Security tools

Capture and inspect network packets to understand protocols and investigate traffic.

Command-line packet capture, ideal for servers and scripted collection.

Discover hosts and services on networks you are authorized to test.

Read/write raw TCP/UDP connections for testing connectivity.

Intercept, inspect and modify HTTP traffic between your browser and a web app.

Open-source web proxy and automated scanner for finding web vulnerabilities.

Inspect HTML, JavaScript, network requests, cookies and storage in your browser.

Validate vulnerabilities during authorized engagements and labs.

Brute-force directories, DNS subdomains and vhosts on authorized targets.

Fast web fuzzer for content discovery and parameter testing.

Map an organization's external attack surface via subdomain enumeration.

Passive subdomain discovery from public sources.

Collect emails, names and subdomains from public sources.

Detect SQL injection flaws in authorized applications.

GUI digital forensics platform for disk image analysis.

Analyze RAM dumps for processes, network connections and malware.

Centralize, search and correlate logs to detect threats.

Turn network traffic into rich, structured logs.

Signature-based intrusion detection and prevention.

Detailed Windows event logging for processes, network and files.

Vendor-neutral detection rule format convertible to SIEM queries.

Endpoint visibility and forensic collection at scale.

Manage AWS and audit IAM, CloudTrail, GuardDuty and Security Hub.

Manage Azure and review security posture.

Manage GCP resources and review Security Command Center.

Open-source cloud security posture assessment.

Multi-cloud security auditing.

NSA open-source disassembler and decompiler.

CLI reverse engineering framework.

Pattern-matching rules to identify malware families.

Debug binaries to understand memory and program flow.

The most common language for security automation and tooling.

The default Linux shell, used for automation and administration.

Windows automation shell, crucial for admins and defenders.

Process Explorer, Autoruns, Procmon and more for Windows analysis.

Track code changes; essential for DevSecOps.

Send HTTP requests from the command line.

Inspect certificates, generate keys and test TLS.

GPU password recovery for auditing hashes you are authorized to test.

CPU password auditing for lab and authorized hashes.

Browser-based encoding, decoding and data transformation.

Run isolated virtual machines for safe labs.

Audit Linux systems for hardening opportunities.

Enumerate privilege escalation paths in lab Linux machines.

Graph AD relationships to find and fix attack paths.

Open-source vulnerability scanning.

Template-based scanner for known issues.

Automated static/dynamic mobile app analysis.

Instrument apps at runtime for testing.

Automated adversary emulation mapped to ATT&CK.

Share and correlate threat intelligence.

Lightweight static analysis for many languages.

Semantic code analysis for vulnerability patterns.

Scan images, IaC and dependencies for vulnerabilities.

Vulnerability scanner for images and SBOMs.

Build and test HTTP/API requests with collections and environments.

Lightweight REST/GraphQL client for API exploration.

Visualize GraphQL schemas (use on schemas you are allowed to view).

Scan git repos for leaked secrets.

High-entropy secret detection in git history.

Identify known vulnerable dependencies.

Automate OWASP ZAP scans in CI.

Static analysis for Terraform/K8s/CloudFormation.

Open-source IaC scanner by Checkmarx.

CIS Kubernetes benchmark checks.

Pen-test Kubernetes clusters (authorized only).

Runtime threat detection for containers/K8s.

Generate SBOMs for containers and directories.

Structured CTI platform with STIX/TAXII.

Aggregate OSINT/threat intel analyzers.

Case management for security incidents.

Automated analyzers for observables (pairs with TheHive).

Collect triage artifacts from Windows quickly.

Super-timeline generation from disk artifacts.

Collaborative timeline analysis UI.

Fast Windows EVTX hunting and timeline.

Automated malware analysis sandbox.

Linux distro with RE/malware analysis tools.

Wireless network detector, sniffer, IDS.

Wi‑Fi security auditing suite (authorized networks only).

Extract embedded files from firmware images.

Large-scale firmware emulation for research.

LLM vulnerability probing framework.

Microsoft framework for generative AI red teaming.

Test and evaluate LLM prompts/policies.

ML/LLM testing for performance and security issues.

Find public accounts across many sites for a username (authorized investigations only).

Username search across thousands of sites with rich reporting (fork/evolution of Sherlock-style tooling).

Read and write metadata in images, PDFs, and media files.

Visual link analysis between domains, people, and infrastructure (Community Edition).

Automated OSINT collection with modular scans (self-hosted).

Modular recon framework (Metasploit-style for OSINT).

Check if an email is registered on many sites (no password needed).

Use advanced search operators to find indexed sensitive pages — for defense and authorized assessments.

Search certificates, hosts, and services exposed on the internet.

Find internet-exposed services on IPs and org footprints (monitor assets you own).

Check if emails appear in known public breach datasets.

Historical DNS, subdomains, and WHOIS intelligence.

Visual DNS reconnaissance (subdomains, MX, NS).

Historical snapshots of websites for change review and leaked path discovery.

Safe remote fetching and analysis of URLs (screenshots, DOM, network).

Aggregate AV/engine results for files, URLs, domains, and IPs.