My cybersecurity toolkit
Overview
Ever since I started my journey into the world of cybersecurity, I’ve been compiling a list of resources and tools. It’s my way of keeping track of everything I’m learning and organizing it in a way that makes sense to me. Think of it as my personal cybersecurity knowledge base.
The core principle I use is categorization by team and purpose. This means I first group tools and resources based on who primarily uses them (Red Team, Blue Team, or other security functions) and then, within those groups, I further organize them by what they are used for (vulnerability scanning, incident response, etc.).
This will be updated over time as I find new resources and tools.
List
Red Team
Reconnaissance (TA0043)
Description: Gathering information for planning future operations.
Bjorn: Pwnagotchi-like tool for network scanning, vulnerability assessment.CF-Hero: With multiple methods, used to discover Cloudflare origin IPs.cloudscraper: Python module to bypass Cloudflare’s anti-bot page (IUAM), enabling scraping and crawling of websites protected by these measures.Creepy: OSINT tool that gathers and maps geolocation information from online sources (e.g., social media, photo metadata).dig: Advanced command-line tool for DNS interrogation, offering more detailed and flexible queries than nslookup.dnsdumpster.com: Online service for finding DNS records and subdomains related to a domain to help map the attack surface.Evil-M5Project: ESP32/M5Core2-based offensive toolkit for Wi-Fi attacks (Rogue AP, Evil Twin, deauth, Karma), network attacks, BadUSB, Bluetooth attacks, and C2, aimed at gaining access and control.GeoSpy: Python tool using an AI service (Graylark) to identify the geographical location where photos were taken.gobuster: Brute-force tool to discover URIs, DNS subdomains, Virtual Hosts, cloud buckets, and TFTP servers.hcxdumptool: Tool for capturing WiFi WPA/WPA2 handshakes and PMKIDs from wireless networks for subsequent cracking attempts.hunter.io: Email harvesting.Nessus: An industry-standard vulnerability scanner for identifying vulnerabilities, misconfigurations, and malware on network assets.Nmap: Initial network scanning of external targets to identify live hosts and broadly check for open ports/services.nslookup: Standard command-line tool for querying DNS to obtain domain name or IP address mapping information.OpenVAS: A full-featured vulnerability scanner that identifies security issues in servers and network devices.Osintgram: OSINT tool for collecting, analyzing, and running reconnaissance on Instagram profiles.PhoneInfoga: Advanced OSINT tool for scanning international phone numbers to gather associated information (carrier, line type, owner clues, social media presence, etc.).Pwnagotchi: Raspberry Pi-based tool (using bettercap) for automatically capturing WPA/WPA2 handshakes and PMKIDs for offline cracking.RustScan: A high-speed port scanner for quickly finding all open ports on a target.Sherlock: OSINT tool to hunt down social media and other online accounts by username across numerous platforms.shodan.io: Search engine for discovering internet-connected devices and services, identifying exposed systems, IoT, and operational technology.theHarvester: OSINT tool for gathering names, emails, IPs, subdomains, and URLs by using multiple public resources.URLCrazy: OSINT tool to generate and test domain variations for typosquatting, phishing, or brand protection research.Wappalyzer: A browser extension and utility that identifies the technologies used on websites, such as frameworks, CMS, and analytics tools.viewdns.info: A web-based collection of network tools for DNS, IP, and domain reconnaissance.whois: Command-line and web utility to query registration data for domains and IP addresses (owner, registrar, contact info).
Initial Access (TA0001)
Description: Trying to get into victim’s network.
CATSploit: Automated penetration testing tool that gathers information, scores, and selects attack techniques, then executes them via Metasploit to compromise targets.cuddlephish: Browser-in-the-Middle (BitM) framework for phishing attacks to bypass MFA and capture sessions.Evil-M5Project: ESP32/M5Core2-based offensive toolkit for Wi-Fi attacks (Rogue AP, Evil Twin, deauth, Karma), network attacks, BadUSB, Bluetooth attacks, and C2, aimed at gaining access and control.Evilginx: Man-in-the-middle attack framework for phishing credentials and session cookies to bypass 2FA.EvilnoVNC: Phishing platform using a real browser over noVNC to bypass 2FA, capture credentials, sessions, and access browser profile data.metasploit-framework: A comprehensive penetration testing platform for developing, testing, and executing exploits against remote targets.Modlishka: HTTP reverse proxy for advanced phishing attacks; facilitates 2FA bypass by capturing credentials and session cookies.Muraena: Reverse proxy for automating phishing and post-phishing activities, facilitating credential and session capture.Powershell-to-Ducky-Converter: Converts PowerShell scripts into Ducky Script for BadUSB (e.g., USB Rubber Ducky) payloads.Wifiphisher: Rogue Access Point framework for Wi-Fi MitM attacks, phishing credentials (network keys, web logins), and malware deployment.
Execution (TA0002)
Description: Trying to run malicious code.
Burp Suite: An integrated platform for web application security testing, used for intercepting, analyzing, and manipulating web traffic.PowerShell-for-Hackers: A collection of PowerShell scripts for offensive tasks like reverse shells, keylogging, and payload delivery.
Defense Evasion (TA0005)
Description: Trying to avoid being detected
UserAgent-Switcher: A browser extension for spoofing the User-Agent string, which can help bypass agent-based access controls.
Credential Access (TA0006)
Description: Trying to steal account names and passwords.
aircrack-ng: A set of tools for auditing wireless networks, including packet capturing and cracking WEP/WPA/WPA2 keys.Bjorn: Pwnagotchi-like tool for brute-force attacks (FTP, SSH, SMB, etc.), and data exfiltration.Ciphey: Automated decryption/decoding tool using AI for cipher detection.crackstation.net: Online hash cracking service using massive pre-computed rainbow tables.cuddlephish: Browser-in-the-Middle (BitM) framework for phishing attacks to bypass MFA and capture sessions.Evilginx: Man-in-the-middle attack framework for phishing credentials and session cookies to bypass 2FA.EvilnoVNC: Phishing platform using a real browser over noVNC to bypass 2FA, capture credentials, sessions, and access browser profile data.hashcat: Advanced password recovery and cracking tool supporting numerous hash types and attack modes, capable of GPU acceleration.hash-identifier: A Python script to identify the type of hash algorithm used on a given hash.hcxtools: Utilities to convert WiFi WPA/WPA2 packet captures into hash formats for cracking.Impacket: Python toolkit for network protocol interaction, used for credential dumping and relay attacks.mimikatz: A powerful tool to extract plaintext passwords, hashes, and Kerberos tickets from memory on Windows systems.Modlishka: HTTP reverse proxy for advanced phishing attacks.Muraena: Reverse proxy for automating phishing and post-phishing activities.THC Hydra: A fast network logon cracker for brute-forcing credentials against numerous protocols like SSH, FTP, and HTTP.Wifiphisher: Rogue Access Point framework for Wi-Fi MitM attacks and phishing.wpa-sec.stanev.org: Community-driven platform for distributed cracking of WPA/WPA2 PSKs.
Discovery (TA0007)
Description: Trying to figure out victim’s environment.
Enum4Linux: Used for enumerating data from Windows and Samba hosts.Nmap: In-depth network mapping (internal/external) for detailed port/service/version/OS detection, vulnerability identification (NSE), and understanding network topology.
Collection (TA0009)
Description: Trying to gather data of interest to their goal.
EvilnoVNC: Phishing platform using a real browser over noVNC to bypass 2FA, capture credentials, sessions, and access browser profile data.
Command and Control (TA0011)
Description: Trying to communicate with compromised systems to control them.
PingRAT: Remote Access Trojan (RAT) that uses ICMP packets for covert Command and Control (C2) traffic.
Impact (TA0040)
Description: Trying to manipulate, interrupt, or destroy your systems and data.
MHDDoS: A powerful DDenial of Service (DoS) attack script written in Python.slowloris: HTTP Denial of Service tool that exhausts a web server’s connection pool by slowly sending headers.
Blue Team
Network Security
Description: Monitoring network traffic, controlling access, and actively preventing intrusions.
Tags: Network Intrusion Prevention (M1031), Filter Network Traffic (M1037), Network Segmentation (M1030)
OPNsense: FreeBSD-based, open-source, user-friendly firewall and routing platform.Snort: Open-source Network Intrusion Prevention System (NIPS) and Intrusion Detection System (NIDS) that uses rule-based analysis of network traffic.testmynids.org: Website and script framework for testing Network Intrusion Detection System (NIDS) detection capabilities against known malicious patterns.Nzyme: Wireless Intrusion Detection System (WIDS) and network monitor for detecting unauthorized devices (WiFi, Bluetooth, wired), rogue APs, and wireless attacks.AC-Hunter: A threat hunting tool that analyzes network traffic data (from Zeek or other sources) to find beaconing Command and Control (C2) activity.RITA (Real Intelligence Threat Analytics): Framework for detecting command and control (C2) communication (beaconing, DNS tunneling, etc.) through network traffic analysis of Zeek logs.Zeek: A powerful network analysis framework that goes beyond a traditional IDS, providing detailed, structured logs of all network activity (HTTP, DNS, SSL, etc.).
AppSec & DevSecOps
Description: Building security into applications, inspecting web traffic, and actively defending against exploits.
Tags: SSL/TLS Inspection (M1020), Exploit Protection (M1050)
BunkerWeb: Nginx-based open-source Web Application Firewall (WAF).grype: Vulnerability scanner for container images and filesystems.OWASP ZAP: An open-source web application security scanner for finding vulnerabilities during development and testing.SafeLine: Open-source Web Application Firewall (WAF).Snyk: Developer security platform for finding and fixing vulnerabilities in code, dependencies, and containers.
Endpoint Security
Description: Monitoring endpoint activities, preventing malware infections, and actively blocking malicious code execution.
Tags: Behavior Prevention on Endpoint (M1040), Antivirus/Antimalware (M1049), Execution Prevention (M1038)
ClamAV: Open source antivirus enginekernel-hardening-checker: Tool for checking Linux kernel security hardening options (compile-time, boot-time, runtime) against best practices.
Data Security
Description: Identifying sensitive data, preventing its unauthorized loss, and actively ensuring its backup and recovery.
Tags: Data Loss Prevention (M1057), Data Backup (M1053)
Cloud Security
Description: Managing secure cloud configurations, protecting cloud workloads and data, and actively controlling access to cloud resources.
Tags:
Email Security
Description: Authenticating email senders, filtering out malicious content, and actively defending against email-based attacks.
Tags:
Sublime Platform: Open platform for detecting and preventing email attacks.DMARC-SPF-Checker: Analyzing DMARC and SPF records for a list of domains.MX Toolbox: Listing MX records for a domain.
Identity Security
Description: Verifying user identities, detecting credential abuse and account takeover attempts, and actively responding to identity-based threats.
Tags:
Push Security: Browser-based ITDR platform protecting against phishing, AitM, credential abuse, and account takeover.Teleport: Identity-aware access proxy providing secure connectivity, authentication (certificates, SSO, MFA), authorization (RBAC), and audit for infrastructure (SSH, K8s, DBs, RDP, web apps).
Digital Forensics & Incident Response (DFIR)
Description: Hands-on analysis of security incidents by investigating and correlating evidence from disk, memory, and network artifacts.
Tags:
Arsenal Image Mounter: Mounts forensic disk images as real disks in Windows, allowing for in-depth analysis with other tools.Autopsy: An open-source digital forensics platform for analyzing disk images and mobile devices.Ciphey: Automated decryption/decoding tool using AI for cipher detection.CyberChef: A web app for data encoding, decoding, encryption, hashing, formatting, and analysis.DC3DD/DD: Command-line tools for creating bit-for-bit forensic images of storage media.EnCase: A commercial, court-accepted digital forensics platform for deep analysis of computer evidence.Eric Zimmerman's Tools: A suite of essential command-line tools for parsing Windows forensic artifacts (e.g., MFT, Prefetch, Shellbags).FTK Imager: A free data preview and imaging tool for creating forensic images and capturing live memory.KAPE (Kroll Artifact Parser and Extractor): A forensic artifact collector and parser for quickly triaging a system to find evidence.Plaso (log2timeline): Python-based forensic engine for creating detailed timelines from diverse system artifacts.Velociraptor: An advanced open-source tool for endpoint monitoring, digital forensics, and incident response at scale.Volatility Framework: The industry-standard open-source framework for memory forensics and analyzing RAM dumps.Wireshark: Network protocol analyzer for deep packet inspection and offline analysis of PCAPs.
Threat Intelligence & Detection
Description: Gathering, analyzing, and operationalizing threat data to proactively hunt for adversaries and detect malicious activity.
Tags:
Cortex: Observable analysis and active response engine with numerous analyzers and responders.Cowrie: SSH and Telnet honeypot designed to log brute force attacks and shell interaction.Dionaea: Low-interaction honeypot designed to trap malware by emulating vulnerable network services.IntelOwl: Open-source platform for scaling threat intelligence operations by aggregating data from multiple sources.MalShare: Community malware repository with an API for sample submission and download.MalwareBazaar (abuse.ch): Malware repository and threat intelligence platform for querying samples.MalwareSourceCode (vxunderground): A collection of malware source code for analysis and research.MISP: Open-source threat intelligence platform for sharing, storing, and correlating IoCs.Shuffle: Open-source Security Orchestration, Automation, and Response (SOAR) platform.SOC Prime: Platform for collaborative cyber defense providing detection content (e.g., Sigma rules).ssdeep: Computing and comparing fuzzy hashes (CTPH) to find similar malware.ThreatFox (abuse.ch): Community-driven platform for sharing Indicators of Compromise (IOCs).Tines: A commercial SOAR platform for automating security workflows.Tracecat: An open-source, case-centric SOAR platform.
Others (Management, Purple Team)
Governance, Risk, and Compliance (GRC)
Description: Focuses on frameworks, processes, and tools for establishing security policies, managing cyber risk, and ensuring compliance with external and internal requirements.
Tags: User Training (M1017), Data Backup (M1053)
Eramba: Stable & feature-rich GRC platform.Comp AI: New & under heavy-development GRC platform.Wizer: Security awareness training & phishing simulation.OpenCVE: Open-source platform for aggregating, monitoring, and managing CVEs to support organizational risk management and compliance.
Cybersecurity Frameworks & Knowledge Bases
Description: Leveraging industry-standard frameworks and knowledge bases to understand threats, guide strategies, and enhance security posture.
MITRE ATT&CK Mitigations: Enterprise mitigation strategies mapped to ATT&CK techniques.MITRE ATT&CK Matrix: A framework of known adversary tactics and techniques.
Purple Team & Adversary Emulation
Description: Simulating attacker techniques to test, validate, and improve defensive controls and incident response capabilities.
Atomic Red Team: A library of scripted tests mapped to MITRE ATT&CK for validating security visibility, detection coverage, and emulating adversary behaviors.AttackGen: LLM-powered tool using MITRE ATT&CK to generate tailored incident response scenarios for testing, training, and purple team exercises.