Open Source Security Software - Page 7
Sort By:
Security Software
View 6074 business solutions-
Ship Agents FasterGemini Enterprise Agent Platform lets you rapidly build, scale, govern and optimize production-ready agents grounded in your organization's data. The platform enables developers to build custom or pre-built agents for virtually any use case. New customers get $300 in free credits.
-
Paessler: Easy to Use With Enterprise Power. Free TrialYou shouldn't have to choose between a monitoring tool that's easy to use and one that's powerful enough for a complex environment. PRTG's low-code interface lets any admin build dashboards, set alerts and monitor devices without scripting, while custom sensors and full API access are there when your team needs deeper control. One platform, no compromise. Download a free 30-day trial now.
-
1
bWAPP
an extremely buggy web app !
bWAPP, or a buggy web application, is a free and open source deliberately insecure web application. bWAPP helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities. bWAPP prepares one to conduct successful penetration testing and ethical hacking projects. What makes bWAPP so unique? Well, it has over 100 web bugs! It covers all major known web vulnerabilities, including all risks from the OWASP Top 10 project. The focus is not just on one specific issue... bWAPP is covering a wide range of vulnerabilities! bWAPP is a PHP application that uses a MySQL database. It can be hosted on Linux/Windows with Apache/IIS and MySQL. It is supported on WAMP or XAMPP. Another possibility is to download bee-box, a custom VM pre-installed with bWAPP. This project is part of the ITSEC GAMES project. You can find more about the ITSEC GAMES and bWAPP projects on our blog. For security-testing and educational purposes only! Cheers Malik Mesellem -
2
Kraken tool
Kraken: A multi-platform distributed brute-force password cracking
Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator-based cracking across multiple machines both as a web app in a web browser and as a standalone electron-based client. Kraken aims to be easy to use, fault-tolerant and scalable. Kraken is a dockerized application using docker-compose which will launch the db (Postgres), s3-compliant file storage (Minio), the server and the browser client. You can find the docker-compose file in the root directory of the repository. To upload password lists or dictionaries, upload them to Minio Console at localhost:9001. View the steps explained for a detailed guide Otherwise, you can generate word lists dynamically using crunch. Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be downloaded from their home page. -
3
Ligolo-ng
An advanced, yet simple, tunneling/pivoting tool
Ligolo-ng is a simple, lightweight and fast tool that allows pentesters to establish tunnels from a reverse TCP/TLS connection using a tun interface (without the need of SOCKS). When running the relay/proxy server, a tun interface is used, packets sent to this interface are translated and then transmitted to the agent's remote network. You need to download the Wintun driver (used by WireGuard) and place the wintun.dll in the same folder as Ligolo. You can listen to ports on the agent and redirect connections to your control/proxy server. You can easily hit more than 100 Mbits/sec. Here is a test using iperf from a 200Mbits/s server to a 200Mbits/s connection. -
4
PEASS-ng
Privilege Escalation Awesome Scripts SUITE
These tools search for possible local privilege escalation paths that you could exploit and print them to you with nice colors so you can recognize the misconfigurations easily. All the scripts/binaries of the PEAS suite should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own machines and/or with the owner's permission. Here you will find privilege escalation tools for Windows and Linux/Unix and MacOS. Find the latest versions of all the scripts and binaries in the releases page. Check the parsers directory to transform PEASS outputs to JSON, HTML and PDF. -
MongoDB Atlas runs apps anywhereMongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.
-
5
gopass
The slightly more awesome standard unix password manager for teams
gopass is a simple but powerful password manager for your terminal. Manage your credentials with ease. In a globally distributed team, on multiple devices or fully offline on an air-gapped machine. By default your credentials are encrypted with GPG and versioned in git. This can be customized easily. The primary interface is the command line, making it an excellent choice for CLI fans, CI/CD systems or anything you can hook it up with. Gopass can also integrate with your browser so you can largely avoid the command line - if you want. gopass can operate without any dependencies but most users will use it with gpg and git. An external editor is required to use gopass edit. The same user experience on Linux, MacOS, *BSD or Windows. Built from our experience working in distributed development teams. -
6
Ettercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis. Development has been moved to GitHub, https://github.com/Ettercap/ettercap
-
7
BlockCheck
Russian ISP blocking type checker
BlockCheck is a Russian ISP blocking-type checker created to identify how websites from Russia’s prohibited-information registry were being blocked by internet providers. The tool was designed for a specific network environment and is explicitly not useful outside Russia. It runs tests that help distinguish different blocking methods, such as DNS manipulation, IP blocking, HTTP blocking, TCP reset behavior, and deeper filtering patterns. The repository is now archived and marked as not currently working, so it should be treated as a historical and diagnostic reference rather than a maintained utility. Its value is strongest for people studying network censorship, ISP filtering behavior, and the technical mechanics of access restriction. Because test results could be affected by circumvention tools, the project warns users not to run it while bypass systems are enabled. -
8
BrowserBox
Remote isolated browser API for security
Remote isolated browser API for security, automation visibility and interactivity. Run-on our cloud, or bring your own. Full scope double reverse web proxy with a multi-tab, mobile-ready browser UI frontend. Plus co-browsing, advanced adaptive streaming, secure document viewing and more! But only in the Pro version. BrowserBox is a full-stack component for a web browser that runs on a remote server, with a UI you can embed on the web. BrowserBox lets your provide controllable access to web resources in a way that's both more sandboxed than, and less restricted than, traditional web <iframe> elements. Build applications that need cross-origin access, while delivering complex user stories that benefit from an encapsulated browser abstraction. Since the whole stack is written in JavaScript you can easily extend it to suit your needs. The technology that puts unrestricted browser capabilities within reach of a web app has never before existed in the open. -
9
Flipper Zero Firmware
Flipper Zero firmware source code
Flipper Zero is a portable multi-tool for pentesters and geeks in a toy-like body. It loves hacking digital stuff, such as radio protocols, access control systems, hardware, and more. It's fully open-source and customizable, so you can extend it in whatever way you like. Flipper Zero is a tiny piece of hardware with a curious personality of a cyber-dolphin. It can interact with digital systems in real life and grow while you use it. Explore any kind of access control system, RFID, radio protocols, and debug hardware using GPIO pins. The idea of Flipper Zero is to combine all the hardware tools you'd need for exploration and development on the go. Flipper was inspired by the pwnagotchi project, but unlike other DIY boards, Flipper is designed with the convenience of everyday usage in mind — it has a robust case, handy buttons, and shape, so there are no dirty PCBs or scratchy pins. Flipper turns your projects into a game, reminding you that development should always be fun. -
Veeam Data Platform v13.1Try Veeam Data Platform today. Experience the unified platform that's secure by design, portable by default, and proven to recover clean, fast, and anywhere.
-
10
OpenLogi
A native, local-first alternative to Logitech Options+
OpenLogi is a native, local-first alternative to Logitech Options+ for configuring supported Logitech mice. It is written in Rust and focuses on direct device control through HID++ rather than account-based cloud software. The app lets users remap buttons, adjust DPI, and configure SmartShift behavior without telemetry. Its current focus is macOS, with wired and Bluetooth mouse support becoming a central part of recent releases. OpenLogi is useful for people who want lightweight mouse customization without signing in or depending on Logitech’s official software stack. It is especially appealing to privacy-conscious users, power users, and developers who want transparent control over Logitech device settings. -
11
Yank Note
A Hackable Markdown Note Application for Programmers
A Hackable Markdown Note Application for Programmers. Version control, AI completion, mind map, documents encryption, code snippet running, integrated terminal, chart embedding, HTML applets, Reveal.js, plug-in, and macro replacement. Use Monaco kernel, optimize for Markdown editing, and have the same editing experience as VSCode. Support version control; Applets, runnable code blocks, tables, PlantUML, Drawio, macro replacements, etc., can be embedded in the document; support for OpenAI auto-completion. Data is saved as local Markdown files, and the extension functions are implemented in the original syntax of Markdown as far as possible. Support users to write their own plug-ins to expand the functionality of the editor. Use encryption to save private files such as account number, and the password can be set separately for each file. -
12
OpenAS2
AS2 1.1 server implementation in Java
OpenAS2 is a java-based implementation of the EDIINT AS2 standard. It is intended to be used as a server. It is extremely configurable and supports a wide variety of signing and encryption algorithms. Supports very high traffic volume allowing parallel processing of files per partner. SUPPORT: Please use the Github issues and Discussions channels here: https://github.com/OpenAS2/OpenAs2App/ Requirements: - Java 17 or newer (tested with the LTS versions of Java up to 25) - Any OS that runs Java Planned enhancements in the next major release: - User interace configuration GUI - Certificate Exchange Management IMPORTANT: Java 8 is no longer supported. -
13
Adguard for iOS
The most advanced ad blocker for iOS
The most advanced Safari content blocker and a privacy keeper for iOS. AdGuard for iOS is an app that blocks ads in the Safari browser at an exceptional level and also provides additional Premium features like configurable DNS settings, encrypted DNS support (DOH, DOT, DNSCrypt), and custom ad-blocking subscriptions. To get more information and to download AdGuard for iOS, visit our website. AdGuard for Windows is more than an ad blocker. It is a multipurpose tool that blocks ads, controls access to dangerous sites, speeds up page loading, and protects children from inappropriate content. AdGuard shields your data from web analytics and online trackers. AdGuard protects against phishing and malicious sites. AdGuard shields children from inappropriate and adult content. -
14
OWASP MASTG
Manual for mobile app security testing and reverse engineering
OWASP Mobile Application Security Testing Guide (MASTG) is a free, open-source resource that provides comprehensive guidance for testing and evaluating the security of mobile applications. Developed by the Open Worldwide Application Security Project (OWASP), the guide offers practical methodologies, technical instructions, and testing procedures for identifying security vulnerabilities in Android and iOS applications. MASTG covers a wide range of mobile security topics, including data storage, cryptography, authentication, network communication, platform interactions, and reverse engineering. The guide aligns with the OWASP Mobile Application Security Verification Standard (MASVS) and Mobile Application Security Weakness Enumeration (MASWE), helping organizations evaluate applications against established security requirements. Security professionals can use its detailed testing techniques, tool recommendations, practical examples, and hands-on exercises. -
15
PDFRip
A multi-threaded PDF password cracking utility
A multi-threaded PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks. pdfrip is a fast multithreaded PDF password cracking utility written in Rust with support for wordlist-based dictionary attacks, date and number range bruteforcing, and a custom query builder for password formats. You can write your own queries like STRING{69-420} with the -q option which would generate a wordlist with the full number range. You can pass in an year as the input with the -d option which would bruteforce all 365 days of the year in DDMMYYYY format which is a pretty commonly used password format for PDFs. Just give a number range like 5000-100000 with the -n option and it would bruteforce with the whole range. -
16
zapret2
Anti-dpi software
zapret2 is a standalone anti-DPI toolkit designed to alter network traffic behavior without depending on external proxy servers. It targets censorship, throttling, and protocol filtering performed through deep packet inspection. The project supports Linux, OpenWrt-oriented embedded routers, FreeBSD, OpenBSD, and Windows. Its nfqws2 engine retains protocol recognition, reassembly, decryption, profiles, host lists, IP sets, and basic filtering. Traffic-manipulation strategies are moved out of fixed C logic and into Lua scripts. This design makes DPI-response techniques more flexible and easier to adapt as filtering methods change. -
17
PAC is a Perl/GTK replacement for SecureCRT/Putty/etc (linux ssh/telnet/... gui)... It provides a GUI to configure connections: users, passwords, EXPECT regular expressions, macros, etc. You like 'SecureCRT/SSHMenu'? Check this tool and let me know
-
18
SpiderFoot
Open Source Intelligence Automation.
SpiderFoot is an open source intelligence automation tool. Its goal is to automate the process of gathering intelligence about a given target, which may be an IP address, domain name, hostname or network subnet. SpiderFoot can be used offensively, i.e. as part of a black-box penetration test to gather information about the target or defensively to identify what information your organisation is freely providing for attackers to use against you. -
19
pamtester is a tiny utility program to test the pluggable authentication modules (PAM) facility, specifically designed to help PAM module authors to intensively test their own modules.
-
20
Instagram OSINT Tool
Instagram OSINT tool for gathering profile data and public posts
InstagramOSINT is an open source intelligence (OSINT) tool designed to collect publicly accessible information from Instagram profiles. It retrieves details that are not always easily visible when browsing an Instagram account normally, allowing investigators, researchers, and developers to gather structured data about a target profile. It works by scraping publicly available profile information and extracting metadata from Instagram pages using Python. It collects various attributes such as the username, profile name, follower counts, account status indicators, and profile metadata. In addition to profile information, it can also retrieve post-related data and download publicly available images associated with an account. The results are saved locally in structured formats such as JSON-style data inside text files, making them easy to analyze or integrate into other applications. InstagramOSINT also exposes a Python API so developers can import the functionality. -
21
Telegram-OSINT
https://github.com/The-Osint-Toolbox/Telegram-OSINT
Telegram-OSINT is an extensive open source repository that compiles tools, techniques, and resources for conducting open source intelligence investigations on the Telegram platform. It serves as a central reference for analysts, researchers, and investigators who want to discover, analyze, and collect publicly available information from Telegram channels, groups, and bots. It organizes a wide variety of utilities that interact with Telegram’s API to gather data such as channel details, posts, and metadata, often exporting the results in formats like JSON for further analysis. The repository also includes utilities that help search for Telegram channels or process lists of channels from input files, making large-scale investigations easier to manage. In addition to direct data collection tools, it provides resources for channel discovery, similar channel analysis, and browser-based interfaces for interacting with Telegram data. -
22
Keycloak
Identity and access management for modern applications and services
Add authentication to applications and secure services with minimum fuss. No need to deal with storing users or authenticating users. It's all available out of the box. You'll even get advanced features such as User Federation, Identity Brokering and Social Login. Keycloak is an open source Identity and Access Management solution aimed at modern applications and services. It makes it easy to secure applications and services with little to no code. Users authenticate with Keycloak rather than individual applications. This means that your applications don't have to deal with login forms, authenticating users, and storing users. Once logged-in to Keycloak, users don't have to login again to access a different application. This also applied to logout. Keycloak provides single-sign out, which means users only have to logout once to be logged-out of all applications that use Keycloak. -
23
clamtk
An easy to use, light-weight, on-demand virus scanner for Linux system
ClamTk is a graphical front-end for ClamAV, the open-source antivirus engine for Unix-like systems. It provides an easy-to-use interface for on-demand virus scanning, making ClamAV more accessible to desktop users. -
24
CFSSL
Cloudflare's PKI and TLS toolkit
CFSSL is CloudFlare's PKI/TLS swiss army knife. It is both a command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates. It requires Go 1.12+ to build. Note that certain linux distributions have certain algorithms removed (RHEL-based distributions in particular), so the golang from the official repositories will not work. Users of these distributions should install go manually to install CFSSL. You can set the GOOS and GOARCH environment variables to have Go cross compile for alternative platforms; however, cfssl requires cgo, and cgo requires a working compiler toolchain for the target platform. The csr is the client's certificate request. The -ca and -ca-key flags are the CA's certificate and private key, respectively. By default, they are ca.pem and ca_key.pem. The -hostname is a comma separated hostname list that overrides the DNS names and IP address in the certificate SAN extension. -
25
Cuckoo Sandbox
Cuckoo Sandbox is for automated analysis of malware
Cuckoo Sandbox uses components to monitor the behavior of malware in a Sandbox environment; isolated from the rest of the system. It offers automated analysis of any malicious file on Windows, Linux, macOS, and Android.
