Recently Added

Cartography

Python

Intel graph of cloud infrastructure. Maps relationships between AWS, GCP, Azure, and other services into a Neo4j graph.

Steampipe

Go

Query cloud APIs with SQL. Zero-ETL approach to infrastructure visibility across AWS, Azure, GCP, and 140+ plugins.

cloud_enum

Python

Multi-cloud OSINT enumeration. Discovers public resources across AWS, Azure, and GCP from keyword input.

CloudFlair

Python

Find origin servers behind Cloudflare. Uses Censys to discover the real IP address of Cloudflare-protected websites.

MISP

PHP/Python

Open-source threat intelligence and sharing platform. Structured IOC management, feeds, correlation, and STIX/TAXII export.

OpenCTI

TypeScript/Python

Cyber threat intelligence platform. Knowledge management for threat data with STIX2 native storage and graph visualization.

TheHive

Scala/JavaScript

Incident response case management platform. Collaborative investigation with observable analysis, playbooks, and MISP integration.

GRR Rapid Response

Python

Remote live forensics framework by Google. Deploy agents across thousands of endpoints for artifact collection and analysis.

KAPE

C#

Kroll Artifact Parser and Extractor. Fast triage collection and parsing of forensic artifacts from Windows, macOS, and Linux.

Cortex

Scala/Python

Observable analysis and active response engine. Analyze IOCs at scale with 100+ analyzers for IPs, hashes, URLs, and domains.

dnSpy

C#

.NET debugger, decompiler, and assembly editor. Inspect and modify .NET and Unity assemblies without source code.

ILSpy

C#

Open-source .NET decompiler and assembly browser. Produces clean C# from compiled binaries with cross-platform support.

x64dbg

C++

Open-source x64/x32 debugger for Windows. Full-featured binary debugger with plugin ecosystem for malware analysis and reverse engineering.

Detect It Easy

C++/Qt

Binary packer and compiler detection. Identifies compilers, linkers, packers, and protectors used to build PE, ELF, and Mach-O files.

Interactsh

Go

Out-of-band interaction server. Detect blind vulnerabilities with DNS, HTTP, SMTP, and LDAP callback listeners.

Scapy

Python

Interactive packet manipulation library. Craft, send, capture, and decode network packets with a powerful Python interface.

Reaver

C

WPS brute force attack tool. Exploits Wi-Fi Protected Setup to recover WPA/WPA2 passphrases from WPS-enabled routers.

Ignorant

Python

Phone number OSINT. Check if a phone number is registered on various platforms without alerting the target.

angr

Python

Binary analysis framework. Symbolic execution, CFG recovery, and vulnerability discovery for compiled binaries in Python.

RetDec

C++

Retargetable decompiler by Avast. Converts machine code back to C from x86, ARM, MIPS, and PowerPC binaries.

Rizin

C

Reverse engineering framework forked from radare2. Modernized API, improved UX, with Cutter as its official GUI.

Unicorn Engine

C

Lightweight CPU emulator framework. Emulate x86, ARM, MIPS, and more for binary analysis, fuzzing, and instrumentation.

Capstone

C

Multi-architecture disassembly framework. The engine behind Ghidra, radare2, and dozens of security tools.

Pixiewps

C

WPS offline brute force. Exploits weak random number generation in WPS implementations to recover PINs in seconds.

mdk4

C

802.11 protocol exploitation toolkit. Authentication floods, beacon floods, deauth attacks, and SSID fuzzing for wireless testing.

hostapd-mana

C

Rogue access point and evil twin toolkit. Modified hostapd for wireless credential capture and MitM attacks.

WiFi-Pumpkin3

Python

Rogue access point framework. GUI-driven evil twin with captive portal, credential harvesting, and transparent proxy support.

Aquatone

Go

Visual web discovery tool. Takes screenshots of web pages across large target lists and generates browsable HTML reports.

EyeWitness

Python

Web screenshot and categorization tool. Captures screenshots of web pages, RDP, and VNC services with auto-categorization.

CRLFuzz

Go

CRLF injection scanner. Fast detection of HTTP response splitting vulnerabilities across multiple URLs.

Smuggler

Python

HTTP request smuggling tester. Detects CL.TE, TE.CL, and TE.TE desync vulnerabilities in web servers and proxies.

RegRipper

Perl

Windows registry forensic parser. Extracts and decodes forensic artifacts from registry hives with extensible plugins.

bulk_extractor

C++

High-performance forensic data carver. Extracts email addresses, URLs, credit cards, and other artifacts from disk images at speed.

CUPP

Python

Common User Passwords Profiler. Generates targeted wordlists based on personal information about the target.

Patator

Python

Multi-purpose brute force tool. Modular design for attacking SSH, FTP, HTTP, SMB, LDAP, and dozens of other protocols.

Mentalist

Python

Wordlist generation GUI. Visual chain-based rule builder that outputs wordlists or hashcat/JtR rule files.

WeirdAAL

Python

AWS Attack Library. Enumerate, exploit, and backdoor AWS services with organized modules for cloud penetration testing.

Zeek

C++

Network analysis framework (formerly Bro). Deep packet inspection, protocol analysis, and security monitoring at scale.

Arkime

JavaScript/C

Full packet capture and search system (formerly Moloch). Indexed network traffic with a web UI for hunting and forensics.

Suricata

C/Rust

High-performance IDS/IPS and network monitoring engine. Multi-threaded with Snort-compatible rules and protocol logging.

osquery

C++

SQL-powered endpoint visibility. Query operating system state as a relational database for security monitoring and compliance.

Wazuh

C/Python

Open-source SIEM and XDR platform. Endpoint detection, log analysis, vulnerability scanning, and compliance monitoring.

Sigma

Python/YAML

Generic detection rule format. Write once, convert to Splunk, Elasticsearch, QRadar, and 30+ SIEM backends.

Wireshark

C/C++

Featured

The world's foremost network protocol analyzer. Deep packet inspection for hundreds of protocols.

TweetFeed

Python

Real-time feed of IOCs shared on Twitter by the infosec community. Domains, IPs, URLs, SHA256 hashes.

Reth

Rust

High-performance Ethereum execution client in Rust. Blazing fast sync, archive mode, and modular architecture.

Rizin

C

Reverse engineering framework forked from radare2. Modernized API, improved UX, with Cutter as its official GUI.

MISP

PHP/Python

Open-source threat intelligence and sharing platform. Structured IOC management, feeds, correlation, and STIX/TAXII export.

Autopsy

Java

Digital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.

Radare2

C

Portable reversing framework. Disassembly, debugging, analysis, patching, and scripting in a single CLI.

TruffleHog

Go

Featured

Find leaked credentials in Git repos, S3 buckets, and filesystems. Regex and entropy-based detection.

tcpdump

C

Command-line packet analyzer. The lightweight, scriptable alternative to Wireshark for capture and analysis.

SecLists

Shell

Featured

The security tester's companion. Huge collection of wordlists - usernames, passwords, URLs, fuzzing payloads, shells.

Retire.js

JavaScript

Scanner for detecting use of JavaScript libraries with known vulnerabilities in web applications.

BlockScout

Elixir

Featured

Open-source blockchain explorer for Ethereum and EVM chains. Full-featured with smart contract verification.