Tools

Template-driven vulnerability scanning built to run at scale

Scales better than anything else in this space, but it only ever finds what someone already wrote a template for. A starting point, not a finish line.

Passive subdomain enumeration with sane defaults

Wire your own API keys in. The free sources alone miss a lot, and you will not know what you missed.

Fast HTTP probing and filtering

The glue between enumeration and everything downstream. Probe, filter on status and title, pipe onward.

In-depth attack surface mapping

The most thorough subdomain enumeration available and by far the slowest. Reach for it when coverage matters more than the clock.

Fast web fuzzer for content and parameter discovery

Rarely the bottleneck — your wordlist is.

Automated SQL injection detection and exploitation

Still unmatched once you have confirmed an injection point. Do not aim it blind; high --risk and --level generate a lot of noise for very little return.

Automated command injection exploitation

What sqlmap is to SQLi. Narrower use case, but it saves real time when the bug class fits.

API route discovery using real request shapes

Finds API routes that directory brute forcing walks straight past, because it replays real request shapes instead of guessing paths.

Interactive GraphQL endpoint testing

Useful the moment introspection is open. If introspection is disabled it has much less to offer, and that is increasingly common.

Python classes for working with network protocols

The library nearly everything else is built on. Learn the example scripts and half of AD testing becomes scriptable.

Attack path mapping for Active Directory

Turns "is this reachable" into a graph query. Collection is the risky half — plan how you run it before you run it.

Network service enumeration and exploitation at scale

The maintained continuation of CrackMapExec. First thing to reach for once you have a foothold and a credential.

Raw Kerberos interaction and abuse

Kerberos abuse in a single binary. Loud by default — know what your target's detection looks like before you run it.

AD Certificate Services enumeration and abuse

ADCS misconfiguration is still one of the most reliable routes to domain admin, and this is what finds it.

LLMNR, NBT-NS and MDNS poisoner

Effective and completely indiscriminate. Scope it carefully — this is the tool most likely to cause an incident on someone else's network.

Network discovery and security auditing

Still the reference. NSE is the part most people never touch and it is where the depth is.

Internet-scale port scanner

For when the range is too large for Nmap. Confirm anything it reports with a real scan — speed costs accuracy.

Multi-cloud security posture auditing

Good for breadth across AWS, Azure and GCP in one pass. Thin on what to actually do with a finding.

Cloud security assessment mapped to compliance frameworks

Deeper on AWS than Scout Suite and mapped to frameworks, which matters when the report has to speak to auditors as well as engineers.

AWS exploitation framework

The exploitation half of AWS testing, picking up where the posture scanners stop at findings.

Automated static and dynamic mobile app analysis

Fastest way to triage an APK or IPA. Treat everything it reports as a lead, not a finding.

Dynamic instrumentation toolkit

The layer most mobile work stands on — pinning bypasses, runtime hooks, method tracing.

Dex to Java decompiler

Best Android decompiler available. Read the source before you touch the runtime; it usually answers the question faster.

Collection of wordlists for security testing

Not a tool, a dependency. Most of this page is only as good as what you feed it.

GPU-accelerated password recovery

The standard. Rule files matter far more than raw hash rate.

Password cracker with very broad format support

Better coverage of odd hash formats than hashcat, slower on GPU. Keep both installed.

winPEAS and linPEAS privilege escalation enumeration

Deliberately verbose. The colour coding is the only reason the output is usable — learn what the highlights mean.

Unix binaries that can bypass local security restrictions

Not a tool, a lookup. First place to check when you have a binary and a sudo rule.

Cross-platform adversary emulation framework

The realistic open-source answer to Cobalt Strike, and actively maintained.

Modern C2 framework with a strong operator UI

Capable, and the demon agent is well built — but the repository is archived, so treat it as unmaintained before you build a workflow on it.

GDB plugin for exploit development

Makes gdb genuinely usable for exploitation work. Heap inspection alone justifies installing it.

Reverse engineering framework

Steep curve and no licence cost. If you are not committed to learning the keybindings, Ghidra is the gentler road to the same place.

Generic signature format for SIEM detection rules

Reading detection rules is the cheapest way to learn what your own activity is expected to trip.

Endpoint visibility, hunting and digital forensics

Worth knowing from the offensive side, because it is often what is looking for you.