Open Source Tools
Categories
Web application testing
Proxies, scanners and fuzzers used to test web applications and APIs for vulnerabilities during development and authorised assessments.
7 tools · mitmproxy, sqlmap, Nuclei
Vulnerability scanning
Scanners that check hosts, services and applications against known vulnerabilities and misconfigurations, plus platforms that track the findings.
8 tools · Metasploit Framework, Nuclei, ZAP
Network scanning and analysis
Port scanners, host discovery and packet analysis tools for mapping and understanding networks you are responsible for.
7 tools · mitmproxy, masscan, RustScan
IDS, IPS and network monitoring
Network intrusion detection and prevention engines and traffic analysis frameworks that turn packets into alerts and logs.
6 tools · CrowdSec, Wireshark, Zeek
Static code analysis (SAST)
Tools that read source code to find insecure patterns and bug classes before the code ships.
5 tools · Semgrep, gosec, Bandit
Dependencies and SBOM (SCA)
Software composition analysis: inventory the open-source components in your software, produce SBOMs and match them against vulnerability databases.
8 tools · Trivy, Grype, OSV-Scanner
Secrets detection
Scanners that find API keys, tokens and passwords committed to repositories, images and other storage.
5 tools · Trivy, Gitleaks, Infisical
Container and Kubernetes security
Image scanning, cluster posture checks and runtime threat detection for containers and Kubernetes.
6 tools · Trivy, Grype, Kubescape
Cloud and IaC security
Cloud security posture checks and infrastructure-as-code scanners that catch misconfigurations before and after deployment.
8 tools · Trivy, Nuclei, Prowler
SIEM, XDR and log management
Platforms that collect logs and endpoint telemetry, correlate events and raise alerts for a security operations team.
3 tools · Wazuh, Graylog, Security Onion
Endpoint visibility and response
Agents and frameworks that query, monitor and collect evidence from endpoints at scale.
4 tools · osquery, Wazuh, Falco
Threat intelligence platforms
Platforms to store, enrich, correlate and share indicators, reports and threat actor knowledge.
4 tools · SpiderFoot, OpenCTI, YARA
OSINT and attack surface discovery
Tools that map an organisation's external footprint from public sources: domains, subdomains, hosts, emails and exposed services.
6 tools · masscan, SpiderFoot, theHarvester
Digital forensics and incident response
Disk, memory and timeline analysis tools used to investigate incidents and preserve evidence.
10 tools · radare2, osquery, Wireshark
Reverse engineering and malware analysis
Disassemblers, decompilers and pattern-matching tools used to analyse binaries and classify malware.
6 tools · Ghidra, Apktool, radare2
Passwords and credential auditing
Password managers and password-hash auditing tools used to test the strength of credentials you are authorised to assess.
3 tools · KeePassXC, hashcat, John the Ripper
Identity, access and secrets management
Single sign-on and identity providers, plus vaults that store and distribute secrets, keys and certificates.
6 tools · Keycloak, HashiCorp Vault, Infisical
WAF and edge protection
Web application firewalls and behaviour-based blocking engines that filter malicious traffic in front of applications.
4 tools · CrowdSec, BunkerWeb, ModSecurity
Fuzzing
Coverage-guided and property-based fuzzers that generate inputs to find crashes and broken invariants.
3 tools · Foundry, AFL++, Echidna
Smart contract security
Static analysers, fuzzers, symbolic execution engines and test frameworks for Solidity and EVM smart contracts.
6 tools · Foundry, Slither, Mythril
Mobile application security
Static and dynamic analysis tools for Android and iOS applications.
3 tools · Apktool, Frida, MobSF
Adversary emulation and security testing
Frameworks used by red and purple teams to emulate attacker techniques and test detections in authorised engagements.
4 tools · Metasploit Framework, Gophish, Atomic Red Team
Training and practice labs
Deliberately vulnerable applications for learning, training and testing security tools safely.
1 tools · OWASP Juice Shop