Search engine for Tor hidden services, endorsed by the Tor Project. Indexes .onion sites for security research and threat monitoring.

Python script that scrapes URLs from multiple .onion search engines simultaneously. Automates dark web link discovery.

Dark web OSINT crawler written in Python. Crawls and extracts data from .onion sites for research and intelligence gathering.

Crawl and extract data from regular and onion webpages through the Tor network. Supports both clearnet and dark web targets.

Scans Tor hidden services for misconfigurations and information leaks. Identifies security issues and exposed data on .onion sites.

Search engine for leaked credentials and exposed data across deep web, dark web, Pastebin, and GitHub. Detects leaks before they surface elsewhere.

Graphical link analysis tool mapping relationships between threat actors, domains, and leaked credentials using 120+ data sources including dark web intel.

OSINT automation with 200+ modules including dark web monitoring, breach detection, and threat intelligence correlation.

Command-line tool for searching and scraping dark web content. Provides quick access to .onion search engines without manual browsing.

Framework for ingesting and analyzing dark web data. Collects, parses, and stores onion site content for intelligence analysis.

Open-source threat intelligence platform for sharing indicators of compromise (IOCs), malware signatures, and threat actor profiles across organizations.

Open-source cyber threat intelligence platform built on STIX 2.1. Structures and visualizes threat data, actors, and campaigns in a knowledge graph.

Open Threat Exchange — community-driven threat intelligence platform with millions of IOCs, pulses, and adversary indicators shared by researchers worldwide.

Analyzes files, URLs, and domains against 70+ antivirus engines and threat intelligence sources. Massive database of malware samples and threat relationships.

Abuse.ch platform for sharing IOCs associated with malware. Free API for querying and submitting indicators like C2 domains, IPs, and hashes.

Abuse.ch project tracking malicious URLs used for malware distribution. Provides real-time feeds and a searchable database of infected domains and payloads.

Classifies internet background noise vs. targeted attacks. Filters out benign scanning traffic so analysts can focus on real threats hitting their infrastructure.

Commercial threat intelligence platform combining open web, dark web, and technical sources into real-time risk scoring and contextual threat analysis.

Open-source platform for organizing observables, indicators, and threat intelligence. Correlates data from multiple sources with a REST API and web UI.

Abuse.ch tracker for botnet command-and-control servers. Tracks Feodo, Emotet, Dridex, and QakBot infrastructure with blocklists and IP feeds.

Complete suite for Wi-Fi security auditing. Captures packets, cracks WEP/WPA/WPA2 keys, and performs replay and deauthentication attacks.

Passive wireless detector, sniffer, and intrusion detection system. Discovers hidden networks, rogue APs, and wireless clients without sending packets.

Automated wireless attack tool that wraps aircrack-ng, reaver, and other tools. One command to scan, attack, and crack multiple networks.

Swiss army knife for network attacks. Handles Wi-Fi deauth, MITM, ARP spoofing, DNS spoofing, and BLE attacks with a live web UI.

WPS PIN brute-force attack tool. Exploits the WPS protocol to recover WPA/WPA2 passphrases from vulnerable routers.

Offline WPS PIN recovery exploiting the Pixie Dust attack. Works on routers with weak WPS random number generation.

Rogue access point and evil twin framework. Performs targeted Wi-Fi phishing attacks to capture credentials and WPA keys.

Evil twin attack suite that captures WPA handshakes and hosts a fake captive portal to harvest Wi-Fi passwords from users.

Bluetooth attack tool for extracting contacts, SMS, and files from vulnerable devices. Exploits legacy OBEX push profiles.

Bluetooth Low Energy swiss army knife. Sniffs, jams, hijacks, and injects packets into BLE connections for IoT and wearable security testing.

Telecom signaling security testing framework covering SS7, GTP, Diameter, and SIP. Finds vulnerabilities in mobile operator interconnects across 2G to 5G [citation:3].

Telecom signaling exploitation framework for SS7, GTP, Diameter, and SIP. Provides a unified interface for testing signaling protocol vulnerabilities [citation:12].

ANSSI's Python tool for 5G SBA signaling automation and SBI fuzzing. Acts as a network function and fuzzes NRF, AMF, SMF, and UDM interfaces [citation:11].

Open-source fuzzing framework for 5G core networks. Generates dynamic test messages for encrypted communications and supports multi-system monitoring [citation:2].

Automated pentesting tool for 5G campus networks and IoT. Integrates with Nmap and Nessus, adds 5G-specific service enumeration and PCAP analysis [citation:7].

Open-source testing platform for 2G/3G/4G/5G using SDR and telecom stacks. Simulates SIM swap, IMSI collection, authentication bypass, and location update attacks [citation:10].

Scans for open GTP-U and GTP-C ports and interfaces in mobile core networks. Identifies exposed GPRS Tunneling Protocol endpoints [citation:9].

Python-based GTP packet manipulation library built on Scapy. Used for crafting custom GTP fuzzers and testing GTP-C/U protocol implementations [citation:9].

Protocol analyzer with native GTP-C/U dissection. Captures and inspects GTP tunnels for TEID spoofing, data breakout, and malformed packet analysis [citation:9].

Commercial fuzz-testing tool for auditing 4G, VoLTE, and 5G network elements and protocol implementations. Identifies crashes and logic flaws in telecom stacks [citation:14].

GNU Radio out-of-tree module for decoding telemetry from satellite protocols. Widely used for live RF signal processing and has known vulnerabilities (CVE-class memory corruption) making it a research target itself [citation:3][citation:8].

Investigate wireless protocols like a boss. Reverse-engineer unknown RF protocols, demodulate signals, and generate fuzzing templates for satellite and RF links [citation:2][citation:7].

RF and reverse engineering framework for everyone. Provides a GUI for signal detection, protocol discovery, and attack execution across SDR hardware [citation:7].

The de facto standard for software-defined radio development. Build custom signal processing pipelines for satellite downlink analysis, jamming simulation, and protocol research [citation:2][citation:3].

World's first open-source, vulnerable-by-design hardware platform for aerospace cybersecurity. Simulates satellite subsystems with real RF links for hands-on hacking practice [citation:10].

Rust-backed Python library for GNSS signal quality analysis. Detects jamming, spoofing, and interference from RINEX observation files with quality scoring and multi-constellation support [citation:4][citation:9].

Satellite telemetry security analyzer focused on GPS spoofing detection for Starlink terminals. ML-powered anomaly detection with interactive dashboard for field analysis [citation:15].

Universal hardware-software toolkit for wireless protocol security research. Provides a uniform API over RF dongles for fuzzing, sniffing, and injecting sub-GHz and 2.4GHz signals [citation:2].

Post-quantum cybersecurity framework for satellite systems. Real-time CCSDS protocol decoding, anomaly detection, GPS spoofing simulation, and Kyber-based encryption [citation:11].

Curated collection of RF communication protocol hacktools. Aggregates SDR-based tools for satellite, cellular, and wireless protocol research in one repository [citation:12].

The world's foremost network protocol analyzer. Captures and inspects packets in real-time, with deep dissection of hundreds of protocols for troubleshooting and security analysis [citation:4][citation:15].

Network discovery and security auditing tool. Host discovery, port scanning, service version detection, and OS fingerprinting via the Nmap Scripting Engine [citation:6][citation:14].

Classic open-source IDS/IPS by Cisco. Real-time traffic analysis with signature-based detection, custom rule language, and IPS mode for active threat blocking [citation:6][citation:14].

High-performance, multi-threaded IDS/IPS and network security monitoring engine. Deep packet inspection, file extraction, and TLS/SSL certificate logging for high-speed networks [citation:11][citation:14].

Powerful network analysis framework (formerly Bro). Logs detailed protocol-level data and supports custom event detection through its scripting language, ideal for forensic investigations [citation:11][citation:14].

Unified open-source security platform (SIEM + XDR). File integrity monitoring, vulnerability detection, log analysis, and active response across Windows, Linux, macOS, and containers [citation:3][citation:11].

Linux distro for intrusion detection, network security monitoring, and log management. Bundles Snort, Suricata, Zeek, OSSEC, and other tools into a ready-to-deploy platform [citation:7].

Command-line packet analyzer. Lightweight and ubiquitous, it captures and filters network traffic on the terminal, essential for quick diagnostics and scripting [citation:15].

Scalable host-based intrusion detection system (HIDS). Log analysis, file integrity checking, rootkit detection, and active response across distributed server environments [citation:14].

Open-source vulnerability scanner (part of Greenbone GVM). Continuously updated vulnerability database covering thousands of CVEs, with network and system scanning plus detailed remediation reports [citation:6].

The go-to graphical packet analyzer for sniffing and deep protocol inspection. Captures live traffic with powerful display filters and supports thousands of protocols [citation:1][citation:13].

Lightweight command-line packet sniffer with powerful BPF filter syntax. Essential for quick captures on remote or headless systems [citation:1][citation:7].

Modern all-in-one MITM framework. Handles ARP spoofing, DNS spoofing, SSL stripping, and credential sniffing with a live web UI. OWASP recommends it over Ettercap for MITM testing [citation:3][citation:9].

Classic comprehensive MITM suite for LAN. Supports ARP poisoning, DHCP spoofing, ICMP redirects, and live connection manipulation with plugin support [citation:1][citation:12].

LLMNR/NBT-NS/mDNS poisoner for Windows environments. Captures NTLM hashes by impersonating legitimate network services during name resolution [citation:1][citation:9].

Collection of sniffing and spoofing tools including arpspoof, dnsspoof, and password sniffers for cleartext protocols like FTP, Telnet, and HTTP [citation:2][citation:4].

Python-based packet crafting and manipulation library. Build custom sniffers, spoofed packets, and fuzzers programmatically for any protocol [citation:1][citation:7][citation:13].

Interactive HTTPS proxy for intercepting, inspecting, and modifying HTTP/HTTPS/WebSocket traffic. Scriptable with Python for automated traffic manipulation [citation:1][citation:9].

ARP/NDP swiss army knife for Layer-2 spoofing. Handles ARP/NDP spoofing, active sniffing, DNS spoofing, and host isolation over LAN [citation:5][citation:6].

Python toolkit for network protocol manipulation. Includes tools for SMB relay, NTLM spoofing, and protocol-level attacks used in MITM scenarios [citation:1].

Open-source network vulnerability scanner forming the core of Greenbone GVM. Scans for known CVEs, misconfigurations, and outdated software with 50,000+ network vulnerability tests [citation:4][citation:6].

Most widely used open-source DAST tool. Intercepting proxy for automated and manual web app vulnerability scanning, including SQLi, XSS, and insecure headers [citation:2][citation:4].

Command-line web server scanner testing for dangerous files, outdated software, misconfigurations, and 6,700+ potentially dangerous files/CGIs [citation:4].

Network mapper with Nmap Scripting Engine (500+ scripts) for vulnerability detection, misconfiguration checks, and weak credential discovery across hosts and services [citation:6][citation:8].

Specialized SQL injection detection and exploitation tool. Supports 6 major SQLi types across 35+ DBMSs including MySQL, Oracle, SQL Server, and PostgreSQL [citation:2].

Black-box web vulnerability scanner. Crawls deployed apps, extracts forms and scripts, then injects payloads to detect vulnerabilities like XSS, SQLi, and file inclusion [citation:4].

Compliance and vulnerability scanning framework for Linux. Automates checks against PCI-DSS, CIS benchmarks, and security baselines with remediation guidance [citation:6].

Lightweight scanner for container images, filesystems, and Git repos. Detects CVEs in OS packages and app dependencies, plus misconfigurations and exposed secrets [citation:6][citation:12].

Automated web app security reconnaissance tool. Recursive crawling and dictionary-based probing generate an interactive sitemap highlighting vulnerability pathways [citation:10][citation:11].

Penetration testing framework with auxiliary scanner modules for vulnerability validation. Used after initial scanning to confirm exploitability of identified weaknesses [citation:6].

The industry standard for web app pentesting. Intercepting proxy, repeater, intruder, and scanner in one platform. Community edition free, Pro adds automated scanning and faster intruder [citation:1][citation:9].

Most widely used open-source DAST tool. Automated and manual web app scanning, intercepting proxy, and CI/CD integration. Closest 1:1 open-source replacement for Burp Suite [citation:2][citation:7].

Specialized SQL injection detection and exploitation tool. Supports 6 major SQLi types across 35+ DBMSs including MySQL, Oracle, SQL Server, and PostgreSQL [citation:2].

Web server scanner testing for dangerous files, outdated software, and misconfigurations. Command-line only, with 6,700+ potentially dangerous files/CGIs in its database [citation:7].

Fast template-based vulnerability scanner by ProjectDiscovery. YAML-defined templates for known CVEs, misconfigurations, and exposed panels. Community template library is massive [citation:6][citation:15].

Black-box web vulnerability scanner. Crawls deployed apps, extracts forms and scripts, then injects payloads to detect XSS, SQLi, file inclusion, and more [citation:7].

Fast web fuzzer written in Go. Directory/file discovery, parameter fuzzing, and vhost discovery. Highly configurable with filters and matchers for precise results.

Advanced command-line directory and file brute-forcer. Dictionary-based scanning to discover hidden endpoints and assets on web servers [citation:4].

Interactive HTTPS proxy for intercepting, inspecting, and modifying HTTP/HTTPS traffic. Scriptable with Python for automated manipulation. Best for scripted flows [citation:3].

Next-generation web crawling framework by ProjectDiscovery. Headless browser support for crawling JavaScript-heavy SPAs and identifying dynamic endpoints [citation:4].

All-in-one automated mobile app pentesting framework for Android, iOS, and Windows. Combines static analysis (APK/IPA/source) with dynamic analysis, CI/CD integration via REST APIs, and MASVS-mapped reporting [citation:2][citation:9].

World-class dynamic instrumentation toolkit. Inject JavaScript into native apps on Android and iOS to hook functions, bypass SSL pinning, and trace runtime behavior. Foundation for most mobile runtime testing tools [citation:3][citation:12].

Leading security assessment framework for Android. Specifically targets IPC surfaces — exported activities, content providers, broadcast receivers, and services — to find component exposure vulnerabilities [citation:7][citation:9].

Runtime mobile exploration toolkit powered by Frida. Assess iOS and Android apps without jailbreak — bypass SSL pinning, dump keychains, manipulate heap objects, and inspect container filesystems [citation:4].

DEX to Java decompiler with CLI and GUI. Decompiles Android APK, DEX, AAR, and AAB files to readable Java source, with deobfuscator and smali debugger included [citation:6].

Reverse engineering tool for Android APKs. Decodes resources to near-original form and rebuilds after modification. Essential for smali-level patching, manifest analysis, and app repackaging [citation:5][citation:13].

Open-source mobile security testing suite powered by Frida. Web-based interface for runtime method hooking, crypto API interception, SQLite inspection, and iOS/Android app analysis with privacy monitoring [citation:1].

Command-line utility for examining the Objective-C segment of Mach-O files. Generates class, category, and protocol declarations from iOS binaries for reverse engineering and API discovery [citation:8].

Self-hosted mobile app security testing platform with static analysis and AI agent. Decompiles APK/IPA using jadx, apktool, Semgrep, and Gitleaks, then lets you chat with decompiled code via local LLM [citation:10].

Static analysis CLI tool by the MobSF project for CI/CD pipelines. Scans Android and iOS source code for insecure patterns mapped to OWASP MASVS, without running a full MobSF instance [citation:2].

Most widely used open-source cloud security platform. 572 AWS checks, 165 Azure, 100 GCP, plus Kubernetes and GitHub. Supports 41+ compliance frameworks including CIS, NIST, PCI-DSS, and SOC2 .

Multi-cloud security auditing tool. Agentless scanning of AWS, Azure, GCP, and Alibaba Cloud environments with HTML report generation and CIS benchmark mapping .

Ant Group's open-source multi-cloud CSPM platform. OPA-based rule engine, 200+ resource types across Alibaba Cloud, AWS, and GCP. Lite version runs as single binary with local dashboard .

OWASP's open-source CSPM for Azure. Scans for misconfigurations and quantum-unsafe cryptography, maps findings to CIS/NIST/ISO27001/SOC2, and provides one-command remediation via Azure CLI playbooks .

Static analysis for Infrastructure as Code. Scans Terraform, CloudFormation, Kubernetes, Serverless, Dockerfile, and ARM templates for misconfigurations before deployment. Large community policy library .

All-in-one scanner for containers, IaC, and cloud. Detects CVEs in images, misconfigurations in Terraform/Kubernetes, and exposed secrets across cloud environments .

IaC scanner built on OPA Rego policy language. Supports Terraform, Kubernetes, Helm, and Kustomize. Appeals to teams that prefer standard policy-as-code over tool-specific DSLs .

Keeping Infrastructure as Code Secure by Checkmarx. Wide format support (Terraform, CloudFormation, Kubernetes, Ansible, Docker) with extensible query library and CI/CD integration .

Extensible Security-as-Code platform. Continuous asset discovery, policy evaluation, auto-fix framework, and dynamic asset grouping across AWS, Azure, and GCP .

Multi-cloud compliance platform with 678 controls across 9 frameworks (SOC 2, ISO 27001, HIPAA, GDPR, PCI-DSS, NIST 800-53). AI-assisted analysis, hash-verified evidence, and remediation tracking .

Aqua Security's all-in-one scanner. Scans container images, filesystems, Git repos, Kubernetes clusters, and IaC for CVEs, misconfigurations, and secrets. Single binary, no server required, default choice for most teams [citation:4][citation:12].

CNCF-graduated runtime security engine by Sysdig. Detects anomalous behavior like shell spawning inside containers, unexpected outbound connections, and sensitive file writes via kernel syscall monitoring (eBPF or kernel module). Largest community rule library [citation:1][citation:5].

Open-source Kubernetes security platform for IDE, CI/CD, and clusters. Risk analysis, security compliance (NSA/CISA, MITRE ATT&CK), and misconfiguration scanning. Scans YAML files, Helm charts, and live clusters before deployment [citation:2][citation:7].

eBPF-native runtime security from Isovalent (Cilium). Unlike Falco, it can enforce in-kernel — kill a process before the syscall completes, not just alert. TracingPolicies define observation and enforcement with low CPU overhead [citation:1][citation:5].

CIS Kubernetes Benchmark compliance checker by Aqua Security. Audits cluster nodes and control plane against the CIS benchmark, returns pass/fail per check. Essential for compliance-driven environments [citation:4][citation:12].

Kubernetes-native policy engine using YAML instead of Rego. Validates, mutates, generates, and verifies images at admission time. Lower learning curve than OPA/Gatekeeper for teams already comfortable with Kubernetes manifests [citation:2][citation:7].

CNCF-graduated policy engine. Gatekeeper is the Kubernetes-native admission controller that blocks non-compliant pods (root, privileged, unapproved registries). Policies written in Rego offer maximum flexibility for complex logic [citation:2][citation:7].

Industry-standard network policy engine for containers. Extends Kubernetes NetworkPolicy with GlobalNetworkPolicy, host endpoint protection, and DNS-based egress rules. Enforces least-privilege pod-to-pod communication [citation:2][citation:7].

CNCF-graduated eBPF-powered networking and security. Identity-aware L3/L4/L7 policy enforcement based on Kubernetes labels, not IPs. Hubble provides network observability with flow logs and service maps [citation:7].

eBPF-native runtime security and forensics by Aqua Security. Built-in signature library plus Rego policies. Strong on container escape patterns (T1611) and ptrace privilege escalation. Good complement to Falco for forensic capture [citation:1][citation:5].

The original SCA tool, created when "using components with known vulnerabilities" entered OWASP Top 10. Identifies project dependencies and checks for publicly disclosed CVEs via NVD feeds. CLI, Maven, Gradle, Jenkins, and GitHub Actions integrations [citation:6].

Container image and artifact signing/verification. Keyless signing via OIDC binds signatures to build workflows, enabling verification that an image came from a trusted pipeline. The de facto standard for supply chain signing [citation:5][citation:11].

Google's SCA library and CLI. Scans filesystems, container images, and binaries for packages across Go, Python, Java, JavaScript, Rust, and more. Cross-references OSV database and outputs SPDX SBOM. CI/CD friendly [citation:13].

Container image SBOM generator with secret detection built in. Outputs SPDX JSON/tag/YAML and GitHub dependency snapshots. Supports Cosign attestation for SBOM signing and provenance metadata [citation:9].

Python supply chain security platform focused on trust verification, not just CVE scanning. Pre-install behavioral analysis, typosquatting detection, provenance verification (Sigstore/GPG), and continuous dependency monitoring [citation:1].

Official verification tool for SLSA provenance. Checks that artifacts were built by a trusted builder with expected inputs, validating Build L1-L3 guarantees. Works with `slsa-github-generator` and Google Cloud Build provenance [citation:4][citation:15].

All-in-one scanner covering the supply chain layers: container images, IaC files, and SBOM generation. Detects CVEs in OS packages and language dependencies, plus exposed secrets and misconfigurations [citation:13].

Research framework for detecting malicious code in packages and reconstructing builds. Uses static analysis to extract metadata, identify suspicious upstream components, and enforce SLSA compliance in CI/CD. Targets novel supply chain attacks that CVE scanners miss [citation:7].

Hybrid Chain of Trust tool for pre-deployment supply chain security. Cryptographic verification (SHA-256 + RSA), tamper-evident blockchain log, OSV vulnerability scanning, and Docker image layer inspection [citation:12].

Lightweight SBOM generator for PHP applications. Parses `composer.lock` and outputs SPDX or CycloneDX in tag, JSON, or YAML format. Designed for CI integration to maintain accurate component inventories [citation:3].

The classic parallelized network login cracker. Supports SSH, FTP, SMB, HTTP forms, databases, and 30+ protocols. Feed it user/pass lists or use built-in charset generation for online brute-force and password spraying [citation:3].

Fast, reliable offline password cracker. Handles Unix crypt(3), Kerberos, Windows LM/NTLM, and many more hash types out of the box. Highly customizable with wordlist rules and incremental modes [citation:4].

World's fastest open-source password recovery tool. GPU-accelerated cracking for 300+ hash types including MD5, NTLM, and WPA. Supports dictionary, rule-based, combinator, mask, and hybrid attacks [citation:5].

Speedy, massively parallel, modular login brute-forcer. Thread-based testing against multiple hosts, users, or passwords concurrently. Supports SMB, HTTP, POP3, MSSQL, SSHv2, and many more protocols [citation:8].

Modular multi-protocol brute-forcer with precise response filtering. Use `ignore-regex` to drop failed-login noise and report only hits. Supports SSH, FTP, HTTP, MySQL, and more with payload offset resume [citation:9].

Swiss army knife for Active Directory credential attacks. Password spraying, pass-the-hash, SMB enumeration, and hash extraction via DCSync. Also used by threat actors (APT39, MuddyWater) for lateral movement [citation:6].

LLMNR/NBT-NS/mDNS poisoner for Windows networks. Captures NetNTLMv1/v2 hashes by impersonating legitimate services during name resolution. Hashes can then be cracked offline or relayed via ntlmrelayx [citation:7].

High-speed network authentication cracker from the Nmap project. Designed for rapid auditing of network devices and services. Supports SSH, RDP, FTP, Telnet, HTTP(S), SMB, databases, and more with Nmap-like timing templates [citation:11].

Custom wordlist generator that spiders a target website and extracts unique words. Perfect for creating targeted password lists based on organization-specific terminology. Optional metadata and email extraction [citation:10].

Wordlist generator that creates all possible password combinations from a defined charset. Specify min/max length and character sets (lowercase, uppercase, digits, symbols). Essential for custom brute-force dictionaries [citation:11].

The classic social engineering framework by TrustedSec. Integrates phishing, website cloning, email spoofing, SMS spoofing, and USB payload delivery into a single menu-driven toolkit. Default in Kali Linux [citation:14][citation:11].

Browser Exploitation Framework. Hooks target browsers via JavaScript and provides real-time command-and-control over compromised sessions. Modules include fake login overlays ("Pretty Theft"), cookie theft, and internal network discovery [citation:3].

Adversary-in-the-middle (AiTM) phishing framework. Acts as a reverse proxy between victim and legitimate site to capture credentials, session cookies, and OAuth tokens — bypassing non-phishing-resistant MFA. Documented in MITRE ATT&CK [citation:12].

Open-source phishing simulation platform for security awareness training. Web-based campaign manager with email templates, landing pages, and detailed click/submission tracking. Widely used for authorized phishing assessments [citation:12][citation:11].

Reverse proxy phishing tool by drk1wi. Automates credential and session token theft from major identity providers. Supports 2FA bypass through real-time proxying of authentication flows [citation:12].

Phishing campaign toolkit with detailed reporting. Supports credential harvesting, email template management, and campaign scheduling. Designed for authorized social engineering engagements with clear audit trails [citation:12].

Multi-platform phishing tool with templates for social media, email, and developer platforms. Supports credential harvesting with optional tunneling for remote delivery. Popular in awareness training and CTF environments [citation:12].

Phishing page generator with templates for Instagram, Facebook, Google, and other major platforms. Simple CLI workflow for cloning login pages and capturing credentials during authorized simulations [citation:12].

User-friendly phishing tool with a web-based admin panel. Creates realistic login pages and manages campaigns through a browser interface. Suitable for security awareness demonstrations and lab exercises [citation:12].

Python phishing script supporting login, image, and video phishing templates. 100+ templates with OTP support, credential mailing, and URL masking. Multi-platform (Linux, Android) with tunnel options for remote access [citation:5].

The world's most used penetration testing framework. Thousands of exploit modules, payloads, encoders, and post-exploitation tools. `msfconsole` provides a unified interface for scanning, exploiting, and maintaining access across virtually every platform and service [citation:1][citation:6].

Offline command-line interface to the Exploit-DB archive. Search by CVE, kernel version, or application name to find public exploit code. The first stop for mapping a discovered vulnerability to a working PoC [citation:6][citation:9].

The definitive SQL injection exploitation tool. Automates detection and exploitation across 40+ database backends, with tamper scripts for WAF evasion, blind injection support, and full data exfiltration capabilities [citation:3][citation:8][citation:13].

Browser Exploitation Framework. Hooks victim browsers via JavaScript and provides real-time command-and-control. Modules include credential theft, internal network discovery, and social engineering overlays. Pairs naturally with Metasploit for full kill-chain coverage [citation:11].

Python library for rapid exploit development. Simplifies shellcode generation, ROP chain construction, assembly/disassembly, and process interaction. The standard toolkit for binary exploitation and CTF pwn challenges [citation:6][citation:8].

Java deserialization payload generator. Builds gadget chains that trigger RCE when deserialized by vulnerable applications. Supports CommonsCollections, Spring, Groovy, and dozens of other library chains [citation:3][citation:8].

PHP unserialize() payload generator. Equivalent to ysoserial but for PHP applications. Generates gadget chains for frameworks like Laravel, Symfony, and Monolog to exploit PHP object injection vulnerabilities [citation:3][citation:8].

Automated OS command injection exploitation tool. Detects and exploits command injection flaws across web applications, supporting multiple injection techniques and providing an interactive shell upon success [citation:8].

Automated XSS testing framework. Fuzzes parameters for reflected, stored, and DOM-based cross-site scripting, with WAF bypass heuristics and payload encoding options [citation:8].

Local privilege escalation helper. Analyzes the target's kernel version and distribution to suggest known local privilege escalation exploits from Exploit-DB. A post-exploitation staple for Linux targets [citation:1].

CTF framework and exploit development library. Simplifies shellcode generation, ROP chain construction, process interaction, and ELF parsing. The de facto standard for writing binary exploits in Python .

GDB enhanced with pwndbg plugin. Exploitation-centric debugging with heap visualization (`heap`, `bins`, `vis_heap_chunks`), register/stack views, and gadget search. Essential for understanding memory state during exploit development .

Fast gadget finder for ROP exploitation. Searches binaries for useful instruction sequences (`pop rdi; ret`, `syscall`, etc.) across x86, x64, ARM, MIPS, and more. Supports ELF, PE, and Mach-O formats .

Alternative gadget finder with semantic search. Lets you search for gadgets by effect (e.g., "set eax to 0") rather than exact byte patterns. Supports ELF, PE, and Mach-O with architecture-specific gadget databases .

Finds "magic gadgets" in libc that call `execve("/bin/sh", ...)` with a single jump. Eliminates the need for full ROP chains when conditions align. Ruby-based, works on any libc version .

Quickly identifies binary mitigations: NX, PIE, Canary, RELRO, and Fortify. First step before any exploitation — knowing which protections are active determines your entire approach .

Shellphish's comprehensive heap exploitation learning repository. Contains working examples for tcache poisoning, fastbin dup, House of Force, and dozens of other techniques across glibc versions. The reference for modern heap pwn .

Database of libc versions with symbol offsets. Given a leaked address, identify the exact libc version and resolve `system`, `/bin/sh`, and gadget offsets. Essential for remote pwn challenges .

De facto standard coverage-guided fuzzer. Finds memory corruption bugs automatically by mutating inputs and detecting crashes. Supports instrumented and binary-only (QEMU) modes for real-world targets .

Automates pwn challenge setup. Patches binaries to use the provided libc and loader, sets correct interpreter paths, and generates a starter solve script. Saves time on remote-vs-local environment mismatch .

NSA's open-source SRE framework. Built-in decompiler produces readable C-like pseudocode for x86, ARM, MIPS, and more. Includes collaboration server, patch diffing, and scripting via Java/Python. The default choice for budget-conscious teams and beginners [citation:1][citation:2].

Industry-standard disassembler and debugger. Hex-Rays decompiler remains the most accurate for optimized and obfuscated C++ code. FLIRT signatures auto-identify standard library functions, and IDAPython offers deep scripting. Expensive but unmatched for professional malware analysis [citation:1][citation:2].

Modern open-source debugger for Windows 32/64-bit executables. Successor to OllyDbg with a cleaner UI, plugin ecosystem (ScyllaHide for anti-debug bypass), and active development. Essential for Windows malware analysis and crackme solving [citation:2][citation:7].

Unix-philosophy reverse engineering framework. `r2` is the powerful CLI core for disassembly, debugging, and binary patching; Cutter provides a graphical frontend. Lightweight, scriptable, and ideal for automation and headless analysis [citation:1].

Modern reverse engineering platform with a strong Python/C++ API designed for automation. Particularly popular for writing custom analysis passes and plugins. Clean UI, fast analysis, and a loyal following among tool developers and vulnerability researchers [citation:2].

GNU Debugger, the standard for Linux/Mac binary analysis. Enhanced with pwndbg or GEF plugins for heap visualization, register views, and exploit development support. Indispensable for Linux pwn and native code debugging [citation:2][citation:6].

macOS/Linux disassembler and decompiler with a polished interface. Excellent native support for Mach-O binaries and Objective-C. A more affordable alternative to IDA for macOS/iOS reverse engineering [citation:3][citation:7].

.NET assembly decompiler, debugger, and editor. Decompiles IL to C# and allows in-place method patching without recompilation. The go-to tool for analyzing and modifying .NET malware, crackmes, and Unity games [citation:2].

Multi-architecture disassembly framework library. Powers many other tools (radare2, Cutter, etc.) and provides clean APIs for Python, C/C++, and more. The standard building block for custom reverse engineering scripts and tools [citation:6].

File type, compiler, and packer identifier. Instantly reveals what language a binary was written in, whether it's packed/obfuscated, and what protections are present. The fastest first step before opening any unknown sample [citation:3][citation:11].

Open-source hardware tool by Joe Grand for identifying on-chip debug (OCD) interfaces from test points, vias, or component pads. Brute-forces JTAG and UART pinouts on unknown boards, making it the first tool to reach for when you have no documentation .

Complete open-source toolchain for side-channel power analysis and glitching attacks. Captures power traces to extract cryptographic keys, and injects voltage/clock faults to bypass authentication. Includes Python API and extensive Jupyter tutorials .

Universal serial interface tool trusted since 2008. Probes and debugs I2C, SPI, UART, 1-Wire, and JTAG/SWD without writing code. Reads/writes flash and EEPROMs, sniffs buses, and works with flashrom and AVRDUDE. The Swiss army knife of hardware hacking .

FPGA-based open hardware tool for exploring digital interfaces. Reconfigurable logic supports UART, SPI, I2C, JTAG, SWD, and even legacy protocols without extra components. Built-in protection against operator error. Python-based applets make automation trivial .

Professional-grade logic analyzer with intuitive software and built-in protocol decoders. Captures multiple digital signals simultaneously and decodes I2C, SPI, UART, CAN, and more. The industry standard for reverse engineering unknown digital interfaces .

Universal flash chip programmer. Detects, reads, writes, and verifies BIOS/firmware chips via SPI, I2C, and parallel interfaces. Works with external programmers (CH341A, Bus Pirate) or internal chipsets. The standard tool for firmware dumping .

Firmware analysis and extraction tool. Scans binary images for embedded filesystems, compressed archives, and executable code. Automatically extracts squashfs, jffs2, and other firmware components. Essential after dumping a flash chip .

Open On-Chip Debugger. Provides JTAG/SWD debugging and flash programming for ARM, MIPS, RISC-V, and other embedded targets. Works with inexpensive adapters (ST-Link, J-Link, FTDI) to dump memory, set breakpoints, and patch firmware .

Open-source signal analysis suite. Works with dozens of affordable logic analyzers (including clones). Provides protocol decoding, signal visualization, and measurement tools. The free alternative to commercial logic analyzer software .

IoT security testing framework and hardware tool. Provides a unified interface for UART, SPI, I2C, and JTAG exploitation. Includes the Attify Badge (multi-protocol hardware) and Python framework for automating embedded device assessments .

Pocket-sized multi-tool for pentesters and geeks. Reads, copies, and emulates RFID, NFC, sub-GHz radio, iButton, and IR signals. Includes GPIO for wired access. The beginner-friendly entry point to hardware hacking [citation:1][citation:6].

Open-source software-defined radio (SDR) covering 1 MHz to 6 GHz. Transmits and receives RF signals for analyzing wireless protocols, replay attacks, and signal research. A staple for RF-focused hardware hacking [citation:3][citation:6].

The definitive RFID/NFC research tool. Reads, writes, and clones 125kHz and 13.56MHz tags including MIFARE Classic, HID Prox, and EM4100. Standard equipment for physical access assessments [citation:3][citation:6].

Keystroke injection tool disguised as a USB drive. When plugged in, it registers as a keyboard and executes pre-programmed payloads at high speed. The classic physical access attack vector [citation:3][citation:6].

Malicious USB cable with embedded HID attack capability and Wi-Fi remote access. Looks like a normal charging cable but can inject keystrokes, exfiltrate data, and maintain persistence. The evolution of the Rubber Ducky concept [citation:3][citation:6].

Purpose-built wireless auditing platform. Automates rogue AP creation, evil twin attacks, and client deauthentication. Includes a web interface with modules for reconnaissance and credential capture [citation:6].

Open-source Bluetooth monitoring and sniffing platform. Captures and analyzes Bluetooth Classic and BLE traffic. Used for protocol research, device discovery, and Bluetooth security assessments [citation:3][citation:6].

Portable RFID emulator and cloning device. Can emulate multiple cards simultaneously and is used for access control testing, card cloning research, and RFID protocol analysis. More focused than Flipper Zero for pure RFID work [citation:3][citation:6].

Covert USB Ethernet adapter with built-in penetration testing tools. Provides remote access, network tunneling, and man-in-the-middle capabilities when plugged into a target network. Designed for physical drop-and-go scenarios [citation:6].

Sub-1 GHz wireless transceiver for RF sniffing and injection. Works with frequencies below 1 GHz (315/433/868/915 MHz) commonly used by garage doors, sensors, and industrial remotes. Pairs with RFCat for Python-based RF hacking [citation:6].

The first step in any firmware analysis. Scans binary images for embedded filesystems, compressed archives, and executable code. Automatically extracts squashfs, jffs2, and other components, turning a raw firmware dump into an analyzable filesystem tree [citation:5].

Comprehensive firmware analysis framework for Linux-based embedded devices. Automates extraction, static analysis, and vulnerability discovery—including insecure binaries, outdated components, and hard-coded passwords—with a focus on generating actionable reports [citation:10].

Firmware emulation and penetration testing framework. Boots extracted Linux-based firmware in QEMU, allowing dynamic analysis of web interfaces, services, and network behavior without needing the physical device [citation:5].

Lightweight script for exploring extracted firmware images. Searches for sensitive files, hardcoded credentials, certificates, and configuration data across the filesystem. A quick triage tool before deeper analysis [citation:5].

Python-based IoT security testing framework with a plugin architecture. Covers hardware interfaces (UART, SPI, JTAG) and network protocols (MQTT, CoAP, Modbus). Designed for extensibility—write custom test cases for specific devices [citation:8].

Framework for testing and auditing ZigBee and IEEE 802.15.4 networks. Captures, replays, and injects packets to test smart home devices, sensors, and industrial IoT deployments. Pairs with hardware like ApiMote [citation:5].

Exploitation framework specifically for embedded devices and routers. Contains modules for known CVEs, default credentials, and misconfigurations in IoT gateways, cameras, and home routers. The Metasploit of embedded devices .

Printer Exploitation Toolkit. The go-to tool for testing network printers—often overlooked IoT devices with sensitive access. Discovers vulnerabilities, extracts documents, and manipulates printer settings via PJL, PostScript, and PCL .

Passive network behavior auditor for consumer IoT devices. Captures traffic (ARP spoof or hotspot mode) and grades each device A–F based on encryption, open ports, cloud destinations, and idle phone-home behavior. Generates a one-page HTML report—no cloud account needed [citation:3].

Collection of specialized tools for IoT pentesting. Includes ONVIF camera scanner, WS-Discovery, network traffic analyzer, firmware file finder (ffind), and JTAG/SWD probe helper. Bridges the gap between manual hardware probing and automated testing [citation:6][citation:11].

The foundational Python library for CAN bus access. Provides a common interface over dozens of hardware backends with CAN FD support and logging to multiple formats. Almost every other Python-based automotive tool depends on it [citation:15].

Cross-platform Qt-based GUI for CAN bus reverse engineering and analysis. Loads DBC files, supports UDS scanning, and includes fuzzing capabilities. Excellent for visualizing traffic patterns and identifying anomalies in real-time [citation:2][citation:15].

Python-based fuzzing and diagnostic toolkit for automotive security research. Automates UDS service discovery, seed-key brute-forcing, and malformed frame fuzzing. Widely used in academic research for its transparency and modifiability [citation:11][citation:8].

Collection of CLI tools and Python library for CAN bus network analysis. Parses DBC, KCD, SYM, and ARXML database files, decodes and encodes signals, and generates C code from database definitions. Essential for understanding proprietary vehicle protocols [citation:2][citation:4].

Free, open-source ECU seed-key unlocking tool. Works with Bosch, Continental, Delphi, Daimler, and Marquardt ECUs without needing proprietary DLLs. Critical for bypassing security access mechanisms during authorized penetration testing [citation:15][citation:1].

UDS (Unified Diagnostic Services) ECU simulator and fuzzer. Discovers and tests UDS services by simulating ECU responses, allowing security researchers to practice diagnostic command discovery and fuzzing without needing a physical vehicle [citation:15].

Python implementation of the ISO 14229 UDS protocol. Covers session control, security access, data identifiers, and routine control. Plugs into python-can or DoIP transports for both client and server roles in diagnostic testing [citation:15].

Development tool for CAN bus simulation with a drag-and-drop GUI. Simulates CAN signals like ignition status, door states, and reverse gear by interconnecting functional blocks. Useful for testing ECU behavior under controlled conditions without a full vehicle [citation:1][citation:2].

Linux SocketCAN user-space utilities. Includes `candump` for traffic capture, `cansend` for frame injection, and `cangen` for fuzzing. The command-line foundation for any Linux-based automotive security assessment [citation:2][citation:5].

Extendable automotive pentesting framework from Fraunhofer AISEC. Focuses on UDS with DoIP and ISO-TP transports, providing structured logging for reproducible security scans. Designed for professional assessments with clear audit trails [citation:15].

Python-native OT/ICS/SCADA assessment and exploitation framework. 976+ modules covering 50+ protocols (Modbus, S7comm, DNP3, BACnet, OPC UA), 3,300+ ICS CVEs, and MITRE ATT&CK for ICS mapping. SafeMode by default—simulates payloads without sending .

OT network scanner with safe, read-only probes for production environments. Detects unauthenticated industrial protocols (Modbus, DNP3, S7comm, BACnet, IEC 104), default credentials, SNMP community strings, and maps identified devices to ICS-CERT CVEs .

High-performance asynchronous scanner for industrial control systems. Protocol detection for Modbus, S7, DNP3, BACnet, EtherNet/IP, IEC 104, and OPC UA. Device fingerprinting with vendor/product/version identification and CVE correlation .

Highly flexible Modbus tool built for penetration testers. Clone coils and registers from live devices, simulate Modbus servers, proxy requests, send custom function codes, and fuzz with bracketed enumeration or random values .

Python GUI toolkit for OT/ICS/SCADA and IoT device assessment. Supports 23+ industrial protocols (Modbus, S7comm, DNP3, IEC 104, OPC UA, BACnet, Profinet, MQTT), concurrent scanning, default credential testing, and risk scoring aligned with IEC 62443 and NIST SP 800-82 .

Low-interactive ICS/SCADA honeypot for threat intelligence gathering. Simulates industrial control systems (Siemens S7, Modbus, SNMP, IPMI, BACnet) to attract and analyze attacker behavior in a controlled environment .

Community-maintained Suricata IDS rules specifically for SCADA and ICS protocols. Detects malicious Modbus, DNP3, and S7comm traffic patterns, unauthorized function codes, and known attack signatures in OT networks .

Zeek network security monitor plugin for BACnet protocol parsing. Enables deep inspection of building automation traffic, device discovery, and anomaly detection in BAS/BMS environments .

The famous SCADA StrangeLove default/hardcoded password list. Community-maintained database of default credentials for ICS/SCADA vendors and devices. Essential reference for authorized security assessments and hardening .

Universal Protocol Analysis and Simulation framework. JSON-based protocol definition language for simulating industrial and IoT protocols (including Modbus RTU) with state machines and multi-packet responses. Useful for testing device behavior without hardware .

The legendary memory scanner and editor for Windows. Scan for values, trace pointers, disassemble code, and create trainers. Still the de facto standard for game hacking education and single-player modding .

Pure-Python library for reading, writing, and scanning process memory on Windows, Linux, and macOS. Cheat Engine-style workflows in a few lines of code, with an optional GUI app and MCP server for AI-assisted scanning .

Advanced game hacking library for Windows, Linux, and FreeBSD. Provides memory read/write, pattern scanning, hooking, assembly/disassembly, and D3D/OpenGL overlay support. C/C++/Rust/Python bindings .

MCP server that gives AI assistants Cheat Engine-like capabilities through Frida. Memory scanning, value modification, pattern matching, function hooking, and code injection—all driven by natural language .

Bridges Cheat Engine to AI agents via MCP protocol. 43 tools for memory reading, pointer chains, disassembly, RTTI class identification, and hardware breakpoints. Turns days of manual RE into conversational queries .

Open-source memory editor written in C#. Cross-platform (Windows/Linux), with a modern UI and scripting support. A viable open-source alternative to Cheat Engine for memory scanning and modification .

The best open-source Cheat Engine alternative for Linux. scanmem is the CLI scanner; GameConqueror provides a GUI frontend. Locates and modifies variables in running processes for game hacking on Linux .

Reverse engineering tool for Linux heavily inspired by Cheat Engine. Built-in disassembler, memory scanner, and debugger. Handles the same kind of workflows as CE but natively on Linux .

MCP server for AI-driven game modding. Auto-detects game engines (Unity, Unreal, Godot) and exposes binary analysis, hex editing, pattern scanning, and string extraction tools to AI assistants. Free open-core edition .

Python tools for modding FromSoftware games (Dark Souls, Bloodborne, Elden Ring). Edit maps, events, parameters, text, AI scripts, and repack game archives. Game-specific but extremely deep for its niche .

BishopFox's open-source cross-platform adversary emulation framework. Implants support C2 over mTLS, WireGuard, HTTP(S), and DNS, with dynamic compilation and per-binary encryption keys. Includes process injection, token manipulation, and in-memory .NET execution [citation:7].

Educational process injector and shellcode loader. Uses APC injection with indirect syscalls to bypass user-mode hooks, includes anti-debug/sandbox checks, and features a reflective DLL agent with a Flask-based C2 server [citation:3].

Comprehensive EDR/AV bypass arsenal for red team research. 30+ tools covering callstack spoofing, APC injection, shellcode mutation, PE infection, LSASS dumping, and driver signature bypass. Educational PoCs for understanding modern evasion [citation:4].

Crypter, binder, and downloader with native (FASM) and .NET stubs. Features emulator detection, low-entropy packing, process hollowing (RunPE), in-memory .NET execution, and self-deleting stubs. Educational project for understanding packer design .

Comprehensive collection of process injection techniques with C implementations. Covers direct/indirect syscalls, module stomping, PEB walking, thread pool injection, PPID spoofing, and callstack spoofing. Well-documented for defenders and researchers [citation:9].

Low-level PE mutator for native Windows executables (x32/x64). Obfuscates headers and entry point to break signature-based detection and hinder reverse engineering. Useful for understanding PE format manipulation in authorized red team engagements [citation:11].

Packer utility for compressing and obfuscating native compiled code. Protects resources, adds DRM, and packs into an optimized loader. Educational tool for studying executable packing and anti-analysis techniques [citation:11].

Educational toolkit showcasing various Windows code injection techniques. Well-documented examples for security researchers and defenders to explore process injection, memory manipulation, and detection strategies in a controlled environment [citation:8].

Assignment solutions and code from Sektor7's Malware Development Essentials course. Covers shellcode execution, process injection, and basic evasion primitives. A structured learning path for red teamers starting with Windows malware development [citation:2].

C/C++ snippets for Windows malware development. Includes foundational techniques like process enumeration, token manipulation, and injection primitives. Useful for building custom tooling during authorized red team engagements [citation:2].

Static analysis tool for Windows executables. Inspects PE headers, imported libraries, suspicious API calls, entropy, and embedded strings. Integrates VirusTotal lookups for instant reputation checks—often the first tool opened on a suspicious sample [citation:4][citation:7].

Mandiant's obfuscated string solver. Goes beyond basic `strings` by decoding stack strings, tight XOR loops, and other runtime-constructed strings that malware authors use to hide IOCs. Extracts domains, IPs, registry paths, and file paths from packed samples [citation:7][citation:13].

Packer, compiler, and protector identifier. Instantly reveals whether a binary is packed with UPX, Themida, or ASPack—which means static analysis needs to wait until unpacking. Also identifies the language and toolchain used to build the sample [citation:7].

Actively maintained fork of Cuckoo Sandbox. Automated dynamic analysis with full control over anti-evasion logic and infrastructure. Particularly strong at automatically extracting malware configurations (Cobalt Strike beacons, RAT configs, Agent Tesla) from executed samples [citation:6][citation:12].

Interactive cloud sandbox with real-time control. Unlike automated sandboxes, you can click through malware's GUI, interact with fake prompts, and guide execution to reveal behaviour that automated runs miss. Free tier available with size/time limits [citation:6][citation:12].

Deep automated analysis with the most detailed reports among commercial sandboxes. Native MISP/MAEC export makes it ideal for teams feeding results into threat intelligence pipelines. Supports Windows, macOS, and Android samples [citation:6].

Microsoft Sysinternals' real-time monitor for file system, registry, process, and network activity. The manual dynamic analysis workhorse—run malware, then filter Procmon's output to see exactly what files it dropped, what registry keys it modified, and what processes it spawned [citation:5][citation:12].

Network protocol analyzer for capturing and dissecting malware's C2 traffic. See beaconing patterns, DNS queries, HTTP POST exfiltration, and TLS certificate details. Often the only way to extract C2 domains and IPs when the sample doesn't expose them in strings [citation:12].

Memory forensics framework. Analyzes RAM dumps to find malware that never touches disk—process injection, rootkits, and fileless attacks. Can extract injected code, network connections, and loaded modules from a running system's memory snapshot .

NSA's open-source reverse engineering suite. When static and dynamic analysis aren't enough, Ghidra's decompiler turns assembly back into readable C-like pseudocode. Essential for understanding custom malware logic, unpacking routines, and obfuscated algorithms [citation:13].

IBM's industry-standard library for adversarial ML. Provides evasion, poisoning, extraction, and inference attacks plus defenses for red and blue teams. Supports TensorFlow, PyTorch, scikit-learn, and more. The foundational toolkit for ML security research .

Full-lifecycle ML security toolkit with CLI and Python API. Covers adversarial robustness (FGSM/PGD/CW), checkpoint triage (backdoor fingerprints, NaN injection), poisoning detection via gradient divergence, ONNX export validation, and Triton server hardening. Designed for CI/CD integration .

NVIDIA-supported LLM vulnerability scanner. Curated library of 100+ research-backed attack probes covering jailbreaks (DAN), prompt injection, data extraction, and toxic content. Audit-style CLI runs with detailed reports. Best for known-exploit scanning rather than application-specific fuzzing .

AI-powered red teaming for LLM applications. Dynamically generates context-specific attacks for your RAG pipeline, agents, and API integrations—not just static prompt libraries. Native CI/CD integration, OWASP/NIST compliance mapping. Adopted by Shopify, Discord, and Microsoft .

AI application security CLI with SBOM generation, static analysis, behavioral testing, and sandboxed red teaming. Covers prompt injection, tool abuse, and data exfiltration with canary-based high-confidence findings. Exports to SARIF for CI pipelines .

Static analysis scanner for TypeScript, JavaScript, and Python code that calls LLMs or serves MCP tools. Detects prompt injection, sensitive data in prompts/logs, unsafe model output handling, MCP tool-argument command injection, and RAG/vector-store weaknesses .

Benchmark environment for prompt-injection attacks and defenses in tool-using LLM agents. ETH Zurich research framework for evaluating agent security across realistic scenarios including direct/indirect injection and memory poisoning .

Sandbox environment for profiling ML models and serialized files (Pickle, ELF, JavaScript). Uses Docker and Tracee to monitor GPU memory, filesystem interactions, network requests, and security events during execution. Useful for safely analyzing untrusted model artifacts .

Enterprise GenAI security platform with inference defense, red teaming, and observability. Tests, defends, and monitors LLM applications in development and production. Covers prompt injection, data leakage, and agentic risks with policy enforcement .

Palo Alto Networks' unified AI security platform. AI model scanning (supply chain, malicious artifacts), AI red teaming (750+ attacks, agent-driven), runtime protection, and AI agent identity governance. Covers the full lifecycle from development to runtime .

BishopFox's open-source cross-platform adversary emulation framework. Implants support C2 over mTLS, WireGuard, HTTP(S), and DNS with per-binary encryption keys. Includes process injection, token manipulation, .NET execution, and BOF/COFF loaders .

Plugin-based collaborative C2 framework with a web UI. Multi-agent, multi-operator support with modular transport profiles (HTTP/HTTPS, WebSocket, TCP, SMB, DNS) switchable without redeploying agents. Extensive community agent ecosystem .

Scalable adversary emulation framework built for large engagements. Rust-based Imix agent with Pythonic Eldritch DSL for offensive scripting. Stateless server architecture with native GCP integration for cloud deployments .

Advanced WinRM post-exploitation platform for Active Directory. Full ADCS ESC1-ESC17 engine, Kerberos AES roasting, dMSA/BadSuccessor, BloodHound collector, and in-band SOCKS5 proxy over PSRP streams—no binaries on target .

Active Directory offensive framework inspired by NetExec, written in Go. Single binary, no Python dependency. Supports LDAP, SMB v1/v2/v3, and native Kerberos auth with Kerberoast, ASREPRoast, DCSync, and Shadow Credentials .

Modern offensive MS-RPC client for AD enumeration. Go rewrite of Samba's rpcclient with automatic fallbacks (LSAT RID cycling), enriched output, JSON support, and SAMR write operations. Single static binary .

Reverse proxy dashboard for authorized red team phishing emulation. Multi-domain support, proxy management, redirectors, WebSocket support, Telegram alerts, and session filtering. Includes EvilPuppet for browser cookie extraction/injection .

Open-source C2 framework built on NATS. Designed for red/purple team engagements with customizable TCP/WebSocket transport, built-in file storage, and observability into agent activity. Vessel prototype agent for Linux/macOS/Windows .

Automated adversary emulation platform built on MITRE ATT&CK. Ranked top among open-source adversary emulation tools in IEEE research. Automates attack chains with plugins, agents, and ability profiles for repeatable security testing .

Newer C2 framework for red team and adversary simulation. Modular management of compromised hosts, command execution, and evasion techniques. Gaining traction in the offensive security community as a modern alternative .

Red Canary's library of small, focused ATT&CK-mapped tests. Each "atomic" test executes a single technique with cleanup procedures, making it ideal for validating whether a specific detection fires. The entry point for most purple team programs—start here before full attack chains [citation:2][citation:11].

Automated adversary emulation platform built on ATT&CK. Executes full attack chains ("adversary profiles") via lightweight agents, with results scored and exported. Now under Apache Incubator governance, it remains the standard for repeatable purple team exercises [citation:4][citation:5][citation:7].

Cloud-based lab environment builder for purple team exercises. Provisions instrumented AWS/Azure/GCP environments with Splunk, Windows/Linux targets, and optional Kali. Runs Atomic Red Team simulations and forwards telemetry to Splunk for detection validation. Docker Compose first experience in v5 [citation:9].

Meta's open-source attack simulation platform with a YAML-based TTP definition format. Explicitly designed for purple teaming—helps blue teams measure detection capabilities via high-fidelity simulations, and helps red teams package attacks as repeatable tests [citation:13].

Modular CLI framework with dedicated Red/Blue/Purple team workflows. Purple Team mode correlates attack simulations with detection validation—runs a technique, then checks if it appears in system logs. Includes MITRE ATT&CK mapping and professional PDF reporting [citation:1][citation:6].

Python script that converts Atomic Red Team tests into Caldera Stockpile YAML abilities. Bridges the gap between Atomic's extensive test library and Caldera's orchestration framework—get the best of both tools without manual conversion [citation:15].

Threat modeling and purple team tracking platform. Tracks test cases, attack simulations, and detection gaps across exercises. Helps teams move from ad-hoc testing to a measurable, repeatable purple team program with coverage metrics [citation:11].

Open-source SIEM/XDR platform commonly used as the "blue team" side of purple team labs. Collects logs, detects anomalies, and provides the detection telemetry needed to validate whether red team simulations actually triggered alerts [citation:3].

Microsoft Sysinternals' system monitoring tool. Provides detailed Windows event logging (process creation, network connections, file changes) that feeds into SIEM platforms for purple team detection validation. The foundation of Windows telemetry in most purple team labs [citation:3].

Generic signature format for SIEM detection rules. Purple teams write Sigma rules to close detection gaps discovered during exercises, then convert them to Splunk/Elastic/other query languages. The standard language for detection-as-code workflows [citation:11].

Open-source SIEM and XDR platform. Combines log analysis, file integrity monitoring, intrusion detection, vulnerability detection, and configuration assessment across endpoints, cloud workloads, and containers. Maps events to MITRE ATT&CK and supports active response actions .

Endpoint visibility and DFIR platform built on VQL (Velociraptor Query Language). Hunt across thousands of endpoints for IOCs, collect forensic artifacts, and monitor process creation in real-time. Notebooks combine evidence with analyst reasoning for structured investigations .

Open-source incident response platform (TheHive) paired with an analysis/response engine (Cortex). TheHive handles case management, task assignment, and collaboration; Cortex automates observable analysis (IPs, hashes, domains) and response actions at scale .

Open-source threat intelligence platform for collecting, enriching, correlating, and sharing IOCs. Exports to Snort, Suricata, Zeek, and STIX formats. Supports sharing groups, taxonomies, and MITRE ATT&CK galaxies for structured intelligence sharing across teams and communities .

Generic signature format for SIEM detection rules. Vendor-agnostic rules (3000+ in the main repository) that convert to Splunk, Elastic, and other query languages via sigconverter.io or Sigma CLI. The standard for detection-as-code and sharing detection logic across teams .

Linux distro for threat hunting, enterprise security monitoring, and log management. Bundles Suricata, Zeek, Elastic Stack, and OSSEC into a pre-configured platform with unified dashboards and case management. Ideal for SOCs that want a ready-to-deploy NSM stack .

High-performance, multi-threaded IDS/IPS and network security monitoring engine. Deep packet inspection, file extraction, and TLS certificate logging. Handles high-speed networks with detailed logging for forensic analysis and threat detection .

Network analysis framework (formerly Bro) focused on rich transaction logging rather than signature matching. Produces detailed connection logs, DNS queries, HTTP requests, and SSL certificates for forensic investigation and anomaly detection. Pairs well with Suricata for layered network visibility .

Host-based intrusion detection system (HIDS). Log analysis, file integrity checking, rootkit detection, and Windows Registry monitoring across Linux, Windows, macOS, and BSD. Supports automated active response and integrates with SIEM environments .

Lightweight SOAR framework built on Open Policy Agent (OPA). Accepts structured event data via HTTP and applies Rego policies to determine whether to treat events as alerts and what actions to take—enrichment, notification, or remediation. Fills the automation gap between detection and response .

OTRF's collection of hunting playbooks organized by MITRE ATT&CK technique. Each playbook includes a hypothesis, required data sources, analytical queries (Spark/Elastic), and sample datasets for validation. The methodological reference for structured hunting [citation:1].

Hunting ELK platform by Roberto Rodriguez (Cyb3rWard0g). Containerized Elastic Stack + Kafka + Spark environment with pre-loaded attack datasets for practicing hunting queries. The go-to lab for learning threat hunting hands-on [citation:1][citation:5].

OTRF's collection of pre-recorded attack datasets in JSON format (Windows events, Sysmon, etc.). Generated with real red teaming tools in controlled environments. Load into your SIEM/ELK to practice hunting without executing actual attacks [citation:1].

Massive database of keywords, artifacts, and patterns for threat hunting. Organized by offensive tool (Cobalt Strike, Mimikatz, Sliver), ATT&CK technique, and log type. Includes ready-to-use queries for Splunk, Elastic, and Microsoft Sentinel [citation:1].

Endpoint visibility and DFIR platform with VQL query engine. Hunt across thousands of endpoints for IOCs, query live host state, and collect forensic artifacts. Notebook environment combines evidence with analyst reasoning for structured investigations [citation:5][citation:9].

Microsoft's official repository of KQL hunting queries for Defender, Sentinel, and M365. Organized by ATT&CK technique. If your environment is Microsoft-centric, this is the most practical query library available [citation:1].

Automated lab builder for hunting practice. Provisions instrumented environments with Active Directory, runs Atomic Red Team simulations, and collects logs into Splunk. Perfect for generating realistic hunting datasets without production risk [citation:1].

Vendor-agnostic detection rule format. When a hunt uncovers a new TTP, encode it as a Sigma rule and convert to Splunk/Elastic/KQL for automated detection going forward. Closes the loop between ad-hoc hunting and persistent coverage [citation:9].

Bundled NSM distro with Zeek, Suricata, and Elastic Stack pre-configured. Provides a hunting-ready platform with network and host telemetry in one deployable. Ideal for teams that want to start hunting without building a stack from scratch [citation:9].

Local-first IOC investigation console for SOC analysts and hunters. Paste an IP, domain, URL, or hash and fan out to 14 enrichment sources (VirusTotal, Shodan, GreyNoise, AbuseIPDB, etc.) in one workspace. Playbooks for quick triage, phishing, ransomware, and C2 infrastructure [citation:14].

Cisco's classic signature-based NIDS/NIPS. Snort 3 introduced multithreading and improved performance, though it still requires more resources than Suricata under high traffic. Flexible rule language and a massive community rule base make it a reliable choice for traditional signature detection .

Multi-threaded, high-performance NIDS/NIPS. Independent studies show Suricata consistently outperforms Snort in scalability, resource efficiency, and detection accuracy under high traffic—making it the better choice for most modern deployments. Supports IPS mode, file extraction, and TLS logging .

Network analysis framework (formerly Bro) focused on rich transaction logging rather than signature matching. Excels at anomaly detection and forensic investigation, with detailed connection logs, DNS queries, and HTTP requests. Less effective as a pure signature-based IDS, but pairs perfectly with Suricata for layered defense .

The most feature-complete open-source HIDS. Agent-based monitoring for file integrity, log analysis, rootkit detection, vulnerability detection, and active response across Windows, Linux, macOS, and Unix. Fork of OSSEC with a modern dashboard and compliance mappings. Best free HIDS for most teams .

The original open-source HIDS, actively maintained again under Atomicorp. Lightweight agent with a small footprint, simple architecture, and a long track record. Recent releases added Windows file attribute checks and JSON alerts. No built-in dashboard—pair it with a SIEM for visualization .

Lightweight intrusion prevention tool for Linux. Monitors log files for repeated failed login attempts and temporarily bans offending IPs via iptables or firewalld. Pre-built filters for SSH, Apache, and NGINX make it the fastest way to stop brute-force attacks with minimal setup .

Advanced Intrusion Detection Environment. Records a baseline of file hashes, permissions, and owners, then reports any changes. Simple, light, and auditable—ideal for compliance requirements (PCI DSS 11.5, NIST SI-7) where you need to prove critical system files are monitored. No real-time alerts; runs on schedule .

Linux distro bundling Suricata, Zeek, Elastic Stack, and OSSEC into a pre-configured NSM platform. Provides unified dashboards for intrusion detection, network security monitoring, and log management. The fastest path to a full IDS/NSM stack without building each component manually .

Wireless IDS and packet sniffer. Detects rogue access points, unauthorized wireless connections, and wireless attacks. Operates passively without actively interacting with the network, reducing detection risk. Complements wired NIDS by covering the wireless attack surface .

CNCF-graduated runtime security engine for containers and Kubernetes. Detects anomalous behavior (shell spawning in containers, unexpected outbound connections, sensitive file writes) via kernel syscall monitoring (eBPF or kernel module). The container-native IDS standard .

The closest free SIEM to production readiness in 2026 [citation:4]. Agent-based platform combining log analysis, file integrity monitoring, vulnerability detection, and active response. Ships with PCI DSS, HIPAA, NIST 800-53, and GDPR compliance mappings out of the box [citation:12]. Best for endpoint-centric monitoring and SMBs wanting one platform [citation:8][citation:15].

Elasticsearch + Kibana + Beats stack with a security app on top. Best query language in the group and a large ecosystem [citation:8]. Free tier includes prebuilt ATT&CK-mapped detection rules, but ML, case management, and advanced analytics are gated to paid tiers [citation:8][citation:15]. A platform, not a product—requires engineering effort to operate [citation:12].

Apache 2.0 fork of Elasticsearch with a Sigma-native security plugin. Ships roughly 2,200 pre-converted Sigma rules with a free alerting engine—no license gating on detection [citation:8]. No built-in endpoint agent (you bring Beats or Wazuh agent) and a smaller ecosystem, but the most unrestricted Sigma support for free [citation:8][citation:15].

Log management platform with a simpler learning curve than ELK. Stream-based routing lets you segment logs by source or sensitivity with different retention and access policies per stream [citation:13]. Sigma rules, anomaly detection, and case management are paid features—if security operations is your primary use case, factor that into cost [citation:13].

Linux distro bundling Suricata, Zeek, Elastic Stack, and OSSEC into a pre-configured NSM/SIEM platform. Unified dashboards for intrusion detection, network security monitoring, and log management [citation:1]. Ideal for SOCs wanting a ready-to-deploy stack without assembling each component. Note: license restricts offering it as a managed service [citation:15].

Open-source SIEM with a unique strength: bundled OpenVAS vulnerability scanner allows correlation of IDS alerts (Snort/Suricata) with actual vulnerability scan results [citation:1]. However, the open-source version lacks reporting, real-time alerting console, and log tagging—features available only in the commercial version [citation:1].

Fully open-source (AGPL-3.0) SIEM with built-in compliance reports, active response, and a complete detect-respond-report loop [citation:15]. Positioned as needing less assembly than Wazuh or Elastic, making it attractive for teams without dedicated platform engineers. A genuine open-source alternative to commercial SIEMs [citation:15].

Server-side log processing pipeline for the Elastic Stack. Collects, parses, transforms, and routes logs from multiple sources to Elasticsearch or other destinations. A single pipeline can write to Elasticsearch, S3, and Kafka simultaneously [citation:2]. Not a SIEM itself—it's the ingestion layer that feeds one.

Lightweight log forwarder (roughly 4 MB) from the CNCF ecosystem. The practical choice over Fluentd for Kubernetes deployments—runs as a DaemonSet on every node with minimal resource footprint [citation:2]. Supports multiline parsing, Kubernetes metadata injection, and backpressure handling. A collector, not an analysis platform [citation:2].

Log management program with strong structured processing. Normalizes logs into consistent formats using built-in parsers before forwarding to Kafka, Elasticsearch, or databases [citation:2]. Native log rotation and archiving. Best for environments needing reliable syslog collection with complex routing requirements.

FreeBSD-based firewall and routing platform, forked from pfSense in 2015. Cleaner interface, six-month release cycle with weekly security updates, and native WireGuard integration. Includes Suricata IDS/IPS, VLAN segmentation, and API-driven automation. Fully open source (BSD), EU-based maintainer [citation:7][citation:13].

Most widely deployed open-source firewall, battle-tested since 2006. Largest community and documentation pool. Note: pfSense CE is open source, but pfSense Plus (home tier) is closed source. Some features gated to Netgate hardware tiers. Best for teams wanting established stability and extensive third-party guides [citation:7][citation:13].

Security-first Linux firewall distribution with a hardened-by-default philosophy. Color-coded trust zones (LAN, DMZ, wireless, internet) contain untrusted devices by default rather than relying on rules. Lighter and simpler than OPNsense/pfSense—ideal for small teams or environments where minimal attack surface matters most [citation:1][citation:7].

Open-source network operating system with enterprise-grade routing and firewall capabilities. Unlike appliance-style firewalls, VyOS uses a CLI configuration model similar to Juniper or Cisco—no web GUI. Built for network engineers who need routing protocols (BGP, OSPF) alongside stateful firewalling [citation:7].

The classic open-source WAF engine, battle-tested in shared hosting for years. Works with Apache (built-in) and NGINX. Uses OWASP Core Rule Set (CRS). Important caveat: Trustwave ended commercial support in July 2024, though community patches continue (v3.0.15/16 in 2026). Default CRS has 10-17.5% false positive rate—requires tuning discipline [citation:8][citation:14].

Modern Go-based WAF engine, ModSecurity rule-compatible. 20-40% higher throughput than ModSecurity in benchmarks. Native integration with Envoy, Istio, and Kubernetes. Where active development is happening now—for new deployments, Coraza is the safer long-term bet over ModSecurity [citation:8][citation:14].

Next-gen open-source WAF built on NGINX, "secure by default" philosophy. One Docker command gets you WAF + ModSecurity + CrowdSec + Let's Encrypt + web UI. Integrates with Linux, Docker, Swarm, and Kubernetes. Best for teams wanting a full WAF stack without manual assembly [citation:14].

ML-based WAF that detects novel attacks without signature updates. Deploys as add-on to Kubernetes Ingress, NGINX, Envoy, and API Gateways. Eliminates traditional CRS rule maintenance and exception handling—but ML-based WAFs are less battle-tested than CRS-based engines [citation:14].

NGINX-specific WAF using a positive security model—defines what normal traffic looks like and blocks everything else. Catches novel attacks that pattern-based WAFs miss. Requires more initial tuning to avoid blocking legitimate requests. Maintained as a focused, founder-led project since 2011. No signature dependency [citation:14].

Linux-based UTM appliance OS that turns any x86 machine into a gateway firewall. Bundles stateful firewall, WAF (ModSecurity), web antivirus (ClamAV), URL filtering, VPN (StrongSwan), and Squid cache. Web-based admin, no CLI required. Under an hour to deploy. Best for small businesses/schools wanting all-in-one perimeter security .

The leading open-source SIEM/XDR platform with strong endpoint capabilities. Agent-based monitoring for file integrity, log analysis, vulnerability detection, rootkit detection, and active response across Windows, Linux, macOS, and Unix. Includes CIS benchmark assessment and compliance mappings (PCI DSS, HIPAA, GDPR) out of the box [citation:1][citation:3][citation:14].

Endpoint visibility and DFIR platform built on VQL (Velociraptor Query Language). Hunt across thousands of endpoints for IOCs, collect forensic artifacts, and query live host state. Lighter than Wazuh (10-20 MB RAM per agent) and excels at incident response scoping, though it's not a real-time continuous detection engine [citation:8][citation:12].

Turns the operating system into a SQL-queryable database. Query running processes, listening ports, logged-in users, installed software, and startup items across Linux, macOS, and Windows. Extremely flexible for fleet-wide visibility and hunting, but needs a fleet manager (Fleet) and SIEM for alerting—it's an instrument, not a detection system [citation:3][citation:7].

The original open-source HIDS, actively maintained again under Atomicorp. Log analysis, file integrity checking, rootkit detection, and active response across Windows, Linux, macOS, and BSD. Small footprint and simple architecture. No built-in dashboard—pair it with a SIEM for visualization [citation:1][citation:3].

Comodo/Xcitium's open-source EDR platform. Collects telemetry on process, network, and file activity with a security event visualizer that maps process lineage. Dockerized stack bundles search and visualization. Good for teams wanting an EDR-style telemetry collector without Wazuh's broader SIEM footprint [citation:1][citation:4][citation:11].

The standard open-source antivirus engine for Linux. Detects trojans, viruses, and malware in files, archives, and emails. Maintained by Cisco Talos with frequent signature updates. Best used for scanning file uploads and mail gateways rather than real-time desktop protection—it's not a memory scanner or behavioral EDR [citation:2][citation:5][citation:9].

Modern, collective-security-based intrusion prevention. Reads logs (SSH, Nginx, etc.), detects suspicious behavior, and bans IPs via firewall bouncers. Shares threat intelligence with the community—if 500 admins see the same malicious IP, it's banned globally. Seen as the successor to Fail2Ban for self-hosted environments [citation:9].

Advanced Intrusion Detection Environment. Records a baseline of file hashes, permissions, and owners, then reports changes on scheduled scans. Simple and auditable for compliance (PCI DSS 11.5, NIST SI-7). Limitation: no real-time alerts and no attribution—you learn what changed, not who changed it [citation:3][citation:10].

CNCF-graduated runtime security engine for Linux servers and containers. Uses eBPF to watch kernel events against rules in real-time—a shell spawned in a production container or an unexpected sensitive file read becomes an alert with pod and image context. Linux-only, rules need tuning per workload [citation:3].

Rootkit hunter for Linux/Unix. Checks for rootkits, backdoors, and local exploits by comparing file hashes against known-good databases, scanning for hidden files, and checking suspicious kernel modules. Complements AIDE and ClamAV for a layered endpoint defense, though it's scan-based rather than real-time [citation:5].

The most widely adopted open-source incident response platform. Multi-analyst case collaboration, task management, observable tracking, and MISP integration for threat intelligence. AGPL-licensed and deployed by CERT teams worldwide . Note: TheHive 5 is now commercial from StrangeBee; the open-source version is TheHive 4 .

Collaborative incident response platform designed for analysts to share technical findings during investigations. Receives alerts from SIEM and other sources, triages and links them to cases. Pre-built integrations with VirusTotal, MISP, WebHooks, and IntelOwl. Full REST API for automation .

Rapid7's open-source DFIR platform for endpoint visibility at scale. VQL queries collect forensic artifacts (processes, network connections, registry keys, files) across thousands of endpoints simultaneously. Hunts, notebooks, and Sigma rule support make it the go-to tool for incident scoping and evidence collection .

Google's remote live forensics framework. Collects data from compromised machines at scale—files, registry, network traffic, system logs, and memory. Built for enterprise environments with thousands of endpoints. Complements Velociraptor; GRR is more focused on live response, Velociraptor on forensic collection and hunting .

SANS' pre-built forensic workstation VM. Bundles The Sleuth Kit, Volatility, Rekall, Plaso/Log2Timeline, and dozens of other DFIR tools into a curated Ubuntu environment. Saves hours of tool installation and configuration—spin up the VM and start investigating .

Memory forensics framework for incident response. Analyzes RAM dumps to find malware that never touches disk—process injection, rootkits, and fileless attacks. Extracts running processes, network connections, loaded modules, and injected code from memory snapshots. Essential when disk-based forensics finds nothing .

Open-source SIEM/XDR with active response capabilities. For incident response, Wazuh provides the detection layer—file integrity monitoring, log analysis, rootkit detection, and vulnerability alerts that trigger investigations. Active response can automatically isolate compromised hosts during containment .

TheHive's companion analysis engine. Automates bulk observable analysis (IPs, hashes, domains) through a REST API. Runs analyzers for VirusTotal, MISP, Shodan, and dozens of other services, enriching observables at scale. Pairs with TheHive for end-to-end case management + automated triage .

Open-source threat intelligence platform tightly integrated with TheHive and IRIS. During incident response, MISP provides IOC correlation—check if observables from the current incident have been seen before, and share indicators with the community. Exports to Snort, Suricata, and STIX formats .

Local CLI toolkit for investigative workflows. IOC extraction with defanging, evidence hashing with chain-of-custody, timeline processing, filesystem baselining, and local case management. Exports to STIX 2.1, MISP, GeoJSON, and KML. Lightweight and self-contained—useful for field triage and small-team investigations .

The most widely used open-source disk forensics platform. GUI frontend for The Sleuth Kit with modules for file carving, keyword search, timeline analysis, hash matching, web artifacts, and email parsing. Used in real investigations and accepted in court proceedings worldwide . Best starting point for beginners in disk forensics .

The command-line library powering Autopsy. Individual tools for every forensic task: `fls` lists files including deleted ones, `icat` extracts by inode, `mmls` shows partition tables, `tsk_recover` recovers deleted files. Many teams run TSK underneath Autopsy rather than standing alone—essential for automation and scripting .

The standard framework for memory forensics. Python 3 rewrite with modular plugin architecture, supporting Windows, Linux, and macOS. Essential plugins: `windows.pslist` for visible/hidden processes, `windows.malfind` for code injection detection, `windows.netscan` for active connections, `windows.cmdline` for process arguments . First tool to run when you have a memory dump .

Kroll Artifact Parser and Extractor. The fastest way to triage a Windows system—collects critical artifacts (MFT, event logs, prefetch, registry hives, browser data) in minutes rather than processing a full disk image. Targets define what to collect; modules define how to process. Ideal for first-responder field triage . Note: binary is Kroll commercial, but KapeFiles configs are open source .

Super-timeline engine. Extracts timestamps from dozens of sources (event logs, registry, filesystem, browser, prefetch) and unifies them into a single chronological timeline. Essential for reconstructing the sequence of events during an incident—who did what, when. Often paired with Timesketch for collaborative analysis .

De facto standard collection of Windows artifact parsers. `MFTECmd` parses Master File Table with all 8 timestamps, `PECmd` extracts prefetch execution evidence, `EvtxECmd` parses event logs, `RECmd` handles registry hives, `AmcacheParser` and `AppCompatCacheParser` recover program execution history. All CLI with CSV output for further processing .

The gold standard for network traffic capture and analysis. For forensics, dissects PCAP files to reconstruct HTTP sessions, extract transferred files, identify C2 beaconing patterns, and analyze DNS queries. Often the only way to recover evidence of data exfiltration or command-and-control communication .

Large-scale full packet capture and network forensics platform. Indexes raw PCAP traffic and provides a web interface for querying and browsing sessions across multi-cluster architectures. Unlike Wireshark's per-file analysis, Arkime handles enterprise-scale network forensics—searching months of captured traffic for specific indicators .

Companion parsers for mobile forensics. ALEAPP parses Android logs, events, and protobuf data; iLEAPP parses iOS logs, events, and plists. Both extract and organize forensic artifacts from mobile device dumps into human-readable reports. Free and actively maintained by the mobile forensics community .

Fast, easy disk imaging tool for creating forensic copies. GUI-based with support for E01, AFF, and raw formats. Verifies image integrity with MD5/SHA hashes and maintains acquisition logs. The first step in disk forensics—create a bit-for-bit copy before any analysis begins, preserving the original evidence .

Free open-source disk encryption software for Windows, macOS, and Linux. Successor to TrueCrypt with significantly stronger key derivation (200,000+ iterations for system partitions vs TrueCrypt's 1,000). Supports hidden volumes for plausible deniability and full-disk pre-boot authentication. Actively maintained with Argon2id support in recent releases .

The standard Linux disk encryption utility based on dm-crypt kernel module. LUKS (Linux Unified Key Setup) is the de facto standard for Linux disk encryption, providing a standardized on-disk format with multiple password support. Also supports TrueCrypt/VeraCrypt, BitLocker, and FileVault2 formats. Includes veritysetup and integritysetup for block integrity checking .

GCHQ's "Cyber Swiss Army Knife"—a web app for encryption, encoding, compression, and data analysis. Drag-and-drop operations for AES, RSA, Base64, hex, XOR, hashing, and hundreds of other transformations. Chaining operations lets you build complex recipes without writing code. The fastest way to decode or encrypt data during investigations .

Free command-line tool for testing TLS/SSL encryption on any server port. Checks supported ciphers, protocols (SSLv2 through TLS 1.3), certificate validity, and recent cryptographic flaws (Heartbleed, ROBOT, etc.). No dependencies beyond bash and openssl—runs anywhere .

Modern, easy-to-use software library for encryption, decryption, signatures, and password hashing. Fork of NaCl with a compatible API and extensive documentation. The recommended choice for developers who need strong crypto without the pitfalls of low-level libraries. Bindings available for Python, Ruby, PHP, and more .

The ubiquitous cryptography toolkit. Command-line interface for generating keys, creating CSRs, signing certificates, encrypting files, and testing TLS connections. The `openssl s_client` command is indispensable for debugging TLS handshakes. Also provides the libcrypto library used by countless applications .

Complete implementation of the OpenPGP standard for encrypting and signing data and communications. The standard for email encryption and file signing. Supports key management, detached signatures, and integration with mail clients. Essential for anyone working with encrypted communications or package verification .

Dropbox's realistic password strength estimator. Unlike simple complexity checkers, zxcvbn recognizes 30,000 common passwords, names, keyboard patterns (qwerty), repeats (aaa), sequences (abcd), and l33t speak. Provides actionable feedback ("add another word") rather than arbitrary rules. Used by many password managers and signup forms .

Kubernetes certificate management controller. Automates issuance and renewal of TLS certificates from Let's Encrypt, HashiCorp Vault, Venafi, or internal CAs. Introduces certificates as first-class Kubernetes resources, enabling developers to self-serve certificates without manual intervention. The standard for Kubernetes TLS automation .

Feature-rich hex editor designed for reverse engineers and security researchers. Pattern language for parsing binary structures, built-in cryptography operations (hashing, encryption, decryption), and a modern UI that's easy on the eyes during long analysis sessions. Essential for examining encrypted files, firmware, and binary data at the byte level .

Maximum anonymity through the Tor network. Isolates each website you visit so third-party trackers can't follow you, and clears cookies/history automatically. Encrypts traffic and routes it through three relays—anyone monitoring your connection only sees that you're using Tor. Also provides access to .onion sites that are harder to censor [citation:1].

Portable operating system that boots from a USB stick and leaves no traces on the computer when shut down. Routes all internet traffic through Tor by default. Ships with a curated toolkit for sensitive work and secure communication, all pre-configured with safe defaults. Used by journalists, activists, and domestic violence survivors to avoid surveillance [citation:3].

Privacy-focused OS that runs inside a virtual machine. Uses a two-VM architecture: a Gateway VM that forces all traffic through Tor, and a Workstation VM that can't leak your real IP even if compromised. Runs on Windows, Linux, macOS, and Qubes. Stronger isolation than Tails for daily use, but requires more setup [citation:4].

Security-oriented operating system using virtualization for "security by compartmentalization." Each activity (work, banking, personal) runs in a separate VM, so a compromise in one doesn't affect the others. Supports Linux and Windows VMs. The gold standard for high-security desktop use, though it requires more powerful hardware and a learning curve [citation:5][citation:11].

Gold standard for private messaging with end-to-end encryption. Open-source, non-profit, and doesn't collect metadata about who you talk to or when. Supports disappearing messages, voice/video calls, and group chats. The default recommendation for anyone serious about private communication [citation:1].

No-logs VPN with anonymous account numbers—no email required to sign up. Accepts cash and cryptocurrency payments. Independently audited, with a transparent ownership structure. Flat €5/month pricing, no confusing tiers. The privacy community's most trusted commercial VPN [citation:1].

Open-source password manager with zero-knowledge encryption. Your vault is encrypted locally before syncing, so even Bitwarden can't read your passwords. Free tier covers unlimited passwords and devices. Self-hosting option available for those who want full control. The most recommended free password manager in the privacy community [citation:1][citation:7].

Offline, cross-platform password manager. Your encrypted database lives entirely on your device—no cloud, no sync service, no third party. Full control over where your vault is stored (USB, NAS, self-hosted cloud). For users who don't trust any online service with their credentials, this is the answer [citation:1][citation:7].

Efficient wide-spectrum content blocker. More than an ad blocker—it blocks trackers, malware domains, and fingerprinting scripts by default with minimal CPU/memory overhead. Available for Firefox and Chromium-based browsers. The single most impactful browser extension for everyday privacy [citation:1][citation:7].

Share files and host temporary sites through Tor onion services. No third-party server involved—your computer becomes the server, and the receiver connects directly through Tor. Supports anonymous drop boxes, chat, and website hosting. Ideal for sharing sensitive files without trusting cloud providers [citation:7].

Maximum anonymity through the Tor network. Isolates each website you visit so third-party trackers can't follow you, and clears cookies/history automatically. Encrypts traffic and routes it through three relays—anyone monitoring your connection only sees that you're using Tor. Also provides access to .onion sites that are harder to censor [citation:1].

Portable operating system that boots from a USB stick and leaves no traces on the computer when shut down. Routes all internet traffic through Tor by default. Ships with a curated toolkit for sensitive work and secure communication, all pre-configured with safe defaults. Used by journalists, activists, and domestic violence survivors to avoid surveillance [citation:3].

Privacy-focused OS that runs inside a virtual machine. Uses a two-VM architecture: a Gateway VM that forces all traffic through Tor, and a Workstation VM that can't leak your real IP even if compromised. Runs on Windows, Linux, macOS, and Qubes. Stronger isolation than Tails for daily use, but requires more setup [citation:4].

Security-oriented operating system using virtualization for "security by compartmentalization." Each activity (work, banking, personal) runs in a separate VM, so a compromise in one doesn't affect the others. Supports Linux and Windows VMs. The gold standard for high-security desktop use, though it requires more powerful hardware and a learning curve [citation:5][citation:11].

Gold standard for private messaging with end-to-end encryption. Open-source, non-profit, and doesn't collect metadata about who you talk to or when. Supports disappearing messages, voice/video calls, and group chats. The default recommendation for anyone serious about private communication [citation:1].

No-logs VPN with anonymous account numbers—no email required to sign up. Accepts cash and cryptocurrency payments. Independently audited, with a transparent ownership structure. Flat €5/month pricing, no confusing tiers. The privacy community's most trusted commercial VPN [citation:1].

Open-source password manager with zero-knowledge encryption. Your vault is encrypted locally before syncing, so even Bitwarden can't read your passwords. Free tier covers unlimited passwords and devices. Self-hosting option available for those who want full control. The most recommended free password manager in the privacy community [citation:1][citation:7].

Offline, cross-platform password manager. Your encrypted database lives entirely on your device—no cloud, no sync service, no third party. Full control over where your vault is stored (USB, NAS, self-hosted cloud). For users who don't trust any online service with their credentials, this is the answer [citation:1][citation:7].

Efficient wide-spectrum content blocker. More than an ad blocker—it blocks trackers, malware domains, and fingerprinting scripts by default with minimal CPU/memory overhead. Available for Firefox and Chromium-based browsers. The single most impactful browser extension for everyday privacy [citation:1][citation:7].

Share files and host temporary sites through Tor onion services. No third-party server involved—your computer becomes the server, and the receiver connects directly through Tor. Supports anonymous drop boxes, chat, and website hosting. Ideal for sharing sensitive files without trusting cloud providers [citation:7].

Modern, code-first load testing tool written in Go and scripted in JavaScript. Single binary with no runtime dependencies, making it ideal for CI/CD pipelines. Built-in thresholds with non-zero exit codes allow automated pass/fail gating. Extremely low memory per virtual user compared to JVM-based tools. Best for developer-led teams testing HTTP/gRPC APIs [citation:10][citation:11].

The most widely adopted open-source load testing tool for over two decades. GUI-based test plan creation with broad protocol support: HTTP, JDBC, JMS, FTP, LDAP, SMTP, and more. Distributed testing via controller/injector mode. Memory footprint is high (one JVM thread per virtual user) and GUI mode is not recommended for actual load runs—use CLI mode instead [citation:2][citation:5][citation:11].

Python-native load testing framework with a web UI. Define user behavior as Python classes—full language available for complex auth flows and custom protocols. Distributed mode (master + workers) scales to hundreds of thousands of users. Recent versions with asyncio/uvloop achieve 100,000+ concurrent connections on a single machine. Best when scenarios require real Python logic [citation:4][citation:9].

High-performance load testing framework based on Scala, Akka, and Netty. Actor-based model provides superior resource efficiency for high-concurrency scenarios (100,000+ users) compared to thread-per-user tools. Generates detailed HTML reports out of the box. Steeper learning curve due to Scala DSL, but excellent for JVM teams needing code-first precision [citation:2][citation:5][citation:9].

Modern HTTP benchmarking tools written in C. Extremely high throughput with low resource usage. wrk2 is a variant that maintains constant throughput while recording correct latency percentiles—essential for accurate P99 measurements under load. Lua scripting for custom request generation. Single-shot benchmark focus: ideal for quick stress tests lasting seconds to minutes, not long-running scenarios [citation:6].

Versatile HTTP load testing tool and Go library. Maintains a precise constant request rate, making it ideal for controlled stress testing. Supports multiple target endpoints, custom headers, and request bodies. Built-in Prometheus exporter allows real-time metrics collection during tests. Simple CLI design with shell script composition for complex scenarios [citation:6].

Modern load testing toolkit built on Node.js. YAML-first scenario definition with JavaScript escape hatches for custom logic. Strong WebSocket and Socket.io support out of the box. Generates HTML reports by default. Best for Node.js teams wanting tests in the same ecosystem, or when stakeholders need to read/review test scenarios without learning code [citation:10].

High-concurrency distributed load testing tool written in Erlang. Erlang's concurrency model allows simulating millions of simultaneous users in cluster configurations. Supports HTTP, WebDAV, SOAP, PostgreSQL, MySQL, LDAP, MQTT, AMQP, XMPP, and more. Built-in proxy recorder converts browser actions to XML scripts. Real-time web dashboard and HTML reports .

Application-layer DoS testing tool focused on slow HTTP attacks (Slowloris, Slow POST, Slow Read). These attacks exploit servers by holding connections open with partial requests—a class of stress test that generic load generators miss. Essential for validating reverse proxy timeouts, connection limits, and HTTP server hardening [citation:4].

HTTP/2 and HTTP/3 load generator from the nghttp2 project. Generic HTTP/1.1 tools won't exercise HTTP/2-specific code paths—h2load does. Essential for stress testing modern servers after HTTP/2 stack upgrades, or when validating patches for protocol-level DoS issues like Rapid Reset. Pairs with h2spec for conformance testing [citation:4].

The reference implementation of NIST's SCAP standard for automated compliance checking. Scans Linux systems against SCAP Security Guide profiles (STIG, CIS, PCI-DSS) using XCCDF and OVAL definitions. Used by Oracle Linux, RHEL, and Debian for compliance automation. The most standards-compliant option for Linux hardening audits [citation:4][citation:12].

Battle-tested security auditing and hardening tool for Linux, macOS, and Unix. Agentless with no installation required—just run the shell script. Performs hundreds of individual security checks and maps findings to HIPAA, ISO 27001, and PCI DSS compliance requirements. 14,000+ GitHub stars and 11+ years of active development [citation:13][citation:15].

The most comprehensive open-source cloud security and compliance scanner. Covers AWS, GCP, and Azure with hundreds of controls mapped to CIS, NIST 800, NIST CSF, PCI-DSS, GDPR, HIPAA, SOC2, and FedRAMP. Also supports incident response, continuous monitoring, and forensics readiness .

Self-hostable GRC platform built for engineering and security teams. Full lifecycle coverage: risk management, controls, vendor risk, data privacy (DPIA/TIA), access reviews, and audit programs. Exposes 270+ MCP tools so LLM agents can automate compliance tasks. Web console, CLI, GraphQL, and n8n integration included [citation:11].

Open-source compliance and security scanner for cloud and Linux infrastructure. Generates audit-ready evidence packs for SOC 2, ISO 27001, and CIS benchmarks. Supports DigitalOcean and Linux (via SSH) collectors with a modular check registry. MIT licensed, written in Go [citation:1][citation:6].

Compliance automation that scans, remediates, and generates audit-ready evidence. Unlike Vanta/Drata which only collect evidence, ComplianceOS auto-fixes violations. Covers SOC 2, ISO 27001:2022, GDPR, HIPAA, and PCI DSS v4.0. Scans codebases, infrastructure, configs, and APIs. Apache 2.0, no signup required [citation:10].

Repository security auditor with static analysis, secret detection, and supply-chain intelligence. Maps findings to OWASP, PCI DSS, ISO 27001, SOC 2, GDPR, HIPAA, and NIST SSDF as supporting evidence. Read-only—never executes audited code. Includes a neural-map GUI and CI-friendly SARIF output [citation:14].

Enterprise-grade GRC management system built with Django. Multi-role user system (Admin, Manager, Employee, Auditor), policy versioning, risk scoring, compliance checklists, and interactive dashboards. Includes 2FA and comprehensive audit logs. SQLite default, PostgreSQL recommended for production [citation:3].

Linux security audit tool with web security checks. Generates HTML/JSON reports, supports scheduled scanning, trend tracking, and notifications (Email, Slack, webhook). Docker-ready with a single `pip install`. Useful for continuous compliance monitoring on Linux servers [citation:5].

Open-source GRC tool with gap analysis, risk statements, evidence collection, web UI, and compliance automation. Early-stage (v0.10.4) but covers the core GRC workflow in a single package. A lighter alternative to Probo or CompliEdge for small teams starting their compliance journey [citation:8].

Open-source one-stop-shop for GRC and risk management. Supports 30+ frameworks including NIST CSF, ISO 27001, SOC2, PCI DSS, NIS2, CMMC, and GDPR. Decoupling principle lets you reuse assessments across frameworks and evaluate one scope against multiple standards simultaneously. Modern Python/Django backend with API-first design .

Self-hostable GRC platform with full risk management lifecycle: risk register, inherent/residual scoring, treatment strategies (mitigate, accept, avoid, transfer), and threat-based assessments. 270+ MCP tools expose every entity to LLM agents, enabling AI-driven risk workflows. Web console, CLI, GraphQL, and n8n integration .

Python implementation of the FAIR (Factor Analysis of Information Risk) model. Automates Monte Carlo risk simulations with a simple API—define Loss Event Frequency and Loss Magnitude distributions, then calculate risk exposure. Supports metamodels for combining multiple risk scenarios and generates HTML reports. Maintained by Hive Systems .

FAIR cyber risk quantification toolkit with Monte Carlo simulation, LEF/LM modeling, portfolio aggregation, and IRIS 2025 benchmarks. Includes TEF Estimator (threat event frequency with vector decomposition) and agent-based control simulation (FAIR-CAM). Non-commercial license .

Simple, intuitive risk management platform trusted by hundreds of companies. Quick deployment and easy-to-use interface for risk registers, mitigation planning, and compliance tracking. Particularly popular in healthcare, government, and technology sectors. Good starting point for teams new to formal risk management .

Comprehensive GRC platform with strong risk, control, and policy management. Mature and widely adopted, with 10 releases in the past year. Best for organizations tackling multiple frameworks simultaneously. Less flexible on custom workflows and modern integrations compared to newer platforms like CISO Assistant .

Simple interface with quick framework imports. Designed for small businesses and teams new to GRC—minimal setup, straightforward risk and compliance tracking. Lacks advanced workflow and notification features of larger platforms, but covers the basics without complexity .

Automated NIST SP 800-53 Rev. 5 control assessment for small and mid-sized organizations. Streamlit dashboard with configurable risk scoring thresholds, family coverage indicators, and guided configuration. Generates audit-ready reports with methodology explanations. Addresses the gap where enterprise GRC tools are too complex for smaller teams .

Third-party vendor risk monitoring system with real-time scoring. AI-simulated risk scores recalculated dynamically, live governance dashboard, automated threshold alerts, and immutable audit trail. Role-based access for admins and vendors. Prototype stage—risk scores are simulated, not from live feeds yet .

Third-party/vendor risk questionnaires with SBOM cross-reference. Scores security questionnaires (weighted controls, inherent-risk multiplier), matches SBOMs against a bundled 262k-record vulnerability database (offline-capable), and produces combined vendor verdicts. CI-friendly exit codes for procurement gates. Self-hostable, MCP-native .

The most widely adopted open-source phishing simulation platform. Self-hosted, MIT-licensed, with a web UI for template editing, campaign scheduling, landing pages, and real-time click/submission tracking. REST API for automation. Limitation: it's a phishing rig, not a training LMS—you bring the awareness content separately [citation:4][citation:11].

Open-source phishing campaign toolkit with a desktop client and server architecture. Supports web-page cloning, credential-harvesting landing pages, and detailed per-target tracking. More suited to penetration testers and red teams than pure awareness programs—powerful but entirely your operational responsibility [citation:11].

Actively maintained fork of Gophish with a single web UI for landing pages, email templates, target groups, and campaign management. Addresses some of the original project's stagnation while keeping the same self-hosted, MIT-licensed model. A practical choice if you want GoPhish's workflow with ongoing updates [citation:8].

Self-hosted security-awareness and training platform that combines employee education, phishing simulations, automated remediation, gamified learning, and human-risk analytics in one application. Unlike GoPhish, it includes the training loop after the click—a more complete open-source awareness stack [citation:1].

The de facto insecure web app for hands-on security training. Runs locally via Docker, covers OWASP Top 10 vulnerabilities, and includes a built-in CTF mode with flags and a scoreboard—ideal for team training events. Also serves as a DAST scanner benchmark: every vulnerability is documented, so you can measure what your scanner misses [citation:2].

Free, browser-based web security training from the makers of Burp Suite. Guided labs cover SQL injection, XSS, CSRF, authentication bypass, and more—all in the cloud with no local setup. Best for individual learning and corporate environments where software installation is restricted. Cannot be scanned externally (labs run on PortSwigger's infrastructure) [citation:2].

Beginner-friendly hands-on cybersecurity training platform. Covers networking, web hacking, Linux, and red team basics through guided rooms. Free plan available with limited content; paid tier unlocks full learning paths. Widely recommended as the starting point for aspiring pentesters and SOC analysts [citation:5][citation:9].

Real-world penetration testing labs with a focus on Active Directory attacks, privilege escalation, and realistic vulnerabilities. Free tier provides limited machines; paid tiers unlock Pro Labs and structured Academy paths. The standard for practitioners who want challenge-based learning beyond guided tutorials [citation:5][citation:9].

Blue team-focused training platform with realistic incident response, malware analysis, and threat hunting challenges. Each challenge provides forensic artifacts (memory dumps, PCAPs, logs) and asks you to investigate—closer to real SOC work than CTF-style exploitation. Free and community-driven [citation:5][citation:9].

Free interactive security awareness training materials in SCORM format. Covers insider threat, shadow IT, VPN safety, home router security, real-world breach case studies (MGM Resorts, OneNote BEC), audit basics, and EU AI Act compliance. Importable into any SCORM-compatible LMS. A practical content library for teams that already have a delivery platform [citation:6][citation:10].

Carnegie Mellon University's beginner-friendly CTF platform. 500+ interactive challenges across web exploitation, cryptography, forensics, reverse engineering, and binary exploitation. Year-round access with a built-in web-based VM for solving challenges—no local setup required. The best starting point for complete beginners [citation:1][citation:6].

Legendary SSH-based wargames. Start with Bandit (34 levels teaching Linux commands and basic security concepts), then progress to Leviathan (privilege escalation), Natas (web security), and Narnia (binary exploitation). No GUI—pure command-line learning that builds fundamental skills [citation:1][citation:6][citation:14].

Gamified learning platform with guided "rooms" covering offensive and defensive topics. Browser-based Kali machine means zero setup. Free tier includes many rooms; premium unlocks full learning paths. The best structured introduction to cybersecurity for those who want hand-holding before jumping into competitive CTFs [citation:1][citation:6].

Realistic penetration testing labs and CTF challenges. Free tier offers limited machines; paid tiers unlock Pro Labs and Academy paths. Less hand-holding than TryHackMe—requires deep enumeration, lateral thinking, and hours of research per machine. The standard for practitioners preparing for real-world engagements or certifications [citation:1][citation:4][citation:6].

French platform with hundreds of free challenges spanning web, binary, crypto, forensics, and steganography. Difficulty ranges from beginner to advanced. Community-driven with writeups and forums. The app allows practice on the go. A solid alternative to HTB for those who want breadth without the competitive pressure [citation:1][citation:6].

Arizona State University's free, open-source education platform focused on binary exploitation and systems security. Self-contained dojos with automated grading. Highly regarded as one of the best (and most challenging) platforms for mastering memory safety, ROP, and low-level exploitation. Not for beginners—but essential for pwn specialists [citation:1][citation:4][citation:14].

Repository of downloadable vulnerable virtual machines. Run them locally with VirtualBox/VMware and practice recon, exploitation, and privilege escalation end-to-end. Unlike online platforms, you control the environment—no VPN, no time limits. Ideal for building a home lab and learning at your own pace [citation:6][citation:10].

The standard open-source platform for hosting your own CTF competitions. Jeopardy-style scoreboard with challenges, hints, teams, and dynamic scoring. Deployable via Docker in minutes. Used by universities, companies, and CTF organizers worldwide. Essential if you want to run internal training events or club competitions [citation:6][citation:7].

Fun, interactive platform for learning modern cryptography through CTF-style challenges. Python-based with a structured curriculum covering RSA, AES, elliptic curves, and more. Math-heavy but well-explained. The best dedicated resource for crypto CTF preparation—complements general platforms that treat crypto as just one category [citation:14].

The global CTF calendar and ranking aggregator. Lists upcoming competitions worldwide with filters by weight and format. Team rankings and historical archives. If you want to compete in live CTFs rather than just practice, this is where you find them. Essential meta-resource for any serious CTF player [citation:11][citation:14].

Brian Krebs' investigative blog, widely regarded as one of the most trusted independent voices in cybersecurity. Breaks major breach stories, exposes cybercrime networks, and provides in-depth analysis of malware campaigns and phishing scams. Often first to report on incidents that mainstream media picks up later [citation:1][citation:6].

Bruce Schneier's blog covering security analysis, policy, cryptography, and government surveillance. As a renowned cryptographer and author of "Applied Cryptography," his commentary offers unique depth on security tradeoffs, privacy implications, and systemic risks that technical blogs often miss [citation:6][citation:11].

Google's elite vulnerability research team blog. Publishes deep technical analysis of zero-day exploits, memory corruption bugs, and novel attack techniques. Known for 0-day disclosures with 90-day deadlines that shape industry patching practices. Essential for binary exploitation and vulnerability research enthusiasts [citation:2].

One of the largest commercial threat intelligence teams, publishing daily research on malware campaigns, vulnerability disclosures, and network security threats. Talos also maintains Snort and ClamAV signatures, making their blog directly relevant to defenders running these tools [citation:2][citation:6].

Palo Alto Networks' threat research arm, publishing weekly analysis of APT campaigns, ransomware groups, and emerging malware families. Known for detailed adversary tracking and attribution, with reports that help SOC teams build detection logic for specific threat actors [citation:6].

Kaspersky's research blog, one of the longest-running sources for malware analysis and threat research. Publishes detailed technical breakdowns of APT campaigns (including Equation Group and Sofacy), ransomware families, and novel attack techniques. Historically significant for documenting state-sponsored cyber operations [citation:2][citation:6].

Community-driven security news site focused on malware analysis, ransomware tracking, and breach updates. Known for rapid alerts and technical breakdowns that are more accessible than vendor whitepapers but still detailed enough for practitioners. Often the first source for breaking ransomware incidents [citation:1][citation:2].

One of the most widely read cybersecurity publications, delivering breaking news on vulnerabilities, data breaches, malware campaigns, and hacking incidents. Covers both technical details and business impact, making it useful for practitioners and decision-makers alike. A reliable daily source for staying current [citation:2][citation:11].

Community-driven threat intelligence from SANS Institute. Daily "Diaries" cover current security issues, emerging attack patterns, and practical defensive advice. The Handler on Duty system provides real-time analysis during major incidents. One of the most practical, defender-focused resources available [citation:2][citation:10].

Curated collection of 366 security RSS/Atom feeds organized into 21 folders by workflow priority (Alerts, Threat Intel, Exploit Research, etc.). Maintained by Federico Maggi, importable into any RSS reader. Instead of visiting 10 different blogs, subscribe to this bundle and get everything in one place .

The industry standard pentesting distribution by Offensive Security. Debian-based with 600+ pre-installed tools covering Metasploit, Nmap, Burp Suite, and everything in between. Most courses, certifications (OSCP), and documentation are built around it—making it the safest starting point for anyone serious about ethical hacking [citation:1][citation:6].

Kali's main competitor, built for both security work and daily use. Home Edition is a privacy-focused daily OS; Security Edition ships 800+ tools with AnonSurf (Tor routing) pre-installed. Lighter than Kali and the first pentesting distro with RISC-V support. Best if you want one distro for work and personal use [citation:1][citation:6][citation:13].

Arch Linux-based distribution with the largest tool repository—2,800+ tools. No hand-holding: you build the environment yourself, manage dependencies, and troubleshoot conflicts. Best for experienced researchers who know exactly what they need and are comfortable with Arch's rolling-release model. Full ISO is 22GB; slim/netinstall recommended [citation:1][citation:5][citation:10].

Computer Aided INvestigative Environment—an Italian GNU/Linux live distribution designed for digital forensics. Provides a complete forensic environment with tools for evidence acquisition, preservation, and analysis. Unlike pentesting distros, CAINE is built specifically for investigators who need to maintain chain of custody and produce court-admissible findings [citation:2].

Digital Evidence & Forensics Toolkit—a Linux distribution for forensics and incident response. Built on Lubuntu with a focus on live forensics, data recovery, and malware analysis. Includes tools for memory forensics, network analysis, and timeline reconstruction. Complements CAINE for forensic specialists who need a portable investigation environment [citation:2].

Arch Linux-based security repository and live ISO. Similar philosophy to BlackArch but with a smaller, more curated tool set. Designed for Arch users who want security tools without the massive repository size. Good middle ground if BlackArch feels overwhelming but you still prefer Arch's package management [citation:2].

Ubuntu-based pentesting distribution with a focus on performance and usability. Includes a curated selection of security and analysis tools without the bloat of larger distributions. Historically popular for its clean XFCE desktop and stable base. Less actively developed than Kali/Parrot but still maintained for users who prefer Ubuntu's ecosystem [citation:15].

Gentoo-based security distribution with a focus on customized kernels and performance. Includes hardened kernel patches and wireless driver support out of the box. For users who want Gentoo's flexibility and compile-from-source approach but need pentesting tools pre-configured. Niche but respected in the wireless security community [citation:15].

Samurai Web Testing Framework—a Linux live CD focused exclusively on web application penetration testing. Includes a curated set of web-focused tools (Burp Suite, OWASP ZAP, sqlmap, BeEF) and pre-configured targets for practice. A focused alternative to general-purpose pentesting distros for web app testers [citation:15].

Debian/Ubuntu-based distribution built for penetration testing and forensic analysis. Includes a wide range of security tools with multiple desktop environments available (Xfce, GNOME, KDE). Known for its comprehensive toolset and active development. A solid alternative to Kali for users who want a Debian-based distro with a different tool selection [citation:15].

The primary HTTP library for security automation. Session handling, retries, proxy support, and cookie management make it indispensable for web fuzzing, API testing, and authenticated scanning. The standard library alternative (`urllib`) works for one-off requests, but `requests` is worth it once you need sessions or auth [citation:1][citation:7].

Python's packet crafting and sniffing engine. Build custom packets for any protocol, perform network discovery, and write protocol fuzzers that go beyond TCP/UDP—Scapy handles layers from Ethernet to application. Requires root for raw socket operations. Essential for network-level tooling [citation:1][citation:7].

Python SSH and SFTP automation library. Programmatic SSH connections with key or password auth, remote command execution, and file transfers. Essential for fleet management, post-exploitation automation, and building SSH-based tools without shelling out to the `ssh` binary [citation:1][citation:7].

CTF and exploit development framework. Simplifies process/socket interaction (tubes), shellcode generation, ROP chain construction, and ELF parsing. The standard for binary exploitation scripting—if you're writing pwn challenges or automating exploit delivery, this is the foundation [citation:1][citation:7].

Python toolkit for network protocol manipulation, with a strong focus on Windows/Active Directory. SMB, NTLM, Kerberos, and LDAP libraries for building custom AD attack tools. Includes ready-made scripts (`GetUserSPNs.py`, `secretsdump.py`) but its real power is as a library for your own automation [citation:1].

Production-grade Windows security automation framework. Modules for event log analysis, system hardening, reconnaissance (local users, AD groups, ACLs), patch management, JEA, and threat detection (AMSI status, suspicious script patterns). Built on PowerShell 7.0+ with Pester tests and automation playbooks [citation:3][citation:15].

Go library for red team and malware development. Functions for system enumeration, cryptography (AES, RC4, XOR), port scanning, shellcode injection, token impersonation, and anti-sandboxing. Designed for building custom offensive tooling in Go with a single import [citation:5].

Python DNS toolkit for arbitrary record queries and zone transfers. Goes beyond `socket.getaddrinfo`—query MX, TXT, NS, and SOA records, attempt AXFR zone transfers, and build subdomain enumeration scripts. Essential for recon automation [citation:7].

Modern crypto primitives for Python. X.509 certificate parsing, AES/RSA operations, Fernet symmetric encryption, and key derivation. Use it when you need real crypto in your tools—for payload encryption, certificate analysis, or building secure communication channels [citation:1][citation:7].

Security Automation Framework command-line interface. Streamlines security automation for DevOps pipelines by tying together MITRE tools and community libraries. Supports InSpec profile testing, Heimdall results viewing, and CI/CD integration for compliance-as-code workflows [citation:6].

Customizable open-source pentest reporting platform. Reports are designed as HTML/CSS and rendered to PDF; findings can be written in Markdown. Actively maintained with features like encrypted archiving, concurrent editing, version histories, and data encryption at rest [citation:14]. Has 2,200+ GitHub stars and a companion `reptor` CLI/Python library for automation [citation:3][citation:11].

The longest-running open-source pentest reporting platform (since 2007, GPLv2). Combines outputs from 47+ tools (Burp, Nessus, Nmap, Qualys) with manual findings and notes to generate consistent HTML, PDF, or CSV reports. Self-hosted with no vendor lock-in. Trusted by 1,182+ InfoSec teams in 81 countries [citation:5]. Pro tier adds QA workflows and client portals [citation:13].

Pentest reporting application focused on Docx report generation. Multi-user with real-time collaboration, reusable vulnerability library, CVSS v3/v4 scoring, and retest workflows. Recent versions add AI-assisted writing (OpenAI, Anthropic, DeepSeek, Ollama) and quality assurance checks [citation:12]. The goal is "more time to Pwn and less time to Doc" [citation:4].

CLI tool and Python library for automating SysReptor reporting. Create findings from tool outputs, upload evidences in bulk, import from other reporting tools (DefectDojo, GhostWriter), manage projects, and download PDF reports. Supports piping tool outputs directly (e.g., `cat sslyze.json | reptor sslyze --push-findings`) [citation:3].

CLI reporting tool that hooks into your shell and tracks every security command you run during an engagement. Automatically generates HTML, Markdown, and JSON reports from tracked commands, with screenshots, scans, and evidence organized per project. Supports PDF export via wkhtmltopdf/WeasyPrint [citation:1].

Open-source unified vulnerability and compliance management platform. Centralizes scan results from Nessus, OpenVAS, OWASP ZAP, and Trivy into a single dashboard. Smart deduplication, SLA tracking, AI-powered explanations via OpenAI, and role-based access control. Built with FastAPI and PostgreSQL [citation:2].

Pentest report aggregator that reads JSON outputs from multiple tools, normalizes severity, deduplicates findings, computes a global risk score, and generates polished HTML, PDF, and Markdown reports. Includes MITRE ATT&CK coverage mapping, prioritized remediation roadmap, and executive summary with inline SVG charts [citation:6].

Modular CLI framework for Red/Blue/Purple team workflows with built-in reporting. Generates professional PDF reports with SVG logo support and table-based analytics. All modules map to MITRE ATT&CK. Includes integrated authorization consent before report generation [citation:9].

Web interface to centralize pentest audits with graphs, severity breakdown, CVE integration (NVD lookup), and a remediation tracking system. Provides API endpoints for CVE search, audit statistics, and vulnerability status updates [citation:10].

Self-hosted CVE tracker that syncs the full NVD feed and discovers vulnerable software via OpenVAS, OVAL scanning, and Red Hat Insights. Cross-joins assets × CVEs on CPE vendor+product, opens GitHub Issues for new matches, and ships a live status page with severity counts and 30-day sparklines [citation:7].

Daniel Miessler's comprehensive collection of security testing wordlists. Usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, and shell strings—organized by attack type. The default wordlist source for Burp, ffuf, Gobuster, Hydra, and virtually every other tool that takes a dictionary .

Swiss Army Knife repository of useful payloads and bypass techniques for web app security. SQL injection, XSS, SSRF, LFI, XXE, command injection, and more—each with working examples and context. The go-to reference when you need a payload that actually works against a specific filter or WAF .

Web-based generator for reverse and bind shell one-liners across dozens of languages and tools: Bash, Python, PowerShell, Perl, Ruby, Netcat, Socat, and more. Enter your IP and port, copy the shell that matches your target environment. Saves the mental overhead of memorizing syntax for each language .

Curated list of Unix binaries that can be exploited to bypass local security restrictions. When you have limited shell access, GTFOBins tells you which legitimate binaries (vim, find, awk, tar) can be abused for file read/write, shell escape, or privilege escalation. Essential post-exploitation reference .

Living Off The Land Binaries, Scripts and Libraries for Windows. The Windows equivalent of GTFOBins—documents legitimate Microsoft-signed binaries (certutil, bitsadmin, mshta, rundll32) that attackers abuse for download, execution, or bypass. Essential for both red team tradecraft and blue team detection logic .

GCHQ's "Cyber Swiss Army Knife" for data transformation. Drag-and-drop operations for encoding, encryption, hashing, compression, and parsing—chain them into recipes to decode obfuscated payloads, analyze malware strings, or convert between formats. The single most useful utility for any security analyst's browser bookmarks .

Modern shell handler that replaces `nc -lvnp`. Handles multiple reverse shells simultaneously, upgrades dumb shells to fully interactive TTYs with tab completion and job control, supports file upload/download, and logs all sessions. A significant quality-of-life improvement over raw netcat .

Markdown-based note-taking app with local storage and graph-based linking. Popular among pentesters for engagement notes, methodology documentation, and building a personal knowledge base. Plugins like Templater and Dataview turn it into a lightweight report drafting environment. No cloud dependency—your notes stay on your machine .

Command-line JSON processor. Every modern security tool outputs JSON—jq lets you filter, transform, and extract fields without writing Python. Chain it with other tools: `nuclei -json | jq '.[] | select(.severity=="critical")'`. The glue that makes CLI-based automation actually work .

User-friendly command-line HTTP client. Colored, formatted output with intuitive syntax makes it far more pleasant than curl for manual API testing. Supports sessions, file uploads, and JSON-first design. When you need to quickly check an endpoint during recon or verify a CORS misconfiguration, HTTPie is faster and more readable .