{"id":41782,"url":"https://github.com/osirislab/awesome-rust-security","name":"awesome-rust-security","description":"Curated list of awesome projects and resources related to Rust and computer security","projects_count":116,"last_synced_at":"2026-07-31T19:00:19.168Z","repository":{"id":40792103,"uuid":"370439292","full_name":"osirislab/awesome-rust-security","owner":"osirislab","description":"Curated list of awesome projects and resources related to Rust and computer security","archived":false,"fork":false,"pushed_at":"2024-02-22T22:52:25.000Z","size":125,"stargazers_count":593,"open_issues_count":11,"forks_count":75,"subscribers_count":8,"default_branch":"master","last_synced_at":"2026-07-12T17:03:15.533Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/osirislab.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2021-05-24T17:50:50.000Z","updated_at":"2026-07-10T15:43:05.000Z","dependencies_parsed_at":"2024-01-16T17:03:09.194Z","dependency_job_id":"1f0ac8a0-7313-400e-9563-550a5d5e55a8","html_url":"https://github.com/osirislab/awesome-rust-security","commit_stats":null,"previous_names":["ex0dus-0x/awesome-rust-security"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/osirislab/awesome-rust-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osirislab%2Fawesome-rust-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osirislab%2Fawesome-rust-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osirislab%2Fawesome-rust-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osirislab%2Fawesome-rust-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/osirislab","download_url":"https://codeload.github.com/osirislab/awesome-rust-security/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/osirislab%2Fawesome-rust-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":36128845,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-31T02:00:06.731Z","response_time":112,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-13T21:18:13.809Z","updated_at":"2026-07-31T19:00:19.168Z","primary_language":"Rust","list_of_lists":false,"displayable":true,"categories":["Talks","Vulnerability Assessment","Articles","Applications","Books","Web and Cloud Security","Cryptography","Threat Detection and Forensics","Offensive Security and Red Teaming"],"sub_categories":["Frameworks","Static Code Auditing","Fuzzing","Binary Analysis \u0026 Reversing","Formal Verification","Cloud and Infrastructure","Secure Frameworks","Pentesting","Packing, Obfuscation, Encryption, Anti-analysis","Property-Based Testing","Software Supply Chain","Authorization \u0026 Authentication Frameworks","Symbolic Execution","Defense Evasion","Command-and-Control Frameworks"],"readme":"\u003cdiv align=\"center\"\u003e\n    \u003ch1\u003eAwesome Rust Security\u003c/h1\u003e\n    \u003cp\u003eCurated list of awesome projects and resources related to Rust and computer security\u003c/p\u003e\n\u003c/div\u003e\n\u003cbr/\u003e\n\n# Table of Contents\n\n- [Tools](#tools)\n    - [Web and Cloud Security](#web-and-cloud-security)\n    - [Vulnerability Assessment](#vulnerability-assessment)\n    - [Offensive Security and Red Teaming](#offensive-security-and-red-teaming)\n    - [Threat Detection and Forensics](#threat-detection-and-forensics)\n    - [Cryptography](#cryptography)\n    - [Applications](#applications)\n- [Educational](#educational)\n    - [Books](#books)\n    - [Articles](#articles)\n    - [Talks](#talks)\n- [Similar Lists](#similar-lists)\n- [Contributing](#contributing)\n\n\u003cbr/\u003e\n\u003cbr/\u003e\n\n# Tools\n\n## Web and Cloud Security\n\n### Pentesting\n\n- [sn0int](https://github.com/kpcyrd/sn0int) - OSINT framework and package manager\n- [sniffglue](https://github.com/kpcyrd/sniffglue) - secure multithreaded packet sniffer\n- [badtouch](https://github.com/kpcyrd/badtouch) - scriptable network authentication cracker\n- [rshijack](https://github.com/kpcyrd/rshijack) - TCP connection hijacker\n- [feroxbuster](https://github.com/epi052/feroxbuster) - fast, simple and recursive content discovery tool\n- [rustbuster](https://github.com/phra/rustbuster) - web fuzzer and content discovery tool\n- [rustscan](https://github.com/RustScan/RustScan) - The Modern Port Scanner\n- [kepler](https://github.com/Exein-io/kepler) - NIST-based CVE lookup store and API powered by Rust.\n- [phaser](https://github.com/skerkour/phaser) - Automated attack surface mapper and vulnerability scanner\n- [pdfrip](https://github.com/mufeedvh/pdfrip) - Fast PDF password cracking utility equipped with commonly encountered password format builders and dictionary attacks.\n- [chromepass](https://github.com/darkarp/chromepass) - Chromepass - Hacking Chrome Saved Passwords\n\n### Authorization \u0026 Authentication Frameworks\n\n- [biscuit](https://github.com/CleverCloud/biscuit) - delegated, decentralized, capabilities based authorization token\n- [paseto.rs](https://github.com/instructure/paseto) - PASETO Rust implementation\n- [webauthn.rs](https://github.com/kanidm/webauthn-rs) - WebAuthn implementation in Rust\n- [aliri](https://github.com/neoeinstein/aliri) - JWT authenticaiton and OAuth2 scope authorization implementations for many web frameworks\n- [OpenSK](https://github.com/google/OpenSK) - open-source implementation for security keys written in Rust\n- [dacquiri](https://github.com/resyncgg/dacquiri) - Attributed based access control (ABAC) framework with compile-time enforcement \n\n### Cloud and Infrastructure\n\n- [firecracker](https://github.com/firecracker-microvm/firecracker) - secure and fast microVMs for serverless computing\n- [boringtun](https://github.com/cloudflare/boringtun) - CloudFlare's Rust implementation of WireGuard\n- [innernet](https://github.com/tonarino/innernet) - private network based on WireGuard\n- [vaultwarden](https://github.com/dani-garcia/vaultwarden) - unofficial BitWarden implementation in Rust\n\n### Software Supply Chain\n\n- [rebuilderd](https://github.com/kpcyrd/rebuilderd) - independent verification of binary packages\n- [rust-tuf](https://github.com/heartsucker/rust-tuf) - Rust implementation of [the Update Framework](https://theupdateframework.io/)\n\n### Secure Frameworks\n\n- [adblock-rust](https://github.com/brave/adblock-rust) - Brave's Rust-based adblock engine\n- [libinjection](https://github.com/arvancloud/libinjection-rs) - Rust bindings to libinjection\n- [http-desync-guardian](https://github.com/aws/http-desync-guardian) - Analyze HTTP requests to minimize risks of HTTP Desync attacks\n- [ammonia](https://github.com/rust-ammonia/ammonia) - Repair and secure untrusted HTML\n\n\u003cbr/\u003e\n\n## Vulnerability Assessment\n\n### Static Code Auditing\n\n- [RustSec](https://github.com/RustSec) - organization supporting vulnerability disclosure for Rust packages, audit Cargo.lock files for dependencies\n- [cargo-geiger](https://github.com/rust-secure-code/cargo-geiger) - detect usage of unsafe Rust\n- [siderophile](https://github.com/trailofbits/siderophile) - find ideal fuzz targets in a Rust codebase\n- [cargo-crev](https://github.com/crev-dev/cargo-crev) - cryptographically verifiable code review for cargo\n- [arch-audit](https://github.com/ilpianista/arch-audit) - audit installed Arch packages for vulnerabilities\n- [ripgrep](https://github.com/BurntSushi/ripgrep) - recursively search directories with regexes\n- [weggli](https://github.com/googleprojectzero/weggli) - fast and robust semantic search tool for C and C++ codebases\n- [noseyparker](https://github.com/praetorian-inc/noseyparker) - command-line program that finds secrets and sensitive information in textual data and Git history.\n- [L3X](https://github.com/VulnPlanet/l3x) - AI-driven Static Analyzer\n\n### Fuzzing\n\n- [rust-fuzz](https://github.com/rust-fuzz) - organization implementing cargo plugins for AFL, libFuzzer, and honggfuzz\n- [LibAFL](https://github.com/AFLplusplus/LibAFL) - slot fuzzers together in Rust\n- [fuzzcheck.rs](https://github.com/loiclec/fuzzcheck-rs) - structure-aware, in-process, coverage-guided, evolutionary fuzzing engine for Rust functions.\n- [onefuzz](https://github.com/microsoft/onefuzz) - self-hosted Fuzzing-As-A-Service platform \n- [lain](https://github.com/microsoft/lain) - fuzzer framework implemented in Rust\n- [fzero](https://github.com/gamozolabs/fzero_fuzzer) - fast grammar-based fuzz generator implementation\n- [nautilus](https://github.com/RUB-SysSec/nautilus) - grammar-based feedback fuzzer from RUB's Systems Security Lab\n- [sidefuzz](https://github.com/phayes/sidefuzz) - fuzzer for side-channel vulnerabilities\n- [arbitrary](https://github.com/rust-fuzz/arbitrary) - trait for generating structured input from raw bytes, helpful for structure-aware fuzzing\n- [rust-san](https://github.com/japaric/rust-san) - sanitizers for Rust code\n- [lidiffuzz](https://github.com/Shnatsel/libdiffuzz) - memory allocator drop-in to test for uninitialized memory reads\n- [rewind](https://github.com/quarkslab/rewind) - Snapshot-based coverage-guided Windows kernel fuzzer\n- [hyperpom](https://github.com/impalabs/hyperpom) - AArch64 fuzzer based on the Apple Silicon hypervisor\n- [icicle-emu](https://github.com/icicle-emu/icicle-emu) - Fuzzing-specific multi-architecture emulation framework\n\n### Binary Analysis \u0026 Reversing\n\n- [goblin](https://github.com/m4b/goblin) - binary parsing crate for Rust\n- [unicorn.rs](https://github.com/unicorn-rs/unicorn-rs) - Rust bindings to the Unicorn framework\n- [cargo-call-stack](https://github.com/japaric/cargo-call-stack) - whole program stack analysis\n- [xori](https://github.com/endgameinc/xori) - disassembly library for PE32, 32+ and shellcode\n- [rd](https://github.com/sidkshatriya/rd) - record/replay debugger implemented in Rust\n- [binsec](https://github.com/ex0dus-0x/binsec) - Swiss Army Knife for Binary (In)Security\n- [radeco](https://github.com/radareorg/radeco) - Radare2-based decompiler and symbol executor\n- [falcon](https://github.com/falconre/falcon) - Binary Analysis Framework in Rust\n- [mesos](https://github.com/gamozolabs/mesos) - binary coverage tool without modification for Windows\n- [guerilla](https://github.com/mehcode/guerrilla) - monkey patching Rust functions\n- [ropr](https://github.com/Ben-Lichtman/ropr) - blazing fast™ multithreaded ROP Gadget finder\n- [pwninit](https://github.com/io12/pwninit) - automate starting binary exploit challenges\n- [binaryninja-rs](https://github.com/Vector35/binaryninja-api/tree/dev/rust) - Binary Ninja API support for Rust\n\n### Property-Based Testing\n\n- [quickcheck](https://github.com/BurntSushi/quickcheck) - property-based testing for Rust\n- [proptest](https://github.com/AltSysrq/proptest) - Hypothesis-like property testing for Rust\n- [bughunt-rust](https://github.com/blt/bughunt-rust) - example of using fuzzing QuickCheck models for bughunting\n- [mutagen](https://github.com/llogiq/mutagen) - mutation testing framework for Rust\n\n### Symbolic Execution\n\n- [seer](https://github.com/dwrensha/seer) - symbolic execution engine for Rust\n- [haybale](https://github.com/PLSysSec/haybale) - LLVM IR-based symbolic execution engine from the USCD System Security Lab\n\n### Formal Verification\n\n- [MIRAI](https://github.com/facebookexperimental/MIRAI) - abstract interpreter for Rust's MIR from Facebook\n- [electrolysis](https://github.com/Kha/electrolysis) - formal verification of Rust programs with the Lean theorem prover\n\n\u003cbr/\u003e\n\n## Offensive Security and Red Teaming\n\n### Command-and-Control Frameworks\n\n- [tetanus](https://github.com/MythicAgents/tetanus) - Mythic agent written in Rust \n\n### Defense Evasion\n\n- [FunctionStomping](https://github.com/Idov31/FunctionStomping) - new shellcode injection technique.\n\n### Packing, Obfuscation, Encryption, Anti-analysis\n\n- [debugoff](https://github.com/0xor0ne/debugoff) - Linux anti-debugging and\n  anti-analysis rust library\n- [goldberg](https://github.com/frank2/goldberg) - procedural macro library for\n  obfuscating Rust code.\n- [obfstr](https://github.com/CasualX/obfstr) - string obfuscation for Rust\n- [oxide](https://github.com/frank2/oxide) - PoC packer written in Rust.\n- [Linux.Fe2O3](https://github.com/guitmz/Fe2O3) - Simple ELF prepender virus / in-memory loader written in Rust\n\n\u003cbr/\u003e\n\n## Threat Detection and Forensics\n\n- [yara-rust](https://github.com/Hugal31/yara-rust) - Rust bindings to YARA\n- [BONOMEN](https://github.com/0xcpu/bonomen) - hunt for malware critical process impersonation\n- [confine](https://github.com/ex0dus-0x/confine) - sandbox for threat detection\n- [redbpf](https://github.com/foniod/redbpf) - crate for writing BPF/eBPF modules\n- [cernan](https://github.com/postmates/cernan) - telemetry aggregation and shipping\n- [chainsaw](https://github.com/countercept/chainsaw) - Windows Event Log Hunting\n- [foniod](https://github.com/foniod/foniod) - Data first monitoring agent using (e)BPF, built on RedBPF\n- [zerotect](https://github.com/polyverse/zerotect) - attack/exploit Detector that utilizes Polymorphism and Diversity\n- [hayabusa](https://github.com/Yamato-Security/hayabusa) - Sigma-based threat hunting and fast forensics timeline generator for Windows event logs written in Rust.\n- [medusa](https://github.com/evilsocket/medusa) - fast and secure multi protocol honeypot.\n- [elegant-bouncer](https://github.com/msuiche/elegant-bouncer) - experimental tool for detection of the FORCEDENTRY (CVE-2021-30860)\n- [cargo-sandbox](https://github.com/insanitybit/cargo-sandbox/) - sandboxed cargo\n\n\u003cbr/\u003e\n\n## Cryptography\n\n### Frameworks\n\n- [secrets](https://github.com/stouset/secrets) - secure storage for cryptographic secrets in Rust\n- [mundane](https://github.com/google/mundane) - BoringSSL-backed cryptography library\n- [rust-threshold-secret-sharing](https://github.com/snipsco/rust-threshold-secret-sharing) - Rust implementation of threshold-based secret sharing\n- [molasses](https://github.com/trailofbits/molasses) - Rust implementation of the MLS group messaging protocol\n- [rust-security-framework](https://github.com/kornelski/rust-security-framework) - Rust bindings to the macOS `Security.framework`\n- [microkv](https://github.com/ex0dus-0x/microkv) - minimal and secure key-value storage for Rust\n- [swanky](https://github.com/GaloisInc/swanky) - suite of rust libraries for secure multi-party computation\n- [tandem](https://github.com/sine-fdn/tandem) - maliciously secure two-party computation engine which is embeddable and accessible\n\n## Applications\n\n- [sniffnet](https://github.com/GyulyVGC/sniffnet) - Application to comfortably monitor your Internet traffic 🕵️‍♂️\n- [ripasso](https://github.com/cortex/ripasso/) - password manager written in Rust\n- [sekey](https://github.com/sekey/sekey) - TouchID / Secure Enclave for SSH authentication\n- [Mullvad VPN Client](https://github.com/mullvad/mullvadvpn-app) - Mullvad VPN app written in Rust\n- [fakio](https://github.com/SerhoLiu/fakio) - lightweight secure tunnel proxy.\n- [firecracker](https://github.com/firecracker-microvm/firecracker) - Secure and fast microVMs for serverless computing.\n\n\u003cbr/\u003e\n\n# Educational\n\n## Books\n\n- [Black Hat Rust](https://github.com/skerkour/black-hat-rust)\n- [Rust Fuzz Book](https://rust-fuzz.github.io/book/)\n- [Secure Rust Guidelines](https://anssi-fr.github.io/rust-guide/)\n\n## Articles\n\n- [str::repeat wildcopy exploit writeup](https://saaramar.github.io/str_repeat_exploit/)\n- [Introduction to Fuzzing Rust code](https://fuzzinglabs.com/introduction-rust-fuzzing-tutorial/)\n\n## Talks\n\n- [BlackHat EU 2018 - RustZone: Writing Trusted Applications in Rust](https://www.youtube.com/watch?v=9wLgXfo0l1g)\n- [DEFCON 30 - Lessons from fuzzing a smart contract compiler](https://www.youtube.com/watch?v=8E7XOHQiRPE)\n\n\u003cbr/\u003e\n\n# Similar Lists\n\n- [awesome-rust](https://github.com/rust-unofficial/awesome-rust)\n- [rust-secure-code/projects](https://github.com/rust-secure-code/projects)\n- [analysis-tools-dev/static-analysis](https://github.com/analysis-tools-dev/static-analysis)\n- [analysis-tools-dev/dynamic-analysis](https://github.com/analysis-tools-dev/dynamic-analysis)\n- [awesome-go-security](https://github.com/Binject/awesome-go-security)\n\n\u003cbr/\u003e\n\n# Contributing\n\nMake a pull request if you are interested in adding more to this list! All contributions are appreciated.\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/osirislab%2Fawesome-rust-security/projects"}