Resources
Security Tools Directory
A curated collection of essential cybersecurity utilities, frameworks, and scripts for security professionals.
No tools match "". Try a shorter or more general term.
Active Directory Security
5 tools
BloodHound
An open-source (with a commercial enterprise edition) Active Directory and Azure AD attack path analysis tool that uses graph theory to reveal hidden, often unintended, privilege escalation and lateral movement paths within an environment. Red teams use it to find attack paths and blue teams use it to identify and remediate them.
Impacket
A free, open-source collection of Python classes for working with network protocols, particularly Windows and Active Directory protocols like SMB and Kerberos, used to build custom offensive security tooling. It underpins many popular penetration testing scripts for Active Directory attacks.
Mimikatz
A free, open-source tool that extracts plaintext passwords, hashes, and Kerberos tickets from Windows memory, widely used to demonstrate credential theft techniques like pass-the-hash and golden ticket attacks. It is a legitimate security research tool that is also one of the most commonly abused post-exploitation tools by real attackers.
NetExec
A free, open-source post-exploitation tool, formerly known as CrackMapExec, for automating the assessment of large Active Directory networks, including credential validation, command execution, and enumeration across many hosts at once. It is a widely adopted successor to the original CrackMapExec project.
Responder
A free, open-source tool that poisons LLMNR, NBT-NS, and mDNS name resolution requests on a local network to capture authentication hashes from Windows systems. It is a staple internal-network penetration testing tool for harvesting credentials without direct exploitation.
Application Security
4 tools
Checkmarx
A commercial application security testing platform offering static analysis (SAST), software composition analysis (SCA), and API security testing aimed at enterprise application security programs. It is one of the longer-established commercial SAST vendors.
Semgrep
A static analysis tool, free with a paid commercial platform, that scans source code for security vulnerabilities and bugs using lightweight, customizable pattern-matching rules across dozens of languages. It is widely adopted in CI/CD pipelines for fast, low-noise static application security testing.
Snyk
A developer security platform, commercial with a free tier, that scans code, open-source dependencies, containers, and infrastructure-as-code for known vulnerabilities, integrating directly into developer workflows and CI/CD pipelines. It is positioned around shifting vulnerability management left into the development process.
SonarQube
A static code analysis platform, commercial with a free community edition, that continuously inspects code quality and security vulnerabilities as part of the software development lifecycle. It is commonly integrated into CI/CD pipelines to enforce quality and security gates before code is merged.
Breach Monitoring
1 tool
Have I Been Pwned
A free, public breach-notification service, run by security researcher Troy Hunt, that lets individuals and organizations check whether an email address or password has appeared in a known data breach. It is widely integrated into password managers and security tools as a breach-checking API.
Advertisement
Cloud Security
5 tools
Prisma Cloud
Palo Alto Networks' commercial cloud-native application protection platform (CNAPP), covering cloud security posture management, workload protection, and identity security across multi-cloud environments. It is one of the broader, more comprehensive commercial CNAPP offerings on the market.
Prowler
A free, open-source command-line tool for auditing AWS, Azure, and GCP environments against security best practices and compliance frameworks like the CIS Benchmarks. Cloud security teams use it for automated, repeatable cloud configuration audits.
ScoutSuite
A free, open-source multi-cloud security auditing tool, developed by NCC Group, that assesses AWS, Azure, GCP, and other cloud provider configurations and generates a report highlighting risky settings. It is commonly used during cloud security assessments and penetration tests.
Trivy
A free, open-source vulnerability and misconfiguration scanner from Aqua Security for container images, filesystems, and infrastructure-as-code, integrated widely into CI/CD pipelines. It is one of the most commonly used open-source scanners in DevSecOps workflows.
Wiz
A commercial cloud security platform that provides agentless vulnerability, misconfiguration, and identity risk scanning across multi-cloud environments, correlating findings into prioritized attack paths. It is aimed at enterprise cloud security and DevSecOps teams.
Container Security
3 tools
Clair
A free, open-source tool for static analysis of vulnerabilities in application container images, originally developed by CoreOS/Quay. It is commonly integrated into container registries and CI/CD pipelines to block images with known vulnerable dependencies.
Falco
A free, open-source runtime security tool, originally created by Sysdig and now a CNCF graduated project, that detects anomalous behavior in containers, Kubernetes, and Linux hosts using kernel-level system call monitoring. It is commonly used as the runtime detection layer in cloud-native security stacks.
kube-bench
A free, open-source tool from Aqua Security that checks whether a Kubernetes cluster is deployed according to the CIS Kubernetes Benchmark, automating what would otherwise be a manual configuration audit. It is commonly run as part of Kubernetes cluster hardening and compliance checks.
Data Analysis
1 tool
CyberChef
Web-based tool for encoding, decoding, encryption, and data analysis operations.
Advertisement
Digital Forensics
4 tools
Autopsy
A free, open-source digital forensics platform providing a graphical interface over The Sleuth Kit for analyzing disk images, recovering deleted files, and building timelines. It is a popular entry point into digital forensics for both law enforcement and corporate investigators.
KAPE
Kroll Artifact Parser and Extractor — a free forensic triage tool that rapidly collects and processes forensically relevant artifacts from a system, such as event logs and registry hives, far faster than imaging an entire disk. Incident responders use it for quick, targeted evidence collection.
The Sleuth Kit
A free, open-source library and collection of command-line digital forensics tools for analyzing disk images and file systems, forming the underlying engine behind Autopsy. It is widely used and referenced in forensic training and tooling.
Velociraptor
A free, open-source endpoint monitoring and DFIR tool that lets responders query and collect artifacts from thousands of endpoints at scale using its own query language, VQL. It is popular for large-scale enterprise incident response and threat hunting.
Email Security
2 tools
Mimecast
A commercial cloud-based email security platform offering threat protection, data leak prevention, and email continuity and archiving for organizations. It competes with Proofpoint in the enterprise secure email gateway market.
Proofpoint
A commercial email security and threat protection platform providing anti-phishing, anti-malware, and data loss prevention for corporate email, along with security awareness training. It is widely deployed as the primary email gateway for large enterprises.
Endpoint Security
5 tools
CrowdStrike Falcon
A commercial, cloud-native endpoint detection and response (EDR/XDR) platform that uses behavioral analytics and threat intelligence to detect and respond to attacks on endpoints. It is one of the most widely deployed EDR platforms among large enterprises and MDR providers.
Microsoft Defender for Endpoint
Microsoft's commercial EDR platform, built into the Microsoft 365 and Windows security ecosystem, providing threat detection, investigation, and automated response for endpoints. It integrates tightly with Microsoft Sentinel and Entra ID for organizations standardized on Microsoft's security stack.
SentinelOne
A commercial EDR/XDR platform that uses AI-driven behavioral analysis on the endpoint agent itself to detect and autonomously respond to threats, including built-in rollback capabilities for ransomware recovery. It competes directly with CrowdStrike in the enterprise endpoint security market.
Sophos Intercept X
A commercial endpoint protection platform combining next-generation antivirus, EDR, and anti-ransomware capabilities, aimed particularly at small and mid-sized businesses alongside enterprise customers. It includes deep-learning malware detection and exploit prevention techniques.
Trellix
A commercial cybersecurity vendor, formed from the merger of McAfee Enterprise and FireEye, offering XDR, endpoint, and email security products aimed at enterprise threat detection and response. Its product line combines legacy McAfee endpoint tools with FireEye's threat intelligence and forensics heritage.
Advertisement
Exploitation
4 tools
Cobalt Strike
A commercial adversary simulation platform used by red teams to emulate advanced attacker tradecraft, including command-and-control, lateral movement, and post-exploitation. It is also one of the most widely abused legitimate red-team tools, frequently cracked and repurposed by ransomware operators.
Empire
An open-source post-exploitation and command-and-control framework built on PowerShell and Python agents, maintained by BC Security, used by red teams to simulate living-off-the-land attacker behavior after gaining a foothold. It continues the project originally developed as PowerShell Empire.
Metasploit
Penetration testing framework for developing and executing exploit code against targets.
Social-Engineer Toolkit (SET)
An open-source framework, maintained by TrustedSec, focused on simulating social engineering attacks, including phishing campaigns, credential harvesting pages, and malicious payload delivery, for authorized penetration tests. It is widely used in red team engagements with a human-targeted component.
Identity Management
6 tools
CyberArk
A commercial privileged access management platform that vaults, rotates, and monitors credentials for privileged accounts, aiming to prevent credential-based lateral movement and privilege escalation. It is considered a market leader in the PAM category for large enterprises.
Duo Security
A commercial multi-factor authentication and zero trust access platform, owned by Cisco, that adds a second verification step to logins via push notifications, hardware tokens, or biometrics. It is popular for its ease of deployment across a wide range of applications and VPNs.
HashiCorp Vault
A tool, available in open-source and commercial editions, for securely storing and tightly controlling access to secrets such as API keys, passwords, and certificates, with dynamic secret generation and detailed audit logging. It is widely used in DevOps and cloud-native environments to eliminate hardcoded credentials.
Okta
A commercial identity and access management platform providing single sign-on, multi-factor authentication, and lifecycle management for workforce and customer identities. It is one of the most widely adopted cloud identity providers among enterprises.
Ping Identity
A commercial identity and access management platform offering SSO, MFA, and API access security, aimed primarily at large enterprises with complex hybrid identity environments. It competes with Okta and Microsoft Entra ID in the enterprise IAM market.
YubiKey
A hardware security key, made by Yubico, that provides phishing-resistant multi-factor authentication using standards like FIDO2/WebAuthn, U2F, and smart card protocols. Individuals and enterprises use it as a physical 'something you have' factor that cannot be remotely phished.
Intrusion Detection
4 tools
OPNsense
A free, open-source firewall and routing platform forked from pfSense, offering a web-based interface for managing VPNs, traffic shaping, and intrusion detection. It emphasizes a more frequent release cycle and a plugin-based architecture compared to its predecessor.
pfSense
A free, open-source firewall and router platform based on FreeBSD, providing enterprise-grade features like VPN, intrusion detection integration, and traffic shaping on commodity hardware. It is popular with small businesses and home-lab security practitioners alike.
Snort
Open-source network intrusion detection and prevention system (IDS/IPS).
Suricata
A free, open-source network intrusion detection, prevention, and monitoring engine that inspects traffic using signature and protocol-based rules, similar to Snort but with native multi-threading. It is widely deployed by network defenders for high-throughput environments.
Malware Analysis
6 tools
Any.Run
An interactive, commercial cloud-based malware sandbox that lets analysts detonate suspicious files or URLs and observe their behavior in real time, including network traffic and process activity. It is widely used by SOC analysts for fast triage of phishing attachments and suspicious samples.
CAPEv2
An open-source malware sandbox, derived from Cuckoo Sandbox, that automates dynamic analysis of malware samples and includes configuration extraction capabilities for many malware families. Malware researchers who need a self-hosted, extensible detonation environment commonly deploy it.
Joe Sandbox
A commercial automated malware analysis sandbox that executes suspicious files and URLs in an instrumented environment and produces detailed behavioral reports. It supports a wide range of file types and evasion-resistant analysis techniques for enterprise malware research teams.
PEStudio
A free tool for the static analysis of Windows executables (PE files), surfacing suspicious indicators such as imported functions, strings, and embedded resources without executing the file. It is commonly used as a first-pass triage step before deeper dynamic or reverse-engineering analysis.
Volatility
A free, open-source framework for memory forensics that extracts artifacts, such as running processes, network connections, and injected code, from RAM captures. It is a core tool in incident response and malware analysis for investigating what a machine was doing at the moment of capture.
YARA
Pattern matching tool used by malware researchers to identify and classify malware samples.
Network Analysis
4 tools
ntopng
A network traffic monitoring tool, open-source with commercial editions, that provides a web-based dashboard for visualizing bandwidth usage, flows, and anomalies in real time. Network administrators use it to spot performance issues and unusual traffic patterns.
tcpdump
A free, open-source command-line packet analyzer that captures and displays network traffic, forming the basis for many other network tools, including Wireshark's underlying capture engine. It is a staple for quick, low-overhead packet capture on servers and network devices.
Wireshark
Network protocol analyzer for deep packet inspection and traffic analysis.
Zeek
An open-source network security monitoring framework that inspects traffic and generates rich, structured logs of network activity rather than raw packet captures. Enterprises and SOCs use it to build custom detection logic on top of detailed network telemetry.
Network Scanning
4 tools
Censys
Continuously scans the internet and catalogs hosts, certificates, and exposed services, providing attribution and context for internet-facing infrastructure. Commercial with free and academic tiers, it is used for external attack surface management and tracking malicious infrastructure.
Masscan
An open-source, extremely fast TCP port scanner capable of scanning the entire IPv4 address space in minutes. It trades some accuracy and stealth for raw speed, making it popular for large-scale internet reconnaissance and asset discovery.
Nmap
Network discovery and security auditing tool. The industry standard for port scanning and service enumeration.
Shodan
A search engine that indexes internet-connected devices and exposed services, letting security researchers and defenders discover what is publicly reachable, including cameras, industrial control systems, and unpatched servers. It is a commercial service with a limited free tier, widely used for attack surface discovery and infrastructure research.
Password Auditing
3 tools
Hashcat
Advanced GPU-accelerated password recovery utility supporting 300+ hash types.
Hydra
An open-source, parallelized login cracker (also known as THC-Hydra) that supports brute-force and dictionary attacks against dozens of protocols, including SSH, FTP, and HTTP forms. Penetration testers use it to test password strength and account lockout policies.
John the Ripper
Fast password cracker supporting hundreds of hash and cipher types.
Password Management
3 tools
1Password
A commercial password manager that stores credentials, secure notes, and other sensitive data behind end-to-end encryption, with dedicated business and developer-focused secrets automation offerings. It is widely used by both individuals and organizations for credential and secrets management.
Bitwarden
A free and open-source password manager, with paid premium and enterprise tiers, that stores and autofills credentials, generates strong passwords, and syncs across devices with end-to-end encryption. It is popular as a self-hostable, auditable alternative to closed-source commercial password managers.
KeePass
A free, open-source, offline password manager that stores an encrypted database of credentials locally rather than syncing to a vendor's cloud. It appeals to users who prefer full local control over their password vault, at the cost of manual sync setup across devices.
Penetration Testing Distributions
2 tools
Kali Linux
A free, open-source Debian-based Linux distribution maintained by Offensive Security, pre-loaded with hundreds of penetration testing, forensics, and reverse engineering tools. It is the most widely used operating system in the penetration testing and security research community.
Parrot OS
A free, open-source Debian-based Linux distribution similar to Kali Linux, bundling penetration testing, digital forensics, and privacy tools, with a lighter default footprint aimed at both security professionals and privacy-focused general use. It is a popular alternative to Kali for practitioners who also use their security distribution as a daily-driver OS.
Reconnaissance
5 tools
Amass
A free, open-source OWASP project for in-depth attack surface mapping and external asset discovery, using DNS enumeration, certificate transparency logs, and other OSINT techniques to find subdomains and related infrastructure. Bug bounty hunters and red teams widely use it during reconnaissance.
Maltego
An OSINT and link-analysis platform, commercial with a free community edition, that visualizes relationships between people, domains, infrastructure, and organizations by aggregating data from many sources into an interactive graph. Threat intelligence analysts and investigators use it to map out complex relationships during research.
Recon-ng
A free, open-source reconnaissance framework with a modular, Metasploit-like interface for automating OSINT data gathering against a target, including domains, hosts, and public leaks. It is popular for building repeatable, scriptable OSINT workflows.
Subfinder
A free, open-source, fast subdomain discovery tool from ProjectDiscovery that passively gathers subdomains from multiple public data sources. It is commonly chained with other ProjectDiscovery tools, like Nuclei, in automated reconnaissance pipelines.
theHarvester
A free, open-source OSINT tool that gathers emails, subdomains, hosts, and employee names for a target organization from public sources like search engines and certificate transparency logs. It is commonly used in the reconnaissance phase of a penetration test.
Reverse Engineering
5 tools
Ghidra
NSA-developed reverse engineering framework for analyzing compiled code and malware.
IDA Pro
A commercial disassembler and debugger widely regarded as the industry standard for reverse engineering compiled binaries and malware. Malware analysts and vulnerability researchers use it to statically analyze code when source is unavailable.
ILSpy
A free, open-source .NET decompiler and assembly browser that converts compiled .NET binaries back into readable C# source code. Reverse engineers and developers use it to analyze .NET malware or recover lost source code.
Radare2
A free, open-source framework for reverse engineering and analyzing binaries, offering disassembly, debugging, and scripting capabilities from the command line. It is a popular no-cost alternative to commercial disassemblers, with a steeper learning curve due to its terminal-driven interface.
x64dbg
A free, open-source debugger for Windows executables, used by malware analysts and reverse engineers to step through and manipulate binary execution at the assembly level. It is a common companion tool to static analysis platforms like Ghidra and IDA Pro.
SIEM Platforms
6 tools
Elastic Security
A SIEM and endpoint security solution built on the open-source Elastic Stack (Elasticsearch, Logstash, Kibana), combining log analytics, detection rules, and endpoint telemetry in one platform. It is available as a free, self-managed open-source tier as well as a paid managed cloud offering.
Graylog
A log management platform, open-source with commercial enterprise editions, used for centralizing, searching, and analyzing log data. It is often chosen as a lighter-weight alternative to Splunk for security and operational monitoring.
IBM QRadar
A commercial SIEM platform that aggregates log and network flow data across an organization, applies correlation rules, and prioritizes security offenses for analyst review. It is commonly deployed in large enterprises alongside IBM's broader security portfolio.
Microsoft Sentinel
A cloud-native SIEM and SOAR platform built on Azure that ingests data from Microsoft and third-party sources, applies analytics rules, and automates response with playbooks. It is priced on data ingestion and integrates tightly with Microsoft 365 Defender and Entra ID.
Splunk
A commercial platform for collecting, searching, and analyzing machine-generated log data, widely used as a SIEM for security monitoring, correlation, and compliance reporting. Its query language (SPL) and extensive app ecosystem make it one of the most established platforms in enterprise SOCs.
Wazuh
A free, open-source security platform that combines SIEM and XDR capabilities, including log analysis, file integrity monitoring, vulnerability detection, and compliance reporting, built on the Elastic Stack. It is popular with organizations wanting enterprise SIEM-style capabilities without commercial licensing costs.
Secrets Detection
2 tools
Gitleaks
A free, open-source tool that scans git repositories for hardcoded secrets and credentials using pattern matching and entropy analysis. It is a lightweight, widely adopted alternative to TruffleHog for pre-commit and CI secret scanning.
TruffleHog
A free, open-source secrets scanning tool that searches source code repositories and history for accidentally committed credentials, API keys, and tokens, including live verification of whether found secrets are still active. It is commonly run in CI/CD pipelines to catch leaked secrets before they reach production.
Threat Intelligence
6 tools
abuse.ch
A set of free, community-driven threat intelligence platforms and feeds, including URLhaus, MalwareBazaar, and ThreatFox, run by a Swiss non-profit, tracking malware, botnet C2 infrastructure, and malicious URLs. Its feeds are widely consumed by security vendors and researchers for free indicator data.
AlienVault OTX
A free, community-driven threat intelligence sharing platform, run by AT&T Cybersecurity, where security researchers and vendors publish and consume indicators of compromise and threat 'pulses.' It is commonly integrated into SIEM and threat intel workflows as a free intelligence feed.
GreyNoise
An internet background noise intelligence platform, commercial with a free community tier, that identifies which scanning and attack traffic is opportunistic mass-internet noise versus targeted activity, helping analysts deprioritize false alarms. It is commonly used to enrich SIEM and firewall alerts with scanner reputation context.
MISP
A free, open-source threat intelligence platform used to collect, store, correlate, and share indicators of compromise and threat information between organizations and communities. It is widely used by CERTs, ISACs, and enterprise threat intelligence teams for structured intel sharing.
Recorded Future
A commercial threat intelligence platform that aggregates data from open, technical, and dark web sources and applies analytics to produce risk scoring and actionable intelligence. It is aimed at enterprise threat intelligence teams and SOCs needing broad external visibility.
VirusTotal
A service, owned by Google, that scans submitted files and URLs against dozens of antivirus engines and blocklists simultaneously and aggregates the results. Free for individual lookups with paid API tiers for automation, it is a standard first step for triaging suspicious files and checking indicators of compromise.
Vulnerability Scanning
5 tools
Nessus
A widely used commercial vulnerability scanner from Tenable that identifies missing patches, misconfigurations, and known vulnerabilities across networks, systems, and applications. It offers a limited free version, Nessus Essentials, alongside its paid enterprise editions.
Nuclei
Fast vulnerability scanner driven by YAML-based templates for targeted scanning.
OpenVAS (Greenbone)
A free, open-source vulnerability scanner maintained by Greenbone that checks systems against a continuously updated feed of vulnerability tests. It is a popular no-cost alternative to commercial scanners like Nessus and Qualys for smaller organizations and researchers.
Qualys VMDR
A commercial, cloud-based platform for vulnerability management, detection, and response, combining continuous asset discovery with vulnerability scanning and prioritization. It is aimed at enterprises needing centralized visibility across large, hybrid environments.
Rapid7 InsightVM
A commercial vulnerability management platform that combines live network scanning with risk-based prioritization to help security teams focus remediation on the vulnerabilities that matter most. It integrates with Rapid7's broader Insight platform for detection and response.
Web Security
5 tools
Burp Suite
Web application security testing platform with proxy, scanner, and intruder modules.
Nikto
An open-source web server scanner that checks for thousands of known dangerous files, outdated software versions, and misconfigurations. It is a fast, noisy scanner typically used for initial reconnaissance rather than stealthy testing.
OWASP ZAP
Open-source web application security scanner for finding vulnerabilities during development.
sqlmap
A free, open-source penetration testing tool that automates detecting and exploiting SQL injection vulnerabilities and taking over database servers. It is a standard tool in web application penetration testers' toolkits for validating SQLi findings.
Wapiti
An open-source web application vulnerability scanner that crawls a site and injects payloads to detect flaws such as SQL injection, XSS, and file disclosure. It is a lightweight, free alternative to commercial DAST scanners for smaller assessments.
Wireless Security
1 tool
Aircrack-ng
A free, open-source suite of tools for assessing Wi-Fi network security, covering packet capture, WEP/WPA-PSK key cracking, and wireless network testing. It has been a standard toolkit for wireless penetration testing for nearly two decades.