Cybersecurity tools
Tools for OSINT, networking, cryptography, web and application security, and malware analysis.
| Tool | What it does | Cost |
|---|---|---|
| Bitwarden Password Strength Tester Cryptography | Rates a password and estimates how long it would take to brute force, with the zxcvbn engine doing the work underneath. The check runs in the browser and nothing is sent anywhere. | Free |
| CrackStation* Cryptography | Looks up unsalted MD5, SHA1, and NTLM hashes against a precomputed table and hands back the plaintext in an instant when it has a match. Salted hashes are beyond it, but it is quick when it works. | Free |
| CyberChef Cryptography | GCHQ's browser-based workbench for encoding, decoding, encryption, and data analysis. You chain operations together like a recipe, and the whole thing runs locally in the page. | Free |
| dCode Cryptography | A sprawling collection of cipher solvers, decoders, and calculators that spans classical ciphers through to modern schemes. Its identifier alone recognises more than 200 ciphers automatically. | Free |
| hashcat* Cryptography | Cracks password hashes on the GPU, with more than 350 hash modes and a rule engine for mangling wordlists. Built for raw speed against fast hashes. | Free |
| hashes.com* Cryptography | A hash lookup backed by plaintext that crackers have recovered and pooled over many years. It will also tell you what type a hash is and take bulk submissions. | Freemium |
| hashID Cryptography | A small Python tool that recognises more than 220 hash types by regular expression. Feed it a single hash, a file, or a whole directory and it names the format and the cracking modes that fit. | Free |
| John the Ripper* Cryptography | Audits passwords by cracking their hashes, detecting the format on its own and supporting hundreds of them in the jumbo build. Its companion 2john helpers pull crackable hashes out of ZIP archives, SSH keys, and the like. | Free |
| jwt_tool* Cryptography | Tests JSON Web Tokens against the known attacks: alg=none, key confusion, weak signing secrets. It will also forge, tamper with, and fuzz the claims during an assessment. | Free |
| jwt.io Cryptography | Decodes a JSON Web Token in the browser so you can read its claims and check the signature against a secret or key. The decoding happens locally, on your own machine. | Free |
| Name-That-Hash Cryptography | Identifies a hash from its shape, covering MD5, SHA256, and 300 or so other formats, and ranks the guesses by how common they are. For each one it prints the matching hashcat and John modes. | Free |
| OpenSSL Cryptography | The toolkit and library that underpins much of the TLS world. From the command line you can generate keys, inspect certificates, and convert between formats like PEM and DER. | Free |
| Qualys SSL Labs Server Test Cryptography | Runs a thorough check of a public web server's TLS setup and grades it from A+ to F. It weighs protocol support, cipher suites, and the certificate chain. | Free |
| SSLShopper SSL Checker Cryptography | Connects to a server and reports on how its certificate is installed: expiry, hostname match, and any missing intermediate certificates. A quick way to diagnose the usual deployment mistakes. | Free |
| SSLyze Cryptography | A fast TLS scanner and Python library for auditing certificates, cipher suites, and known flaws. JSON output and library access make it a fit for CI or for scanning a large fleet. | Free |
| testssl.sh Cryptography | Checks a server's TLS support, cipher suites, and known crypto weaknesses from the command line, on any port. It runs locally, so nothing leaves your machine, and it copes with STARTTLS services like SMTP and IMAP. | Free |
| zxcvbn Cryptography | Dropbox's password strength estimator, which scores a password by spotting common words, patterns, and keyboard runs rather than counting character types. It returns a guess count and an estimated time to crack. | Free |
| AbuseIPDB Malware & Forensics | A community database of IP addresses reported for scanning, brute forcing, spam, and other abuse. Check an address against it, or report a new offender, through the site or the API. | Freemium |
| ANY.RUN Malware & Forensics | An interactive online sandbox: detonate a sample and click around it in real time while it records the behaviour. Reach for it to triage a file or a suspect link without leaving the browser. | Freemium |
| Autopsy Malware & Forensics | A disk forensics platform built on The Sleuth Kit, with timeline analysis, keyword search, file carving, and web history recovery. A frequent pick for working through a disk image. | Free |
| capa Malware & Forensics | A Mandiant tool that reads a binary's disassembly and tells you what it is capable of: persistence, injection, network activity, and so on. It gives you a quick read on a sample before you commit to full reversing. | Free |
| Ghidra Malware & Forensics | The NSA's open-source reverse engineering suite, with a capable decompiler, disassembler, and scripting. It runs on Windows, Linux, and macOS, and it is what a lot of people now learn on. | Free |
| Hybrid Analysis Malware & Forensics | A free analysis service running CrowdStrike's Falcon Sandbox, mixing static and dynamic techniques. Submit a sample and you get back a verdict, extracted indicators, and a full report to download. | Freemium |
| Joe Sandbox Malware & Forensics | Detonates samples automatically and writes up detailed behaviour reports across Windows, Linux, macOS, Android, and iOS. The depth pays off most on evasive and targeted malware. | Freemium |
| MalwareBazaar* Malware & Forensics | An abuse.ch repository where researchers trade live malware samples, indexed by hash, family, and tag. These are real binaries, so treat anything you pull from it as dangerous. | Free |
| MISP Malware & Forensics | A platform for storing and sharing threat indicators and incident data between teams and communities. It handles correlation, tagging, and automated exchange of feeds. | Free |
| PEStudio Malware & Forensics | Inspects a Windows executable statically, flagging suspicious imports, strings, and resources without ever running it. A sensible first stop when you are triaging a sample. | Freemium |
| ThreatFox Malware & Forensics | An abuse.ch and Spamhaus project for sharing indicators of compromise tied to malware, searchable by family and indicator type. It exposes community APIs and exportable IOC feeds. | Free |
| URLhaus Malware & Forensics | An abuse.ch database of URLs caught serving malware, with search, submission, and downloadable feeds. Often plumbed straight into a blocklist as a source. | Free |
| urlscan.io Malware & Forensics | Opens a URL in an instrumented browser and records the requests, redirects, page DOM, and a screenshot. Because past scans stay searchable, you can often tie a site back to a known campaign. | Freemium |
| Velociraptor Malware & Forensics | Queries endpoints for forensic artefacts before, during, and after an incident, all from one console. It is built to collect across a lot of machines at once. | Free |
| VirusTotal Malware & Forensics | Runs a file, URL, domain, or hash past dozens of antivirus engines at once and shares back what they say. Usually the first thing an analyst checks to see if something is already known to be bad. | Freemium |
| Volatility Malware & Forensics | Pulls artefacts out of a RAM dump, from running processes and network connections to injected code. For memory forensics it is the tool most analysts turn to. | Free |
| YARA Malware & Forensics | Classifies files using rules written from strings, byte patterns, and conditions. It is how malware family signatures get written and shared between teams. | Free |
| Arkime Networking | Stores full network traffic as indexed PCAP and gives you a web interface to search it and replay sessions. Built to scale across a cluster when you need to keep weeks of capture. | Free |
| bettercap* Networking | Handles reconnaissance and machine-in-the-middle attacks across WiFi, Bluetooth Low Energy, and both IPv4 and IPv6. ARP, DNS, and DHCP spoofing sit alongside live traffic interception. | Free |
| dnsx* Networking | Runs bulk DNS queries and probes across many records and resolvers at speed. It copes with wildcards and brute-force resolution, so it drops neatly into a recon workflow. | Free |
| iperf3 Networking | Measures the real bandwidth between two hosts over TCP, UDP, or SCTP and reports throughput, loss, and jitter. JSON output makes it simple to script into automated tests. | Free |
| masscan* Networking | Sweeps huge address ranges at very high packet rates by running its own TCP/IP stack. The command syntax deliberately echoes Nmap, so it is easy to pick up if you already know that. | Free |
| mtr Networking | Combines traceroute and ping into one live view, showing loss and latency at every hop. When a connection is flaky, this is how you find the hop where it falls apart. | Free |
| naabu* Networking | A Go port scanner built for speed without giving up reliable results. It takes hosts, CIDRs, and ASNs on stdin, which makes it easy to wire into a recon pipeline. | Free |
| NetworkMiner Networking | Pulls files, images, credentials, and certificates out of a PCAP and builds an inventory of the hosts it saw. Because it only ever reads captures, it never puts a packet on the wire. | Freemium |
| Nmap* Networking | The scanner most people learn first: it discovers live hosts, maps open ports, and fingerprints services and operating systems. A scripting engine pushes it into vulnerability checks and deeper enumeration. | Free |
| Scapy* Networking | A Python library and shell for building, sending, and picking apart packets across a huge range of protocols. Reach for it when you need a custom probe or want to see how something handles malformed traffic. | Free |
| Security Onion Networking | Bundles Suricata, Zeek, and the Elastic Stack into one free platform for monitoring, threat hunting, and log management. Install it and you have a working sensor and analyst console without assembling the pieces yourself. | Freemium |
| Suricata Networking | Runs as an IDS, an inline IPS, or a passive monitor, inspecting packets deeply across multiple threads. Along the way it matches signatures and extracts protocol and file metadata. | Free |
| tcpdump Networking | Captures packets from the command line, which makes it the obvious choice on a headless server or for a quick filtered grab. Save the output and open it in Wireshark when you want a closer look. | Free |
| Wireshark Networking | The graphical packet analyser most analysts grow up on, with dissectors for hundreds of protocols and filters to cut through the noise. It reads live traffic or a saved PCAP file just the same. | Free |
| Zeek Networking | Watches network traffic and turns it into structured logs of connections, files, and protocol events. Detection runs through its own scripting language rather than a fixed signature set, so it leans towards spotting behaviour. | Free |
| ZMap* Networking | Scans the entire IPv4 internet with a single packet per host, fast enough to finish in under an hour. Companion tools ZGrab and ZDNS handle the application-layer and DNS follow-up. | Free |
| Censys Search OSINT | Holds scan data on hosts, services, and TLS certificates across the whole internet. Investigators use it to map a target's external footprint and pivot from one certificate or banner to related infrastructure. | Freemium |
| crt.sh OSINT | Searches certificate transparency logs to surface subdomains and hostnames from the TLS certificates a domain has issued. It often turns up internal or forgotten hosts you would not find any other way. | Free |
| DeHashed* OSINT | Searches breach and leak datasets and returns the actual records: usernames, passwords, names, phone numbers. Where Have I Been Pwned gives a yes or no, this shows you what was exposed. | Paid |
| ExifTool OSINT | Reads and edits the metadata buried in images, audio, and video, from EXIF and GPS coordinates to XMP tags. If a photo carries a capture date, camera model, or location, this gets it out. | Free |
| Have I Been Pwned OSINT | Tells you whether an email address or password has turned up in a known breach. Most credential investigations start here before going any deeper. | Freemium |
| Holehe* OSINT | Works out which of more than a hundred sites an email address is registered on by quietly probing their password-reset and signup forms. The account holder never gets a notification. | Free |
| Hunter.io OSINT | Finds the email addresses behind a domain and works out the pattern an organisation uses, such as first.last. Recruiters and testers both use it to build a list of staff contacts. | Freemium |
| Hurricane Electric BGP Toolkit OSINT | Free lookups for ASNs, IP prefixes, and BGP routing. Use it to work out which IP ranges and networks actually belong to a company or its provider. | Free |
| Intelligence X OSINT | Indexes the surface web, darknet, paste sites, whois history, and leaked data, then lets you search it by domain, email, IP, or crypto address. Old snapshots stay searchable long after the original page is gone. | Freemium |
| Maigret OSINT | Like Sherlock, but it goes a step further: as well as finding accounts from a username, it scrapes the profile pages for names, locations, and other linked identifiers. | Free |
| Maltego OSINT | Maps the links between people, emails, domains, and infrastructure as a visual graph. When an investigation has too many moving parts to hold in your head, this is where you lay them out. | Freemium |
| OWASP Amass* OSINT | Maps an organisation's subdomains and external assets by pulling from certificate logs, passive DNS, and a long list of other sources. One of the more thorough options when you need full coverage of a domain. | Free |
| Sherlock OSINT | Takes a username and checks for it across hundreds of social and web platforms. A quick way to see where someone shows up online before you start digging by hand. | Free |
| Shodan OSINT | Searches the internet for connected devices and indexes their open ports, banners, and software. You can hunt for exposed databases, webcams, or industrial kit by product, port, or location. | Freemium |
| SpiderFoot OSINT | Points dozens of OSINT modules at a target, whether an IP, domain, email, or name, and stitches the findings together. Set it running and it pulls from hundreds of sources with little hand-holding. | Freemium |
| theHarvester* OSINT | Pulls emails, subdomains, hostnames, and staff names for a domain out of search engines and other public sources. A fast way to rough out what an organisation exposes to the world. | Free |
| WhatsMyName OSINT | Checks a username against hundreds of sites from the browser, drawing on the same community dataset many account-hunting tools rely on. Reach for it when you want a quick look without installing anything. | Free |
| Yandex Images OSINT | A reverse image search that tends to beat Google on faces, landmarks, and anything from Eastern Europe. It is a first port of call for tracking down where a photo came from or where it was taken. | Free |
| Burp Suite* Web & AppSec | The intercepting proxy most web testers live in. The free Community edition covers manual work, while Professional adds an automated scanner and more. | Freemium |
| feroxbuster* Web & AppSec | Recursive content discovery written in Rust, with recursion and resilient retries built in rather than bolted on. It keeps going deep where simpler tools stop at the first level. | Free |
| ffuf* Web & AppSec | A quick Go fuzzer for the web that handles directory discovery, virtual host enumeration, and fuzzing of parameters, headers, and POST bodies. Speed is the draw. | Free |
| gobuster* Web & AppSec | Brute-forces directories, files, DNS subdomains, and virtual hosts. Plenty of testers fire it off as a first sweep of a target. | Free |
| GTFOBins* Web & AppSec | A lookup of Unix binaries that can be twisted into breaking out of restricted shells, escalating privileges, or moving files around. Each entry spells out which functions a binary can be abused for. | Free |
| httpx* Web & AppSec | Probes a list of hosts to find which are serving live web servers, reporting status codes, page titles, technologies, and TLS details. Fast enough to throw a large list at it. | Free |
| Katana* Web & AppSec | Crawls and spiders a site in either a plain or a headless browser mode. The headless mode parses JavaScript, so it finds endpoints that a basic crawler walks straight past. | Free |
| LOLBAS* Web & AppSec | The Windows counterpart to GTFOBins: legitimate binaries, scripts, and libraries that attackers lean on to stay quiet. Every technique is mapped to MITRE ATT&CK. | Free |
| Nikto* Web & AppSec | An old web server scanner that hunts for risky files, stale software, and common misconfigurations. It is loud and makes no attempt to hide, trading stealth for coverage. | Free |
| Nuclei* Web & AppSec | Scans for vulnerabilities using community-written YAML templates, one per check. The output stays predictable enough to run at scale and to gate a CI build. | Free |
| OWASP ZAP* Web & AppSec | A free, open-source web scanner with an intercepting proxy, a spider, and an active scanner. An automation framework and API let it run inside a CI pipeline. | Free |
| PayloadsAllTheThings* Web & AppSec | A huge reference of payloads and bypass tricks, sorted by vulnerability class. Each section pairs the technique with payloads you can copy straight out. | Free |
| Postman Web & AppSec | An API client for building, sending, and inspecting requests across REST, GraphQL, and more. Testers use it to explore an API and hand-craft tampered requests. | Freemium |
| Reverse Shell Generator* Web & AppSec | Builds reverse and bind shell one-liners for whatever language or shell you are stuck with, and gives you the matching listener command. Encoding options help when the payload has to survive an awkward context. | Free |
| SecLists* Web & AppSec | The wordlists almost everyone tests with, gathered in one place: usernames, passwords, directory names, and fuzzing payloads. Most discovery and brute-force tools point at it by default. | Free |
| SQLMap* Web & AppSec | Finds SQL injection and then exploits it for you, fingerprinting the database, dumping data, and in some setups taking over the host. How much it automates is the whole point. | Free |
| subfinder* Web & AppSec | Enumerates subdomains passively by querying a long list of online sources. Usually the opening move when you start mapping an external attack surface. | Free |
| WPScan* Web & AppSec | A WordPress-focused scanner that enumerates plugins, themes, and users and checks them against a vulnerability database. That database is what makes its findings worth acting on. | Freemium |
* Offensive or dual-use. Only run these against systems you have permission to test.