Skip to content
Project categories

Security · GitHub

Protect systems, find vulnerabilities, and improve privacy.

Useful GitHub projects

3,285 projects

GuardianWAF

GuardianWAF

38stars
GuardianWAF preview

Zero-dependency Web Application Firewall in Go. Single binary. Three deployment modes. Tokenizer-based detection.

  • Eleven attack detectors: SQL injection, XSS, path traversal, command injection, XXE, SSRF, SSTI, NoSQL injection, HTTP request smuggling, open redirect, GraphQL depth/complexity
  • Tokenizer-based detection engine with configurable scoring thresholds

openradview

gyorgysh

26stars

Free, open-source desktop viewer for exploring your own DICOM and NIfTI images. Local viewing with GPU rendering, linked MPR and optional MCP agent access. For personal education and research; not for diagnosis or care decisions.

SecurityRustGPL-3.0GitHub
68stars

Hack23 Public Information Security Management System:Security Through Transparency and Open Documentation Demonstrating Security Excellence Through Public ISMS Disclosure

SecurityApache-2.0GitHub

pwneye

Hackerest

423stars
pwneye preview

Your ONVIF and RTSP camera companion for discovering and hacking real-world security cameras 🎥

SecurityPythonGPL-3.0GitHub

BlueTeam

Hacking-Notes

56stars

This repo shares blue team security notes and resources for detecting and preventing cyber attacks. Topics covered include email, file, log, malware, memory forensics, and packet analysis.

33stars

🛡️ A decade of technology evolution (2013–Present): Archiving cybersecurity, Linux, AI, and DevSecOps research for the Hack-Under-Root blog.

OmniOAST

hahwul

27stars

Unify your OAST provider management and consolidate all interactions into a single, streamlined workflow.

SecurityTypeScriptMITGitHub

urx

hahwul

194stars
urx preview

Extracts URLs from OSINT Archives for Security Insights

  • Keyless sources: Wayback Machine, Common Crawl, OTX, Arquivo.pt, URLScan (anonymous)
  • Keyed sources with key rotation: VirusTotal, URLScan, ZoomEye, GitHub Code Search, BeVigil (URLs from Android apps)

xssmaze

hahwul

40stars

XSSMaze is a web service designed to test and improve the performance of security testing tools by providing various cases of XSS vulnerabilities.

SecurityCrystalMITGitHub

cyber-neo

Hainrixz

297stars
cyber-neo preview

Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 categories. 11 security domains, 60+ secret patterns, parallel subagent analysis, professional report generation. Built by tododeia.com

  • 1 - Code Security (SAST) - SQL injection, XSS, command injection, code injection, path traversal, SSRF, deserialization, prototype pollution - Semgrep (optional) + Claude-native pattern analysis
  • 2 - Authentication & Authorization - Missing auth middleware, JWT misconfigurations, broken access control, IDOR, session management flaws, missing RBAC - Claude-native analysis using auth-authz-patterns.md
19stars

Umbrella Spoofer v2.0.4 scans hwid reset beside hwid checker. hwid ban tally, smbios board, volume label, nic oui, snapshot pair, disk serial, caller id, device fingerprint, webgl canvases.

ghostline

hashcott

123stars

One-click encrypted DNS (DoH/DoT/DoQ/DNSCrypt), protection against DPI interference with zapret2 (or GoodbyeDPI on Windows), a local HTTP/SOCKS proxy with TLS fragmentation, and domain rules for Windows and Linux. ~30 MB RAM, no telemetry, always restores your original DNS. For privacy, security research and education.

144stars

High-performance open-source anti-DPI / anti-censorship tunnel in Go. Hides VLESS/Trojan traffic behind a 16-mimic arsenal (SSH, TLS, mail, databases, cPanel/WHM/DirectAdmin/Grafana/Prometheus) in coherent personas. Real Let's Encrypt certs, full UDP/QUIC, TUN + transparent gateway mode, runs on MikroTik/RouterOS & Docker.

  • Chaos Mesh Dynamic Balancing: Replaces traditional Round-Robin with a smart "Least Loaded" distribution algorithm. The system actively monitors real-time bandwidth (Mbps) and scales physical connections up or down based on actual traffic volume, not just stream count.
  • DPI Evasion (Fluctuating Caps): Implements dynamic bandwidth jitter. Each physical connection operates under a randomized, fluctuating bandwidth limit (e.g., 8 Mbps ± 2 Mbps) to break static patterns, making the tunnel indistinguishable from organic, noisy internet traffic.

earshot

HellzYeahh

45stars

One Android app for any Bluetooth headset: Bose, Sony, Sennheiser, Soundcore, Skullcandy and more. No account, no internet permission.

dtpr

Helpful-Places

27stars

A wayfinding system and visual language for urban tech that helps people see and understand how data, sensors and AI shapes the places we live, work and play.

SecurityTypeScriptApache-2.0GitHub
251stars
whoishere.py preview

WIFI Client Detection - Identify people by assigning a name to a device performing a wireless probe request.

Tella-Android

Horizontal-org

117stars
Tella-Android preview

The Android version of our app Tella. Tella is a mobile app designed to protect human rights defenders, advocates, and journalists by encrypting and hiding their sensitive data and safely uploading it to their organization's server.

286stars

A privacy protection tool for screenshots with strong anti-detection capabilities.

  • Comprehensively block malicious detection by specific appsBypass malicious app detection of user screenshots and screen recordings.Supports independently blocking apps' floating window detection, focus detection, and window integrity detection.Supports more aggressive detection and filtering against “unruly” malware.
  • Enables stealthy screen capture, recording, and sharingThe screenshot and screen recording feature bypasses malicious application-layer detection through direct low-level system calls.Screen sharing supports not only local network sharing but also remote sharing over SSH. It also supports receiving screen sharing and remote control efficiently.
SecurityKotlinGPL-3.0GitHub