Security

fscan14.6k★

Fscan is a one-command internal network scanner for security testing. Point it at an IP range and it does host discovery, port and service scanning, web and CMS fingerprinting, weak-credential brute-forcing across dozens of services, and checks for known vulnerabilities like MS17-010. It is the kind of tool a red teamer reaches for to map and probe an internal network fast. Written in Go, MIT licensed, free. Running it is genuinely one command: ./fscan -h 192.168.1.1/24 and it goes. A single static Go binary, no dependencies, cross-platform, with an optional web UI. That simplicity is the whole appeal; there is nothing to install or configure before you are scanning. For anyone doing authorized penetration testing or defending their own network, this is a fast, capable recon tool at zero cost. Solo testers and security teams use it the same way. There is no paid tier and no team story; it is a CLI you run against targets you are allowed to test. The catch is that this is a dual-use offensive tool, and the responsibility is entirely yours. Fscan includes brute-forcing, credential extraction, and exploitation modules that are legal on networks you own or are contracted to test, and a crime everywhere else. It also lights up every IDS in the building. Use it inside a real engagement scope, not because it is easy to point at something.

opencti10.0k★

OpenCTI is a platform for managing cyber threat intelligence. It structures the messy world of threat data (adversary TTPs, indicators, attribution) into the STIX2 standard, links every piece back to its source with a confidence level, and connects to MISP, TheHive, and MITRE ATT&CK. If your team drowns in threat feeds and spreadsheets, this is where that turns into a queryable knowledge graph. The community edition is Apache-2.0 and free. Self-hosting is a real project. OpenCTI is not a single binary; it runs on a stack (Elasticsearch, a message broker, workers, the GraphQL API and web UI), typically via Docker Compose. Getting it stood up is manageable with the docs, but keeping it healthy (index sizing, connector management, upgrades) is ongoing work that assumes someone owns it. For a security team that needs a real threat-intel backbone, the free edition covers the core platform and costs nothing in licensing. Solo analysts can run it but rarely need this much machinery. Larger orgs are the natural fit, and that is also where Filigran's proprietary Enterprise Edition comes in, adding features on top of the open core for a subscription. The catch is operational weight versus payoff. OpenCTI earns its keep when you have enough threat data and enough analysts to justify a platform; run it for a handful of feeds and you have built a data center to store a filing cabinet. Size the deployment to your actual intel volume, not to how impressive the graph looks.

T3MP3ST6.2k★

T3MP3ST points a swarm of AI agents at a target and tries to break in, then writes up how. It automates the red-team loop, reconnaissance, exploitation, and reporting, across web apps, CTF challenges, source code, embedded systems, and smart contracts. Instead of asking for its own API keys, it drives coding agents you already run, Claude Code, Codex, or Hermes. AGPL-3.0 and free. Getting it running is light: npm install, npm run server, and a web War Room interface comes up. What is behind that interface is the honest question. The recon operator is production-ready, but the headline, a coordinated multi-agent swarm chaining exploits end to end, is still largely scaffolded. The benchmark numbers (around 90 percent on a web-security challenge suite, most of a held-out CVE set matched) come from a single agent, not the swarm the name promises. To its credit, the repo ships a verify-claims command so you can re-derive them yourself. This is for security people doing authorized work, pentesters, CTF players, researchers probing their own code, not a push-button tool for anything you do not own. Solo researchers and small security teams: worth a look as an AI-assisted recon and triage layer today, with the exploitation swarm as a promising work in progress. Treat the automation as a force multiplier for a human who knows what they are doing, not a replacement for one. The catch is the gap between the pitch and the product. The recon works, the autonomous kill chain does not fully exist yet, and AGPL-3.0 means anything you build on top inherits that copyleft. Judge it on what runs today, not the roadmap in the README.

Modlishka5.4k★

Modlishka is a reverse-proxy tool for phishing simulations and red-team testing. It demonstrates why SMS and TOTP-based 2FA aren't as secure as people think. Fully free. No paid tier. This is a security research tool, not a commercial product. Set it up, point it at a target domain, and it automatically mirrors the real site while capturing everything the user types, including one-time 2FA codes. The catch: this is a double-edged sword. It's designed for authorized penetration testing only. Using it against targets without permission is illegal. The project hasn't been actively maintained, and modern phishing-resistant methods like WebAuthn/passkeys defeat it entirely. If you're a defender, this tool shows you exactly why you should be pushing your org toward hardware security keys instead of SMS codes.

METATRON4.1k★

METATRON runs penetration tests with a local LLM doing the analysis. Point it at a target and it executes nmap, nikto, whois, and other standard security scans, then feeds the results to an LLM running on your machine for vulnerability assessment and exploit suggestions. Everything stays local, nothing hits the cloud. Built specifically for Parrot OS (a Linux pen-testing distro), it stores findings in MariaDB and exports reports as PDF or HTML. The LLM integration means you get natural language explanations of scan results instead of parsing raw nmap output yourself. It's essentially a security analyst copilot that runs offline. Security professionals and pen-testers who want AI assistance without sending scan data to external APIs get the most out of this. Students learning security will appreciate the explanations. Experienced red teamers might find the tool suggestions basic compared to their existing workflow. The catch: Parrot OS only, which limits the audience significantly. The local LLM quality depends entirely on your hardware, and smaller models give vague or wrong security advice.

sogen3.6k★

sogen runs Windows and Linux programs without the operating system underneath them. It emulates the CPU and fakes the system calls, loading the real system DLLs so a binary behaves like it is on a real machine. For reverse engineers and malware analysts, that means stepping through a sketchy executable, hooking any instruction, inspecting memory, and snapshotting the entire machine state, all without booting a VM or risking your host. It is open source under GPL-2.0, and there is a browser demo at sogen.dev if you want to try it before installing anything. Running it yourself is reasonable for a tool this deep. It ships Python bindings on pip and several emulation backends (Unicorn, icicle, Hyper-V, KVM), so you trade speed against fidelity depending on what you pick. The usual emulator catch applies: not every Windows API or odd syscall is implemented, so sophisticated malware that probes for an emulated environment or hits an unsupported call can break or detect it. Expect to file the occasional issue and work around gaps. Solo researchers and small security teams: this is a useful free addition to your kit, especially for deterministic, scriptable analysis you cannot get out of a normal sandbox. Larger teams doing heavy malware work will want it alongside commercial dynamic-analysis suites, not instead of them, since those bring broader API coverage and a support contract. The catch is that it is a one-person project. Polished and actively developed, but one maintainer. Before you build analysis workflows on top of it, know that the bus factor is one.

skitter-creek-bath-salts2.1k★

Modern CPUs wall off memory regions the operating system is never supposed to touch: AMD's PSP firmware, microcode, SMM. This project goes underneath all of that. By flipping configuration bits in the DRAM controller itself, it rewires how physical addresses map onto real memory, manufacturing aliases that point at protected regions without tripping the checks sitting above. MIT licensed, full source, and about as small as you would expect. There is nothing to deploy. This is proof-of-concept research aimed at AMD Family 16h processors, the last generation whose datasheets publicly document the DRAM controller's translation registers. The argument is that the technique generalizes to Intel, ARM, and RISC-V, but the working code targets hardware from roughly a decade ago, and you need that hardware in front of you. The audience is security researchers and people who design memory controllers. That is the entire list. It is not a defensive tool, there is nothing to configure, and it will not tell you whether your fleet is exposed. The catch is that this is pre-publication. Two commits, a Black Hat 2026 talk still listed as coming soon, no paper, no written threat model, no vendor response. Read it as an argument about where memory protection breaks down, not as a result anyone has finished reviewing.

for-open-source2.0k★

This is not a tool you install. It's 1Password's program that gives free team accounts to open source projects. If you maintain an open source project and need to share API keys, deployment credentials, or service passwords with contributors, this gets you a 1Password Teams account at no cost. The application is straightforward: submit your open source project, demonstrate active maintenance, and 1Password provides a free team account with all the premium features: shared vaults, access controls, and the 1Password CLI for CI/CD integration. This matters because open source projects constantly struggle with credential management. Sharing secrets over Discord DMs or unencrypted emails is how breaches happen. A proper password manager with team vaults is the right answer. The catch: this is a proprietary product offered for free, not open source software. 1Password itself is closed-source. If 1Password changes or ends this program, you'd need to migrate. And the free tier is specifically for open source teams; your startup or side business doesn't qualify. For an actually open source password manager, Vaultwarden (self-hosted Bitwarden) is the alternative. It's more work to set up but you own everything.

sandboxed-api1.8k★

Sandboxed API takes a C or C++ library you do not fully trust, an image parser, a font renderer, a decompressor, and puts it in its own locked-down process so a memory bug in that library cannot reach the rest of your program. Google built it on top of Sandbox2 and uses it internally. The working motto is sandbox once, use anywhere: you write the policy for a library a single time and every project that needs that library reuses it. Apache 2.0. Getting there is real engineering. Builds run under Bazel or CMake, it is Linux-only, and each sandboxed library gets a tightly scoped security policy plus generated RPC stubs for calls that now cross a process boundary. That boundary is also a performance and data-marshalling cost you have to design around. This is infrastructure work measured in days, not an afternoon. Free, entirely, with no commercial edition. The teams that should care are the ones shipping C or C++ that touches untrusted input: file format parsers, media pipelines, anything processing user uploads. Everyone else does not need this. For sandboxing whole workloads rather than a single library, gVisor or Firecracker are the different tool. The catch is that it only helps if you were already going to do this work. Sandboxing changes your calling convention, and a team that will not maintain a per-library policy will end up with a sandbox that is permissive enough to be theater.

darksword-kexploit1.5k★

This is the DarkSword kernel exploit reimplemented in clean Objective-C. It targets iOS 15.0 through 26.0.1 and provides arbitrary kernel read/write, the foundation for jailbreaks, security research, and vulnerability analysis. The original DarkSword exploit chain was used by commercial surveillance vendors targeting multiple countries before being leaked publicly. This reimplementation by opa334 (a well-known jailbreak developer) makes it accessible to researchers in clean, readable code rather than the obfuscated original. No license specified. The catch: this is a kernel exploit. The security implications are real. Apple has patched this in newer iOS versions, so it only affects devices that haven't updated. Using this for anything other than security research or personal device modification puts you in legal and ethical gray areas. No license means no explicit permission to use or modify. And if you're not already deep in iOS internals, the code won't teach you much without significant background knowledge.

probo1.4k★

probo is open source compliance automation for startups, the kind of tool that gets you through a SOC 2, GDPR, or ISO 27001 audit without paying for an expensive platform. It tracks the controls, evidence, and policies those frameworks demand, with HIPAA and newer ISO standards on the list too. Built in Go with a React frontend, MIT licensed, and free to self-host. This is the open alternative to Vanta, Drata, and Secureframe. Self-hosting is real work. It runs via Docker, but the stack is substantial: a Go backend, Postgres, a React frontend, and a full observability layer with Grafana, Prometheus, Loki, and Tempo. Standing it up takes Docker, Node 22, and some patience. This is moderate-to-significant ops burden, not a weekend project, though it is far cheaper than the contracts the commercial GRC platforms charge. Solo founders and small startups facing their first SOC 2 will save real money here, since the commercial tools start in the five figures a year. Small teams with someone technical to run it get most of the value. Larger or less technical orgs that need hand-holding, auditor integrations, and support may still want a paid platform. There is no paid tier from probo; the trade is your time and infrastructure for their subscription fee. The catch is that compliance software is only half the job. probo organizes evidence and controls, but it will not talk to your auditor for you, and the commercial platforms' real value is often the audit relationships and integrations they bring. Self-hosting saves money; it does not save you from the audit itself.

vault-guides1.1k★

This isn't HashiCorp Vault itself; it's the official collection of example code and tutorials for learning Vault. If you're trying to figure out how to store API keys, database passwords, or encryption keys securely, these guides walk you through Vault's features with working code examples. Vault is a secrets management tool: instead of hardcoding passwords in environment variables or config files, your applications request secrets from Vault at runtime. Vault can also generate temporary database credentials, encrypt data, and manage PKI certificates. It's the industry standard for secrets management at scale. The guides cover identity management, secrets engines, encryption as a service, governance policies, and operational patterns. Examples in Shell, Python, Ruby, and Terraform. Useful for getting started but increasingly dated; some guides reference older Vault versions. Vault itself is source-available (BSL license). The open source fork is OpenBao. HCP Vault (managed cloud) starts at $0.03/hr (~$22/mo) for a small cluster. The catch: these are learning guides, not the tool. If you need Vault, go to the main vault repo. And Vault itself is complex; it's designed for organizations with real compliance requirements. For a solo developer or small team, SOPS or doppler.com handles secrets management with 10% of the complexity.

VaultSharp547★

VaultSharp is the .NET client library for HashiCorp Vault. Instead of making raw HTTP calls to Vault's API, you get typed methods and objects. Apache 2.0, C#. Covers the full Vault API: secret engines (KV, Transit, PKI, databases), auth methods (AppRole, Token, LDAP, Kubernetes), and system operations. Supports both Vault Community and Enterprise features. Fully free. This is a client library: no hosting, no service, no paid tier. NuGet install and use. The catch: this is a niche library for a specific integration. You need HashiCorp Vault already running (which has its own cost and ops story). VaultSharp just makes talking to it from C# easier. If you're not in the .NET ecosystem, this isn't relevant. If you are, it's essentially the only maintained Vault client for C#, so the choice is this or raw HTTP. At, the community is small, don't expect instant answers to edge case questions.