Security

fscan14.7k★

Fscan is a one-command internal network scanner for security testing. Point it at an IP range and it does host discovery, port and service scanning, web and CMS fingerprinting, weak-credential brute-forcing across dozens of services, and checks for known vulnerabilities like MS17-010. It is the kind of tool a red teamer reaches for to map and probe an internal network fast. Written in Go, MIT licensed, free. Running it is genuinely one command: ./fscan -h 192.168.1.1/24 and it goes. A single static Go binary, no dependencies, cross-platform, with an optional web UI. That simplicity is the whole appeal; there is nothing to install or configure before you are scanning. For anyone doing authorized penetration testing or defending their own network, this is a fast, capable recon tool at zero cost. Solo testers and security teams use it the same way. There is no paid tier and no team story; it is a CLI you run against targets you are allowed to test. The catch is that this is a dual-use offensive tool, and the responsibility is entirely yours. Fscan includes brute-forcing, credential extraction, and exploitation modules that are legal on networks you own or are contracted to test, and a crime everywhere else. It also lights up every IDS in the building. Use it inside a real engagement scope, not because it is easy to point at something.

opencti10.3k★

OpenCTI is a platform for managing cyber threat intelligence. It structures the messy world of threat data (adversary TTPs, indicators, attribution) into the STIX2 standard, links every piece back to its source with a confidence level, and connects to MISP, TheHive, and MITRE ATT&CK. If your team drowns in threat feeds and spreadsheets, this is where that turns into a queryable knowledge graph. The community edition is Apache-2.0 and free. Self-hosting is a real project. OpenCTI is not a single binary; it runs on a stack (Elasticsearch, a message broker, workers, the GraphQL API and web UI), typically via Docker Compose. Getting it stood up is manageable with the docs, but keeping it healthy (index sizing, connector management, upgrades) is ongoing work that assumes someone owns it. For a security team that needs a real threat-intel backbone, the free edition covers the core platform and costs nothing in licensing. Solo analysts can run it but rarely need this much machinery. Larger orgs are the natural fit, and that is also where Filigran's proprietary Enterprise Edition comes in, adding features on top of the open core for a subscription. The catch is operational weight versus payoff. OpenCTI earns its keep when you have enough threat data and enough analysts to justify a platform; run it for a handful of feeds and you have built a data center to store a filing cabinet. Size the deployment to your actual intel volume, not to how impressive the graph looks.

T3MP3ST6.9k★

T3MP3ST points a swarm of AI agents at a target and tries to break in, then writes up how. It automates the red-team loop, reconnaissance, exploitation, and reporting, across web apps, CTF challenges, source code, embedded systems, and smart contracts. Instead of asking for its own API keys, it drives coding agents you already run, Claude Code, Codex, or Hermes. AGPL-3.0 and free. Getting it running is light: npm install, npm run server, and a web War Room interface comes up. What is behind that interface is the honest question. The recon operator is production-ready, but the headline, a coordinated multi-agent swarm chaining exploits end to end, is still largely scaffolded. The benchmark numbers (around 90 percent on a web-security challenge suite, most of a held-out CVE set matched) come from a single agent, not the swarm the name promises. To its credit, the repo ships a verify-claims command so you can re-derive them yourself. This is for security people doing authorized work, pentesters, CTF players, researchers probing their own code, not a push-button tool for anything you do not own. Solo researchers and small security teams: worth a look as an AI-assisted recon and triage layer today, with the exploitation swarm as a promising work in progress. Treat the automation as a force multiplier for a human who knows what they are doing, not a replacement for one. The catch is the gap between the pitch and the product. The recon works, the autonomous kill chain does not fully exist yet, and AGPL-3.0 means anything you build on top inherits that copyleft. Judge it on what runs today, not the roadmap in the README.

Modlishka5.4k★

Modlishka is a reverse-proxy tool for phishing simulations and red-team testing. It demonstrates why SMS and TOTP-based 2FA aren't as secure as people think. Fully free. No paid tier. This is a security research tool, not a commercial product. Set it up, point it at a target domain, and it automatically mirrors the real site while capturing everything the user types, including one-time 2FA codes. The catch: this is a double-edged sword. It's designed for authorized penetration testing only. Using it against targets without permission is illegal. The project hasn't been actively maintained, and modern phishing-resistant methods like WebAuthn/passkeys defeat it entirely. If you're a defender, this tool shows you exactly why you should be pushing your org toward hardware security keys instead of SMS codes.

ciso-assistant-community4.6k★

CISO Assistant is a GRC platform (governance, risk and compliance): the spreadsheet work of proving to auditors you meet ISO 27001, SOC 2, NIST CSF, NIS2, DORA or GDPR. It ships 200+ frameworks, maps controls between them automatically, and runs risk registers, evidence, audits and vendor risk in one place. The Community edition is AGPLv3, free, with unlimited users and SSO included. Setup is a git clone and ./docker-compose.sh, which pulls prebuilt images. That default file runs Django in debug mode and exposes the full API, so for production use the config builder and work through the README hardening list. Releases land every few days; pin a tag, never run main. Pro adds SCIM, nested domains for subsidiaries, custom fields, the audit log and Jira/ServiceNow sync. Pro SaaS is about $44 per contributor per month, billed annually. On-prem Pro is about $2,690 a year for five contributors or $8,960 unlimited. Solo consultants and small teams: free. Multi-entity orgs: pay. The catch: the README feature list mixes Community and Pro with no labels. It's also a system of record, not Vanta or Drata: scanner results get pushed in by API or file import, nothing pulls evidence from your cloud accounts.

METATRON4.3k★

METATRON runs penetration tests with a local LLM doing the analysis. Point it at a target and it executes nmap, nikto, whois, and other standard security scans, then feeds the results to an LLM running on your machine for vulnerability assessment and exploit suggestions. Everything stays local, nothing hits the cloud. Built specifically for Parrot OS (a Linux pen-testing distro), it stores findings in MariaDB and exports reports as PDF or HTML. The LLM integration means you get natural language explanations of scan results instead of parsing raw nmap output yourself. It's essentially a security analyst copilot that runs offline. Security professionals and pen-testers who want AI assistance without sending scan data to external APIs get the most out of this. Students learning security will appreciate the explanations. Experienced red teamers might find the tool suggestions basic compared to their existing workflow. The catch: Parrot OS only, which limits the audience significantly. The local LLM quality depends entirely on your hardware, and smaller models give vague or wrong security advice.

sogen3.9k★

sogen runs Windows and Linux programs without the operating system underneath them. It emulates the CPU and fakes the system calls, loading the real system DLLs so a binary behaves like it is on a real machine. For reverse engineers and malware analysts, that means stepping through a sketchy executable, hooking any instruction, inspecting memory, and snapshotting the entire machine state, all without booting a VM or risking your host. It is open source under GPL-2.0, and there is a browser demo at sogen.dev if you want to try it before installing anything. Running it yourself is reasonable for a tool this deep. It ships Python bindings on pip and several emulation backends (Unicorn, icicle, Hyper-V, KVM), so you trade speed against fidelity depending on what you pick. The usual emulator catch applies: not every Windows API or odd syscall is implemented, so sophisticated malware that probes for an emulated environment or hits an unsupported call can break or detect it. Expect to file the occasional issue and work around gaps. Solo researchers and small security teams: this is a useful free addition to your kit, especially for deterministic, scriptable analysis you cannot get out of a normal sandbox. Larger teams doing heavy malware work will want it alongside commercial dynamic-analysis suites, not instead of them, since those bring broader API coverage and a support contract. The catch is that it is a one-person project. Polished and actively developed, but one maintainer. Before you build analysis workflows on top of it, know that the bus factor is one.

CAPEv23.7k★

CAPE is a malware sandbox: you feed it a suspicious file, it runs that file inside an isolated Windows virtual machine, and it reports everything the file did. Files touched, network traffic, memory dumps, screenshots. What sets it apart from its Cuckoo roots is automatic unpacking and extraction of the malware's hidden config, like the command-and-control addresses analysts actually want. It's the free, self-hosted answer to ANY.RUN, Joe Sandbox and VMRay. Setup is the opposite of docker run. The docs push an Ubuntu 24.04 host running KVM, built by two install scripts over 3,000 lines combined, and want you to swap hardware ID placeholders first so malware can't tell it's in a VM. Then you build Windows 10 or 11 guests with 32-bit Python. There are no releases: you git pull a rolling branch. Nothing is paywalled. Solo analysts: free, try the public demo at capesandbox.com first. Small and larger teams: free, but someone has to own that box. The catch: you are running live malware on purpose. A guest that can reach your LAN is an incident, not a bug report. The docs also warn that updating packages with apt can break the whole install.

skitter-creek-bath-salts2.2k★

Modern CPUs wall off memory regions the operating system is never supposed to touch: AMD's PSP firmware, microcode, SMM. This project goes underneath all of that. By flipping configuration bits in the DRAM controller itself, it rewires how physical addresses map onto real memory, manufacturing aliases that point at protected regions without tripping the checks sitting above. MIT licensed, full source, and about as small as you would expect. There is nothing to deploy. This is proof-of-concept research aimed at AMD Family 16h processors, the last generation whose datasheets publicly document the DRAM controller's translation registers. The argument is that the technique generalizes to Intel, ARM, and RISC-V, but the working code targets hardware from roughly a decade ago, and you need that hardware in front of you. The audience is security researchers and people who design memory controllers. That is the entire list. It is not a defensive tool, there is nothing to configure, and it will not tell you whether your fleet is exposed. The catch is that this is pre-publication. Two commits, a Black Hat 2026 talk still listed as coming soon, no paper, no written threat model, no vendor response. Read it as an argument about where memory protection breaks down, not as a result anyone has finished reviewing.

for-open-source2.0k★

This is not a tool you install. It's 1Password's program that gives free team accounts to open source projects. If you maintain an open source project and need to share API keys, deployment credentials, or service passwords with contributors, this gets you a 1Password Teams account at no cost. The application is straightforward: submit your open source project, demonstrate active maintenance, and 1Password provides a free team account with all the premium features: shared vaults, access controls, and the 1Password CLI for CI/CD integration. This matters because open source projects constantly struggle with credential management. Sharing secrets over Discord DMs or unencrypted emails is how breaches happen. A proper password manager with team vaults is the right answer. The catch: this is a proprietary product offered for free, not open source software. 1Password itself is closed-source. If 1Password changes or ends this program, you'd need to migrate. And the free tier is specifically for open source teams; your startup or side business doesn't qualify. For an actually open source password manager, Vaultwarden (self-hosted Bitwarden) is the alternative. It's more work to set up but you own everything.

sandboxed-api1.8k★

Sandboxed API takes a C or C++ library you do not fully trust, an image parser, a font renderer, a decompressor, and puts it in its own locked-down process so a memory bug in that library cannot reach the rest of your program. Google built it on top of Sandbox2 and uses it internally. The working motto is sandbox once, use anywhere: you write the policy for a library a single time and every project that needs that library reuses it. Apache 2.0. Getting there is real engineering. Builds run under Bazel or CMake, it is Linux-only, and each sandboxed library gets a tightly scoped security policy plus generated RPC stubs for calls that now cross a process boundary. That boundary is also a performance and data-marshalling cost you have to design around. This is infrastructure work measured in days, not an afternoon. Free, entirely, with no commercial edition. The teams that should care are the ones shipping C or C++ that touches untrusted input: file format parsers, media pipelines, anything processing user uploads. Everyone else does not need this. For sandboxing whole workloads rather than a single library, gVisor or Firecracker are the different tool. The catch is that it only helps if you were already going to do this work. Sandboxing changes your calling convention, and a team that will not maintain a per-library policy will end up with a sandbox that is permissive enough to be theater.

darksword-kexploit1.6k★

This is the DarkSword kernel exploit reimplemented in clean Objective-C. It targets iOS 15.0 through 26.0.1 and provides arbitrary kernel read/write, the foundation for jailbreaks, security research, and vulnerability analysis. The original DarkSword exploit chain was used by commercial surveillance vendors targeting multiple countries before being leaked publicly. This reimplementation by opa334 (a well-known jailbreak developer) makes it accessible to researchers in clean, readable code rather than the obfuscated original. No license specified. The catch: this is a kernel exploit. The security implications are real. Apple has patched this in newer iOS versions, so it only affects devices that haven't updated. Using this for anything other than security research or personal device modification puts you in legal and ethical gray areas. No license means no explicit permission to use or modify. And if you're not already deep in iOS internals, the code won't teach you much without significant background knowledge.

probo1.5k★

Probo is an open source compliance platform for getting through SOC 2, ISO 27001, GDPR or HIPAA without a Vanta or Drata contract. It tracks risks, controls, policies, vendors and audits, ships 13 framework templates and publishes a trust page for customers. MIT licensed and free to self-host. Self-hosting is real work. The Compose file runs Probo, Postgres, SeaweedFS and headless Chrome, with Postgres alone asking for 4 GB. The docs admit it ships fixed dev credentials and exposed database ports, so harden it first. You bring TLS, email, backups and an OAuth app per connector. Those connectors pull access reviews from AWS, Okta, GitHub and dozens more, and a device agent checks laptop encryption. Probo makes money on the managed side: a Compliance Officer Service where their team runs your program and talks to your auditor, plus Probo Cloud hosting. Both are quote-only. Solo founders and small startups with an engineer to spare: free. Teams that want the audit handled: get a quote and compare. The catch: it's a young codebase holding your most sensitive paperwork. Eleven security advisories since May, including an account takeover through custom domains, all patched. Pin releases and update fast.

certmate1.5k★

CertMate is a self-hosted control panel for TLS certificates, the files behind your site's padlock. It issues and renews them from Let's Encrypt, ZeroSSL, DigiCert and others, finds certificates you didn't issue, and pushes renewals to the servers using them. It's built for 2029, when public certificates max out at 47 days. MIT licensed and free, with a web UI, API, CLI and MCP server. Setup is one Docker Compose file plus three generated secrets. It runs as a single instance by design (the renewal scheduler lives in the web process), so high availability means active and standby on shared storage. SSO, roles and a tamper-evident audit trail are free. The author sells support and CertMate-ng, a BSL 1.1 build for multi-tenant and white-label use, priced by email. Solo and small teams: free. Larger teams: free, plus support if outages cost real money. The catch: it's one maintainer shipping several releases a week. In September 2026 it published eight security advisories, including a critical where the shipped default left admin access unauthenticated (fixed in 2.41.0). Then the October 25 clock change stopped instances in some European time zones from restarting until 2.55.0. Pin versions; keep it off the open internet.

vault-guides1.1k★

This isn't HashiCorp Vault itself; it's the official collection of example code and tutorials for learning Vault. If you're trying to figure out how to store API keys, database passwords, or encryption keys securely, these guides walk you through Vault's features with working code examples. Vault is a secrets management tool: instead of hardcoding passwords in environment variables or config files, your applications request secrets from Vault at runtime. Vault can also generate temporary database credentials, encrypt data, and manage PKI certificates. It's the industry standard for secrets management at scale. The guides cover identity management, secrets engines, encryption as a service, governance policies, and operational patterns. Examples in Shell, Python, Ruby, and Terraform. Useful for getting started but increasingly dated; some guides reference older Vault versions. Vault itself is source-available (Business Source License). The open source fork is OpenBao. Managed HCP Vault Dedicated starts at $0.62 an hour (about $450/mo) for a single-node development cluster. The catch: these are learning guides, not the tool. If you need Vault, go to the main vault repo. And Vault itself is complex; it's designed for organizations with real compliance requirements. For a solo developer or small team, SOPS or doppler.com handles secrets management with 10% of the complexity.

VaultSharp550★

VaultSharp is the .NET client library for HashiCorp Vault. Instead of making raw HTTP calls to Vault's API, you get typed methods and objects. Apache 2.0, C#. Covers the full Vault API: secret engines (KV, Transit, PKI, databases), auth methods (AppRole, Token, LDAP, Kubernetes), and system operations. Supports both Vault Community and Enterprise features. Fully free. This is a client library: no hosting, no service, no paid tier. NuGet install and use. The catch: this is a niche library for a specific integration. You need HashiCorp Vault already running (which has its own cost and ops story). VaultSharp just makes talking to it from C# easier. If you're not in the .NET ecosystem, this isn't relevant. If you are, it's essentially the only maintained Vault client for C#, so the choice is this or raw HTTP. At, the community is small, don't expect instant answers to edge case questions.