for pro Ethical Hackers and Cyber Security Experts. Simplify security in your IT infrastructure with Cyborg. Its real strength comes from the understanding that a tester requires a strong and efficient system,that benefits from a strong selection of tools, integrated with a stable linux environment. -
6
SafeLine
Serve as a reverse proxy to protect your web services from attacks
SafeLine is a self-hosted WAF(Web Application Firewall) to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web apps from attacks such as SQL injection, XSS, code injection, os command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoor, brute force, HTTP-flood, bot abuse, among others. By deploying a WAF in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects a client machine’s identity by using an intermediary, a WAF is a type of reverse-proxy, protecting the server from exposure by having clients pass through the WAF before reaching the server. A WAF protects your web apps by filtering, monitoring, and blocking any malicious HTTP/S traffic traveling to the web application. -
7
Cyber Security Mindmap
This repository will contain many mindmaps for cyber security tech
Cyber Security Mindmap is a large visual reference collection for cybersecurity tools, technologies, methods, courses, and certifications. It organizes complex subjects into tree-shaped diagrams that show relationships and learning paths at a glance. Topics include penetration testing, red teaming, OSINT, forensics, cloud and container security, compliance, networking, and privilege escalation. Tool-focused maps cover products and utilities such as Nmap, Wireshark, Metasploit, Burp Suite, Shodan, Hashcat, and sqlmap. Additional diagrams address vulnerability classes, enumeration methods, search operators, privacy resources, and professional certifications. Most content is distributed as images grouped into topic directories for direct viewing or download. The repository is intended for learners, practitioners, exam candidates, and security teams that need compact visual study aids. -
8
reverse-skill
Reverse Engineering and Authorized Penetration Testing
reverse-skill is a cybersecurity skill router for AI coding agents working on authorized reverse engineering, penetration testing, CTF, and security research tasks. It analyzes the target type and directs the agent to an appropriate methodology instead of relying on improvised commands. Its playbooks cover Android and iOS applications, native binaries, .NET, JavaScript, firmware, malware, APIs, supply chains, and other specialized scenarios. The package checks locally available tools and can bootstrap supporting scripts, MCP servers, and utilities when needed. Scope gates, case initialization, timelines, evidence chains, reports, and field journals encourage repeatable and auditable work. It supports clients such as Claude Code, Codex CLI, Cursor, and Cline across Windows, Linux, macOS, and Kali Linux. The repository also preserves reusable lessons so later investigations can avoid previously documented mistakes. -
9
Scalytics Open Intelligence - OSINT
Open OSINT stack for monitoring, analysis, and risk detection
EUOSINT is the open-source edition of the OSINT pipeline built by Scalytics for real-world intelligence monitoring, situation analysis, and risk detection. It is not a toy dashboard or a loose script bundle. It is a packaged operational stack with a web interface, a Go-based collector runtime, configurable ingestion and refresh cadence, Docker-first deployment, and local or server installation options. The public release removes non-public and protected integrations while preserving the pipeline structure and deployment model that make the system usable in practice. EUOSINT is built for teams that need continuous monitoring, reproducible installs, and a base they can extend for their own intelligence and security workflows. -
99.99% Uptime for MySQL and PostgreSQL DatabasesCloud SQL Enterprise Plus delivers near-zero downtime with 35 days of point-in-time recovery. Supports MySQL, PostgreSQL, and SQL Server.
-
10
usb-guard
Turn any USB flash drive into a master key for your PC
USB Guard is an advanced workstation security solution for Windows that turns USB drives into physical authentication keys using native Windows Kernel APIs. - Zero-Trust Security: Validates unique hardware serial numbers through direct Kernel API calls, ensuring only authorized USB drives can unlock your PC. - Brute-Force Protection: Exponential delay penalties after failed unlock attempts prevent automated attacks. - High-Fidelity Lock Screen: Glassmorphism aesthetics with GPU-accelerated blur effects that blend seamlessly with your desktop wallpaper. - System Integration: Auto-mutes volume when locked, persists via Windows Registry, and covers all connected monitors. - Master Recovery Key: Exportable backup codes ensure you never get permanently locked out. - Lightweight: Runs efficiently using direct native APIs instead of heavy middleware, keeping resource usage minimal. Built with .NET 10, WPF, and Fluent Design. Open source under MIT License. -
11
Watcher
Open Source Cybersecurity Threat Hunting Platform
Watcher is a file integrity monitoring tool that detects unauthorized changes to files, helping organizations maintain compliance and security. -
12
Full Stack Computer Scanner
Scans for Windows computer system integrity
Full Stack Computer Scanner brings 30 years of full-time IT experience to Windows security diagnostics. Created by Keith of KCJ Tech Solutions, it helps you understand your system and assess integrity alongside AV results. Read-only. Fully offline. No ads, accounts, or data collection. Download only official binaries from this SourceForge project. Discuss your Windows computer security concerns with Keith and understand your findings. Security check consults are available by chat only (21+), with no remote access. 20 minutes: $40. 40 minutes: $80. Contact: fullstackcomputerscanner@gmail.com The free app is limited. For the full app with 100 scans, please make a $100 USD dev donation and email your receipt number as text to the email above. The latest dev build will be provided within 24 hours. CashApp: $computersafety Venmo: @computersafety BTC: bc1qz259yr4q89r0669zm9mrvs2trkyw0z4kazzx0n Connect: https://www.linkedin.com/in/keithjohnsontechnicalwriter -
13
pyWhat
Identify emails, IP addresses, and more
pyWhat is a Python-based identification tool designed to figure out “what” a piece of text or file content represents, especially in security and OSINT workflows. Given inputs such as hex strings, URLs, email addresses, IP addresses, credit card numbers, cryptocurrency wallets, or entire .pcap capture files, it scans for structured patterns and tells you what it finds. The tool is recursive: it can traverse files and directories to extract meaningful entities, which is useful when analyzing malware samples, network captures, or code repositories at scale. It offers powerful filters called “tags” and distributions that let you narrow results to specific categories like bug bounties, cryptocurrencies, or AWS-related artifacts. For automation and integration, pyWhat provides a CLI with options for rarity filtering, sorting, and JSON export, as well as an API that can be imported into other Python programs. -
14
Stegcore
A cross-platform crypto-steganography toolkit
Stegcore combines cryptography and steganography to hide encrypted data inside ordinary files. It encrypts your payload before embedding it, so the hidden content is unreadable even if someone extracts it, and invisible to anyone who doesn't know it's there. Unlike basic steganography tools that hide data without encrypting it, Stegcore ensures the payload is cryptographically protected at rest. Unlike pure encryption tools, the payload isn't even visible. Designed for journalists, security researchers, red teamers, digital forensics professionals, and CTF participants. -
15
DISCLAIMER: USE ON YOUR OWN RISK. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER OR CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES !!! ONLY FOR PENTESTING PURPOSES !!!
-
16
SCADA-LTS
A comprehensive Supervisory Control, Data Acquisition, and Execution
SCADA-LTS is an advanced FOSS, web-based, multi-platform environment designed to build your own Supervisory Control, Data Acquisition, and Management Execution Software - SCADA/MES. Its architecture provides a robust foundation for complex industrial automation and monitoring. Optimized for Smart Infrastructure, it is highly capable of managing industrial PV/BESS, Smart buildings, municipal Water networks or Wastewater treatment, ANPR telemetry, City-wide lighting, and other diverse data administration workflows. Beyond standard use, SCADA-LTS serves as a secure "independent source of truth" in sandboxed or zero-trust environments. It enhances critical infrastructure with cyber-alarm functionality, emergency operation scenarios, and vital operational visibility. Developed since 2015 on behalf of Abil'I.T. and supported by a global community, the project focuses on stability, security, and modernizing the codebase to meet the demands of industry, defense, and wide-area distributed -
17
IP Availability Scanner
Fast IP and Port Scanner
This utility efficiently scans IP addresses and gathers host names and MAC addresses. It offers the capability to export scan results and includes features for port scanning of selected hosts. Enhanced with a multithreaded framework, the tool delivers increased speed, supporting functionalities like trigger actions and banner grabbing during port scans. For more advanced options, right-click on the displayed grids. This context menu includes options for port scanning, copying results, and network diagnostics tools like ping and traceroute. Additionally, it allows for easy access to ports using standard protocols such as SSH. A convenient feature is the ability to quickly identify the manufacturer of a MAC address with a simple mouse click. Moreover, the interface is user-friendly, enabling sorting of information by simply clicking on the column headers in the display grid. For more information, visit https://vonwallace.com Video Overview: https://rumble.com/v51z6o3-fas -
18
REDACT
Erase everything. Leave nothing.
REDACT 4.0.0 is an open-source Windows anti-forensics & artifact sanitization suite that permanently destroys 285 system artifacts — browser history, registry traces, NTFS change journals, Windows Recall AI snapshots, live RAM, and encrypted volume key material. New in 4.0.0: Auto-Trigger Engine — 7 triggers: USB Panic, Login Failure, Dead Man's Switch, VPN Disconnect, WiFi Change, Time Window, Forensic Tool Detection. BitLocker and VeraCrypt header destruction renders encrypted volumes permanently unrecoverable. EFS key wipe and Windows Hello NGC store included. Zero-footprint: Transient Execution Splitting, NTFS File Cliff Masking, Registry LastWrite Spoofing. 8 wipe standards: 1-Pass Quick, NIST SP 800-88, HMG IS5, AFSSI-5020, NAVSO P-5239-26, VSITR, 7-Pass DoD 5220.22-M, 35-Pass Gutmann. 13 browsers: Chrome, Edge, Firefox, Brave, Vivaldi, Arc, Zen, Pale Moon, Tor & more. Pro 5: eBay — https://ebay.de/itm/206609583195 | Gumroad — yonaabe.gumroad.com/l/redactpro5 -
19
HunterX AI-Assisted Offensive Security Engine Discover. Validate. Prove. Report. HunterX is not merely a vulnerability scanner. It is an open-source, AI-assisted offensive security engine for planning and running authorized security-assessment missions. It combines reconnaissance, security-tool orchestration, AI-assisted reasoning, hypothesis-driven investigation, vulnerability validation, evidence collection, proof / PoC engineering, replay / reproducibility, correlation, impact assessment and professional reporting into a single workflow. The core message. HunterX does not stop at finding a possible vulnerability. It is built to investigate the hypothesis, validate the behavior, prove the finding, reproduce the evidence, assess the impact, and turn the result into a report-ready security finding. Vulnerability + Evidence + Reproducibility + Proof / PoC + Impact ================ Validated Finding
-
20
cyborg hawk v 1.0
The World's most advanced penetration testing distribution ever
The most advanced, powerful and yet beautiful penetration testing distribution ever created.Lined up with ultimate collection of tools for pro Ethical Hackers and Cyber Security Experts. Simplify security in your IT infrastructure with Cyborg. Its real strength comes from the understanding that a tester requires a strong and efficient system,that benefits from a strong selection of tools, integrated with a stable linux environment. -
21
T2DECODE
Offline-first cybersecurity and system learning platform (Flutter)
T2DECODE — Plateforme locale d’apprentissage technique T2DECODE est une suite native conçue pour l’apprentissage pratique de l’informatique, des réseaux et de la cybersécurité. Porté par l'association TUTODECODE, le projet applique le principe du "Privacy by Design" : exécution 100% locale, zéro télémétrie et souveraineté absolue sur vos données. SPECIFICATIONS TECHNIQUES * 100% Offline-first : Fonctionne sans Internet. Idéal pour zones blanches ou architectures sécurisées (Air-gapped). * Souveraineté : Pas d'analytics, pas de trackers, pas de comptes obligatoires. * IA Locale : Support optionnel des LLM via Ollama pour une assistance privée sans API tierce. MODULES INTÉGRÉS * Réseau : Simulateur de masques de sous-réseau et calculs CIDR. * Système : Gestionnaire et traducteur interactif de permissions Unix (chmod). * Cryptographie & Outils : +15 utilitaires offline (Hachage SHA-256/MD5, diagnostics). Idéal pour étudiants (BTS SIO, BUT) et admins. Licence GPLv3. -
22
USBShield
USBShield protects your Windows from unauthorized USB devices
USBShield stands out as a free and open-source option for users seeking security against unauthorized USB access. Unlike many competing paid solutions, it offers extensive usability through its portable format and easy rule syntax, along with essential functionalities like automatic device disabling and thorough event logging. If you're looking for a straightforward yet effective means to safeguard your Windows system from unauthorized USB use, USBShield is a reliable choice. -
23
wafw00f-GUI
wafw00f GUI is an Graphical User Interface version of wafw00f CLI.
Wafw00f GUI is a graphical user interface version of wafw00f. I created this tool because I believed there was no GUI tool like NMap available for this purpose. The GUI of NMap is ZenMap, so creating WAFW00F was a good idea, and it runs in both systems, Linux and Windows, so it will be helpful for beginners. Refer to the official repository of WAFW00F in case you need any detailed information. Note: This file is an unofficial version of wafw00f purely made by me; the original credits go to Enable-Security. Other information: Version 1.1 (Latest) Written on: Python 3.13 Supported OS: Windows, Linux -
24
hdom_as
advanced watch of your server or computer usage + periodical job
receive an email or done a command when a file is accessed or modified or renamed or erased on linux, watch your files access, secure your workstation against viruses and ransomware, run a command periodicaly: a simplified alternative to cron wich send you report of your server usage, so you know it works, for exemple for your sessions deleting. or your periodical jobs. -
25
maskphish
MaskPhish: First ever URL masking tool for Phishing
MaskPhish can hide any URL to another URL. We can make https://ngrok.io/4GTJ78C [Example Link] to https://google.com/live-football@is.gd/6hts4 [Example Link] For more Cybersecurity information visit https://www.kalilinux.in
