Cariddi
Cariddi is a free, open-source Go crawler that takes a list of domains and scans the pages it finds for endpoints, secrets, API keys, tokens and file types.
Cybersecurity tools, platforms and training
A curated directory of cybersecurity tools, platforms and training for practitioners, researchers and learners.
Top voted
Huntress
Huntress is a managed security platform with EDR, ITDR, SIEM, and security awareness training, all backed by a 24/7 SOC for businesses of all sizes.
Ultrafuzz
Ultrafuzz is an open-source orchestrator from the Monad Foundation that runs AI agents to fuzz Solidity smart contracts, hunt threats, and report findings.
Aderyn
Aderyn is a free, open-source Rust static analyzer from Cyfrin that scans Solidity smart contracts for vulnerabilities and works inside your editor.
ChipWhisperer
ChipWhisperer is NewAE's open-source toolchain for side-channel power analysis and glitching attacks, covering capture hardware, firmware, and Python APIs.
GOAD (Game of Active Directory)
GOAD is a free Orange Cyberdefense lab that builds a deliberately vulnerable Active Directory network so pentesters can practice common attack techniques.
HackRF One
HackRF One from Great Scott Gadgets is an open-source software defined radio that can transmit or receive signals from 1 MHz to 6 GHz over USB.
MVT (Mobile Verification Toolkit)
MVT is a source-available forensic toolkit from Amnesty International's Security Lab that checks Android and iOS data for traces of known spyware.
Mobile SecurityFree
Codex Security CLI
Codex Security CLI is a freemium, open-source tool used to find, validate, and fix code vulnerabilities for dev teams, with usage on a ChatGPT or API account.
Shannon
Shannon is a freemium AI pentester used to read web app source code and run real exploits that prove its findings for AppSec and pentest teams.
Timesketch
Timesketch is an open-source collaborative timeline tool used to organize, search, and annotate forensic timelines for DFIR analysts and incident responders.
EMBA
EMBA is an open-source firmware analyzer used to extract firmware, find vulnerabilities, and build SBOMs for penetration testers and product security teams.
DefectDojo
DefectDojo is an open-source vulnerability management platform used to import, deduplicate, and track scanner findings for AppSec and DevSecOps teams.
REA (Reverse Engineer Anything)
REA is an open-source, agent-driven reverse engineering tool used to analyze binaries, Android APKs, and app behavior for security researchers and developers.
SkillSpector
SkillSpector is an open-source security scanner used to check AI agent skills for prompt injection, data exfiltration, and supply chain risks for developers.
OpenSCAP
OpenSCAP is a free SCAP toolkit used to evaluate configuration baselines and vulnerability content on Linux hosts for compliance and security teams.
Lynis
Lynis is a free host auditing tool used to scan Linux, macOS, and UNIX systems for hardening gaps for system administrators and defensive teams.
angr
angr is a free binary analysis platform used to explore program behavior with symbolic execution for reverse engineers and vulnerability researchers.
Detect It Easy (DiE)
Detect It Easy is a free file identification tool used to detect compilers, packers, and file types for malware analysts and reverse engineers.
Interactsh
Interactsh is a free out-of-band interaction server used to catch DNS and HTTP callbacks during vulnerability tests for pentesters on authorized targets.
Docker Bench for Security
Docker Bench for Security is a free script used to check Docker hosts against CIS Docker Benchmark practices for platform and security teams.
Commix
Commix is a free command-injection exploitation tool used to detect and exploit OS command injection flaws in web apps for pentesters on authorized targets.
CloudFox
CloudFox is a free cloud situational-awareness tool used to map attack paths in AWS, Azure, and GCP for pentesters on authorized cloud assessments.
Sherlock
Sherlock is a free OSINT tool used to find social media accounts matching a username across many sites for investigators doing lawful research.