Tools for every side of cybersecurity.

FreemiumWindowsLinuxmacOS

WEB APPLICATION SECURITY

Burp Suite

Intercept web requests and assess applications through controlled security testing workflows.

CLOUD-NATIVE SIEM

Microsoft Sentinel

Collect cloud and endpoint telemetry, correlate detections, and investigate security incidents.

CommercialWeb-basedCloud

FreemiumWindowsLinuxmacOS

SECURITY ANALYTICS

Elastic Security

Investigate events, build detection rules, and hunt across indexed security telemetry.

NETWORK DISCOVERY

Nmap

Discover hosts, enumerate services, and assess network exposure in authorized environments.

VULNERABILITY VALIDATION

Nuclei

Use versioned templates to check systems for known security misconfigurations and exposures.

IDENTITY ATTACK PATHS

BloodHound

Map identity permissions and visualize potential attack paths in directory environments.

DISK FORENSICS

Autopsy

Examine disk images, files, and artifacts during digital forensic investigations.

REVERSE ENGINEERING

Ghidra

Disassemble and decompile software for reverse engineering and malware analysis.

FreemiumWindowsLinuxmacOS

OSINT LINK ANALYSIS

Maltego

Visualize relationships between publicly available entities and investigation findings.

Free & open sourceLinuxWeb-based

THREAT INTEL SHARING

MISP

Structure, correlate, and share threat indicators and related intelligence with teams.

Free & open sourceLinuxWeb-based

THREAT INTEL PLATFORM

OpenCTI

Organize cyber threat intelligence and map relationships among actors, malware, and indicators.

ENDPOINT VISIBILITY

osquery

Query operating-system state with SQL-style queries for fleet visibility and investigations.

WEB SECURITY TESTING

OWASP ZAP

Open-source proxy and scanner for testing web application security during authorized assessments.

Free & open sourceLinuxmacOSCloud

CLOUD POSTURE

Prowler

Assess security configurations and compliance posture across cloud environments.

Free & open sourceLinuxmacOSCloud

MULTI-CLOUD AUDITING

ScoutSuite

Inspect cloud security configurations and surface audit findings across providers.

NETWORK DEFENSE PLATFORM

Security Onion

Integrated platform for network visibility, intrusion detection, log analysis, and threat hunting.

Free & open sourceLinux

INTERNET EXPOSURE SEARCH

Shodan

Explore publicly indexed internet-connected devices and exposed services.

FreemiumWeb-based

NETWORK IDS / IPS

Suricata

Detect suspicious traffic using signatures, protocol inspection, and network event logging.

ENDPOINT INVESTIGATION

Velociraptor

Collect endpoint artifacts and run targeted investigations across systems.

ARTIFACT ENRICHMENT

VirusTotal

Look up files, hashes, domains, and URLs using aggregated security analysis results.

FreemiumWeb-based

MEMORY FORENSICS

Volatility 3

Analyze memory captures to inspect processes, modules, and other volatile system artifacts.

OPEN-SOURCE SIEM / XDR

Wazuh

Monitor endpoints, analyze security events, and assess configuration and file integrity.

MALWARE CLASSIFICATION

YARA

Write pattern-matching rules to identify families and characteristics in suspicious files.

Free & open sourceLinuxmacOS

NETWORK VISIBILITY

Zeek

Produce rich network event logs and support security monitoring and incident investigations.

EDITOR'S SPOTLIGHT

Featured Tools

Three handpicked tools from the directory.

View full directory →

PACKET ANALYSIS

Wireshark

Capture and inspect network packets to troubleshoot protocols and investigate suspicious traffic.

CommercialWindowsLinuxWeb-based

View tool profile →

SIEM / SOC

Splunk Enterprise Security

Analyze security events, build detections, and investigate incidents across diverse log sources.

View tool profile →

PENETRATION TESTING

Metasploit Framework

Open-source framework used to validate vulnerabilities and develop controlled exploit tests.

View tool profile →

EXPLORE BY WORKFLOW

Curated Collections

Discover tools based on the work you are trying to accomplish.

View all collections →

Build a SOC Lab

SIEM, endpoint monitoring, and network visibility for a practical defensive operations stack.

Incident Response

Forensic collection, memory analysis, endpoint triage, and investigation workflows.

Web Application Security

Proxies, scanners, and authorized application-security testing workflows.

Threat Hunting

Threat intelligence, endpoint visibility, detection engineering, and investigation tooling.