🛠️ Security Tools Reference
A curated list of tools for penetration testing, red teaming, OSINT, defense, mobile testing, and more.
🔐 Web Application Security Testing
- Burp Suite – Comprehensive platform for web vulnerability scanning and penetration testing, includes proxy, repeater, intruder, and more.
- Acunetix – Automated scanner for web apps to detect over 7,000 vulnerabilities including SQLi, XSS.
- EyeWitness – Tool for capturing screenshots of websites, collecting server header info and technologies.
- Mantra – Browser-based security testing framework with pre-loaded extensions for testing.
- OWASP ZAP – Open-source web application security scanner, suitable for both beginners and pros.
- Wafw00f – Detects and identifies Web Application Firewalls (WAFs) in front of web apps.
🌐 Network Scanning and Discovery
- Nmap – Industry standard for port scanning, service fingerprinting, and OS detection.
- Chaos Project Discovery – Large-scale internet scanning and reconnaissance datasets for OSINT.
- Amass – Performs DNS enumeration, network mapping, and attack surface discovery.
- httpx – Fast HTTP probing with support for GET, POST, and TLS detection.
- Masscan – Ultra-fast port scanner, capable of scanning entire internet in minutes.
- Rustscan – Blazingly fast port scanner with modern UI and Nmap integration.
- Angry IP Scanner – Simple and fast IP address and port scanner for all OSes.
- Naabu – Lightweight and fast port scanner focusing on security testing.
- Dnsx – Lightweight and fast port scanner focusing on security testing.
- Wireshark – Network protocol analyzer for deep packet inspection and live traffic analysis.
🏷️ Subdomain Discovery
- Subfinder – Fast passive subdomain enumeration using multiple sources.
- Shuffledns – High-performance DNS brute-forcing tool using massdns.
- Subzy – Checks for subdomain takeover vulnerabilities.
- Subzack – Lightweight subdomain discovery tool using shuffledns and APIs.
- Subjs – Collects JavaScript files from subdomains for further analysis.
- Assetfinder – Searches for subdomains and assets related to a given domain.
🐙 GitHub Recon
- GitDocker – Dumps .git directories from exposed repositories.
- GitGrabber – Monitors GitHub for sensitive info such as keys, tokens.
- TruffleHog – Scans repos for secrets and sensitive keys using entropy and regex checks.
☁️ Get Leaked Buckets
- Lazys3 – Bruteforces S3 buckets using permutations of domain names.
- S3scanner – Scans for open Amazon S3 buckets and lists their contents.
🧪 Vulnerability Testing
- SQLMap – Automated tool for detecting and exploiting SQL injection flaws.
- Nuclei – Customizable vulnerability scanner using templated YAML format.
- Searchsploit – Command-line tool for accessing Exploit-DB offline.
- XSSHunter – Automates detection and exploitation of out-of-band XSS vulnerabilities.
- Metasploit – Powerful exploitation framework for developing and executing payloads.
🔓 Password Cracking
- Hashcat – Advanced password recovery tool supporting GPU acceleration.
- John the Ripper – Classic password cracking tool supporting a wide variety of hash types.
🔍 Information Gathering
- Paramspider – Crawls for URL parameters useful for testing.
- crt.sh – Search engine for certificate transparency logs to find subdomains.
- OpenRedireX – Finds open redirect vulnerabilities.
- ARIN WHOIS – Provides registration details of IPs and ASNs.
- BGP He – BGP routing data lookup by ASN, domain, or IP.
- ViewDNS.info – Aggregates DNS and IP lookup tools.
- WhoXY – WHOIS API with historical data and contact info.
- MXToolbox – DNS, MX, blacklist, and email tools in one.
- Who.is – Simple WHOIS lookup with registrar info.
- Lopseg – WHOIS, ASN, IP and DNS tools.
- IP Address Guide – CIDR calculator and subnetting helper.
💥 Fuzzing
- ffuf – Fast web fuzzer written in Go, ideal for directory and parameter brute-forcing.
🧬 Sensitive Data Discovery
- Secret Finder – Detects sensitive tokens in JavaScript files during recon.
🤖 Automation and Recon
- Katana – Next-gen crawling and spidering tool supporting JS parsing.
- ReconFTW – Automated, all-in-one recon suite using multiple tools and APIs.
🛰️ ASN and CIDR Mapping
- Asnmap – Maps ASN to IP ranges for better asset enumeration.
- Mapcidr – Processes CIDR ranges for inclusion/exclusion in scanning.
🛡️ Defensive Security Tools
- OSSEC – Open-source HIDS for log analysis and threat detection.
- Suricata – High-performance NIDS/NIPS with advanced traffic analysis.
- Snort – Popular real-time packet sniffer and intrusion detection engine.
- Wazuh – Full-featured security monitoring and threat detection platform.
- Security Onion – Linux distro for blue teaming with full packet capture and IDS integration.
💾 Forensics & Memory Analysis
- Volatility – Framework for analyzing memory dumps.
- Autopsy – GUI-based digital forensic tool supporting many file systems.
- Binwalk – Firmware reverse engineering tool for extracting embedded files.
- Redline – Host investigation tool to collect and analyze memory.
- ExifTool – Reads, writes, and edits metadata in image and document files.
🎭 Payload Generation & Obfuscation
- MSFvenom – Payload generation utility from Metasploit.
- Veil – Obfuscates payloads to bypass AV detection.
- TheFatRat – Automated backdoor generator and AV evasion toolkit.
- Shellter – Dynamic shellcode injector for PE files.
🕵️ OSINT Tools
- theHarvester – Collects emails, domains, names from search engines and PGP.
- Maltego – Graph-based OSINT tool for mapping relationships between people, groups, and infrastructure.
- Spiderfoot – OSINT automation with hundreds of modules and integration options.
- Recon-ng – Modular web reconnaissance framework with CLI.
- Sherlock – Hunts down usernames across many social platforms.
📱 Mobile Security Testing
- MobSF – Static and dynamic analysis for Android/iOS apps.
- Frida – Dynamic instrumentation toolkit for tracing and tampering with mobile apps.
- Objection – Runtime mobile exploration, based on Frida, useful for bypassing jailbreak/root detection.
🧠 Wordlists & Dictionaries
- SecLists – Collection of multiple wordlists for usernames, passwords, fuzzing, etc.
- FuzzDB – Attack payloads, predictable resource names, and regexes for testing.
- RockYou.txt – Classic and widely-used password wordlist.
🧰 Useful Utilities
- CyberChef – "The Cyber Swiss Army Knife" – for encoding, decoding, encryption, etc.
- Base64 Decode – Simple web-based Base64 encode/decode utility.
- DnsDumpster – Visual DNS recon tool for mapping a domain’s network.
- HaveIBeenPwned – Check if your email or credentials have been compromised in breaches.