Tools

In-depth attack surface mapping. OWASP tool for network asset discovery using OSINT and active techniques.

Fast subdomain finder from Tomnomnom. Finds domains related to a target from various sources.

Domain name permutation engine to detect typosquatting, phishing, and corporate espionage. Generates and checks variations of domain names.

SAST tool for detecting hardcoded secrets (API keys, passwords, tokens) in git repos. Fast and configurable with built-in and custom rules.

Check if an email address is registered on 120+ online platforms including Twitter, Instagram, GitHub and more.

Fast and multi-purpose HTTP toolkit. Probes for alive hosts, tech stack, status codes, and more.

Collect user information by username from 3000+ sites. Profiles social network footprint with detailed metadata extraction.

Ultra-fast TCP port scanner. Scans the entire internet in under 6 minutes. Transmit-only design with custom TCP/IP stack for maximum speed.

High-performance DNS stub resolver. Resolves millions of domains per second for bulk operations.

Fast port scanner written in Go. Designed for reliability and speed with SYN/TCP/CONNECT scan modes.

Security assessment tool for AWS, GCP, and Azure. Performs 300+ checks for CIS benchmarks, GDPR, HIPAA, and custom compliance frameworks.

Modern port scanner written in Rust. Scans all 65k ports in 3 seconds then feeds results to nmap for service detection.

Multi-cloud security auditing tool. Gathers data from AWS, GCP, Azure, Alibaba Cloud, and Oracle Cloud to identify misconfigurations and risks.

Python tool to discover sensitive data (API keys, tokens, passwords) in JavaScript files via regex patterns.

Hunt down social media accounts by username across 400+ platforms including Twitter, GitHub, Instagram, LinkedIn and more.

Automated OSINT framework with 200+ modules. Correlates data from DNS, WHOIS, social media, threat intelligence, and more.

Passive subdomain discovery tool. Finds valid subdomains using online sources like crt.sh, SecurityTrails, and more.

Subdomain enumeration tool using search engines (Google, Bing, Yahoo, DNSDumpster, VirusTotal) and brute-force.

OSINT tool for gathering emails, subdomains, hosts, employee names, open ports from public sources like search engines and DNS.

Find credentials and secrets in git repos, S3 buckets, and filesystems. Verifies secrets against APIs to eliminate false positives.

HTTP parameter discovery suite. Finds hidden GET/POST parameters using wordlists and multi-threaded probing.

Web path brute-force scanner. Python-based directory and file enumeration tool.

Fast, simple, recursive content discovery tool written in Rust.

Fast web fuzzer written in Go. Directory/file discovery, vhost discovery, and parameter fuzzing.

Directory/file, DNS, and vhost brute-forcing tool written in Go.

Fast web spider for web application recon. Discovers URLs from sitemaps, JavaScript, robots.txt, forms, and external sources.

Fast and configurable web crawler and spider from ProjectDiscovery. Supports headless mode, JS rendering, and scope control.

Interactive man-in-the-middle HTTP/HTTPS proxy. Intercept, inspect, modify, and replay web traffic. Scriptable via Python addons.

Network exploration and security auditing utility. Port scanning, service detection, OS fingerprinting, and NSE scripts.

Fast and customizable vulnerability scanner based on YAML templates. Community-driven template library.

Free command-line tool to check SSL/TLS encryption. Tests ciphers, protocols, vulnerabilities (BEAST, POODLE, Heartbleed) and certificate issues.

All-in-one security scanner for containers, filesystems, git repos, and cloud configs. Detects CVEs, misconfigurations, secrets, and generates SBOMs.

Web Application Firewall detection tool. Identifies WAF products protecting a target.

Web technology fingerprinting tool. Identifies CMS, web servers, JavaScript frameworks, and more.

Multi-use bash menu-driven wireless auditing framework. Handshake capture, evil twin attacks, PMKID attacks, and captive portal attacks in one script.

Swiss army knife for network attacks and monitoring. ARP spoofing, DNS spoofing, HTTP/HTTPS MITM, WiFi scanning, BLE scanning, and scriptable modules.

Active Directory attack path mapping. Identifies privilege escalation paths and trust relationships.

Web application security testing platform. Proxy, scanner, intruder, repeater, and more.

Tool for enumerating and exploiting Active Directory Certificate Services (AD CS). Finds vulnerable certificate templates for privilege escalation.

Fast TCP/UDP tunnel over HTTP, secured with SSH. Enables port forwarding and SOCKS proxy through firewalls and restricted networks.

Automated OS command injection and exploitation tool.

Post-exploitation lateral movement tool. SMB, WinRM, MSSQL, and Active Directory enumeration.

Powerful open-source XSS scanner and exploitation tool. Parameter analysis, DOM XSS detection, blind XSS support, and custom payload injection.

WinRM shell for pentesting Windows targets. Supports pass-the-hash, pass-the-ticket, Kerberos authentication, file upload/download, and PowerShell remoting.

MITM attack framework for phishing credentials while bypassing 2FA. Proxies target website to capture session cookies.

Advanced password recovery tool. GPU-accelerated hash cracking with support for 300+ hash types.

Modern C2 framework with an advanced GUI and extensible shellcode loaders. Supports multiple agents and post-exploitation modules.

Capture WiFi packets and PMKID hashes from WPA/WPA2 networks. Designed for offline WPA password cracking with hcxtools and hashcat.

Fast and flexible online password brute-forcing tool. Supports numerous protocols.

Network protocols implementation. SMB, Kerberos, MSRPC, WMI, DCE/RPC for lateral movement.

John the Ripper password cracker. Supports many hash formats and attack modes.

Kerberos brute-force and user enumeration tool. Performs AS-REP roasting, password spraying, and user enumeration against Active Directory.

Advanced tunneling and pivoting tool using TUN interfaces. No SOCKS proxy needed — agents create real network interfaces for seamless pivoting.

Penetration testing framework. Exploit development, payload generation, post-exploitation, and pivoting.

Collaborative multi-user C2 framework with a web UI. Plugin-based architecture supporting multiple agents (Athena, Apollo, Merlin) and C2 profiles.

Network execution tool — successor to CrackMapExec for SMB, WinRM, LDAP, MSSQL, SSH. Mass credential testing and lateral movement automation.

Web server vulnerability scanner. Tests for dangerous files, outdated software, and server misconfigurations.

Automated NoSQL database exploitation tool. Tests for NoSQL injection vulnerabilities in MongoDB, Redis, CouchDB, and other NoSQL systems.

OWASP Zed Attack Proxy. Free, open-source web application security scanner.

AWS exploitation framework. Post-exploitation and persistence in AWS environments — privilege escalation, data exfiltration, and lateral movement.

Privilege Escalation Awesome Scripts (LinPEAS/WinPEAS). Automated local privilege escalation enumeration for Linux, Windows, and macOS.

Netcat replacement with persistence-focused post-exploitation. Handles shell stabilization, file upload/download, and automated enumeration on connection.

CTF exploitation framework. Python library for exploit development, binary exploitation, and crypto challenges.

LLMNR/NBT-NS/mDNS poisoner. Captures NTLM hashes from network traffic.

Exploitation framework for embedded devices and routers. Modules for exploiting CVEs in Cisco, Huawei, D-Link, TP-Link, and other network devices.

Social Engineering Toolkit. Comprehensive suite for social engineering attacks: spear-phishing, website cloning, credential harvesting, and payload delivery.

Open-source cross-platform C2 framework by BishopFox. Generates implants, manages sessions, and supports MTLS/HTTP/DNS/WireGuard C2 channels.

Slow HTTP denial-of-service attack tool. Keeps many connections open to the target web server simultaneously by sending partial HTTP requests.

Automatic SQL injection and database takeover tool. Detects and exploits SQL injection flaws.

Automated WiFi phishing framework. Creates rogue access points with realistic captive portals to capture WPA credentials via social engineering.

Automated wireless auditing tool. Attacks WEP, WPA, WPA2, and WPS networks. Captures handshakes and cracks with built-in Hashcat/Aircrack-ng support.

Advanced XSS detection suite with intelligent payload generation, context analysis, and WAF bypass capabilities.

Append lines to a file only if they don't already exist. Perfect for deduplication in pipelines.

Digital forensics platform. Disk image analysis, file recovery, timeline generation.

Common User Passwords Profiler. Generates targeted password lists based on personal information gathered through social engineering or OSINT.

Command-line tool for transferring data with URL syntax. Essential for HTTP testing and API interaction.

Pattern matching utility. Essential for filtering and searching output from security tools.

Hash type identifier. Detects hash algorithms from a given hash string and provides hashcat/john mode numbers.

Command-line JSON processor. Essential for parsing JSON output from security tools.

Send notifications to multiple platforms (Discord, Slack, Telegram, etc.) from pipelines.

Sort lines of text. Essential for organizing output from security tools.

Remove duplicate adjacent lines. Usually used after sort for deduplication.

Memory forensics framework. Analyzes RAM dumps for malware, artifacts, and incident response.

Network protocol analyzer. Deep packet inspection, traffic analysis, and protocol decoding.

Pattern matching for malware detection. Signature-based malware identification.

Firmware analysis and embedded file extraction. Identifies and extracts files from binary images including file systems, compression artifacts, and bootloaders.

Fast digital forensics tool that extracts features from disk images without parsing the file system. Extracts emails, URLs, credit cards, phone numbers, and more.

Metadata extraction from files including images, audio, video, and documents. Essential for OSINT and forensic file analysis.

File carving tool for recovering deleted or hidden files from disk images. Recovers files based on headers, footers, and internal data structures.

Monitor Linux processes without root privileges. Sniffs process creations by watching /proc. Useful for detecting cron jobs, privilege escalation vectors, and scheduled tasks.

Steganography brute-force tool for uncovering hidden data in image files. Supports steghide and other steganography tools.

Steganography tool for hiding data in JPEG, BMP, WAV, and AU files. Password-protected embedding and extraction of secret messages.

Command-line network packet analyzer. Captures and analyzes network traffic. Essential for network forensics and protocol analysis.

Wireshark's command-line interface. Powerful PCAP analysis with protocol dissection, field extraction, and filtering. Scriptable alternative to Wireshark GUI.

Python binary analysis framework. Symbolic execution, concolic testing, CFG recovery, and automated vulnerability discovery. Used for binary CTF challenges and security research.

Free and open-source GUI for radare2. Provides a visual interface for reverse engineering including disassembly view, decompiler (Ghidra plugin), graph view, and scripting.

GNU Project Debugger. Full-featured debugger for C/C++, assembly, and other compiled languages. Core tool for dynamic binary analysis and exploit development.

NSA's open-source reverse engineering framework. Disassembly, decompilation, scripting, and binary analysis for multiple architectures including x86, ARM, MIPS, and more.

Library call tracer. Intercepts and records dynamic library calls made by an executing process. Useful for reversing obfuscated binaries and understanding program behavior.

GDB plugin for exploit development. Provides enhanced commands for heap analysis, ROP gadget search, memory visualization, and CTF/pwn challenge solving on top of GDB.

Open-source portable reverse engineering framework. Disassembly, debugging, hex editing, binary diffing, and scripting via r2pipe. Supports 40+ architectures.

System call tracer. Intercepts all system calls made by a process. Essential for understanding binary I/O behavior, file access, and privilege escalation analysis.

Android Debug Bridge — command-line interface for communicating with Android devices. Essential for mobile pentest: install/pull APKs, logcat, shell access, port forwarding, and device management.

Python tool for reverse engineering Android applications. APK parsing, DEX disassembly, control flow analysis, and taint analysis.

Android APK reverse engineering tool. Decompiles APK resources to near-original form, rebuilds APKs, and handles resource decoding (resources.arsc, XML manifests).

Dynamic instrumentation toolkit for Android, iOS, macOS, Windows, and Linux. Hook native functions, trace APIs, dump memory, bypass SSL pinning, and patch at runtime without source code.

DEX to Java decompiler. Produces Java source code from Android DEX and APK files. Includes a GUI (jadx-gui) for browsing decompiled code, searching strings, and cross-referencing.

Mobile Security Framework — automated all-in-one mobile application security assessment tool. Static and dynamic analysis for Android APK/AAB and iOS IPA. REST API for CI/CD integration.

Runtime mobile exploration toolkit built on Frida. Automates common mobile pentest tasks: SSL pinning bypass, root/jailbreak detection bypass, memory dumping, file system exploration, and class intros