Tools (General)

Recon Tools

Nmap

Masscan

Whois

dig

nslookup

Amass

Gobuster

DNS enumeration tools

Web Tools

Burp Suite

Nikto

curl

wget

Exploitation Tools

Metasploit

SearchSploit

sqlmap

Password Tools

Hashcat

John the Ripper

Hydra

Windows/AD Tools

PowerShell

Impacket

BloodHound

Mimikatz concepts

Linux Tools/Commands

Bash

grep

awk

sed

find

netstat/ss

ps

chmod, chown

Traffic Tools

Wireshark

tcpdump

Wayback Machine

An OSINT service used to view archived versions of websites and analyze historical website changes.

Category: OSINT

Licensing: Free Service

Maltego

An OSINT data-mining and link-analysis tool used to discover relationships between people, organizations, domains, and other entities.

Category: OSINT

Licensing: Commercial (Community Edition available)

Recon-ng

A web reconnaissance framework used to automate OSINT gathering and collect information about targets.

Category: OSINT

Licensing: Open Source

Shodan

An internet-connected device search engine used to discover exposed devices, services, ports, and banners.

Category: OSINT

Licensing: Commercial (Freemium)

SpiderFoot

An OSINT automation tool that gathers and correlates information from multiple sources to build a profile of a target.

Category: OSINT

Licensing: Open Source / Commercial

WHOIS

A lookup service used to retrieve domain registration information, including registrant details, registrar, and registration dates when publicly available.

Category: OSINT

Licensing: Free

nslookup

A command-line DNS query tool used to retrieve DNS records and troubleshoot name resolution.

Category: Network

Licensing: Free

dig

A DNS lookup utility used to query DNS servers and retrieve detailed DNS record information.

Category: Network

Licensing: Free

Installing dig on Windows

Open PowerShell and run the command: winget install ISC.Bind

Category: Network

Licensing: Free

Hunter.io

An OSINT service used to discover email addresses associated with organizations and domains.

Category: OSINT

Licensing: Commercial (Freemium)

Censys.io

An internet asset search platform used to identify and analyze internet-connected devices, services, and exposed infrastructure.

Category: OSINT

Licensing: Commercial (Limited free access)

DNSdumpster

An OSINT tool used to map DNS infrastructure and discover associated hosts, subdomains, and DNS records.

Category: OSINT

Licensing: Free

Amass

A reconnaissance tool used for attack surface mapping and subdomain enumeration.

Category: Recon

Licensing: Open Source

Nmap

A network scanning tool used to discover hosts, identify open ports, detect services, and perform OS detection.

Category: Network

Licensing: Open Source

theHarvester

An OSINT tool used to collect publicly available email addresses, subdomains, hostnames, and other information about a target.

Category: OSINT

Licensing: Open Source

WiGLE

A crowdsourced wireless network database used to map Wi-Fi access points and associate them with geographic locations.

Category: Wireless / OSINT

Licensing: Freemium

inSSIDer

A Wi-Fi analysis tool used to identify nearby wireless networks, channels, signal strength, and potential interference.

Category: Wireless

Licensing: Free / Community

Wireshark

A graphical packet analyzer used to capture and inspect network traffic at the packet level.

Category: Network

Licensing: Open Source

tcpdump

A command-line packet analyzer used to capture and inspect network traffic.

Category: Network

Licensing: Open Source

Aircrack-ng

A wireless security auditing suite used to assess Wi-Fi security and test the strength of WEP and WPA/WPA2 protections.

Category: Wireless

Licensing: Open Source

WiFi-Pumpkin

A wireless security framework used to create rogue access points and demonstrate captive portal and wireless attack scenarios.

Category: Wireless / Phishing

Licensing: Open Source

Kismet

A wireless network detection and monitoring tool used to discover Wi-Fi networks, capture wireless traffic, and identify devices.

Category: Wireless

Licensing: Open Source

Responder

A network poisoning tool used to exploit name-resolution protocols such as LLMNR and NetBIOS Name Service (NBNS) to capture authentication information.

Category: Active Recon / MITM

Licensing: Open Source

Hashcat

A password recovery and cracking tool that uses GPU acceleration to test password hashes against candidate passwords.

Category: Passwords

Licensing: Open Source (Free)

John the Ripper

A password auditing and cracking tool used to identify weak passwords by testing password hashes against potential passwords.

Category: Passwords

Licensing: Open Source

Medusa

A parallel, modular login brute-force tool used to test authentication services for weak credentials.

Category: Passwords

Licensing: Open Source

Hydra

A parallel network login cracker used to test username and password combinations against remote authentication services.

Category: Passwords

Licensing: Open Source

Netcat (nc)

A network utility used to read and write data across TCP or UDP connections, commonly for port testing, listeners, and remote shells.

Category: Network

Licensing: Open Source

Impacket

A collection of Python classes and tools used to interact with network protocols, particularly Windows networking and authentication protocols.

Category: Network / Tools

Licensing: Open Source

CrackMapExec (CME)

A network and Active Directory assessment tool used to enumerate Windows environments and evaluate authentication and lateral movement opportunities.

Category: Windows / AD

Licensing: Open Source

msfvenom

A Metasploit utility used to generate and encode payloads for authorized security testing.

Category: Exploit Framework

Licensing: Open Source / Rapid7

Metasploit

A penetration testing framework used to develop, test, and execute exploits against vulnerable systems.

Category: Exploit Framework

Licensing: Open Source / Commercial

Mimikatz

A Windows security tool used to interact with credentials, authentication material, and Kerberos tickets, including extracting credentials from memory.

Category: Windows / Credentials

Licensing: Open Source

Rubeus

A Windows toolset used to interact with and test Kerberos authentication, tickets, and delegation configurations.

Category: Windows / Kerberos

Licensing: Open Source

Certify

A tool used to enumerate Active Directory Certificate Services (AD CS) configurations and identify certificate template misconfigurations that could enable privilege escalation.

Category: Windows / PKI

Licensing: Open Source / Research

Seatbelt

A Windows host-enumeration tool used to collect system information and identify security-relevant configurations.

Category: Windows

Licensing: Open Source

PowerSploit

A collection of PowerShell modules designed for authorized penetration testing and security assessments of Windows environments.

Category: PowerShell

Licensing: Open Source

PowerShell / ISE

PowerShell is a command-line shell and scripting language used to automate Windows administration and security tasks. PowerShell ISE is an integrated scripting environment for writing and debugging PowerShell scripts.

Category: PowerShell

Licensing: Microsoft

PsExec

A Sysinternals utility used to execute processes remotely on Windows systems.

Category: Windows / Admin

Licensing: Free (Sysinternals)

Evil-WinRM

A tool used to establish remote Windows shells through Windows Remote Management (WinRM), commonly used during authorized penetration testing.

Category: Windows

Licensing: Open Source

Burp Suite

A web application security testing platform that intercepts, inspects, and modifies HTTP/S traffic and provides tools for identifying vulnerabilities.

Category: Web

Licensing: Commercial (Community Edition available)

ZAP (Zed Attack Proxy)

An OWASP web application security testing tool used to intercept web traffic, crawl applications, and identify vulnerabilities through automated and manual testing.

Category: Web

Licensing: Open Source

sqlmap

An automated tool used to detect and exploit SQL injection vulnerabilities in web applications.

Category: Web

Licensing: Open Source

Wfuzz

A web application fuzzing tool used to discover resources and test parameters, directories, and virtual hosts.

Category: Web

Licensing: Open Source

GoBuster

A command-line tool used to discover hidden directories, files, DNS subdomains, and virtual hosts through brute-force enumeration.

Category: Web

Licensing: Open Source

DirBuster

A graphical web application tool used to discover hidden directories and files through brute-force enumeration.

Category: Web

Licensing: Open Source

WPScan

A WordPress security scanner used to identify vulnerabilities, outdated components, plugins, themes, and user information.

Category: Web

Licensing: Open Source / WPVulnDB

Nikto

A web server vulnerability scanner used to identify outdated software, dangerous files, misconfigurations, and known security issues.

Category: Web

Licensing: Open Source

OpenVAS / Greenbone

A vulnerability scanning platform used to identify known vulnerabilities, misconfigurations, and security weaknesses across systems and networks.

Category: Vulnerability Scanner

Licensing: Open Source / Commercial

Tenable Nessus

A vulnerability scanner used to identify known vulnerabilities, missing patches, and security misconfigurations.

Category: Vulnerability Scanner

Licensing: Commercial (Free trial available)

Trivy

A security scanner used to identify vulnerabilities and misconfigurations in container images, filesystems, repositories, and other software artifacts.

Category: Container Scanning

Licensing: Open Source

Grype

A vulnerability scanner used to identify known vulnerabilities in container images, filesystems, and software bills of materials (SBOMs).

Category: Container Scanning

Licensing: Open Source

Kube-hunter

A Kubernetes security assessment tool used to discover security weaknesses and potential attack paths in Kubernetes clusters.

Category: Cloud / Container

Licensing: Open Source

TruffleHog

A secret-scanning tool used to detect exposed credentials, API keys, tokens, and other sensitive information in code repositories and files.

Category: OSINT / Code

Licensing: Open Source

BloodHound

An Active Directory analysis tool that maps relationships and permissions to identify potential attack paths and privilege escalation opportunities.

Category: Windows / AD

Licensing: Open Source

tcpreplay

A network utility used to replay previously captured packet files (PCAPs) onto a network for traffic analysis and IDS/IPS testing.

Category: Network

Licensing: Open Source

Scapy

A Python-based packet manipulation tool used to craft, send, capture, and analyze network packets.

Category: Network / Scripting

Licensing: Open Source

BeEF

The Browser Exploitation Framework, a tool used to assess browser security by hooking browsers and testing client-side vulnerabilities.

Category: Browser / Post-Exploitation

Licensing: Open Source

Evilginx2

An adversary-in-the-middle framework used in authorized security testing to demonstrate phishing techniques and session-token interception.

Category: Phishing / AiTM

Licensing: Open Source

GoPhish

A phishing simulation platform used to create and manage authorized phishing awareness campaigns.

Category: Phishing

Licensing: Open Source

SET (Social-Engineer Toolkit)

A penetration testing framework used to automate social-engineering assessments, including phishing simulations.

Category: Phishing

Licensing: Open Source

WPAD

Web Proxy Auto-Discovery (WPAD) is a protocol that allows devices to automatically discover proxy configuration. It can be abused in certain network environments to redirect traffic or capture authentication information.

Category: Network / Attacks

Licensing: Concept / Tools

ScoutSuite

A multi-cloud security auditing tool used to assess cloud environments for security misconfigurations and weaknesses.

Category: Cloud

Licensing: Open Source

Prowler

A cloud security assessment tool primarily used to audit AWS environments against security best practices, compliance standards, and configuration benchmarks.

Category: Cloud

Licensing: Open Source

Pacu

An AWS exploitation framework used to assess cloud security by testing for weaknesses in AWS configurations, permissions, and services.

Category: Cloud

Licensing: Open Source

Docker Bench for Security

A script that checks Docker host configurations against the CIS Docker Benchmark to identify security weaknesses and misconfigurations.

Category: Container / Host

Licensing: Open S