Open Source Tools
Security tools whose source code you can read, self-host and audit. Each entry has a ThreatWire description, a licence checked against the project's own LICENSE file, live repository statistics and the vulnerabilities published for the tool itself.
Data refreshed weekly from GitHub, OSV.dev and OpenSSF Scorecard · last update 2026-10-20 (UTC) · How we list tools
77 tools
Software reverse engineering framework from the NSA
Reverse engineering suite released by the NSA with disassembly, decompilation, graphing and scripting for many processor architectures.
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Penetration testing framework
Rapid7's open-source framework for developing, testing and running exploit modules and auxiliary checks in authorised security assessments.
Automated SQL injection detection and testing
Command-line tool that automates the detection and confirmation of SQL injection flaws in web applications, with support for many database engines.
All-in-one scanner for images, code, IaC and clusters
Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.
Identity and access management for apps and services
Identity provider with single sign-on, OpenID Connect, OAuth 2.0 and SAML, user federation, MFA and fine-grained authorisation. A CNCF project.
Secrets management and encryption as a service
Secrets manager that stores and issues credentials, certificates and keys, with dynamic secrets, encryption as a service and detailed audit logs.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Secret scanner for Git repositories and files
Fast secret scanner for Git history, directories and stdin, with regex and entropy rules for API keys, tokens and passwords.
Secrets, certificates and access management platform
Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.
Offline, cross-platform password manager
Community port of KeePass for Windows, macOS and Linux that stores passwords in an encrypted KDBX database file you control.
Find, verify and analyse leaked credentials
Secret scanner with hundreds of credential detectors that can verify whether a found key is live, across Git, cloud storage, chat and more.
GPU-accelerated password recovery
Password recovery and hash auditing tool that uses GPUs and CPUs to test passwords against hundreds of hash types.
Reverse engineering tool for Android APK files
Decodes Android APK resources and code to a near-original form (smali) and rebuilds them after modification, for analysis and testing.
Asynchronous TCP port scanner for large ranges
Internet-scale port scanner that sends SYN packets asynchronously with its own TCP/IP stack, designed to scan very large address ranges quickly.
Self-hosted identity provider
Identity provider supporting OIDC, OAuth 2.0, SAML, LDAP, RADIUS and a proxy provider, with flow-based customisation of every login step.
UNIX-like reverse engineering framework
Command-line reverse engineering framework with a disassembler, debugger, hex editor and scripting for many architectures and file formats.
Query your endpoints with SQL
Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.
OSINT automation for footprinting
OSINT automation tool with a web UI and more than 200 modules that gather data on IPs, domains, emails, names and more from public sources.
Dynamic instrumentation toolkit
Injects a JavaScript engine into running processes on Windows, macOS, Linux, iOS and Android to trace, hook and modify functions at runtime.
Automated mobile app security testing
Mobile Security Framework: automated static and dynamic analysis of Android and iOS apps, with malware analysis and a REST API for CI.
Fast port scanner that hands results to Nmap
Port scanner written in Rust that finds open ports quickly and then pipes them into Nmap for service detection, with a scripting engine of its own.
Gather emails, names and subdomains from public sources
Python OSINT tool that collects emails, names, subdomains, IPs and URLs about a domain from search engines and public data sources.
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
Lightweight, pattern-based static analysis
Fast static analysis engine where rules look like the code they match, supporting many languages; the open-source Community Edition runs locally and in CI.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
Attack surface mapping and asset discovery
OWASP project for in-depth attack surface mapping: discovers domains, subdomains, IP ranges and related assets using DNS and many public data sources.
Collaborative behaviour-based IPS
Security engine that parses logs to detect aggressive behaviour, blocks it with remediation components and shares signals in a community blocklist.
Cloud security posture and compliance checks
Open-source cloud security platform that runs hundreds of checks against AWS, Azure, Google Cloud, Kubernetes and Microsoft 365, mapped to compliance frameworks.
Fast passive subdomain enumeration
ProjectDiscovery's subdomain discovery tool that queries passive online sources, built for speed and easy chaining with other tools.
Phishing simulation framework for awareness programmes
Open-source framework to run authorised phishing simulation campaigns, with templates, landing pages, scheduling and result tracking.
Deliberately insecure web application for training
Intentionally vulnerable web shop by OWASP, covering the OWASP Top Ten and more, used for security training, CTFs and testing scanners.
Network discovery and security auditing tool
The Network Mapper: host discovery, port scanning, service and OS detection, and the Nmap Scripting Engine (NSE) for further checks.
Offline password security auditing
Openwall's long-standing password cracker; the community "jumbo" version supports hundreds of hash and cipher types on CPUs and GPUs.
Vulnerability scanner for images, file systems and SBOMs
Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.
Small detection tests mapped to MITRE ATT&CK
Red Canary's library of small, portable tests mapped to MITRE ATT&CK techniques, used to check whether detections and logging work.
Kubernetes security posture and compliance scanner
CNCF project that scans clusters, manifests and Helm charts against frameworks such as the NSA-CISA guidance and CIS Benchmarks, and scans images.
Dependency scanner backed by the OSV database
Google's vulnerability scanner that reads lockfiles, SBOMs and container images and checks the packages against the open OSV.dev database.
Nginx-based web application firewall
WAF and hardened reverse proxy based on Nginx, with ModSecurity and the OWASP CRS, bot protection and a web UI, for Docker, Kubernetes or Linux.
Web server scanner for dangerous files and misconfigurations
Long-running open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations.
Fast toolkit for Ethereum development and testing
Rust toolkit (forge, cast, anvil, chisel) to build, test, fuzz and deploy Solidity contracts, with fuzz and invariant testing built in.
Cyber threat intelligence knowledge platform
Platform by Filigran to structure, store and visualise threat intelligence as a STIX 2.1 knowledge graph, with many connectors.
Network protocol analyser
The widely used network protocol analyser: capture live traffic or open capture files and inspect thousands of protocols with display filters.
Pattern matching for malware research
Tool and rule language from VirusTotal to identify and classify malware samples using textual and binary patterns plus conditions.
Web application firewall engine
Cross-platform WAF engine (libmodsecurity) for Apache, Nginx and IIS, typically used with the OWASP Core Rule Set. Now an OWASP project.
SBOM generator for images and file systems
CLI tool and Go library from Anchore that generates a software bill of materials from container images and file systems in SPDX and CycloneDX formats.
Runtime threat detection for containers and hosts
CNCF graduated project that watches Linux system calls (via eBPF or a kernel module) and raises alerts when rules detect suspicious behaviour.
