A categorized reference of security tools — open source, free, and commercial — worth knowing. Skews toward tools that are actively maintained and widely used in practice.
Pull requests welcome.
- Reconnaissance & OSINT
- Network Scanning & Enumeration
- Web Application Testing
- Exploitation Frameworks
- Password Attacks & Credential Testing
- Wireless Security
- Traffic Analysis & Network Monitoring
- SIEM & Log Management
- Forensics & Incident Response
- Malware Analysis & Reverse Engineering
- Vulnerability Scanning & Management
- Cloud & Container Security
- Threat Intelligence
- AI & Machine Learning for Security
- Browser Extensions
- Open Source vs. Commercial
- Maltego — Graph-based OSINT and link analysis. Community edition free; commercial versions available.
- theHarvester — Gather emails, subdomains, hosts, and open ports from public sources. (Open source)
- Recon-ng — Full-featured web reconnaissance framework with modular design. (Open source)
- SpiderFoot — Automated OSINT tool with 200+ modules for target profiling. (Open source / commercial HX version)
- Amass — In-depth attack surface mapping and asset discovery (DNS, IP, ASN). (Open source — OWASP)
- Subfinder — Fast passive subdomain enumeration. (Open source — ProjectDiscovery)
- Shodan — Search engine for internet-connected devices. (Freemium / API)
- Censys — Internet-wide scan data, certificates, and host intelligence. (Freemium)
- OSINT Framework — Web-based directory of OSINT resources by category. (Free)
- Photon — Fast crawler designed for OSINT. (Open source)
- httpx — Fast HTTP probing and technology fingerprinting across large host lists. (Open source — ProjectDiscovery)
- dnsx — High-speed DNS toolkit for resolution, wildcard detection, and record enumeration. (Open source — ProjectDiscovery)
- Nmap — The standard for host discovery, port scanning, and service fingerprinting. (Open source)
- Zenmap — Official Nmap GUI. (Open source)
- Masscan — Fastest internet-scale port scanner; useful for large subnets. (Open source)
- Nuclei — Template-based vulnerability scanner with a large community template library. (Open source — ProjectDiscovery)
- Rustscan — Extremely fast port scanner that pipes results into Nmap. (Open source)
- Naabu — Fast port scanner focused on reliability. (Open source — ProjectDiscovery)
- Netdiscover — Active/passive ARP-based network address scanner. (Open source)
- Burp Suite — The industry-standard web app testing proxy. Community edition free; Pro is paid. (Freemium)
- OWASP ZAP — Full-featured web app scanner and proxy, actively maintained by OWASP. (Open source)
- sqlmap — Automated SQL injection detection and exploitation. (Open source)
- ffuf — Fast web fuzzer for directory/file discovery and parameter brute-forcing. (Open source)
- Gobuster — Directory/DNS/vhost brute-forcing tool. (Open source)
- Nikto — Web server scanner for known vulnerabilities and misconfigurations. (Open source)
- Caido — Modern web security testing platform, gaining traction as a Burp alternative. (Freemium)
- Wfuzz — Web application fuzzer for brute-forcing parameters, auth, and more. (Open source)
- Arjun — HTTP parameter discovery tool. (Open source)
- Dalfox — Fast XSS scanner and parameter analysis tool. (Open source)
- Metasploit Framework — The most widely used exploitation framework. Community version free; Pro is paid. (Open source / commercial)
- Cobalt Strike — Commercial adversary simulation and red team platform. (Commercial)
- Sliver — Open source C2 framework from BishopFox, increasingly popular as a Cobalt Strike alternative. (Open source)
- Havoc — Modern C2 framework with an extendable agent. (Open source)
- Empire — Post-exploitation framework with PowerShell and Python agents. (Open source)
- Armitage — GUI front-end for Metasploit. (Open source)
- SILENTTRINITY — Post-exploitation framework using .NET's DLR. (Open source)
- Hashcat — GPU-accelerated password cracking. Supports hundreds of hash types. (Open source)
- John the Ripper — Classic password cracker, still widely used. (Open source)
- Hydra — Fast network login cracker for dozens of protocols. (Open source)
- Medusa — Parallel, modular brute-force tool. (Open source)
- NetExec (nxc) — Active Directory enumeration and lateral movement (successor to CrackMapExec). (Open source)
- Responder — LLMNR/NBT-NS/mDNS poisoner for capturing NetNTLM hashes. (Open source)
- Impacket — Python library and toolset for Windows networking protocols. Essential for AD attacks. (Open source)
- BloodHound — Active Directory attack path analysis using graph theory. (Open source)
- Kerbrute — Kerberos username enumeration and password spraying. (Open source)
- Aircrack-ng — Suite of tools for 802.11 monitoring, attacking, testing, and cracking. (Open source)
- Kismet — Wireless network detector, sniffer, and IDS that works with monitor-mode hardware. (Open source)
- Bettercap — Swiss army knife for network attacks and MITM. Supports WiFi, BLE, and Ethernet. (Open source)
- Wifite — Automated wireless auditor. (Open source)
- hcxtools / hcxdumptool — WiFi key material capture and conversion for use with Hashcat. (Open source)
- WiFi Pineapple — Purpose-built hardware for wireless auditing and pen testing. (Commercial hardware)
- Wireshark — The standard packet capture and analysis tool. (Open source)
- tcpdump — CLI packet capture. Wireshark for the terminal. (Open source)
- Zeek — Network analysis framework that produces rich, structured logs. (Open source)
- Suricata — High-performance network IDS/IPS/NSM engine. (Open source)
- Snort — Long-standing IDS/IPS; signature-based detection. (Open source / commercial)
- Security Onion — Linux distro and platform built for threat hunting and NSM, integrating Zeek, Suricata, and Elastic. (Open source)
- RITA — Real Intelligence Threat Analytics — analyzes Zeek logs for C2 beaconing and other threats. (Open source)
- NetworkMiner — Passive network sniffer and PCAP analyzer. (Free / commercial)
- Arkime — Large-scale PCAP indexing and session search (formerly Moloch). (Open source)
- Elastic / ELK Stack — Elasticsearch + Logstash + Kibana + Beats. Widely deployed SIEM foundation. (Open source core / commercial features)
- Wazuh — Open source SIEM and XDR with agent-based host monitoring. (Open source)
- Graylog — Log management platform with good search and alerting. (Open source / commercial)
- OpenSearch Security Analytics — AWS-backed Elasticsearch fork with security analytics capabilities. (Open source)
- Splunk — Enterprise SIEM/observability platform. Industry standard but expensive. (Commercial)
- Microsoft Sentinel — Cloud-native SIEM/SOAR on Azure. (Commercial / consumption-based)
- Shuffle — Open source SOAR for playbook automation; pairs with SIEMs for alert triage and response. (Open source)
- osquery — SQL-powered endpoint visibility; query running processes, sockets, and configs across fleets. (Open source — Meta)
- Autopsy / The Sleuth Kit — Disk image and file system forensics. (Open source)
- Volatility — Memory forensics framework — essential for analyzing RAM dumps. (Open source)
- SIFT Workstation — SANS-built Linux distro preloaded with forensics tools. (Free)
- KAPE — Fast artifact collection and processing for Windows. (Free)
- Chainsaw — Rapidly search and triage Windows event logs. (Open source)
- Hayabusa — Windows event log fast forensics and threat hunting. (Open source)
- CyberChef — Browser-based data transformation and analysis "Swiss army knife" from GCHQ. (Open source)
- Eric Zimmerman Tools (EZ Tools) — Comprehensive suite of Windows forensics utilities. (Free)
- REMnux — Linux distro for reverse-engineering and malware analysis. (Free)
- DFIR-ORC — Collects forensic artifacts at scale on Windows endpoints. (Open source)
- Timesketch — Collaborative timeline analysis for incident response and threat hunting. (Open source — Google)
- Ghidra — NSA's open source reverse engineering suite. Strong competitor to IDA Pro. (Open source)
- IDA Pro / IDA Free — Long-standing industry-standard disassembler and debugger. (Commercial / free limited version)
- Binary Ninja — Modern disassembler and binary analysis platform. (Commercial / free cloud version)
- x64dbg — Open source x64/x32 debugger for Windows. (Open source)
- Cutter — GUI frontend for Rizin/Radare2. (Open source)
- CAPE Sandbox — Malware sandbox with configuration extraction. (Open source)
- ANY.RUN — Interactive online malware sandbox. (Freemium)
- VirusTotal — File and URL scanning against 70+ antivirus engines. (Free / commercial API)
- YARA — Pattern matching for malware identification and classification. (Open source)
- Detect-It-Easy (DIE) — Identifies file types, packers, compilers, and protections. (Open source)
- floss — Automatically extract obfuscated strings from malware (Mandiant FLARE). (Open source)
- Greenbone / OpenVAS — Open source vulnerability scanner. Community edition free. (Open source / commercial)
- Nessus — Widely used vulnerability scanner. Essentials (free up to 16 IPs); Pro is paid. (Freemium / commercial)
- Nuclei — Fast, template-based vulnerability scanner with massive community library. (Open source)
- Faraday — Collaborative vulnerability management platform. (Open source / commercial)
- DefectDojo — Open source DevSecOps vulnerability management. (Open source)
- Vulncheck — Exploit intelligence and KEV/XDB feeds beyond public CISA data. (Commercial / API)
- Dependency-Track — SBOM analysis and continuous monitoring for third-party component risk. (Open source — OWASP)
- ScoutSuite — Multi-cloud security auditing across AWS, Azure, and GCP. (Open source — NCC Group)
- Prowler — Cloud security tool for AWS, Azure, and GCP with hundreds of checks. (Open source)
- Pacu — AWS exploitation framework for red teaming cloud environments. (Open source — Rhino Security)
- Trivy — Comprehensive vulnerability scanner for containers, filesystems, and IaC. (Open source — Aqua)
- Grype — Container image vulnerability scanner. (Open source — Anchore)
- Falco — Runtime security and threat detection for containers and Kubernetes. (Open source — CNCF)
- Checkov — Static analysis for IaC (Terraform, CloudFormation, Kubernetes, etc.). (Open source — Bridgecrew/Prisma)
- CloudSploit — Cloud security configuration scanning. (Open source — Aqua)
- MISP — Open source threat intelligence platform for sharing IoCs and threat data. (Open source)
- OpenCTI — Cyber threat intelligence management with STIX/TAXII support. (Open source)
- TheHive — Scalable incident response and case management platform. (Open source / commercial)
- Cortex — Analysis and active response engine that integrates with TheHive. (Open source)
- YARA — Pattern matching for malware classification and threat hunting. (Open source)
- SIGMA — Generic signature format for SIEM rules — write once, use anywhere. (Open source)
- STIX / TAXII — Structured Threat Information Expression and sharing protocol standards. (Open standard)
- Abuse.ch — Free threat intelligence feeds: MalwareBazaar, URLhaus, ThreatFox, Feodo Tracker. (Free)
- MITRE ATT&CK — Adversary tactics, techniques, and procedures framework used across detection engineering. (Open standard)
- OpenSanctions — Consolidated sanctions, PEP, and watchlist data for screening and enrichment. (Open source / API)
Practitioner-focused ML/AI — anomaly detection on telemetry, LLM red teaming, and adversarial testing of models. Not a catalog of every data-science library; these are widely cited in security work.
- PyOD — Python outlier detection toolkit; common starting point for unsupervised anomaly scoring on logs and metrics. (Open source)
- Kitsune — Online network anomaly detection via an ensemble of autoencoders on packet features. (Open source — research)
- Elastic Machine Learning — Built-in time-series anomaly detection and UEBA-style jobs in the Elastic Stack. (Open source core / commercial)
- Garak — LLM vulnerability scanner and probe harness; checks for jailbreaks, prompt injection, and data leakage patterns. (Open source — NVIDIA)
- Promptfoo — Repeatable LLM evaluation and red-team test suites with CI-friendly workflows. (Open source)
- LLM Guard — Input/output scanners for PII, injection, toxicity, and other policy violations in LLM pipelines. (Open source — Protect AI)
- Adversarial Robustness Toolbox (ART) — IBM's library for evasion, poisoning, extraction, and inference attacks against ML models. (Open source — Linux Foundation)
- Counterfit — Microsoft's CLI for automated adversarial attack campaigns against deployed ML endpoints. (Open source)
- TextAttack — Framework for adversarial attacks on NLP models; useful for testing classifier robustness. (Open source)
- EMBER — Open malware classifier benchmark and feature set from Elastic; de facto reference for PE static analysis ML. (Open source — Elastic)
- MalwareBazaar — Abuse.ch malware sample feed frequently used as labeled data for classification research. (Free)
- Capa — Mandiant's capability extractor; rules-based but pairs well with ML pipelines for feature engineering. (Open source — Google/Mandiant)
Useful for passive reconnaissance and web app testing directly in the browser.
- Wappalyzer — Identifies technologies (frameworks, CMS, libraries) used by websites.
- FoxyProxy — Proxy switcher — essential for routing traffic through Burp Suite or ZAP.
- Cookie-Editor — View, edit, and export cookies in one click.
- HackTools — All-in-one cheat sheet extension: XSS, SQLi, reverse shells, and more.
- Shodan — Shows Shodan data for the current IP/domain while you browse.
- DotGit — Checks if a
.gitdirectory is exposed on web servers. - Retire.js — Detects use of vulnerable JavaScript libraries on visited pages.
- TruffleHog — Browser extension that checks for exposed secrets and credentials.
Worth knowing that for most capabilities, open source tools match or exceed their commercial counterparts.
| Use Case | Open Source | Commercial Equivalent |
|---|---|---|
| Network IDS/IPS | Suricata, Snort | Cisco Firepower |
| NSM Platform | Security Onion, Zeek | Darktrace, ExtraHop |
| SIEM | Wazuh, Elastic Security | Splunk, Microsoft Sentinel |
| Vulnerability Scanning | OpenVAS, Nuclei | Nessus Pro, Qualys |
| Exploitation Framework | Metasploit, Sliver | Cobalt Strike |
| Endpoint Detection | Wazuh, Velociraptor | CrowdStrike, SentinelOne |
| Disk Forensics | Autopsy/TSK | EnCase, FTK |
| Memory Forensics | Volatility | Magnet RAM Capture |
| Network Access Control | FreeRADIUS | Cisco ISE |
| Cloud Security Audit | Prowler, ScoutSuite | Wiz, Prisma Cloud |
| Log Management | Graylog, ELK | Splunk |
| Threat Intelligence | MISP, OpenCTI | Recorded Future, ThreatConnect |
| LLM Red Teaming | Garak, Promptfoo | HiddenLayer, Robust Intelligence |
| Anomaly Detection | PyOD, Elastic ML | Darktrace, Vectra |