Open Source Security Software
A curated list of actively maintained open source tools across the four categories most relevant to a security program's own tooling: static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and penetration testing. Every link below points to the project's official site or GitHub organization — each was verified live before publishing rather than assumed. Genuinely unmaintained projects (however well-known historically) were deliberately left off rather than listed as if current.
Note on "open source" vs. "free": Some widely used security tools are free to use but not open source — Burp Suite Community Edition and Nessus Essentials are the two most common examples. They're excellent tools, but they don't belong on a strictly open source list, so they're intentionally not included below.
SAST — Static Application Security Testing
Analyzes source code, bytecode, or binaries without executing the program. See SAST and SCA for how this fits into a broader pipeline.
| Tool | Description | License |
|---|---|---|
| Semgrep | Fast, pattern-based static analysis across dozens of languages; rules are easy to read and write. See also Semgrep (Open Source Edition). | LGPL 2.1 |
| SonarQube Community Edition | Widely deployed static analysis platform with CI/CD integration and long-standing language coverage. | LGPL 3.0 |
| Bandit | Static analysis specifically for Python, checking for common security issues in AST. | Apache 2.0 |
| Brakeman | Static analysis scanner purpose-built for Ruby on Rails applications. | Free / open source |
| SpotBugs | Static analysis for Java bytecode; the actively maintained successor to FindBugs. | LGPL 2.1 |
| Find Security Bugs | A security-focused plugin extending SpotBugs with vulnerability-specific detectors. | LGPL 3.0 |
| CodeQL | Query-based semantic code analysis engine from GitHub; free for public repositories and open source use. | Free for open source use (source-available) |
DAST — Dynamic Application Security Testing
Tests a running application from the outside, the way an attacker would, without needing source code access.
| Tool | Description | License |
|---|---|---|
| OWASP ZAP | The most widely used open source web application scanner/proxy; active community and plugin ecosystem. | Apache 2.0 |
| Nikto | Web server scanner checking for dangerous files, outdated software, and common misconfigurations. | GPL 2.0 |
| Arachni | Modular web application security scanner framework. | Apache 2.0 |
| Wapiti | Web application vulnerability scanner that operates as a black-box fuzzer against discovered forms/URLs. | GPL 2.0 |
SCA — Software Composition Analysis
Identifies known-vulnerable open source dependencies and generates software bills of materials. See pip-audit for a hands-on example.
| Tool | Description | License |
|---|---|---|
| OWASP Dependency-Check | Long-standing SCA tool identifying publicly disclosed vulnerabilities in project dependencies. | Apache 2.0 |
| Trivy | Fast, all-in-one scanner covering dependencies, containers, IaC misconfigurations, and secrets. | Apache 2.0 |
| Grype | Vulnerability scanner for container images and filesystems from Anchore. | Apache 2.0 |
| Syft | SBOM generation tool, commonly paired with Grype for scanning what it discovers. | Apache 2.0 |
| OSV-Scanner | Google-maintained scanner built on the open, cross-ecosystem OSV vulnerability database. | Apache 2.0 |
| pip-audit | PyPA's own dependency vulnerability auditor for Python projects. | Apache 2.0 |
| Dependency-Track | OWASP platform for continuously analyzing SBOMs across an organization's full application portfolio. | Apache 2.0 |
Penetration Testing Tools
See Penetration Testing for how these fit into a full engagement methodology.
| Tool | Description | License |
|---|---|---|
| Metasploit Framework | The standard open source exploitation and post-exploitation framework. | BSD-3-Clause |
| Nmap | The standard network discovery and port-scanning tool. See Scanning Hosts and Networks with Nmap. | GPL 2.0 |
| Kali Linux | Debian-based distribution pre-loaded with the majority of tools in this list. | Free / open source |
| OpenVAS | Full-featured open source vulnerability scanner, part of the Greenbone Community Edition. | GPL |
| John the Ripper | Password cracking tool supporting a wide range of hash and cipher formats. | GPL 2.0 |
| Hashcat | GPU-accelerated password recovery tool, complementary to John the Ripper. | MIT |
| Wireshark | The standard network protocol analyzer for packet-level traffic inspection. | GPL 2.0 |
| BloodHound | Active Directory / Entra ID attack path analysis using graph theory to reveal privilege escalation paths. | Apache 2.0 / GPL 3.0 (dual) |
| Impacket | Python library collection for working with network protocols, heavily used in Active Directory testing. | Apache 2.0 (modified) |
| SQLMap | Automated SQL injection detection and exploitation tool. | GPL 2.0 |
| Aircrack-ng | Suite of tools for assessing Wi-Fi network security. | GPL 2.0 |