Security

Interactive data mining and link analysis tool. Visualize relationships between people, domains, IPs, and infrastructure. Essential for OSINT.

Physical memory acquisition tool for Windows. Captures RAM for forensic analysis. Kernel driver-based, minimal footprint.

Open-source intelligence automation tool. 200+ modules for OSINT collection. Web UI, CLI, correlations, and data visualization.

Sysinternals system monitor. Logs process creation, network connections, file changes, and driver loads. Essential for threat detection.

Pattern matching tool for malware researchers. Create rules to identify and classify malware samples. Used by antivirus engines worldwide.

Active Directory attack path mapping. Reveals hidden relationships in AD environments. Community Edition — free and open source.

Linux audit daemon. Records system calls, file access, authentication events. Foundation for compliance and security monitoring.

Portable operating system that protects against surveillance. Routes everything through Tor. Leaves no trace on the host computer.

Fast web fuzzer written in Go. Fuzz URLs, headers, POST data, and more. Highly customizable with filters, matchers, and output formats.

Free vulnerability scanner from Tenable. Scans up to 16 IPs. Identifies vulnerabilities, misconfigurations, and compliance issues.

Advanced automated malware analysis system. Execute suspicious files in isolated VMs, track API calls, network traffic, and file changes.

Static analysis tool for infrastructure-as-code. Scans Terraform, CloudFormation, Kubernetes, Docker for misconfigurations. 1000+ built-in policies.

AWS and Azure security assessment tool. 300+ checks for compliance, hardening, and best practices. Supports CIS, PCI-DSS, HIPAA, GDPR.

Rapidly search and hunt through Windows forensic artifacts. EVTX logs, MFT, shimcache, and more. Sigma rule compatible.

Email OSINT and breach hunting tool. Check if emails appear in data breaches using multiple APIs and local databases.

Debian-based Linux distribution for digital forensics and penetration testing. Pre-installed with 600+ security tools including Metasploit, Nmap, and Burp Suite.

Locally checks for signs of rootkits. Examines system binaries for rootkit modifications. Quick, lightweight scan.

Microsoft's SBOM generation tool. Creates SPDX-compliant SBOMs for any project. Integrates with build pipelines.

Swiss army knife for WiFi, Bluetooth, and network attacks. ARP spoofing, DNS spoofing, proxy, sniffer, and WiFi module.

Sysinternals tool to verify digital signatures. Check file version, VirusTotal submission, and certificate chain for any file.

Modern WAF written in Go. Compatible with ModSecurity/OWASP CRS rules. Embeddable, fast, and cloud-native.

NSA's software reverse engineering suite. Disassembly, decompilation, scripting, and graphing. Supports dozens of processor architectures.

Fast, simple content discovery tool written in Rust. Forced browsing with recursion, filtering, and auto-calibration.

Simple IOC and YARA scanner. Checks files against known indicators of compromise, suspicious filenames, and YARA rules.