🛡️⚔️ 🔐 SecOps Toolkits

A comprehensive collection of security tools for Blue Team and Red Team operations. Choose from our categorized tools to meet your cybersecurity needs with our searchable directory.

How to use this index: Use the navigation sidebar to jump between Blue Team and Red Team categories with their subcategories, or search for specific tools using the search bar. Each tool is tagged with relevant keywords for easier discovery.

🛡️ Blue Team (Defensive Security)

Tools for monitoring, detecting, and responding to security incidents to protect your organization's assets.

🛡️ Blue Team: Threat Intelligence & Intel

Platforms and tools that provide intelligence on threats, indicators, and attack patterns.

Malware Analysis & Scanning

VirusTotal
Visit Tool
A free online service that analyzes suspicious files, URLs, and domains using multiple antivirus engines and URL scanners. VirusTotal provides threat intelligence by aggregating results from over 70 security vendors and specialized analysis tools. It helps security professionals identify malware, classify malicious behavior, and understand the potential impact of suspicious content.
Malware Analysis Scanning Threat Intelligence
Hybrid Analysis
Visit Tool
A free malware analysis service that delivers automated threat analysis of suspicious files, URLs and IPs. The service provides users with in-depth analysis reports of unknown malware variants.
Malware Analysis Sandbox
MalAPI
Visit Tool
A malware API providing programmatic access to malware data and threat intelligence. This service helps automate malware analysis and threat detection in security operations.
Malware Analysis API
MTA Intelligence
Visit Tool
A repository of malware traffic analysis resources, providing samples and detailed analysis of malware communication patterns and behaviors.
Malware Analysis Network Traffic
CAPEv2
Visit Tool
A malware configuration and payload extraction system that builds on the Cuckoo Sandbox framework. CAPEv2 helps reverse engineers understand malware behavior and extract configuration data.
Malware Analysis Sandbox
EML File Checker
Visit Tool
Analyze .eml files for phishing and security indicators
Email Analysis Phishing
FileSec
Visit Tool
File security and analysis resources for examining potentially malicious files and understanding common file-based attack vectors.
File Analysis Security

IoCs & Threat Feeds

AlienVault OTX
Visit Tool
An open threat exchange platform that allows security researchers and organizations to share threat intelligence for correlation and awareness. OTX provides access to threat indicators and security research.
Threat Intelligence IoCs
abuse.ch
Visit Tool
A threat intelligence portal that tracks and collects information about malicious activities, including indicators of compromise and malware samples.
Threat Intelligence Indicators
ThreatConnect
Visit Tool
A threat intelligence platform that enables organizations to gather, analyze, and act on threat intelligence to strengthen security decisions.
Threat Intelligence Analysis

Reconnaissance

Shodan
Visit Tool
A search engine for internet-connected devices. Shodan enables users to find specific types of devices and systems connected to the internet using a variety of search filters.
Reconnaissance IoT
Censys
Visit Tool
An internet infrastructure search engine that helps organizations find, monitor, and analyze publicly accessible hosts and services.
Reconnaissance Infrastructure

Email Security & Forensics

MXToolbox Email Header Analyzer
Visit Tool
A comprehensive tool for analyzing email headers to verify authentication mechanisms including SPF, DKIM, and DMARC. The analyzer provides detailed breakdowns of email routing, authentication results, and potential indicators of spoofing or other email-based attacks. It helps security professionals trace email paths, verify sender authenticity, and identify potential email security issues.
Email Analysis Headers Authentication
Sublime EML Analyzer
Visit Tool
An advanced .eml file analysis platform that provides in-depth examination of email structure, content, and metadata. The analyzer identifies potential threats within email components including suspicious links, embedded content, and attachment analysis. It provides detailed reporting on security indicators, helps identify phishing attempts, and examines email authenticity markers. Security professionals use this tool to understand the full context of email-based threats and determine the potential impact of suspicious messages.
Email Analysis Advanced File Analysis
EML Wrap
Visit Tool
A utility that converts .eml files into a readable, formatted view for easier analysis without requiring an email client. This tool allows security professionals to quickly view email content, headers, and attachments in a human-readable format. It preserves all email elements including embedded images, links, and metadata while presenting them in an organized view that makes it easier to identify suspicious elements, examine email structure, and analyze potential phishing attempts.
Email Analysis File Viewing Format Conversion
Mail-Tester
Visit Tool
A service that tests email deliverability and authentication by providing a temporary email address for testing. Mail-Tester analyzes your email's configuration including SPF, DKIM, and DMARC records, checks for blacklisting issues, evaluates content for spam triggers, and provides a score for your email's likelihood of reaching the inbox. It provides detailed feedback on authentication mechanisms, content analysis, and configuration issues that could affect email delivery. Security professionals use this tool to verify that their security notifications and legitimate emails won't be flagged as spam.
Email Testing Authentication Deliverability

🛡️ Blue Team: Network Security

Tools for capturing, analyzing, and monitoring network traffic to identify malicious activity.

Network Traffic Analysis & Monitoring

Tools for capturing, analyzing, and monitoring network traffic to identify malicious activity.

Traffic Analysis & Monitoring

Wireshark
Visit Tool
The world's most popular network protocol analyzer. Wireshark allows you to capture and interactively browse the traffic running on a computer network. It provides deep inspection of hundreds of protocols and features a rich display of network data that helps security professionals identify potential threats, troubleshoot network issues, and analyze network behavior in real-time.
Traffic Analysis Packet Capture Protocol Analysis
Tcpdump
Visit Tool
A powerful command-line packet analyzer that allows you to intercept and display TCP/IP and other packets being transmitted or received over a network interface. Tcpdump is widely used by network administrators and security experts for network troubleshooting, traffic analysis, and security auditing. It provides a detailed view of network activity without the overhead of a GUI, making it ideal for server environments and automated analysis.
Traffic Analysis CLI Packet Capture
NetworkMiner
Visit Tool
A Network Forensic Analysis Tool (NFAT) that is designed to detect and analyze network sessions, extract files, images and other relevant data from PCAP files. NetworkMiner performs passive network monitoring, reconstructs sessions, extracts files and images from network traffic, and provides host information from captured packets. It is particularly useful in forensic investigations and security analysis.
Forensics Passive Scanning File Extraction
Netflow Analyzer
Visit Tool
A comprehensive network traffic analysis software that enables administrators to monitor network traffic flow, bandwidth utilization, and identify potential security threats. It supports NetFlow, sFlow, and other flow technologies to provide detailed insights into network usage patterns, traffic sources and destinations, and helps detect anomalies that could indicate security incidents.
Traffic Analysis Netflow Bandwidth Monitoring

Intrusion Detection & Prevention

Snort
Visit Tool
An open-source network intrusion detection and prevention system (NIDS/NIPS) that provides real-time traffic analysis and packet logging. Snort can perform protocol analysis, content searching, and pattern matching to detect potential threats and malicious activity. It's widely used by network administrators and security professionals for monitoring network traffic, identifying suspicious behavior, and preventing intrusions by comparing network traffic against a rules-based language. It serves as both a passive network sniffer and an active intrusion prevention system depending on configuration.
NIDS IPS Network Security
Suricata
Visit Tool
A free, open-source, mature, fast and robust network threat detection engine. Suricata inspects network traffic using a variety of detection methods including signature-based, anomaly-based, and behavioral detection. It combines intrusion detection (IDS), intrusion prevention (IPS), network security monitoring (NSM), and offline pcap processing capabilities in a single, powerful engine. Suricata supports multiple file and protocol analyzers, provides extensive logging capabilities, and offers high-performance packet processing with multi-threading capabilities. It's widely adopted by security teams for real-time threat detection and network monitoring.
NIDS IPS NSM
OSSEC
Visit Tool
An open-source, Host-based Intrusion Detection System (HIDS) that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response. OSSEC operates by collecting and normalizing log data from multiple sources across networked systems, applying correlation rules to identify potential security events, monitoring system configurations for unauthorized changes, and detecting common attack patterns. It provides centralized monitoring capabilities with agents deployed on monitored systems and a central server for log analysis and alerting. The system can respond to threats automatically through active response mechanisms and provides detailed analysis capabilities for security analysts.
HIDS Monitoring Log Analysis
Zeek (Bro)
Visit Tool
A powerful network analysis framework that focuses on network security monitoring (NSM). Originally developed as Bro, Zeek provides deep visibility into network behavior by transforming raw network traffic into high-level, structured logs and events. Unlike traditional intrusion detection systems that rely on signature matching, Zeek takes a more comprehensive approach by analyzing network protocols, extracting application data, and detecting anomalies that may indicate security incidents. It generates detailed logs of network activity, including connection records, HTTP requests, DNS lookups, SSL certificates, and file transfers, making it invaluable for incident response, threat hunting, and forensic analysis.
Network Analysis NSM Traffic Analysis

Endpoint Security

Tools for monitoring and responding to security events on endpoints like workstations and servers.

EDR & SIEM

Elastic Security
Visit Tool
A comprehensive security solution that combines SIEM capabilities with endpoint protection using the Elastic Stack (Elasticsearch, Logstash, Kibana). Elastic Security provides threat detection, incident response capabilities, and endpoint monitoring through a unified platform. It offers behavioral analytics, threat hunting capabilities, and pre-built security rules for detecting and responding to security incidents. The platform uses machine learning and statistical analysis to identify anomalies and potential threats across network, endpoint, and cloud data sources.
SIEM EDR Threat Detection
Splunk Enterprise Security
Visit Tool
A leading SIEM platform that enables organizations to detect, investigate, and respond to security threats using data analytics. Splunk ES collects and correlates data from thousands of sources including network devices, security tools, endpoints, and applications. It provides customizable dashboards, threat intelligence integration, and incident response workflows. The platform is known for its powerful search processing language (SPL) that allows security analysts to create complex queries and visualizations to identify potential security incidents.
SIEM Data Analytics Correlation Engine

Host Monitoring

OSQuery
Visit Tool
A SQL-powered operating system instrumentation tool that makes low-level operating system data accessible via SQL queries. OSQuery allows security teams to write SQL queries to explore operating system state across their entire fleet of machines in real-time. It exposes system information as high-performance, low-footprint virtual tables that can be queried using familiar SQL syntax. Security professionals use OSQuery for endpoint monitoring, compliance auditing, incident response, and threat hunting by querying for indicators of compromise, system configurations, process activity, file integrity, and network connections across their infrastructure.
Query Endpoint Monitoring SQL
Sysmon
Visit Tool
A system service and device driver that remains resident across system reboots to monitor and log system activity to the Windows event log. Sysmon provides detailed information about process creation, network connections, file creation times, registry changes, and other system activities that are critical for security monitoring and incident response. It's part of Microsoft's Sysinternals suite and is widely used by security professionals to establish a baseline of normal system behavior and detect anomalous activity that could indicate malicious activity.
Windows Monitoring Logging

Vulnerability Management

Tools for identifying and assessing security vulnerabilities in systems and applications.

General Vulnerability Scanners

Rapid7 Nexpose
Visit Tool
A comprehensive vulnerability management solution that combines vulnerability assessment with risk management. Nexpose provides continuous monitoring for security vulnerabilities across physical, virtual, and cloud assets. It offers real-time asset discovery, prioritized risk scoring, remediation guidance, and integration with other Rapid7 products. Security teams use Nexpose to identify, validate, and prioritize vulnerabilities to reduce their risk exposure and strengthen their security posture.
Vulnerability Scanner Risk Management Asset Discovery
Tenable Nessus
Visit Tool
One of the most popular vulnerability scanners in the industry, Nessus provides comprehensive vulnerability detection across diverse IT environments. It can identify vulnerabilities in operating systems, applications, web applications, databases, and network appliances. Nessus offers customizable scanning policies, compliance auditing, and detailed reporting capabilities. Security professionals rely on Nessus for its extensive vulnerability database, regular updates, and accuracy in identifying security vulnerabilities.
Vulnerability Scanner Asset Assessment Compliance
Qualys
Visit Tool
A cloud-based security and compliance platform that provides continuous monitoring and protection across cloud, virtual, and on-premises environments. Qualys offers vulnerability management, web application security, web application firewall, endpoint detection and response, security assessments, and compliance monitoring. Its cloud-based approach eliminates the need for hardware deployments and provides real-time insights into security gaps and compliance violations.
Cloud Compliance Continuous Monitoring
OpenVAS
Visit Tool
An open-source vulnerability scanner and manager that provides comprehensive vulnerability testing for various types of systems. OpenVAS offers a web-based interface, detailed reporting capabilities, and an extensive vulnerability database called the Greenbone Security Assistant (GSA). It performs comprehensive and unattended vulnerability scans, supports a wide range of protocols, and provides detailed reports with risk assessments. Organizations use OpenVAS as a cost-effective alternative to commercial vulnerability scanners.
Open Source Vulnerability Scanner Compliance

Dependency & Code Scanning

Retire.js
Visit Tool
A comprehensive security scanner specifically designed to detect the use of JavaScript libraries with known vulnerabilities. Retire.js scans web projects and identifies outdated or vulnerable JavaScript libraries that might pose a security risk. The tool works by analyzing JavaScript files, HTML pages, and package manifests to identify the versions of included libraries, then cross-references them against vulnerability databases. It can be integrated into development workflows, CI/CD pipelines, and security testing processes to identify potentially dangerous dependencies early in the development lifecycle. Retire.js supports multiple output formats and can be customized with custom vulnerability data sources, making it an essential security tool for web developers and security auditors.
JavaScript Dependency Scanning Vulnerability Detection
Snyk
Visit Tool
A developer-first security platform that helps organizations find and fix vulnerabilities in open source dependencies, container images, and infrastructure as code. Snyk provides real-time security analysis that identifies and prioritizes vulnerabilities based on severity and exploitability, helping teams make informed decisions about which issues to address first. It integrates seamlessly into developer workflows with IDE extensions, CI/CD integrations, and GitHub apps to provide automated security testing. Snyk's approach combines vulnerability databases with real-world exploit data and security intelligence, helping teams remediate security debt with actionable fix guidance. The platform supports multiple programming languages and ecosystems including npm, Maven, pip, RubyGems, NuGet, and more, making it a comprehensive solution for dependency security management.
Dependency Scanning DevSecOps SAST
AuditJS
Visit Tool
A command line utility for detecting JavaScript and npm package vulnerabilities. AuditJS performs comprehensive scans of npm packages and their dependencies to identify known security vulnerabilities. The tool integrates with the Sonatype Nexus Repository Manager and the public npm registry to provide accurate vulnerability detection and remediation advice. It can be incorporated into CI/CD pipelines and development workflows to automatically identify and flag insecure packages before deployment. AuditJS provides detailed reports on security issues, including CVSS scores, severity rankings, and fix recommendations. Security-conscious developers and DevOps teams use AuditJS as part of their security practices to maintain healthy dependency trees and prevent vulnerable packages from entering production environments.
JavaScript npm Dependency Analysis

Threat Intelligence

Platforms and tools that provide intelligence on threats, indicators, and attack patterns.

Malware Analysis & Scanning

VirusTotal
Visit Tool
A free online service that analyzes suspicious files, URLs, and domains using multiple antivirus engines and URL scanners. VirusTotal provides threat intelligence by aggregating results from over 70 security vendors and specialized analysis tools. It helps security professionals identify malware, classify malicious behavior, and understand the potential impact of suspicious content.
Malware Analysis Scanning Threat Intelligence
Hybrid Analysis
Visit Tool
A powerful online malware analysis service that delivers automated threat analysis of suspicious files, URLs and IPs. Hybrid Analysis provides users with in-depth analysis reports of unknown malware variants using both static and dynamic analysis methods. The service features a fast and accurate sandbox environment that executes samples in a secure virtualized environment to observe their behavior. It provides detailed reports with IOCs, network indicators, and behavioral analysis of malware samples. Security professionals use Hybrid Analysis for threat intelligence, incident response, and proactive security research to understand malicious code and identify new threats.
Malware Analysis Sandbox
MalAPI
Visit Tool
A malware API that provides programmatic access to malware data and threat intelligence. MalAPI allows security tools and systems to programmatically access information about known malware families, behaviors, and patterns. This service helps automate malware analysis and threat detection workflows by providing structured data that can be integrated into security operations platforms, SOAR tools, and threat intelligence systems. Security professionals use MalAPI to enhance their security tools with real-time malware intelligence and improve automated threat response capabilities.
Malware Analysis API
MTA Intelligence
Visit Tool
A comprehensive repository of malware traffic analysis resources that provides detailed information about malware communication patterns, network behaviors, and threat intelligence. MTA Intelligence offers samples, packet captures, and detailed analysis reports of malware campaigns and their network activities. Security researchers use this resource to understand how malware communicates over networks, identify IOCs related to malicious traffic, and develop signatures for network detection systems. The site provides valuable insights into malware command-and-control channels, data exfiltration methods, and other network-based malicious activities.
Malware Analysis Network Traffic
CAPEv2
Visit Tool
A malware configuration and payload extraction system built on the Cuckoo Sandbox framework. CAPEv2 specializes in extracting configuration data and payloads from malware samples to help reverse engineers understand malware behavior and capabilities. It uses advanced sandboxing techniques to detonate malware samples in isolated environments and automatically extract key configuration parameters such as C2 servers, encryption keys, and other critical malware settings. CAPEv2 is particularly valuable for understanding targeted malware families and creating specific IOCs for detection and prevention measures. The tool is widely used by malware researchers and incident responders to quickly understand malware operations and develop countermeasures.
Malware Analysis Sandbox

IoCs & Threat Feeds

AlienVault OTX
Visit Tool
An open threat exchange platform that allows security researchers and organizations to share threat intelligence for correlation and awareness. AlienVault OTX (Open Threat Exchange) provides a collaborative environment where security professionals can share indicators of compromise (IOCs), threat data, and security research. Users can access threat data contributed by the global security community, subscribe to threat feeds relevant to their interests, and contribute their own threat intelligence. The platform provides structured data including IP addresses, domain names, file hashes, and URLs associated with malicious activities. Security teams use OTX to enrich their threat intelligence, validate suspicious observables, and stay updated on emerging threats and attack patterns.
Threat Intelligence IoCs
abuse.ch
Visit Tool
A threat intelligence portal that systematically tracks and collects information about malicious activities including malware distribution points, command and control servers, and other indicators related to cybercriminal operations. Abuse.ch maintains several threat feeds including the SSL Blacklist (SSLBL), the URLhaus feed for malware hosting sites, and the Feodo Tracker for botnet C2 servers. The site provides security researchers and SOC teams with continuously updated threat intelligence that can be integrated into security tools and monitoring systems. The data provided by abuse.ch is widely used for blocking malicious domains, IP addresses, and SSL certificates associated with malware campaigns and criminal infrastructure.
Threat Intelligence Indicators
ThreatConnect
Visit Tool
A comprehensive threat intelligence platform that enables organizations to gather, analyze, validate, and act on threat intelligence to strengthen security decisions. ThreatConnect provides a unified platform for threat intelligence management, allowing teams to collect data from multiple sources, validate indicators against known threat actors and campaigns, create and share intelligence with other organizations, and operationalize threat data by integrating it directly into security tools and business processes. The platform includes features for threat modeling, risk scoring, and workflow automation, making it easier for security teams to transform raw threat data into actionable intelligence. Security professionals use ThreatConnect to streamline their threat intelligence operations and improve their organization's threat detection and response capabilities.
Threat Intelligence Analysis

Reconnaissance

Shodan
Visit Tool
A specialized search engine that indexes information about internet-connected devices and services. Shodan scours the internet to find devices that are connected but potentially insecure, including routers, webcams, printers, and industrial control systems. Unlike traditional search engines that index web pages, Shodan indexes device banners and services. Security professionals use Shodan for vulnerability research, security audits, and to understand the potential attack surface of their organizations. The service provides detailed information about device types, server software, open ports, and other technical information that can reveal security vulnerabilities in internet-facing infrastructure.
Reconnaissance IoT
Censys
Visit Tool
An internet infrastructure search engine that helps organizations find, monitor, and analyze publicly accessible hosts and services. Censys systematically scans the entire public IPv4 address space and major IPv6 networks, collecting information about open ports, services, SSL/TLS certificates, and other infrastructure components. The service provides security researchers and organizations with detailed information about their internet-facing assets and potential security exposures. Censys offers advanced search capabilities that allow users to query the collected data using a SQL-like syntax to identify misconfigurations, outdated software, vulnerable services, and other security concerns. Security professionals use Censys for attack surface discovery, vulnerability research, and security monitoring to maintain awareness of their external infrastructure exposure.
Reconnaissance Infrastructure

🛡️ Blue Team: Incident Response & Forensics

Tools and frameworks for responding to security incidents and managing breach response activities.

Incident Response

Tools and frameworks for responding to security incidents and managing breach response activities.

Forensic Analysis

Timesketch
Visit Tool
A collaborative forensic timeline analysis platform developed by Google that enables security teams to analyze and investigate digital evidence through interactive timelines. Timesketch allows incident responders to upload and analyze forensic artifacts, correlate events across multiple data sources, and share findings with team members. The platform features advanced search capabilities, annotation tools, and a flexible data model that supports various types of forensic evidence including log files, memory dumps, and network captures. It includes machine learning-powered event clustering, similarity detection, and visualization tools to help analysts identify patterns and anomalies in security incidents. Timesketch is particularly valuable for managing complex investigations involving multiple data sources and analysts working together on incident response activities.
Forensics Timeline Analysis Collaboration
OSDFCon
Visit Tool
The Open Source Digital Forensics Conference is a collection of resources, presentations, and tools dedicated to open-source digital forensics solutions. OSDFCon provides educational materials, training resources, and practical tools for digital forensics professionals. The conference series focuses on showcasing and advancing the use of open-source tools in digital investigations, offering workshops, tutorials, and demonstrations of the latest techniques in forensic analysis. The resources include tools for disk imaging, memory analysis, network forensics, mobile device forensics, and specialized investigation techniques. Security teams and forensic investigators can access cutting-edge open-source methodologies and tools for incident response, malware analysis, and digital evidence collection to enhance their forensic capabilities while reducing licensing costs.
Forensics Resources Open Source

Monitoring & Alerting

Security Monkey
Visit Tool
A security auditing tool developed by Netflix that monitors AWS, GCP, and OpenStack accounts for configuration changes that may represent security risks. Security Monkey continuously monitors cloud infrastructure resources including EC2 instances, S3 buckets, IAM users/groups/roles/policies, RDS instances, and other cloud services. It tracks changes in configurations, identifies resources with overly permissive access policies, and alerts security teams to potentially dangerous changes in cloud infrastructure. The tool provides a centralized dashboard for security teams to review changes, examine resource configurations over time, and maintain awareness of their cloud security posture. Security Monkey is particularly useful for organizations with dynamic cloud environments where manual monitoring of configurations would be impractical, helping teams maintain security controls as infrastructure scales and changes.
AWS Monitoring Configuration Management
ThreatIngestor
Visit Tool
An extensible framework for automating threat intelligence collection, enrichment, and dissemination. ThreatIngestor enables security teams to automatically gather threat indicator data from various sources including RSS feeds, Twitter, SMS, and other threat intelligence feeds. The framework processes and normalizes threat intelligence data, extracts relevant indicators of compromise (IoCs) such as IP addresses, domain names, and file hashes, and outputs them in various formats compatible with security tools. It can be configured to automatically populate threat intelligence platforms, SIEM systems, and other security infrastructure with up-to-date threat data. ThreatIngestor is highly customizable, allowing teams to define their own sources, processors, and outputs. The tool helps organizations maintain current threat intelligence without manual effort, enabling faster response to emerging threats and better integration of threat data into security operations.
Threat Intelligence Automation IoCs

🛡️ Blue Team: DevSecOps & Infrastructure Security

Tools for integrating security into development processes and securing infrastructure.

Container & Infrastructure Security

Tools for securing containers, infrastructure as code, and deployment pipelines.

Container Security

Trivy
Visit Tool
A comprehensive security scanner for containers and other artifacts. Trivy scans for vulnerabilities, misconfigurations, and secrets in container images, file systems, and infrastructure as code with ease of use in mind.
Container Security Vulnerability Scanner DevSecOps
Anchore Engine
Visit Tool
A service that analyzes images for software content and evaluates that content against various software vulnerability databases and policy engines.
Container Security Policy Engine

CI/CD Security

secureCodeBox
Visit Tool
A lightweight, scalable, and flexible scanning framework specifically designed for continuous security testing in CI/CD pipelines. It provides a Kubernetes-native approach to security scanning with multiple security tools.
CI/CD Automation Security Orchestration
SAST Scan
Visit Tool
A comprehensive multi-language Static Application Security Testing (SAST) tool that combines multiple scanning engines to identify security vulnerabilities in source code.
SAST Static Analysis Code Scanning

⚔️ Red Team (Offensive Security)

Tools for penetration testing, vulnerability assessment, and red team exercises to identify security weaknesses.

⚔️ Red Team: Web Application Testing

Tools for identifying and exploiting web application vulnerabilities.

Scanning & Crawling

Nikto
Visit Tool
An Open Source web server scanner which performs comprehensive tests against web servers for multiple items including dangerous files, outdated server software, and other problems. Nikto combines libwhisker and databases of potentially dangerous files, CGI scripts, and problems with specific server versions. It's widely used by penetration testers and security auditors to identify vulnerabilities in web applications and servers.
Web Security Scanning Vulnerability Detection
Nikto Web Scanner
Visit Tool
The open-source web server and CGI scanner that identifies potential security vulnerabilities in web applications and servers. Nikto performs comprehensive tests against web servers for dangerous files, outdated server software, and other problems. It combines libwhisker with databases of potentially dangerous files and CGI scripts to provide a detailed analysis of web application security.
Web Security Vulnerability Scanner CGI Testing
BlackWidow
Visit Tool
A Python-based web application scanner that performs OWASP testing, audits form inputs, crawls websites, and identifies potential vulnerabilities through automated analysis. BlackWidow automates the process of finding and testing web application vulnerabilities including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and other common web security issues.
Web Security Crawling OWASP Testing
Nuclei
Visit Tool
A fast and customizable vulnerability scanner based on a simple YAML-based template engine. Nuclei can send requests with predefined templates and detect potential vulnerabilities across various protocols including HTTP, DNS, SSL/TLS, and network services. It's designed to be efficient and fast while maintaining high accuracy in vulnerability detection. The template-based approach allows security professionals to create custom checks for specific vulnerabilities.
Vulnerability Scanner Templates Multi-protocol
Katana
Visit Tool
A fast web crawling framework designed to crawl web applications efficiently and discover hidden paths, parameters, and endpoints. Katana extracts links, forms, scripts, headers, and other points of interest from various sources and follows redirect chains to build an accurate map of the application's structure.
Web Security Crawling Reconnaissance

Proxy & Interception

Burp Suite
Visit Tool
An integrated platform for performing security testing of web applications. Burp Suite includes various tools for different aspects of web application testing including interception proxy, scanner, intruder, repeater, and sequencer. It allows security professionals to map out the attack surface of an application, identify vulnerabilities, and exploit them to verify risk.
Web Security Proxy Manual Testing
OWASP ZAP
Visit Tool
The world's most widely used web application security scanner, maintained under the Open Web Application Security Project (OWASP). OWASP ZAP is an open-source tool that provides both automated and manual security testing capabilities for web applications. It includes a proxy for intercepting traffic, an automated scanner for identifying vulnerabilities, and various other tools for security testing.
Web Security Open Source Automated Scanning

Specialized Testing

SQLMap
Visit Tool
The premier open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. SQLMap supports various kinds of SQL injection techniques and can bypass many security measures. It provides access to an underlying database management system through the web application's database, taking advantage of insecure SQL query processing.
Database SQL Injection Automated Enumeration
WPScan
Visit Tool
A comprehensive WordPress security scanner that performs black box penetration testing specifically on WordPress installations. WPScan uses a database of known vulnerabilities to detect security issues in WordPress core, themes, and plugins. It can identify WordPress version, enumerate usernames, detect installed plugins and themes, and check them against a database of known vulnerabilities.
Web Security CMS Vulnerability Scanner
Dalfox
Visit Tool
A powerful open-source XSS (Cross-Site Scripting) scanning and parameter analysis tool designed for security professionals. Dalfox performs both passive and active XSS scanning, supports headless browsing, and provides detailed analysis of parameters to identify potential XSS vulnerabilities. It can detect reflected, stored, and DOM-based XSS vulnerabilities.
Web Security XSS Parameter Analysis
Smuggler
Visit Tool
An HTTP Request Smuggling detection tool specifically designed to identify and exploit HTTP desync vulnerabilities. Smuggler detects various types of HTTP Request Smuggling vulnerabilities including CL.TE, TE.CL, and other desynchronization attacks. HTTP Request Smuggling can lead to serious security issues including bypassing access controls and web cache poisoning.
Web Security HTTP Request Smuggling

⚔️ Red Team: Cloud Security Testing

Tools for testing security in cloud environments and identifying misconfigurations.

Cloud Platform Testing

Prowler
Visit Tool
The most popular open-source tool for AWS security assessment, auditing, and hardening. Prowler performs hundreds of security checks following security best practices and compliance requirements like CIS, PCI-DSS, ISO27001, and others.
AWS Auditing Compliance
AWS Pwn
Visit Tool
A collection of AWS penetration testing tools designed to help security professionals identify and exploit vulnerabilities in AWS environments.
AWS Exploitation
Pacu
Visit Tool
An open source AWS exploitation framework that can be used to gather information and exploit configuration weaknesses within an AWS account. Pacu contains modules to attack services and features within an AWS environment.
AWS Exploitation
CloudHunter
Visit Tool
A tool for security testing of cloud environments that allows security professionals to identify misconfigurations and vulnerabilities across major cloud platforms.
Cloud Security Misconfiguration

⚔️ Red Team: Network & Infrastructure Testing

Tools for scanning networks, identifying services, and exploiting network-based vulnerabilities.

Network Scanning & Enumeration

Nmap
Visit Tool
The Network Mapper, a powerful open-source utility for network discovery and security auditing. Nmap discovers hosts and services on a computer network, creates a map of the network, and identifies open ports, running services, operating systems, and potential vulnerabilities. It is widely used by network administrators and security professionals for inventory, managing service upgrade schedules, and monitoring host or service uptime.
Scanning Enumeration Network Discovery
Masscan
Visit Tool
An extremely fast and lightweight port scanner capable of scanning the entire Internet in under 6 minutes from a single machine. Masscan uses asynchronous transmission to achieve high speeds while maintaining accuracy, making it suitable for large-scale network reconnaissance.
Scanning High-Speed Large Scale
WhatWeb
Visit Tool
A website fingerprinter that identifies web technologies used by sites, including content management systems, blogging platforms, statistics and analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1,800 plugins to recognize different web technologies and can be used to profile websites during the reconnaissance phase of penetration testing.
Web Analysis Fingerprinting Technology Recognition
Httprobe
Visit Tool
A tool designed to check if HTTP/HTTPS servers are responding. Httprobe takes a list of potential URLs and verifies which ones have active HTTP services running, making it ideal for reconnaissance after domain enumeration or port scanning.
Web Security Reconnaissance Service Validation

Password Auditing

John the Ripper
Visit Tool
A powerful and flexible open-source password security auditing tool that is available for multiple operating systems. John the Ripper is designed for detecting weak passwords and employs various password cracking techniques including dictionary attacks, brute force, and hybrid approaches.
Password Cracking Hash Analysis Dictionary Attack
Hashcat
Visit Tool
The world's fastest and most advanced password recovery utility that supports a wide range of hashing algorithms and features. Hashcat is renowned for its GPU acceleration capabilities, making it significantly faster than CPU-based crackers. It supports over 300 different hash types and provides various attack modes including brute-force, dictionary, combination, and rule-based attacks.
Password Cracking GPU Acceleration Hash Recovery
Aircrack-ng
Visit Tool
A complete suite of tools for auditing wireless network security. Aircrack-ng includes tools for monitoring, attacking, testing, and cracking WiFi networks. It can capture packets and export data to text files for further analysis, crack WEP and WPA/WPA2-PSK keys, and includes utilities for injecting frames and replaying captures.
WiFi Security WPA/WPA2 Wireless Testing
Hydra
Visit Tool
A fast and flexible network logon cracker that supports numerous protocols for brute-force attacks against network services. Hydra is capable of performing rapid dictionary and brute-force attacks against more than 50 protocols including FTP, HTTP, HTTPS, SMB, Telnet, SSH, Oracle, and many others.
Brute Force Authentication Network Services

Exploitation & Post-Exploitation

Metasploit
Visit Tool
The world's most widely used penetration testing framework. Metasploit provides information about security vulnerabilities and aids in penetration testing and IDS signature development. It includes tools for exploit development, payload generation, and post-exploitation activities, making it an essential tool for security professionals conducting authorized penetration tests and vulnerability assessments.
Framework Exploitation Penetration Testing
PowerSploit
Visit Tool
A PowerShell exploitation framework that leverages PowerShell's strengths in offensive security. PowerSploit modules help penetration testers and red teamers quickly gain situational awareness, circumvent software restrictions, inject reflective assemblies into memory, and perform post-exploitation tasks.
PowerShell Post-Exploitation
Covenant
Visit Tool
A .NET command and control framework that provides a collaborative interface for red teamers to perform post-exploitation tasks. Covenant aims to support all stages of the attack life cycle and provides a web-based interface for managing implants and executing commands.
C2 Post-Exploitation
Impacket
Visit Tool
A collection of Python classes for working with network protocols. Impacket provides a set of tools for manipulating network protocols and is widely used by security professionals for penetration testing and security assessments. It includes tools for performing various attacks against network protocols and Active Directory environments.
Network Protocols Active Directory

Penetration Testing Frameworks

Comprehensive frameworks for conducting penetration tests and exploiting vulnerabilities.

Metasploit
Visit Tool
The world's most widely used penetration testing framework. Metasploit provides information about security vulnerabilities and aids in penetration testing and IDS signature development. It includes tools for exploit development, payload generation, and post-exploitation activities, making it an essential tool for security professionals conducting authorized penetration tests and vulnerability assessments.
Framework Exploitation Penetration Testing
Metasploitable3
Visit Tool
An intentionally vulnerable Linux virtual machine designed for training and educational purposes in penetration testing and security research. It provides a safe and legal environment to practice security tools and techniques, learn about vulnerabilities, and develop defensive strategies in a controlled setting.
Training Vulnerable Educational

Web Application Testing

Tools for identifying and exploiting web application vulnerabilities.

Scanning & Crawling

Nikto
Visit Tool
An Open Source web server scanner which performs comprehensive tests against web servers for multiple items including dangerous files, outdated server software, and other problems. Nikto combines libwhisker and databases of potentially dangerous files, CGI scripts, and problems with specific server versions. It's widely used by penetration testers and security auditors to identify vulnerabilities in web applications and servers, including checking for over 6700 potentially dangerous files, over 2000 server problems, and more than 1250 cgi scripts.
Web Security Scanning Vulnerability Detection
Nikto Web Scanner
Visit Tool
The open-source web server and CGI scanner that identifies potential security vulnerabilities in web applications and servers. Nikto performs comprehensive tests against web servers for dangerous files, outdated server software, and other problems. It combines libwhisker with databases of potentially dangerous files and CGI scripts to provide a detailed analysis of web application security. The scanner checks for over 6500 potentially dangerous files, 1300 CGI scripts, and over 2000 server problems, making it a valuable tool for security professionals conducting web application security assessments.
Web Security Vulnerability Scanner CGI Testing
BlackWidow
Visit Tool
A Python-based web application scanner that performs OWASP testing, audits form inputs, crawls websites, and identifies potential vulnerabilities through automated analysis. BlackWidow automates the process of finding and testing web application vulnerabilities including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and other common web security issues. It provides detailed reports and helps security researchers efficiently identify potential security exposures in web applications. The tool combines crawling capabilities with security testing to give a comprehensive view of web application security vulnerabilities.
Web Security Crawling OWASP Testing
Nuclei
Visit Tool
A fast and customizable vulnerability scanner based on a simple YAML-based template engine. Nuclei can send requests with predefined templates and detect potential vulnerabilities across various protocols including HTTP, DNS, SSL/TLS, and network services. It's designed to be efficient and fast while maintaining high accuracy in vulnerability detection. The template-based approach allows security professionals to create custom checks for specific vulnerabilities and test for known issues across their infrastructure. Nuclei supports various protocols beyond web applications, making it a versatile tool for comprehensive security assessments.
Vulnerability Scanner Templates Multi-protocol
Katana
Visit Tool
A fast web crawling framework designed to crawl web applications efficiently and discover hidden paths, parameters, and endpoints. Katana extracts links, forms, scripts, headers, and other points of interest from various sources and follows redirect chains to build an accurate map of the application's structure. It's particularly useful for security professionals who need to understand the full scope of a web application before conducting penetration testing or security assessments. The tool specializes in discovering hidden attack surfaces by combining intelligent crawling with parameter analysis and can be customized to fit specific reconnaissance requirements.
Web Security Crawling Reconnaissance

Proxy & Interception

Burp Suite
Visit Tool
An integrated platform for performing security testing of web applications. Burp Suite includes various tools for different aspects of web application testing including interception proxy, scanner, intruder, repeater, and sequencer. It allows security professionals to map out the attack surface of an application, identify vulnerabilities, and exploit them to verify risk. The platform provides a comprehensive set of tools for manual and automated security testing of web applications, making it an essential component of many security professionals' toolkits.
Web Security Proxy Manual Testing
OWASP ZAP
Visit Tool
The world's most widely used web application security scanner, maintained under the Open Web Application Security Project (OWASP). OWASP ZAP is an open-source tool that provides both automated and manual security testing capabilities for web applications. It includes a proxy for intercepting traffic, an automated scanner for identifying vulnerabilities, and various other tools for security testing. ZAP actively crawls web applications, identifies security vulnerabilities, and provides guidance on remediation. It's designed to be used by people with a wide range of security experience to find and fix security vulnerabilities in web applications.
Web Security Open Source Automated Scanning

Specialized Testing

SQLMap
Visit Tool
The premier open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. SQLMap supports various kinds of SQL injection techniques and can bypass many security measures. It provides access to an underlying database management system through the web application's database, taking advantage of insecure SQL query processing. SQLMap can fingerprint the back-end database, enumerate users, password hashes, privileges, roles, databases, tables, and columns. It can also dump entire database tables, execute arbitrary SQL queries, take over the database management system, and access the underlying file system through out-of-band connections.
Database SQL Injection Automated Enumeration
WPScan
Visit Tool
A comprehensive WordPress security scanner that performs black box penetration testing specifically on WordPress installations. WPScan uses a database of known vulnerabilities to detect security issues in WordPress core, themes, and plugins. It can identify WordPress version, enumerate usernames, detect installed plugins and themes, and check them against a database of known vulnerabilities. The tool also identifies common configuration issues and provides detailed information about security weaknesses in WordPress installations. Security professionals use WPScan to assess the security posture of WordPress sites and ensure they are protected against known threats.
Web Security CMS Vulnerability Scanner
Dalfox
Visit Tool
A powerful open-source XSS (Cross-Site Scripting) scanning and parameter analysis tool designed for security professionals. Dalfox performs both passive and active XSS scanning, supports headless browsing, and provides detailed analysis of parameters to identify potential XSS vulnerabilities. It can detect reflected, stored, and DOM-based XSS vulnerabilities, and includes features for parameter analysis, request/response handling, and custom payload injection. Dalfox is designed to be fast and accurate, with support for multiple browsers and various XSS evasion techniques.
Web Security XSS Parameter Analysis
Smuggler
Visit Tool
An HTTP Request Smuggling detection tool specifically designed to identify and exploit HTTP desync vulnerabilities. Smuggler detects various types of HTTP Request Smuggling vulnerabilities including CL.TE, TE.CL, and other desynchronization attacks. The tool is designed to bypass WAFs and other security controls that fail to parse HTTP requests properly. HTTP Request Smuggling can lead to serious security issues including bypassing access controls, web cache poisoning, and gaining unauthorized access to sensitive data. Smuggler helps security professionals identify these complex vulnerabilities.
Web Security HTTP Request Smuggling

Network & Infrastructure Testing

Tools for scanning networks, identifying services, and exploiting network-based vulnerabilities.

Network Scanning & Enumeration

Nmap
Visit Tool
The Network Mapper, a powerful open-source utility for network discovery and security auditing. Nmap discovers hosts and services on a computer network, creates a map of the network, and identifies open ports, running services, operating systems, and potential vulnerabilities. It is widely used by network administrators and security professionals for inventory, managing service upgrade schedules, and monitoring host or service uptime.
Scanning Enumeration Network Discovery
Masscan
Visit Tool
An extremely fast and lightweight port scanner capable of scanning the entire Internet in under 6 minutes from a single machine. Masscan uses asynchronous transmission to achieve high speeds while maintaining accuracy, making it suitable for large-scale network reconnaissance. It supports custom network interfaces, configurable timing, and can output results in various formats for further analysis. Security professionals use Masscan to identify which ports are open across a range of IP addresses, providing valuable information about the attack surface of target networks. The tool can scan at rates exceeding 10 million packets per second, making it ideal for Internet-wide scanning projects.
Scanning High-Speed Large Scale
WhatWeb
Visit Tool
A website fingerprinter that identifies web technologies used by sites, including content management systems, blogging platforms, statistics and analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1,800 plugins to recognize different web technologies and can be used to profile websites during the reconnaissance phase of penetration testing. The tool provides detailed information about web technologies, version numbers, and can help security professionals understand what technologies they're dealing with before beginning an assessment. It includes various plugins for recognizing different technologies and can operate in stealth mode to avoid detection by intrusion detection systems.
Web Analysis Fingerprinting Technology Recognition
Httprobe
Visit Tool
A tool designed to check if HTTP/HTTPS servers are responding. Httprobe takes a list of potential URLs and verifies which ones have active HTTP services running, making it ideal for reconnaissance after domain enumeration or port scanning. The tool is lightweight and efficient, making it excellent for checking large numbers of potential web servers. Httprobe can be seamlessly integrated into larger reconnaissance workflows, helping security professionals focus their efforts on services that are actually accessible before launching more intensive web security assessments. It supports various configuration options for timeouts, redirects, and custom headers to tailor the probing behavior to specific requirements.
Web Security Reconnaissance Service Validation

Password Auditing

John the Ripper
Visit Tool
A powerful and flexible open-source password security auditing tool that is available for multiple operating systems. John the Ripper is designed for detecting weak passwords and employs various password cracking techniques including dictionary attacks, brute force, and hybrid approaches. It supports a wide range of hash formats and can audit password security by attempting to crack password hashes extracted from various systems. The tool has both a robust built-in wordlist and extensive support for custom dictionaries and rule-based attacks, making it highly configurable for specific cracking requirements. Security professionals use John the Ripper to identify weak passwords in their systems as part of security audits and penetration tests.
Password Cracking Hash Analysis Dictionary Attack
Hashcat
Visit Tool
The world's fastest and most advanced password recovery utility that supports a wide range of hashing algorithms and features. Hashcat is renowned for its GPU acceleration capabilities, making it significantly faster than CPU-based crackers. It supports over 300 different hash types including LM hashes, NTLM, MD5, SHA-family, bcrypt, and more complex algorithms. The tool provides various attack modes including brute-force, dictionary, combination, and rule-based attacks. Hashcat also features a distributed cracking capability that allows multiple systems to work together on the same cracking job, making it ideal for large-scale password recovery operations. Security professionals rely on Hashcat for auditing password strength and testing the resilience of authentication systems.
Password Cracking GPU Acceleration Hash Recovery
Aircrack-ng
Visit Tool
A complete suite of tools for auditing wireless network security. Aircrack-ng includes tools for monitoring, attacking, testing, and cracking WiFi networks. It can capture packets and export data to text files for further analysis, crack WEP and WPA/WPA2-PSK keys, and includes utilities for injecting frames and replaying captures. The suite has tools for discovering wireless networks, monitoring traffic, testing password strength, and performing various security assessments on WiFi infrastructure. It supports numerous wireless chipsets and drivers across different operating systems, making it an essential toolkit for wireless security professionals and penetration testers. The tools are particularly effective for evaluating the security of wireless networks and demonstrating potential vulnerabilities.
WiFi Security WPA/WPA2 Wireless Testing
Hydra
Visit Tool
A fast and flexible network logon cracker that supports numerous protocols for brute-force attacks against network services. Hydra is capable of performing rapid dictionary and brute-force attacks against more than 50 protocols including FTP, HTTP, HTTPS, SMB, Telnet, SSH, Oracle, and many others. It's designed to be efficient and customizable, with support for various authentication methods and error handling for different services. Security professionals use Hydra to audit password strength and authentication implementations across network services. The tool allows for custom username and password lists, timeout configuration, and rate limiting to optimize attack effectiveness while avoiding detection. Hydra's modular architecture enables support for new protocols and maintains its status as one of the most widely-used network authentication crackers.
Brute Force Authentication Network Services

Exploitation & Post-Exploitation

Tools for exploiting vulnerabilities and maintaining access after initial compromise.

Exploitation Frameworks

PowerSploit
Visit Tool
A PowerShell Post-Exploitation Framework consisting of a collection of PowerShell modules and scripts that aid in penetration testing and red team operations. PowerSploit enables security professionals to perform various post-exploitation tasks including code execution, persistence, privilege escalation, and data theft using PowerShell. The framework includes modules for PowerShell-based malware development, execution of reflective DLLs, bypassing software restrictions, and performing token manipulation. It provides tools for keylogging, credential theft, file manipulation, and registry interactions, all executed through PowerShell. Security researchers and penetration testers use PowerSploit as part of their offensive security toolset to simulate advanced persistent threats and test organizational defenses. The framework is particularly effective in Windows environments where PowerShell is enabled, allowing for stealthy operations that leverage trusted system components.
PowerShell Post-Exploitation Windows Security

Command & Control (C2)

Empire
Visit Tool
A PowerShell and Python 3 post-exploitation agent that operates over HTTP/S and includes a robust plugin and detection evasion architecture. Empire provides a sophisticated command and control (C2) framework that enables security teams to conduct post-exploitation activities after gaining initial access to systems. The framework features a cross-platform agent that uses AES encryption for command and control communications, PowerShell and Python stagers for initial access, and an extensive library of modules for various post-exploitation tasks. Empire includes modules for credential harvesting, privilege escalation, persistence mechanisms, and lateral movement techniques. It also provides detection evasion capabilities, including obfuscated PowerShell commands, proxy-aware communication, and AMSI bypass techniques. The web-based interface allows operators to manage agents, execute commands, and coordinate complex attack scenarios. Security professionals use Empire for red team exercises, penetration testing, and adversarial simulation to test organizational defenses against advanced persistent threats.
C2 Post-Exploitation Command & Control
Covenant
Visit Tool
A .NET command and control (C2) framework that provides a collaborative interface for red teamers and defenders to perform post-exploitation activities. Covenant is designed as an ASP.NET-based web application that offers a web-based interface for managing implants and executing commands during penetration testing and red team operations. The framework includes features for creating implants in multiple languages (C#, PowerShell, and Python), defining listeners for different communication protocols, and executing post-exploitation tasks through a user-friendly dashboard. It provides built-in payloads and activities for common exploitation tasks, including PowerShell implant functionality, shellcode execution, and various lateral movement techniques. Covenant also offers integration with other offensive security tools and frameworks. The platform aims to support all stages of the attack lifecycle and provides a collaborative environment for offensive security teams to coordinate their operations. Security professionals use Covenant to simulate advanced attack scenarios and test their organization's ability to detect and respond to C2 communications.
C2 .NET Command & Control

Active Directory & Network Protocols

Certify
Visit Tool
A .NET tool designed for Active Directory Certificate Services (ADCS) enumeration and abuse. Certify helps security professionals identify misconfigured certificate templates that could be exploited for privilege escalation in Active Directory environments. The tool enumerates certificate authorities, certificate templates, and enrollment permissions to identify templates that may be vulnerable to abuse. It can identify certificate templates that allow for authentication certificate requests based on user attributes, potentially allowing an attacker to request certificates for other users, including domain admins. Certify also provides checks for specific ADCS attacks like ESC1 (misconfigured certificate templates) and ESC8 (misconfigured PKI certificate templates) vulnerabilities. During enumeration, Certify identifies certificate authorities, lists available templates, checks which principals have enrollment permissions, and determines if authentication certificates can be requested for other users. This tool is essential for both red teamers looking to exploit ADCS misconfigurations and blue teamers assessing the security of their certificate infrastructure.
Active Directory Certification ADCS
Impacket
Visit Tool
A collection of Python classes for working with network protocols that provides both lower layer access and high-level protocol implementations. Impacket is essential for security professionals performing penetration tests and security assessments on networks, as it enables direct interaction with various network protocols including SMB, DCE/RPC, MS-DCERPC, Windows Authenticated (NTLMv1/v2/LMv2), Kerberos, LDAP, and other related services. The framework includes command-line tools for common attacks against these protocols, such as secretsdump for extracting secrets from remote machines, smbexec for executing commands via SMB, wmiexec for WMI-based command execution, and ticketer for creating Kerberos tickets. Impacket is widely used for implementing and testing security vulnerabilities related to network protocols, particularly in Active Directory environments. Key tools include GetNPUsers for identifying users with Kerberos pre-authentication disabled, GetUserSPNs for requesting TGS tickets against users with SPNs set, and ntlmrelayx for NTLM relay attacks. Impacket is invaluable for security professionals looking to assess the security of network protocols and Active Directory authentication mechanisms, providing both offensive and defensive capabilities for security testing.
Network Protocols Active Directory Authentication

🔐 General Security Tools

Tools that apply to both offensive and defensive operations, including forensics, cryptography, and infrastructure security.

Digital Forensics

Tools for collecting, preserving, and analyzing digital evidence.

Disk & File Analysis

Sleuth Kit
Visit Tool
A comprehensive digital forensics toolkit that provides command-line tools for analyzing disks and file systems. The Sleuth Kit includes utilities for performing post-mortem analysis on disk images and live systems. It features 'fls' for listing file system information, 'ils' for listing inode information, 'icat' for printing file contents, and 'dls' for listing deleted files. The toolkit supports multiple file systems including NTFS, Ext2/3/4, FAT, and HFS+, making it invaluable for forensic investigators. The Sleuth Kit is widely used by law enforcement, military, and corporate investigators to analyze disk drives and recover evidence, supporting everything from basic file system analysis to complex data recovery operations.
Forensics Disk Analysis
Autopsy
Visit Tool
A powerful graphical digital forensics platform that enables investigators to easily analyze disk images and perform in-depth analysis of computer systems. Autopsy provides a user-friendly interface built on top of The Sleuth Kit, offering advanced features such as keyword searching, file carving, web artifact analysis, and timeline analysis. The platform supports multiple file systems and provides tools for analyzing email, web history, registry data, and other artifacts critical to forensic investigations. Autopsy allows examiners to examine the entire file system, recover deleted files, view file metadata, and identify suspicious activity. It's widely used by law enforcement, military, and corporate investigators to process evidence and support legal proceedings with detailed forensic reports.
Forensics GUI
SIFT Workstation
Visit Tool
A comprehensive digital forensics and incident response platform that provides an arsenal of tools for investigators to analyze evidence in a forensically sound manner. The SIFT (SANS Investigative Forensic Toolkit) Workstation combines hundreds of tools from SANS into a Ubuntu-based distribution that offers a complete forensic environment. It includes all of the command-line tools from The Sleuth Kit, plus additional analysis tools, timeline utilities, and network forensics capabilities. The platform supports various file systems and provides utilities for analyzing memory dumps, network captures, and disk images. The SIFT Workstation is regularly updated with the latest forensic tools and techniques, and is designed to support advanced forensic methodologies and processes. It's widely used by security professionals for incident response, forensic analysis, and digital investigations in both government and corporate environments.
Forensics Workstation
FileSec
Visit Tool
A comprehensive portal for file security and analysis resources that provides information about file-based threats, analysis techniques, and security best practices. FileSec offers educational content, analysis tools, and resources for understanding various file formats and potential security risks associated with different file types. The site provides guidance on how to securely handle files, identify potentially malicious file types, and understand common attack vectors using files. Security professionals use FileSec as a reference for understanding file security challenges, learning about new file-based attack techniques, and accessing tools and resources for analyzing suspicious files in security investigations.
File Analysis Security

Memory Analysis

Volatility
Visit Tool
An advanced memory analysis framework for incident response and digital forensics. Volatility allows security professionals to examine RAM dumps from computers to identify malicious activity, recover deleted data, and analyze system state during security incidents. It supports multiple operating systems and provides detailed insights into process execution, network connections, and artifacts that exist only in memory.
Memory Forensics RAM Incident Response

Cryptography & Certificates

Tools for testing cryptographic implementations, certificate validation, and encryption.

SSL Labs SSL Test
Visit Tool
A free online service that performs comprehensive analysis of the SSL/TLS configuration of any web server. The tool examines certificate validity, protocol support, cipher suites, handshake procedures, and potential vulnerabilities. It provides detailed reports with grades and recommendations to help administrators improve their SSL/TLS security posture.
SSL/TLS Testing Certificate Analysis
Certificate Transparency Log
Visit Tool
A public repository of certificates collected from publicly trusted Certificate Authorities (CAs) around the world. Certificate transparency logs enable security researchers and organizations to monitor certificate issuance, identify misissued certificates, and detect potential phishing attempts. The service allows users to search for certificates by domain, email, hash, or other identifiers, providing valuable reconnaissance data for security professionals investigating potential security incidents or suspicious certificates.
SSL/TLS Reconnaissance Certificate Analysis
OpenSSL
Visit Tool
A robust, commercial-grade, full-featured open-source toolkit implementing the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols, as well as a full-strength general-purpose cryptography library. OpenSSL provides essential cryptographic functions including symmetric encryption, asymmetric encryption, hashing algorithms, and digital signatures. It's widely used for creating and verifying certificates, encrypting communications, and implementing secure protocols in applications and web servers.
Cryptography CLI SSL/TLS
Keybase
Visit Tool
A security company that provides an open-source client for end-to-end encryption that makes it easier to use public-key cryptography. Keybase connects social identities to cryptographic keys in a public directory, enabling secure messaging, encrypted file sharing, and team collaboration. It provides a user-friendly interface for PGP encryption, making advanced cryptographic tools accessible to everyday users while maintaining enterprise-grade security capabilities.
Cryptography Key Management Encryption

DevSecOps & Infrastructure Security

Tools for integrating security into development processes and infrastructure.

Container & Infrastructure Security

Trivy
Visit Tool
A comprehensive security scanner designed to find vulnerabilities in container images, file systems, and infrastructure as code. Trivy is known for its simplicity, speed, and accuracy. It can scan Docker images, container registries, and file systems to identify security issues including OS packages, application dependencies, and misconfigurations in infrastructure code.
Container Security Vulnerability Scanner DevSecOps
Anchore Engine
Visit Tool
An open-source platform for container image analysis and evaluation. Anchore Engine provides deep inspection of container images for vulnerabilities, software composition analysis, and policy compliance checking. It integrates with CI/CD pipelines to enforce security policies before deployment, analyzes container images for known CVEs, examines package contents, and evaluates container configurations against security best practices. Organizations use Anchore to achieve secure supply chain management and shift-left security implementation.
Container Security Policy Engine Image Analysis
Cartography
Visit Tool
An open-source Python-based tool that consolidates infrastructure data from multiple sources into a graph model for security analysis and visualization. Cartography specializes in pulling data from cloud providers (AWS, GCP, Azure) and other infrastructure services, creating a unified graph that enables security teams to understand relationships between assets, identify potential security risks, and visualize complex infrastructure interdependencies. It helps security teams identify overly permissive access patterns, unencrypted storage, exposed resources, and other security misconfigurations across their infrastructure.
IaC Visualization Cloud Security

CI/CD Security

secureCodeBox
Visit Tool
A lightweight, scalable, and flexible scanning framework specifically designed for continuous security testing in CI/CD pipelines. secureCodeBox provides a Kubernetes-native approach to security scanning, allowing organizations to integrate security checks seamlessly into their development workflows. It supports multiple security scanning tools and orchestrates them in a unified framework, enabling automated security testing that doesn't slow down the development process. The platform enables security teams to define security scanning policies and automatically execute them as part of the software delivery lifecycle.
CI/CD Automation Security Orchestration
SAST Scan
Visit Tool
A comprehensive multi-language Static Application Security Testing (SAST) tool that combines multiple scanning engines to identify security vulnerabilities in source code. SAST Scan supports numerous programming languages and frameworks, helping development teams identify security flaws early in the development lifecycle. The tool aggregates results from various security scanners, normalizes findings, and presents them in a unified format. It integrates seamlessly with CI/CD pipelines and provides actionable remediation guidance to help developers fix security issues before they reach production.
SAST Static Analysis Code Scanning

Cloud Security

Tools for securing cloud infrastructure and identifying misconfigurations in cloud environments.

Cloud Configuration & Compliance

BLESS
Visit Tool
An SSH Certificate Authority that runs as an AWS Lambda function, providing a secure and auditable way to grant SSH access to AWS EC2 instances. BLESS allows authorized users to obtain time-limited SSH certificates without requiring a bastion host or manual key distribution. The system integrates with AWS Identity and Access Management (IAM) for authentication and implements security controls to ensure SSH access is properly managed, logged, and audited. It's designed to solve the challenge of secure access to AWS resources while maintaining auditability and reducing the risk of compromised SSH keys.
AWS SSH Access Management
Repokid
Visit Tool
An AWS tool that implements the principle of least privilege by automatically identifying and removing excessive permissions from IAM roles. Repokid continuously monitors IAM roles and gradually removes unused permissions based on CloudTrail logs, ensuring that roles have only the minimum permissions necessary for operations. The tool helps organizations reduce their attack surface by minimizing the potential impact of compromised credentials. It provides a systematic approach to implementing least privilege access in dynamic environments where IAM roles frequently accumulate unnecessary permissions over time.
AWS IAM Least Privilege
PacBot
Visit Tool
Policy as Code Bot, an open-source platform for continuous compliance monitoring and security automation in AWS environments. PacBot continuously evaluates AWS resources against security policies, identifies misconfigurations, and provides remediation workflows. The platform helps organizations maintain compliance standards by automatically monitoring cloud infrastructure, detecting violations in real-time, and ensuring that security policies are enforced consistently across all AWS accounts. It provides dashboards and reporting capabilities to help security teams understand their compliance posture.
AWS Compliance Policy Enforcement

Cloud Security Testing

Pacu
Visit Tool
An open-source AWS exploitation framework designed to assist penetration testers and security professionals in evaluating the security posture of AWS environments. Pacu provides various modules for enumerating and exploiting AWS services, allowing red teams to identify misconfigurations, escalate privileges, and pivot within cloud environments. The framework includes modules for attacking IAM, EC2, S3, Lambda, and other AWS services. It maintains session information, allows persistence across engagement phases, and provides detailed documentation for each attack module. Pacu helps security teams understand how attackers might exploit AWS misconfigurations and guides them in implementing proper security measures.
AWS Exploitation Cloud Security
GCPloit
Visit Tool
A Google Cloud Platform (GCP) exploitation framework that provides security professionals with tools to assess the security of GCP environments. GCPloit contains modules for enumerating and exploiting various GCP services, including Compute Engine, Storage, BigQuery, and IAM. The framework enables penetration testers to identify misconfigured resources, escalating privileges, and performing lateral movement within GCP projects. It helps red teams understand potential attack vectors in cloud environments and assists blue teams in securing their cloud infrastructure against real-world attacks.
GCP Exploitation Cloud Security
Cartography
Visit Tool
An open-source Python-based tool that consolidates infrastructure data from multiple cloud providers (AWS, GCP, Azure) and other infrastructure services into a unified graph model for security analysis and visualization. Cartography enables security teams to understand relationships between assets, identify potential security risks, and visualize complex infrastructure interdependencies. It helps identify overly permissive access patterns, unencrypted storage, exposed resources, and other security misconfigurations across multi-cloud environments. The tool creates a centralized view of the infrastructure landscape to aid in security auditing and compliance verification.
AWS GCP Azure