OpenTRAP
Intercept, replay and audit web app traffic without a Burp licence: Repeater, Intruder and Collaborator on top of the OWASP ZAP scan engine, under the AGPL-3.0.
// SECURITY
29 entries tagged with "security"
// COMPARISONS
5 GRC and compliance Running ISO 27001, NIS2 or SOC 2 compliance on your own server: three open source GRC tools compared on bundled frameworks, hosting needs and paid editions. Web application firewall (WAF) Stop attacks before they reach your web apps: OWASP rules, shared IP reputation or a trained model. Three open source WAFs compared, paid tiers included. Self-hosted CAPTCHA Replacing reCAPTCHA with a CAPTCHA you host: ALTCHA, Cap and mCaptcha compared on proof of work, server setup, visitor data, licensing and release health. Remote desktop Taking control of remote machines without TeamViewer: three open source tools compared on what they install, the server they need, paid plans and licence. Single sign-on (SSO) Putting a single sign-in in front of your self-hosted apps: five open-source tools compared on protocols, user accounts, memory needs and licensing terms.
// ENTRIES
24 entries
Cachety
Watermark ID copies and payslips without uploading them: PDFs and photos are processed in the browser, with real redaction, traceable copies and AES-256 PDFs.
BunkerWeb
Protect web apps behind an NGINX reverse proxy that enables ModSecurity, the OWASP Core Rule Set and automatic bans by default. AGPL core, SSO in the paid tier.
CISO Assistant
One control, many standards: a self-hosted GRC platform that assesses risk and compliance against 220+ frameworks, including ISO 27001, NIS2, SOC 2 and DORA.
Apache Guacamole
Remote desktop in a browser tab, with no client or agent: a self-hosted gateway to RDP, VNC and SSH servers, with SSO, MFA and session recording built in.
VoidAuth
One login in front of your self-hosted apps: OIDC and ForwardAuth from a single container, invite-only accounts. A recent project with one main maintainer.
mCaptcha
Block bots without image puzzles: a self-hosted Rust CAPTCHA server whose proof of work gets harder as traffic rises. Its only release dates from March 2024.
Probo
Prepare for SOC 2 or ISO 27001 in an MIT-licensed GRC driven from a CLI or MCP. The vendor's paid offer is a compliance officer who runs the program for you.
Technitium DNS Server
Network-wide ad and malware blocking plus DNS encrypted over DoT, DoH or DoQ: an open source resolver and DNSSEC zone server, written in C# to run on .NET 10.
FingerprintJS
Recognise a returning visitor without cookies, even in incognito: an MIT-licensed TypeScript library that hashes 42 browser signals on the client side.
ISMS Builder
Keep your ISO 27001 and NIS2 management system on your own server, not in a SaaS. You import the ISO controls yourself, and one maintainer runs the project.
Yopass
Get a password or file to someone without it sitting in Slack or email: the browser encrypts it with OpenPGP and the self-hosted server stores only ciphertext.
Flowsint
Link domains, IPs, emails and usernames on one investigation graph that DNS, WHOIS and API lookups keep extending. An open source OSINT tool that runs locally.
Hyperswitch
One payments API in front of Stripe, Adyen and other processors, with rule or auth-rate routing and a PCI card vault, self-hosted or run as a cloud service.
open-appsec
Block web and API attacks without maintaining signatures: a model that learns your traffic, plugged into NGINX, Kong or Envoy. Anti-bot and IPS cost extra.
2FAuth
TOTP and HOTP codes generated on your own server and read in any browser: a multi-user PHP web app that can share codes without ever revealing the secret.
Sniffnet
See which hosts, countries and apps your computer talks to, with live charts and blacklist alerts: a free, open-source desktop app for Windows, macOS and Linux.
Authelia
Add SSO and 2FA to any web app at the reverse proxy, without touching its code. Accounts stay in a YAML file or an LDAP directory, with no sign-up flow.
CrowdSec
Ban IPs caught attacking other servers before they reach yours: a log-based detection engine and WAF that trades your alert metadata for a shared blocklist.
Fleet
Manage Macs, Windows PCs, Linux hosts and phones from one self-hosted server: MDM, osquery SQL queries, config in Git. Remote wipe and CIS checks are paid.
ALTCHA
Blocks form bots without image puzzles or cookies: an accessible MIT proof-of-work widget, server libraries in 11 languages. Risk-based checks cost extra.
Shinobi
Record IP and USB cameras and watch them from a browser: a self-hosted NVR in Node.js, free for home use, paid as soon as it runs in a shop or business.
Cap
Stops bots without image grids: the browser solves a proof of work and a Docker server you run checks it, with no cookie and no profiling. Apache 2.0.
Keycloak
Add SSO and MFA to your apps without writing auth code: a Java OIDC and SAML server with LDAP federation, and the JVM, database and memory it requires.