Tools (4958)

010 Editor is a text and hex editor with Binary Templates technology.

Web security tool to make fuzzing at HTTP inputs, made in C with libCurl.

Traceroute tool that can run within an existing TCP connection

Analyze Cobalt Strike beacons.

Tiny free proxy server.

Tiny free proxy server.

Recursive Zip archive bomb.

Compress and decompress files using a variety of algorithms.

Unclear image-related web service with an active domain but limited publicly verifiable functionality.

7-Zip file archiver with a high compression ratio

Auto Scanning to SSL Vulnerability.

PowerShell toolkit for Azure AD and Entra ID assessment, including tenant reconnaissance and hybrid identity attack-path analysis.

ActionScript ByteCode Disassembler.

Network security sniffer for finding vulnerabilities in the network

Bypassing WAF by abusing SSL/TLS Ciphers.

A python script to automatically list vulnerable Windows ACEs/ACLs.

A password dictionary attack tool that targets windows authentication via the SMB protocol.

Accept connections to all IPv4 and IPv6 addresses and redirect it to the corresponding local port.

A simple yet powerful VoIP Corporate Directory enumeration tool that mimics the behavior of an IP Phone in order to down

Active Directory ACL exploitation with BloodHound.

Enumerate AD through LDAP.

An LDAP based Active Directory user and group enumeration tool.

Active Directory audit tool that extract data from Bloodhound to uncover security weaknesses and generate an HTML report

Active Directory Assessment and Privilege Escalation Script.

Extensible post-exploitation and adversarial emulation framework.

Extensible post-exploitation and adversarial emulation framework

An Active Directory environments pentest tool complementary to existing ones like NetExec.

adbhoney honeypot, bundled with T-Pot's multi-honeypot platform.

Free people search engine for name, phone, and address lookups. Basic results are free; detailed reports redirect to Intelius (paid).

A pentesting tool that allows to find misconfiguration through the the protocol LDAP and exploit some of those weaknesse

AD Explorer snapshot parser.

Simple admin panel finder for php,js,cgi,asp and aspx admin panels.

Python3 tool to perform password spraying against Microsoft Online service using various methods.

Active Directory Integrated DNS dumping by any authenticated user.

ADM DNS spoofing tools - Uses a variety of active and passive methods to spoof DNS packets. Very powerful.

This python script looks for a large amount of possible administrative interfaces on a given site.

ADM SNMP audit scanner.

winPEAS, but for Active Directory.

Large community-driven unfiltered ADS-B flight tracking network with broad global aircraft coverage.

Netherlands-focused ADS-B tracking portal with emphasis on military and regional aviation movements.

Adult-oriented social and dating platform with searchable profiles and preference-driven discovery.

Python Library for Machine Learning Security.

A tool for dumping domain data via ADWS for evasion purposes.

Tool for correcting bit errors in an AES key schedule

Tool for locating AES keys in a captured memory image

Find 128-bit and 256-bit AES keys in a memory image.

Reads data from stdin and outputs encrypted or decrypted results to stdout.

A backconnect shell for Windows and Unix written in python and uses AES in CBC mode in conjunction with HMAC-SHA256 for

Advanced Forensics Format Library (utilities)

Instrumentation-driven fuzzer for binary formats

A gadget finder and a ROP-Chainer tool for x86 platforms.

A very fast ssh attacking script which includes a multithreaded port scanning module (tcp connect) for discovering possi

Bruteforce commandline buffer overflows, linux, aggressive arguments.

Well-known Tor search engine indexing onion services with clearnet accessibility for discovery workflows.

AI content detection tool that analyzes images and audio to determine whether they were generated by AI or created by humans.

A packet inspection engine with capabilities of learning without any human intervention.

A tool to create aff-images.

Security scanner and fingerprinter for AI/ML infrastructure. Identifies 23 service types including LLMs, vector database

Python 3 DNS asynchronous brute force utility.

A GUI front-end to dd/dc3dd designed for easily creating forensic images.

aircrack-ng

Wireless WEP/WPA cracking utilities

A modification of aireplay that allows for a DoS of the AP. This program fills the table of clients of the AP with rando

Multi-use bash script for Linux systems to audit wireless networks

Multi-use bash script for Linux systems to audit wireless networks.

Get (wireless) clients and access points.

A script to simplify the use of aircrack-ng tools.

Script to simplify the use of aircrack-ng tools

A tool for generic packet injection on an 802.11 network.

Host code for AirspyHF+ SDR.

A command-line fuzzer for the Apache JServ Protocol (ajp13).

Online Android Interactive Analysis Environment with plugins for analyzing malicious Android applications and APKs for suspicious behavior and…

A SQLi exploitation framework in Python.

Aliasr is a modern and feature-rich TUI launcher for penetration testing commands inspired by Arsenal but with significantly improved functionality.

Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.

Twitter/X account history viewer for reviewing public tweet timelines in a single interface.

A vhost discovery tool that scrapes various web applications.

Subdomain discovery through alterations and permutations

Permutation-based DNS tool that generates and resolves alternative subdomains from known names.

Fast and customizable subdomain wordlist generator using DSL.

Next-generation scanning tool for pentesters

In-depth DNS Enumeration and Network Mapping

Advanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.

Amazon gift registry search for wedding, baby, and other registries.

Reflective PE packer.

Yet another tool for analysing binaries.

Comprehensive web-based OSINT platform with 40+ integrated tools for people search, social media analysis, username enumeration, and archive…

Reverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.

Parse the MFT file from an NTFS filesystem.

Analyze digital signature of PE file.

World's largest genealogy platform with over 40 billion historical records including census, immigration, military, and vital records across 80+…

An efficient Android vulnerability scanner that helps developers or hackers find potential security vulnerabilities in A

Reverse engineering, Malware and goodware analysis of Android applications and more.

A python tool to help in forensics analysis on android.

A tool for reverse engineering Android apk files.

Android backup extractor

Android C/C++ developer kit

Google Android SDK

Software development kit for Android platform

A collection of tools for debugging Android applications

Android udev rules.

AI tool to deobfuscate and find any potential vulnerabilities in android apps.

Bruteforce the Android Passcode given the hash and salt.

Convert an Android APK application file into an Android Studio project for easier analysis.

A perl script that lets you search for 3rd party passwords, dump the call log, dump contacts, dump wireless configuratio

Yet another static code analyzer for malicious Android applications.

A simple tool for filtering and manipulating text data / such as log files and other outputs.

The next-generation binary analysis platform from UC Santa Barbaras Seclab.

The official angr GUI.

The next-generation binary analysis platform from UC Santa Barbaras Seclab.

A rop gadget finder and chain builder.

Free directory of annual reports for thousands of public companies worldwide. Allows browsing and downloading official investor relations documents.

A wrapper around wget, ssh, sftp, ftp, and telnet to route these connections through Tor to anonymize your traffic.

A free software python client designed to navigate anonymously on social networks. It supports Identi.ca and Twitter.com

Java-based authorship anonymization tool that analyzes and modifies writing style features to reduce stylometric identification of document authors.

FCC-backed lookup for antenna structure and tower records used in RF and telecom investigations.

A XSS vulnerability scanner.

A tool capable of detect and stop attacks of Ransomware using honeypots.

Subdomain enumeration and information gathering tool.

Interactive malware analysis sandbox allowing real-time manual interaction with Windows, macOS, Linux, and Android environments. Fast report…

Toolkit for detecting and extracting metadata and structured text content

Apache content analysis framework for extracting metadata and text across a very broad set of file formats.

Enumerate usernames on systems with Apache UserDir module

Apache HTTP Server

Apache Tomcat vulnerability scanner.

Sniffer syn and backscatter packets.

A program that automatically hops between access points of different wireless networks.

API Monitor lets you monitor and control API calls made by applications and services.

Android Application Identifier for Packers, Protectors, Obfuscators and Oddities.

Scanning APK file for URIs, endpoints & secrets.

arguably the most important step to optimize your APK file

Automated Information Retrieval From APKs For Initial Analysis.

An IDE for decompiling/editing & then recompiling of android application binaries.

Tool for reverse engineering Android apk files

Extract endpoints from APK files.

A small python script designed for enumerating valid APNs (Access Point Name) on a GTP-C speaking device.

Scripts to show what an attacker get from Apple devices

A runtime security testing & profiling framework for native apps on macOS, iOS & android and it is built using Frida.

Automated penetration toolkit.

NOAA APT satellite imagery decoder.

A Tool for Domain Flyovers.

Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report…

A feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators ev

A fast and clean dns spoofing tool.

Backdoor iOS packages and create the necessary resources for APT repositories.

Just another guided/automated Arch Linux installer with a twist

On-demand web snapshot service that preserves point-in-time copies of pages and shortens archive links.

The open source self-hosted web archive. Takes browser history/bookmarks/Pocket/Pinboard/etc., saves HTML, JS, PDFs, med

Archlinux Version Controller (Git version patched for runtime config using environment variables)

Search and access layer for Reddit datasets with tools for historical content retrieval and analysis.

Automated decoding of encrypted text without knowing the key or ciphers used.

Network monitoring tool with flow control.

Network monitoring client for Argus.

HTTP parameter discovery suite

AI-powered blockchain intelligence platform mapping 300+ million address labels and 150K+ entity pages using proprietary Ultra system for entity…

Cyber attack management for Metasploit

A simple Bash script designed to create encrypted macOS payloads capable of evading antivirus scanners.

ARM Shellcode Generator (Mostly Thumb Mode).

Arp scanning and fingerprinting tool

Monitor ARP changes in ethernet networks.

Sends IP and/or ARP pings (to the MAC address)

ARP Ping from Thomas Habets (aka Debian arping).

The UNIX arp cache update utility

A host-based solution to secure the ARP protocol and prevent MITM attacks via ARP spoofing or cache poisoning.

Performs an ARP spoofing attack using the Linux kernel's raw sockets.

Arp spoof detection tool.

A simple tool about ARP broadcast, ARP attack, and data transmission.

Ethernet/FDDI station activity monitor

GUI-based python tool for arp poisoning and dns poisoning attacks.

Go-based command library equipped with 200+ cybersecurity cheat-sheets

Blue team tool designed to protect Linux and Windows operating systems through multiple methods.

Apache Real Time Logs Analyzer System.

asar decompresses .asar archives

Terminal session recorder

Extendable version manager with support for ruby python go etc

A tool for exploiting Cisco LEAP networks

ASN, RPKI validity, BGP stats, IPv4v6, Prefix, URL, ASPath, Organization, IP reputation, IP geolocation, IP fingerprinti

Map organization network ranges using ASN information.

An ASP fingerprinting tool and vulnerability scanner.

Removes the traces left by offensive security tools.

Make your VLAN ASREProastable.

Web pentest framework for information gathering and vulnerability scanning.

Find domains and subdomains related to a given domain

Assetnote generated wordlists.

Automated Security Testing For REST API's.

Astrometry.net solves star-field images to estimate where and when a photo was taken.

Wireless Hacking, WiFi Security, Vulnerability Analyzer, Pentestration.

Advanced TFTP client

A SSL cipher scanner that checks all cipher codes. It can identify about 150 different ciphers.

Open source tool that can suggest sqlmap tampers to bypass WAF/IDS/IPS.

Module to execute Atomic Red Team tests (Python 3)

Server, Site and Dork Scanner.

This is an archive of various @Stake tools that help perform vulnerability scanning and analysis, information gathering,

The ATT&CK Navigator is designed to provide basic navigation and annotation of ATT&CK matrices, something that people are already doing today in…

Tool that aims to automate the reconnaissance process.

Trend Micro Anti-Threat Toolkit.

for recording and editing sounds

Translate JavaScript to Other Alphabets.

Automated Brute-Force Login Attacks Against EAP Networks.

Automatic XOR decryptographyr tool.

Automatic XOR decryptor tool.

Automatically exploit Active Directory privilege escalation paths shown by BloodHound.

Tool for producing shell scripts to configure source code packages

Vehicle history lookup platform with records from European and North American markets and paid report expansion.

a tool to automatically restart containers with failed healthchecks.

Extract AutoIt scripts embedded in PE binaries.

Should help with automating some of the user-focused enumeration tasks during an internal penetration test.

This script communicates with the Nessus API in an attempt to help with automating scans.

Massive NSE (Nmap Scripting Engine) AutoSploit and AutoScanner.

Graphical interface to SleuthKit

Specify targets and run sets of tools against them.

Multi-threaded network reconnaissance tool

European VIN and plate intelligence service with free and paid tiers for technical vehicle profile data.

Tool to automate common osint tasks.

Automate the exploitation of remote hosts.

Easily connect to a VPN in a country of your choice.

.NET Decompiler (port of ILSpy)

AntiVirus Evasion Tool.

A portable volatile memory acquisition tool for Linux.

AVRDUDE is a command-line program that allows you to download/upload/manipulate the ROM and EEPROM contents of AVR microcontrollers using the…

Community GitHub repository compiling data broker opt-out procedures, privacy request templates, and removal links for 2026.

Large curated OSINT resource list covering investigation tools, techniques, and training references.

Script to test S3 buckets as well as Google Storage buckets and Azure Storage containers for common misconfiguration iss

AWS IAM policy scanner that helps determine where privilege escalation can be achieved.

Discover resources created in an AWS account.

A tool to quickly enumerate AWS S3 buckets to look for loot.

Python tool that enumerates AWS S3 buckets and optionally downloads accessible objects using keyword and pattern-based discovery.

Command-line interface for Amazon Web Services.

Light command line download accelerator

Online community for real-time meeting and chatting with singles across web and mobile platforms.

A userland rootkit based off of the original LD_PRELOAD technique from Jynx rootkit.

A footprinting tool for ROS and SROS systems.

A great cloud needs great tools; we're excited to introduce Azure CLI our next generation multi-platform command line experience for Azure.

BloodHound data collector for Microsoft Azure (program)

Remote management tool

Small backdoor using cookie.

Shell script that simplifies the process of adding a backdoor to any Android APK file

Patch win32/64 binaries with shellcode.

A powerful utility capable of backdooring Unix machines with a slew of backdoors.

Transform your payload.exe into one fake word doc (.ppt).

A network protocol fuzzing toolkit.

Tool to perform Android app analysis by backing up and extracting apps, allowing you to analyze and modify file system c

Tool aided persistence via Windows URI schemes abuse.

A remote administration system which allows a user to control a computer across a tcpip connection using a simple consol

Steal NTLM Hashes with Bad-PDF.

Advanced network reconnaissance toolkit.

A tool which interfaces with management or administration applications from an offensive standpoint.

Global social dating platform with swipe-based matching, nearby discovery, and in-app messaging.

A library for detecting known secrets across many web frameworks.

Yet another frida based App decryptor.

Chinese reverse image search platform useful for discovering image reuse on China-centric websites.

Major Chinese mapping platform with strong POI and routing coverage in mainland China.

Disassembler for the dex format used by Dalvik, Android's Java VM implementation.

A package of malware analysis tools in python to extract patterns of interest from suspicious files (IP addresses, domai

Python malware analysis toolkit that extracts indicators and brute-forces common obfuscation patterns including XOR and rotation transforms.

A modular framework designed to be a platform to launch attacks against botnets.

A toolbox to analyze mobile phone metadata.

A multiplatform open source Binary Analysis and Reverse engineering Framework.

Java RMI enumeration and attack tool.

An AWS Cloud Post Exploitation framework.

Extract and decode base64 strings from files.

Locate and decode strings encoded in Base64 and other common encodings.

Tool that can extract TLD (Top Level Domain), domain extensions (Second Level Domain + TLD), domain name, and hostname f

Fully configurable and extendable Bash obfuscation framework.

A port scanner built to utilize /dev/tcp for network and service discovery.

Bulk geocoding workflow that converts large address lists into latitude/longitude pairs.

Bulk reverse-geocoding workflow that converts coordinate lists into human-readable addresses.

Batman kernel module, (included upstream since .38)

Almighty Lightweight Fact Remote Exchange Daemon.

Multipurpose scanner built to automate your Recon, Bug Bounties, and ASM.

SQL injection exploit tool.

A tiny Batch web vulnerability Scanner.

Patch Binaries via MITM: BackdoorFactory + mitmProxy

This is a utility to parse a Bit Defender log file, in order to sort them into a malware archive for easier maintenance

Open geolocation database for Wi-Fi/Bluetooth/cell beacons used in location inference.

Parse PE file contents.

A network protocol fuzzer

A tool for checking exploitability.

The Browser Exploitation Framework that focuses on the web browser.

Pentesting framework that focuses on web-browser exploitation

Browser Exploitation Framework (BeEF)

beelzebub honeypot, bundled with T-Pot's multi-honeypot platform.

Honeypot deployment made easy.

A wireless intrusion detection tool that looks for anomalies in a wifi environment.

The Traditional Swiss Army Knife for OSINT.

Open-source OSINT data collection and automation framework for gathering information from multiple sources.

A Multi-threaded Dictionary based SSH cracker.

A Multi-threaded Dictionary based SSH cracker

Guide to Meta Content Library access for researching public Facebook, Instagram, and Threads content.

Script for orchestrating mana rogue Wi-Fi Access Points

A post exploitation tool to check common misconfigurations to find a way to escalate our privilege.

Complete, modular, portable and easily extensible MITM framework

Bettercap’s web UI

An automated tool that checks for backup artifacts that may disclose the web-application's source code.

Perform checks of single and multiple argument command line overflows and environment variable overflows.

Input based fuzzer tool for browsers.

Platform ranking ASNs and BGP prefixes by malicious content and security threats.

RFC2385 password cracker

Binary grep.

Academic search engine indexing over 400 million documents from 12,000+ content providers including institutional repositories, open-access journals,…

Information Gathering tool for a Website or IP address.

Business Identification Number database for company registration lookups. Provides business registration and compliance information.

Commercial security research platform with internet-wide scanning and module-based detection.

A new kind of reversing platform (demo version).

Internet Domain Name Server

A static analysis tool for binaries

A static analysis tool for binaries

A comparison tool for binary files, that assists vulnerability researchers and engineers to quickly find differences and

Analyze I/O operations of a suspicious PE file by emulating its execution.

Format String exploit building tool.

POSIX function tracing. Much better and faster than ftrace.

Microsoft visual search engine with reverse image lookup and crop-based matching for partial-object analysis.

Enumerate hostnames for an IP using bing.com

Python script for searching Bing for sites that may have local and remote file inclusion vulnerabilities.

Microsoft web mapping service with road, aerial, and route layers for location analysis.

Microsoft's neural translation service for text and web content across 100+ languages.

A Linux bash based Bing and Google Dorking Tool.

A binary analysis IDE that allows to inspect, navigate, edit and annotate control flow graphs and call graphs of disasse

A proxy for arbitrary TCP connections.

Tool library for analyzing binary blobs and executable code

Tool library for analyzing binary blobs and executable code

Binary and Directory tree comparison tool using the Fuzzy Hashing concept (ssdeep).

A tool to dump RAM contents to disk (aka cold boot attack).

Open-source Twitter data harvesting and analysis framework for collecting tweets and producing offline analytical artifacts.

A tool that will assist in the security assessment of mainframe applications served over TN3270.

Community-curated Bitcoin address abuse database tracking addresses associated with ransomware, fraud, scams, and illicit activities.

Bitcoin address profiling and scam reporting platform with community-driven address tagging for fraud detection and wallet identification.

A tool to extract database data from a blind SQL injection vulnerability.

Bitcoin address balance checker and transaction analyzer supporting address clustering, mempool data, mining statistics, and developer API.

A simple yet powerful libpcap-based Ethernet packet generator. It is designed to complement tcpdump, which by itself has

Crack legacy zip encryption with Biham and Kocher known plaintext attack.

Program for dumping the syskey bootkey from a Windows NT/2K/XP system hive.

Free public records search portal covering 37,000+ types of records including criminal records, court records, property records, and background…

Meta package for installing official security tools from the Arch Linux repository.

An OSINT tool to search fast for accounts by username across 581 sites.

Dork scanner & bruteforcing & hash cracker with blackbox framework.

Ultimate phishing tool with ngrok and serveo.

Creates a filter from system hashes.

A low bandwidth ICMP attack that is capable of doing denial of service to well known firewalls.

Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.

A BLE scanner for "smart" devices hacking.

High-quality, full-featured hex editor.

A collection of practical application cryptanalysis tools.

A blind SQL injection module that uses bitshfting to calculate characters.

A web application fingerprinter. Attempts to discover the version of a (known) web application by comparing static files

Set of bash scripts for blind SQL injection attacks.

Simple script to automate brutforcing blind sql injection vulnerabilities.

Exploit Time-based blind-SQL injection in HTTP-Headers (MySQL/MariaDB).

BlobRunner is a simple tool to quickly debug shellcode extracted during malware analysis.

BlobRunner is a simple tool to quickly debug shellcode extracted during malware analysis.

Community-contributed blocklist of IP addresses involved in attacks and malicious activity.

Bitcoin payment API and OSINT platform providing address monitoring, wallet balance tracking, and transaction alerts for developers and enterprises.

Multichain EVM blockchain explorer aggregating 25+ EVM-compatible chains with portfolio tracking, real-time data, and in-depth analytics.

BloodBash is a powerful standalone BloodHound / SharpHound + AzureHound JSON analyzer written in Python

Six Degrees of Domain Admin, BloodHound CE

Active Directory security tool for reconnaissance and attacking AD environments (Community Edition)

BloodHound-CE ingestor in Python.

Python based ingestor for BloodHound CE

Command-line interface for BloodHound v5.

Import data into BloodHound for analyzing active directory trust relationships

BloodHound ingestor in Python.

Python data collector for Bloodhound legcacy (v4)

A tool for BloodHounding on Windows machines without .NET or Powershell installed

Ingestor for BloodHound, based on Impacket (Python 3)

Active Directory privilege escalation framework

Bluetooth device discovery service

A GPL VoIP/UC vulnerability scanner.

An implementation of the bluebug technique which was discovered by Martin Herfurt.

Web reputation filtering service rating URLs with 50+ language support. Processes 180+ million rating requests daily with Dynamic Link Analysis for…

A Bluetooth penetration testing suite.

A tool that can generate an essentially unlimited number of phantom Bluetooth devices.

Bluetooth scanner and logger

A Bluetooth Honeypot written in Java, it runs on Linux.

A perl tool to identify Bluetooth devices.

Simple Bash script to locate Bluetooth devices

A Bluetooth Device Scanner.

Bluesnarfing utility

Free, lightweight Android emulator for desktop. Includes built-in forensic capabilities for data extraction from installed apps.

Bluetooth tools and daemons

Convert shellcode into different formats.

Bluetooth device and service discovery tool that can be used for security assessment and penetration testing.

Recon, Subdomain Bruting, Zone Transfers.

Recon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.

Tool for copying largely sparse files using information from a block map file.

RDP Bitmap Cache parser.

A distributed password cracker package.

A simple detector of BOF vulnerabilities by source-code-level check.

Bolt crawls the target website to the specified depth and stores all the HTML forms found in a database for further processing.

The DDoS Botnet Simulator.

boofuzz

to convert linear PDF documents into booklets, and vice-versa

A Suite of Tools written in Python for wireless auditing and security testing.

A collection of generic, C++ Bloom Filter classes developed for the Boost C++ Libraries.

Generate smart and powerful wordlists

A container analysis and exploitation tool for pentesters and engineers.

A framework intended to aid those developing exploits.

A tool for studying JavaScript malware.

Simplify building modern BPF programs

Download BloudHound query lists, deduplicate entries and merge them in one file.

Mass SNMP scanner

A Bluetooth Tracking Utility.

A smarter web fuzzing tool that combines local LLM models and ffuf to optimize directory and file discovery.

A static analysis security vulnerability scanner for Ruby on Rails applications.

to burn CD/DVDs

Privacy-focused search engine with independent index. Offers Goggles for custom search result ranking. First search API with zero data retention…

BRB Publications portal linking to public records sources across US. Reference guide with 20K+ government agencies and vendors.

Community-powered blockchain analytics platform with fund-flow visualization (PathFinder), address investigation, and crypto transaction network…

Scrape employee names from search engine LinkedIn profiles. Convert employee names to a specified username format.

An interactive reference tool to help security professionals utilize useful payloads and commands.

Retrieves the browse list ; the output list contains computer names, and the roles they play in the network.

Browser Fuzzer 3

Brute-force attack that supports multiple protocols and services

Brute-Force attack tool for Gmail Hotmail Twitter Facebook Netflix.

A tool designed for auditing the cryptography container security in PKCS12 format.

Try to find a password of a LUKS encrypted volume

Try to find the passphrase for files encrypted with OpenSSL

Try to find the password of an encrypted wallet file

Penetration testing tool that automates testing accounts to the site's login page.

Network Forensic Analysis Tool (NFAT)

Bruteforcing from various scanner output

A simple sshd password bruteforcer using a wordlist, it's very fast for internal networks. It's multithreads.

Automatically brute force all services running on a target.

Cross-Site Scripting Bruteforcer.

One of the fastest, most flexible remote password crackers you can get your hands on.

Bruteforce XOR'ed strings to find those that are English words.

Tools for building and applying patches to binary files.

Blind SQL Injection Brute Forcer.

Blind SQL injection exploitation tool written in ruby.

Bluetooth stack smasher / fuzzer.

Bluetooth audit

The world's first Bluetooth Pass phrase (PIN) bruteforce tool. Bruteforces the Passkey and the Link key from captured Pa

Bluetooth Low Energy Swiss-army knife.

Man in the Middle analysis tool for Bluetooth.

Ncurses-based scanner for Bluetooth devices

Open-source cloud bucket discovery utility with limited current documentation and unclear maintenance signals.

Download and use custom hosts sources to build /etc/hosts

Technology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.

Extracts information without parsing filesystem

Implementation of the WPS brute force attack, written in C

Swipe-based dating app with women-first messaging rules and location-based recommendations.

A closed loop, high-performance, general purpose protocol-blind fuzzer for C programs.

Curated list of temporary email service domains with API references and detection library implementations across multiple languages.

Investigate website interactions using this web proxy.

Industry-standard web application security testing platform for manual and automated vulnerability assessment.

burpsuite

Platform for security testing of web applications

Find emails of a person and return info associated with them.

Provide an open source framework for automated botnet monitoring.

US company database providing business profiles, SIC codes, employee counts, and contact information for millions of US businesses.

A display-oriented editor for binary files operate like "vi" editor.

Automates password cracking tasks using optimized dictionaries and mangling rules.

A Swiss Army knife for bypassing web application firewalls and filters.

Firewall bypass script based on DNS history records.

Java 8+ Jar & Android APK Reverse Engineering Suite

A lightweight user-friendly Java/Android Bytecode Viewer, Decompiler and more.

Generate byte-usage-histograms for all types of files with a focus on PE files.

Vulnerability scanner and information gatherer for the Concrete5 CMS.

Cisco password type encryptor and decryptor.

Comprehensive California government salary database covering state, local, schools, universities, and special districts.

Microsoft Cabinet file unpacker

The hidden RDP client recorder

Web cache lookup utility that surfaces archived and cached versions of a target page from multiple sources.

Simple cache-checking service that retrieves copies of pages from search engine and archive caches.

A tool that demonstrates how to recover cache entry information: username and hashed password (called MSCASH).

Command-line WebDAV client

Java bytecode editor & decompiler.

The framework for AI Security.

Security auditing toolkit (desktop)

Security auditing toolkit (CLI)

Intercepting proxy to replay, inject, scan and fuzz HTTP requests.

Scalable Automated Adversary Emulation Platform

Networking and network security solution for Kubernetes

Caller ID and number-validation utility for checking formatting and telecom metadata responses.

Dictionary and learner reference platform with translation support across multiple language pairs.

Hacks its way into RTSP videosurveillance cameras.

Mobile visual search app that identifies objects, landmarks, and products from photos.

A camera exploitation tool that allows to disclosure network camera admin password.

A tool which will analyze the CAM table of Cisco switches to look for anamolies.

Linux-CAN / SocketCAN user space applications.

Security analysis toolkit for proprietary car protocols.

Maltego rapid transform development and execution framework.

Dashboard Finder.

A python-based Web Content Discovery Tool.

Framework for black-box CAN network analysis.

The FLARE team's open-source tool to identify capabilities in executable files.

Web interface for exploring and understanding capa results

Capture, fuzz and intercept web traffic.

Lightweight multi-architecture disassembly framework - command line tool

Malicious HTTP traffic explorer tool.

OSINT tool for estimating when a web page was written.

OSINT Tool to find Breached Credit Cards Information.

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, token.

AI vehicle image recognition platform that identifies make/model/generation from submitted photos.

International VIN and registration decoder with vehicle history reporting across accident, theft, and ownership datasets.

Sensibilise manufacturers of carkits and other Bluetooth appliances without display and keyboard for the possible securi

The little brother to Maltego without transforms, but combines graph and link analysis to examine links between manually

Harvard-hosted comprehensive free legal database with 6M+ court opinions. Digitized legal decisions from centuries of US case law.

Filter your wordlist according to the specified password policy.

An application to query the canary.pw data set for leaked data.

For phishing and corporate espionage.

Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.

Creative Commons search portal for discovering openly licensed and public-domain images.

Retrieves from the CommonCrawl data set unique subdomains for a given domain name.

Secure encryption and decryption of files and streams

Cisco discovery protocol sniffer.

A tool to perform security testing against the HDMI CEC (Consumer Electronics Control) and HEC (HDMI Ethernet Channel) p

Internet-wide scanner and search engine for hosts, certificates, and services.

Community edition nuclei templates.

Cold boot & DMA protection

A Panic button for protection against cold boot attacks

Scrape domain names from SSL certificates of arbitrary hosts.

Tool to crawl the graph of certificate Alternate Names

CLI tool that crawls SSL certificates via Certificate Transparency logs to create a directed graph of domain relationships. Supports multiple drivers…

Tool to ask certificates to ADCS and discover templates

Active Directory Certificate Services enumeration and abuse.

Tool for attacking AD Certificate Services

Fast Certificate Transparency log search tool using Clickhouse for sub-second queries. Discover all certificates issued to a domain, including…

Dump NTDS remotely without DRSUAPI: using golden certificate and UnPAC the hash.

Custom word list generator

Ruby-based web spider that generates custom wordlists by crawling target websites to specified depth and extracting unique words for password…

CeWL alternative in Python

A C program flow analyzer.

Java decompiler.

Rapidly search and hunt through Windows forensic artefacts

A tool for evading Proxy categorisation.

Official repository of ChameleonMini, a freely programmable, portable tool for NFC security analysis that can emulate an

Open-source change-monitoring system for tracking updates on websites over time.

Open-source website change detection platform with both self-hosted and hosted options. Supports visual diffs, notifications, and automation…

Default credential scanner

Tool that generates a PHP capable of run a custom binary (like a meterpreter) or a bash script (p.e. reverse shell) bypa

A Go client to communicate with Chaos dataset API from ProjectDiscovery.

Go client to communicate with Chaos dataset API.

An information gathering tool and dns / whois / web server scanner

Trace network sessions and export it to html format

A tool for parsing and decrypting MS-CHAPv2 network handshakes.

Commercial HTTP/HTTPS proxy for traffic analysis. Captures and analyzes network traffic between apps and servers.

The only cheat sheet you need.

Debian OpenSSL weak client Diffie-Hellman Exchange checker.

Checks the validity of an International Bank Account Number (IBAN).

Command-line utility for checking local machine IP address and network connectivity.

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images a

Infrastructure-as-code security scanner that checks Terraform, CloudFormation, Kubernetes, and other cloud configs against policy rules.

Python wrapper script for checksec.sh from paX.

Preview service for shortened URLs with destination and threat-check context.

Decode and otherwise analyze data using this command-line tool and Python library.

Hierarchical note taking application

Python-based interactive assembler/disassembler CLI, powered byKeystone/Capstone.

Platform Security Assessment Framework.