Tools

Filter security tools by category.

1–100 of 5,923

ImpactToolCategoryStarsUpdated

Reaches othersAdGuard Homeadguardteam/adguardhomeA self-hosted DNS server that blocks DNS lookups for ads, trackers, and dangerous domains across a whole home or small-office network.Defense and hardening / Network37,6852026-10-23 Local onlyAutheliaauthelia/autheliaAn authentication server that works with your reverse proxy to put a login portal and multi-factor authentication in front of your own web apps. It also provides single sign-on and OpenID Connect.Defense and hardening / AppSec and DevSecOps29,4012026-10-25 Local onlyCyberChefgchq/cyberchefA web app for converting and analyzing data by chaining operations such as Base64 and hex decoding, hashing, and text extraction into a "recipe". Processing happens in your browser.Cryptography and passwords / Forensics36,2032026-10-23 Local onlyGhidraNationalSecurityAgency/ghidraA software reverse engineering suite from the NSA that disassembles and decompiles compiled programs so you can read what they do.Reverse engineering / Learning and practice labs94,1332026-10-22 Local onlyGitleaksgitleaks/gitleaksA command-line tool that finds passwords, API keys, and tokens that have slipped into Git repositories and files.Vulnerability scanning30,3152026-10-23 Local onlyInfisicalinfisical/infisicalA secrets management platform that keeps API keys and passwords in one place and hands them to apps and CI at runtime. Use Infisical Cloud or run it yourself.Defense and hardening / AppSec and DevSecOps29,9812026-10-25 Reaches othersJumpServerjumpserver/jumpserverAn open-source bastion host (privileged access management, PAM) that funnels operators' access to servers and databases through one place and records who did what and when.Defense and hardening31,8322026-10-23 Local onlyKeycloakkeycloak/keycloakA self-hosted identity and access management server that handles login for your apps, with single sign-on, multi-factor authentication, identity brokering, and user management.Defense and hardening / AppSec and DevSecOps37,5052026-10-25 Local onlyMobSFMobSF/Mobile-Security-Framework-MobSFA mobile app security tool that analyzes Android and iOS apps and lists risky permissions, settings, and code issues. You use it from a web browser.Reverse engineering / Vulnerability scanning22,0322026-10-25 Reaches othersNmapnmap/nmapThe standard scanner for finding hosts on a network, the ports they have open, and the services running on them.Network / Reconnaissance13,8712026-10-24 Can harm othersNucleiprojectdiscovery/nucleiA command-line scanner that sends requests following steps written in YAML templates and checks the responses for known vulnerabilities and misconfigurations.Vulnerability scanning / Web security32,3012026-10-25 Local onlyosqueryosquery/osqueryA tool that lets you query the state of an operating system, such as running processes, listening ports, users, and startup items, with SQL.Defense and hardening / Incident response23,6742026-10-23 Local onlyOSV-Scannergoogle/osv-scannerA command-line tool from Google that reads your project's dependencies and checks them against the OSV.dev vulnerability database.Vulnerability scanning11,2642026-10-24 Local onlyOWASP Juice Shopjuice-shop/juice-shopAn intentionally vulnerable online shop for practice. Run it on your own computer to learn how web vulnerabilities work and to try out security testing tools.Learning and practice labs / Web security14,2282026-10-23 Reaches othersProwlerprowler-cloud/prowlerAn audit tool that reads the configuration of AWS, Azure, Google Cloud, and other clouds and lists the settings that fail security standards.Containers and cloud15,0942026-10-25 Reaches othersSafeLinechaitin/safelineA self-hosted, reverse-proxy WAF that sits in front of your own web app, inspects incoming HTTP requests, and blocks attacks. You install it on your own Linux server with Docker.Defense and hardening / Web security22,9482026-10-22 Local onlyShellCheckkoalaman/shellcheckA static analysis tool that reads sh and bash scripts without running them and points out common mistakes such as missing quotes and dangerous patterns.AppSec and DevSecOps40,2352026-10-19 Reaches othersSniffnetgyulyvgc/sniffnetA desktop app that lists your computer's network traffic by remote country, domain, and program. It does not show packet contents.Network / Defense and hardening41,6912026-10-21 Reaches othersSuricataOISF/suricataAn intrusion detection and prevention engine (IDS/IPS) that matches network traffic against rules and records suspicious activity as alerts.Network6,7732026-10-23 Local onlyTrivyaquasecurity/trivyA scanner that finds vulnerabilities, misconfigurations, and embedded secrets in container images, code, and Kubernetes.Vulnerability scanning / Containers and cloud38,7032026-10-23 Reaches othersTruffleHogtrufflesecurity/trufflehogA scanner that finds leaked API keys and passwords in Git history, files, cloud storage, and more. It can also check whether a key it finds still works.Vulnerability scanning / AppSec and DevSecOps28,6982026-10-24 Local onlyuBlock Origingorhill/ublockA browser extension that uses filter lists to block ads, trackers, and malware sites inside your browser.Defense and hardening68,8212026-10-24 Reaches othersVulsfuture-architect/vulsAn agentless vulnerability scanner that checks the packages installed on a server and lists the ones affected by known CVEs.Vulnerability scanning12,3022026-10-21 Local onlyWazuhwazuh/wazuhA free security platform (SIEM/XDR) that collects logs, configuration, and vulnerability data from agents on your endpoints and shows it all in one dashboard.Vulnerability scanning / Forensics17,4102026-10-24 Reaches othersWeb-Checklissy93/web-checkAn OSINT tool that shows a website's public information, such as DNS, certificates, and headers, from a single URL.Reconnaissance / Web security35,2192026-10-25 Reaches othersWiresharkwireshark/wiresharkA packet analyzer that records network traffic and breaks each packet down by protocol so you can read it.Network / Forensics10,0822026-10-25 Can harm othersZAPzaproxy/zaproxyA free web app scanner that sits between your browser and a web app, records the traffic, and looks for vulnerabilities. Formerly OWASP ZAP, now ZAP by Checkmarx.Web security / Vulnerability scanning16,0252026-10-23 Not ratedbuild-your-own-xcodecrafters-io/build-your-own-xReview coming soon (opens GitHub in a new tab)Learning and practice labs555,7932026-07-14 Not ratedawesomesindresorhus/awesomeReview coming soon (opens GitHub in a new tab)Learning and practice labs523,7832026-09-02 Not ratedreamorluto/reaReview coming soon (opens GitHub in a new tab)Reverse engineering / AppSec and DevSecOps374,3232026-10-24 Not ratedawesome-pythonvinta/awesome-pythonReview coming soon (opens GitHub in a new tab)Learning and practice labs329,7982026-10-22 Not ratedawesome-selfhostedawesome-selfhosted/awesome-selfhostedReview coming soon (opens GitHub in a new tab)Learning and practice labs329,7682026-10-22 Not ratedthe-book-of-secret-knowledgetrimstray/the-book-of-secret-knowledgeReview coming soon (opens GitHub in a new tab)Learning and practice labs252,7342024-11-19 Not ratedcomputer-scienceossu/computer-scienceReview coming soon (opens GitHub in a new tab)Learning and practice labs210,2772026-07-14 Not ratedrustdeskrustdesk/rustdeskReview coming soon (opens GitHub in a new tab)Network126,7542026-10-24 Not ratedawesome-hackinghack-with-github/awesome-hackingReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Learning and practice labs123,4692026-07-26 Not ratedfrpfatedier/frpReview coming soon (opens GitHub in a new tab)Web security / Defense and hardening110,1022026-10-23 Not ratedsherlocksherlock-project/sherlockReview coming soon (opens GitHub in a new tab)Reconnaissance94,8112026-10-24 Not ratedbitcoinbitcoin/bitcoinReview coming soon (opens GitHub in a new tab)Cryptography and passwords90,4662026-10-23 Not ratedworldmonitorkoala73/worldmonitorReview coming soon (opens GitHub in a new tab)Reconnaissance89,3772026-10-24 Not rateddevops-exercisesbregman-arie/devops-exercisesReview coming soon (opens GitHub in a new tab)Containers and cloud84,9392025-12-27 Not ratedpayloadsallthethingsswisskyrepo/payloadsallthethingsReview coming soon (opens GitHub in a new tab)Exploits and PoCs / Learning and practice labs82,0162026-08-27 Not ratedhackingtoolz4nzu/hackingtoolReview coming soon (opens GitHub in a new tab)Cryptography and passwords81,3492026-10-15 Not ratednetdatanetdata/netdataReview coming soon (opens GitHub in a new tab)Containers and cloud81,1122026-10-24 Not ratedawesome-scalabilitybinhnguyennus/awesome-scalabilityReview coming soon (opens GitHub in a new tab)Learning and practice labs75,0232026-01-04 Not ratedseclistsdanielmiessler/seclistsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps74,3202026-10-23 Not ratedmobymoby/mobyReview coming soon (opens GitHub in a new tab)Containers and cloud72,1992026-10-22 Not ratedstrixusestrix/strixReview coming soon (opens GitHub in a new tab)Web security71,4862026-10-24 Not ratedtldrtldr-pages/tldrReview coming soon (opens GitHub in a new tab)Learning and practice labs64,0232026-10-24 Not ratedmagisktopjohnwu/magiskReview coming soon (opens GitHub in a new tab)Mobile security / Reverse engineering63,4482026-10-22 Not ratedgods-eye-viewbilawalsidhu/gods-eye-viewReview coming soon (opens GitHub in a new tab)Reconnaissance59,4112026-10-24 Not ratedimhexwerwolv/imhexReview coming soon (opens GitHub in a new tab)Network / Reverse engineering / AppSec and DevSecOps55,5452026-10-09 Not rateddivewagoodman/diveReview coming soon (opens GitHub in a new tab)Containers and cloud54,6682025-12-15 Not ratedwindowsdockur/windowsReview coming soon (opens GitHub in a new tab)Containers and cloud53,6742026-10-08 Not ratedcl4r1t4selder-plinius/cl4r1t4sReview coming soon (opens GitHub in a new tab)Reconnaissance51,4722026-09-22 Not ratedjadxskylot/jadxReview coming soon (opens GitHub in a new tab)Reverse engineering51,2232026-10-23 Not ratedx64dbgx64dbg/x64dbgReview coming soon (opens GitHub in a new tab)Malware analysis / Reverse engineering50,0052026-10-20 Not ratedshannonkeygraphhq/shannonReview coming soon (opens GitHub in a new tab)Web security / Vulnerability scanning49,2902026-10-15 Not ratedbrunousebruno/brunoReview coming soon (opens GitHub in a new tab)Web security47,8172026-10-23 Not ratedbig-list-of-naughty-stringsminimaxir/big-list-of-naughty-stringsReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps / Web security47,7212024-04-18 Not ratedserverlessserverless/serverlessReview coming soon (opens GitHub in a new tab)Containers and cloud46,9222026-10-23 Not ratedv2ray-corev2ray/v2ray-coreReview coming soon (opens GitHub in a new tab)Web security46,9022026-08-31 Not ratedmitmproxymitmproxy/mitmproxyReview coming soon (opens GitHub in a new tab)Web security / Cryptography and passwords46,2582026-10-23 Not ratedjsoncrack.comaykutsarac/jsoncrack.comReview coming soon (opens GitHub in a new tab)Reverse engineering44,5182026-09-14 Not ratedkongkong/kongReview coming soon (opens GitHub in a new tab)Containers and cloud44,2962026-10-19 Not ratedcurlcurl/curlReview coming soon (opens GitHub in a new tab)Network43,2242026-10-23 Not ratedreverse-skillzhaoxuya520/reverse-skillReview coming soon (opens GitHub in a new tab)Learning and practice labs / Reverse engineering43,1652026-09-22 Not ratedsecurity-audit-skillcloudflare/security-audit-skillReview coming soon (opens GitHub in a new tab)AppSec and DevSecOps42,5542026-09-14 Not ratedcheat.shchubin/cheat.shReview coming soon (opens GitHub in a new tab)Learning and practice labs41,8282026-09-22 Not ratedoutlineoutline/outlineReview coming soon (opens GitHub in a new tab)Containers and cloud41,0452026-10-24 Not ratedmaigretsoxoj/maigretReview coming soon (opens GitHub in a new tab)Reconnaissance39,3222026-10-23 Not ratedmetasploit-frameworkrapid7/metasploit-frameworkReview coming soon (opens GitHub in a new tab)Exploits and PoCs / Red teaming and C239,2192026-10-23 Not ratedpython-cheatsheetgto76/python-cheatsheetReview coming soon (opens GitHub in a new tab)Learning and practice labs38,7702026-07-29 Not ratedsqlmapsqlmapproject/sqlmapReview coming soon (opens GitHub in a new tab)Web security38,7702026-10-22 Not ratedportainerportainer/portainerReview coming soon (opens GitHub in a new tab)Containers and cloud38,7072026-10-23 Not ratedharnessharness/harnessReview coming soon (opens GitHub in a new tab)Containers and cloud38,6842026-10-23 Not ratedclihttpie/cliReview coming soon (opens GitHub in a new tab)Web security38,6702024-12-17 Not ratedcomposedocker/composeReview coming soon (opens GitHub in a new tab)Containers and cloud38,4482026-10-22 Not ratedawesome-shellalebcay/awesome-shellReview coming soon (opens GitHub in a new tab)Learning and practice labs37,8312025-08-28 Not ratedpdfmathtranslatepdfmathtranslate/pdfmathtranslateReview coming soon (opens GitHub in a new tab)Reverse engineering37,8082026-10-24 Not ratedfirecrackerfirecracker-microvm/firecrackerReview coming soon (opens GitHub in a new tab)Malware analysis37,5852026-10-24 Not ratedlinux-commandjaywcjlove/linux-commandReview coming soon (opens GitHub in a new tab)Network37,1732026-10-22 Not ratedawesome-dockerveggiemonk/awesome-dockerReview coming soon (opens GitHub in a new tab)Containers and cloud / Learning and practice labs37,0962026-10-14 Not ratedbitchatpermissionlesstech/bitchatReview coming soon (opens GitHub in a new tab)Network36,7522026-10-24 Not ratedhereticp-e-w/hereticReview coming soon (opens GitHub in a new tab)Red teaming and C236,3362026-10-24 Not ratedawesome-sysadminawesome-foss/awesome-sysadminReview coming soon (opens GitHub in a new tab)Learning and practice labs35,4822026-10-22 Not ratedanthropic-cybersecurity-skillsmukul975/anthropic-cybersecurity-skillsReview coming soon (opens GitHub in a new tab)Reconnaissance / Containers and cloud / Malware analysis34,9212026-08-31 Not ratednpsehang-io/npsReview coming soon (opens GitHub in a new tab)Reconnaissance / Network / Defense and hardening34,2562024-05-30 Not ratedawesome-awesomenessbayandin/awesome-awesomenessReview coming soon (opens GitHub in a new tab)Learning and practice labs33,7422024-06-02 Not ratedcheatsheetseriesowasp/cheatsheetseriesReview coming soon (opens GitHub in a new tab)Learning and practice labs33,7242026-10-23 Not ratedawesome-phpziadoz/awesome-phpReview coming soon (opens GitHub in a new tab)Learning and practice labs32,7622026-09-27 Not ratedpentagivxcontrol/pentagiReview coming soon (opens GitHub in a new tab)Web security32,1972026-10-22 Not ratedhow-to-secure-a-linux-serverimthenachoman/how-to-secure-a-linux-serverReview coming soon (opens GitHub in a new tab)Defense and hardening31,8362026-09-07 Not ratedhostsstevenblack/hostsReview coming soon (opens GitHub in a new tab)Defense and hardening31,2982026-10-20 Not ratedopensslopenssl/opensslReview coming soon (opens GitHub in a new tab)Cryptography and passwords31,0402026-10-23 Not ratedawesome-osintjivoi/awesome-osintReview coming soon (opens GitHub in a new tab)Reconnaissance / Learning and practice labs30,4392026-10-22 Not ratedh4ckerthe-art-of-hacking/h4ckerReview coming soon (opens GitHub in a new tab)Vulnerability scanning / Learning and practice labs29,8932026-10-23 Not rateddnspydnspy/dnspyReview coming soon (opens GitHub in a new tab)Reverse engineering29,6602020-12-20 Not ratednginxconfig.iodigitalocean/nginxconfig.ioReview coming soon (opens GitHub in a new tab)Web security28,2562024-12-14 Not ratedawesome-pentestenaqx/awesome-pentestReview coming soon (opens GitHub in a new tab)Learning and practice labs27,5302026-07-25