111+ tools, organised by what you are trying to do.

Debian-based distribution preloaded with several hundred testing and forensics utilities. The usual baseline for a portable assessment VM.

Lighter security-focused Linux bundling privacy tooling, development stacks and forensics suites. A reasonable hardened daily driver.

Linux toolkit assembled specifically for malware analysis and reverse engineering. Saves a day of dependency wrangling.

Italian live distribution for digital forensics, with write-blocking defaults that keep evidence admissible.

The reference exploitation framework: modules, payload generation, post-exploitation and a scriptable console.

Python implementations of Windows network protocols. Indispensable for SMB, MSRPC and Kerberos work on internal engagements.

Maintained successor to CrackMapExec. Credential validation, enumeration and execution across a network at scale.

Open-source adversary emulation and C2 framework with cross-platform implants. Common Cobalt Strike alternative for red team work.

Modular, multi-agent C2 platform designed so operators can build and swap payload types per engagement.

Archived but still-referenced PowerShell post-exploitation modules. Study for technique; expect modern EDR to catch it as-is.

OWASP project for in-depth attack surface mapping: DNS enumeration, certificate transparency, ASN and infrastructure correlation.

Fast passive subdomain discovery pulling from a wide set of sources. Pairs naturally with httpx and nuclei.

Probes a host list for live HTTP services and reports status, title, technology and TLS detail in one pass.

Template-driven scanner for known issues and misconfigurations. Excellent for coverage; still not an assessment on its own.

DNS enumeration covering zone transfers, brute force, cache snooping and reverse lookups.

Search engine for internet-connected hosts. Use it to find exposure your client does not know they have.

Collects email addresses, hostnames and employee names from public sources for social-engineering scope definition.

Automates OSINT collection across a large module set and correlates results into a browsable graph.

Offensive OSINT tooling for Google account footprints. Cited for awareness of what an attacker can learn — mind local privacy law.

Validates whether discovered API keys and credentials are actually live before you report them.

Finds and verifies leaked credentials across repositories, buckets and CI logs.

The industry-standard web proxy: intercept, repeat, fuzz and extend. The Community edition is enough to learn on.

Free, fully featured alternative to Burp with strong automation and a scriptable API for CI integration.

Scriptable interactive proxy driven from the terminal. Best choice for mobile and non-browser clients.

Modern lightweight web proxy with a project-based workflow. Increasingly common as a Burp alternative.

Fast web fuzzer for content discovery, parameter mining and virtual-host enumeration.

Recursive content discovery in Rust, with sensible defaults for large applications.

Automated SQL injection detection and exploitation. Powerful and noisy — always confirm scope before pointing it anywhere.

Injection and misconfiguration testing against MongoDB and similar document stores.

Server-side template injection detection and exploitation across common template engines.

Discovers hidden HTTP parameters that never appear in the documented API surface.

Thorough TLS configuration assessment from a single shell script. No installation, no cloud dependency.

Fast scriptable TLS scanner with structured JSON output, suited to continuous checking.

Quick external check of security headers and TLS posture, useful as a client-facing baseline.

Host discovery, port scanning, service fingerprinting and a scripting engine that covers a remarkable amount of ground.

Asynchronous scanner capable of internet-scale sweeps. Rate-limit deliberately or you will take something down.

Fast port sweep that hands open ports straight to nmap for detailed service work.

Packet analysis with deep protocol dissection. The tool that turns a suspicion into evidence.

Command-line capture available on essentially every host you will ever land on.

Python packet crafting and manipulation, for when you need a packet no tool will generate for you.

Graphs Active Directory relationships to reveal privilege-escalation paths that are invisible in the admin console.

The collector that feeds BloodHound, gathering sessions, ACLs, group membership and trust data.

Kerberos toolkit for ticket requests, Kerberoasting, AS-REP roasting and delegation abuse testing.

Enumerates and exploits Active Directory Certificate Services misconfigurations — a consistently underestimated escalation path.

LLMNR, NBT-NS and MDNS poisoner used to demonstrate credential capture. Authorised, scoped tests only.

The reference Windows credential-extraction research tool. Study it to understand what your EDR must catch.

Complete suite for Wi-Fi monitoring, capture, attack and cracking across WEP and WPA.

Patched access point for testing enterprise wireless: demonstrates what happens when clients skip certificate validation.

Wireless detection and sniffing across Wi-Fi, Bluetooth and SDR sources.

Multi-cloud security auditing across AWS, Azure, GCP and others, producing a browsable risk report.

Wide-coverage cloud security assessment with CIS and compliance mappings, runnable in CI.

AWS exploitation framework for testing privilege escalation and persistence paths after an initial foothold.

Models AWS IAM as a graph to answer 'who can reach admin, and by what route'.

Entra ID (Azure AD) exploration and enumeration framework, with a queryable local database.

Enumerates exploitable attack paths in cloud environments from an offensive operator's perspective.

Hunts for security weaknesses in Kubernetes clusters from inside or outside the cluster network.

Scans images, filesystems and IaC for vulnerabilities, misconfigurations and embedded secrets.

Kubernetes penetration testing tool focused on escalation and lateral movement from a compromised pod.

Runtime security monitoring for containers. Included here as the defensive counterpart worth recommending.

NSA-developed reverse engineering suite with a capable decompiler. Free, scriptable and genuinely competitive with commercial tools.

The long-standing commercial standard for disassembly and decompilation, with the widest processor support.

Modern commercial reversing platform with a strong intermediate language and a first-class Python API.

Open-source reversing framework driven entirely from the command line. Steep curve, enormous capability.

Graphical front end over the Rizin framework, giving radare-style analysis a workable interface.

Open-source Windows user-mode debugger, the practical successor to OllyDbg for 64-bit work.

Multi-architecture disassembly framework used as the engine inside a great many other tools.

Decompiles Android DEX and APK files to readable Java. The first tool to open on any mobile engagement.

Converts Android DEX to JAR so the wider Java tooling ecosystem becomes available.

Standalone Java decompiler with a graphical browser for class files and archives.

Java decompiler that handles modern language constructs other decompilers still stumble on.

Open-source .NET assembly browser and decompiler, actively maintained.

Maintained fork of dnSpy: .NET debugger and assembly editor that can patch and re-run in place.

Deobfuscator and unpacker for .NET assemblies protected by common commercial obfuscators.

Recovers Python source from compiled bytecode across a wide range of interpreter versions.

Firmware analysis: identifies and extracts embedded filesystems and compressed blobs from an image.

Declarative binary format description language that generates parsers in many target languages.

Dynamic instrumentation toolkit for hooking live processes. The backbone of practical mobile testing.

Binary analysis platform combining symbolic execution with static analysis for automated reasoning about code.

Fast, free Windows hex editor that handles disks and process memory as well as files.

Executable packer, and just as often the unpacker you need before analysis can begin.

Automated static and dynamic analysis for Android and iOS with a clear reporting front end. A solid first pass.

Frida-powered runtime exploration: bypass pinning, inspect storage and dump keychains without writing hooks by hand.

Decodes and rebuilds Android resources, so you can patch an app and repackage it for testing.

Forensic triage of mobile devices for signs of compromise. Defensive tooling, used in consented investigations.

GPU-accelerated password recovery supporting a very wide range of hash types and attack modes.

Long-standing password auditing tool with excellent format coverage and useful rule support.

Network login testing across many protocols. Watch account lockout policy before you run it.

Browser-based toolkit for encoding, decoding, encryption and data analysis. Ends most 'what format is this' questions.

Automated decryption and decoding that identifies the scheme for you. Useful in CTF triage.

Vendor-neutral detection rule format that converts to your SIEM's query language. The portable way to share detections.

Endpoint visibility and digital forensics at fleet scale, with a powerful query language for hunting.

Open-source security platform combining host monitoring, log analysis and file integrity checking.

Small, testable ATT&CK-mapped techniques for validating that your detections actually fire.

High-performance network IDS, IPS and traffic monitoring engine with a large open rule ecosystem.

Exposes operating system state as a SQL database, making fleet-wide hunting a matter of writing a query.

Graphical digital forensics platform built on The Sleuth Kit, with timeline and keyword analysis.

Command-line filesystem and volume analysis library underpinning much of the open forensics ecosystem.

Memory forensics framework for extracting processes, network state and injected code from a memory image.

Fast live-response artefact collector that gathers what matters without imaging the whole disk.

Wireless auditing platform for rogue access point and client-association testing during authorised assessments.

Keystroke injection device used to demonstrate the risk of unattended, unlocked workstations.

RFID research platform for assessing badge and access-control systems. Community firmware and toolchain.

Portable multi-tool for sub-GHz radio, RFID, NFC, infrared and GPIO research and education.

The shared vocabulary for adversary behaviour. Map findings to it and your client's blue team can act immediately.

Extensive practical methodology notes covering nearly every service and platform you will encounter.

Payload and bypass reference organised by vulnerability class. The most-opened tab on most engagements.

Unix binaries that can be abused to bypass local security restrictions. Essential for privilege escalation work.

The Windows equivalent: signed binaries, scripts and libraries that can be abused to live off the land.

Archive of public exploits and vulnerable software, maintained by Offensive Security.

Concise, well-maintained defensive guidance. What to hand a developer alongside a finding.

Broad searchable index of security tools, resources and CTF platforms.