The ZMap Project is an open-source initiative focused on developing high-speed network scanning tools for Internet-wide security research.

DNSDumpster is an online tool used for passive DNS reconnaissance, providing information on domain names, IP addresses, and related DNS records for security analysis.

Dnsmap is a tool used for discovering subdomains of a domain through DNS enumeration.

PassiveDNS::Client is a Perl module for querying historical DNS data, enabling programmatic access to past DNS records for cybersecurity investigations.

SMBMap is a tool for enumerating and auditing SMB shares to identify accessible files on a network.

ScanCannon v1.1 automates network reconnaissance by combining Nmap and Masscan for efficient port scanning.

Nmap.org is the official website for Nmap, a widely used open-source network scanning tool for security auditing and network discovery.

CloudFail is a tool that identifies misconfigurations to reveal the real IP behind Cloudflare protection.

DNSRecon is a tool for DNS enumeration and reconnaissance, including DNS record collection and subdomain discovery.

PassiveDNS collects and stores historical DNS records for cybersecurity analysis and tracking of domain activities.

XRAY is a security assessment tool used for vulnerability scanning and detection across web applications and networks.

Fierce is a DNS reconnaissance tool used to find non-contiguous IP spaces and discover subdomains.

Scanless is a tool that allows users to perform port scans through third-party websites, helping to mask the origin of the scan.

Dnsenum is a tool for DNS enumeration, used to gather information about DNS records and subdomains.

Dnstracer traces the path of DNS queries to identify the DNS servers resolving a domain.

Masscan is a fast port scanner capable of scanning the entire Internet in minutes for large-scale reconnaissance.

ACLight is a tool for auditing and identifying excessive permissions and privilege escalation paths in Active Directory environments.

Intercepter-NG is a network security tool for intercepting, analyzing, and manipulating network traffic.

dsniff is a collection of tools for network auditing and penetration testing, specializing in sniffing and traffic interception.

RouterSploit is an open-source exploitation framework, similar to Metasploit, but focused on vulnerabilities in embedded devices.

dnstwist is a domain name permutation engine used to detect typo squatting, phishing, and corporate espionage threats.

NetworkMiner is a Network Forensic Analysis Tool (NFAT) used for passive network traffic analysis and packet capture.

SPARTA is a network scanning and enumeration tool for automating service discovery and vulnerability analysis.

Scapy is a Python-based interactive program and library for packet manipulation, allowing custom packet creation, sending, sniffing, and network analysis.

CrackMapExec is a versatile tool, often called the "Swiss army knife" for network penetration testing.

THC Hydra is an online password cracking tool that supports numerous network protocols, including HTTP, SMB, FTP, telnet, MySQL, LDAP, and more.

Firesheep is a free program designed for HTTP session hijacking attacks, allowing interception of unencrypted cookies over a network.

Zarp is a network attack tool focused on exploiting vulnerabilities in local networks.

Printer Exploitation Toolkit (PRET) is a printer security testing tool for exploiting PostScript, PJL, and PCL features over IP and USB.

Impacket is a collection of Python classes for working with and implementing various network protocols.

hping3 is a network tool capable of crafting and sending custom TCP/IP packets for various network testing purposes.

Netsparker Application Security Scanner is an automated tool for detecting security vulnerabilities in web applications.

w3af is a web application attack and audit framework used for identifying and exploiting vulnerabilities in web applications.

CMS-Explorer is a tool that reveals the specific modules, plugins, components, and themes used by websites running content management systems.

SQLmate is a companion tool to sqlmap, designed to identify SQL injection vulnerabilities using a given dork and, optionally, a website.

Nikto is a fast, but noisy, black-box web server and web application vulnerability scanner.

Wapiti is a black-box web application vulnerability scanner with a built-in fuzzer for discovering security flaws.

JoomScan is a vulnerability scanner specifically designed for detecting security flaws in Joomla websites.

JCS is a Joomla Vulnerability Component Scanner that automatically updates its database with vulnerabilities from ExploitDB and Packetstorm.

Arachni is a scriptable framework designed for evaluating the security of web applications.

SecApps is an in-browser web application security testing suite for identifying vulnerabilities directly from the browser.

ACSTIS is an automated tool for detecting client-side template injection vulnerabilities and sandbox bypasses in AngularJS applications.

LOIC is an open-source network stress testing tool for Windows, commonly used for launching denial-of-service (DoS) attacks.

HOIC (High Orbit Ion Cannon) is an updated version of LOIC, featuring "boosters" to bypass common countermeasures during DoS attacks.

JS LOIC is a JavaScript-based, in-browser version of the LOIC network stress testing tool.

T50 is a high-speed network stress testing tool designed for fast and efficient DoS attacks.

SlowLoris is a DoS tool that consumes minimal bandwidth on the attacking side to slowly exhaust the target server's resources.

Memcrashed is a DDoS attack tool that sends forged UDP packets to vulnerable Memcached servers, leveraging data from the Shodan API.

theHarvester is a tool for gathering email addresses, subdomains, and people’s names from various public sources.

Metagoofil is a metadata harvester that extracts metadata from publicly available documents to gather sensitive information.

Shodan is the world’s first search engine for discovering and analyzing internet-connected devices.

Sn1per is an automated penetration testing reconnaissance scanner designed to identify vulnerabilities and gather intelligence on target systems.

PacketTotal is a free tool for analyzing packet captures to quickly detect network malware using Bro and Suricata signatures.

SimplyEmail is a tool designed to simplify and speed up email reconnaissance during information gathering.

Google Hacking Database is a collection of Google dorks used for reconnaissance by uncovering sensitive information through advanced search queries.

sn0int is a semi-automatic OSINT framework and package manager designed for conducting structured information gathering.

fast-recon is a tool that performs Google dorks to quickly gather information about a domain.

Hunter.io is a data broker that provides a web search interface for finding email addresses and organizational details of companies.

Creepy is a geolocation OSINT tool used to gather location-based information from social media and other online platforms.

Censys is a platform that collects data on hosts and websites through daily scans using ZMap and ZGrab, offering insights into internet infrastructure and security.

github-dorks is a CLI tool used to scan GitHub repositories and organizations for potential sensitive information leaks.

DataSploit is an OSINT visualizer that uses tools like Shodan, Censys, and Zoomeye for data collection.

OSINT-SPY is a tool that performs OSINT scans on email addresses, domain names, IP addresses, or organizations.

Social Engineer Toolkit (SET) is an open-source pentesting framework for creating realistic social engineering attacks quickly.

Evilginx2 is a standalone man-in-the-middle attack framework used primarily for phishing credentials and session hijacking.

Beelogger is a tool used for generating keyloggers to capture keystrokes from target systems.

Gophish is an open-source phishing framework designed for running and managing phishing campaigns.

Modlishka is a flexible and powerful reverse proxy designed for real-time phishing, including bypassing two-factor authentication (2FA).

King Phisher is a toolkit for creating and managing phishing campaigns with customizable emails and server content.

Wifiphisher is a tool that automates phishing attacks against WiFi networks to steal credentials or capture traffic.

FiercePhish is a full-fledged phishing framework for managing and automating all phases of phishing campaigns.

Phishery is a TLS/SSL-enabled Basic Auth credential harvester used for phishing attacks.

Evilginx is a MITM attack framework designed for phishing credentials and session cookies from web services.

Catphish is a Ruby-based tool designed for phishing and corporate espionage.

SocialFish is a social media phishing framework that can be run on an Android phone or within a Docker container.

ReelPhish is a real-time phishing tool designed to bypass two-factor authentication (2FA).

Fiddler is a free, cross-platform web debugging proxy with user-friendly tools for inspecting and modifying network traffic.

Offensive Web Testing Framework (OWTF) is a Python-based penetration testing framework for web applications, built around the OWASP Testing Guide.

SQLmap is an automated tool for detecting and exploiting SQL injection vulnerabilities and taking over databases.

Wappalyzer is a tool that uncovers the technologies and software used on websites.

wafw00f is a tool used to identify and fingerprint Web Application Firewall (WAF) products on web applications.

Liffy is a tool designed specifically for exploiting Local File Inclusion (LFI) vulnerabilities.

GitTools is a set of tools designed to automatically find and download web-accessible .git repositories.

FuzzDB is a dictionary of attack patterns and primitives for black-box fault injection and resource discovery.

Raccoon is a high-performance offensive security tool designed for reconnaissance and vulnerability scanning.

Burp Suite is an integrated platform used for performing security testing of web applications.

WordPress Exploit Framework is a Ruby framework for creating and using modules to pentest WordPress sites.

Tplmap is an automated tool for exploiting server-side template injection vulnerabilities and taking over web servers.

WhatWeb is a website fingerprinting tool used to identify technologies and software running on websites.

fimap is a tool designed to find, audit, exploit, and automate the search for Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities.

Commix is an automated all-in-one tool for detecting and exploiting operating system command injection vulnerabilities.

NoSQLmap is an automated tool for detecting NoSQL injection vulnerabilities and taking over NoSQL databases.

webscreenshot is a simple script that captures screenshots of a list of websites.

WhatWaf is a tool used to detect and bypass web application firewalls and protection systems.

Browser Exploitation Framework (BeEF) is a command and control server used to deliver exploits and payloads to compromised web browsers.

WPSploit is a tool that integrates with Metasploit to exploit vulnerabilities in WordPress-powered websites.

Weevely3 is a weaponized web shell used for remote access and post-exploitation in compromised web environments.

BlindElephant is a web application fingerprinting tool that identifies versions of web applications by analyzing static files.

Kadabra is an automatic tool for scanning and exploiting Local File Inclusion (LFI) vulnerabilities.

DVCS Ripper is a tool used to rip and retrieve web-accessible distributed version control systems like SVN, GIT, HG, and BZR.

VHostScan is a virtual host scanner that detects catch-all scenarios, aliases, and dynamic default pages, with reverse lookup capabilities.

recursebuster is a content discovery tool used for directory and file brute-forcing on web servers.

badtouch is a scriptable network authentication cracker designed for testing and cracking network authentication protocols.

Hyperion is a runtime encryptor for 32-bit portable executables (PE files), used to obfuscate malware and bypass antivirus detection.

peCloakCapstone is a multi-platform fork of peCloak.py, designed for automating malware antivirus evasion.

AntiVirus Evasion Tool (AVET) is a tool for modifying Windows exploits to avoid antivirus detection.

Shellter is a dynamic shellcode injection tool and the first truly dynamic PE infector ever created, used for obfuscating executables.

peCloak.py automates the process of concealing malicious Windows executables to evade antivirus detection.

John the Ripper is a fast password cracking tool used for recovering weak passwords.

JWT Cracker is a simple brute force tool for cracking HS256 JWT tokens.

Hashcat is a highly efficient and fast hash cracking tool used for password recovery and cryptographic hash cracking.

BruteForce Wallet is a tool used to find the password of an encrypted wallet file, such as wallet.dat.

CeWL is a tool that generates custom wordlists by spidering a target's website and extracting unique words.

StegCracker is a steganography brute-force tool used to uncover hidden data within files.

Dnschef is a highly configurable DNS proxy designed for penetration testers to spoof and monitor DNS traffic.

Mallory is an HTTP/HTTPS proxy that operates over SSH for secure interception and manipulation of web traffic.

Ettercap is a comprehensive and mature suite designed for conducting machine-in-the-middle (MITM) attacks on networks.

Lambda-Proxy is a utility used for testing SQL injection vulnerabilities in AWS Lambda serverless functions.

mitmproxy is an interactive TLS-capable HTTP proxy for intercepting and analyzing web traffic.

SSH MITM is a tool that intercepts SSH connections via a proxy, logging all plaintext passwords and session data to disk.

BetterCAP is a modular, portable, and easily extensible man-in-the-middle (MITM) attack framework.

Morpheus is an automated TCP/IP hijacking tool that uses Ettercap for network attacks.

Evilgrade is a modular framework that exploits weak software update mechanisms by injecting malicious fake updates.

MITMf is a framework specifically designed for performing man-in-the-middle (MITM) attacks.

Aircrack-ng is a suite of tools designed for auditing and securing wireless networks.

Wifite is an automated tool for launching wireless network attacks, including WEP, WPA, and WPS.

Cowpatty is a tool used to perform brute-force dictionary attacks against WPA-PSK (Pre-Shared Key) networks.

KRACK Detector is a tool used to detect and prevent KRACK attacks on WPA2 networks.

Kismet is a wireless network detector, sniffer, and intrusion detection system (IDS).

Fluxion is a suite of automated social engineering-based WPA attacks designed to capture WPA/WPA2 credentials.

Infernal-Twin is an automated wireless hacking tool designed for launching various WiFi attacks, including rogue access points.

wifi-arsenal is a collection of tools and resources specifically curated for Wi-Fi penetration testing.

Reaver is a tool used to perform brute-force attacks against WiFi Protected Setup (WPS) to recover WPA/WPA2 passphrases.

Airgeddon is a multi-use bash script for Linux systems designed to audit and attack wireless networks.

Airgeddon is a multi-use bash script for Linux systems designed to audit and attack wireless networks.

WiFi-Pumpkin is a framework designed to create rogue Wi-Fi access points for conducting man-in-the-middle and other wireless attacks.

Tor is free software and an onion-routed overlay network that helps protect users from traffic analysis and enhance privacy online.

Nipe is a script that redirects all network traffic from a machine through the Tor network for anonymity.

OnionScan is a tool used to investigate the Dark Web by identifying operational security issues in Tor hidden services.

Oregano is a Python module that acts as a machine-in-the-middle (MITM) to intercept and handle Tor client requests.

I2P is an anonymous overlay network for secure and private communication through encrypted routing.

kalitorify is a transparent proxy tool for Kali Linux that routes all network traffic through the Tor network.

Interactive Disassembler (IDA Pro) is a proprietary multi-processor disassembler and debugger, with a free version called IDA Free.

x64dbg is an open-source x64/x32 debugger for Windows.

Plasma is an interactive disassembler for x86, ARM, and MIPS architectures, generating indented pseudo-code with colored syntax.

Binwalk is a fast, easy-to-use tool for analyzing, reverse engineering, and extracting firmware images.

Capstone is a lightweight, multi-platform, and multi-architecture disassembly framework.

Boxxy is a linkable sandbox exploration tool used to analyze and inspect sandboxed environments.

WDK/WinDbg is the Windows Driver Kit and a powerful Windows debugger tool.

Evan's Debugger is an OllyDbg-like debugger designed for GNU/Linux systems.

PEDA (Python Exploit Development Assistance for GDB) is a Python-based tool that enhances GDB with exploit development features.

PyREBox is a Python-scriptable reverse engineering sandbox developed by Cisco-Talos for dynamic malware analysis and system inspection.

rVMI is a robust debugger for inspecting userspace processes, kernel drivers, and preboot environments in one tool.

pwndbg is a GDB plugin that simplifies debugging for low-level developers, hardware hackers, and exploit developers.

Radare2 is an open-source, cross-platform reverse engineering framework.

Medusa is an open-source, cross-platform interactive disassembler used for reverse engineering.

dnSpy is a tool used to reverse engineer and debug .NET assemblies.

Voltron is an extensible debugger user interface (UI) toolkit written in Python, designed to enhance various debuggers.

Frida is a dynamic instrumentation toolkit for developers, reverse engineers, and security researchers.

DET is a proof-of-concept tool for performing data exfiltration using single or multiple channels simultaneously.

Iodine tunnels IPv4 data through DNS, useful for exfiltration in firewalled networks that allow DNS queries.

pwnat is a tool that punches holes in firewalls and NATs, enabling unsolicited inbound connections.

tgcd is a simple Unix network utility that extends the accessibility of TCP/IP-based network services through firewalls.

tcpdump/libpcap is a commonly used command-line packet analyzer for capturing and analyzing network traffic.

Dshell is a network forensic analysis framework used to investigate and analyze network traffic.

sniffglue is a secure, multithreaded packet sniffer designed for efficient network traffic analysis.

Wireshark is a widely-used, graphical, cross-platform network protocol analyzer for capturing and analyzing network traffic.

Debookee is a simple yet powerful network traffic analyzer designed for macOS.

netsniff-ng is a versatile tool, often called the Swiss army knife, for network sniffing and traffic analysis.

Netzob is a tool for reverse engineering, traffic generation, and fuzzing of communication protocols.

SSLyze is a fast and comprehensive TLS/SSL configuration analyzer used to identify security misconfigurations.

Crackpkcs12 is a multithreaded tool used to crack PKCS#12 files (with .p12 and .pfx extensions), like TLS/SSL certificates.

tls_prober is a tool used to fingerprint a server's SSL/TLS implementation for security analysis.

testssl.sh is a command-line tool that checks a server's TLS/SSL ciphers, protocols, and cryptographic flaws.

ChipWhisperer is a complete open-source toolchain for conducting side-channel power analysis and glitching attacks.

ctf-tools is a collection of scripts for quickly installing security research tools on new machines.

shellpop is a tool that quickly generates sophisticated reverse or bind shell commands to streamline penetration testing.

Pwntools is a rapid exploit development framework designed for use in Capture The Flag (CTF) competitions.

RsaCtfTool is a tool used to decrypt data encrypted with weak RSA keys and recover private keys from public keys using automated attacks.