Nmap

Network scanning, discovery, and security auditing tool.

IP-Lookup.org

IP lookup tool for finding geolocation, ISP, ASN, hostname, and other IP details.

Quttera Website Security API

API for malware detection, reputation checks, and website security analysis.

Securewp Online Scanner

Online WordPress security scanner for vulnerability discovery, website profiling, malware and compromise detection, including exposed files, outdated software, and security misconfigurations without requiring installation.

Tuta Mail

Privacy-focused, end-to-end encrypted email service for secure communication.

Nessus

Vulnerability assessment and security scanning platform.

Impreza Host

Privacy-focused hosting provider offering anonymous VPS and dedicated servers for security-conscious users and cybersecurity infrastructure.

BloodHound

Active Directory attack path and privilege relationship analysis tool.

Ghidra

Reverse engineering and binary analysis framework.

IP Geolocation

IP geolocation and threat intelligence API for identifying accurate IP locations, Company, ASN, VPN/proxy/Tor usage, and potential IP security signals. Ideal for OSINT, network reconnaissance, and cybersecurity investigations.

WhoisFreaks

Comprehensive domain WHOIS, historical WHOIS, and DNS intelligence API for tracking domain ownership records, registration timelines, nameservers, and registrar details. Ideal for brand protection, threat intelligence, domain research, and cybercrime investigations.

APIFreaks

A robust, high-performance API hub delivering 100+ real-time APIs across 20+ categories-including IP intelligence, domain lookups, email validation, timezone data, live weather, commodity pricing, PDF generation, web screenshots, and exchange rates. Built for enterprise scalability and developer…

IP-Lookup.org

IP lookup tool for finding geolocation, ISP, ASN, hostname, and other IP details.

Osintly

All-in-one OSINT platform combining hundreds of search modules, investigation tools, public data sources, intelligence APIs, and collaborative workspaces in a single place.

OnionLand Search

Onionland Search is a deep-web search engine that indexes Tor onion services.

OSINT Search

OSINTsearch is a live OSINT search engine. Find matching profiles, former usernames and traces of deleted accounts where sources return them.

DAEMON Intelligence

OSINT and private intelligence services for investigations, background checks, digital footprint analysis, and risk assessment.

IPLocation.net

IP geolocation lookup service for finding the location, ISP, and other details associated with IP addresses.

WhiteIntel

WhiteIntel is a dark web monitoring service that helps organizations monitor exposed data, credentials, and other potential threats across the dark web.

ViewDNS.info

Comprehensive suite of Domain and IP Intelligence tools for domain research.

IP2Location.io

IP geolocation and IP intelligence API for retrieving location, network, and other information associated with IP addresses.

Nmap

Network scanning, discovery, and security auditing tool.

ipapi.is

IP intelligence and geolocation service for identifying IP addresses, locations, ISPs, hosting providers, and VPN or proxy connections.

ProxyDetect.live

Proxy detection service for checking IP addresses and identifying potential proxies, VPNs, and other anonymization services.

OSINTNova

OSINTNova finds public information linked to usernames, emails, phone numbers, and more. It combines automated searches and AI-assisted reporting in one platform.

Check-Host

Network monitoring and diagnostic tool for checking host availability, connectivity, ping, HTTP, TCP, and DNS from multiple locations.

Dato Capital

Business intelligence platform providing company information, corporate data, and business insights.

Kismet

Wireless network detector, sniffer, and intrusion detection.

urlcap

HTTP capture and analysis API for inspecting requests and responses, extracting structured web data, and detecting bots and crawlers.

Maltego

OSINT and data mining tool for information analysis.

theHarvester

Tool to gather emails, subdomains, hosts, and more.

Recon-ng

Full-featured web reconnaissance framework.

SpiderFoot

Automate OSINT collection from multiple sources.

Amass

Network mapping and external asset discovery tool.

Sublist3r

Subdomain enumeration using search engines.

Assetfinder

Subdomain discovery using various sources.

crt.sh

SSL certificate transparency log search engine.

Dnsrecon

Perform DNS enumeration and zone transfers.

Fierce

DNS reconnaissance and attack tool.

WHOIS

Domain registration and ownership lookup.

CC.LA

Free WHOIS/RDAP lookup, DNS records, name server history, IP WHOIS, SSL certificate search, and network diagnostics.

EmailHarvester

Email enumeration and gathering.

Shodan

Search engine for internet-connected devices.

Netlas

Internet intelligence platform for discovering internet-connected assets, analyzing domains and IP addresses, and identifying exposed services.

Censys

Search engine for hosts and networks on the internet.

OSINT Framework

Collection of OSINT tools and resources.

FOCA

Metadata extraction and document analysis.

Netcraft

Website profiling and phishing detection.

BuiltWith

Website technology lookup and analysis.

StackScan

Website technology lookup and asset footprint search.

Ahmia

Tor-recommended dark web search engine that filters illegal content and is accessible via both clearnet and Tor.

Torch

One of the oldest Tor search engines, indexing millions of .onion pages with no content filtering.

Excavator

Unfiltered search engine indexing Tor and I2P with a free public API.

Not Evil

Well-known unfiltered .onion search engine, often listed alongside Ahmia and Torch.

SpiderFoot

Automate OSINT collection from multiple sources.

Blackbird

OSINT tool for searching emails, usernames, and keywords across the dark web and clearnet.

Maltego

OSINT and data mining tool for information analysis.

darkweb-directory

Curated .onion resource list categorized by news, forums, whistleblowing platforms, and search engines.

onion-links

Curated list of Tor services for researchers and privacy users, with NSFW tagging and safety review.

Dark-Net-Collection

Dark web resource collection including Dread forum, Hidden Wiki, and official Tor Project .onion links.

VoidAccess

Self-hosted dark web OSINT platform that turns research queries into structured threat intelligence with STIX/MISP/Sigma/YARA export.

reconCTI

Python CLI tool for searching sensitive data leaks on clearnet and dark web, mapping to MITRE ATT&CK and generating threat reports.

ULTRON

Privacy-centric dark web reconnaissance framework with multi-engine search, directory fuzzing, metadata scraping, and CSV/JSON/PDF export.

Darkweb-search-engine (NexvisionLab)

Open-source dark web search engine and crawler with 14 content categories, entity extraction, safety ratings, and ransomware tracking.

osint-toolbox-mcp

OSINT toolbox MCP server integrating Sherlock, Maigret, GHunt, theHarvester, and SpiderFoot.

osint-mcp

OSINT aggregation MCP service supporting email, username, phone, Shodan, VirusTotal, and leak detection.

awesome-osint-repos

Continuously updated directory of OSINT tools, skills, plugins, and agent integrations.

osint-darkweb-pkg

Modular dark web OSINT tool aggregating 15+ dark web search engines with concurrent .onion content scraping.

SecretFinding

Dark web search tool (visit repository for full details).

Sherlock

Hunt down social media accounts by username across 400+ social networks.

Maigret

Collect a dossier on a person by username across thousands of sites, with rich report generation.

theHarvester

Tool to gather emails, subdomains, hosts, and more.

Recon-ng

Full-featured web reconnaissance framework.

Shodan

Search engine for internet-connected devices.

Spoof Me

Chrome/Firefox extension that switches the browser identity of a research profile (user agent, language, timezone, screen size) and flags pages that read fingerprinting signals.

MISP

Open-source threat intelligence sharing platform used by 6,000+ organizations worldwide, supporting STIX, TAXII, OpenIOC, and automated SIEM/IDS exports.

OpenCTI

Knowledge-graph-based CTI platform that connects indicators, actors, campaigns, and techniques in a searchable intelligence graph, with built-in STIX 2.1 and TAXII 2 support.

IntelOwl

Open-source enrichment and analysis platform that automates queries across a broad range of threat intelligence sources for IOC investigation.

Yeti

CTI-DFIR investigation platform that builds richer intelligence from indicators, entities, and context, deployed via Docker with MongoDB and Redis.

ThreatBus

Dissemination layer that distributes threat intelligence efficiently between security systems, not a full TIP but useful as an integration layer alongside MISP or OpenCTI.

IntelMQ

Pipeline-based threat intelligence processing framework by CERT.at with collector, parser, expert, and output bots, using a harmonized data model covering 100+ fields.

ThreatDeck

Tracks threat intelligence feeds and surfaces meaningful changes quickly, focused on alerting on feed updates.

AlienVault OTX

Free community-driven threat intelligence platform with 100,000+ participants, offering curated IOC feeds and OpenIOC compatibility.

ThreatFox

Free community IOC platform by abuse.ch for searching domains, IPs, and file hashes against a constantly updated database of known malware infrastructure.

IBM X-Force Exchange

Free community threat intelligence research platform (the paid IBM SaaS upgrade was withdrawn and divested to Palo Alto Networks in 2024), offering malware reverse engineering and dark web research insights.

Google Threat Intelligence

Combines Google’s internet-scale telemetry with Mandiant frontline research and VirusTotal community data, with agentic AI for automated detection rule creation and malware reverse engineering.

CrowdStrike Falcon Adversary Intelligence

Blends machine-scale telemetry with human expertise from reverse engineers and threat collectors, offering high-fidelity reporting and production-grade connectors for SIEM/SOAR/XDR.

Recorded Future

Broad correlated view across technical, dark web, and open source data, widely used in enterprise CTI programs for threat actor tracking and campaign analysis.

KELA

Specialized deep underground visibility platform monitoring criminal forums, ransomware leak sites, and botnet logs, with automated adversarial testing for GenAI tools via AiFort.

Flare

Cloud-based, agentless Threat Exposure Management platform with identity-centric intelligence from dark web forums, Telegram channels, and breach repositories.

Feedly Threat Intelligence

AI-OSINT aggregation layer with Leo AI that reads 10,000+ curated sources, extracts IOCs structurally, tags ATT&CK techniques, and exports to Navigator, with an MCP Server for AI-assisted CTI automation.

VirusTotal

Community-driven malware and IOC reputation service that serves as a data source for many TIPs and enrichment platforms.

Shodan

Search engine for internet-connected devices.

theHarvester

Tool to gather emails, subdomains, hosts, and more.

Maltego

OSINT and data mining tool for information analysis.

SpiderFoot

Automate OSINT collection from multiple sources.

awesome-threat-intelligence

Curated list of threat intelligence resources, feeds, frameworks, and tools maintained by the community.

threat-intel (GitHub)

Real-time threat intelligence aggregation and visualization platform with IOC tracking, threat actor profiling, Elasticsearch/Kibana dashboards, and automated alert generation from MISP, OTX, VirusTotal, and Shodan.

ICHI – Internet Cyber Health Index

Free, source-transparent daily barometer of internet-wide cyber health. Aggregates 28+ live threat intel feeds (CISA KEV, EPSS, ransomware trackers, C2 infrastructure, DShield) into a composite hourly score for situational awareness. No signup required.

Aircrack-ng

Complete suite for auditing Wi-Fi security, covering monitoring, attacking, testing, and cracking WEP and WPA/WPA2-PSK keys.

Kismet

Wireless network detector, sniffer, and intrusion detection.

Wifite2

Automated wireless auditor that simplifies the process of attacking WEP, WPA, and WPS networks with minimal user interaction.

Reaver

Implements a brute-force attack against Wi-Fi Protected Setup (WPS) registrar PINs to recover WPA/WPA2 passphrases.

Pixiewps

Offline WPS PIN brute-force utility exploiting low entropy in vulnerable implementations via the Pixie Dust attack.

Fern WiFi Cracker

Python/Qt-based GUI for wireless security auditing and attack, capable of cracking WEP/WPA/WPS keys.

Bettercap

All-in-one framework for Wi-Fi, BLE, HID, and Ethernet reconnaissance and MITM attacks, including PMKID association and handshake capture.

hcxdumptool

Small tool for capturing packets from WLAN devices, specifically designed for PMKID and handshake collection for Hashcat.

hcxtools

Converts packet captures into hash files for cracking with Hashcat or John the Ripper, essential for modern WPA/WPA2 auditing.

EAPHammer

Targeted evil twin attacks against WPA2-Enterprise networks, supporting hostile portal and credential capture.

Fluxion

Social-engineering focused Wi-Fi attack tool that creates rogue access points and captive portals to harvest credentials.

Airgeddon

Multi-use bash script for Linux systems to audit wireless networks, with a comprehensive menu-driven interface.

MDK4

Wi-Fi testing tool designed to exploit common protocol weaknesses, including deauthentication and beacon flooding.

Wifiphisher

Rogue access point framework for automated Wi-Fi phishing attacks, capturing credentials via fake captive portals.

Wireshark

Network protocol analyzer that can be used to inspect 802.11 frames and understand wireless traffic during assessments.

HackRF One

Open-source Software Defined Radio (SDR) platform for wireless experimentation, including capturing and transmitting signals across a wide frequency range.

FuzzyDoo

Open-source framework for finding flaws in the 5G landscape, enabling dynamic test message generation for encrypted communications and supporting extensible protocol integration for 5G core networks.

SigPloit

Telecom signaling exploitation framework covering SS7, GTP, Diameter, and SIP protocols for testing mobile operator interconnects.

Rodan

Telecom signaling exploitation framework by Etisalat Egypt Research Labs with SS7 and Diameter support, featuring location tracking, call/SMS interception, and fraud testing capabilities.

SWITCHSNIPER

Comprehensive signaling security testing framework for telecom switches and core network systems, covering SS7, GTP, Diameter, and SIP protocols across 2G through 5G networks.

5G Houl

Fuzzing tool that discovers vulnerabilities in 5G NR implementations, capable of misleading UEs into connecting to malicious base stations and causing connection drops or device freezes.

CovFUZZ

Coverage-based fuzzer for 4G and 5G protocols, providing automated testing for Attach procedure implementations with uplink and downlink fuzzing capabilities.

MNSF

Mobile Network Security Framework providing open-source security testing for 2G through 5G networks using SDR and telecom stacks, with modules for SIM swap, interception, and authentication bypass testing.

SigFW

Open-source signaling firewall for SS7 and Diameter filtering with anti-spoofing and anti-sniffing capabilities.

Open5GS

Open-source project for emulating 4G and 5G core network functions, widely used as a test environment for security research and fuzzing.

UERANSIM

Open-source 5G UE and RAN simulator, commonly used for fuzzing NAS and RRC protocols in telecom security research.

srsRAN

Open-source 4G and 5G software radio suite used for building man-in-the-middle fuzz models and testing cellular protocol implementations.

asnfuzzgen

ASN.1-based fuzzing tool for Radio Resource Control protocol in 4G and 5G networks, generating syntactically correct payloads according to ASN.1 specifications.

5Greplay

NGAP fuzzing tool used for testing 5G core network AMF implementations, applied to Open5GS, free5GC, OAI, and ella-core.

Scapy PFCP Module

Python-based packet manipulation library with PFCP module used for fuzzing 5G N4 interface communications between SMF and UPF.

TLS-Scanner

Open-source tool for analyzing TLS configurations in 5G core networks, checking for vulnerabilities like Padding Oracle, Bleichenbacher, POODLE, and DROWN.

SSLyze

Fast SSL/TLS configuration analyzer for scanning 5G core network TLS implementations, detecting CCS Injection, Heartbleed, and ROBOT vulnerabilities.

HackRF One

Open-source Software Defined Radio (SDR) platform for wireless experimentation, including capturing and transmitting signals across a wide frequency range.

USRP B210

Software Defined Radio hardware used in over-the-air baseband exploitation research and 5G security testing setups.

Awesome Cellular Hacking

Curated list of cellular security research, tools, papers, and resources covering 2G through 5G, baseband hacking, IMSI catchers, and satellite-cellular integration.

Don't Look Up

Open-source Python research tool for decoding DVB-S2 satellite data transponders, enabling evaluation of satellite IP link security and revealing unencrypted traffic on geostationary communications satellites.

GSExtract

Python application for extracting IP traffic from DVB-S2 satellite streams, predecessor to Don't Look Up with narrower scope but foundational for satellite security research.

Universal Radio Hacker (URH)

Complete suite for wireless protocol investigation with native SDR support, offering demodulation, automatic modulation parameter detection, protocol reverse-engineering, and fuzzing components for stateless and stateful attacks.

GQRX

Software defined radio receiver built on GNU Radio and Qt, supporting HackRF, RTL-SDR, Airspy, BladeRF, USRP and other hardware for AM/FM/SSB reception and FFT spectrum analysis.

Inspectrum

Offline spectrum analysis tool with spectrogram visualization, zoom and pan capabilities for examining captured RF signals including Iridium, LTE, WiFi, and satellite captures.

GNU Radio

Free and open-source signal processing framework providing blocks for modulation, demodulation, filtering, and spectrum analysis, with graphical flowgraph composition via GNU Radio Companion.

HackRF One

Open-source Software Defined Radio (SDR) platform for wireless experimentation, including capturing and transmitting signals across a wide frequency range.

RTL-SDR

Budget-friendly SDR receiver based on the RTL2832U chipset, widely used for satellite signal reception including NOAA weather satellites, amateur radio satellites, and ISS SSTV transmissions.

SatDump

Satellite image decoding software supporting a wide range of weather and Earth observation satellites for processing received RF signals into usable imagery.

WXtoImg

NOAA weather satellite image decoding software that processes APT signals received via SDR to generate weather imagery with map overlays and ground station location configuration.

Gpredict

Real-time satellite tracking and orbit prediction software for identifying satellite passes over ground station locations and accounting for Doppler shift during signal reception.

Orbitron

Satellite tracking software for predicting passes of NOAA, GOES, amateur radio, and other satellites, essential for planning reception windows and antenna pointing.

SatNOGS DB

Open database of satellite frequencies, modulations, and operational status maintained by the SatNOGS community for planning satellite signal reception.

ESA Cybersecurity Laboratory

European Space Agency facility providing end-to-end security assessment for space systems, including RF physical layer security testing, CCSDS/ECSS protocol assessment, SDLS toolkit, and hardware hacking testbeds with side-channel attack capabilities.

SigFW

Open-source signaling firewall for SS7 and Diameter filtering with anti-spoofing and anti-sniffing capabilities.

TBS5927

USB DVB-S2 satellite receiver used with RAW data handling patches for capturing satellite transponder data for security research and IP traffic extraction.

HackRF and RTL-SDR Satellite Scanning Guide

Step-by-step guide covering hardware selection, software setup, satellite frequency tracking, signal reception, and decoding for weather, amateur radio, and communications satellites.

HTB SATCOM Security Essentials

Hands-on CTF pack covering orbital mechanics, RF signal analysis, CCSDS protocols, DVB-S2 demodulation, satellite firmware reverse engineering, and ground station compromise.

Wireshark

Network protocol analyzer that can be used to inspect 802.11 frames and understand wireless traffic during assessments.

Zeek

Powerful network analysis framework that produces high-fidelity transaction logs and supports deep protocol analysis for security monitoring.

Suricata

High-performance Network IDS, IPS, and NSM engine using multi-threading for real-time threat detection and deep packet inspection.

Snort

Classic signature-based intrusion detection system widely used for real-time traffic analysis and packet logging.

Nmap

Network scanning, discovery, and security auditing tool.

Masscan

Ultra-fast TCP port scanner capable of scanning the entire Internet in under 6 minutes using asynchronous transmission.

Scapy PFCP Module

Python-based packet manipulation library with PFCP module used for fuzzing 5G N4 interface communications between SMF and UPF.

Fail2Ban

Lightweight intrusion prevention tool that scans log files and bans IPs showing malicious behavior via firewall rules.

CrowdSec

Collaborative behavior detection engine with a community-driven blocklist for blocking aggressive IPs across the network.

IVRE

Self-hosted network recon framework for building your own Shodan/Censys alternative, using Nmap, Masscan, and Zeek.

masscanned

Low-interaction honeypot focused on network scanners and bots, integrating with IVRE for self-hosted threat intelligence.

TorPylle

Python/Scapy implementation of the Tor protocol for network security research and protocol analysis.

Netmoth

Lightweight traffic analysis and intrusion detection solution with eBPF support and automatic TCP stream reassembly.

Maltrail

Malicious traffic detection system using publicly available blocklists and custom blacklists.

Security Onion

Free and open platform for threat hunting, enterprise security monitoring, and log management, bundling Suricata, Zeek, and Elasticsearch.

NetworkMiner

Network forensic analysis tool for extracting artifacts from PCAP files including files, credentials, and images.

Malcolm

Powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts, Zeek logs, and Suricata alerts.

Artillery

Blue team tool designed to protect Linux and Windows systems through multiple defensive methods.

Wireshark

Network protocol analyzer that can be used to inspect 802.11 frames and understand wireless traffic during assessments.

Ettercap

Man-in-the-middle attack tool.

Bettercap

All-in-one framework for Wi-Fi, BLE, HID, and Ethernet reconnaissance and MITM attacks, including PMKID association and handshake capture.

Tcpdump

Command-line packet analyzer.

Nessus

Vulnerability assessment and security scanning platform.

Scapy PFCP Module

Python-based packet manipulation library with PFCP module used for fuzzing 5G N4 interface communications between SMF and UPF.

MITMf

Man-in-the-middle framework for network attacks.

Fakenet-NG

Fake network traffic generation tool.

Dsniff

Collection of network monitoring tools for penetration testers.

Responder

LLMNR, NBT-NS, and MDNS poisoner for internal network attacks.

Ettercap-NG

Enhanced version of Ettercap with additional features.

Arp-Spoof

Tool to intercept network traffic by sending ARP packets.

WiFi-Pumpkin

WiFi spoofing tool.

Aircrack-ng

Complete suite for auditing Wi-Fi security, covering monitoring, attacking, testing, and cracking WEP and WPA/WPA2-PSK keys.

Xplico

Network forensics tool that extracts applications' data from pcap files.

Pry-Fi

A tool to find and exploit vulnerabilities in wireless networks.

Kismet

Wireless network detector, sniffer, and intrusion detection.

Snoopy

Sniffing & spoofing tool focused on DNS & HTTP traffic.

Snort

Classic signature-based intrusion detection system widely used for real-time traffic analysis and packet logging.

SmartScanner

An AI-driven web vulnerability assessment tool designed to automate security scanning for websites, APIs, and web applications.

VulnWatch

A cybersecurity platform dedicated to tracking vulnerabilities, monitoring emerging security threats, and providing valuable insights to help security researchers and organizations stay ahead of potential risks.

OpenVAS

Open-source vulnerability scanner.

Nessus

Vulnerability assessment and security scanning platform.

Nikto

Web server scanner for detecting vulnerabilities.

Wapiti

Web application security scanner.

Vega

GUI-based web vulnerability scanner.

Arachni

Feature-rich web application security scanner.

SQLmap

Automated SQL injection detection and exploitation tool.

OWASP ZAP

Open-source web application security scanner.

Nmap Vulners

Nmap NSE script for CVE detection.

Retire.js

JavaScript library vulnerability scanner.

BugBoard

Bug hunter dashboard for vulnerability scanning, automation, and managing bug bounty workflows.

Dependency-Check

Vulnerability analysis for project dependencies.

Bandit

Security linter for Python code.

Vuls

Agentless vulnerability scanner for Linux/FreeBSD servers.

Trivy

Vulnerability scanner for containers and dependencies.

Grype

Vulnerability scanner for container images and filesystems.

Safety

Python dependency security scanner.

Lychee

Broken link checker with vulnerability detection potential.

GitLeaks

Detect hardcoded secrets and sensitive data.

ScoutSuite

Multi-cloud security auditing tool.

CloudSploit

AWS security auditing tool.

WebSentry

Website security scanner for detecting misconfigurations, analyzing SSL/TLS, security headers, CSP, CORS, DNS, and vulnerable JavaScript libraries, with actionable security insights.

Securewp Online Scanner

Online WordPress security scanner for vulnerability discovery, website profiling, malware and compromise detection, including exposed files, outdated software, and security misconfigurations without requiring installation.

OWASP ZAP

Open-source web application security scanner.

SQLmap

Automated SQL injection detection and exploitation tool.

Quttera Website Security API

API for malware detection, reputation checks, and website security analysis.

Wappalyzer

Identify technologies on websites.

Vulnify

Web application security scanner for identifying vulnerabilities, security misconfigurations, and OWASP Top 10 risks with actionable security insights.

Dirb

Web content scanner.

Gobuster

Directory and DNS brute-forcing.

Nikto

Web server vulnerability scanner.

Sublist3r

Subdomain enumeration using search engines.

Amass

Network mapping and subdomain enumeration.

Httpx

Fast HTTP probing.

FFUF

Fast web fuzzer.

WhatWeb

Identify web technologies.

Nuclei

Vulnerability scanning and templating.

XSStrike

XSS detection and exploitation.

Commix

Automated command injection.

WPScan

WordPress security scanner.

Cmsmap

CMS detection and exploitation.

Arachni

Feature-rich web application security scanner.

Waybackurls

Fetch URLs from Wayback Machine.

Unfurl

Extract URLs and data from URLs.

Dirsearch

A fast and powerful scanner that uses brute-force to find hidden directories and files on web servers. It discovers inaccessible content with customizable wordlists.

MobSF

Automated all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis, and security assessment framework capable of static and dynamic analysis, open source under GPL-3.0.

Frida

Industry-standard dynamic instrumentation toolkit for injecting scripts into native apps, enabling runtime hooking, tracing, SSL pinning bypass, and root/jailbreak detection bypass on both Android and iOS.

Objection

Frida-powered runtime mobile exploration toolkit providing SSL pinning bypass, filesystem/keychain access, and method hooking without requiring jailbreak/root for basic operations.

Jadx

Dex-to-Java decompiler and the current de facto standard for reading Android bytecode as readable Java source, with GUI support for code navigation.

Apktool

Decompiles and rebuilds APK resources and Smali code, essential for repackaging, resource-level edits, and security patching of Android applications.

Drozer

Leading security assessment framework for Android, specifically designed for exploiting inter-process communication (IPC) surfaces including exported activities, content providers, and broadcast receivers.

Grapefruit

Open-source runtime mobile instrumentation toolkit powered by Frida, offering a web-based interface for inspecting, hooking, and modifying iOS and Android apps with features like Keychain access, class inspection, and privacy monitoring.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

Androguard

Powerful reverse engineering and static analysis library for Android, integrating well with custom tooling and automation pipelines.

FlowDroid

Precise, context/flow/field/object-sensitive taint analysis framework for Android apps, used for detecting data leakage and injection vulnerabilities.

APKLeaks

Scans APK files for URIs, endpoints, and hardcoded secrets, useful for quickly extracting API keys and internal URLs from compiled Android applications.

Corellium

Virtualized iOS and Android device platform providing root-level access, instrumentation, and tools for mobile penetration testing, vulnerability research, and malware analysis without physical hardware.

mobile-security-mcp

MCP (Model Context Protocol) server that transforms AI agents into Android security researchers by providing automated access to apktool, jadx, Frida, Objection, and RASP bypass generation.

Nazar

Open-source autonomous security and quality scanner supporting React Native, Flutter, and native mobile projects, with 197+ tests covering OWASP Mobile Top 10, secret detection, and store compliance.

Pithus

Open-source APK analyzer with YARA rule hunting capabilities for malware detection and threat intelligence on Android applications.

Oversecured

Agentic offensive security platform for mobile apps with static analysis covering 175+ Android and 85+ iOS vulnerability types, providing proof of concept for each DAST finding.

blutter

Flutter application reverse engineering tool that extracts Dart code and function signatures from snapshot files (libapp.so) in compiled Flutter apps.

hermes-dec

Decompiler for Hermes bytecode (.hbc files) used in React Native apps, converting bytecode back to readable JavaScript.

Prowler

The world's most widely used open-source cloud security platform, automating security and compliance across AWS, Azure, GCP, Kubernetes, and SaaS providers with thousands of ready-to-use checks and AI-driven monitoring.

ScoutSuite

Multi-cloud security auditing tool.

CloudSploit

AWS security auditing tool.

Pacu

Open-source AWS exploitation framework designed for offensive security testing, allowing penetration testers to exploit configuration flaws within AWS accounts using modular attack modules including privilege escalation, IAM backdooring, and Lambda attacks.

CloudGoat

Rhino Security Labs' "Vulnerable by Design" cloud deployment tool providing CTF-style scenarios in AWS and Azure for exploring environments, identifying vulnerabilities, and practicing exploitation in a safe training context.

Steampipe

Zero-ETL tool for querying cloud APIs and services using SQL, with 2000+ tables across AWS, Azure, GCP, Kubernetes, GitHub, and 100+ other plugins for real-time cloud data access and compliance scanning.

Checkov

Static code analysis tool for scanning Infrastructure as Code (IaC) files for misconfigurations, with 750+ predefined policies covering Terraform, CloudFormation, Kubernetes, Docker, and Helm charts, plus CIS and AWS Foundations Benchmark compliance.

Cloudsplaining

AWS IAM security assessment tool that identifies violations of least privilege in IAM policies and generates HTML reports, detecting risks including data exfiltration, infrastructure modification, resource exposure, and privilege escalation.

Wiz

Agentless cloud security platform that continuously analyzes configurations, vulnerabilities, networks, IAM settings, and secrets across AWS, Azure, and GCP to discover critical issues representing actual risk, with integration into AWS Security Hub.

Microsoft Defender for Cloud

Cloud-native application protection platform (CNAPP) that combines CSPM, DevOps security, and cloud workload protection to identify vulnerabilities, misconfigurations, and threats across hybrid and multicloud environments.

Tenable Cloud Security

Identity-intelligent cloud security platform exposing and closing security gaps caused by misconfigurations, risky entitlements, and vulnerabilities, pinpointing toxic combinations of risk with guided remediations and code snippets.

Orca Security

Agentless cloud security and compliance platform providing asset inventory, vulnerability management, threat detection, and risk assessment across public cloud environments.

InsightCloudSec

Continuous security and compliance monitoring across public cloud environments with automated discovery, policy enforcement, and real-time risk identification for cloud infrastructure.

Trivy

Vulnerability scanner for containers and dependencies.

Kubescape

CNCF incubating project providing comprehensive Kubernetes security from development to runtime, with misconfiguration scanning against NSA-CISA, MITRE ATT&CK, and CIS Benchmarks, image vulnerability scanning via Grype, auto-remediation, admission control, and eBPF-based runtime monitoring.

Grype

Vulnerability scanner for container images and filesystems.

Falco

CNCF graduated runtime security standard originally created by Sysdig, monitoring syscalls and Kubernetes audit events in real time using eBPF to detect suspicious behaviors like shells spawned inside containers, privileged container creation, and unexpected outbound connections.

Tetragon

eBPF-based runtime security tool from Isovalent (now part of Cilium) that enforces policy in-kernel with near-zero overhead, capable of blocking malicious processes outright rather than just alerting on them.

Tracee

Aqua Security's runtime security tool focusing on forensics and behavioral signature detection, including rootkit and container-escape pattern detection using eBPF.

Kube-bench

Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark, identifying configuration weaknesses in cluster components.

Kube-hunter

Penetration testing tool that hunts for security weaknesses in Kubernetes clusters by discovering and exploiting misconfigurations from an attacker's perspective.

Open Policy Agent (OPA)

Policy engine that streamlines policy application across microservices, Kubernetes, CI/CD processes, and API gateways, allowing policies to be specified as code using Rego for admission control and workload validation.

Calico

Open-source networking solution and network policy engine for containers that operates at layer three, using BGP for packet routing and extending Kubernetes NetworkPolicy API with more granular control over traffic flow.

Istio

Open-source service mesh for Kubernetes providing traffic control, security, monitoring, and policy enforcement through sidecar proxies (Envoy) that intercept and manage all incoming and outgoing service traffic.

KubeXHunt

Kubernetes post-compromise security assessment tool that maps attack paths from pod to cloud account compromise, with 16 phases covering reconnaissance, RBAC enumeration, network scanning, container escape, and cloud metadata access.

CDK

Zero-dependency container penetration toolkit designed for stable exploitation in slimmed containers without OS dependencies, featuring container escape PoCs for capabilities like CAP_DAC_READ_SEARCH and CAP_SYS_MODULE.

Kimera

Kubernetes security validation platform from Dynatrace that tests whether security controls actually block attacks, with 40 techniques mapped to MITRE ATT&CK for Containers and support for MCP server integration with AI agents.

Jacked

Vulnerability scanner for Docker images, code repositories, and tarballs using CycloneDX SBOM internally, with severity threshold configuration for CI/CD pipeline gating and multiple output formats including SPDX and JSON.

Kubeaudit

Audit tool for Kubernetes clusters detecting misconfigurations and non-compliance with best practices, tailored for Red Hat OpenShift with extensible custom audits and NetworkPolicy analysis.

NodeAgent

Kubescape's runtime security agent using eBPF and Inspektor Gadget for process execution monitoring, file integrity checking, network tracing, SBOM generation, and CEL-based detection rules for threats like crypto mining and container escapes.

SLSA (Supply-chain Levels for Software Artifacts)

A security framework led by the Open Source Security Foundation (OpenSSF) that provides a checklist of standards and controls to prevent tampering, improve integrity, and secure packages across the software supply chain. SLSA v1.2, approved in November 2025, introduced a complete Source Track…

Sigstore

An open-source project for improving software supply chain security that empowers developers to securely sign and verify software artifacts using ephemeral keys, eliminating the need for long-lived key management. Sigstore combines Cosign (signing client), Fulcio (certificate authority bound to…

in-toto

A CNCF-graduated framework developed at NYU Tandon that protects the integrity of the software supply chain by verifying each task in the chain is carried out as planned, by authorized personnel only, and that the product is not tampered with in transit. in-toto uses signed layouts and link…

CycloneDX

An OWASP-led Software Bill of Materials (SBOM) standard that is lightweight and well-suited for expressing component relationships and vulnerability data. CycloneDX is the recommended choice for security-response-focused supply chain programs, with mature tooling ecosystem support and integration…

SPDX

A Linux Foundation-maintained SBOM standard that emphasizes license compliance expression, making it popular in regulatory and compliance-focused scenarios. Both SPDX and CycloneDX support JSON and XML formats, and organizations can produce both in parallel depending on their primary focus.

Ampel

A lightweight supply chain policy engine designed to be embedded across the software development lifecycle, verifying unforgeable metadata captured in signed attestations. Ampel works with in-toto attestations and Sigstore bundles, supports SLSA provenance and SBOM gating, and allows policies to…

Chainloop

An open-source evidence store for software supply chain attestations, SBOMs, VEX, SARIF, and QA reports. Chainloop provides a SLSA Level 3 compliant single source of truth built on open standards (Sigstore, in-toto, SLSA, OCI), with declarative Workflow Contracts that let Security teams define…

OpenSSF Scorecard

An automated tool from the Open Source Security Foundation that assesses repositories against a set of security heuristics and assigns each check a score from 0 to 10. Scorecard evaluates Branch-Protection, Code-Review, Dangerous-Workflow, Token-Permissions, Pinned-Dependencies, Vulnerabilities,…

Macaron

An open-source framework presented at IEEE that enhances software supply chain security by detecting malicious code and providing comprehensive insights into the construction and provenance of software artifacts. Macaron leverages static analysis to extract metadata from open-source packages,…

GardWatch

A CLI tool that analyzes dependencies for trust, security risks, and quality signals across PyPI, npm, Go, Cargo, Maven, and NuGet. GardWatch uses a composite trust scoring engine (0-100) that factors in malware detection, package age and maturity, download popularity, OpenSSF Scorecard…

Chainmail

A unified open-source workbench for software supply chain security that brings eight capabilities together in one place. Chainmail introduces a Multi-Dimensional Supply Chain Risk Score (SCRS), a graph-theoretic License Conflict Propagation (LCP) framework, and Automated VEX Generation using…

Dependency-Check

Vulnerability analysis for project dependencies.

GitLeaks

Detect hardcoded secrets and sensitive data.

Trivy

Vulnerability scanner for containers and dependencies.

Grype

Vulnerability scanner for container images and filesystems.

Syft

A CLI tool and library for generating Software Bills of Materials (SBOMs) from container images and filesystems, supporting CycloneDX and SPDX formats.

John the Ripper

Password cracking tool for various password hashes.

Arp-Spoof

Tool to intercept network traffic by sending ARP packets.

Hashcat

Advanced password recovery using GPUs.

Medusa

A speedy, parallelized login brute-forcer.

Aircrack-ng

Complete suite for auditing Wi-Fi security, covering monitoring, attacking, testing, and cracking WEP and WPA/WPA2-PSK keys.

Wifite2

Automated wireless auditor that simplifies the process of attacking WEP, WPA, and WPS networks with minimal user interaction.

Hash-Toolkit

A tool for password hash cracking.

Brutus

An old but reliable password cracker for HTTP, FTP, and more.

Ophcrack

A Windows password cracker using rainbow tables.

Cain & Abel

A versatile tool for cracking various password hashes, sniffing networks, and decoding passwords.

L0phtCrack

Windows password auditing and recovery tool.

CrackStation

A free online service for cracking password hashes using dictionary attacks.

RainbowCrack

A tool that utilizes rainbow tables to crack passwords.

Patator

A multi-purpose brute-forcing tool that supports numerous protocols.

RSMangler

A hash bruteforce tool for creating password dictionaries.

CrackMapExec

A post-exploitation tool for automating credential validation.

SudoKiller

A tool for privilege escalation that can be used for password cracking in Unix-based systems.

SET (Social-Engineer Toolkit)

Advanced framework for social engineering attacks.

King Phisher

Phishing campaign toolkit for testing and training.

Phishing Frenzy

Phishing campaign automation platform.

Gophish

Open-source phishing toolkit for awareness and testing.

Evilginx2

Phishing toolkit using reverse proxy for capturing credentials & tokens.

HiddenEye

Modern phishing tool with advanced social engineering features.

BlackEye

Phishing tool with site cloning capabilities.

Zphisher

Advanced phishing tool with tunneling support.

SocialFish

Social engineering phishing framework.

HiddenEye Reborn

Improved version of HiddenEye for phishing & spoofing.

EvilPhish

Social engineering tool for phishing websites.

ShellPhish

Automated phishing tool supporting multiple templates.

CamPhish

Webcam phishing attack tool.

Weeman

HTTP server-based phishing framework.

QRGen

QR code phishing generator.

PyPhisher

Python-based phishing toolkit with multiple site templates.

AdvPhishing

Advanced phishing tool with login page cloning.

SocialBox

Brute-force social media hacking toolkit.

XPhisher

Advanced phishing tool with inbuilt tunneling.

CredSniper

Phishing framework with two-factor authentication bypass support.

Metasploit Framework

Powerful exploit development and penetration testing framework.

Armitage

GUI front-end for Metasploit to visualize attacks.

BeEF (Browser Exploitation Framework)

Exploits browser vulnerabilities for client-side attacks.

ExploitDB

Archive of public exploits and proof-of-concept code.

SearchSploit

Offline version of ExploitDB for quick exploit searching.

SQLmap

Automated SQL injection detection and exploitation tool.

Commix

Automated command injection.

RouterSploit

Exploits vulnerabilities in routers, IoT, and embedded devices.

SET (Social-Engineer Toolkit)

Advanced framework for social engineering attacks.

Empire

Post-exploitation framework for PowerShell agents.

Pupy

Cross-platform post-exploitation remote access tool (RAT).

Sliver

C2 framework for adversary simulation and red teaming.

Merlin

Post-exploitation command & control server using HTTP/2.

Covenant

C#-based post-exploitation platform.

PowerSploit

PowerShell scripts for post-exploitation.

Windows Exploit Suggester

Suggests exploits based on Windows OS versions.

PayloadsAllTheThings

Collection of payloads for exploits, fuzzing, and pentesting.

Fuzzbunch

NSA’s exploit framework (part of the Shadow Brokers leak).

CrackMapExec

A post-exploitation tool for automating credential validation.

pwntools

CTF framework and exploit development library providing cyclic pattern generation, ELF parsing, ROP chain building, tube I/O, and assembly/disassembly utilities.

pwndbg

GDB and LLDB plugin that makes exploit development and reverse engineering easier with commands like checksec, vmmap, search-pattern, and telescope for stack inspection.

ROPgadget

Searches binaries for ROP gadgets to facilitate return-oriented programming exploitation across ELF, PE, and Mach-O formats.

ropper

Displays information about files and finds gadgets for building ROP chains across multiple architectures including x86/x86_64 and ARM.

one_gadget

Finds magic gadgets in libc that spawn a shell with minimal constraints, enabling quick RCE without building full ROP chains.

checksec

Inspects binary protection mechanisms including RELRO, Stack Canary, NX, PIE, RPATH, RUNPATH, and FORTIFY.

angr

Powerful binary analysis platform supporting symbolic execution, concolic testing, and automated vulnerability discovery.

how2heap

Repository for learning various heap exploitation techniques with educational examples covering tcache, fastbin, unsortedbin, and house-of attacks.

libc-database

Builds a database of libc offsets to simplify identification of libc versions from leaked addresses during exploitation.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

VulnHub Binary Exploitation Repos

Curated collection of vulnerable binaries, CVE walkthroughs, and exploitation notes covering stack smashing, SEH chains, egghunters, and x86/x64 differences.

Binary Exploitation Writeups

CTF-focused collection covering buffer overflow, ret2libc, ROP chains, format strings, and shellcode injection with full exploit code and educational walkthroughs.

picoCTF Binary Exploitation Roadmap

Structured learning path from foundations (assembly, gdb, pwntools) through stack smashing, mitigations, ROP, and heap exploitation.

CTF Tools

Setup scripts for security research tools commonly used in binary exploitation and CTF competitions.

LearnPwn

Sample problems and solutions for learning binary exploitation with progressive difficulty.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

Radare2

Command-line reverse engineering toolkit.

OllyDbg

32-bit assembler-level debugger for Windows.

IDA Pro

Industry-standard interactive disassembler.

Binary Ninja

Interactive binary analysis platform.

x64dbg

Open-source Windows debugger for x64 and x86.

Cutter

GUI for Radare2 with advanced analysis features.

Hopper

Mac & Linux disassembler with powerful analysis.

dnSpy

.NET debugger and assembly editor.

RetDec

Open-source decompiler for machine code.

angr

Python framework for binary analysis.

Frida

Industry-standard dynamic instrumentation toolkit for injecting scripts into native apps, enabling runtime hooking, tracing, SSL pinning bypass, and root/jailbreak detection bypass on both Android and iOS.

Binary Analysis Toolkit (BAT)

Malware analysis and binary inspection.

Rizin

Fork of Radare2 with a focus on usability.

PEiD

Detect packers, cryptors, and compilers.

DiE (Detect It Easy)

Portable executable identifier.

LIEF

Library for parsing and modifying executables.

Snowman

Native code to C++ decompiler.

Apktool

Decompiles and rebuilds APK resources and Smali code, essential for repackaging, resource-level edits, and security patching of Android applications.

JEB Decompiler

Commercial decompiler for Android and other platforms.

ChipWhisperer

Complete open-source toolchain for side-channel power analysis and voltage/clock glitching attacks on embedded devices, used widely in academia and industry as a baseline for implementation security testing.

ChipSHOUTER

Electromagnetic fault injection (EMFI) platform from NewAE Technology for disrupting chip execution and bypassing security checks.

JTAGulator

Open-source hardware tool by Joe Grand for automatically discovering JTAG and UART pin assignments on unknown PCBs by brute-forcing all pin permutations, eliminating manual tracing.

Bus Pirate

Universal serial interface tool supporting UART, I2C, SPI, and JTAG protocols for communicating with embedded chips and dumping firmware.

Flashrom

Utility for detecting, reading, writing, verifying, and erasing flash chips, supporting in-system programming via CH341A and other SPI programmers.

binwalk

Powerful firmware analysis tool for scanning binary images, identifying embedded filesystems, compressed archives, and executables, with extraction and entropy analysis capabilities.

OpenOCD

Open On-Chip Debugger providing JTAG and SWD debugging, programming, and boundary scan testing for embedded targets.

Saleae Logic

Professional logic analyzer for capturing and analyzing digital signals on embedded devices, essential for protocol decoding and hardware debugging.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

CH341A Programmer

Low-cost USB-based EEPROM/SPI flash programmer commonly used with SOIC8 clips for dumping NOR flash chips on routers and IoT devices.

Segger J-Link

Professional JTAG and SWD debug probe, more robust than Bus Pirate or Shikra for advanced debugging scenarios.

Dediprog SF100

High-speed SPI Flash programmer for rapid firmware dumping and programming.

Ubertooth One

Open-source Bluetooth monitoring and experimentation platform, useful for wireless protocol reverse engineering.

JTAGenum

Arduino-compatible JTAG pin scanning tool for enumerating instruction registers and discovering undocumented instructions.

Flipper Zero

Portable multi-tool for pentesters and geeks, supporting Sub-GHz RF, RFID/NFC, Infrared, BadUSB, and GPIO, all in a pocket-sized device.

Lilygo T-Embed CC1101 Plus

ESP32-based Flipper Zero alternative with WiFi/Bluetooth/BLE, IR, RFID, SubGHz (CC1101), and nRF24L01 for raw 2.4 GHz communications, supported by the Bruce firmware.

Bus Pirate 6

The “Swiss Army knife” of hardware hacking, now RP2350-based with dual ARM M33 cores, LCD for pin labels/voltage/current, and support for UART, I2C, SPI, JTAG, and more.

ChipWhisperer

Complete open-source toolchain for side-channel power analysis and voltage/clock glitching attacks on embedded devices.

ChipSHOUTER

Electromagnetic fault injection (EMFI) platform from NewAE Technology for disrupting chip execution and bypassing security checks.

JTAGulator

Open-source hardware tool by Joe Grand for automatically discovering JTAG and UART pin assignments on unknown PCBs by brute-forcing all pin permutations, eliminating manual tracing.

Flashrom

Utility for detecting, reading, writing, verifying, and erasing flash chips, supporting in-system programming via CH341A and other SPI programmers.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

HackRF One

Open-source Software Defined Radio (SDR) platform for wireless experimentation, including capturing and transmitting signals across a wide frequency range.

Ubertooth One

Open-source Bluetooth monitoring and experimentation platform, useful for wireless protocol reverse engineering.

Proxmark3

RFID/NFC research tool for reading, cloning, and emulating access cards and other RFID-based systems.

USB Rubber Ducky

HID-based keystroke injection tool disguised as a USB flash drive for automated payload delivery.

Fing Desktop

Network security assessment tool providing full device inventory in under two minutes, with built-in open port scanning and automated router vulnerability checks for IoT environments.

Firewalla

Network security appliance and app that discovers vulnerable IoT devices, detects Mirai virus infections, and provides IPS sensors for blocking public scanners and known threat actors.

FirmAE

Automated firmware emulation platform that boots extracted Linux-based IoT firmware in QEMU for dynamic testing, enabling runtime vulnerability discovery without physical hardware.

Firmwalker

Automated sensitive information search tool for extracted firmware filesystems, scanning for credentials, certificates, and configuration secrets.

binwalk

Powerful firmware analysis tool for scanning binary images, identifying embedded filesystems, compressed archives, and executables, with extraction and entropy analysis capabilities.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

Boofuzz

Network protocol fuzzing framework for discovering memory corruption vulnerabilities in embedded services and daemons.

AFL

American Fuzzy Lop coverage-guided fuzzer used for embedded binary fuzzing to uncover crashes and exploitable conditions in IoT firmware.

Bus Pirate 6

The “Swiss Army knife” of hardware hacking, now RP2350-based with dual ARM M33 cores, LCD for pin labels/voltage/current, and support for UART, I2C, SPI, JTAG, and more.

CH341A Programmer

Low-cost USB-based EEPROM/SPI flash programmer commonly used with SOIC8 clips for dumping NOR flash chips on routers and IoT devices.

KillerBee

Zigbee security testing framework for capturing and analyzing Zigbee traffic, testing replay attacks, and checking key exchange security.

Ubertooth One

Open-source Bluetooth monitoring and experimentation platform, useful for wireless protocol reverse engineering.

nRF Connect

BLE enumeration and testing tool for discovering services and characteristics, testing for unauthorized read/write access.

HackRF One

Open-source Software Defined Radio (SDR) platform for wireless experimentation, including capturing and transmitting signals across a wide frequency range.

ApiMote

Dedicated Zigbee security testing hardware for advanced Zigbee 3.0 penetration testing and vulnerability discovery.

IoT Auditor

Machine learning-based IoT detection system using ping sweep with Random Forest and Isolation Forest algorithms, correlating with 37,928 manufacturers and 9,832 CVEs for automated vulnerability classification.

Nokia Anomaly Detection Pipeline

ML-based IoT anomaly detection tool that fingerprints normal device sensor behavior and reports deviations in near-real-time, validated in smart manufacturing use cases.

mitmproxy

Interactive HTTPS proxy used for inspecting IoT device traffic and testing privacy and security of ultrasonic scanners and other connected devices.

Cooja Simulator

Contiki OS network simulator for emulating IoT device behavior in resource-constrained environments and implementing attack scenarios.

PureEdgeSim

Simulation tool for edge and IoT computing environments, used for evaluating security models and attack scenarios.

picocom

Minimal serial communication tool used for UART console access to embedded devices, extracting device IDs and boot logs at 115200 baud.

mosquitto_sub

MQTT client for subscribing to IoT device topics, used for testing MQTT broker authentication and topic ACL enforcement.

JTAGulator

Open-source hardware tool by Joe Grand for automatically discovering JTAG and UART pin assignments on unknown PCBs by brute-forcing all pin permutations, eliminating manual tracing.

Firmadyne

Automated firmware emulation platform for Linux-based IoT devices, enabling dynamic analysis of extracted firmware in QEMU.

LinPEAS

Privilege escalation enumeration script run against extracted IoT filesystems to identify misconfigurations and security weaknesses.

S3Scanner

Cloud storage scanner for identifying exposed S3 buckets containing IoT firmware or configuration data.

Apktool

Decompiles and rebuilds APK resources and Smali code, essential for repackaging, resource-level edits, and security patching of Android applications.

checksec

Inspects binary protection mechanisms including RELRO, Stack Canary, NX, PIE, RPATH, RUNPATH, and FORTIFY.

QEMU

Emulation platform used with qemu-mips and qemu-mipsel for running extracted embedded binaries in controlled environments for dynamic analysis.

CANToolz

Modular CAN bus analysis framework using a pipe system to chain modules for ECU discovery, Man-in-the-Middle testing, fuzzing, brute-forcing, and scanning in black-box automotive security assessments.

Caring Caribou

Zero-knowledge CAN bus exploration tool that can be dropped onto any automotive network to discover services, dump traffic, fuzz messages, and enumerate UDS diagnostic services across ECUs.

can-utils

Essential SocketCAN userspace utilities suite including candump for traffic capture, cansend for frame injection, cangen for fuzzing, and canplayer for replay attacks against CAN networks.

CANable / CANtact

Low-cost USB-to-CAN hardware adapters that provide SocketCAN-compatible interfaces for Linux-based automotive security testing, supporting both monitoring and message injection.

HydraLink

Compact USB 3.0 to Automotive Ethernet (100BASE-T1 and 1000BASE-T1) interface designed for security researchers, enabling wire-speed packet forwarding, Man-in-the-Middle bridging, and SOME/IP fuzzing with full open-source driver support.

AEVisionLab

Comprehensive Automotive Ethernet test platform using commercial off-the-shelf ECUs that enables sniffing, interception, injection, and fuzzing of AE protocols including SOME/IP and PTP across realistic vehicle network topologies.

NetHunter CARsenal

Kali NetHunter's automotive security toolset for Android devices, bundling CAN interface configuration, VIN decoding, can-utils, Caring Caribou, ICSim/UDSim simulators, and Metasploit automotive modules.

oCANada

Generation-based CAN fuzzer that leverages DBC database files to craft syntactically correct messages for ECU fuzzing, incorporating state-of-the-art CAN reverse engineering techniques for black-box environments.

UnlockECU

Free, open-source ECU seed-key unlocking tool designed to bypass security access mechanisms on automotive electronic control units for diagnostic and research purposes.

Flipper Zero

Portable multi-tool for pentesters and geeks, supporting Sub-GHz RF, RFID/NFC, Infrared, BadUSB, and GPIO, all in a pocket-sized device.

BladeRF / HackRF SDR

Software Defined Radio platforms used for GNSS/GPS spoofing attacks against vehicle navigation systems, capable of generating counterfeit GPS signals that can force vehicles to a halt by mimicking signal loss conditions.

BlueToolkit

Extensible Bluetooth Classic vulnerability testing framework that catalogs known automotive Bluetooth vulnerabilities including BLURTooth, KNOB, and BLESA attacks affecting infotainment and telematics systems.

ICSim (Instrument Cluster Simulator)

CAN bus simulator that emulates a vehicle instrument cluster for safe, legal testing of CAN injection, replay, and reverse engineering techniques without requiring physical vehicle access.

canbus-toolbox

Curated collection of automotive security resources, papers, and tools maintained by the security community, covering CAN bus analysis, ECU exploitation, and vehicle penetration testing methodologies.

Project TEMPA v2

Research toolkit and offensive tools for testing Tesla's Phone-as-a-Key BLE protocol, including VINTAG for recovering Vehicle Identification Numbers from BLE advertisements without pairing.

IndustrialXPL-Forge (IXF)

The world's largest OT/ICS/SCADA security assessment and exploitation framework, Python-first with 976+ modules covering 50+ vendors and 50 protocols, supporting the complete attack lifecycle (OSINT → Discovery → Fingerprint → Vulnerability Check → Exploit → Report) with MITRE ATT&CK for ICS 93%…

GRASSMARLIN

NSA-released passive ICS/SCADA network situational awareness tool that safely discovers, inventories, and maps industrial control network topologies, supporting both logical and physical views with built-in fingerprint database and GeoIP capabilities for device identification and traffic analysis.

PyPLCploit

Vendor-agnostic PLC exploitation and vulnerability discovery framework supporting cross-vendor PLC interaction (Delta, Allen-Bradley, Siemens) with validated physical process disruption capabilities on real CPS testbeds, contributing to CVE-2025-62578 disclosure.

plcscan

Tool for enumerating Siemens S7 PLCs, supporting device discovery via TCP/IP or LLC networks, serving as a foundational tool for ICS network asset identification.

OT/ICS Security Auditor

Python-based security assessment toolkit for OT/ICS/SCADA and IoT devices, featuring a dark amber GUI, 20+ industrial protocol probes (Modbus, S7comm, DNP3, IEC 60870-5-104, OPC UA, EtherNet/IP, BACnet/IP), concurrent scanning, risk scoring, and multi-format export with IEC 62443 and NIST SP…

ModbusPal

Modbus slave simulator for creating virtual Modbus devices for security testing, protocol learning, and attack validation, supporting register and coil configuration with real-time interaction.

S.I.D.E. (SCADA Intrusion Detection Environment)

Next-generation IDS designed for ICS/SCADA networks, monitoring SCADA devices, detecting network anomalies, and providing real-time alerts with support for Modbus/TCP, SNAP7, and OPC-UA protocols using rule matching, Z-Score, and machine learning-based detection.

Protofire

Modular OT/ICS protocol fuzzer with plugin support for Modbus/TCP, DNP3, S7comm, IEC 60870-5-104, and OPC UA, featuring PCAP replay, anomaly detection, and MITRE ICS ATT&CK mapping for red team experiments and industrial protocol research.

Zeek S7comm Plugin

Zeek network security monitoring platform's S7 protocol parsing plugin (maintained by AWS) for deep analysis and logging of S7 traffic.

ICS-Pentesting-Tools

Curated list of industrial control system security and penetration testing tools covering asset discovery, protocol analysis, exploitation, and reporting tools.

s7comm_security_framework

Siemens S7comm security assessment framework supporting PLC information extraction, firmware version identification, program upload, and MITRE ATT&CK mapping.

Shodan / Censys

Internet-connected ICS device OSINT search engines for discovering publicly exposed industrial control assets and conducting external reconnaissance.

OpenPLC

Open-source PLC runtime and simulator used for building low-cost OT security labs, enabling Modbus protocol attack practice and ladder logic visualization on commodity hardware.

PyModbus

Python Modbus library used for simulating industrial environments and crafting custom protocol packets for ICS security testing and fuzzing.

GRFICSv3

Free and open-source OT security lab with realistic networking and 3D process simulation, featuring PLCs, HMIs, engineering workstations, Kali Linux attacker tools, MITRE Caldera, Suricata IDS, and optional Wazuh SIEM for comprehensive ICS security training.

Cheat Engine

The industry-standard memory scanner and editor for game hacking, featuring value scanning, pointer scanning, code injection, Lua scripting, and a comprehensive auto-assembler for patching game logic at runtime.

x64dbg

Open-source binary debugger for Windows with a comprehensive plugin system, widely used for game reverse engineering and analyzing obfuscated game executables without source code.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

ReClass.NET

More than a port of ReClass to the .NET platform, providing a memory scanner, structure dissect tool, and a plugin ecosystem for visualizing game data structures and pointer chains.

dnSpyEx

Unofficial continuation of dnSpy for debugging and editing .NET and Unity assemblies, enabling game hacking without source code via C# decompilation, IL editing, and live assembly modification.

Frida Game Hacking MCP

Model Context Protocol server that transforms AI agents into game hacking assistants using Frida for memory operations, function hooking, code injection, and Cheat Engine-style value scanning workflows.

cheat-engine-linux

Native C++/Qt6 reimplementation of Cheat Engine for Linux, delivering ~2x faster first scans than the official native Linux build and 30-40x faster than scanmem, with a Mono/Unity dissector and Cheat Engine-compatible Lua API.

scanmem

Linux memory scanner used for Cheat Engine-style value scanning, allowing game state manipulation via interactive commands like scan, narrow, and set to locate and modify health, score, or currency values.

ps5dbg-scanner

Cross-platform "Cheat Engine for PS5" built on the ps5dbg library, supporting value scanning, freeze/edit operations, and server-resident turbo scanning for jailbroken PlayStation 5 consoles.

ReClass.NET-MCP

MCP integration for ReClass.NET that exposes memory read/write, class/node management, and process inspection to AI coding assistants for automated game memory analysis.

Coldfire

Golang malware development library providing a rich set of functions for process manipulation, network operations, privilege checking, and evasion primitives, enabling rapid development of offensive tooling in Go.

Rust for Malware Development

Repository focused on advanced Red Team techniques and offensive malware & ransomware written in Rust, covering shellcode runners, process injection, and evasion methods.

awesome-malware-development

Curated collection of the best resources for malware development, rootkits, implants, evasion, and red-team tooling, continuously updated with modern topics from 2025-2026.

Donut

Position-independent shellcode generator and in-memory payload injector that converts executables, .NET assemblies, and scripts into encrypted shellcode for fileless execution.

Sliver

C2 framework for adversary simulation and red teaming.

Havoc

Modern, malleable C2 framework with a beautiful GUI, designed for post-exploitation and red team operations with advanced evasion capabilities.

ScareCrow

Payload creation framework focused on EDR bypass, using code signing, AES encryption, and multiple execution techniques to evade modern endpoint detection.

BYOB (Build Your Own Botnet)

Post-exploitation framework and C2 platform that generates cross-platform encrypted binaries with multi-stage delivery chains and reverse shell capabilities.

OffensiveNim

Red teaming framework and post-exploitation toolkit in Nim, featuring API unhooking, direct syscalls, anti-debugging, and multiple shellcode injection techniques.

SharpSploit

.NET post-exploitation library written in C# that highlights the attack surface of .NET and simplifies offensive .NET operations for red teamers.

ScareCrow

Payload toolkit using suspended processes and direct syscalls for EDR evasion, generating loaders that execute payloads without touching disk.

Phantom-Evasion

Security research framework for generating obfuscated payloads and automating post-exploitation tasks, with memory-resident execution, junk code injection, and payload encryption.

Veil-Evasion

Framework for generating custom executable files to test defensive systems, using template-based source injection and modular build systems for cross-platform payload generation.

PEzor

Open-source packer for executable files designed to evade antivirus detection through obfuscation and encryption.

Tradecraft Garden

Development environment by Raphael Mudge (Cobalt Strike creator) that simplifies shellcode and Position Independent Code (PIC) creation using C and Makefiles, with Crystal Palace linker for automatic API hashing.

DarkArmour

Windows antivirus evasion tool that stores and executes an encrypted Windows binary entirely from memory without writing to disk.

Shhhloader

Shellcode loader that compiles a C++ stub performing multiple AV/EDR bypass techniques, with a Python builder for Linux-based cross-compilation.

Inceptor

Template-driven framework for AV and EDR evasion, providing modular templates for payload generation and obfuscation.

Charlotte

Fully undetected C++ shellcode launcher designed to bypass security monitoring without triggering alerts.

GadgetToJScript

Generates .NET serialized gadgets that trigger .NET assembly load/execution when deserialized from JS/VBS/VBA scripts, enabling fileless execution.

Pafish

Anti-analysis sandbox detector and virtualization environment tester that validates evasion methods against VM and sandbox detection.

SysWhispers

Syscall generator for evasion, enabling direct system calls to bypass user-mode hooks placed by EDR solutions.

Obfusk8

Lightweight C++17 header-only obfuscation library for Windows binaries, providing compile-time obfuscation capabilities.

ProtectMyTooling

Multi-packer wrapper that daisy-chains various packers, obfuscators, and other red-team-oriented weapons, with artifact watermarking, IOC collection, and PE backdooring capabilities.

Killer

Highly simple tool designed to bypass AV/EDR security tools using various evasion techniques.

BYOVD Research

Bring Your Own Vulnerable Driver research repository with detection and reverse engineering methodology, covering CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, and CVE-2026-8501.

Malware Development for Ethical Hackers

Published by Packt, this repository contains comprehensive material for learning malware development from an ethical hacking perspective.

maldev-for-dummies

Beginner-friendly malware workshop covering fundamentals of offensive tooling development.

DarkWidow

Advanced payload with indirect dynamic syscalls, SSN sorting via modified TartarusGate approach, and remote process injection via APC Early Bird technique.

CAPA

Mandiant's FLARE team's premier static analysis tool that identifies what a program can do by applying 800+ rules to binaries, mapping findings to MITRE ATT&CK, MAEC, and MBC frameworks in about 30 seconds without executing the sample. Supports PE, ELF, .NET, and shellcode, with JSON export for…

Cuckoo Sandbox

Open-source automated malware analysis system that executes samples in isolated virtual machines and captures process trees, API calls, network traffic, file drops, and registry modifications. Provides REST API for programmatic submission and JSON reports for programmatic analysis of behavioral…

FLARE VM

Windows-based security distribution designed for malware analysis, reverse engineering, and incident response, bundling hundreds of curated tools including x64dbg, OllyDbg, IDA Freeware, PEiD/DIE, Process Hacker, Volatility, Sysinternals Suite, and Wireshark. Installation requires a Windows 10/11…

REMnux

Linux toolkit for reverse-engineering and analyzing malicious software, providing a curated collection of free community-created tools in an Ubuntu-based distribution with Docker container support. Available as a virtual appliance or installable on existing systems, with AI-powered capabilities…

FlareVM MCP Server

Model Context Protocol server that enables AI agents (Claude Code, etc.) to drive an isolated, air-gapped FlareVM through 52 unified tools for static triage, dynamic detonation, unpacking, and debugging, keeping the malware confined to the VM. Features WinRM with NTLM encryption, hash verification…

DiE (Detect It Easy)

Portable executable identifier.

Process Monitor (Procmon)

Sysinternals tool that monitors real-time file system, registry, and process/thread activity, serving as a core dynamic analysis tool for observing malware behavior in sandbox environments.

Process Hacker

Advanced process viewer and memory editor for Windows, providing detailed inspection of running processes, threads, memory regions, and handles during malware analysis.

Volatility

Advanced memory forensics framework for extracting artifacts from RAM dumps, including hidden processes, injected code, network connections, and encryption keys, critical for analyzing fileless malware and rootkits.

PEStudio

Static analysis tool for Windows executables that examines PE headers, imports, exports, strings, and indicators without executing the file, widely used for initial triage.

Ghidra

NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.

x64dbg

Open-source Windows debugger for x64 and x86.

YARA

Pattern matching tool for malware identification and classification, enabling analysts to create rules based on textual and binary patterns to detect malware families and variants. Supports wildcards, case-insensitive strings, regular expressions, and hexadecimal patterns for flexible detection…

Wireshark

Network protocol analyzer that can be used to inspect 802.11 frames and understand wireless traffic during assessments.

FakeNet-NG

Dynamic network analysis tool by Mandiant that simulates internet services to intercept and redirect malware C2 traffic, allowing analysis of network behavior without risking real infrastructure.

Any.run

Interactive online sandbox with real-time analysis capabilities, allowing analysts to observe malware execution, interact with the environment, and capture behavioral indicators.

Hybrid Analysis

Public sandbox powered by Falcon Sandbox, providing automated malware analysis with detailed behavioral reports.

FLOSS

Mandiant's FLARE Obfuscated String Solver that automatically extracts and deobfuscates strings from malware binaries, defeating common obfuscation techniques like stack strings and encrypted strings.

awesome-malware-analysis

Curated list of 400+ tools, resources, labs, and communities for analyzing, dissecting, and understanding malicious software, organized by category including static analysis, dynamic analysis, memory forensics, and threat intelligence.

oletools

Python tools for analyzing Microsoft OLE2 files including Office documents and MSI files, essential for analyzing malicious macros, embedded objects, and document-based malware.

PyRIT

Microsoft's Python Risk Identification Toolkit for generative AI, providing a red-teaming framework with attack strategies, orchestrators, and scorers for systematically probing LLM applications for safety failures and prompt injection vulnerabilities.

promptfoo

Open-source CLI and library for LLM evaluation and red-teaming, with 50+ vulnerability plugins covering prompt injection, jailbreaks, PII leakage, and hijacking, supporting OpenAI, Anthropic, Ollama, and custom providers with CI/CD-native YAML configuration.

Garak

NVIDIA-maintained Generative AI Red-teaming & Assessment Kit that scans LLMs for hallucinations, data leakage, prompt injection, and jailbreaks using a comprehensive probe library, now the industry-standard open-source LLM vulnerability scanner.

Giskard

Open-source evaluation, testing, and red-teaming framework for LLM agents, including agent vulnerability scanning and RAG evaluation workflows to detect bias, performance issues, and security flaws.

Guardrails AI

Python framework for adding input/output guards, validators, and structured-output controls to LLM applications, with Hub checks for content policy, PII detection, and SQL injection prevention.

NeMo Guardrails

NVIDIA's programmable guardrails toolkit using Colang-based policy language to define topical, safety, and action guardrails for LLM applications, supporting input, output, dialog, and retrieval rails.

Meta Llama Prompt Guard 2

Meta's prompt-injection classifier available on HuggingFace, fine-tuned from mDeBERTa with adversarial-resistant tokenization, providing binary BENIGN/MALICIOUS classification across 8 languages for local, API-free detection.

PurpleLlama

Meta's open-source LLM security toolkit including Llama Guard classifiers, CodeShield for insecure code detection, and CyberSecEval for benchmarking AI safety and security.

HarmBench

ICML 2024 standardized evaluation framework for automated red-teaming and robust-refusal benchmarking, providing a rigorous methodology for measuring LLM safety against adversarial attacks.

Counterfit

Microsoft's ML/AI penetration-testing automation tool that provides a CLI for running adversarial attacks against machine learning models, supporting evasion, poisoning, and extraction attack scenarios.

LLM Guard

Protect AI's suite of input/output scanners for PII, prompt injection, toxicity, and secrets detection, retained as a historical reference for local guardrails implementation though no longer actively maintained.

EasyJailbreak

Framework for building and testing adversarial jailbreak prompts against LLMs, providing modular components for attack construction, evaluation, and defense testing.

ModelScan

Protect AI's model file scanner that detects malicious code in serialized ML models (Pickle, H5, SavedModel), protecting against model supply chain attacks through dangerous deserialization.

CycloneDX

An OWASP-led Software Bill of Materials (SBOM) standard that is lightweight and well-suited for expressing component relationships and vulnerability data. CycloneDX is the recommended choice for security-response-focused supply chain programs, with mature tooling ecosystem support and integration…

OpenSSF Model Signing (OMS)

Open Source Security Foundation specification (v1.0, April 2025) for signing ML models to establish provenance and integrity, filling the signing gap for model artifacts in the AI supply chain.

Fickling

Pickle file analysis and decompilation tool that achieves 100% detection of malicious pickle payloads through allowlist-based validation, critical for safely loading ML models from untrusted sources.

AI-UTM

All-in-one platform security protection product for large models and agent applications from NSFOCUS, addressing multiple OWASP LLM Top 10 risks including prompt injection and sensitive information disclosure.

weaponized-ai-scan

Open-source CLI tool that scans LLM applications for vulnerabilities including prompt injection, jailbreaks, and data leakage, providing automated security assessment for AI deployments.

Rebuff

Archived prompt-injection detector by Protect AI combining heuristics, LLM-based detection, vector similarity, and canary tokens, retained as a historical reference for multi-layer prompt injection defense.

LLAMATOR

Red-teaming framework for chatbots and GenAI systems, providing automated adversarial testing methodologies for conversational AI safety evaluation.

LangKit

LLM monitoring toolkit from WhyLabs that extracts safety and security signals including jailbreak similarity, prompt-injection similarity, hallucination checks, PII patterns, toxicity, and refusal metrics for production observability.

PIMap

Automated black-box prompt injection scanner described as "sqlmap for LLMs," with 8 attack modules, 33 payloads, and HTML report generation for systematic prompt injection testing.

Cobalt Strike

The industry-standard commercial adversary simulation framework, providing Beacon payloads, Malleable C2 profiles, and a comprehensive post-exploitation toolkit for red team operations.

Sliver

C2 framework for adversary simulation and red teaming.

Havoc

Modern, malleable C2 framework with a beautiful GUI, designed for post-exploitation and red team operations with advanced evasion capabilities.

Mythic

Collaborative, cross-platform C2 framework with plug-and-play architecture allowing teams to add payload types, communication profiles, and translation services without rebuilding the core server. Tracks payload, build parameters, C2 configuration, loaded command versions, issuing operator, task…

Brute Ratel C4

Commercial adversary simulation framework active since 2020, featuring Badger payloads, EDR evasion, syscall-only execution, DNS over HTTPS, indirect syscalls, built-in debugger for detecting EDR userland hooks, and MITRE graph integration. Licensed at $2500/year per user, with cracked copies…

Nighthawk

MDSec's commercial C2 framework featuring groundbreaking memory hiding that masks all inactive pages even during interactive execution, exposing only approximately 2% of the codebase in plaintext memory at any given moment. Includes Python API, JSON RPC web service, and Nighthawk Labs with…

Empire

PowerShell and Python post-exploitation framework providing agents and modules for credential theft, lateral movement, persistence, and exfiltration, with extensive MITRE ATT&CK technique coverage.

Covenant

C#-based post-exploitation platform.

Foojank

Open-source C2 framework built on NATS for red team and purple team engagements, providing customizable C2 transport over TCP and WebSockets, built-in file storage for payload distribution and data exfiltration, and observability into agent activity and C2 messaging.

Metasploit Framework

The world's most used penetration testing framework, providing exploit modules, payloads, encoders, and post-exploitation modules for adversary simulation and vulnerability validation.

Impacket

Collection of Python classes for working with network protocols, widely used for lateral movement via SMB, MSRPC, DCOM, WMI, and Kerberos, with detectable network signatures and log artifacts for defenders to study.

Rubeus

C# toolset for raw Kerberos interaction and abuse, supporting Kerberoasting, AS-REP Roasting, ticket manipulation, and delegation abuse, leaving detectable events such as 4769 and 4768 with specific encryption types.

Mimikatz

The most well-known Windows credential extraction tool, capable of extracting plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory, with countermeasures including Credential Guard, RunAsPPL, and Sysmon Event ID 10.

Atomic Red Team

Red Canary's library of small, focused test scripts mapped directly to MITRE ATT&CK techniques, enabling rapid validation of detection coverage with self-contained, reversible, and cross-platform atomic tests. Each test runs with a single command, includes cleanup steps, and supports Windows,…

MITRE Caldera

Automated adversary emulation platform originally developed by MITRE and now an Apache Incubating project, providing a modular framework for modeling, scripting, and executing adversary behavior through adversary profiles mapped to real threat groups (APT3, APT29, etc.). Unlike Atomic Red Team's…

VECTR

Security Risk Advisors' platform for tracking and reporting purple team exercises, mapping results by ATT&CK technique and generating coverage score reports usable by both leadership and technical teams. VECTR facilitates tracking of red and blue team testing activities and is commonly paired with…

Stratus Red Team

Datadog's cloud-focused attack simulation tool described as "Atomic Red Team, but for cloud," enabling granular detonation of offensive techniques against live AWS, Azure, GCP, Kubernetes, and Amazon EKS environments. Each technique uses Terraform to transparently manage prerequisites, with…

SimRun

IBM's attack simulation platform for detection engineering that detonates attacks, verifies expected SIEM alerts actually fire, and measures exactly which detection rules are exercised versus blind spots. First-class connectors for AWS, GCP, Azure, and Kubernetes, with PostgreSQL persistence,…

TTPForge

Meta's cyber attack simulation platform built by Red, Blue, and Purple security teams, promoting purple teaming by automating attacker TTPs in a powerful YAML format. Helps blue teams measure detection and response capabilities through high-fidelity simulations, and helps red teams improve ROI by…

Validato

Commercial Adversarial Exposure Validation (AEV) platform that performs continuous security control validation using TTPs from MITRE ATT&CK. Tests detection capabilities (whether logs are correctly configured and reaching SIEM) and protective controls (whether endpoint security is configured to…

SentinelX

Modular, production-ready CLI framework for authorized security testing, defensive validation, and Purple Team simulations, built for Kali Linux and Termux with dedicated Red, Blue, and Purple Team workflows. Purple Team module provides attack-to-detection correlation, automatic validation of…

purpleteam (Go package)

Orchestrates governed adversary-emulation runs and turns them into purple-team coverage, joining expected detections against detections that actually fired and persisting the coverage dashboard. Uses a no-host SimulationExecutor so the governed flow (admission, blast-radius, evidence) runs…

Invoke-AtomicRedTeam

PowerShell module for executing Atomic Red Team tests, automating standardized, reproducible execution of 1,000+ ATT&CK techniques from a PowerShell console. Documentation is well-organized with clear instructions for installation, execution, and logging, though the wiki format is less polished…

Practical Purple Teaming (Book)

Comprehensive guide to designing purple team exercises that produce measurable improvements, covering adversary emulation with Atomic Red Team, MITRE Caldera, and Mythic, telemetry collection and coverage analysis using open source platforms, lab automation with Splunk's Attack Range, and building…

Kali Autopilot

Tool from Kali Linux for developing automatic attack scripts for red and purple teaming, primarily intended for creating scripts that attack vulnerable machines in the Kali Purple platform for detection and response training.

Wazuh

Open-source security platform that unifies SIEM and XDR capabilities, providing log analysis, intrusion detection, file integrity monitoring, vulnerability detection, and incident response across endpoints and cloud workloads. Recognized as Best SIEM of 2023 by SC Awards and widely adopted by…

Security Onion

Free and open platform for threat hunting, enterprise security monitoring, and log management, bundling Suricata, Zeek, and Elasticsearch.

Zeek

Powerful network analysis framework that produces high-fidelity transaction logs and supports deep protocol analysis for security monitoring.

Suricata

High-performance Network IDS, IPS, and NSM engine using multi-threading for real-time threat detection and deep packet inspection.

YARA

Pattern matching tool for malware identification and classification, enabling analysts to create rules based on textual and binary patterns to detect malware families and variants. Supports wildcards, case-insensitive strings, regular expressions, and hexadecimal patterns for flexible detection…

Splunk

Industry-leading SIEM platform for centralized log ingestion, correlation, and detection engineering, widely deployed in enterprise SOC environments and DoD-style blue team labs.

DoD Blue Team Network Lab

End-to-end virtualized blue team lab simulating DoD-style enterprise defense, including pfSense firewall, VLAN segmentation, Windows Server AD, IDS/IPS, SIEM (Splunk), STIG-aligned hardening scripts, and adversary emulation with detection validation.

RedSentinel

AI-assisted defensive security assessment framework that orchestrates tools like Nmap, Nikto, and WhatWeb, normalizes output, enriches findings with risk context, and generates professional remediation plans — designed for blue teams, SOC analysts, and security students with no exploitation…

SentinelOps

Lightweight defensive security platform that ingests system and network logs to detect brute-force attempts, anomalous logins, and misuse patterns in real time, generating actionable alerts and structured incident timelines with PDF/HTML report generation.

Blue Team Tools (Pluralsight)

34-course learning path covering network analysis, OS analysis, infrastructure analysis, file analysis, application analysis, incident management, and threat intelligence using MITRE ATT&CK and Shield frameworks to identify tooling gaps and fill them with open-source solutions.

Blue Team Tools: Defense against Adversary Activity

Course focused on leveraging MITRE ATT&CK and Shield for a 360-degree view of attack scenarios, analyzing organizational tooling gaps, and integrating open-source blue team tools into enterprise security strategy.

SharpHound / BloodHound

Dual-use Active Directory attack path mapping tools that defenders can run in controlled settings to identify excessive privileges, unconstrained delegation, and overexposed accounts before attackers exploit them.

Mimikatz

The most well-known Windows credential extraction tool, capable of extracting plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory, with countermeasures including Credential Guard, RunAsPPL, and Sysmon Event ID 10.

Credential Guard

Windows security feature that isolates LSASS secrets using virtualization-based security, making credential extraction significantly harder and serving as a key blue team defensive control.

LAPS (Local Administrator Password Solution)

Microsoft solution for managing local administrator passwords on domain-joined computers, enforcing unique passwords and limiting lateral movement opportunities.

Velociraptor

Digital forensics and incident response platform that doubles as a powerful endpoint threat-hunting tool, with a specialized query language for interrogating host state, remote forensic collection across fleets, and a notebook environment for collaborative investigation workflows.

HELK (Hunting ELK)

All-in-one free threat hunting stack built on Elasticsearch, Logstash, Kafka, and Kibana with Jupyter Notebook integrations, designed by Roberto Rodriguez (Cyb3rWard0g) as a security data science suite for practicing hunting with pre-loaded attack datasets.

ThreatHunter-Playbook

Collection of hunting playbooks organized by MITRE ATT&CK technique, each including hypothesis, required data sources, analytical queries (Spark, Elastic), and sample datasets to validate detection logic before deploying to production.

Security-Datasets (Mordor)

Simulated attack datasets in JSON format (Windows events, Sysmon, etc.) generated with real red teaming tools in controlled environments, the perfect companion to ThreatHunter-Playbook for practicing hunting without executing live attacks.

Chainsaw

Fast Sigma-based threat hunting tool for Windows event logs, capable of scanning EVTX files, extracting artifacts, and generating Sigma-rule-driven detection results with CSV/JSON output for SIEM ingestion.

Hayabusa

Fast Windows Event Log timeline generation and analysis tool with comprehensive detection rules, supporting CSV/JSON timelines, severity filtering, metrics generation, and logon summaries for rapid triage of large EVTX collections.

Hayabusa Lens

Desktop application wrapping Hayabusa and Chainsaw with an intuitive dashboard, Sigma rule viewer, AI-powered investigation helpers (local Ollama or API-based), 3D network path visualization, and audit trail export for streamlined threat hunting workflows.

ThreatHunting-Keywords

Massive database of keywords, artifacts, and patterns organized by offensive tool, ATT&CK technique, and log type, with ready-to-use queries for Splunk, Elastic, and Microsoft Sentinel to hunt for specific tools like Cobalt Strike, Mimikatz, and Sliver.

Sigma

Generic signature format for SIEM systems that has become the practical standard for vendor-agnostic detection rules, enabling threat hunters to describe relevant log events in a portable format convertible to platform-specific queries.

MITRE ATT&CK Navigator

Coverage mapping tool for visualizing detection and hunting coverage against the ATT&CK matrix, with the mitre-mcp-server enabling AI assistants to generate Navigator layers and query technique relationships for gap analysis.

Zeek

Powerful network analysis framework that produces high-fidelity transaction logs and supports deep protocol analysis for security monitoring.

Wazuh

Open-source security platform that unifies SIEM and XDR capabilities, providing log analysis, intrusion detection, file integrity monitoring, vulnerability detection, and incident response across endpoints and cloud workloads. Recognized as Best SIEM of 2023 by SC Awards and widely adopted by…

Security Onion

Free and open platform for threat hunting, enterprise security monitoring, and log management, bundling Suricata, Zeek, and Elasticsearch.

DeepBlueCLI

PowerShell module for hunt teaming via Windows Event logs, enabling rapid triage of security events directly from PowerShell without a full SIEM deployment.

GRR Rapid Response

Incident response framework focused on remote live forensics, with a Python agent installed on assets and server infrastructure enabling analysts to quickly triage attacks and perform analysis at scale.

Velociraptor + Elastic (VELK)

Integration pattern combining Velociraptor's endpoint collection with Elastic Stack (Elasticsearch, Logstash, Kibana) for scalable, visualized threat hunting across enterprise fleets, particularly useful for organizations without existing SOC infrastructure.

DFIR-MCP

Unified Digital Forensics and Incident Response toolkit integrating Chainsaw, Hayabusa, Hindsight, Plaso, and Timesketch through Model Context Protocol, allowing AI assistants to orchestrate complex multi-tool hunting workflows from a single interface.

Microsoft 365 Defender Hunting Queries

KQL hunting queries for Microsoft Defender, Sentinel, and M365 organized by ATT&CK technique, indispensable for Microsoft-centric environments.

Splunk Attack Range

Framework for creating automated attack labs that deploys Windows environments with Active Directory, executes attacks with Atomic Red Team, and collects logs in Splunk for generating realistic hunting datasets.

Awesome Threat Detection

Meta-list of detection and hunting resources including tools, papers, presentations, blogs, and datasets, serving as a starting point for discovering additional hunting resources.

Snort

Classic signature-based intrusion detection system widely used for real-time traffic analysis and packet logging.

Suricata

High-performance Network IDS, IPS, and NSM engine using multi-threading for real-time threat detection and deep packet inspection.

Zeek

Powerful network analysis framework that produces high-fidelity transaction logs and supports deep protocol analysis for security monitoring.

OSSEC

Open-source host-based intrusion detection system (HIDS) performing log analysis, file integrity checking, rootkit detection, and active response across Linux, Windows, macOS, and Solaris. A central manager collects data from agents and runs them through ~1,500 rules to detect brute-force…

Samhain

Open-source multiplatform HIDS providing file integrity checking, log file monitoring and analysis, rootkit detection, port monitoring, detection of rogue SUID executables, and hidden process detection. Designed to monitor multiple hosts with potentially different operating systems, providing…

Splunk

Industry-leading SIEM platform for centralized log ingestion, correlation, and detection engineering, widely deployed in enterprise SOC environments and DoD-style blue team labs.

Palo Alto Networks IPS

Signature, anomaly, and policy-based IPS delivered as part of Advanced Threat Protection within the Next-Generation Firewall platform. Classifies all traffic including encrypted traffic by application, function, user, and content before applying threat prevention policies, with Unit 42 threat…

Fortinet FortiGuard IPS

Deep packet inspection and virtual patching integrated within the Fortinet Security Fabric, with frequent signature updates from FortiGuard Labs covering newly disclosed CVEs in commercial software, network devices, and web applications. Demonstrates lower false positive rates than anomaly-based…

Check Point Quantum IPS

Behavioral and signature-based protections integrated into Check Point's Next-Generation Firewall platform, with multi-gigabit throughput and low false positive rates. ThreatCloud intelligence continuously updated from millions of global sensors enables rapid identification of zero-day and…

Cisco Secure IPS

Enterprise IPS integrated with Cisco's security portfolio, requiring immediate patching for CVE-2025-20333 (remote code execution) and CVE-2025-20362 (privilege escalation) in Cisco ASA and Firepower devices, which persisted after reboots and upgrades. Organizations using unpatched Firepower…

IDS-Defender

Educational IDS/IPS deployment project using Snort 3 and Suricata on Kali Linux, with practical attack simulation using Hydra (SSH brute force), Nmap (port scan), and SQLmap (SQL injection) to validate detection rules in a controlled lab environment.

IDS/IPS Deployment with Snort and Wireshark

Step-by-step walkthrough for deploying and configuring Snort 3 on Kali Linux, capturing and analyzing network traffic with Wireshark, creating custom detection rules based on known attack patterns, and automating alerts for suspicious behavior.

snort2lua

Conversion utility included with Snort and Suricata that converts Snort 2.x rules and configuration to Snort 3 Lua format, facilitating migration and rule modernization. Used during the Snort-to-Suricata migration process since Suricata supports Snort rule syntax.

Wazuh

Open-source security platform that unifies SIEM and XDR capabilities, providing log analysis, intrusion detection, file integrity monitoring, vulnerability detection, and incident response across endpoints and cloud workloads. Recognized as Best SIEM of 2023 by SC Awards and widely adopted by…

Graylog

Centralizes logs and provides alerting and dashboards through a polished interface. Licensed under the Server Side Public License (SSPL), best described as open-core or source-available. Graylog 7.0 introduced an experimental Model Context Protocol (MCP) endpoint allowing LLM clients to connect…

Elastic Stack (ELK)

Infrastructure for log storage, processing, and visualization rather than a complete SIEM. Elastic relicensed Elasticsearch and Kibana back to open source in 2024 under a dual license: AGPL-3.0 or Elastic License 2.0, with the core stack freely available under AGPL. However, SIEM-relevant features…

OpenSearch

Launched in 2021 as a fork of Elasticsearch and Kibana, led by AWS. Includes OpenSearch (the database) and OpenSearch Dashboards (for visualization and analytics). Provides a fully open-source alternative to the Elastic Stack for log storage and search, though like ELK it is not a complete SIEM…

Fluentd

Log collector and forwarder, not a SIEM. Gathers logs from many sources and routes them to other systems for processing, integrating cleanly with Elasticsearch, OpenSearch, Splunk, and Snowflake. Does not perform threat detection, correlation, or alerting, and has no storage layer. Highly…

Suricata

High-performance Network IDS, IPS, and NSM engine using multi-threading for real-time threat detection and deep packet inspection.

Snort

Classic signature-based intrusion detection system widely used for real-time traffic analysis and packet logging.

OSSEC

Open-source host-based intrusion detection system (HIDS) performing log analysis, file integrity checking, rootkit detection, and active response across Linux, Windows, macOS, and Solaris. A central manager collects data from agents and runs them through ~1,500 rules to detect brute-force…

Security Onion

Free and open platform for threat hunting, enterprise security monitoring, and log management, bundling Suricata, Zeek, and Elasticsearch.

Google Security Operations (Chronicle SIEM)

Cloud service built on Google's core infrastructure for private retention, analysis, and search of large volumes of security and network telemetry. Normalizes, indexes, correlates, and analyzes data to provide rapid analytics and context for risky activity. In 2026, Google launched a unified rules…

Microsoft Sentinel

Cloud-native SIEM with a new Data Lake providing cost-effective long-term storage in an open format, decoupling storage and compute for flexibility. UEBA anomaly detection now supports Check Point, Fortinet, Zscaler, and AWS GuardDuty findings, with ten new rules comparing each user and device…

Exabeam New-Scale Security Operations Platform

Cloud-native SIEM with AI-driven analytics and scalable architecture for real-time visibility across environments. New-Scale Analytics builds upon Exabeam Security Analytics with advanced multi-layer risk scoring and business factor adjustments, using machine learning and behavioral analytics to…

LogRhythm SIEM

Platform updates focused on security, performance, and stability. Version 7.23 updated Data-Indexer Java Corretto JRE to 8.0.472, Web-Indexer Java Corretto JDK to 21.0.9, .NET 8 Core to 8.0.22, Grafana to 12.3.0, and Go to 1.24.2 for Case API. CentOS 7 and RHEL 7 have reached end-of-life for Data…

CrowdStrike Falcon Next-Gen SIEM

Positioned as a Leader in the IDC MarketScape Worldwide SIEM 2026 assessment. Leverages an index-free design powered by the Falcon LogScale engine, enabling lightning-fast searches across expansive retention windows. Native endpoints, identity, and cloud logs are piped directly without re-ingest…

OPNsense

FreeBSD-based open-source firewall and routing platform that protects every device on the network, offering intrusion detection via Suricata, network-wide DNS filtering, VLAN segmentation for IoT isolation, and traffic reporting. Releases two major versions per year with weekly security updates,…

pfSense

The most widely deployed open-source firewall with the largest community and extensive third-party documentation, built on FreeBSD with a browser-based management interface. Available in Community Edition (open source) and pfSense Plus (commercial). Known for extremely stable long-running…

IPFire

Hardened Linux firewall with a security-first philosophy, splitting networks into color-coded trust zones (LAN, DMZ, wireless, internet) so untrusted devices are contained by default configuration. Lighter than pfSense and OPNsense, easier to harden, and maintains a strong security patch delivery…

Fortinet FortiGuard IPS

Deep packet inspection and virtual patching integrated within the Fortinet Security Fabric, with frequent signature updates from FortiGuard Labs covering newly disclosed CVEs in commercial software, network devices, and web applications. Demonstrates lower false positive rates than anomaly-based…

Palo Alto Networks IPS

Signature, anomaly, and policy-based IPS delivered as part of Advanced Threat Protection within the Next-Generation Firewall platform. Classifies all traffic including encrypted traffic by application, function, user, and content before applying threat prevention policies, with Unit 42 threat…

Check Point Quantum IPS

Behavioral and signature-based protections integrated into Check Point's Next-Generation Firewall platform, with multi-gigabit throughput and low false positive rates. ThreatCloud intelligence continuously updated from millions of global sensors enables rapid identification of zero-day and…

AWS Network Firewall

Managed cloud-native firewall service that provides fine-grained control with a flexible rules engine supporting open-source Suricata rules for intrusion detection and prevention. Centrally managed across all AWS accounts with AWS Firewall Manager, offering managed infrastructure for high…

Suricata

High-performance Network IDS, IPS, and NSM engine using multi-threading for real-time threat detection and deep packet inspection.

Snort

Classic signature-based intrusion detection system widely used for real-time traffic analysis and packet logging.

VyOS

Open-source network operating system providing routing alongside firewall features, using a command-line configuration model similar to Juniper or Cisco rather than a web-managed appliance interface. Suited for network engineers who need advanced routing capabilities combined with firewall…

Portmaster

PC-based firewall suite from Safing that hooks into the network stack via a WFP kernel driver on Windows and nfqueue/eBPF on Linux, making every packet visible and stoppable. Provides a live scrolling list of every application's connections and destinations, intercepts stray DNS queries and…

Fort Firewall

Windows-only open-source firewall built on the Windows Filtering Platform, providing app groups, wildcard path matching for folder-level blocking, and rate limiting. Excels at distinguishing individual services sharing svchost.exe, allowing one specific service to be blocked without disrupting the…

CrowdStrike Falcon Next-Gen SIEM

Positioned as a Leader in the IDC MarketScape Worldwide SIEM 2026 assessment. Leverages an index-free design powered by the Falcon LogScale engine, enabling lightning-fast searches across expansive retention windows. Native endpoints, identity, and cloud logs are piped directly without re-ingest…

Microsoft Defender for Endpoint

Matured into a strong enterprise EDR platform, particularly compelling for organizations already using Microsoft 365. Included in Microsoft 365 E5 licensing or available standalone, it provides deep Windows integration that enables detection capabilities other vendors cannot match in pure Windows…

SentinelOne Singularity

The primary CrowdStrike competitor with a differentiating capability: autonomous response. Rather than requiring a human analyst to take action after an alert, SentinelOne's AI engine can automatically isolate infected devices, kill malicious processes, and roll back malware-induced changes in…

Bitdefender GravityZone EDR

Winner of the Cybersecurity Stars Awards 2026 for Best Endpoint Detection and Response Platform. Its primary differentiator is alert quality achieved architecturally: in MITRE ATT&CK Evaluations Round 6, the platform generated just 3 alerts to identify and report an incident compared to an…

Fortinet FortiGuard IPS

Deep packet inspection and virtual patching integrated within the Fortinet Security Fabric, with frequent signature updates from FortiGuard Labs covering newly disclosed CVEs in commercial software, network devices, and web applications. Demonstrates lower false positive rates than anomaly-based…

LMNTRIX Endpoint Security

Combines AI-driven prevention, Active EDR visibility, forensic investigation, and rapid containment in a single lightweight agent for Windows, macOS, and Linux. Static AI inspects files before execution while behavioral AI detects fileless attacks, exploits, malicious macros, and scripts.…

Radegast EDR

Open-source and privacy-respecting EDR platform built with complete end-to-end encryption using age encryption, meaning log data remains private even from the server itself. The built-in SQLite database and self-contained deployment make it easy for smaller teams, home labbers, and families to get…

Owlyshield

Open-source EDR framework written in Rust for Linux and Windows servers, developed by SitinCloud. It analyzes how processes use files to detect intrusions through vulnerability exploitation, with particular focus on Command and Control, exfiltration, and impact tactics. The core concept learns…

Sophos Intercept X

Ranked second overall in the ISG Buyers Guide for EDR Platforms 2026 and rated Exemplary. Market leader in endpoint security with 20.55% market share across 26,132 customers according to 6sense data. The platform combines deep learning neural networks with behavioral analysis, anti-ransomware…

Palo Alto Networks IPS

Signature, anomaly, and policy-based IPS delivered as part of Advanced Threat Protection within the Next-Generation Firewall platform. Classifies all traffic including encrypted traffic by application, function, user, and content before applying threat prevention policies, with Unit 42 threat…

Trend Micro Vision One

Well-established regional vendor with strong APAC support, ranked as an Assurance provider in ISG's 2026 EDR evaluation. The platform includes Email and Collaboration Security, Identity Security, Network Security fed by Deep Discovery Inspector NDR, and Cyber Risk Exposure Management folding…

Cisco Secure IPS

Enterprise IPS integrated with Cisco's security portfolio, requiring immediate patching for CVE-2025-20333 (remote code execution) and CVE-2025-20362 (privilege escalation) in Cisco ASA and Firepower devices, which persisted after reboots and upgrades. Organizations using unpatched Firepower…

WithSecure Elements XDR

Ranked as a Leader in Customer Experience in the ISG Buyers Guide 2026. Headquartered in Helsinki, Finland, the platform is well-suited for small and midsize organizations, especially those in Europe with data sovereignty requirements. WithSecure announced plans to make its offering available on…

Kaspersky Endpoint Security

Rated Innovative in ISG's 2026 EDR evaluation. The platform has extended to space: Kaspersky Endpoint Security for Linux (KESL) Space Edition was developed for hosting provider RUVDS to protect the RUVDSSat1 satellite platform throughout its mission, demonstrating the platform's adaptability to…

Qualys Endpoint Detection and Response

Rated Innovative in the ISG Buyers Guide 2026 and achieved Leader status in one category. Integrates tightly with Qualys' vulnerability management and compliance platform, making it attractive for organizations already using Qualys for security assessment.

Sentinel Antivirus

Lightweight open-source antivirus engine for Windows with YARA scanning, PE ML classifier, and kernel minifilter driver. Includes an interactive GUI dashboard, headless CLI scanner, and dynamic sandbox analysis with pure in-memory emulation under 100ms with zero host risk. The hybrid analysis mode…

Velociraptor

Digital forensics and incident response platform that doubles as a powerful endpoint threat-hunting tool, with a specialized query language for interrogating host state, remote forensic collection across fleets, and a notebook environment for collaborative investigation workflows.

Volatility 3

The reference framework for memory forensics with 2,500+ GitHub stars, rewritten in Python 3 with a modular plugin architecture supporting Windows XP through 11, Server equivalents, and Linux 2.6.18 through latest kernels. Essential plugins include windows.pslist and windows.psscan for listing…

KAPE (Kroll Artifact Parser and Extractor)

Windows-native triage tool for rapidly collecting forensic artifacts including registry hives, $MFT, event logs, prefetch, browser databases, and LNK files without triggering anti-tamper protections. Uses a two-phase architecture: Targets (.tkape files) define what to collect via raw NTFS file…

AVML (Acquire Volatile Memory for Linux)

Microsoft's static binary for acquiring memory on Linux systems during incident response, designed for environments where software installation is not possible. Generates dumps compatible with Volatility and LiME, with 700+ GitHub stars and active maintenance. Portable with no dependencies, making…

LiME (Linux Memory Extractor)

Linux kernel module for acquiring memory dumps, older than AVML but supporting additional formats and more kernel versions. With 1,700+ GitHub stars, it remains a standard tool for Linux memory acquisition in incident response engagements where kernel module loading is permitted.

GRR Rapid Response

Incident response framework focused on remote live forensics, with a Python agent installed on assets and server infrastructure enabling analysts to quickly triage attacks and perform analysis at scale.

Plaso / log2timeline

Super-timeline engine that extracts timestamps from dozens of sources including event logs, registry, filesystem, browser, and prefetch, unifying them into a single chronological timeline for reconstructing incident sequences. With 1,500+ GitHub stars, it serves as the data ingestion layer for…

Timesketch

Open-source collaborative forensic timeline analysis tool where analysts and collaborators organize timelines in "sketches," annotating raw data with rich comments, tags, and stars. Version 20260630 is available on PyPI with SHA-256 and BLAKE2b checksums for verified deployment. Originally…

TheHive

Scalable security incident response platform with Docker images available through StrangeBee, with version 5.6.3-1 as the most recent stable tag. Integrates with Cortex analyzers for automated observable enrichment and MISP for threat intelligence sharing, providing case management, task tracking,…

Cortex

Observable analysis and active response engine that pairs with TheHive for automated enrichment of IP addresses, domains, file hashes, and other indicators during incident response. Note: The "Cortex" at github.com/hurttlocker/cortex is an unrelated AI agent memory layer project and not the…

MISP

Open-source threat intelligence sharing platform used by 6,000+ organizations worldwide, supporting STIX, TAXII, OpenIOC, and automated SIEM/IDS exports.

Cyber Triage

Automated incident response tool for rapid triage of Windows endpoints, scoring threat indicators and identifying compromised hosts for prioritization. Rated 3.9/5 overall with strongest scores in deployment and usability (4.5/5), suited for organizations needing quick assessment without full…

Autopsy

Open-source disk forensics platform providing a complete GUI for analyzing E01, raw, and VHD disk images with modules for file carving, keyword search, timeline generation, hash matching, web artifacts, and email analysis. Positioned as the open-source alternative to EnCase and FTK for full disk…

Magnet AXIOM Cyber

DFIR platform for investigating cyber incidents across endpoints and cloud environments, supporting Windows, macOS, and Linux with cloud deployment on AWS and Azure. Features remote data collection from off-network endpoints, data visualization showing artifact connections, and VirusTotal…

EnCase

Enterprise and law enforcement forensic suite for court-admissible evidence handling with structured workflows, supporting Mac, Windows, and Linux investigation, Verakey mobile data extraction, remote data collection, optical character recognition for text extraction from images and PDFs, and…

Aircrack-ng

WiFi cracking suite

Reaver

WPS attack tool

Fern WiFi Cracker

Wireless network auditing tool

Wifite

Automated wireless attack tool

Kismet

Wireless network detector, sniffer, and intrusion detection.

MDK3

Wireless network attack tool

PixieWPS

WPS offline attack tool

WPA2 Wordlist Generator

Generate custom WPA2 wordlists

Bully

WPS attack tool for brute-forcing

Evil Twin

Create fake AP for capturing handshakes

WiFi-Pumpkin

WiFi spoofing tool.

Airgeddon

Multi-use bash script for Linux systems to audit wireless networks, with a comprehensive menu-driven interface.

Ghost Phisher

Wireless network attack tool for phishing

NoCatSplash

Captive portal for Wi-Fi networks

Wifiphisher

Rogue access point framework for automated Wi-Fi phishing attacks, capturing credentials via fake captive portals.

WLANPi

Wireless attack platform for pen-testers

Cowpatty

Tool for offline WPA2 cracking

Scapy

Python tool for packet manipulation and analysis

NetStumbler

Wi-Fi scanner for Windows

Wi-Fi Pineapple

Wireless attack platform by Hak5

Autopsy

Digital forensics platform for analyzing hard drives and smartphones.

Volatility

Advanced memory forensics framework for extracting artifacts from RAM dumps, including hidden processes, injected code, network connections, and encryption keys, critical for analyzing fileless malware and rootkits.

binwalk

Powerful firmware analysis tool for scanning binary images, identifying embedded filesystems, compressed archives, and executables, with extraction and entropy analysis capabilities.

Sleuth Kit (TSK)

Command-line tools for disk image investigation.

ExifTool

Metadata extractor for images, videos, and documents.

TestDisk

Disk recovery tool to restore lost partitions.

PhotoRec

File recovery software for deleted files from disks.

Foremost

File carving tool for data recovery based on headers.

Hashdeep

File hashing tool with recursive hashing & audit mode.

Bulk Extractor

Extracts email, URLs, and other artifacts from raw data.

Digital Forensics Framework (DFF)

Open-source platform for digital forensics.

Xplico

Network forensics tool that extracts applications' data from pcap files.

NetworkMiner

Network forensic analysis tool for extracting artifacts from PCAP files including files, credentials, and images.

Pdf-parser

Analyze and extract content from PDF files.

RegRipper

Windows registry analysis tool.

PEView

Portable executable (PE) file viewer for malware analysis.

YARA

Malware pattern-matching tool used by researchers.

HxD

Hex editor for raw disk editing and analysis.

FTK Imager

Disk imaging and evidence preview tool.

age

A simple, modern and secure file encryption tool, format, and Go library with small explicit keys, no config options, and UNIX-style composability. Supports X25519 recipients, SSH keys, passphrase encryption with auto-generated secure passphrases, and hybrid post-quantum keys via the -pq flag for…

OpenXPKI

Enterprise-grade open-source PKI/trustcenter solution written in Perl, supporting CA rollover, multiple PKI realms in a single installation, hardware security modules (nCipher nShield, SafeNet Luna), threshold secret sharing, database backends including Oracle, SCEP for embedded device certificate…

Dogtag Certificate System

Robust, scalable enterprise PKI solution managing the complete digital certificate lifecycle including creation, storage, distribution, and revocation. Features extreme flexibility in certificate profiles, workflows, and policies, with HSM integration via PKCS #11, multi-factor authentication,…

Step CLI

Easy-to-use CLI tool for building, operating, and automating PKI systems. Provides step certificate for X.509 operations including creation, revocation, validation, linting, and trust store installation; step ca for ACMEv2-compliant CA administration; step crypto for JWTs, JWS, JWE, TOTP, NaCl,…

GnuPG (GPG)

Complete OpenPGP implementation for digital encryption and signing services. GnuPG 2.x supports modern encryption algorithms including Kyber keys implemented as composite ECC keys (PQ/T hybrid) for post-quantum resistance. Features complete key management including export, import, list-keys with…

OpenSSL

The de facto standard cryptographic toolkit providing a comprehensive command-line interface for symmetric ciphers (AES-128/192/256, ARIA, Blowfish, Camellia, CAST5, ChaCha20, DES/3DES, IDEA, RC2/4/5, SEED, SM4), message digest commands (BLAKE2, MD5, SHA-1, SHA-2, SHA-3, SHAKE, SM3), X.509…

Tomb

Free and easy-to-operate desktop application for strong encryption of personal files using dm-crypt/cryptsetup with the aes-xts-plain64 cipher. Operates as a "locked folder" that can be transported and hidden in filesystems, requiring both a keyfile and a password to open. Keys can be kept…

GTKCrypto

GTK+ application for encrypting and signing files or text, supporting AES, Twofish, Serpent, and Camellia cipher algorithms with 256-bit keys in CBC or CTR mode. Also computes and compares MD5, SHA-1, SHA-2, SHA-3, GOST, and Whirlpool hashes for file integrity verification.

Quinto

CLI tool that automates hash cracking by identifying hash types using prefix matching, name-that-hash, and hashid, then orchestrating hashcat and John the Ripper through a sequence of attacks: wordlist → wordlist + rules → masks → EFF diceware passphrases. Handles password-protected files (.zip,…

Hashcat

Advanced password recovery tool and the world's fastest CPU-based password cracker, supporting over 300 hash types including MD5 (-m 0), SHA-1 (-m 100), and SHA-256 (-m 1400). GPU-accelerated for massive throughput, widely used in CTF competitions and authorized penetration testing for credential…

John the Ripper

Password cracking tool for various password hashes.

CyberChef

The "Cyber Swiss Army Knife" web application from GCHQ for encryption, encoding, compression, and data analysis. Provides a drag-and-drop interface for chaining operations including Base64, AES, RSA, hashing, and classical ciphers, with 36,000+ GitHub stars.

Cryptii

Web-based modular conversion, encoding, and encryption tool supporting classical ciphers (Caesar, Vigenère, substitution, transposition), modern ciphers (AES, RSA), and various encoding schemes.

Dcode

Online cipher and code identification/decoding tool with extensive support for classical ciphers, modern cryptographic challenges, and CTF-oriented encoding analysis.

Tor Browser

The gold standard for anonymous browsing, routing all traffic through the Tor network's three-relay onion routing architecture to prevent tracking and enable access to .onion sites. Includes NoScript, tracker blocking, and Letterboxing to standardize window sizes and prevent fingerprinting.

LibreWolf

Privacy-hardened Firefox fork with no telemetry, uBlock Origin pre-installed, DuckDuckGo as default search, and built-in DNS-over-HTTPS. Designed to resist fingerprinting and tracking out of the box, available for Windows, macOS, and Linux.

Brave

Chromium-based browser with built-in ad/tracker blocking and fingerprinting protection enabled by default. Includes optional Tor-powered private windows for casual anonymous sessions, though it doesn't match Tor Browser's deep anonymity guarantees.

Mullvad Browser

A collaborative project between Tor Project and Mullvad that provides Tor Browser's anti-fingerprinting protections without requiring the Tor network. Designed to be used alongside a VPN, it makes all users look identical to prevent profiling.

Mullvad VPN

No-logs VPN with anonymous account numbers (no email required), cash payment support, and open-source clients. Audited by Cure53 and widely recommended for privacy-conscious users who want to pay anonymously.

Proton VPN

Swiss-based VPN from Proton AG with a strict no-logs policy, open-source apps, and a generous free tier. Part of the Proton privacy ecosystem alongside Proton Mail and Proton Drive.

IVPN

Audited no-logs VPN with anonymous account identifiers, cash payment option, and customizable multi-hop routing. Known for minimalist design and transparent privacy practices.

Bitwarden

Open-source password manager with zero-knowledge encryption, supporting unlimited passwords and devices on the free tier. Available as hosted service or self-hosted via Vaultwarden.

KeePassXC

Offline, cross-platform password manager storing everything locally in an encrypted database. No cloud dependency, no telemetry, and compatible with KeePassDX on Android.

Signal

The gold standard for private messaging with end-to-end encryption, open-source clients, and a minimal metadata collection policy. Recommended by security professionals worldwide.

Session

Decentralized messenger requiring no phone number or email, using onion routing for metadata protection. Built on the Oxen network for anonymous communication .

Proton Mail

End-to-end encrypted email service based in Switzerland, with no personal information required to sign up. Part of the broader Proton privacy suite.

Tutanota

German encrypted email service with open-source clients, offering a free tier and post-quantum encryption for future-proof security.

VeraCrypt

Free open-source disk encryption software and successor to TrueCrypt, supporting full-disk encryption, hidden volumes, and plausible deniability.

Cryptomator

Client-side encryption for cloud storage, encrypting files before they reach services like Google Drive, Dropbox, or OneDrive. Open-source and available on all major platforms.

Tails

Portable amnesic Linux distribution that runs from USB, routes all traffic through Tor, and leaves no trace on the host machine. Ideal for high-risk anonymous work sessions.

Whonix

Security-focused Linux distribution running inside a VM with a two-VM architecture: a Gateway VM routes all traffic through Tor while the Workstation VM never knows the real IP address.

GrapheneOS

Privacy and security-hardened Android OS for Pixel devices, with no Google services by default and hardened memory allocator. Recommended for mobile privacy.

OnionShare

Open-source tool for securely and anonymously sharing files, hosting websites, and chatting over the Tor network. Creates temporary onion services that close after transfer.

DuckDuckGo

Privacy-focused search engine with no tracking, no search history, and no personal profiling. Available as web search and mobile browser.

SearXNG

Self-hosted privacy metasearch engine aggregating results from multiple sources without profiling users. Open-source and community-maintained.

SimpleLogin

Email aliasing service that lets you create anonymous email addresses to protect your real address from spam and data breaches. Open-source and available as hosted or self-hosted.

uBlock Origin

Efficient wide-spectrum content blocker with 47k+ GitHub stars. Blocks ads, trackers, and malware domains with minimal resource usage, available for all major browsers.

Privacy Badger

Automatic tracker blocker from the Electronic Frontier Foundation that learns which domains track you and blocks them without requiring configuration.

GnuPG (GPG)

Complete OpenPGP implementation for digital encryption and signing services. GnuPG 2.x supports modern encryption algorithms including Kyber keys implemented as composite ECC keys (PQ/T hybrid) for post-quantum resistance. Features complete key management including export, import, list-keys with…

age

A simple, modern and secure file encryption tool, format, and Go library with small explicit keys, no config options, and UNIX-style composability. Supports X25519 recipients, SSH keys, passphrase encryption with auto-generated secure passphrases, and hybrid post-quantum keys via the -pq flag for…

7-Zip

Open-source file archiver with AES-256 encryption support, widely used for creating encrypted archives on Windows and cross-platform environments.

Qubes OS

Security-focused desktop OS that compartmentalizes different activities into isolated VMs, preventing a compromise in one area from affecting others. Endorsed by Edward Snowden.

Slowloris

HTTP DoS tool for keeping many connections open

LOIC

Low Orbit Ion Cannon for stress testing

HULK

HTTP flood tool that makes use of varied requests

GoldenEye

Python-based HTTP denial-of-service tool

Tsunami

Network stress testing and security evaluation

R-U-Dead-Yet

Simple DoS testing tool

DDoS-Sim

DDoS simulation tool

Xerxes

Powerful DDoS attack tool for testing purposes

Web-Hulk

Web server stress testing tool

Synful

SYN flood tool for stress testing

LOIC-PowerShell

PowerShell-based LOIC for DDoS testing

T50

A powerful stress testing tool that simulates multiple attack vectors

RIP-Lite

Lightweight stress testing tool for HTTP and SOCKS

Stress-ng

A tool that can stress test the CPU, RAM, I/O, and more

XDT

DDoS testing tool with multi-protocol support

Botnet

DDoS botnet attack simulation tool

DDOS-Exploit

Exploit kit for DDoS stress testing

Fudp

A multi-threaded UDP flooder for stress testing

BlackHAT

A stress testing framework for web applications

OpenSCAP

The reference implementation of the SCAP (Security Content Automation Protocol) standard, NIST-certified and built into RHEL and derivatives. Evaluates OVAL vulnerability definitions and XCCDF benchmark profiles including CIS, PCI-DSS, STIG, and USGCB, with HTML and XML report generation. Supports…

Lynis

Open-source security auditing and hardening tool for Linux and Unix systems with 200+ individual tests and a hardening index score (0-100). Excels at quick, repeatable configuration audits covering kernel, services, authentication, and filesystem checks, validating both CIS, NIST, and NSA…

CIS-CAT Pro

Official CIS Benchmark assessment tool providing automated verification across 80+ benchmarks covering nearly all operating systems. Proprietary Java-based cross-platform application requiring Java Runtime Environment (JRE 6, 7, or 8), generating pass/fail/error/unknown/not-checked scores with…

Wazuh

Open-source security platform that unifies SIEM and XDR capabilities, providing log analysis, intrusion detection, file integrity monitoring, vulnerability detection, and incident response across endpoints and cloud workloads. Recognized as Best SIEM of 2023 by SC Awards and widely adopted by…

Chef InSpec

Open-source testing framework for infrastructure compliance, with the auditd resource for testing audit rules against system configurations. Integrated into Chef Automate for centralized compliance reporting, with the opsworks-audit cookbook orchestrating DevSec SSH Baseline profile scans.…

OpenSCAP Workbench

GUI for OpenSCAP that allows browsing XCCDF profiles, running scans, and generating reports without command-line interaction. Simplifies compliance assessment for administrators who prefer visual workflows while maintaining the same SCAP-compliant engine as the oscap CLI.

Ubuntu Security Guide (USG)

Canonical's built-in compliance tooling for Ubuntu systems, providing CIS Benchmark profiles at Level 1 and Level 2 for both workstation and server configurations. Audits systems using sudo usg audit cis_level1_server with HTML and XML report generation at /var/lib/usg/, and supports profile…

AIDE (Advanced Intrusion Detection Environment)

File integrity monitoring tool that creates cryptographic checksums of system files and detects unauthorized modifications, complementing compliance scanning by verifying that hardened configurations remain unchanged. Used alongside Lynis and OpenSCAP in multi-tool compliance aggregation…

FABRIC Unified Compliance Aggregator (UCA)

Academic framework that normalizes heterogeneous compliance outputs from Lynis, OpenSCAP, and AIDE into a unified scoring system using weighted metrics (0.4 for Lynis, 0.4 for OpenSCAP, 0.2 for AIDE). Demonstrates that aggregating complementary tools yields clearer, more interpretable security…

cis-host

PyPI-distributed CIS Benchmark scanner and remediator with per-host HTML reports featuring traffic-light scoring (green ≥ 90, amber ≥ 70, red otherwise) and a weighted Hardening Index that prioritizes high-risk rule failures. Supports fleet scanning with aggregate dashboards, drift detection…

Hardenix

OpenSCAP-powered Linux hardening CLI that combines compliance scanning with Lynis second-opinion audits and OVAL-based CVE detection in a single workflow. Features a dead-man switch for safe remote hardening (--deadman 10 auto-reverts unless confirmed), dry-run preview, and YAML-based profiles…

Pavois

Effective Linux compliance and hardening tool over CINC/InSpec producing A-E grades with multi-standard mappings including CIS, ANSSI BP-028, NIST, PCI-DSS, and STIG. Generates tamper-evident evidence bundles with SLSA build provenance and OpenSSF Scorecard verification, supporting cosign…

SimpleRisk

A lightweight and flexible open-source GRC platform focused on risk management, suitable for SMEs looking for straightforward risk tracking and compliance tools. Features include risk assessment and tracking, risk acceptance and mitigation workflows, and optional compliance modules for standards…

Eramba

An open-source GRC software providing a comprehensive suite of tools for governance, risk management, and compliance, with a community-driven repository of GRC templates. Key features include policy management, risk registers, mitigation tracking, incident and exception handling, and support for…

CISO Assistant

An open-source GRC platform designed to simplify governance, risk, and compliance management, supporting over 70 frameworks worldwide with automated risk assessment and audit tracking. It is a one-stop-shop for GRC covering Risk, AppSec, and Audit Management.

OpenRMF

An open-source Risk Management Framework tool focused on managing NIST RMF compliance and assessments, providing automated compliance checklists for NIST 800-53, workflow management for authorization and risk handling, and reporting and dashboards for system assessments. Ideal for defense,…

GovReady-Q

A self-service, open-source GRC tool that automates security assessments and compliance documentation. It supports frameworks like SOC 2, ISO 27001, and GDPR, with emerging data standards for reusable compliance content and a user-friendly interface for both technical and non-technical users.

GraphGRC

A data-driven documentation tool connecting compliance frameworks by mapping and organizing controls across SOC 2, ISO 27001, and GDPR using the Secure Controls Framework (SCF). Features visual representation of compliance control mappings and structured, reusable documentation.

Sai360 IT Risk & Cybersecurity

A cloud-based GRC platform providing AI-powered modules for IT risk management, auditing, and compliance. In-built frameworks include SOC 2, HIPAA, ISO 27001/2, NIST, PCI DSS, and GDPR, with automation of VA, IT risk monitoring, dashboards, and reporting.

Archer

An enterprise-grade Integrated Risk Management (IRM) platform used across organizations for ERM, Internal Controls, Digital Security Risks & Compliance, Third-Party Risk Management, Internal Audit, Global Policy Management, and Insurance.

Riskonnect

An enterprise risk management platform covering ERM, Internal Controls, Digital Security Risks & Compliance, TPRM, Internal Audit, Global Policy Management, and Insurance, used across groups for integrated risk management.

ZenGRC

A GRC platform with built-in frameworks for compliance checks (NIST, HIPAA, CJIS, etc.), used for tracking audits, maintaining compliance evidence, vendor compliance processes and reviews, internal policy compliance, and risk scoring hierarchy for vendor cyber evaluations.

SureCloud IT Risk

A cloud-based Integrated GRC platform with strong supply chain management capabilities, Advanced Risk Manager, Incident Manager, and Digital Asset Discovery system. The highly configurable, no-code Aurora platform allows customization to match various operating models.

Rapid7 Cyber GRC

Launched within the Rapid7 Command Platform, this is the first major security operations platform to combine security operations with governance, risk, and compliance. It links GRC workflows with live security operations data for a single view of control performance, threats, and organizational…

MONARC

An open-source risk analysis tool that takes assets from inventory and mapping tools as objects of risk analysis, covering threats, vulnerabilities, and treatment. Part of a fully open-source ecosystem for cybersecurity that includes GLPI (asset inventory), Mercator (IS mapping), and Deming (ISO…

grc (OWASP Project)

A Python/web2py based GRC tool supporting COSO/ISO 31000/COBIT/NIST/CVSS3.1 standards, now moved to the OWASP project, suitable for organizations of any size needing IT risk management.

KnowBe4

The market leader in security awareness training with the broadest attack vector coverage in a single platform, spanning phishing links, attachments, data entry pages, spear phishing, QR codes, callback phishing, and reply-to tests. AIDA Orchestration is KnowBe4's fully autonomous human risk…

Hoxhunt

Adaptive phishing simulation and awareness platform delivering training through email, Slack, and Teams with simulations sent approximately every ten days per employee. Difficulty adapts automatically based on individual performance, while positive reinforcement through points, streaks, and…

SoSafe

German security awareness platform with multilingual microlearning modules designed for all roles, earning high praise for making training interactive and enjoyable. Keeps users engaged with short, frequent lessons backed by multilingual support, with 51% mid-market adoption per G2 data. SoSafe is…

Arctic Wolf Managed Security Awareness

Managed awareness platform delivering regular, customizable training modules and phishing simulations with inbox-based delivery. Leads mid-market adoption at 77% per G2 data, making it a strong fit for organizations already using Arctic Wolf's MDR services. Detailed reporting and analytics track…

Proofpoint Security Awareness

Enterprise-grade awareness platform with threat intelligence-fed phishing simulations and large-scale campaign management. Proofpoint stands out for its easy campaign scheduling and extensive phishing simulation options, simulating emerging threats using real-world templates. Available in email…

NINJIO

Simulated phishing program built around seven emotional triggers including urgency, obedience, and curiosity, with each simulation tagged by the primary emotion being exploited. NINJIO PHISH3D uses an individual's Emotional Susceptibility Profile to shape both simulation targeting and personalized…

Adaptive Security

Multi-channel, AI-native simulation platform covering email, SMS, voice calls, voicemail, and deepfake video, with scenarios personalized using OSINT drawn from the organization's digital footprint. Executive deepfakes impersonate senior leaders to test responses to high-pressure obedience…

Keepnet

Secure behaviour management platform providing multi-channel phishing simulations beyond email including SMS, voice, QR, callback, MFA, and deepfake attacks, supported by AI agents for campaign creation and automation. Combines phishing simulation with hyper-personalized security awareness…

SANS Security Awareness

Structured awareness training with modules covering phishing, social engineering, password protection, and secure data handling. Interactive learning content, assessments, and simulated attack exercises raise awareness about information security risks, with progress tracking and compliance…

TryHackMe

Beginner-friendly hands-on platform with guided labs, mini-games, and virtual machines for learning networking, web hacking, Linux, and Red Team basics. Follow-along exercises load virtual machines with specific example programs where you either hack or defend by following steps and hints. The…

Hack The Box

Real-world penetration testing labs with Active Directory attacks, privilege escalation, and real vulnerabilities. The Academy provides structured learning modules with challenging practices that force thinking outside the box. HTB can feel overwhelming for complete beginners as it occasionally…

PortSwigger Web Security Academy

The best free resource for learning web hacking, with labs covering SQL injection, XSS, CSRF, authentication bypass, and all OWASP Top 10 categories. Maintained by the creators of Burp Suite, providing the most up-to-date web security training available.

OverTheWire

Learn Linux hacking fundamentals through a series of wargames covering bash, file permissions, and exploitation basics. Ideal for beginners building command-line proficiency and understanding Linux security concepts.

PicoCTF

CTF platform made by security experts for learning cryptography, reverse engineering, and web exploitation through progressively challenging puzzles.

CyberDefenders

Blue Team focused labs for incident response, malware analysis, and threat hunting. The BlueYard section features dozens of free, tiered labs allowing analysis of real artifact files including memory dumps, PCAP files, and event logs locally.

Blue Team Labs Online (BTLO)

SOC operations and defensive security training by Security Blue Team, offering a free tier with real-world defensive challenges and operational attack scenarios.

RangeForce Community

Simulated SOC environments using industry-standard tools including Splunk, Wireshark, and Suricata. Free interactive cloud-based community modules for learning and applying fundamental defensive skills step-by-step.

LetsDefend

Simulated SOC environment for learning SIEM tools, alert analysis, and real attack scenarios. Provides practical experience in the workflows and tools used by security operations center analysts.

PicoCTF

CTF platform made by security experts for learning cryptography, reverse engineering, and web exploitation through progressively challenging puzzles.

OverTheWire

Learn Linux hacking fundamentals through a series of wargames covering bash, file permissions, and exploitation basics. Ideal for beginners building command-line proficiency and understanding Linux security concepts.

Hack The Box

Real-world penetration testing labs with Active Directory attacks, privilege escalation, and real vulnerabilities. The Academy provides structured learning modules with challenging practices that force thinking outside the box. HTB can feel overwhelming for complete beginners as it occasionally…

TryHackMe

Beginner-friendly hands-on platform with guided labs, mini-games, and virtual machines for learning networking, web hacking, Linux, and Red Team basics. Follow-along exercises load virtual machines with specific example programs where you either hack or defend by following steps and hints. The…

PortSwigger Web Security Academy

The best free resource for learning web hacking, with labs covering SQL injection, XSS, CSRF, authentication bypass, and all OWASP Top 10 categories. Maintained by the creators of Burp Suite, providing the most up-to-date web security training available.

Root-Me

French-origin platform with 600+ free challenges spanning web, cryptography, steganography, forensics, networking, and reverse engineering. Multilingual with a strong community-driven approach, suitable from beginner to advanced.

pwn.college

Free, open-source education platform teaching cybersecurity through hands-on, CTF-style challenges focused on system internals, memory safety, and binary exploitation. Highly regarded though notably challenging, ideal for mastering deep computer systems concepts.

Hacker101 CTF

HackerOne's free CTF platform with real-world web security challenges. Participants hunt for vulnerabilities in simulated environments, with a focus on practical web application hacking.

CTFlearn

Community-driven CTF platform with challenges across web security, cryptography, forensics, reverse engineering, and more. Beginner-friendly with a supportive community.

VulnHub

Downloadable vulnerable virtual machines for creating your own local penetration-testing lab. Self-hosted challenges covering Linux, Active Directory, and web exploitation, from intermediate to advanced difficulty.

CyberDefenders

Blue Team focused labs for incident response, malware analysis, and threat hunting. The BlueYard section features dozens of free, tiered labs allowing analysis of real artifact files including memory dumps, PCAP files, and event logs locally.

Blue Team Labs Online (BTLO)

SOC operations and defensive security training by Security Blue Team, offering a free tier with real-world defensive challenges and operational attack scenarios.

CTFtime

Public directory and calendar of CTF competitions worldwide, serving as the central hub for discovering upcoming events and past competition archives.

CTFd

Open-source CTF platform for hosting your own competitions, widely used by educational institutions and organizations for running capture-the-flag events.

CTF Field Guide

Comprehensive online book by Trail of Bits covering tools, techniques, and strategies for CTF competitions across all categories.

Krebs on Security

Brian Krebs’ investigative blog that both reports and breaks major cybersecurity news, known for deep dives into cybercrime networks, botnets, and data breaches. His investigative style combines traditional journalism with technical analysis, often producing stories that law enforcement and…

Schneier on Security

Bruce Schneier’s blog offering invaluable insights on security affairs, cryptography, and government surveillance. As the author of Applied Cryptography (considered the field’s bible), Schneier publishes daily commentary on current events and provides expert analysis on encryption policy and…

The Hacker News

One of the most popular resources for breaking cybersecurity and hacking news, offering insights and analysis for information security professionals.

Bleeping Computer

Large information security and technology news publication covering the latest security threats, technical news, online safety, and privacy with millions of readers.

Dark Reading

One of the most widely read cybersecurity news platforms, providing comprehensive coverage of IoT, cloud security, application security, threat intelligence, vulnerabilities, and analysis. Industry professionals frequently cite it as their go-to source for solid coverage across threat intel and…

SecurityWeek

Created by industry professionals and an experienced news team, covering malware, emerging threats, incident response, threat intelligence, cloud security, application security, IoT security, CISO insights, and industry trends.

CyberScoop

Reports on breaking cybersecurity news, policy, homeland security, APT threats, and the intersection of private sector and government defense, vital for understanding policy shifts and major breaches.

CrowdStrike Blog

Top-tier vendor blog known for thorough investigative research on security trends, emerging threats, network vulnerabilities, and APT groups and tactics. A must-follow for staying on the cutting edge of cyber and APT threats.

Google Project Zero

Google’s elite security research team blog, publishing deep technical analyses of zero-day vulnerabilities, exploitation techniques, and original research that shapes the industry’s understanding of offensive security.

Mandiant Blog

Research from the team that investigated some of the most significant breaches in history, providing frontline threat intelligence and incident response insights.

Check Point Research

Threat intelligence and malware research from Check Point, covering APT campaigns, vulnerability discoveries, and emerging attack trends.

Cisco Talos Intelligence

Threat research from Cisco’s intelligence group, covering vulnerabilities, malware campaigns, and threat actor activity.

Fortinet Threat Research

FortiGuard Labs research covering emerging threats, malware analysis, and vulnerability intelligence.

Securelist (Kaspersky)

Kaspersky’s research blog with deep technical malware analysis, APT tracking, and threat intelligence.

Malwarebytes Labs

Malware research, threat analysis, and security news from Malwarebytes.

SentinelLabs

SentinelOne’s research division publishing threat intelligence, malware analysis, and offensive security research.

CISA Advisories

The Cybersecurity & Infrastructure Security Agency’s official alerts, advisories, and Known Exploited Vulnerabilities (KEV) catalog. Their KEV catalog and joint reports with international partners are considered must-reads for security professionals.

NIST Cybersecurity Framework

NIST CSF 2.0 remains foundational for aligning cyber programs with best practices, emphasizing risk management, supply chain oversight, and performance metrics.

MITRE ATT&CK

Maps attacker behaviors across tactics and techniques, giving security teams evidence-based ways to identify and mitigate threats. Essential for red teams, SOC analysts, and vulnerability analysts.

Exploit-DB

Archive of public exploits and proof-of-concept code, essential for vulnerability research and penetration testing.

Zero Day Initiative (ZDI)

Trend Micro’s bug bounty program publishing advisories on discovered vulnerabilities, with upcoming and published advisory feeds.

Google Online Security Blog

Google’s security team blog covering vulnerabilities, security features, and threat research.

Risky Business Podcast

Long-running cybersecurity podcast with news, analysis, and interviews with industry leaders.

Hak5 ThreatWire

Weekly security, privacy, and internet freedom news covering the latest threats and vulnerabilities.

Seytonic

In-depth security and hacking news analysis channel that dissects technical news events and cyber attacks with thorough analysis.

John Hammond

Enthusiastic cybersecurity expert covering defensive and offensive security, CTF challenges, and malware analysis from beginner to advanced topics.

David Bombal

Former Cisco instructor turned popular creator, covering cybersecurity, networking, career, AI, and interviews with industry experts.

SANS Internet Storm Center

Daily diary of security incidents and handler insights, a trusted community resource for real-time threat awareness.

awesome-threat-intelligence

Curated list of threat intelligence resources, feeds, frameworks, and tools maintained by the community.

CyberSec-Blogs

Curated list of independent cybersecurity blogs covering threat intelligence, purple team, red team, threat hunting, and detection engineering, most maintained by practitioners who publish original research, tradecraft, and tooling.

infosec-opml

Curated collection of 366 information security RSS/Atom feeds organized by reading action and urgency, designed for import into any RSS reader.

cyber-threat-intel-rss-feeds

Curated list of cybersecurity threat intelligence blogs and RSS feeds for SOC analysts, researchers, and enthusiasts.

cyber_rss

Organized list of useful security feeds covering CERT advisories, news, vulnerabilities, vendor advisories, malware research, exploit research, and community sources.

Kim Zetter’s Zero Day

Veteran investigative journalist known for in-depth cybersecurity and national security reporting, publishing longform analysis on cyber attacks, policy developments, and critical vulnerabilities often overlooked by mainstream media.

The Record by Recorded Future

Intelligence-driven reporting on attackers, vulnerabilities, and global security incidents, backed by threat intelligence firm Recorded Future.

The DFIR Report

Real-world incident response case studies with detailed timelines, IOCs, and attacker TTPs, essential for blue teamers and threat hunters.

Dradis

Collaboration and reporting platform for pentesters.

Faraday

Multi-user penetration testing IDE.

MagicTree

Pentesting productivity tool for data aggregation and reporting.

Serpico

Simplifying pentest reporting using templates.

LaTeX

High-quality typesetting system often used for security reports.

reNgine

Automated reconnaissance framework with reporting.

ReconNote

Web-based notes manager for recon and reporting.

Pentracker

Pentest reporting and management tool.

Markdown

Lightweight markup language for clean report writing.

Ghostwriter

Reporting and engagement management platform.

VulnReport

Automated vulnerability reporting platform.

Katana Framework

Post-exploitation and reporting utility.

Pentest-Report-Template

Professional pentest report LaTeX template.

ProofSuite

Automated proof of concept and reporting tool.

VulnWhisperer

Vulnerability management reporting with Nessus, Qualys, and OpenVAS.

RiskSense

Risk-based vulnerability management and reporting.

Pentestly

Powershell-based post-exploitation and reporting.

SecReport

Report generation tool for pentesters.

PwnDoc

Pentest reporting tool with customizable templates.

PenTest-Wiki

Knowledge base for pentesting & reporting references.

HostMeNow

Anonymous offshore hosting: cPanel, VPS, dedicated servers, LTE proxies, and more. Pay with 100+ cryptocurrencies. Use code SAFE for one month of free cPanel hosting.

Geonix

IPv4/IPv6/ISP, and Mobile LTE proxies for security testing. If you want to save money feel free to use this promo code at checkout: HTGR1.

PROXY-SOLUTIONS.net

A proxy server provider providing IP addresses for proxy servers, internet service providers, and mobile devices in over 200 locations. Promo code for a 5% discount: Y1xpdOA8Xr.

OnionLand Hosting

OnionLand Hosting is a cryptocurrency-available Tor hidden-service hosting provider.

Impreza Host

Privacy-focused hosting provider offering anonymous VPS and dedicated servers for security-conscious users and cybersecurity infrastructure.

Tuta Mail

Privacy-focused, end-to-end encrypted email service for secure communication.

Kali Linux

Advanced penetration testing and security auditing OS.

Parrot Security OS

Security-focused OS for pentesting and privacy.

BackBox

Ubuntu-based Linux distro for penetration testing.

BlackArch Linux

Arch-based OS with 2800+ hacking tools.

Pentoo

Security-focused Gentoo-based Linux.

CAINE

Digital forensics live Linux distro.

Bugtraq

Linux distro for pentesting & malware analysis.

Whonix

Security-focused Linux distribution running inside a VM with a two-VM architecture: a Gateway VM routes all traffic through Tor while the Workstation VM never knows the real IP address.

Subgraph OS

Secure Linux distro with hardened kernel.

ArchStrike

Arch Linux repository for security tools.

Fedora Security Lab

Fedora spin for security auditing.

SamuraiWTF

Web application penetration testing environment.

Cyborg Hawk

Security distro for penetration testing.

Matriux Krypton

Debian-based security distribution.

NodeZero

Ubuntu-based penetration testing OS.

GnackTrack

Linux live distribution for penetration testing.

SELKS

Suricata-based IDS/IPS platform.

PentestBox

Penetration testing toolkit for Windows.

WebVerse Labs

Hands-on hacking labs, challenges, learning paths, and WebRanges.

XSS Labs

xss-labs for learning web application security.

Vulnerable Shopping Cart

A deliberately insecure e-commerce application.

Vulnerable Login

Vulnerable login form designed for security education and training.

Open Redirect

An educational web application demonstrating open redirect vulnerabilities.

Website -

LinkTree -

Bug Bounty USA (Telegram Channel) -

LinkedIn -

Threads -

x.com -