Dalfox
Dalfox is a free XSS scanner used to find and verify cross-site scripting flaws in web parameters for pentesters and bug bounty hunters on authorized targets.
Cybersecurity tools, platforms and training
A curated directory of cybersecurity tools, platforms and training for practitioners, researchers and learners.
Top voted
gosec (Securego)
gosec is a free static analysis tool used to inspect Go source code for security problems such as injection and weak crypto for Go developers and AppSec teams.
Bandit (PyCQA)
Bandit is a free static analysis tool used to find common security issues in Python source code for Python developers and application security teams.
OpenSSF Scorecard
OpenSSF Scorecard is a free security health checker used to score how safely open source projects are built and maintained for developers and security teams.
Cosign (Sigstore)
Cosign by Sigstore is a free signing tool used to sign and verify container images, binaries, and attestations for DevSecOps and software supply chain teams.
dnsx (ProjectDiscovery)
dnsx by ProjectDiscovery is a free DNS toolkit used to resolve, probe, and filter large lists of hostnames for pentesters and recon teams on authorized targets.
Naabu (ProjectDiscovery)
Naabu by ProjectDiscovery is a free port scanner used to quickly find open TCP and UDP ports on many hosts for pentesters and recon teams on authorized targets.
Katana (ProjectDiscovery)
Katana by ProjectDiscovery is a free web crawler used to map URLs, endpoints, and JavaScript files on sites for recon teams and authorized bug bounty hunters.
CrowdSec
CrowdSec is a freemium intrusion prevention engine used to spot attacks in logs and HTTP traffic and block them with bouncers for sysadmins and SOC teams.
OSV-Scanner (Google)
OSV-Scanner by Google is a free dependency scanner used to match lockfiles and container packages against known vulnerabilities for developers and AppSec teams.
Syft (Anchore)
Syft by Anchore is a free SBOM generator used to list every package inside container images and filesystems for DevSecOps and software supply chain teams.
Cutter
Cutter is a free open-source reverse engineering platform used to disassemble, decompile, and debug binaries through a GUI for malware analysts and researchers.
httpx (ProjectDiscovery)
httpx by ProjectDiscovery is a free HTTP probing toolkit used to check which hosts run live web servers and fingerprint them for recon and bug bounty teams.
Tetragon
Tetragon is a free eBPF-based runtime security tool used to observe and block risky process, file, and network activity for Kubernetes and Linux platform teams.
Caido
Caido is a freemium web security auditing toolkit used to intercept, replay, and automate HTTP traffic for web pentesters and application security engineers.
Application SecurityFreemiumNodeZero
NodeZero is a paid autonomous pentesting platform from Horizon3.ai used to find and safely exploit attack paths inside and outside a network for security teams.
XBOW
XBOW is a paid autonomous offensive security platform used to pentest apps and APIs and prove findings with working exploits for security teams.
Armadin
Armadin is a paid AI offensive security platform used to find and validate real attack paths across an enterprise with autonomous agents for security teams.
NeMo Guardrails
NeMo Guardrails is a free open-source NVIDIA toolkit used to add programmable safety rails to LLM chat apps for AI engineers and security teams.
Chainsaw
Chainsaw is a free open-source first-response tool used to search and hunt through Windows event logs and other forensic artifacts for incident responders.
objection
objection is a free open-source runtime mobile exploration toolkit used to inspect iOS and Android apps without a jailbreak for mobile security testers.
hcxtools
hcxtools is a free open-source suite of Linux tools used to convert Wi-Fi capture files into hashes for password recovery tools for wireless testers.
urlscan.io
urlscan.io is a freemium web sandbox used to scan suspicious URLs and record what a page loads, contacts, and shows for threat analysts and SOC teams.
Threat IntelligenceFreemium
Grype
Grype is a free open-source vulnerability scanner from Anchore used to find known flaws in container images, filesystems, and SBOMs for DevSecOps teams.