Cyber tools directory

1Password

1Password is a password manager available on Mac, iOS, Windows, Android, Linux, and browser that helps users store and retrieve passwords and personal data.

504ENSICS Labs LiME

LiME is a Loadable Kernel Module for volatile memory acquisition from Linux and Linux-based devices, such as Android.

Abnormal AI

aboutcode

above

Above is a network security sniffer that detects vulnerabilities in network equipment by analyzing traffic across up to 28 protocols without generating network noise.

Acalvio Technologies Acalvio

Acalvio is a deception technology platform that deploys decoys and honeypots to detect advanced threats and insider attacks.

Acronis Cyber Infrastructure

Acronis Cyber Infrastructure is hyperconverged software that pools storage, compute, and networking on commodity servers, often as a backup storage target.

Acronis Cyber Protect

Acronis Cyber Protect combines backup, disaster recovery, and endpoint protection in one platform for businesses and managed service providers.

Acronis Cyber Protect Cloud

Acronis Cyber Protect Cloud is a cloud-based platform combining data backup, disaster recovery, cybersecurity, and endpoint management for managed service providers and businesses.

Acronis True Image

Acronis True Image is backup, disk imaging, and anti-malware protection for home and small-office Windows and macOS computers.

Acsense

Acsense is an identity security platform that provides backup, recovery, and resilience for Okta environments to prevent identity-related outages and breaches.

Active Countermeasures RITA

Open source framework for network traffic analysis that ingests Zeek logs to detect beaconing, long connections, DNS tunneling, and threat intel matches.

Acunetix 360

Acunetix 360 scans web applications and APIs to identify security vulnerabilities through automated testing.

Acunetix Premium

Acunetix Premium is a web application security scanner that automatically detects vulnerabilities like SQL injection, XSS, and misconfigurations across websites and APIs.

adalanche

Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?

Adaptiva OneSite Patch

Adaptiva OneSite Patch is autonomous patch management software that detects, prioritizes, and deploys patches across Windows, Mac, and Linux endpoints at scale.

adm-controller

Manage admission policies in your Kubernetes cluster with ease

adscan

Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.

Adversarial Risk Management

Aembit

Aembit is a non-human identity and access management platform that verifies workload and AI agent identities, evaluates policy, and issues short-lived credentials.

afflib

AFFLIB is a library and toolkit implementing the Advanced Forensic Format for storing computer forensic disk images and associated metadata.

aflplusplus

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

agenthound

Agentic Security

Agentic Security scans AI agents and LLM applications for prompt injection, insecure tool use, and other vulnerabilities.

agentic-bug-hunter

agentshield

AgentShield is a cyber tool that scans AI agent configurations for security vulnerabilities like hardcoded secrets and permission misconfigs.

aguara

Aguara is a cyber tool that scans AI agent instructions, tool configurations, and software dependencies for malicious packages and risky permissions.

AI-Infra-Guard

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

ai-safe2-framework

Ai-Safe2-Framework provides governance, risk, and compliance controls for securing agentic AI systems and non-human identities.

aigoat

Aikido Security

Aikido Security is a developer-focused application security platform that scans code, dependencies, containers, and cloud infrastructure to detect and help fix vulnerabilities.

Aikido Security safe-chain

Aikido Safe Chain blocks malware in npm and PyPI packages on developer laptops and CI/CD by intercepting downloads through a local proxy.

AIR Security AIR

AIR is an inline context firewall that discovers enterprise AI agents, vets every skill, plugin and MCP server they use and blocks untrusted instructions.

Aircrack-ng

Aircrack-ng is a complete suite of tools to assess WiFi network security, covering monitoring, attacking, testing, and cracking WEP and WPA PSK.

Aircrack-ng mdk4

MDK4 is a proof-of-concept Wi-Fi testing tool that exploits common IEEE 802.11 protocol weaknesses by injecting frames on multiple operating systems.

airgeddon

airgeddon is a multi-use bash script for Linux systems to audit wireless networks.

airgorah

A WiFi security auditing software

Akto

Akto discovers APIs, MCP servers and AI agents, tests and red-teams them, and enforces runtime guardrails and posture management.

ALEAPP

ALEAPP (Android Logs Events And Protobuf Parser) is a tool that parses Android extractions and generates artifact reports for digital forensics.

AlertEnterprise

Alibaba Cloud OpenSandbox

OpenSandbox gives AI applications isolated environments to execute code, run commands, manage files, and operate browsers or desktops.

amneziawg-installer

AnChain.AI

AnChain.AI builds AI-powered blockchain analytics tools for crypto investigations, AML compliance, and payment risk screening.

Anchore

Anchore Grype

Grype is a vulnerability scanner for container images and filesystems.

Anchore syft

Syft is a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.

Androguard

Androguard is a Python toolkit for Android reverse engineering: inspect APKs, disassemble or decompile DEX code, and hunt references and vulnerabilities.

AngryOxide

AngryOxide is an 802.11 attack tool built in Rust that performs automated Wi-Fi attacks to collect hashlines crackable with Hashcat.

Anomali

anthropic-cybersecurity-skills

apex

AI-powered offensive security testing using autonomous agents, directly in your terminal.

Apiiro

Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.

apkhunt

APKHunt is a comprehensive static code analysis tool for Android apps that is based on the OWASP MASVS framework. Although APKHunt is intended primarily for mobile app developers and security testers, it can be used by anyone to identify and address potential security vulnerabilities in their code.

APKiD

APKiD identifies how an APK was made, detecting compilers, packers, obfuscators, and other characteristics of Android applications.

apparmor.d

AppOmni

aptrs

Automated pentest reporting with custom templates, project tracking, customer dashboard and client management tools. Streamline your security workflows effortlessly!

Aqua Security kube-bench

Checks whether Kubernetes is deployed securely by running CIS Kubernetes Benchmark tests configured via YAML files.

Aqua Security Tracee

Tracee is an open-source runtime security and forensics tool that uses eBPF to trace system events and detect suspicious behavior in Linux environments.

Aqua Security Trivy

Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds

Arcade

Arcade is a developer platform that provides AI agents with secure, authenticated access to tools and APIs across popular services.

Arcjet

Arcjet is the AI agent runtime security platform that helps teams observe agent activity, enforce policies on tool calls, and audit decisions.

Arctic Wolf

arjun

Arjun is an HTTP Parameter Discovery Suite that finds valid query parameters for URL endpoints using a default dictionary of 25,890 parameter names.

Arkose Labs

Arkose Labs protects account integrity with adaptive defenses that stop bots, AI agents, and human fraud networks across the user journey.

Armis

ArmorCode

ArmorCode is the independent control plane where AI agents help find, prioritize, and fix vulnerabilities across apps, cloud, infra, and AI.

Arnica

Arnica is an application security platform that scans code for vulnerabilities across SAST, SCA, IaC, and secrets, integrating directly into source code management.

arp-scan

Network scanning tool that uses the ARP protocol to discover and fingerprint IPv4 hosts on the local network.

arsenal-ng

arsenal-ng is a pentest command launcher written in Go with fuzzy search across 248 tools and 2,940 commands for Linux and macOS.

Artemis

Artemis is a modular vulnerability scanner that checks website security aspects and builds easy-to-read reports to send to scanned organizations.

Artemis Security

Artemis Security is a cybersecurity platform that provides detection, investigation, threat hunting, and response using a unified model of a customer's environment.

Asimily

Asimily is a cyber asset defense platform that discovers IoT, OT, and IoMT devices, prioritizes vulnerabilities by risk, and enforces mitigation through segmentation and patching.

AsmResolver

AsmResolver is a library for reading, modifying, and reconstructing Portable Executable files, supporting native Windows and managed .NET images.

asnmap

Maps organization network ranges to CIDR blocks using ASN, IP, DNS, or ORG name lookups.

assetfinder

Find domains and subdomains related to a given domain - tomnomnom/assetfinder

Astrix Security

Gain visibility and control over AI agents & NHIs. Astrix secures agent identities with governance, least-privilege access, and full audit trails.

attackgen

AttackIQ

Auditd Best Practices

Auditd Best Practices provides a best-practice auditd configuration that collects broad, reusable security-relevant host telemetry across major Linux distributions.

Aura

Aurascape

Aurascape secures employee AI use, helps teams build agents safely, and protects AI agents in production with real-time visibility, policy enforcement, and data protection.

Auth0

authentik

authentik is an open-source Identity Provider and SSO platform supporting OAuth2, SAML, LDAP, RADIUS, and SCIM, designed for self-hosting.

Automox

AutoPkg

AutoPkg is an automation framework for macOS software packaging and distribution, preparing third-party software for mass deployment to managed clients.

Aviatrix

Welcome to the comprehensive documentation for Aviatrix's cloud networking platform. Here you'll find everything you need to deploy, configure, and manage your multi-cloud networking infrastructure.

Aviatrix CoPilot

axel

Axel is a lightweight CLI download accelerator that speeds up downloads using multiple connections per file, supporting HTTP, HTTPS, FTP, and FTPS.

Axonius

Axonius is a cybersecurity platform that discovers, manages, and protects all devices and software across an organization's IT infrastructure.

aya

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

b374k

b374k is a single-file PHP shell that enables remote web server management via a browser, including file management, command execution, and database access.

Backslash

Backslash detects and prioritizes reachable vulnerabilities in cloud-native application code and dependencies.

Baffle

Baffle is an enterprise security platform that protects data using masking, tokenization, and encryption with role-based access control, supporting GenAI, analytics, and databases.

bank-vaults

Bastille Networks

Bastille Networks offers a Wireless Airspace Cybersecurity Platform that detects and locates wireless devices and threats across 50+ protocols in enterprise environments.

bbot

The recursive internet scanner for hackers.

BC Security powershell-empire

PowerShell Empire is a post-exploitation and adversary emulation framework used to aid Red Teams and Penetration Testers.

BC Security Starkiller

Starkiller is a Frontend for Empire.

Bearer

Bearer CLI is a free and open code security scanning tool that natively filters and prioritizes security risks by business impact

Bedrock Security

BeEF

BeEF (Browser Exploitation Framework) is a penetration testing tool that hooks web browsers and uses them to launch attacks against target systems.

Beelzebub

Beelzebub is an open-source deception framework that deploys realistic decoys to observe attacker behavior and capture interactions as security evidence.

Belkasoft

Belkasoft is a digital forensics and incident response platform for investigating cybercrime, data breaches, and security incidents.

bettercap

Go-based network attack framework for reconnaissance and exploitation of WiFi, BLE, HID, CAN-bus, and Ethernet networks.

bettercap-ui

Official web UI for bettercap, the network attack and monitoring framework.

betterleaks

BeyondTrust

BeyondTrust provides privileged access management and endpoint security solutions to control, monitor, and audit user access to critical systems.

Bforeai

BigID

Bishop Fox CloudFox

CloudFox is an open source command line tool that helps penetration testers find exploitable attack paths in cloud infrastructure.

Bishop Fox sliver

Sliver is an open-source, cross-platform adversary emulation and red team framework for authorized security testing across macOS, Windows, and Linux.

Bitnami Sealed Secrets

Encrypts Kubernetes Secrets into SealedSecrets safe for public storage, decryptable only by the in-cluster controller.

Black Duck

Black Duck is a software composition analysis tool that identifies and manages open source components, vulnerabilities, and licensing risks in applications.

blackarch

bloodyad

Active Directory privilege escalation tool that performs LDAP calls to a domain controller, supporting cleartext, pass-the-hash, pass-the-ticket, and certificat

Bloom Security

Bloom Security maps the applications, AI agents, plugins, extensions and code packages on every employee endpoint and enforces risk-based policy on them.

Bold Security

Bold Security runs a local AI agent on every endpoint that blocks insider threats, data leakage and shadow-AI use.

bopscrk

Generates targeted wordlists by combining personal info, applying leet/case transforms, and fetching artist lyrics for password attacks.

BorgBackup

BorgBackup is an open-source deduplicating archiver with compression and authenticated encryption, used for space-efficient, verifiable backups.

bpf-linker

bpf-linker statically links multiple BPF object files together and optionally performs optimizations to target older kernels.

braa

Braa is a mass SNMP scanner that queries dozens or hundreds of hosts simultaneously in a single process, consuming very few system resources.

Breachrx

Bridgecrew Checkov

Static code analysis tool for infrastructure-as-code and SCA tool that scans cloud configs for security and compliance misconfigurations.

Bright Security

Bright is a dynamic application & API security testing platform that offers automation, fast scans, minimal false positives, and comprehensive security testing.

Brinqa

Brinqa is a risk and security analytics platform that aggregates and correlates security data to prioritize vulnerabilities and threats.

Britive

Britive is a platform providing policy-based access control, JIT provisioning, secrets management, and endpoint privilege management to enforce zero standing privileges.

Bruce

Predatory ESP32 firmware for M5Stack, Cardputer and LilyGo devices.

bruteforce-luks

bruteforce-luks tries to find the password of a LUKS encrypted volume via exhaustive charset enumeration or dictionary file.

bruteforce-salted-openssl

bruteforce-salted-openssl tries to find the password of a file encrypted with the openssl command, using exhaustive or dictionary mode.

bruteforce-wallet

bruteforce-wallet tries to find the password of an encrypted Peercoin, Bitcoin, or Litecoin wallet.dat file via exhaustive or dictionary attack.

bruteshark

BruteShark is a Network Forensic Analysis Tool that processes PCAP files to extract passwords, authentication hashes, and build network maps.

brutespray

Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.

Bubblewrap

Bubblewrap is a tool for constructing sandbox environments that lets unprivileged users run applications with restricted access to the operating system.

Bugcrowd

Bugcrowd is a crowdsourced security platform that connects organizations with ethical hackers to find and report vulnerabilities through bug bounty and penetration testing programs.

Bugcrowd Researcher Platform

Bugcrowd Researcher Platform crowdsources security vulnerability discovery by connecting organizations with ethical hackers and security researchers worldwide.

Buildah

Buildah is a command line tool that facilitates building Open Container Initiative (OCI) container images with or without Dockerfiles.

bulk-extractor

bulk_extractor is a digital forensics tool that scans disk images and files to extract structured information such as email addresses and credit card numbers.

bully

Bully is a C program that brute-forces WPS on Wi-Fi access points by exploiting the WPS specification design flaw, running on Linux including embedded systems.

Bunkerity BunkerWeb

Open-source and cloud-native Web Application Firewall (WAF)

burp-ai-agent

Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more

burpsuite-collections

bytebase

Bytebase is an open-source database governance platform governing change management, access control, and compliance across databases for humans and AI agents.

bytecode-viewer

Java/Android bytecode viewer and reverse engineering suite with multiple decompilers, disassemblers, assemblers, and APK conversion support.

c/side

C/Side is a cloud-based IDE for Dynamics 365 Business Central development, enabling creation and modification of extensions and customizations.

caido

Caido - A lightweight web security auditing toolkit for penetration testing and security research.

calico

Open-source container networking and network security solution for Kubernetes supporting eBPF, BGP, VXLAN, and WireGuard encryption.

cameradar

Cameradar scans RTSP endpoints on authorized targets and uses dictionary attacks to bruteforce their credentials and routes.

Canonical Landscape

Landscape is a systems management tool that automates security patching, auditing, access management, and compliance tasks across Ubuntu estates.

CAPEv2

CAPEv2 is a malware sandbox that executes malicious files in an isolated environment whilst instrumenting their dynamic behaviour and collecting forensic artefacts.

Capital One VulnHunter

VulnHunter is an open-source agentic AI security tool that applies attacker-first analysis to source code to identify exploitable vulnerabilities.

Capstone

Capstone is a disassembly framework supporting multiple hardware architectures, designed for binary analysis and reversing in the security community.

cargo-auditable

cariddi

Cariddi crawls URLs from a list of domains and scans for endpoints, secrets, API keys, file extensions, and tokens.

case

Castle

Castle is a fraud detection platform that monitors user behavior and device signals to detect account takeovers, fake accounts, and other abuse.

Cathedral Cyber SPITFIRE

Deployable nerve center for pentest engagements integrating collaboration, C2, recon, reporting, and reference tools on a portable server.

Cato Networks

Caution

Censys

Censys is a search engine for internet-connected devices that indexes certificates, websites, and network services for security research and reconnaissance.

cerbos

Cerbos is an open-core authorization management platform for authorizing every identity and governing every action across applications, gateways, workloads, and AI agents.

cert-manager

Automatically provision and manage TLS certificates in Kubernetes

certgraph

An open source intelligence tool to crawl the graph of certificate Alternate Names - lanrat/certgraph

certipy-ad

Enumerates and exploits Active Directory Certificate Services misconfigurations, supporting all ESC1-ESC17 attack paths.

Certiv

Certiv is an AI agent assurance platform for endpoints that discovers every agent, monitors activity in real time, and enforces policy before risky actions execute.

cewl

CeWL is a Ruby app that spiders a given URL to a specified depth and returns a list of words for use with password crackers.

Chainguard

Chainguard provides trusted open source artifacts for every layer of your modern software stack—containers, language libraries, and VM images.

changeme

changeme is a default credential scanner that detects default and backdoor credentials across protocols including HTTP, SSH, FTP, SNMP, and databases.

Charm Security

Checkmarx

Checkmarx agentic application security software platform Combines Hybrid scanning, AI-powered agents, and unified risk intelligence across every attack surface

Checkmarx KICS

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

checksec.sh

Checks security properties of executables (PIE, RELRO, stack canaries, NX, FORTIFY_SOURCE) and kernel configurations on Linux systems.

CHIPSEC

CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components.

chisel

Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH, useful for passing through firewalls.

Chocolatey Software Chocolatey

Chocolatey is a package manager for Windows, similar to apt-get or yum, that automates software installation and management.

cicd-sensor

Open-source eBPF runtime security sensor for GitHub Actions and GitLab CI/CD.

Cilium hubble

Hubble - Network, Service & Security Observability for Kubernetes using eBPF

Cilium tetragon

Tetragon is an eBPF-based security observability and runtime enforcement tool for Kubernetes and cloud-native environments.

cilium-cli

CLI to install, manage & troubleshoot Kubernetes clusters running Cilium

CISA ScubaGear

ScubaGear is an assessment tool that verifies a Microsoft 365 tenant's configuration conforms to CISA SCuBA Secure Configuration Baseline policies.

cisagov CSET

CSET is a free software tool by CISA and INL that guides users through assessing cybersecurity posture and comparing it to security standards.

cisagov Malcolm

Malcolm is an open-source network traffic analysis tool suite that ingests PCAP files, Zeek logs, and Suricata alerts for network security monitoring.

Cisco / Splunk Splunk Enterprise Security

Splunk Enterprise Security is a platform that collects, analyzes, and correlates security data to detect threats and respond to incidents.

Cisco creddump7

Extracts cached domain credentials, LSA secrets, and LM/NT hashes from Windows registry hives offline.

Cisco Duo Desktop

Cisco Duo Desktop is a native client application that checks the security posture of laptops and desktops to control access to corporate applications.

Cisco skill-scanner

Security Scanner for Agent Skills

Cisco Snort3

Snort 3 (Snort++) is a next-generation intrusion prevention system (IPS) that inspects and alerts on network traffic using rules and multi-threaded packet proce

Cisco Splunk Enterprise

Splunk Enterprise enables you to search, analyze and visualize your data to quickly act on insights from across your technology landscape.

Cisco Splunk Enterprise Security

Cisco Splunk SOAR

Cisco Talos ClamAV

ClamAV is an open source antivirus engine for detecting trojans, viruses, malware, and other malicious threats.

CISO Assistant

CISO Assistant is a one-stop-shop GRC platform for Risk Management, AppSec, Compliance & Audit, TPRM, BIA, Privacy, and Reporting. It supports 200+ global frameworks with automatic control mapping, including ISO 27001, NIST CSF, SOC 2, CIS, PCI DSS, NIS2, DORA, GDPR, HIPAA, CMMC, and more.

CISOfy Lynis

Security auditing and hardening tool for UNIX-based systems that performs in-depth scans and provides system hardening tips.

Clair

Performs static analysis of vulnerabilities in OCI and Docker container images via an API for indexing and matching.

clamui

ClamAV Desktop application ( GUI )

Claroty

Clavister Knowledge Base

clawscan

ClawScan is a composable security scanning harness for agent skills that runs multiple scanners, passes results to a judge, and compares against benchmarks.

Clerk

Clerk is an authentication and user-management platform that provides pre-built UI components, APIs, and SDKs for adding sign-up, sign-in, and identity features to applications.

Clevis

Pluggable framework for automated decryption of data and automated unlocking of LUKS volumes using pins like Tang, TPM, and PKCS#11.

ClickHouse

ClickHouse® is a real-time analytics database management system

ClickHouse RunReveal

RunReveal is a security platform that stores, detects threats in, and helps teams respond to all their security data in one place.

Cloud Custodian

Cloud Custodian is a rules engine for managing public cloud accounts and resources across AWS, Azure, and GCP using YAML-defined policies.

cloud-enum

Enumerates public resources across AWS, Azure, and Google Cloud using OSINT and keyword-based fuzzing.

cloudbrute

CloudBrute is a tool to find a company's infrastructure, files, and apps on top cloud providers including Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, and Linode.

Cloudflare

Cloudflare Blog is a publication sharing updates, technical insights, and announcements about Cloudflare's internet security, performance, and developer infrastructure products.

cloudformation-guard

Cloudmersive

Cloudmersive is a cloud API platform providing developers with tools for document conversion, image processing, virus scanning, and data validation.

Cloudsmith

Cloudsmith is a fully-managed artifact management, software supply chain security, and software distribution platform.

Clover Security

Clover Security automates security design reviews and threat modelling from specs, flags design-to-implementation drift, and feeds security context to coding agents.

cmseek

CMSeeK is a CMS detection and exploitation suite that scans WordPress, Joomla, Drupal, and over 180 other content management systems.

cntlm

Local proxy authenticating to corporate NTLM/NTLMv2 proxies, forwarding connections without exposing credentials.

Codacy

code-on-incus

Coi is a cyber tool that runs AI coding agents inside isolated Incus containers with active defense and network isolation.

Codeintegrity

Codezero

Codezero is a developer tool that enables teams to collaboratively test and debug microservices by connecting local development environments directly to live Kubernetes clusters.

coercer

Coercer is a Python script that automatically coerces a Windows server to authenticate on an arbitrary machine through many methods.

Cohesity

Cohesity DataProtect is an enterprise data protection platform for self-managed Cohesity clusters, offering backup, security, and ransomware protection.

Cohesity Data Cloud

Cohesity FortKnox

Cohesity NetBackup

Cohesive VNS3 Controller

Cohesive VNS3 Controller is a network security appliance that creates encrypted virtual networks and manages multi-cloud connectivity and segmentation.

coi

colly

Colly is a Go framework that lets you build web scrapers and crawlers to extract structured data from websites.

Command Zero

AI SOC platform with autonomous and AI-assisted investigation modes. Run the full Tier-1 to Tier-3 lifecycle across identity, endpoint, cloud, and SaaS.

Commix

Automates detection and exploitation of command and code injection vulnerabilities in web applications.

Commvault Cloud

Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.

Commvault Clumio

Compyl

ConductorOne

ConductorOne is an identity governance platform that automates workforce access management and deploys AI agents to streamline access reviews and provisioning.

ConnectWise Automate

ConnectWise Automate is an RMM tool that helps MSPs proactively monitor, manage, and support endpoints while automating repetitive tasks.

containerssh

Contrast Security

Contrast Security provides the Contrast Runtime Security Platform, which instruments applications from within to detect vulnerabilities and block attacks in real time.

Conveyor

Conveyor delivers AI for high-stakes customer requests like security reviews, vendor assessments, and requests for proposal (RFP).

copacetic

Corellium

Corellium is a platform that provides virtual iOS, Android, and IoT devices for testing, security research, and automation without relying on physical hardware.

Corridor

Corridor injects codebase-specific guardrails into Cursor, Claude Code and Codex, scans changes before commit, reviews pull requests and enforces merge policy.

Cortex

Open source observable analysis platform that lets SOCs and CSIRTs analyze IPs, URLs, files, and hashes at scale via a web UI or REST API.

cortex-analyzers

Collection of Cortex analyzers and responders for automating observable analysis and response actions in TheHive Project.

Cossack Labs Themis

Themis is an open-source cryptographic services library for securing data during authentication, storage, messaging, and network exchange.

cradle

Crash Override Chalk

Chalk allows you to follow code from development, through builds and into production.

Credo AI

Credo AI is a platform for auditing and managing AI governance, compliance, and responsible AI practices across organizations.

Cribl

Cribl is an observability pipeline platform that helps organizations collect, process, route, and transform machine data from any source to any destination.

Cribl / CardinalOps CardinalOps

Cribl CardinalOps

Cribl Stream

Cribl Stream is a data processing platform that routes, transforms, and enriches data from multiple sources to destinations in real-time.

crlfuzz

CRLFuzz is a fast tool written in Go that scans for CRLF vulnerabilities in URLs.

crowbar

Brute forcing tool for penetration tests supporting RDP, SSH private keys, VNC, and OpenVPN authentication.

CrowdSec

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

CrowdStrike

CrowdStrike provides cloud-based endpoint security and threat intelligence services protecting organizations from cyberattacks and malware.

CrowdStrike Counter Adversary Operations

CrowdStrike Counter Adversary Operations combines AI-powered threat intelligence and 24/7 managed threat hunting to detect and stop adversaries.

CrowdStrike Falcon AI Detection and Response

CrowdStrike Falcon AI Detection and Response is a cybersecurity platform that uses artificial intelligence to detect, investigate, and automatically stop threats across endpoints, cloud, and identity environments.

CrowdStrike Falcon Cloud Security

CrowdStrike Falcon Data Protection

CrowdStrike Falcon Data Protection provides endpoint detection and response capabilities to protect against threats and data breaches.

CrowdStrike Falcon Exposure Management

CrowdStrike Falcon Exposure Management continuously discovers and prioritizes attack surface vulnerabilities across an organization's assets, helping security teams reduce risk and remediate exposures faster.

CrowdStrike Falcon for IT

CrowdStrike Falcon for XIoT

CrowdStrike Falcon for XIoT is a security platform that detects and responds to threats on extended IoT devices and operational technology networks.

CrowdStrike Falcon Identity Protection

CrowdStrike Falcon Identity Protection detects and prevents identity-based attacks through behavioral analytics and threat intelligence across enterprise environments.

CrowdStrike Falcon Insight XDR

CrowdStrike Falcon Insight XDR is an extended detection and response platform that unifies endpoint and cross-domain telemetry to detect, investigate, and stop advanced threats.

CrowdStrike Falcon Next-Gen SIEM

CrowdStrike Falcon Next-Gen SIEM collects, analyzes, and correlates security data to detect and respond to threats across enterprise environments.

CrowdStrike Falcon Onum

CrowdStrike Falcon Secure AI Services

CrowdStrike Falcon Secure AI Services provides AI-powered threat detection, incident response automation, and security intelligence for enterprise endpoints and cloud environments.

CrowdStrike Falcon Shield

CrowdStrike Falcon provides cloud-based endpoint protection and threat intelligence, detecting and preventing cyberattacks on devices.

crust

Crust is a transparent, local gateway between AI agents and LLM providers that intercepts tool calls and blocks dangerous actions before they execute.

cryptomator

Cryptomator for Windows, macOS, and Linux: Secure client-side encryption for your cloud storage, ensuring privacy and control over your data.

CTFd

CTFd is a Capture The Flag framework focusing on ease of use and customizability, with everything needed to run a CTF.

Cure53 DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

curl

A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl offers a myriad of powerful features

cutter

Cutter is a free and open-source reverse engineering platform powered by Rizin, available for Linux, macOS, and Windows.

cve

CVE MCP Server

CVE MCP Server provides an MCP interface for looking up Common Vulnerabilities and Exposures (CVEs).

cve-lite-cli

CVE Lite CLI is a command-line tool that scans project lockfiles for vulnerabilities and provides copy-and-run fix commands.

cve-search

Cybeats SBOM Studio

Cybeats SBOM Studio stores, enriches, distributes, and continuously monitors SBOMs at scale for digital product risk and compliance management.

CybelAngel

CybelAngel is a digital risk protection platform that detects and remediates exposed data, credentials, and assets across the internet, dark web, and connected storage.

Cyberbro

Cyberbro is an application that extracts IoCs from garbage input and checks their reputation using multiple services.

cyclonedx-cli

cyclonedx-core-java

CycloneDX SBOM Model and Utils for Creating and Validating BOMs

cyclonedx-go

cyclonedx-gomod

cyclonedx-gradle-plugin

cyclonedx-maven-plugin

cyclonedx-python

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

cyclonedx-python-lib

Cycode

Cycode is a complete software supply chain security platform that protects the software development lifecycle.

Cyera

Cyera is a cloud data security platform that discovers, classifies, and protects sensitive data across cloud environments to reduce risk and ensure compliance.

Cymulate

Dalfox

Dalfox is an open-source XSS scanner and automation tool for reflected, stored, and DOM-based XSS, with parameter discovery and AST-level verification.

dark-moon

DarkMoon is an autonomous AI penetration testing cyber tool that finds, exploits, and documents vulnerabilities on authorized infrastructure.

DarkFlippers Unleashed Firmware

Databricks

Databricks is a unified analytics platform for data engineering, data science, and machine learning built on Apache Spark.

Databricks Panther

Datadog Cloud Security

Datadog Cloud Security monitors cloud infrastructure for threats, misconfigurations, and compliance violations across multi-cloud environments.

Datadog Cloud SIEM

Datadog Cloud SIEM detects and investigates security threats and anomalies across cloud infrastructure through real-time log analysis and threat detection.

Datadog GuardDog

GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Datadog pathrunner

Datadog Security

Datadog Security is a cloud monitoring platform that detects threats, vulnerabilities, and compliance risks across applications and infrastructure.

Datadog Stratus Red Team

Stratus Red Team is a self-contained binary that detonates granular, offensive attack techniques against live cloud environments, mapped to MITRE ATT&CK.

DataDome

DataDome protects web, mobile, and API applications by detecting and blocking bot and fraud traffic.

Datto RMM

Datto RMM is a secure cloud-based platform that lets IT professionals remotely monitor, manage, and support client endpoints.

dcfldd

dcfldd is an enhanced version of GNU dd for forensics and security, adding on-the-fly hashing, status output, disk wiping, output verification, and multiple outputs.

deepaudit

DeepAudit：人人拥有的 AI 黑客战队，让漏洞挖掘触手可及。小白一键部署运行，自主协作审计 + 自动化沙箱 PoC 验证。支持 Ollama 私有部署 ，一键生成报告。支持中转站。​让安全不再昂贵，让审计不再复杂。

Deepfence ThreatMapper

ThreatMapper hunts for threats in production platforms and ranks them based on risk-of-exploit, uncovering vulnerable software, exposed secrets, and security deviations.

Deepfence YaraHunter

YaraHunter scans container images, running Docker containers, and filesystems to find indicators of malware using a YARA ruleset.

Deepmark

DeepSource

DeepSource is an automated code review platform that analyzes code for bugs, security vulnerabilities, anti-patterns, and style issues across multiple languages.

DeepTeam

DeepTeam tests and red-teams LLM applications by simulating attacks and evaluating security vulnerabilities.

defectdojo

DefectDojo is a DevSecOps, ASPM, and vulnerability management tool that orchestrates end-to-end security testing, vulnerability tracking, deduplication, remediation, and reporting.

Defused

Delinea

Delinea Secret Server is an enterprise-grade password management solution designed to help organizations securely store, manage, and control access to privileged credentials.

dep-scan

DePalma Research AI DFIR Toolkit

DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

DerScanner

detect-it-easy

The detect-it-easy analyzer identifies executable and file formats on Windows, Linux, and macOS.

Devicie

Devicie continuously automates the endpoint operations that keep your end-user environment current, secure and aligned to policy, inside Microsoft Intune.

dex2jar

dex2jar is a set of tools to work with Android .dex and Java .class files, including converting .dex files to .class files zipped as jar.

dfdatetime

dfDateTime provides date and time objects for digital forensics to preserve accuracy and precision.

DFIR ORC

DFIR ORC is an ANSSI tool that collects forensic artifacts from Windows systems for digital forensic and incident response investigations.

dfvfs

Digital Forensics Virtual File System (dfVFS)

dfwinreg

dfWinReg provides read-only access to Windows Registry objects via a generic interface resembling the Registry key hierarchy on a live Windows system.

dhcpig

DHCP exhaustion script written in python using scapy network library - kamorin/DHCPig

Didit

Didit provides identity verification, fraud prevention, and transaction-monitoring APIs, SDKs, and MCP tools.

DigiCert CertCentral

DigiCert CertCentral is a certificate lifecycle management platform that allows organizations to issue, manage, renew, and automate SSL/TLS and other digital certificates.

dirsearch

dirsearch is an advanced web path brute-forcer that discovers paths on web servers using wordlists.

discover

Discover is a cyber tool that automates penetration testing tasks including recon, scanning, enumeration, and malicious payload creation.

distorm3

diStorm3 is a binary stream disassembler library for x86/AMD64 that decomposes instructions into binary structures for code analysis.

dnscat2

DNS tunneling tool that creates an encrypted command-and-control channel over the DNS protocol for use in penetration testing.

dnsenum

Multithreaded Perl script that enumerates DNS information of a domain and discovers non-contiguous IP blocks.

DNSFilter

dnsmap

dnsmap scans a domain for common subdomains using a built-in or an external wordlist, mainly used by pentesters during the information gathering phase.

dnsrecon

DNSRecon is a Python script that enumerates DNS records, checks for zone transfers, brute forces subdomains, and supports security assessment and network troubleshooting.

dnstwist

doberman-core

Your AI's guard dog. Doberman sits at runtime, gating every input, output and tool call to stop unsafe or unintended actions before they execute.

Docker CLI

Docker Compose

Defines and runs multi-container Docker applications using a Compose file with a single command.

Docker Sandboxes

Docker Sandboxes isolates applications in lightweight containers, providing secure, reproducible environments for development and deployment.

dockerscan

Scans Docker container images for CVEs, secrets, supply chain attacks, CIS benchmark compliance, and runtime security issues.

DockSec

DockSec is an OWASP Lab Project AI-powered Docker security scanner that explains vulnerabilities in plain English.

donut-shellcode

Generates position-independent shellcode that enables in-memory execution of VBScript, JScript, EXE, DLL, and .NET assemblies.

dploot

Python tool for remotely or locally looting DPAPI-protected secrets (masterkeys, credentials, certificates, browser data) from Windows systems.

Dradis

Dragos

DRAKVUF

DRAKVUF is a virtualization-based agentless black-box binary analysis system for in-depth execution tracing of arbitrary binaries without installing software in the VM.

Drata

Dreadnode

Dreadnode is an AI-powered security research platform that helps teams build, run, and evaluate offensive AI agents for penetration testing and red teaming.

driftnet

Driftnet watches network traffic, and picks out and displays JPEG and GIF images for display

Dropzone AI

Dropzone AI is an agentic SOC platform with AI agents that investigate alerts, run threat hunts, and analyze threat intelligence 24/7.

Druva

Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.

Druva Data Resiliency Cloud

Druva Data Resiliency Cloud is a cloud-native platform providing backup, disaster recovery, and ransomware protection for enterprise data.

Druva inSync

dscan

dscan is a distributed Nmap scanner that wraps Nmap and distributes scans across several hosts.

dsniff

Enhanced fork of dsniff network sniffer with cookie logging, deep-packet inspection, and hidden command-line options.

Duality Technologies

dvwa

Intentionally vulnerable PHP/MariaDB web application for practicing common web vulnerabilities in a legal, controlled environment.

eaphammer

EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks for use in wireless assessments and red team engagements.

ecapture

Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64 and arm64.

Echo

Echo provides vulnerability-free containers, libraries, VMs, and OS packages continuously vetted and patched against known vulnerabilities and supply chain threats.

EclecticIQ OpenTAXII

Python implementation of TAXII server services for sharing cyber threat intelligence.

Eclypsium

Eclypsium’s infrastructure assurance platform protects mission critical hardware and detects compromised devices in enterprises and government agencies.

edb-debugger

edb-debugger is a cross platform AArch32/x86/x86-64 debugger for Linux, with ports underway for FreeBSD, OpenBSD, OSX, and Windows.

Edgescan

Edgescan is a platform that provides attack surface management, vulnerability scanning, and penetration testing as a service.

EFF Rayhunter

A tool that detects cell site simulators (IMSI catchers) on a cheap mobile hotspot.

elastdocker

Elastic Detection Rules

Detection Rules is Elastic's framework for defining and managing security detection logic to identify threats and anomalies in system and network data.

Elastic Security Labs

Elastic security labs is a powered by Elasticsearch. Ready to deploy your data?

ElcomSoft

emailharvester

EmailHarvester is a tool to retrieve domain email addresses from search engines including Google, Bing, Yahoo, ASK, Baidu, Dogpile, and Exalead.

EMBA

EMBA - The firmware security analyzer

Enable Security sipvicious

Set of cyber tools to audit SIP-based VoIP systems by scanning for SIP servers, enumerating extensions, and cracking passwords.

Enable Security wafw00f

Fingerprints Web Application Firewalls (WAFs) by analyzing HTTP responses to normal and malicious requests.

Endor Labs

Endor Labs is a software supply chain security platform that detects vulnerabilities and malicious dependencies in open source code.

Ent

Ent is an endpoint agent that detects human and AI-agent activity in the workspace and blocks insider risk, data loss and unsafe AI use.

Entersekt

enum4linux-ng

enum4linux-ng is a rewrite of enum4linux for enumerating information from Windows and Samba systems, wrapping nmblookup, net, rpcclient, and smbclient.

Enveil

EQTY Lab

Align and control data, models, and agents at runtime.

ESET PROTECT

ESET PROTECT is a centralized security management platform that allows administrators to deploy, monitor, and manage ESET endpoint protection across an organization's network.

ESP32 Marauder

A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32.

Ettercap

Comprehensive suite for man-in-the-middle attacks featuring live connection sniffing, content filtering, and active/passive protocol dissection.

evil-winrm

Evil-WinRM is a WinRM shell for hacking/pentesting that connects to Windows servers via WinRM, supporting pass-the-hash, Kerberos, in-memory payload execution, and AMSI bypass.

evil-winrm-py

evil-winrm-py is a Python-based tool for executing commands on remote Windows machines using the WinRM protocol via an interactive shell.

evilginx2

Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, bypassing 2-factor authentication.

Exabeam

Exabeam is a security analytics platform that detects insider threats and advanced cyberattacks through behavioral analysis and machine learning.

Exaforce

Exaforce runs AI Exabots that detect, triage, investigate and respond to threats across cloud, SaaS, identity, endpoint and code on a real-time knowledge graph.

exe2hexbat

Encodes Windows executable binaries into ASCII hex text for inline file transfer using DEBUG.exe or PowerShell.

exiflooter

Extracts and removes EXIF metadata from images, including GPS coordinates, via file, directory, or piped URLs.

F5 CalypsoAI

CalypsoAI tests AI systems for security, safety, and compliance risks before deployment.

Fail2ban

Fail2Ban scans log files and bans IP addresses conducting too many failed login attempts by updating system firewall rules to reject new connections.

Falco

Cloud-native Linux runtime security agent that detects abnormal behavior and threats by monitoring syscalls and container events using custom rules.

falco-talon

falcosidekick

fame

faraday-agent-dispatcher

Middleware dispatcher that integrates custom executors with Faraday vulnerability management platform, relaying JSON output to Faraday's Bulk Create API.

faraday-cli

Command-line client for Faraday that automates security workflows including managing workspaces, hosts, vulnerabilities, and tool reports.

Fastly

Fastly is an edge cloud platform offering content delivery network, load balancing, edge computing, and web application security services for developers and enterprises.

fatcat

FAT filesystems explore, extract, repair, and forensic tool - Gregwar/fatcat

favirecon

Use favicons to improve your target recon phase. Quickly detect technologies, WAF, exposed panels, known services.

fcaptcha

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Feedly Threat Intelligence

Feedly Threat Intelligence is a product that helps teams collect, enrich, and triage cyber threat intelligence using AI-powered agents and APIs.

fern-wifi-cracker

Wireless security auditing tool that cracks and recovers WEP/WPA/WPS keys and runs network-based attacks on wireless or ethernet networks.

feroxbuster

feroxbuster is a fast, simple, recursive content discovery tool written in Rust that uses brute force and wordlists to find unlinked web resources.

ffuf

ffuf is a fast web fuzzer written in Go for directory, vhost, and parameter discovery using a FUZZ keyword in URLs, headers, or POST data.

Fibratus

Security sensor for realtime threat detection and protection

Fig Security

findomain

Findomain is a subdomain enumeration tool that uses Certificate Transparency logs and 54 passive APIs to discover subdomains.

Finite State Platform

Finite State Platform is a software supply chain security tool that analyzes firmware and software composition to identify vulnerabilities and compliance risks.

Firejail

Firejail is an SUID sandbox program that reduces the risk of security breaches by using Linux namespaces, seccomp-bpf, and Linux capabilities.

Firezone

Firezone is an open source platform to securely manage remote access for any-sized organization.

flare-vm

FLARE-VM uses Chocolatey and Boxstarter scripts to automatically install and maintain a reverse engineering environment on Windows virtual machines.

Flashpoint

Fleet

Fleet is an open-source platform for IT and security teams to secure, manage, and maintain computing devices across every OS from one place.

Flexera Revenera

Flexera Software Vulnerability Manager

Flipper Devices Flipper One

Firmware for the Flipper One's low-power RP2350 co-processor, controlling the LCD, buttons, battery, and power states.

Flipper Devices Flipper Zero

fluxion

Fluxion is a security auditing and social-engineering research tool that retrieves WPA/WPA2 keys from access points via phishing attacks.

forensic-artifacts

Machine-readable YAML knowledge base of digital forensic artifacts for use as a reference or within other cyber tools.

Forescout

Fortreum

Fortreum Kovr

Kovr is Fortreum’s AI-native compliance automation platform for FedRAMP, CMMC, NIST, DoD SRG, GovRAMP, and PCI DSS readiness.

FOSSA

FOSSA secures the software supply chain with automated SBOM generation, software composition analysis, license compliance, and vulnerability management.

Fox-IT Dissect

Digital forensics and incident response framework for parsing and analysing forensic artefacts from disk images, filesystems, and containers.

Frida

Frida is a dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

Future Architect Vuls

Vuls is an agentless vulnerability scanner for Linux/FreeBSD, written in Go, that automatically detects and reports vulnerabilities affecting servers.

FuzzyAI

FuzzyAI tests AI agents by fuzzing tool calls to find security vulnerabilities and unsafe behavior.

fwbuilder

GUI firewall management application for iptables, PF, Cisco ASA/PIX/FWSM, and Cisco router ACL, storing configs in a central file.

gallia

garak

Garak scans language models and applications for vulnerabilities including prompt injection and data leakage.

gcpwn

gcpwn is a Google Cloud offensive security assessment framework for credential handling, service enumeration, artifact collection, and graph-based attack-path analysis.

gdb-peda

GDB plugin that enhances exploit development with colorized disassembly, ROP gadget search, pattern generation, and shellcode utilities.

gef

GEF (GDB Enhanced Features) - a modern experience for GDB with advanced debugging capabilities for exploit devs & reverse engineers on Linux

Geordie AI

Geordie AI is an AI governance platform that discovers autonomous agents, monitors their behavior, and provides controls to govern them as they scale.

getallurls

getallurls (gau) fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, Common Crawl, and URLScan for any given domain.

GFI Software GFI LanGuard

GFI LanGuard is a network security tool that scans and patches systems, manages vulnerabilities, and supports Windows, Linux, and WAN environments.

GhostESP

GhostESP is an ESP-IDF-native wireless security platform for ESP32 offering Wi-Fi and BLE assessment, packet capture, and a native app ecosystem.

GhostPack Rubeus

Rubeus is a C# toolset for raw Kerberos interaction and abuses, supporting ticket requests, forgery, extraction, roasting, and constrained delegation abuse.

Ghostty

Ghostty is a fast, feature-rich, and cross-platform terminal emulator that uses platform-native UI and GPU acceleration.

Giskard

Giskard tests and evaluates LLM applications for performance, bias, and security issues.

GitGuardian Detection Engine

GitGuardian Detection Engine scans code repositories to identify and alert on exposed secrets, credentials, and sensitive data.

GitGuardian SaaS

GitGuardian SaaS is a secrets detection and security platform that scans code repositories to prevent sensitive data leaks and policy violations.

GitGuardian Self-Hosted

GitGuardian Self-Hosted is an on-premise secret detection tool that scans repositories and prevents sensitive credentials from being committed.

GitHub

GitHub is a web-based platform for version control and collaborative software development using Git repositories.

GitHub CLI

GitHub CLI is a command-line tool that brings pull requests, issues, GitHub Actions, and other GitHub features to your terminal.

github-dorks

GitLab

GitLab is a web-based DevOps platform providing Git repository hosting, CI/CD pipelines, and collaboration tools for software development teams.

gitleaks

Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in git repos, files, and stdin.

Glasgow Interface Explorer

A Scots Army Knife for electronics, an FPGA-based tool for exploring and debugging digital interfaces.

GLAuth

GLAuth is a secure, easy-to-use LDAP authentication server with configurable backends for centralizing account management across infrastructure.

Glow

Glow's fleet of specialised AI agents maps the software, AI agents and developer tools on every employee device, assesses risk and enforces policy.

go-tuf

Go implementation of The Update Framework (TUF)

gobuster

CLI cyber tool for brute-forcing directories, DNS subdomains, virtual hosts, cloud buckets, and fuzzing using wordlists.

goldeneye

GoldenEye Layer 7 (KeepAlive+NoCache) DoS Test Tool - jseidl/GoldenEye

Google Cloud Forensics Utils

Cloud Forensics Utils provides tools for forensics teams to collect evidence from Google Cloud Platform, Microsoft Azure, and Amazon Web Services.

Google distroless

Distroless provides container images containing only your application and its runtime dependencies, without package managers, shells, or other standard Linux distribution programs.

Google GRR

Incident response framework with a Python agent installed on target systems and server infrastructure for remote live forensics.

Google SecOps

Google Timesketch

Timesketch is an open-source tool for collaborative forensic timeline analysis, letting users organize and analyze timelines together with annotations, comments, tags, and stars.

google-nexus-tools

gosec

Go security checker

goshs

goshs - the simple, yet feature-rich web server goshs is a modern replacement for Python’s SimpleHTTPServer, written in Go.

gospider

GoSpider is a fast web spider written in Go that crawls websites, parses robots.txt and sitemap.xml, and extracts URLs from JavaScript files.

gpart

Scans a damaged MBR-partitioned disk to guess and reconstruct lost partition tables by detecting filesystem signatures.

GrapheneOS hardened_malloc

hardened_malloc is a security-focused general purpose memory allocator providing the malloc API with substantial hardening against heap corruption vulnerabilities.

grapheneos.org

graudit

graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep.

graylog2-server

Free and open log management

Great Scott Gadgets Cynthion

Cynthion is an FPGA-based tool for building, testing, monitoring, and experimenting with USB devices, including protocol analysis and emulation.

Great Scott Gadgets GreatFET One

GreatFET One is an interface tool for hardware hacking, making, and reverse engineering, produced by Great Scott Gadgets.

Great Scott Gadgets HackRF One

HackRF One is a low cost, open source Software Defined Radio platform for receiving and transmitting radio signals.

Great Scott Gadgets Packetry

Packetry is a fast, intuitive USB 2.0 protocol analysis application for use with Cynthion.

Great Scott Gadgets ubertooth

Ubertooth is an open source wireless development platform for Bluetooth experimentation, shipping with a BLE sniffer and Basic Rate Bluetooth Classic sniffing capability.

Great Scott Gadgets Ubertooth One

An open source 2.4 GHz wireless development platform for Bluetooth experimentation and sniffing; Great Scott Gadgets retired it from its catalog in December 2022.

Great Scott Gadgets YARD Stick One

A USB sub-1 GHz digital wireless transceiver that runs rfcat firmware, used to test garage doors, remote keyless entry, sensors and other low-speed radio systems.

greedybear

Gremwell qsslcaudit

qsslcaudit is a tool to determine if an application using TLS/SSL for data transfers does this in a secure way.

Gruntwork cloud-nuke

cloud-nuke is a CLI tool to delete all resources in your cloud account, designed for cleaning up test accounts and removing leftover resources.

gsa

Greenbone Security Assistant - The web frontend for the Greenbone Community Edition

gss-ntlmssp

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication.

guard

gvm-libs

gvmd

Greenbone Vulnerability Manager - The database backend for the Greenbone Community Edition

h4x-tools

h5i

h5i is an Axum-based Rust web framework for formal verification with Lean 4 and optional GPU acceleration, plus development infrastructure for browser automation and red-teaming.

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services or local breaches.

hackingbuddygpt

Hackmanit TInjA

TInjA is a CLI tool that tests web pages for template injection vulnerabilities, supporting 44 template engines across eight programming languages.

Hackmanit Web-Cache-Vulnerability-Scanner

Web Cache Vulnerability Scanner (WCVS) is a CLI tool that tests websites for web cache poisoning and web cache deception vulnerabilities.

Hacktron

Hacktron is an AI-powered security code-review platform. Our AI agents review your repositories for exploitable vulnerabilities and surface them as pull-request comments and dashboard findings.

Hak5 Bash Bunny

A Linux-based USB attack platform that mimics keyboards, storage, serial and Ethernet devices to run multi-vector payloads against a computer within seconds of plugging in.

Hak5 Cloud C2

Hak5 Key Croc

A keylogger with a Linux base that triggers payloads when chosen keywords are typed, for red teams who want keystroke capture plus active attacks.

Hak5 LAN Turtle

A covert USB Ethernet adapter with a Linux system inside for remote access, network recon and man-in-the-middle work by pentesters and sysadmins.

Hak5 Packet Squirrel

A pocket-sized inline Ethernet man-in-the-middle device that sniffs, proxies and manipulates traffic with DuckyScript, Bash and Python payloads.

Hak5 Plunder Bug

A pocket-sized USB-C LAN tap that passively records or actively scans Ethernet links for packet analysis in tools like Wireshark.

Hak5 Screen Crab

An inline HDMI implant that sits between a computer and its display, saving screenshots or video to MicroSD and streaming them over WiFi through Cloud C2.

Hak5 Shark Jack

A pocket-sized Linux network pentest box that plugs into an Ethernet port and runs DuckyScript and Bash payloads for recon and exfiltration.

Hak5 Shark Jack Display

Shark Jack Display by Hak5 is a portable network attack and automation tool for pentesters and systems administrators for wired network auditing.

Hak5 USB Rubber Ducky

The keystroke injection tool that looks like a flash drive and types DuckyScript payloads into a computer as a keyboard, used by red teams and IT staff.

Hak5 WiFi Pineapple

WiFi Pineapple is a Hak5 device for WiFi penetration testing that performs rogue access point attacks, reconnaissance, and automated audits with actionable reports.

Hak5 WiFi Pineapple Pager

A pocket sized WiFi Pineapple built for those on the go.

hakrawler

Fast web crawler that gathers URLs and JavaScript file locations from target websites.

Harmonic Security

Harmonic Security detects shadow AI and prevents sensitive-data leaks across employee web, desktop, and agent workflows.

harpoon

Hashcat

Hashcat is a password recovery platform for GPUs, CPUs, and distributed systems, supporting over 590 hash modes and 10 attack modes.

hashcat-utils

Small utilities that are useful in advanced password cracking - hashcat/hashcat-utils

HashiCorp terraform

Terraform is an infrastructure as code tool that lets you build, change, and version infrastructure safely and efficiently.

hashrat

Hashrat is a hash-generation utility supporting md5, sha1, sha256, sha512, whirlpool, jh-244, jh256, jh-384, and jh-512 functions.

HCL Software HCL BigFix

HCL BigFix is an endpoint management platform that unifies device management, patching, & security through autonomous, AI-driven automation across 120+ OS.

hcxtools

hcxtools converts packets from capture files to hash files for use with Hashcat or John the Ripper.

Headscale

Headscale is an open source, self-hosted implementation of the Tailscale control server.

heartleech

heartleech scans systems for the Heartbleed vulnerability and downloads heartbleed data, with automatic private key retrieval and IDS evasion support.

Heimdal Patch & Asset Management

Heimdal Patch & Asset Management automates patch management for OS and third-party applications to ensure compliance and minimize risks.

hekatomb

Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.

helm-secrets

helm-secrets is a Helm plugin to decrypt encrypted Helm value files on the fly.

helmet

HexStrike AI

AI-powered MCP penetration testing platform integrating 150+ cyber tools and 12+ autonomous AI agents for automated security assessments.

Hexway apple-bleee

Apple bleee is a set of experimental scripts that sniff Bluetooth BLE traffic to reveal information leaked by Apple devices.

HiddenLayer

hollows_hunter

hollows_hunter is a command-line tool that scans running processes to recognize and dump malicious implants, shellcodes, hooks, and in-memory patches.

Horizon3 NodeZero

NodeZero is Horizon3's autonomous penetration testing platform that identifies, prioritizes, and helps remediate weaknesses across your environment.

horst

“horst” - lightweight IEEE802.11 wireless LAN analyzer with a text interface - br101/horst

hrtng

hrtng IDA plugin is a cyber tool that provides automation, deobfuscation, and pseudocode transformation features for reverse engineering in IDA Pro.

httprobe

Take a list of domains and probe for working HTTP and HTTPS servers - tomnomnom/httprobe

Hudson Rock

Hudson Rock is a cybersecurity threat intelligence platform that detects compromised credentials and leaked data across the internet.

HUMAN Security

humanbound

Open-source adversarial testing engine, SDK, and CLI for AI agents. Runs locally or against the Humanbound Platform.

Humanix

Humanix detects and stops social engineering attacks as they unfold across email, chat, voice, and help desk workflows.

humble

A humble and fast security-oriented HTTP headers analyzer.

Hunter

Hunter is a platform that finds and verifies professional email addresses, enables cold email outreach via Sequences, and discovers B2B leads.

Hunters Pathfinder AI

Hunters Pathfinder AI is an AI-powered security assistant that helps analysts investigate, triage, and respond to threats within the Hunters SOC platform.

hunting-queries-detection-rules

Hunting-queries-detection-rules is a learn how to use KQL functions like `where`, `summarize`, and `render` with syntax examples to streamline your data queries.

Huntress

hydra

Network login brute-forcing cyber tool supporting parallelized attacks across 50+ protocols including SSH, FTP, HTTP, and RDP.

HydraBus

Open source C firmware for HydraBus v1 hardware hacking board, enabling protocol analysis and hardware interaction.

HyperDbg

Open-source hypervisor-assisted debugger for Windows using Intel VT-x and EPT, supporting kernel/user-mode debugging, EPT hooks, syscall hooking, and hardware t

Hyperproof

Hyperproof is compliance and risk management software that allows developers to read and write platform data via REST APIs to automate functionality.

iDenfy

ifixai

ifixai is a cyber tool that audits AI agents for misalignment and operational risks by running adversarial inspections against business KPIs.

ike-scan

ike-scan discovers IKE hosts (IPsec VPN servers) and can fingerprint them using retransmission backoff patterns and Vendor ID payloads.

iLEAPP

iLEAPP parses iOS and iPadOS forensic extractions and produces HTML, TSV, timeline, KML, and LAVA output.

ILSpy

ILSpy is the open-source, cross-platform .NET assembly browser and decompiler, with a desktop UI running on Windows, Linux, and macOS.

imhex

ImHex is a hex editor for reverse engineers, programmers, and people who value their retinas when working at 3 AM.

ImmuniWeb

Immuta

Use Immuta to provision governed access to data.

infisical

Infisical is the open-source platform for securing secrets, certificates, access, and AI Agents.

Infobyte isr-evilgrade

Modular framework that exploits poor software update implementations by injecting fake updates via a built-in web server and DNS server.

InGuardians peirates

Peirates - Kubernetes Penetration Testing tool

INKY Technology INKY

inspectrum

inspectrum is a tool for analysing captured signals, primarily from software-defined radio receivers.

Inspektor Gadget

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF

inspy

Python-based LinkedIn enumeration tool for discovering employees, domains, and email addresses by company name.

Installomator

Installation script to deploy standard software on Macs - Installomator/Installomator

instaloader

Instaloader is a tool to download pictures or videos along with their captions and other metadata from Instagram.

IntelMQ

IntelMQ is an open-source threat intelligence processing framework that collects, normalizes, and routes security event data for incident response teams.

IntelOwl

Open source threat intelligence platform that aggregates multiple analyzers and tools to enrich observables and files via a single API request.

intrace

Enumeration of IP hops using existing TCP connections - robertswiecki/intrace

Intruder

Intruder is a security platform that scans targets for vulnerabilities and integrates with AWS, Google Cloud, Azure, Slack, Jira, and Zapier.

Invicti

Official documentation for Invicti AppSec Platform, Invicti Platform, and Invicti Enterprise — web application security testing, DAST, API security, and vulnerability management.

ipatool

Command-line tool that allows you to search for iOS, iPadOS, tvOS, watchOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages.

IPED

IPED is an open source tool that processes and analyzes digital evidence seized at crime scenes by law enforcement or in corporate investigations.

iproute2 (ss)

Iru

Iru is a device-centric platform that unifies security, IT, and compliance around devices and everything they touch.

is-website-vulnerable

is-website-vulnerable finds publicly known security vulnerabilities in a website's frontend JavaScript libraries via CLI, Docker, or GitHub Action.

isMalicious

Product updates, API improvements, and release notes for the isMalicious threat intelligence platform.

it-depends

It-Depends automatically builds a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.

IT-Harvest

Data-driven analyst firm covering the entire cybersecurity industry, with 4,000+ vendors and 11,000+ products in one living research platform (the IT-Harvest Dashboard).

ITarian

ITarian is an AI-native platform for managed service providers that consolidates RMM, patch management, MDM, remote desktop, service desk, and endpoint security in one console.

Ivanti Neurons for Patch Management

Ivanti neurons for patch management is a prioritize and patch vulnerabilities based on active risk exposure, patch reliability and device compliance with Ivanti's cloud-based patch management solution.

jadx

jadx is a Dex to Java decompiler providing command line and GUI tools for producing Java source code from Android Dex and Apk files.

jadx-ai-mcp

Jamf Pro

Jamf Pro, enterprise-level Mobile Device Management (MDM) software, manages and secures Apple devices with advanced tools and integrations.

Jazz Security

Jazz Security is an AI-native data loss prevention platform that investigates risky data movement and insider activity.

JFrog

JFrog is a DevOps platform providing software supply chain solutions including artifact management, CI/CD integration, and security scanning.

Joe Security (Joe Sandbox)

Joe Sandbox is a malware analysis platform by Joe Security that performs deep malware and phishing analysis, including endpoint detection and behavior inspection.

joplin

Joplin - the privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS.

JPCERT/CC LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log - JPCERTCC/LogonTracer

js-x-ray

jsql

jSQL Injection is a Java application for automatic SQL database injection. - ron190/jsql-injection

juice-shop

OWASP Juice Shop is an intentionally insecure web application that developers and security professionals use to practice finding and exploiting common vulnerabilities.

julius

Julius is a cyber tool that identifies LLM server infrastructure like Ollama and vLLM on network endpoints via HTTP probing.

JumpCloud

JumpCloud is a cloud-based directory platform that manages user identities, devices, and access to applications and networks across organizations.

JustCallMeKoko LLC ESP32 Marauder v8

The official handheld ESP32-C5 board for the ESP32 Marauder firmware, with a touchscreen, dual-band Wi-Fi 6, Bluetooth 5 and GPS for Wi-Fi and BLE auditing and wardriving.

jwt-hack

jwt-hack is a high-performance toolkit for testing, analyzing, and attacking JSON Web Tokens.

karton

Karton is a distributed malware processing framework based on Python, Redis and S3 for building flexible malware analysis pipelines.

Kaseya VSA

Kaseya VSA is a cloud-based remote monitoring and management tool that helps IT teams remotely monitor, manage, and secure endpoints.

kata-containers

Kata Containers builds lightweight Virtual Machines that feel and perform like containers but provide the workload isolation and security advantages of VMs.

Keeper Security

kexa

Keycard

Control agent access to tools, APIs, and data. Scoped to the task, enforced by policy, logged for everything.

Keycloak

Keycloak is an open-source identity and access management solution that provides single sign-on, authentication, and authorization for applications and services.

Keygraph shannon

Shannon is an autonomous AI pentester for web applications and APIs that analyzes source code, identifies attack paths, and executes real exploits to prove vulnerabilities.

Keystone

Lightweight multi-architecture assembler framework supporting Arm, Arm64, x86, MIPS, RISC-V, and more with a C/C++ API and multi-language bindings.

kingfisher

Detect secrets + live validation. Map blast radius. Revoke fast. Use the CLI or embed in Rust and Python.

Knocknoc

Knocknoc is a security tool for detecting and managing security vulnerabilities in software dependencies and code.

Knostic

Knostic enforces need-to-know access controls for enterprise AI assistants such as Microsoft Copilot.

Kopia

Kopia is a fast and secure open-source backup/restore tool that creates encrypted snapshots and saves them to cloud, network, or local storage.

ks-aur-scanner

kube2iam

kube2iam provides IAM credentials to containers running inside a Kubernetes cluster based on annotations.

kubehound

KubeHound is a Kubernetes attack graph tool that automates calculation of attack paths between assets in a cluster.

Kubernetes cri-tools

The cri-tools project provides command-line and validation tools for the Kubelet Container Runtime Interface (CRI).

Kubernetes kustomize

Customization of kubernetes YAML configurations

kubernetes-helm

Helm is the package manager for Kubernetes that manages Charts, which are packages of pre-configured Kubernetes resources.

kubescape

Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

kubeshark

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

kubevault

Kunai

Kunai is a Linux security monitoring and threat-hunting tool that uses eBPF kernel-level probes to capture, enrich, and correlate system events.

Lacework FortiCNAPP

Lacework FortiCNAPP is a cloud-native application protection platform providing visibility, compliance, and threat detection across cloud environments.

Lakera

Lakera is an AI security platform that detects and prevents prompt injection attacks and other LLM vulnerabilities.

Landlock

Landlock is a Linux kernel security module that enables unprivileged users to create sandboxes restricting filesystem and network access.

lanzaboote

Lasso Security

Lasso Security protects employee GenAI use, LLM applications and AI agents with runtime guardrails, data-leak prevention and CPU-only guardrail models.

Latio

Cybersecurity vendor directory for discovering, comparing and evaluating cyber tools, with independent research reports, market maps and an AI-powered search assistant.

Laurel

Transform Linux Audit logs for SIEM usage

LavaMoat

tools for sandboxing your dependency graph

ldeep

ldeep is a Python tool that queries Active Directory LDAP servers or cached files to enumerate users, groups, GPOs, trusts, and other domain objects.

Legit Security

Legit Security is a platform that secures software development pipelines by detecting and preventing supply chain attacks across code, build, and deployment stages.

lego

Let's Encrypt/ACME client and library written in Go

Levo

Levo is a platform that provides API security testing, API inventory management, and AI security controls including an AI Gateway and AI Firewall.

LHMisme420 mcp-authscan

libewf

Library and tools to read/write Expert Witness Compression Format (EWF) forensic disk images in formats like E01 and S01.

ligolo-mp

Ligolo-MP is an advanced version of Ligolo-ng that enables multiple pentesters to collaboratively manage concurrent network tunnels via a client-server architecture.

ligolo-ng

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

Lineaje

Lineaje is a software supply chain security platform that manages SBOMs, eliminates vulnerabilities, and secures open-source and AI assets continuously.

linkedin2username

linkedin2username is an OSINT tool that scrapes LinkedIn company pages to generate lists of probable employee username formats without requiring an API key.

linwinpwn

linWinPwn is a bash script wrapping Active Directory tools for enumeration, vulnerability checks, object modifications, and password dumping on Linux.

live-forensicator

LLM Guard

LLM Guard is a security toolkit for LLM interactions offering sanitization, harmful language detection, data leakage prevention, and prompt injection resistance.

LogicGate

LoginRadius

LoginRadius is a customer identity and access management (CIAM) platform that handles user authentication, registration, SSO, and profile management for applications.

lolbas

lonkero

Lonkero is a web security scanner for penetration testing that detects vulnerabilities across 125+ scan modules with approximately 5% false positives.

Lookyloo

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other.

lsof

Lists open files and the processes that opened them on Unix-like systems.

Lumia

Secure enterprise AI with Lumia’s AI security platform. Govern employee AI usage, detect risks, and keep autonomous agents safely under control.

Lynx Software Technologies Lynx Vigiles

Lynx Vigiles is a vulnerability mitigation and management tool that simplifies SBOM management and CVE monitoring for enhanced security.

M5Stack Cardputer

A card-sized ESP32-S3 computer with a 56-key keyboard, display and IR emitter, popular as a pocket host for Wi-Fi, BLE and USB pentest firmware.

M5Stack M5StickC PLUS2

A thumb-sized ESP32 development stick with a 1.14-inch display, IR emitter and battery, widely used as a cheap host for Wi-Fi and BLE pentest firmware.

m5stick-nemo

ESP32 firmware for M5Stack devices enabling Bluetooth spam, WiFi attacks, IR TV-B-Gone, captive portals, and wireless attack detection.

mac_apt

macOS (& ios) Artifact Parsing Tool

macadmins Nudge

Nudge is an open-source macOS app that displays reminders encouraging users to install required operating system security updates.

macchanger

Utility for manipulating MAC addresses of network interfaces.

macos-security-and-privacy-guide

macos-unifiedlogs

macos-unifiedlogs is a Rust library that parses macOS Unified Log files, extracting fields such as process ID, timestamp, log message, and subsystem.

magicrescue

Scans block devices for recognizable file types using magic bytes and extracts them, functioning as an undelete and drive recovery utility.

Maigret

Collect a dossier on a person by username from 3000+ sites

Malanta

malcontent

Analyzes programs for malware capabilities using YARA rules, supporting binary/script analysis, differential comparison, and OCI image scanning.

maltrail

This Integration is part of the Github Maltrail Feed Pack.

malware-research

malwaredb-rs

ManageEngine Patch Manager Plus

ManageEngine Patch Manager Plus automates patch management for servers, laptops, and workstations across Windows, macOS, Linux, and 1100+ third-party applications.

Mandiant capa

Detects capabilities in PE, ELF, .NET, shellcode, and sandbox report files by matching against a rule set.

Mandiant FLOSS

FLOSS uses advanced static analysis to automatically extract and deobfuscate all strings from malware binaries.

Mandos

Cybersecurity market intelligence platform that tracks vendors, products, funding and M&A, with company profiles, battle cards, a weekly Brief and an MCP server for AI assistants.

Manifest

Manifest secures the software and AI supply chains behind the technology enterprises build and buy, with inside-out visibility across dependencies, binaries, vulnerabilities, provenance, and AI models.

Manifold Security

Manifold Security is an AI detection and response platform that monitors what autonomous AI agents do at runtime on enterprise endpoints and blocks risky actions.

maryam

OWASP Maryam is a modular open-source framework based on OSINT and data gathering to harvest data from open sources and search engines.

maskprocessor

Maskprocessor is a high-performance word generator with a per-position configurable charset

masscan

Internet-scale port scanner that transmits up to 10 million packets per second using an asynchronous, custom TCP/IP stack.

massdns

High-performance DNS stub resolver that resolves millions of domain names rapidly using publicly available resolvers.

mastg

OWASP MASTG is a comprehensive manual for mobile app security testing and reverse engineering that describes technical processes for verifying mobile security weaknesses.

masvs

OWASP standard defining baseline security and privacy requirements for mobile apps, used for verification, guidance, and procurement.

Mate

Material Security

Material Security is an email security platform that uses AI to detect and prevent advanced threats like phishing, malware, and data exfiltration.

Mayhem Security

mcp-kali-server

API bridge connecting MCP clients to a Kali Linux terminal, enabling AI-assisted penetration testing and CTF solving via tools like Nmap, Metasploit, and sqlmap

mcp-security

MCP servers connecting AI clients to Google Security Operations, Threat Intelligence, SOAR, and Security Command Center APIs.

mcp-shodan

mdbtools

Set of utilities and libraries for reading and exporting data from Microsoft Access (MDB/ACCDB) files.

Mend.io Mend AI

Mend AI is a product by Mend.io that detects, inventories, and assesses security risks in AI models, system prompts, agents, and runtime applications.

Mend.io Mend Container

Mend Container scans container images for vulnerabilities, licenses, and components, supporting registry integrations, Kubernetes, and SBOM export formats.

Mend.io Mend Platform

Mend Platform is an application security platform offering SCA, SAST, container, and AI scanning to help organizations detect and manage security findings.

Mend.io Mend SAST

Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.

Mend.io Mend SCA

Mend SCA is a software composition analysis product that detects and manages open source vulnerabilities, license compliance, and dependency security findings.

Menlo Security

Menlo Security's Browser Security Platform secures browser sessions for humans and AI agents with threat prevention, data protection, and zero-trust access.

Mente Binaria readpe

Multiplatform command-line toolkit to analyze and work with PE (Portable Executable) binaries.

merlin

Merlin is a cross-platform post-exploitation command-and-control framework written in Go, enabling attackers to manage compromised systems via HTTP/2.

merlin-agent

Agent component of the Merlin post-exploitation command and control framework.

mesh

MESH is a cyber tool that creates encrypted overlay networks for remote mobile device forensics acquisition and network monitoring.

Meta ThreatExchange

metagoofil

Metagoofil searches Google for specific file types publicly hosted on a domain and optionally downloads them locally.

Metalware

Metalware is a tool that finds vulnerabilities in firmware binaries autonomously, requiring no source code, physical hardware, or human intervention.

microsandbox

microsandbox is a cyber tool that runs untrusted workloads inside fast, local microVMs with hardware isolation and OCI compatibility.

Microsoft AVML

AVML - Acquire Volatile Memory for Linux

Microsoft code-oss

Open-source code editor combining editing, debugging, and extensibility for developers across Windows, macOS, and Linux.

Microsoft Defender

Microsoft Defender is built-in antivirus and threat protection software for Windows that detects and removes malware and security threats.

Microsoft Defender for Cloud

Microsoft Defender for Cloud monitors and protects cloud infrastructure, applications, and data across Azure, AWS, and on-premises environments against threats.

Microsoft Defender for IoT

Learn how Microsoft Defender for IoT, an Azure-based, cloud security service provides comprehensive IoT device threat protection.

Microsoft Entra

Microsoft Entra is a cloud-based identity and access management platform that secures user authentication, manages permissions, and controls access to applications and resources.

Microsoft Intune

Microsoft Intune is a cloud-based unified endpoint management solution that helps organizations manage and protect devices, apps, and access from one place.

Microsoft MSTICPy

MSTICPy is a Python library for InfoSec investigation and hunting in Jupyter Notebooks, supporting data queries, threat intelligence enrichment, and visualization.

Microsoft ProcMon for Linux

Process Monitor for Linux is a Linux reimagining of the classic Procmon tool that traces syscall activity on the system.

Microsoft Purview

Microsoft Purview is a unified data governance platform that discovers, manages, and protects data across cloud and on-premises environments.

Microsoft SEAL

Open-source homomorphic encryption library supporting BFV, BGV, and CKKS schemes for computing on encrypted integers and real numbers.

Microsoft Security

Microsoft Security is a comprehensive platform providing threat protection, vulnerability management, and security monitoring across devices, identities, and cloud environments.

Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM and SOAR solution that collects, detects, investigates, and responds to security threats across an enterprise.

Microsoft Sysinternals

Microsoft Sysinternals is a suite of utilities for managing, diagnosing, troubleshooting, and monitoring Windows systems.

Microsoft Windows Package Manager

Windows Package Manager (WinGet) is a command-line tool that lets users discover, install, upgrade, remove, and configure applications on Windows.

mihari

mimikatz

mimikatz is a Windows security tool that extracts plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory.

MIND

MIND data security platform puts data loss prevention (DLP) and insider risk management (IRM) on autopilot - automatically identify, detect & prevent data leaks

Minimus

MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Mitiga

Mitiga is a cloud security platform that detects and responds to threats in AWS, Azure, and GCP environments.

mitm6

mitm6 is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server via DHCPv6.

mitmproxy

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy with a console interface for HTTP/1, HTTP/2, and WebSockets.

MITRE caldera

Cyber security platform built on MITRE ATT&CK for automating adversary emulation, assisting red teams, and automating incident response.

MITRE CTI

Mobile Verification Toolkit

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

mock-oauth2-server

Mock OAuth2/OpenID Connect server for JVM tests and Docker Compose. No security workarounds needed.

Mondoo

Mondoo is a security platform that continuously scans and assesses infrastructure, cloud environments, and software supply chains for vulnerabilities and misconfigurations.

Mozilla SOPS

Encrypted file editor supporting YAML, JSON, ENV, INI, and BINARY formats with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP.

msfpc

Wrapper around msfvenom that generates basic Meterpreter payloads for multiple platforms with minimal user input.

multimon-ng

Multimon-ng decodes and displays digital radio signals including POCSAG, DTMF, and other modes from audio input or SDR receivers.

Munki

Munki is a set of open-source tools for macOS administrators to manage software installs and removals on macOS client machines.

mushorg Conpot

Conpot is an ICS honeypot that collects intelligence about the motives and methods of adversaries targeting industrial control systems.

mxcheck

Info scanner for e-mail servers checking DNS records, DANE/TLSA, TLS, open ports, blacklists, SMTPSmuggling, and open relay status.

my-arsenal-of-aws-security-tools

myip

Mythic

Mythic is a cross-platform, post-exploit, red teaming framework providing a collaborative, web-based interface for operators managing command and control operations.

N-able N-central

N-able N-central is a remote monitoring and management platform enabling IT service providers to manage and support clients' IT infrastructure remotely.

name-that-hash

Name-That-Hash identifies hash types, displaying the most popular hashes first with summaries of each hash's main usage.

National Security Agency ghidra

Ghidra is a software reverse engineering (SRE) framework

nbtscan

NBTscan is a program for scanning IP networks for NetBIOS name information, sending status queries and listing IP address, computer name, user, and MAC address.

Nebulock Agentic Threat Hunting Framework

ATHF is a framework for agentic threat hunting - building systems that can remember, learn, and act with increasing autonomy.

NeMo Guardrails

NeMo Guardrails is an open-source toolkit for easily adding programmable guardrails to LLM-based conversational systems.

nerva

Nerva is a high-performance Go CLI for fast service fingerprinting across TCP, UDP, and SCTP that identifies over 170 protocols with rich metadata extraction.

Netcap

Netcap converts network packets into structured Protocol Buffer audit records designed for security monitoring, forensic analysis, and machine learning.

netdiscover

Netdiscover is a network address discovering tool that sends ARP requests and sniffs for replies, working on wireless, hub, and switched networks.

netexec

The Network Execution Tool

netmask

Netmask is a tool for generating terse netmasks in several common formats and converting netmasks from one format to another.

NETRESEC

Netresec is a network forensics, packet sniffers and IT security products. Download NetworkMiner and other free software for network security analysis.

netscanner

netscanner is a network scanner and diagnostic tool supporting WiFi scanning, packet dumping, port scanning, and traffic counting.

Netskope

Netskope is a cloud security platform that provides visibility and threat protection for cloud applications and web traffic.

NetSPI OCInferno

OCInferno is an OCI offensive-security framework for credential handling, service enumeration, artifact download, configuration auditing, and graph-based attack-path analysis.

Nettacker

OWASP Nettacker is an open-source, Python-based automated penetration testing framework for reconnaissance, vulnerability assessments, and network security audits.

Nettitude PoshC2

PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.

NewAE Technology ChipWhisperer

The complete open-source toolchain for side-channel power analysis and glitching attacks.

NewAE Technology ChipWhisperer-Husky

A compact side-channel power analysis and voltage/clock fault injection capture tool, used by embedded security researchers to attack and test crypto on microcontrollers.

Next-Flip Momentum Firmware

nextnet

Pivot point discovery tool that probes networks for multi-homed hosts via NetBIOS and other protocols.

nfdump

nfdump is a suite of tools for collecting, processing, and analyzing NetFlow, IPFIX, and sFlow data from network devices.

nginx-lua-anti-ddos

ngrep

PCAP-based network packet analyzer that matches extended regular or hexadecimal expressions against packet data payloads.

nikto

Web server scanner that tests for dangerous files, outdated software, and misconfigurations across web servers.

Ninite Pro

NinjaOne

NinjaOne is an IT management platform offering endpoint management, patch management, backup, remote access, MDM, ticketing, and documentation tools.

nishang

PowerShell framework and payload collection for offensive security, penetration testing, and red teaming across all pentest phases.

njsscan

Nmap

Network scanner that discovers hosts, open ports, services, and OS details across networks.

noir

SAST cyber tool that extracts API endpoints, parameters, headers, and cookies from source code across 205 frameworks to map attack surfaces.

NoLabs nono

The nono runtime runs AI agents in isolated environments with policy-controlled filesystem, network, and credential access.

Noma Security

Noma Security discovers an enterprise's AI applications and agents, manages their posture and protects them at runtime with compliance reporting.

Nozomi Networks

Nozomi Networks keeps operational technology cyber resilient with OT network and endpoint visibility, threat detection, and AI-powered analysis.

npq

npq audits npm packages before installation by checking vulnerabilities, package age, download count, README, license, and install scripts.

ntoseye

WinDbg-like kernel debugger for Windows, from Linux and macOS

Nuand bladeRF

A USB 3.0 Superspeed Software Defined Radio.

Nuand bladeRF 2.0 micro

A 2x2 MIMO USB 3.0 software defined radio covering 47 MHz to 6 GHz, bought by RF researchers and students building wireless and waveform-development rigs.

Nudge Security

Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.

NVIDIA OpenShell

OpenShell runs autonomous AI agents in policy-controlled sandboxes with isolated filesystem, network, and credential access.

NVIDIA SkillSpector

SkillSpector is a security scanner for AI agent skills that detects vulnerabilities, malicious patterns, and security risks before installation.

O.MG / Hak5 O.MG Cable

A hand-made USB cable with a WiFi-controlled implant hidden inside that injects keystrokes, so red teams can emulate sophisticated physical attacks.

Obsidian

Obsidian is a note-taking app that lets you write and organize Markdown files stored locally in a vault.

Obsidian Forensics Hindsight

Hindsight is a free tool that parses web artifacts from Google Chrome, Chromium-based browsers, and Mozilla Firefox profiles for forensic analysis.

Obsidian Security

Obsidian Security is a platform that provides visibility, governance, and runtime enforcement over AI agents, identities, and integrations across third-party apps.

oclgausscrack

oclGaussCrack is an OpenCL-accelerated tool that cracks the verification hash of the encrypted payload of the Gauss Virus.

odat

Penetration testing tool for remotely testing Oracle Database security, including SID/credential discovery, privilege escalation, and OS command execution.

OffSec Kali Linux

Home of Kali Linux, an Advanced Penetration Testing Linux distribution used for Penetration Testing, Ethical Hacking and network security assessments.

OISF Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

Okta for AI Agents

Okta for AI Agents provides identity and access management capabilities for authenticating and authorizing AI agents securely.

Okta Identity Engine

Okta Identity Engine is a flexible authentication platform that enables developers to build customizable, secure identity and access management workflows into their applications.

oletools

oletools is a package of Python tools to analyze Microsoft OLE2 files, such as MS Office documents, mainly for malware analysis, forensics and debugging.

Omada Identity

Omada Identity is an enterprise identity governance platform that manages user access, permissions, and compliance across IT systems.

OneTrust

OneTrust is a platform that integrates with external systems via APIs and SDKs to manage and streamline data flows.

ongrid

An ops AI Agent that understands your infrastructure, finds the root cause, and fixes it — right from Slack, Telegram, Lark or DingTalk.

Onyx Security

Onyx Security is a control plane that discovers, monitors and governs enterprise AI agents inline across browsers, coding assistants, cloud workloads and MCP servers.

opal

Open Policy Agent Gatekeeper

Gatekeeper is a validating and mutating webhook that enforces CRD-based policies executed by Open Policy Agent on Kubernetes clusters.

OpenA2A HackMyAgent

HackMyAgent is a security scanner, red-team toolkit, and behavioural simulator for AI agents.

OpenAI Codex Security

OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security

openbao

OpenBao is a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.

OpenCTI

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables.

OpenCVE

OpenCVE is a platform that monitors and manages CVEs by aggregating data from multiple sources and alerting users to new or updated vulnerabilities.

openfga

A high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar.

Openlayer

Openlayer is an AI governance platform that helps enterprises build, deploy, and operate trustworthy AI systems.

OpenOSINT

OpenOSINT is an OSINT agent with 21 investigation tools behind a natural-language interface, plus an MCP server so any MCP-compatible AI client can drive them.

OpenQodex

Open source code review that runs in your coding agent before you push. Scanners plus a separate AI reviewer, on your own login, no key.

opensc

OpenSC is a cyber tool providing utilities to interact with smart cards and cryptographic tokens.

OpenSnitch

GNU/Linux application firewall that filters outbound connections interactively and blocks ads, trackers, or malware domains system-wide.

opensquat

openSquat is a cyber tool that identifies brand squatting threats like phishing and typosquatting by scanning newly registered domains.

OpenSSH

OpenSSH is a complete implementation of the SSH protocol (version 2) for secure remote login, command execution, and file transfer.

OpenSSL

OpenSSL is an open source toolkit for the TLS, DTLS, and QUIC protocols, built on a full-strength general purpose cryptographic library.

opentaint

OpenTaint is an open-source, formal inter-procedural taint analysis engine for application security.

OpenVanta GrantGuard

GrantGuard audits, reviews, and removes Claude Code standing permissions, classifying allow rules into risk groups via a local web UI or CLI.

openvas-scanner

OpenVPN

OpenVPN is an open source VPN daemon

Openwall John the Ripper

John the Ripper is an open-source password security auditing tool that detects weak passwords by performing dictionary, brute-force, and rainbow crack attacks.

Operant AI

Operant AI discovers, detects and defends AI applications, agents, MCP servers, APIs and Kubernetes workloads at runtime.

Opsera

Opsera is a DevOps orchestration platform that unifies CI/CD pipelines, security tools, and deployment processes across multiple technologies.

Ordr

ORDR gives security teams complete visibility over every IoT, OT, and connected asset, from discovery to risk assessment, segmentation, and automated response.

Ory

osctrl

osctrl is a fast osquery management solution implementing the remote API via TLS for monitoring systems, distributing configuration, collecting logs, and running queries.

osdfir-infrastructure

OSDFIR Infrastructure simplifies deploying and integrating open source digital forensics tools to Kubernetes clusters using Helm.

osint-brazuca

osintgram

osmedeus

A Modern Orchestration Engine for Security

oss-sydr-fuzz

OSSEC HIDS

OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

OSV-Scanner

Use OSV-Scanner to find existing vulnerabilities affecting your project’s dependencies.

osv-scanner-action

OWASP Amass

OWASP Amass performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.

OWASP dependency-track

Dependency-Track is a software composition analysis platform that identifies and monitors vulnerabilities in application dependencies and third-party components.

OWASP ZAP

OWASP ZAP is a free, open-source web app scanner that automatically finds security vulnerabilities in web applications during development and testing.

OX Security

oxo

P0 Security

P0 Security delivers runtime access control for AI, built on a proven runtime authorization platform for humans and machines. Discover the agents operating across your environment and the identities, tools and privileges they use.

pac4j

Palo Alto Cortex Cloud

Palo Alto Cortex XDR

Palo Alto Networks Cortex XDR is an extended detection and response platform that unifies endpoint, network, and cloud telemetry to detect, investigate, and stop threats.

Palo Alto Cortex Xpanse

Palo Alto Cortex XSIAM

Palo Alto Networks' Cortex XSIAM is an AI-driven security operations platform that unifies data, automates threat detection, investigation, and response across an organization's security tools.

Palo Alto Cortex XSOAR

Palo Alto Networks

Palo Alto Networks is a cybersecurity platform that provides advanced firewalls, cloud security, and AI-driven threat detection to protect networks and enterprises.

Palo Alto Networks CyberArk

Palo Alto Prisma Access

Palo Alto Prisma Access is a cloud-based secure access service providing zero-trust networking and threat prevention for remote users and branch offices.

Palo Alto Prisma Cloud

Palo Alto Prisma Cloud is a cloud security platform that protects cloud infrastructure, applications, and data across multiple cloud providers.

Palo Alto Strata NGFW

Palo Alto Strata NGFW is a next-generation firewall providing advanced threat protection, application visibility, and network security across cloud and on-premises environments.

Pangea

Pangea provides security guardrails for AI applications, delivering services and APIs including AI Guard, Prompt Guard, and audit logging through a single framework.

Panorays

Panorays is a third-party cyber risk management platform that automates supplier assessments, questionnaires, monitoring, and remediation across the vendor lifecycle.

Passbolt

Passbolt is an open source password and credential manager for teams that can be self-hosted or cloud-hosted.

passdetective

PassDetective is a command-line tool that scans shell command history for mistakenly written passwords, API keys, and secrets using regular expressions.

Patch My PC

patchleaks

PatchLeaks compares two versions of a codebase, highlights vendor-changed lines, and explains why they matter for security analysis.

Patchman

Django-based patch status monitoring tool that tracks package updates available for Linux hosts via a web interface.

payloadsallthethings

Collection of web application security payloads and bypasses covering common vulnerabilities for use in penetration testing.

PCAPdroid

PCAPdroid is an open source Android app that tracks, analyzes, and blocks connections made by other apps, and exports PCAP traffic dumps.

PDQ Deploy & Connect

peass-ng

Suite of scripts for Windows, Linux/Unix, and macOS that enumerate local privilege escalation paths and highlight misconfigurations.

penelope

Shell handler for penetration testers that provides automatic PTY upgrades, session management, logging, file transfers, and modules for post-exploitation.

penet

Pentera

Perplexity numbat

numbat provides endpoint visibility into AI agent activity, with local detection, optional pre-action blocking, and forensic reconstruction.

phishery

SSL-enabled HTTP server that harvests credentials via Basic Authentication prompts and injects phishing URLs into .docx Word documents.

Phoenix Security

Phoenix Security correlates scanner, cloud and runtime findings with exploitability and ownership, and uses AI agents to prioritise and open remediation pull requests.

PhoneSploit-Pro

PhoneSploit Pro is a Python tool that uses ADB, scrcpy, Nmap, and Metasploit-Framework to remotely take over Android devices.

photon

Photon is a fast web crawler designed for OSINT that extracts URLs, emails, secret keys, JavaScript endpoints, subdomains, and files from target websites.

phpsploit

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor - nil0x42/phpsploit

Pi

Pi Security triages vulnerability and bug-bounty reports with agentic AI, analyzes the organisation's code and cloud context and generates fixes for developers.

Picus Security

Picus Autonomous Exposure Validation Platform proves which exposures are exploitable, validates security controls, and automates penetration testing in one loop.

pike

Pike is a tool for determining the permissions or policy required for IAC code

Pillar Security

Pillar Security discovers, governs and secures AI agents, models and workflows with posture management, red teaming and runtime guardrails.

Pindrop

Pindrop is a platform that detects deepfakes, identifies synthetic speech, assesses fraud risk, and authenticates callers across voice and video channels in real time.

Ping Identity

Ping Identity is an identity and access management platform providing authentication, single sign-on, multi-factor authentication, and identity governance services.

pip-audit

pip-audit is a tool for scanning Python environments for packages with known vulnerabilities, using the Python Packaging Advisory Database as a source.

pipelock

Open-source AI agent firewall for MCP security and agent egress. Scans mediated HTTP, MCP, A2A, and WebSocket traffic for exfiltration, SSRF, and prompt injection, and emits mediator-signed action receipts: verifiable audit evidence from outside the agent.

pixiewps

An offline Wi-Fi Protected Setup brute-force utility - wiire-a/pixiewps

plaso

Plaso is a Python-based engine used by several tools for automatic creation of timelines to support digital forensic investigators.

Platform One Iron Bank

Iron Bank is the Department of Defense's centralized repository for hardened, approved container images that meet strict security compliance standards for government use.

Plerion

Plerion is a cloud security platform that detects and responds to infrastructure vulnerabilities and misconfigurations across multi-cloud environments.

Plexicus

Plexicus is an AI-powered application security platform that automatically detects, prioritizes, and remediates vulnerabilities across code, APIs, and cloud environments.

plumber

Plumber detects CI/CD security issues in your GitHub workflows and gives you a score

Pluto Security

Pluto Security agentlessly discovers the AI builders, agents, MCP servers and extensions on employee endpoints, scores their risk and enforces guardrails.

pnscan

pnscan is a parallel network scanner tool used to survey IPv4 TCP network services such as SSH, FTP, SMTP, and web servers.

polenum

Uses Core's Impacket Library to get the password policy from a windows machine - Wh1t3Fox/polenum

Pomerium

Pomerium is an identity-aware proxy that provides secure, clientless access to internal applications by enforcing context-based authentication and authorization policies.

pompem

Automates searching for exploits and vulnerabilities across databases like PacketStorm, Vulners, NVD, and WPScan.

PortaPack Mayhem

Custom firmware for HackRF PortaPack devices, adding features, bugfixes, and apps for RF transmission and reception.

Portkey

portspoof

Portspoof emulates open ports and service signatures across all 65535 TCP ports, turning reconnaissance from a quick scan into a long, resource-intensive process.

PortSwigger Burp Suite

Burp Suite is a web vulnerability scanner and penetration testing toolkit available in multiple editions, including Professional, Community, and DAST.

poutine

powersploit

Collection of PowerShell modules for penetration testers covering code execution, persistence, exfiltration, privilege escalation, and recon.

Prescient Security Cait

Cait is a continuous AI pentester by Prescient Security that performs ongoing automated penetration testing of customer environments.

princeprocessor

Standalone password candidate generator using the PRINCE algorithm - hashcat/princeprocessor

privado

ProjectDiscovery Cloud

ProjectDiscovery Cloud is a platform providing cloud-based security scanning and reconnaissance tools for identifying vulnerabilities and assets in applications.

ProjectDiscovery cloudlist

Cloudlist is a multi-cloud tool for getting assets from cloud providers, maintaining a centralized list across multiple clouds with minimal configuration.

ProjectDiscovery dnsx

dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.

ProjectDiscovery httpx-toolkit

The httpx-toolkit probes HTTP services in parallel to identify live hosts, technologies, status codes, titles, and other web metadata.

ProjectDiscovery Katana

Katana is a command-line web crawling tool written in Golang designed to crawl websites to gather information and endpoints.

ProjectDiscovery naabu

Naabu is a port scanning tool written in Go that enumerates valid ports for hosts using fast SYN/CONNECT/UDP scans.

ProjectDiscovery nuclei

Nuclei is a fast vulnerability scanner that uses simple YAML-based templates to detect vulnerabilities across applications, infrastructure, cloud platforms, and networks.

ProjectDiscovery proxify

Proxify is a proxy tool that intercepts, dumps, filters, and manipulates HTTP/HTTPS and non-HTTP traffic, with upstream HTTP/SOCKS5 proxy support.

ProjectDiscovery subfinder

Subfinder is a subdomain discovery tool that finds and returns valid subdomains for websites using passive online sources.

Promptfoo

Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.

Prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

proxycat

proxychains-ng

ProxyChains-NG is a UNIX program that hooks network-related libc functions in dynamically linked programs and redirects connections through SOCKS4a/5 or HTTP proxies.

psalm-plugin-laravel

Security-focused Laravel static analyser

pskracker

PSKracker is a collection of WPA/WPA2/WPS default algorithms, password generators, and pingens for router models, written in C.

pspy

Monitors and logs Linux processes without root privileges by scanning procfs and using inotify file system watchers.

PurpleAILAB Decepticon

Decepticon is an autonomous red team agent that executes attack chains covering reconnaissance, exploitation, privilege escalation, lateral movement, and C2.

Pwnagotchi

Pwnagotchi is a Raspberry Pi tool that uses bettercap to capture crackable WPA key material via passive sniffing or authentication attacks.

pwncat

Netcat-based cyber tool supporting bind/reverse shells, port scanning, port forwarding, firewall/IDS evasion, and self-injecting shell deployment.

pwndbg

GDB and LLDB plug-in that enhances debugging for reverse-engineers and exploit developers with low-level utilities.

pwndoc

PwnDoc is a pentest reporting application that simplifies writing findings and generating customizable Docx reports.

pwntools

CTF framework and exploit development library for rapid prototyping and writing exploits in Python.

pyinstxtractor

Extracts contents of PyInstaller-generated executables and fixes pyc headers for Python bytecode decompilation.

PyPA python-pipx

The python-pipx CLI installs and runs Python applications in isolated environments while exposing their commands on the user's PATH.

pysigma

pySigma is a Python library for parsing, converting, and manipulating Sigma detection rules into queries for various SIEM and log analysis platforms.

python-gvm

python-ldapdomaindump

Dumps Active Directory users, groups, computers, and policies via LDAP and outputs results in HTML, JSON, and greppable formats.

qodana-cli

JetBrains Qodana’s official command line tool

qu1cksc0pe

Qualys

Qualys is a cloud-based security and compliance platform that continuously monitors, detects, and helps remediate vulnerabilities across IT assets and infrastructure.

Qualys CyberSecurity Asset Management

Qualys CyberSecurity Asset Management continuously discovers, inventories, and assesses all IT assets across hybrid environments to eliminate security blind spots and reduce cyber risk.

Qualys EDR

Qualys EDR is an endpoint detection and response security solution that helps organizations measure, communicate, and eliminate cyber risk.

Qualys Patch Management

Qualys Patch Management is a cloud-based tool that automates the discovery, prioritization, and deployment of patches across IT assets to reduce vulnerabilities.

Qualys Policy Compliance

Qualys Policy Compliance is a cloud-based security tool that monitors IT infrastructure for regulatory compliance violations and policy adherence.

Qualys TotalCloud

Qualys TotalCloud is a cloud security platform providing vulnerability management, compliance monitoring, and threat detection across cloud infrastructure.

Qualys VMDR

Qualys VMDR is a cloud-based vulnerability management platform that continuously discovers, assesses, prioritizes, and remediates security vulnerabilities across IT assets.

Qualys Web Application Scanning

Qualys Web Application Scanning is a cloud-based security tool that identifies vulnerabilities in web applications through automated scanning and testing.

quark-engine

Quark-Engine is a mobile security analysis framework that detects malicious behaviors in Android applications through rule-based pattern matching.

Quarry VRC

Designed for managing vulnerability discovery at scale with agentic AI and integrates with HackerOne.

QuilrAI

QuilrAI discovers every AI agent, LLM API and copilot in an organization and enforces least-privilege runtime controls through gateways and an endpoint agent.

Radare2

UNIX-like reverse engineering framework and command-line toolset

Radiflow

Radiflow is an OT cybersecurity platform providing threat detection, risk management, and asset visibility for industrial environments across 20,000 sites globally.

rake

Rake is a Ruby-based build automation tool that manages tasks and dependencies using a domain-specific language written in Ruby.

ransomlook

Yet another Ransomware gang tracker

Rapid7 Active Patching

Rapid7 Cyber GRC

Rapid7 Cyber GRC platform helps organizations manage cybersecurity governance, risk, and compliance across their IT environments.

Rapid7 Exposure Command

Rapid7 Incident Command

Rapid7 Insight Platform

Rapid7 Insight Platform is a cloud-based security analytics suite providing vulnerability management, threat detection, and incident response capabilities.

Rapid7 InsightAppSec

Rapid7 InsightAppSec is a dynamic application security testing platform that identifies vulnerabilities in web and API applications through automated scanning.

Rapid7 InsightCloudSec

Rapid7 InsightCloudSec is a cloud security platform that monitors multi-cloud environments to detect misconfigurations, enforce compliance policies, and manage risk across AWS, Azure, and Google Cloud.

Rapid7 InsightConnect

Rapid7 InsightConnect is a security orchestration and automation platform that integrates with multiple tools to streamline incident response and security workflows.

Rapid7 InsightIDR

Rapid7 InsightIDR is a cloud-based threat detection and response platform that identifies and investigates security incidents using behavioral analytics.

Rapid7 InsightVM

Rapid7 InsightVM is a vulnerability management platform that scans networks and assets to identify, prioritize, and help remediate security weaknesses.

Rapid7 Metasploit Framework

Open-source penetration testing framework for developing, testing, and executing exploits against remote targets.

Rapid7 Metasploit Pro

Metasploit Pro is a commercial penetration testing framework for identifying, exploiting, and validating security vulnerabilities in systems.

Rapid7 Surface Command

Rapid7 Threat Command

Rapid7 Threat Command is a threat intelligence platform providing real-time monitoring, vulnerability insights, and threat data for security teams.

RapidFort

RapidFort is a software supply chain security platform that analyzes container vulnerabilities, removes unused components, and provides curated near-zero CVE container images.

RAPTOR

RAPTOR chains static analysis, binary analysis, LLM vulnerability validation, exploit generation, and patch writing into one autonomous security research workflow.

raven

Raven is a Python tool that provides a self-contained file upload web server, enabling remote clients to send files via HTTP.

raviaxo RiskShard

RiskShard audits public cyber-loss reports, recording what each one actually publishes across four statistical questions, with every answer pinned to a quoted source.

rawsec-cybersecurity-inventory

Reality Defender

Reality Defender detects synthetic audio, video, images, and documents for enterprise deepfake screening.

Realm Security

Realm Security is the SOC-aware security data pipeline that lets teams control, reduce, enrich, and route security data from any source to any destination.

rearm

ReARM - Release Governance Platform

reaver

Brute-forces WPS registrar PINs to recover WPA/WPA2 passphrases, supporting both online and offline Pixie Dust attacks.

Rebuff

Rebuff detects and protects LLM applications against prompt injection attacks.

reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

reconmap

Open source vulnerability assessment and penetration testing platform for planning, executing, and reporting on security assessments.

reconspider

ReconSpider is an OSINT framework that scans IP addresses, emails, websites, and organizations to find information from different sources.

Recorded Future

Recorded Future provides an API platform offering threat intelligence data including malware intelligence, playbook alerts, risk scoring, and attack surface insights.

RedAmon

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

redeye

Pentest data management platform for organizing servers, users, vulnerabilities, files, and attack vectors during engagements.

refinery

High Octane Triage Analysis

ReFirm Labs binwalk

Binwalk is a firmware analysis tool that identifies and optionally extracts files and data embedded inside other files.

RegScale

RegScale is a compliance and security governance platform that automates regulatory assessment, documentation, and continuous monitoring across organizations.

rekono-kbx

Offensive security platform that automates attack surface discovery and vulnerability management

Relyance AI

Relyance AI is an AI-native data security and governance platform that tracks real-time data flows from source code to AI models.

Request Tracker / RTIR (Best Practical)

Request tracker / rtir (best practical) is a open source ticketing system from Best Practical. Self-host RT or let us run it in the cloud. Own your data, every feature on every plan, no lock-in.

resolvers

restic

restic is an open-source command-line backup program that stores encrypted, deduplicated snapshots on local disks, SFTP servers, and object storage.

Retire.js

Retire.js scans JavaScript libraries and Node.js modules to identify versions with known security vulnerabilities.

retoolkit

retoolkit is a collection of tools for reverse engineering and malware analysis on x86 and x64 Windows systems, bundled as a pre-configured installer.

reverse_ssh

reversecore_mcp

Reversecore_mcp is a 🚀 The fast, Pythonic way to build MCP servers and clients. - PrefectHQ/fastmcp

ReversingLabs Spectra Assure

rf-swift

rfcat

RF research tool for CC1111-based USB dongles enabling sub-GHz radio transmission, reception, and analysis via an interactive Python shell.

RFID Research Group ChameleonUltra

ChameleonUltra is an RFID research device for emulating, cloning, and analyzing contactless smart cards and tags.

RFID Research Group proxmark3

Iceman fork of the Proxmark3 firmware and client for RFID analysis, cloning, emulation, and penetration testing across LF/HF/UHF tags.

RFID Research Group Proxmark3 RDV4

A compact, modular Proxmark3 revision for reading, sniffing, emulating and cloning low-frequency and high-frequency RFID tags, aimed at pentesters and red teams.

Rhino Security Labs CloudGoat

CloudGoat is Rhino Security Labs' "Vulnerable by Design" cloud deployment tool for honing cloud cybersecurity skills via capture-the-flag scenarios.

Rhino Security Labs Pacu

Pacu is an open-source AWS exploitation framework designed for offensive security testing against cloud environments using plug-in modules.

RIG Security

Rig Security is an identity protection platform that sees, protects, and enforces every identity for people, non-human identities, and AI agents.

Riot

Riot is an employee cybersecurity platform that helps companies reduce human risk by training employees, monitoring threats, and protecting personal accounts.

Risk Ledger

Risk Ledger is a supply chain security platform that helps organisations assess, monitor, and manage third-party supplier cybersecurity risks collaboratively.

risu

Rizin

UNIX-like reverse engineering framework and command-line toolset.

Rizin rz-ghidra

Rizin plugin integrating the Ghidra decompiler and Sleigh Disassembler for reverse engineering without requiring Ghidra itself.

rling

Removes lines from files faster than rli, with deduplication, binary search, frequency analysis, and gzip support.

robin

RoboForm

RoboForm is a password manager for Windows that securely stores, organizes, and autofills passwords and online forms across websites and applications.

routerkeygenpc

RouterKeygenPC is a Qt application for Linux, Mac OSX, and Windows that generates default WPA/WEP keys for supported routers.

rsigma

A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers

Rspamd

Rspamd is an advanced spam filtering system and email processing framework that evaluates messages using rules, statistical analysis, and custom services.

Rubrik Security Cloud

Rubrik Security Cloud is a data protection and cyber-recovery platform that backs up enterprise data and watches it for threats and sensitive-data exposure.

Runlayer

Runlayer is an MCP gateway that enforces identity-mapped permissions and detects threats across the agents and MCP servers employees use.

Runtime Mobile Security

Web interface powered by Frida for manipulating Android and iOS apps at runtime, enabling class dumping, method hooking, and script injection.

runZero

runZero is an asset discovery and inventory platform that identifies and maps all devices on networks without requiring agents.

rustinel

Rustinel is a open-source endpoint detection for Windows, Linux, and macOS using ETW, eBPF, Endpoint Security, Sigma, YARA, IOCs, and Rust

s3scanner

S3Scanner is a tool to find open S3 buckets in AWS or other cloud providers and scans all bucket permissions to find misconfigurations.

SafeBreach

SafeBreach provides the leading exposure validation platform, combining breach and attack simulation with attack path validation.

safeline

SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.

SailPoint

SailPoint is an identity governance and access management platform that automates user provisioning, access reviews, and compliance across enterprise systems.

Salesforce Cloudsplaining

Cloudsplaining is an AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized report.

Salesforce Policy Sentry

Policy Sentry is an AWS IAM least privilege policy generator that creates scoped IAM policies based on resource ARNs and access levels.

Salt Security

SAND Security

SAND Security protects modern AI infrastructure by governing, detecting, and responding to threats across agents, untrusted code, and AI-cloud environments.

SandboxAQ AQtive Guard

SandboxAQ AQtive Guard is a quantum-safe cryptography solution that protects against quantum computing threats to encryption.

sandboxed-api

Sandboxed API (SAPI) is an open-source project built on Google's Sandbox2 that makes sandboxing individual C/C++ libraries less burdensome.

sara

Sara is a MikroTik RouterOS security inspector that detects misconfigurations, weak settings, and known CVEs via read-only SSH analysis.

Satori Cyber Satori

sbom-operator

Catalogue all images of a Kubernetes cluster to multiple targets with Syft

sbom-tool

SBOM Tool creates SPDX 2.2 and SPDX 3.0 compatible SBOMs for any variety of artifacts.

sbom-utility

sbomify

sbomify is an SBOM and document management platform for uploading, managing, and sharing Software Bill of Materials with stakeholders, available self-hosted or via app.sbomify.com.

sbomqs

scant3r

Scilla

Scilla is an information gathering tool that performs DNS, subdomain, port, and directory enumeration against a target domain or IP.

ScoutDNS

ScoutDNS is a DNS filtering and threat protection service for businesses, MSPs, schools, and nonprofits that blocks unwanted content and malicious domains.

Scrut Automation

Scrut Automation is a compliance platform for managing controls, evidence, audits, risk, and continuous monitoring.

seclists

SecLists is a collection of multiple types of lists used during security assessments, including usernames, passwords, URLs, fuzzing payloads, and web shells.

SecPod SanerNow

SecPod SanerNow is a continuous exposure remediation platform that detects, prioritizes, and remediates vulnerabilities and misconfigurations across endpoints and cloud.

Secretlint

Secretlint is a pluggable linting tool to prevent committing credentials.

secure-code-game

secure-socket-funneling

Forwards TCP/UDP sockets through a single secure TLS tunnel between client and server across platforms.

SecureAgentics Adrian

Adrian is an open-source runtime security engine for AI agents that analyses activity logs and reasoning traces to detect and block malicious or out-of-remit behaviour.

SecureAuth impacket

Impacket is a collection of Python classes for working with network protocols.

Secureframe

Secureframe is a compliance automation platform that helps organizations achieve and maintain security certifications.

Securiti

Securiti is a platform that discovers and classifies sensitive data across cloud, SaaS, and on-premises environments and assesses data security risk posture.

Security Onion

Security Onion is a free and open Linux distribution for threat hunting, enterprise security monitoring, and log management.

security-profiles-operator

Security Profiles Operator is a cyber tool that manages SELinux, seccomp and AppArmor security profiles in Kubernetes clusters.

SecurityTrails

Sekoia.io

Sekoia.io is a cybersecurity platform providing threat intelligence, incident response, and security operations center capabilities.

Semgrep

Semgrep is a static analysis tool that scans code for bugs, security vulnerabilities, and policy violations using customizable rules.

SensePost goDoH

godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPS as a transport medium.

SensePost gowitness

gowitness is a website screenshot utility written in Golang that uses Chrome Headless to generate screenshots of web interfaces via the command line.

SensePost hostapd-mana

hostapd-mana is a featureful rogue access point that captures EAP credentials, WPA2 handshakes, and responds to probe requests using KARMA/MANA mode.

SensePost objection

objection is a runtime mobile exploration toolkit powered by Frida that helps assess mobile application security on iOS and Android without a jailbreak.

SensePost wpa-sycophant

wpa_sycophant is a tool that relays phase 2 authentication attempts to access corporate wireless without cracking the password.

SentinelOne

shadowsocks-rust

shadowsocks-rust is a cyber tool that implements ShadowSocks tunnel proxy services for bypassing firewalls.

shai-hulud-2.0-detector

shellfire

An exploitation shell focusing on exploiting command injection vulnerabilities, eg., LFI, RFI, SSTI, etc.

sherlock

Hunt down social media accounts by username across social networks

Shuffle

Shuffle is an open source automation platform built for security professionals to simplify security operations.

sickle-pdk

Payload development kit for shellcode generation, formatting, execution, disassembly, bad character identification, and diffing across multiple architectures.

sif

sighthound

SigmaHQ Sigma Rules

Open repository of 3000+ vendor-agnostic SIEM detection rules in the Sigma generic signature format for log event detection.

SigmaHQ sigma-cli

CLI for managing, listing, and converting Sigma rules into SIEM query languages using the pySigma library.

Sigstore cosign

Cosign signs OCI containers and other artifacts using Sigstore, supporting keyless signing, hardware and KMS signing, and bring-your-own PKI.

sippts

SIPPTS is a set of scripts, programmed in Python, for auditing VoIP servers and devices using the SIP protocol.

sipsak

sipsak is a command-line tool for testing SIP applications and devices, described as a SIP swiss army knife.

sitadel

Web Application Security Scanner

skylos

Install Skylos, run your first local scan, and add an open-source SAST and dead-code PR gate to CI.

Slack go-audit

Alternative to the auditd daemon that connects to the Linux kernel via netlink and outputs audit logs as JSON.

Slack Nebula

Nebula is a scalable overlay networking tool that connects computers anywhere in the world, running on Linux, OSX, Windows, iOS, and Android.

slimtoolkit

Inspects, optimizes, and minifies container images by analyzing application behavior to remove unnecessary components and generate security profiles.

slowhttptest

SlowHTTPTest is a highly configurable tool that simulates Application Layer Denial of Service attacks by prolonging HTTP connections in different ways.

Smallstep step CLI

CLI tool for building, operating, and automating PKI systems, X.509/SSH certificates, JWTs, and OAuth flows.

Smallstep step-ca

step-ca is an online certificate authority for secure, automated X.509 and SSH certificate management for DevOps.

smbmap

Enumerates Samba share drives across networks, supporting share listing, permission checks, file upload/download, and remote command execution.

sn0int

sn0int is a semi-automatic OSINT framework and package manager that gathers intelligence about a target by processing public information.

snake_apple

sniffglue

sniffglue is a network sniffer written in Rust that parses packets concurrently using a thread pool to utilize all CPU cores.

sniffnet

Snyk

Snyk Agent Scan

Scans agent components (MCP servers, skills, harnesses) on a machine for prompt injections, tool poisoning, and vulnerabilities.

Snyk AppRisk

Snyk AppRisk is a security tool that aggregates application and cloud data to prioritize and manage risks across an organization's software development lifecycle.

Snyk Code

Snyk Code is a static application security testing (SAST) tool that scans developer code in real time to find and fix vulnerabilities.

Snyk Container

Snyk Container scans Docker images and container registries for vulnerabilities, misconfigurations, and malware to secure containerized applications.

Snyk IaC

Snyk Open Source

Snyk Open Source scans and fixes vulnerabilities in open source dependencies used in your applications automatically.

SO-CRATES

Web application for analyzing pcap, log, and binary files using Suricata, YARA, and Sigma rules with a single-page UI.

Socket

Socket is a security platform that detects and prevents supply chain attacks in open source dependencies and third-party code.

SolarWinds Patch Manager

SolarWinds Patch Manager is a patch management tool that lets you create, schedule, and amend tasks to deploy updates to systems.

SonarSource SonarQube

Sonarqube is a enforce consistent quality gates across every pull request and pipeline, from IDE to CI/CD, with automated code review for bugs and security issues.

Sonatype

Sophos Access Points

Sophos Access Points provides secure remote access and authentication management for protecting enterprise network resources.

Sophos Anti-Virus for macOS

Sophos Anti-Virus for macOS is endpoint security software that detects and removes malware, viruses, and threats on Apple computers.

Sophos Central

Sophos Central is a cloud-based endpoint protection and management platform that delivers security, threat detection, and device management across organizations.

Sophos Central Device Encryption

Sophos Central Device Encryption manages and enforces full-disk encryption on Windows (BitLocker) and macOS (FileVault) devices from a centralized cloud console.

Sophos Central Firewall

Sophos Central Firewall is a cloud-managed network security solution that provides firewall protection, intrusion prevention, and threat monitoring for organizations, administered through the Sophos Central platform.

Sophos Central Server Core Agent

Sophos Central Server Core Agent is a lightweight security agent installed on servers to provide centralized threat protection and management via the Sophos Central platform.

Sophos Central Server Intercept X

Sophos Central Server Intercept X is a server security solution that uses AI and advanced threat detection to protect servers from malware, ransomware, and exploits.

Sophos Cloud Optix

Sophos Cloud Optix monitors cloud environments for security misconfigurations, compliance policy violations, anomalous user activity, and malware in cloud storage.

Sophos Connect

Sophos Connect is a VPN client that provides secure remote access to corporate networks for authorized users.

Sophos Core Agent

Sophos Core Agent is an endpoint protection platform component providing malware detection, threat response, and security monitoring across managed devices.

Sophos DNS Protection

Sophos DNS Protection is a security service that blocks malicious websites and threats by filtering DNS queries at the network level.

Sophos Email Security

Sophos Email Security protects organizations from email-based threats including phishing, malware, and spam through advanced threat detection and filtering.

Sophos Firewall

Sophos Firewall is a network security appliance that protects organizations by filtering traffic, preventing threats, and managing secure connectivity across networks.

Sophos Intercept X

Sophos Intercept X is an advanced endpoint security solution that uses AI and deep learning to detect, block, and remediate malware and ransomware threats.

Sophos Intercept X for Mobile

Sophos Intercept X for Mobile is an endpoint protection platform that detects and prevents malware, ransomware, and threats on iOS and Android devices.

Sophos Mobile

Sophos Mobile is an enterprise mobile device management and security platform protecting iOS and Android devices.

Sophos Mobile (on-premises)

Sophos Mobile on-premises is an enterprise mobile device management solution for securing and managing iOS, Android, and other mobile devices within organizations.

Sophos NDR

Sophos NDR (Network Detection and Response) monitors network traffic to detect and respond to threats, suspicious activity, and anomalous behaviour across an organisation's environment.

Sophos Protected Browser

Sophos Protected Browser is a hardened web browser that safeguards online banking and sensitive transactions by isolating them from malware and keyloggers.

Sophos Protection for Linux

Sophos Protection for Linux is an endpoint security solution providing antivirus, anti-malware, and threat detection for Linux servers and workstations.

Sophos SafeGuard Enterprise

Sophos SafeGuard Enterprise is an enterprise encryption solution that protects data on endpoints, removable media, and cloud storage through centralized policy management.

Sophos Secure Email

Sophos Secure Email is a cloud-based email security solution that protects organizations from spam, phishing, malware, and data loss in email communications.

Sophos Secure Workspace

Sophos Secure Workspace is a mobile app that provides secure access to business documents and websites, protecting corporate data on personal devices.

Sophos Switch

Sophos Switch is a network orchestration platform enabling centralized management and security policy enforcement across switching infrastructure.

Sophos UTM

Sophos UTM is a unified threat management firewall appliance that combines network security features including intrusion prevention, web filtering, VPN, and antivirus protection.

Sophos ZTNA

Sophos ZTNA is a zero-trust network access solution that verifies user and device identity before granting access to applications and resources.

specification

SpecterOps AzureHound

AzureHound is the official tool for collecting Azure data for BloodHound Community Edition and BloodHound Enterprise.

SpecterOps BloodHound

BloodHound uses graph theory to reveal hidden relationships across identity and access management systems, mapping privilege attack paths in Active Directory and Azure.

SpecterOps SharpHound

SharpHound is a data collector for BloodHound CE that enumerates Active Directory environments to gather relationship and permission data.

Spektion

SpiderLabs HostHunter

Discovers and extracts hostnames from IPv4/IPv6 addresses using OSINT and active reconnaissance techniques, outputting CSV, TXT, or Nessus formats.

SPIFFE spire

SPIRE is a production-ready implementation of the SPIFFE APIs that performs node and workload attestation to securely issue and verify SVIDs.

spike

Lightweight secrets store using SPIFFE as its identity control plane for securing secrets across distributed environments.

sploitscan

SploitScan is a sophisticated cybersecurity utility designed to provide detailed information on vulnerabilities and associated exploits.

Splunk Attack Range

Splunk Attack Range builds instrumented cloud environments on AWS, Azure, or GCP, simulates attacks, and forwards data into Splunk for detection development and testing.

Splunk Security Content

sponsio

Sponsio is a cyber tool that checks agent tool calls against runtime rules before execution to prevent misalignment.

Sprinto

Sprinto is a compliance automation platform that helps companies achieve security certifications like SOC 2, ISO 27001, and GDPR efficiently.

sqlmap

sqlmap is an open source penetration testing tool that automates detecting and exploiting SQL injection flaws and taking over database servers.

sqlmc

SQLMC (SQL Injection Massive Checker) is a tool that crawls a domain to a specified depth and checks each link for SQL injection vulnerabilities.

sqlvet

ssdeep

ssdeep is a fuzzy hashing tool that computes context-triggered piecewise hashes to identify similar or partially matching files, useful in malware analysis.

ssh-audit

SSH server & client security auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

ssh-mitm

sshuttle

sshuttle is a transparent proxy tool that routes traffic over SSH, combining aspects of a VPN without requiring admin access on the remote network.

ssldump

SSLv3/TLS network protocol analyzer that decodes records, decrypts connections with keying material, and outputs JSON with JA3 and FAN/1 fingerprints.

sslscan

sslscan tests SSL/TLS enabled services to discover supported cipher suites

sslstrip

sslstrip is a Linux proxy that implements Moxie Marlinspike's HTTPS stripping attacks for authorized testing only.

sslyze

Fast and powerful SSL/TLS scanning library.

sstimap

Automatic SSTI detection tool with interactive interface

StackHawk

StackHawk is an application security tool that runs dynamic scans to find vulnerabilities in APIs and web applications, locally or in CI/CD pipelines.

statsprocessor

Statsprocessor is a word-generator based on per-position markov-chains

StepSecurity

StepSecurity is a security platform that hardens CI/CD pipelines, such as GitHub Actions, by detecting supply-chain risks, enforcing least-privilege runners, and monitoring workflow tampering.

Straiker

Straiker discovers and inventories enterprise AI agents, tests them with automated red teaming and protects them with runtime guardrails.

stratocyberlab

stride-gpt

AI-powered threat modeling cyber tool that uses LLMs to generate STRIDE-based threat models, attack trees, and mitigations for applications.

Strike Graph

Strix

Strix is an open-source AI penetration testing tool that autonomously finds and fixes vulnerabilities in applications.

StrongDM

StrongDM is a privileged access management platform that grants least-privilege, just-in-time access to databases, servers, containers, and cloud infrastructure.

Stytch

subjack

Subjack is a DNS takeover scanner written in Go that scans domains concurrently to identify ones vulnerable to hijacking.

Sublime Security

Sublime Security is an email security platform that detects and blocks phishing, malware, and other email-based threats using customizable, logic-based detection rules.

sublist3r

Fast subdomains enumeration tool for penetration testers - aboul3la/Sublist3r

sudo

Sudo is a program that allows a sysadmin to give limited root privileges to users and log root activity.

Sumo Logic

Sumo Logic is a cloud-based platform for log management, monitoring, and security analytics of applications and infrastructure.

Superagent

Superagent is an open-source SDK for AI agent safety that blocks prompt injections, redacts PII and secrets, and scans repositories for threats.

Swimlane atomic-operator

atomic-operator is a Python package used to execute Atomic Red Team tests (Atomics) across multiple operating system environments locally and remotely.

sysdig

Sysdig is a universal system visibility tool with native container support that captures system calls and OS events to enable deep inspection.

Sysdig Secure

Sysdig Secure is a container security platform providing runtime threat detection, forensics, and compliance monitoring for cloud-native environments.

Sysinternals Sysmon for Linux

Sysmon for Linux monitors and logs system activity including process lifetime, network connections, and file system writes to help identify malicious activity.

Syslifters SysReptor

SysReptor is a customizable pentest reporting platform for penetration testers to design reports in HTML, write in Markdown, and render to PDF.

sysmon-modular

Modular repository and Go CLI for building, validating, analysing, and comparing Microsoft Sysmon XML configurations from composable modules.

systeminformer

syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer

T3MP3ST

autonomous red teaming platform; multi-agent offensive-security meta-harness

tailscale

Open source daemon and CLI for creating private WireGuard-based mesh networks via the Tailscale service.

Tanium Patch

Tanium Patch automates patch management across Windows, Linux, and Mac endpoints at enterprise scale, helping IT teams keep systems up to date.

taranis-ai

Taranis AI is an advanced Open-Source Intelligence (OSINT) tool, leveraging Artificial Intelligence to revolutionize information gathering and situational analysis.

tcpdump

tcpdump is a tool for network monitoring and data acquisition that prints packet contents on a network interface matching a filter expression.

tcpflow

tcpflow captures data transmitted as part of TCP connections and stores each flow in its own file for protocol analysis and debugging.

tcpreplay

Edit and replay captured network traffic at arbitrary speeds — a suite of pcap tools for *NIX and Windows.

Teleport

Teleport provides connectivity, authentication, access controls, and audit for infrastructure, securing servers, Kubernetes clusters, databases, desktops, and web applications.

Telesign

Telesign provides cloud-based authentication and verification services through SMS, voice, and push notifications for securing user identity.

Tenable

Tenable is a cybersecurity platform that identifies, tracks, and remediates vulnerabilities across networks and cloud environments.

Tenable Attack Surface Management

Tenable Attack Surface Management discovers and monitors an organization's internet-facing assets, identifying exposures and vulnerabilities across the external attack surface.

Tenable Cloud Security

Tenable Identity Exposure

Tenable Nessus

Tenable Nessus is a vulnerability scanner that identifies security weaknesses, misconfigurations, and compliance issues across networks and systems.

Tenable One

Tenable One is an integrated cybersecurity platform that unifies vulnerability management, cloud security, and compliance across an organization's entire attack surface.

Tenable OT Security

Tenable Vulnerability Management

Tenable Vulnerability Management is a cloud-based product for scanning and managing vulnerabilities, available alone or as part of the Tenable One Exposure Management Platform.

Tenable Web App Scanning

Tenable Web App Scanning scans web applications for vulnerabilities as part of the Tenable One Exposure Management Platform.

Tencent Cloud CubeSandbox

CubeSandbox is a secure sandbox service built on RustVMM and KVM that creates hardware-isolated MicroVM sandboxes in under 60ms with less than 5MB memory overhead.

Tenchi Security Zanshin

tenuo

Task-scoped authorization for AI agents. Cryptographic warrants constrain tools and arguments, prevent privilege escalation at every delegation hop, and produce signed evidence of what was allowed or denied.

Tenzir

Tenzir is a data pipeline engine for security teams that collects, transforms, enriches, and routes telemetry.

Termius

testssl.sh

Testing TLS/SSL encryption anywhere on any port

The Apache Software Foundation maka

Apache Maka (Incubating) is a high-performance agent workspace that keeps a complete record of everything it did.

The Foreman Project Katello

Katello is a Foreman plugin that orchestrates content distribution and subscription management at scale across thousands of Enterprise Linux and Debian-based systems.

The Hacker's Choice gsocket

Toolkit enabling two users behind NAT/firewall to establish end-to-end encrypted TCP connections via the Global Socket Relay Network.

The Sleuth Kit

Open source forensic toolkit for analyzing Microsoft and UNIX file systems and disk images to identify and recover evidence.

theharvester

theHarvester gathers open-source intelligence about a domain or organization from search engines, certificate transparency logs, DNS datasets, and other public sources.

TheHive

TheHive is a Security Incident Response Platform for SOCs, CSIRTs, and CERTs to investigate and mitigate security incidents.

Thinkst OpenCanary

OpenCanary is a multi-protocol network honeypot that alerts you when attackers breach non-public networks and interact with its services.

Threat9 routersploit

RouterSploit is an open-source exploitation framework dedicated to embedded devices, with modules for exploits, scanners, credentials testing, and payloads.

Tigard

An FTDI FT2232H-based multi-protocol tool for hardware hacking.

Tines

tirith

Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.

tlsfuzzer

tmux

tmux is a terminal multiplexer that enables multiple terminals to be created, accessed, and controlled from a single screen, with background session persistence.

Token Security

Token Security is a blockchain security analysis platform that audits smart contracts and tokens for vulnerabilities, scams, and security risks.

Tonari innernet

innernet is a private network system that uses WireGuard under the hood to manage peers and control access using CIDRs.

tookie-osint

Tookie is a advanced OSINT information gathering tool that finds social media accounts based on inputs. - Alfredredbird/tookie-osint

ToolHive

ToolHive is an enterprise-grade platform for running and managing Model Context Protocol (MCP) servers.

topaz

Topaz is an open-source, self-hosted, fine-grained access control service for modern cloud applications.

Torq

tpotce

Trail of Bits onesixtyone

onesixtyone is a fast SNMP scanner that sends requests to multiple IP addresses, trying different community strings and logging responses.

transparency-exchange-api

Trend Vision One

Trend Vision One is Trend Micro's cloud-based XDR platform providing unified security visibility and threat detection across endpoints, networks, and cloud environments.

Trident

trivy-action

trivy-operator

Truffle Security trufflehog

TruffleHog is a tool that discovers, classifies, validates, and analyzes leaked credentials such as API keys, database passwords, and private encryption keys.

TrustCloud

TrustCloud is a compliance and security management platform that automates vendor risk assessments and regulatory compliance monitoring.

tsunami-security-scanner

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

Turbinia

Turbinia is an open-source framework for deploying, managing, and running distributed forensic workloads to automate common forensic processing tools in the cloud.

Turbot Steampipe

Zero-ETL tool that queries APIs and cloud services in real-time using SQL via plugins that map APIs to database tables.

Twine Security

Twine Security provides AI digital employees for cybersecurity, starting with Alex, an identity and access management expert.

Twingate

Twingate is a zero-trust network access platform that securely connects remote users and devices to private resources without VPN.

TXOne Networks

UAC

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

Uber ADR

Enterprise cyber tool that discovers, monitors, and detects threats in AI agent activity across employee-facing and customer-facing agents.

Ubiq Security

Unfurl

Parses URLs into directed graphs, extracting and visualizing components like timestamps, UUIDs, and platform-specific metadata.

Upwind

Upwind is a runtime-powered CNAPP that protects cloud workloads by combining posture, detection and response, and identity security with real-time runtime context.

urlfinder

URLFinder is a high-speed, passive URL discovery tool that gathers URLs for web asset discovery without active scanning.

uro

uro is a command-line tool that filters a URL list for security testing by removing duplicate, incremental, and low-value URLs without making HTTP requests.

user-scanner

user-scanner is a cyber tool that performs OSINT on email addresses and usernames across 2700+ platforms to map digital footprints and verify account registrati

user.js

Valence Security

Valence Security is a SaaS and AI security platform that provides visibility and control across SaaS applications, AI tools, and AI agent identities.

Vanta

Vanta automates security compliance and monitoring, helping companies achieve and maintain certifications like SOC 2, ISO 27001, and HIPAA.

varmor

Learn about vArmor and create your first policy through a Quick Start guide.

Varonis

Varonis Data Security Platform discovers and classifies sensitive data, monitors access and activity, and detects threats across cloud, SaaS, and on-premises environments.

Vector 35 Binary Ninja

Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.

Vectra AI

Vectra AI is a network detection and response platform that uses machine learning to detect threats including command-and-control, lateral movement, and data exfiltration.

Veeam Backup & Replication

Veeam Backup & Replication is backup, recovery, and replication software for virtual, physical, cloud, and SaaS workloads.

Veeam Data Cloud

Veeam Data Cloud is a SaaS backup and recovery service that protects Microsoft 365, Azure, and virtual machine data with cloud-hosted storage and management.

Veeam Kasten

Kasten K10 is a data management platform for Kubernetes that provides backup/restore, disaster recovery, and application mobility.

Vega

Vega is a decentralized protocol for derivatives trading that enables peer-to-peer trading of futures and options on a blockchain.

veil

Generates Metasploit payloads designed to bypass common anti-virus solutions.

Velero

Velero is an open-source tool that backs up, restores, and migrates Kubernetes cluster resources and persistent volumes.

Velocidex Velociraptor

Endpoint visibility and collection tool that gathers host-based state information using the Velociraptor Query Language (VQL).

Veracode

Veracode is a cloud-based application security platform that performs static, dynamic, and software composition analysis to identify vulnerabilities in code.

Vercel deepsec

Deepsec is a security harness for finding vulnerabilities in your codebase powered by coding agents

Versa Networks

vigolium

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision

villain

Villain is a C2 framework that handles multiple reverse TCP and HoaxShell-based shells, generates payloads, and shares sessions among connected Villain instances.

vinetto

Vinetto: a thumbnail file parser. Based on the original Vinetto by Michel Roukine - AtesComp/Vinetto

VirusTotal YARA

YARA is a tool that helps malware researchers identify and classify malware samples using rules based on textual or binary patterns.

vm-packages

Volatility 3

Volatility 3 is an open-source framework for extracting digital artifacts from volatile memory (RAM) samples across Windows, Mac, and Linux.

Volatility Foundation dwarf2json

dwarf2json is a Go utility that processes files containing symbol and type information to generate Volatility3 Intermediate Symbol File (ISF) JSON output.

vopono

vopono runs applications through VPN tunnels via temporary network namespaces, letting you route select apps through different VPNs simultaneously.

VulnCheck Target Intelligence

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

vulnerability-db

Vulnerability database and package search for sources such as Linux, OSV, NVD, GitHub and npm. Powered by sqlite, CVE 5.2, purl, and vers.

vulnerablecode

Vulners getsploit

Getsploit searches and downloads public exploits from the Vulners database online, or fully offline from a local SQLite FTS5 index.

vulnix

Wabbi

Wabbi is a continuous security platform that automates and integrates application security policies into CI/CD pipelines for development teams.

Wallarm

Wapiti

Wapiti is a web vulnerability scanner written in Python that performs black-box scans by crawling web applications and injecting payloads to detect vulnerabilities.

Waratek

Waratek is a Java application security platform that provides runtime protection against vulnerabilities and attacks without code modification.

warden

Warden is the secure gateway connecting AI agents to the enterprise systems they need to do real work.

Watcher

Django & React JS platform for automated cybersecurity threat detection, monitoring domains, data leaks, CVEs, and ransomware with AI-powered intelligence.

Waterfall Security

waybackpy

Waybackpy is a Python package and CLI tool that interfaces with the Wayback Machine APIs.

waymore

waymore finds links from the Wayback Machine and other sources, and can also download archived responses to search for additional links.

Wazuh

Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.

wazuh-mcp-server

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

Weaveworks eksctl

eksctl is a command-line utility tool that automates and simplifies the process of creating, managing, and operating Amazon Elastic Kubernetes Service (Amazon EKS) clusters.

web-check

Web-Check is an open source tool that provides on-demand intelligence for any website, uncovering server architecture, security configurations, and technologies in use.

webanalyze

webanalyze is a Go port of Wappalyzer that detects web technologies across large host lists with high performance.

weevely

PHP web shell for post-exploitation providing remote shell access, file management, pivoting, and over 30 modules via obfuscated HTTP.

whatsapp-osint

whatweb

WhatWeb identifies websites, recognising web technologies including CMS, blogging platforms, JavaScript libraries, web servers, and embedded devices using over 1800 plugins.

Where Labs Bus Pirate 5

A universal serial interface tool that talks 1-Wire, I2C, SPI, UART and other protocols from a terminal, used to probe chips and debug embedded hardware.

wifiphisher

Rogue Access Point framework for Wi-Fi phishing attacks, capturing credentials or delivering malware via Evil Twin, KARMA, and Known Beacons techniques.

wifipumpkin3

wifipumpkin3 is a Python framework for rogue access point attacks that allows security researchers to mount a wireless network and conduct man-in-the-middle attacks.

wifite

Automated wireless network auditing tool that runs existing tools to capture and crack WEP, WPA/WPA2/WPA3, and WPS credentials.

wig

Web application information gatherer that fingerprints CMS versions, platforms, and OS by analyzing known file checksums and HTTP headers.

wig-ng

wig-ng is a free and open source utility for WiFi device fingerprinting supporting protocols including WPS, WiFi-Direct, CCX, AWDL, and HP Printers.

Wireblast

Wireblast is an AF_XDP traffic generator for measuring and replaying high-rate Linux network traffic.

Wireshark

Wireshark is a network traffic analyzer, or sniffer, for Linux, macOS, BSD, and Windows that captures and analyzes packets.

WithSecure chainsaw

Chainsaw is a command-line tool that rapidly searches and hunts through Windows forensic artefacts such as Event Logs and the MFT file.

WitnessAI

WitnessAI sits in the network path and monitors, controls and protects employee, application and agent AI activity.

witr

witr is a cyber tool that traces processes, ports, containers, or files back to their initiating cause chain.

Wiz

Wiz is a cloud security platform that identifies and remediates risks across cloud environments using AI-driven analysis.

Wiz Cloud

Wiz Cloud is a cloud security platform that identifies and remediates risks across cloud infrastructure, applications, and data.

Wiz Code

Wiz Code is a developer security tool that scans code and infrastructure-as-code for vulnerabilities and misconfigurations during the development lifecycle.

Wiz Defend

Wiz Defend is a cloud detection and response platform that identifies and helps remediate real-time threats across cloud environments.

Wiz Sensor

Wiz Sensor is a lightweight, eBPF-based runtime sensor that scans workloads and AI models, detects threats, and blocks active attacks in real time.

wolfssl

wordfence-cli

World Monitor

Real-time global intelligence dashboard. AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface

wpprobe

WPProbe scans WordPress sites to detect installed plugins and themes, then maps them to known vulnerabilities from Wordfence and WPScan databases.

WPScan

Scans WordPress sites for vulnerabilities, enumerating plugins, themes, users, and misconfigurations via the WPScan vulnerability database.

wsgidav

WsgiDAV is a generic and extendable WebDAV server written in Python and based on WSGI.

wstg

Comprehensive guide and framework of best practices for testing the security of web applications and web services.

x-osint

x64dbg

x64dbg is an open-source binary debugger for Windows, aimed at malware analysis and reverse engineering of executables you do not have the source code for.

Xage Security

Xage Security is a company providing zero-trust access control and data protection for industrial operational technology and critical infrastructure, enabling secure remote access, identity-based policy enforcement, and encrypted data sharing.

xalgorix

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

xapkdetector

XAPKDetector is an Android detector for Windows, Linux, and macOS that shows build tools, libraries, and protection info for APK/DEX files.

xclip

Command line interface to the X11 clipboard

XFA

XFA is a framework for building and testing XML Forms Architecture documents with security and developer tooling capabilities.

xnLinkFinder

Discovers endpoints, parameters, wordlists, and secrets for a target by crawling URLs, directories, Burp/ZAP/HAR files, or waymore results.

xsrfprobe

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

xsstrike

XSS detection suite that crawls targets, analyzes response context, and generates context-aware payloads to find reflected, DOM, and blind XSS vulnerabilities.

Xygeni

Xygeni is a software supply chain security platform that detects threats, misconfigurations, and vulnerabilities across CI/CD pipelines, code repositories, and dependencies.

Yamato Security Hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

yara-forge

Automated YARA Rule Standardization and Quality Assurance Tool

YARA-X

A rewrite of YARA in Rust.

Yelp detect-secrets

An enterprise friendly way of detecting and preventing secrets in code. - Yelp/detect-secrets

yersinia

Yersinia is a framework for layer 2 attacks targeting protocols including STP, CDP, DHCP, DTP, VTP, HSRP, and 802.1Q.

Yeti

Yeti is a Forensics Intelligence platform that stores CTI observables, TTPs, and campaigns, and provides a web API for DFIR-related queries and enrichment.

Yubico

Yubico makes YubiKey hardware security keys that provide two-factor and passwordless authentication, protecting accounts against phishing and unauthorized access.

yubikey-guide

Zama fhEVM

FHEVM, a full-stack framework for integrating Fully Homomorphic Encryption (FHE) with blockchain applications

zarf

The Airgap Native Package Manager for Kubernetes

Zeek

Zeek is a network security monitor and framework for network traffic analysis and security monitoring.

Zenity

Zenity discovers, secures and governs enterprise AI agents from buildtime to runtime across SaaS, endpoint and cloud.

ZeroPath

ZeroTier

ZeroTier is a virtual networking tool that creates secure, encrypted peer-to-peer networks connecting devices globally as if on a local LAN.

zizmor

Static analysis for GitHub Actions (and more)

Zscaler

Zscaler is a cloud-native security platform that provides secure internet access, zero trust networking, and threat protection for users, devices, and applications.

Zscaler Data Protection

Zscaler Data Protection is a cloud-based security service that prevents data loss and enforces policies across web, cloud, and email channels.

Zscaler Internet Access

Zscaler Internet Access is a cloud-based security platform that inspects and controls user internet traffic to block threats and enforce policies.

Zscaler Posture Control

Zscaler Posture Control monitors and enforces security compliance policies across devices and users in cloud and on-premises environments.

Zscaler Private Access

Zscaler Private Access provides zero-trust secure access to private applications without exposing them to the internet.