Security Tooling

Free checks for compliance readiness, header quality, CMS weaknesses, and common cryptographic issues.

Comprehensive domain assessment across HTTP headers, TLS, DNSSEC, and email security records.

External perimeter scanner for malware indicators, defacement checks, spam injection, and blocklist status.

Sandboxed URL analysis with network traces, DOM activity, and third-party script visibility.

Industry-standard SSL and TLS grading for cert chains, protocols, ciphers, and known cryptographic risks.

Checks if your domain is eligible for HSTS preload submission in major browsers.

Verifies certificate deployment, intermediate chain completeness, and server-side TLS setup.

Command-line deep TLS inspection for protocols, ciphers, and common cryptographic vulnerabilities.

Validates SPF, DKIM, DMARC, and broader domain-layer configuration used to prevent spoofing.

Specialized DMARC parser and validator for email authentication governance.

Google-hosted diagnostics for mail routing, DNS records, and anti-spoofing controls.

Recon-focused DNS asset discovery to reveal related hosts and potentially forgotten subdomains.

Tests websites and mail servers for modern standards including IPv6, DNSSEC, HTTPS, DMARC, DKIM, SPF, and STARTTLS.

Free light scans for website vulnerabilities, passive fingerprinting, and subdomain discovery.

Automated EASM and DAST monitoring built by ethical hackers, including emerging CVE checks.

Scans code, dependencies, containers, and infrastructure definitions for known vulnerabilities.

Postman is an API platform for developers to design, build, test and iterate their APIs.

EthicalCheck performs automated, instantaneous API security scans covering the OWASP API Top 10.

Converts mitmproxy captures to OpenAPI 3.0 specifications. Automatically reverse-engineer REST APIs by just running the apps and capturing the traffic.

TruffleHog helps discover exposed secrets.

Industry-standard web application security testing platform with intercepting proxy, scanner, and repeater tools.

Free open-source web application scanner and proxy for finding vulnerabilities in web applications during development.

Web-based Swiss Army knife for encoding, decoding, hashing, data transformation, and cryptographic analysis.

Intentionally insecure web application for learning and practicing web security testing techniques.

Damn Vulnerable Web Application - deliberately vulnerable PHP/MySQL web app for security training.

OWASP's modern vulnerable web application for security training with progressive difficulty levels.

FoxyProxy is an advanced proxy management tool that completely replaces Firefox's limited proxying capabilities.

mitmproxy is a free and open source interactive HTTPS proxy.

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions.

Reference database for matching site favicons to common web applications and technologies during reconnaissance and web security testing.

Burp Intruder is a tool for automating customized attacks against web applications. It can be used to perform a huge range of tasks, from simple brute-force guessing of web directories through to active exploitation of complex blind SQL injection vulnerabilities.

Wfuzz is a tool designed for bruteforcing Web Applications. It can be used to find resources not linked directories, servlets, scripts, etc., bruteforce GET and POST parameters for checking different kind of injections (SQL, XSS, LDAP,etc), bruteforce Forms parameters (User/Password), Fuzzing, etc.

JWT Tool is a toolkit for testing, tweaking and cracking JSON Web Tokens.

Docker-based XSS testing platform for detecting blind cross-site scripting vulnerabilities with automated payload generation, correlated injections, and email reports.

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

Interactive visual explorer for GraphQL APIs that renders schemas as entity relationship diagrams to aid in API reconnaissance and security review.

Tool for reconstructing GraphQL API schemas through introspection and field brute-forcing when introspection is disabled.

API endpoint discovery and content brute-forcing tool optimized for modern web applications and REST API route enumeration.

Lightweight web security auditing proxy with request replay, automation, and match-and-replace workflows.

Property-based API testing tool that generates test cases from OpenAPI and GraphQL schemas to find crashes and spec violations.

Parameter analysis and XSS scanner that verifies reflected, stored, and DOM-based XSS with low false positives.

Crawler that discovers endpoints from standard and headless browsing, including JavaScript-rendered routes, for wider test coverage.

Stateful REST API fuzzer from Microsoft that infers request dependencies from an OpenAPI spec to find security and reliability bugs.

Desktop utility for computing cryptographic hashes (MD5, SHA-1, SHA-2, SHA-3, BLAKE2) for files and text.

Web-based tool to generate and verify hashes including MD5, SHA-1, SHA-256, and other algorithms instantly.

Google's open-source toolkit for safe cryptographic key generation and usage across languages.

Industry-standard cryptography library and command-line tool for SSL, TLS, and general-purpose cryptographic operations.

Reference database and analysis tool for cryptocurrency cryptography, hashing algorithms, and blockchain verification.

Industry-leading offline password cracker supporting hundreds of hash types and password attack modes including dictionary and brute-force.

GPU-accelerated password recovery tool supporting the fastest hash cracking with advanced attack modes and mask support.

Parallel login cracker supporting dozens of protocols (SSH, HTTP, FTP, Telnet, LDAP) for online password testing.

Online hash cracking service with massive precomputed hash rainbow tables for common weak passwords.

Searchable repository of billions of leaked passwords and breached credentials to check if a password is compromised.

Uses precomputed rainbow tables for extremely fast password hash cracking across multiple formats.

Commercial password auditing tool for Windows passwords with GPU acceleration and dictionary attack capabilities.

Command-line tool that spiders websites to build custom wordlists for targeted password cracking attempts.

Simple, modern file encryption tool and format with small explicit keys and no configuration options to get wrong.

Open-source web application firewall engine supporting Apache, Nginx, and IIS with the OWASP Core Rule Set for real-time attack detection and mitigation.

Managed web application firewall on AWS that protects against common web exploits, bots, and layer 7 attacks with customizable rules and managed rule groups.

Cloud-based web application firewall with managed rulesets, custom rule support, OWASP Top 10 coverage, and real-time threat intelligence.

Open-source enterprise-grade WAF engine written in Go, compatible with ModSecurity rulesets and designed for cloud-native deployments.

Nginx module providing a lightweight, high-performance web application firewall with a focus on low overhead and simple rule management.

Google Cloud WAF and DDoS protection with preconfigured OWASP rules, rate limiting, and adaptive protection.

Managed WAF for Azure Front Door and Application Gateway with OWASP core rule sets and bot protection.

Edge and agent-based WAF and API protection with low false-positive detection, formerly Signal Sciences.

Open-source web application firewall built on NGINX with ModSecurity rules, bot protection, and secure defaults.

Comprehensive penetration testing platform with exploit modules, payloads, and post-exploitation capabilities for systematic testing.

Open-source vulnerability scanner providing comprehensive network and host assessment with CVE database integration.

Industry-leading vulnerability scanner with extensive plugin database and compliance checking capabilities.

Cloud-based vulnerability management with real-time scanning, asset inventory, and compliance tracking.

Rapid7 vulnerability scanner for identifying and prioritizing exposures across on-prem and cloud assets.

Official Common Vulnerabilities and Exposures catalog for researching standardized vulnerability identifiers, records, and references.

Database of known exploits and vulnerability proof-of-concepts for security research and penetration testing.

Template-based vulnerability scanning engine for web applications and API security testing.

Fast, customizable vulnerability scanner based on YAML templates for web, network, and cloud security testing.

Open-source web application vulnerability scanner that performs black-box testing for SQL injection, XSS, SSRF, and more.

Feature-rich web application security scanner framework with support for distributed scanning.

Authoritative list of vulnerabilities confirmed as exploited in the wild, available as JSON and CSV feeds for prioritization.

Exploit Prediction Scoring System that estimates the probability a CVE will be exploited in the next 30 days, with a free API.

Open source vulnerability database and API that maps vulnerabilities to precise package versions across ecosystems.

Open-source secrets management platform for securely storing, accessing, and rotating secrets, API keys, certificates, and encryption keys with dynamic secret generation.

AWS managed service for storing, retrieving, and rotating database credentials, API keys, and other secrets with automatic encryption using KMS.

Microsoft Azure service for safeguarding cryptographic keys, certificates, and secrets with hardware security module support and access policy controls.

Universal secrets manager that syncs environment variables and secrets across teams, services, and deployment environments with version control integration.

Open-source secrets management platform with end-to-end encryption, secret rotation, access controls, and integrations for modern development workflows.

Managed secret storage for Google Cloud with IAM access control, versioning, rotation notifications, and audit logging.

Secrets management for machine identities and DevOps pipelines with an open source edition and enterprise offering.

Encrypts values in YAML, JSON, ENV, and INI files using KMS, age, or PGP so secrets can be stored safely in Git.

End-to-end encrypted secrets manager for developers and DevOps teams with CLI and SDK access for pipelines.

Command-line tool for passive information gathering including emails, subdomains, and associated data.

Visual link analysis platform for investigating relationships in OSINT data and infrastructure mapping.

Internet intelligence platform for discovering exposed services, certificates, and infrastructure relationships.

Technology fingerprinting platform and browser extension for identifying frameworks, CMS platforms, analytics, and third-party services during reconnaissance.

Web archive used to review historical versions of sites, recover removed content, and discover legacy endpoints during reconnaissance.

General search engine commonly used for Google dorking to surface indexed files, exposed directories, login portals, and other reconnaissance targets.

GitHub's code and repository search used for GitHub dorking to find exposed secrets, sensitive files, misconfigurations, and technology clues.

Certificate transparency search engine used to enumerate certificates, discover subdomains, and pivot on related infrastructure.

Cyberspace search engine for identifying exposed assets, ports, and services across global internet space.

Asset discovery and subdomain enumeration framework for external attack surface reconnaissance.

Fast passive subdomain enumeration tool for reconnaissance and attack surface expansion.

Subdomain enumeration tool for gathering subdomains from search engines, certificate sources, and other passive recon data providers.

DNS enumeration tool for discovering hosts, brute-forcing subdomains, and mapping DNS records during reconnaissance.

High-performance directory, DNS, virtual host, and S3 bucket brute-force enumeration tool used in web and infrastructure reconnaissance.

Fast web fuzzer for content discovery, parameter fuzzing, and endpoint enumeration during application reconnaissance.

Modular reconnaissance framework with workspaces and data collection modules for OSINT operations.

Kiterunner is a tool that performs traditional content discovery, and also bruteforces routes/endpoints in modern applications.

Arjun helps find query parameters for URL endpoints.

The Google Hacking Database (GHDB) is a compiled list of common mistakes web/server admins make, which can be easily searched by using Google.

Search engine for internet-connected devices and services, useful for finding exposed assets and banners.

Automated OSINT collection tool with over 200 modules for domains, IPs, emails, and names.

The standard network scanner for host discovery, port scanning, service and version detection, and scriptable checks through the Nmap Scripting Engine.

Fast HTTP probing toolkit that checks which hosts respond and collects titles, status codes, technologies, and TLS details at scale.

Historical DNS, WHOIS, and subdomain data for mapping an organisation's internet-facing assets over time.

Kiosk system lockdown software that secures browsers, restricts OS access, and manages application whitelisting for self-service kiosk deployments.

Windows-based kiosk browser software with lockdown capabilities, remote management, content filtering, and payment integration for public-access terminals.

Windows lockdown utility that restricts system access to a single application or browser, preventing unauthorized desktop access on kiosk and digital signage systems.

Lightweight kiosk lockdown application for Windows and Android that restricts devices to a single app or browser with configurable security policies.

Android kiosk browser and app launcher with remote management, device lockdown, screensaver scheduling, and motion detection for kiosk and digital signage deployments.

Windows application whitelisting feature that restricts which applications users can run, commonly used to lock down kiosk and public-access endpoints.

Zero-trust application whitelisting and endpoint management platform that enforces least-privilege access for kiosk, retail, and public-facing terminal deployments.

Security scanning script for Docker containers and host configurations following CIS benchmarks.

Container and filesystem vulnerability scanner with comprehensive CVE detection.

Container image scanning integrated with CI/CD for vulnerability detection and remediation.

Runtime security engine for detecting suspicious process and container behavior.

Penetration testing tool for Kubernetes clusters that hunts for security weaknesses from outside and inside the cluster.

Static code analysis tool for infrastructure-as-code covering Terraform, CloudFormation, Kubernetes, Helm, and ARM templates.

Kubernetes security platform for misconfiguration scanning, vulnerability assessment, and compliance monitoring.

Static analysis tool from StackRox that checks Kubernetes YAML files and Helm charts against best practices and security misconfigurations before deployment.

Kubernetes penetration testing toolkit for assessing cluster security from both attacker and defender perspectives including service account exploitation and pod escape techniques.

Zero-dependency container penetration toolkit for security assessment of Docker and Kubernetes environments including privilege escalation, information gathering, and lateral movement.

Analyzes container images for vulnerabilities and base image updates, integrated with Docker Desktop and registries.

eBPF-based runtime security and forensics tool that detects suspicious behavior in containers and Linux hosts.

Checks Kubernetes cluster configuration against the CIS Kubernetes Benchmark and reports failing controls.

Dockerfile linter that flags insecure and non-reproducible patterns, such as running as root or unpinned base images.

Container image linter that checks built images against CIS Docker Benchmark and best-practice rules.

completely ridiculous API (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but each of the vulnerabilities can still be found in the wild. It's a good target while learning

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs.

Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications.

Pixi is a MongoDB, Express.js, Angular, Node (MEAN) stack web application that was designed with deliberately vulnerable APIs.

This is a "Goat" project so you can get familiar with REST API testing. There is an included Postman project so you can see how everything is meant to be called.

Damn Vulnerable Web Services is a vulnerable application with a web service and an API that can be used to learn about webservices/API related vulnerabilities.

Websheep is an app based on a willingly vulnerable ReSTful APIs.

Damn Vulnerable GraphQL Application for practicing GraphQL attacks such as introspection abuse, batching, and injection.

Free online training with interactive labs covering web vulnerabilities from SQL injection to request smuggling.

Hands-on labs, vulnerable machines, and guided academy courses for offensive and defensive security skills.

Beginner-friendly guided rooms and learning paths covering web, network, cloud, and SOC skills in the browser.

Vulnerable application that teaches how secrets leak across code, containers, Kubernetes, and cloud secret stores.

Intentionally vulnerable Kubernetes cluster for practising container and cluster attack and defence scenarios.

Lightweight static analysis tool that finds bugs, enforces code standards, and prevents security vulnerabilities across many languages.

GitHub's semantic code analysis engine for discovering vulnerabilities through query-based code exploration.

Continuous code quality and security inspection platform with rules for bugs, vulnerabilities, and code smells.

Security-focused static analysis tool for Python code that detects common security issues and anti-patterns.

Static analysis security scanner for Ruby on Rails applications that detects common vulnerabilities.

ESLint plugin that detects common security anti-patterns in JavaScript and TypeScript code during development.

SpotBugs plugin for Java that detects security vulnerabilities including injection, XSS, and cryptographic weaknesses.

Security scanner for Go source code that inspects the AST for common security issues and coding mistakes.

Lightweight static analysis tool for scanning source code for hardcoded secrets, credentials, and sensitive data patterns across multiple programming languages.

Static application security testing tool for Node.js applications that detects insecure code patterns using Semgrep rules and custom pattern matching.

Python static analysis tool with security-focused checkers that detect common vulnerabilities including unsafe deserialization, SQL injection risks, and insecure function usage.

Developer-first SAST that scans code in the IDE and pull requests with AI-assisted fix suggestions.

Integrated security features including code scanning, secret scanning, and dependency review directly in GitHub repositories.

Built-in application security testing including SAST, DAST, dependency scanning, and container scanning in CI/CD pipelines.

OWASP tool that identifies project dependencies and checks for known vulnerabilities using the NVD and other data sources.

Vulnerability scanner for container images and filesystems with comprehensive CVE detection and SBOM integration.

CLI tool for generating Software Bill of Materials (SBOM) from container images and filesystems.

Container signing, verification, and storage in an OCI registry for supply chain security with Sigstore.

Fast secret detection tool for git repositories that finds hardcoded secrets, API keys, and tokens in commit history.

Static analysis scanner for Terraform templates that detects security misconfigurations before deployment.

Automated checks that score open source projects on security practices like branch protection, pinned dependencies, and signed releases.

Monitors and restricts network egress and file activity on GitHub Actions runners to detect supply chain attacks.

Detects malicious and risky open source packages by analyzing package behavior such as install scripts and network access.

Scans lockfiles, SBOMs, and container images for known vulnerabilities using the open OSV.dev database.

Automated dependency update bot that opens pull requests for outdated packages, base images, and CI actions across many ecosystems.

Static analyser for GitHub Actions workflows that finds template injection, excessive permissions, and credential exposure risks.

OWASP platform that ingests SBOMs and continuously tracks component vulnerabilities and license risk across your portfolio.

LLM vulnerability scanner that probes large language models for hallucination, prompt injection, data leakage, and other weaknesses.

Microsoft's Python Risk Identification Tool for automated red teaming and safety testing of generative AI systems.

Testing framework for LLM prompts that evaluates model outputs for security, accuracy, and policy compliance.

Prompt injection detection API that protects LLM applications from adversarial prompt attacks and data exfiltration.

NVIDIA toolkit for adding programmable guardrails to LLM applications to control output and prevent unsafe behavior.

Input and output scanners for LLM applications covering prompt injection, PII leakage, toxicity, and secrets.

Open source testing framework that scans ML models and LLM apps for hallucination, bias, and injection vulnerabilities.

Python library for evaluating and defending ML models against evasion, poisoning, extraction, and inference attacks.

Scans machine learning model files such as pickle and H5 for unsafe code that runs when the model is loaded.

Framework for validating LLM inputs and outputs with configurable checks for structure, PII, toxicity, and more.

Script for searching extracted firmware filesystems for potentially sensitive files, credentials, and configuration weaknesses.

Automated firmware analysis framework for static analysis, unpacking, entropy detection, and software identification in IoT firmware images.

Firmware analysis tool for extracting embedded filesystems and identifying file signatures, compression, and executable code within firmware images.

Comprehensive methodology and checklist for assessing IoT device security covering web interfaces, network services, firmware, and ecosystem communication.

GUI-based MQTT client for exploring, testing, and debugging IoT broker topics, payloads, and authentication mechanisms.

IoT security testing framework with plugins for assessing IoT protocols including MQTT, CoAP, BLE, and hardware interfaces.

Firmware security analyzer that extracts firmware and runs static and emulation-based checks for vulnerabilities.

NSA's open source reverse engineering suite for disassembling and decompiling firmware and binaries.

Network protocol analyser for capturing and inspecting device traffic, including MQTT, CoAP, BLE, and Zigbee with the right capture hardware.

Automated firmware emulation framework for running and dynamically testing embedded Linux web interfaces.

All-in-one scanner for container images, filesystems, git repositories, and Kubernetes clusters detecting vulnerabilities, misconfigurations, and secrets.

Kubernetes-native policy engine for validating, mutating, and generating Kubernetes configurations to enforce security policies.

Cloud-native runtime security tool that detects abnormal behavior, security violations, and threats in Kubernetes and container environments.

Open-source static analysis tool for detecting security misconfigurations in Terraform, CloudFormation, Kubernetes, Docker, and other IaC templates.

Kubernetes policy enforcement tool that validates manifests against best practices and security rules before deployment.

Open-source tool for validating Kubernetes best practices and security configurations across clusters and CI/CD pipelines.

Policy testing framework using OPA/Rego to validate configuration files including Kubernetes, Terraform, Docker, and CI/CD pipelines.

HashiCorp tool for securely storing and accessing secrets, API keys, certificates, and passwords with dynamic secret generation and automatic rotation.

Declarative GitOps continuous delivery tool for Kubernetes that automates deployment, monitoring, and lifecycle management of applications.

GitOps toolkit for Kubernetes that keeps clusters in sync with sources of truth using pull-based reconciliation and automated updates.

Kubernetes admission controller powered by Open Policy Agent that enforces custom policies and governance rules on cluster resources at deploy time.

Open-source software supply chain security platform that tracks, attests, and enforces compliance policies across CI/CD pipelines and artifact registries.

Framework for securing software supply chains by cryptographically verifying each step in the build and deployment pipeline using signed metadata and layout policies.

Open-source cloud security assessment tool for AWS, Azure, and GCP that evaluates security posture against CIS Benchmarks and best practices.

Multi-cloud security auditing tool that assesses AWS, Azure, GCP, and Alibaba Cloud configurations for security risks and misconfigurations.

Cloud security configuration scanner for AWS, Azure, GCP, and Oracle Cloud detecting misconfigurations, risky permissions, and compliance violations.

Query cloud infrastructure using SQL to audit security posture, compliance, and cost optimization across AWS, Azure, GCP, and other providers.

Rules engine for cloud security, governance, and management that enables automated policy enforcement across AWS, Azure, and GCP.

Tool for finding and auditing AWS S3 buckets for public access, permissions, and potential data exposure.

Python tool that consolidates infrastructure assets and their relationships into an intuitive graph view powered by a Neo4j database.

Open-source cloud asset inventory and compliance tool that transforms cloud configurations into a queryable SQL database for security analysis.

AWS service that identifies resources shared with external entities and helps detect overly permissive IAM policies and S3 bucket access.

Microsoft's prescriptive security baseline for Azure providing recommendations for identity management, network security, data protection, and monitoring.

Agentless cloud security platform providing full-stack visibility, risk prioritization, and remediation across AWS, Azure, GCP, and Kubernetes environments.

Agentless cloud security platform using SideScanning technology to detect vulnerabilities, misconfigurations, and exposed data across multi-cloud environments.

Cloud infrastructure-as-code security platform by Palo Alto Networks that scans Terraform, CloudFormation, and Kubernetes for misconfigurations and policy violations.

Cloud-native security and compliance platform that continuously assesses infrastructure, containers, and cloud configurations using policy-as-code with the Mondoo Query Language.

AWS exploitation framework for authorized testing of IAM privilege escalation and misconfigurations.

Finds exploitable attack paths in cloud infrastructure from an attacker's perspective across AWS, Azure, and GCP.

Analyses AWS IAM policies for least-privilege violations such as privilege escalation, data exfiltration, and resource exposure risks.

Models AWS IAM as a graph to find privilege escalation paths between principals.