wafw00f
wafw00f is a free WAF fingerprinting tool used to detect which web application firewall sits in front of a site for recon and AppSec testers.
Cybersecurity tools, platforms and training
A curated directory of cybersecurity tools, platforms and training for practitioners, researchers and learners.
Top voted
WhatWeb
WhatWeb is a free web scanner used to identify technologies, frameworks, and plugins on websites for recon and application security practitioners.
dirsearch
dirsearch is a free web path scanner used to discover hidden directories and files on web servers for pentesters assessing authorized targets.
ntopng
ntopng is a freemium web-based traffic monitor used to inspect live network flows and talking hosts for network operations and security teams.
Chisel
Chisel is a free TCP/UDP tunnel over HTTP used to reach internal networks through firewalls for pentesters and red teams on authorized targets.
Zitadel
Zitadel is a free identity infrastructure platform used to run authentication, SSO, and user management for developers and IT teams building or securing apps.
SOPS
SOPS is a free secrets editor used to encrypt values inside YAML, JSON, and env files for platform and DevOps teams who keep secrets in Git.
authentik
authentik is a freemium identity provider used to add SSO, MFA, and access policies in front of company applications for IT and security teams.
Infisical
Infisical is a freemium secrets platform used to store, version, and inject secrets for developers and platform teams across apps and infrastructure.
Vaultwarden
Vaultwarden is a free unofficial Bitwarden-compatible server used to self-host password vaults for individuals and teams who want a lighter backend.
The Sleuth Kit
The Sleuth Kit is a free library and tool set used to analyze disk images and file systems for digital forensics investigators and incident responders.
Snort
Snort is a free open source intrusion detection and prevention engine used to inspect network traffic for known attacks for SOC and network security teams.
Mythic
Mythic is a free collaborative command-and-control framework used to run red team and purple team operations with many payload types for authorized assessments.
GRR Rapid Response
GRR Rapid Response is a free remote live-forensics platform used to hunt and collect evidence from many endpoints for incident responders and DFIR teams.
Recon-ng
Recon-ng is a free modular OSINT framework used to gather web-based open source intelligence on people and hosts for investigators and recon teams.
Cloud Custodian
Cloud Custodian is a free rules engine used to define and enforce cloud resource policies across AWS, Azure, and GCP for cloud security and platform teams.
Proxmark3 (Iceman / RRG)
Proxmark3 (Iceman / RRG) is a free RFID and NFC research platform used to analyze and test contactless cards and readers for hardware security practitioners.
CodeQL
CodeQL is a freemium static analysis engine used to query source code as a database for security bugs for developers and application security teams.
Application SecurityFreemium
Flipper Zero
Flipper Zero is a paid portable multi-tool used to research RFID, NFC, infrared, Sub-GHz, and GPIO targets for hardware and wireless security practitioners.
Masscan
Masscan is a free high-speed port scanner used to scan the internet or large address ranges for open TCP ports for pentesters on authorized targets.
binwalk (ReFirmLabs)
binwalk is a free open source firmware analysis tool used to find and extract embedded files and file systems from binary images for researchers and analysts.
Rizin
Rizin is a free reverse engineering framework used to disassemble, debug, and analyze binaries from the command line for malware analysts and researchers.
Steampipe (Turbot)
Steampipe by Turbot is a free query engine used to inspect live cloud and SaaS APIs with SQL for security, compliance, and cloud operations teams.
kube-bench (Aqua Security)
kube-bench by Aqua Security is a free tool used to check Kubernetes nodes and control planes against the CIS Kubernetes Benchmark for platform security teams.