↓Skip to main content

Awesome Security Products

2025-05-15·1176 words·6 mins

Author

bsecure.dk

Cyber Security are us!

Table of Contents

Table of Contents

More than 120 Awesome Security Products¹ (In alphabetical order)

¹ Most of them Open Source

Products
#

— A —
#

AC-Hunter — Active Countermeasures AC-Hunter

AD Explorer — Microsoft Active Directory Explorer

Adalanche — Adalanche: Attack path analysis engine visualizing data from core infrastructure

ADeleginator — ADeleginator: A tool to find insecure trustee and resource delegations in Active Directory

AIL project — AIL is a framework to collect, crawl, dig and analyse unstructured data

Arkime (formerly Moloch) — Network Analysis & Packet Capture

atomicgen.io — atomicgen.io: Create Atomic Red Team tests with ease

Atomic Purple Team — Atomic Purple Team Framework

Autopsy Digital Forensics — Autopsy® open source digital forensics platform.

— B —
#

Bash Bunny — The Bash Bunny from Hak5

Beaker — BeaKer combines Sysmon, and the Elastic Stack to provide insights into network traffic

Bloodhound — BloodHound uses graph theory to reveal relationships within Active Directory

bruteloops — BruteLoop library for efficient password brute force attacks

bruteshark — Bruteshark: Network Forensic Analysis Tool (NFAT)

Burp proxy — Burp Proxy operates as a web proxy server

Burp suite — Burp Suite: Test Web Appliations

— C —
#

C2 Matrix — The C2 Matrix Gitbook

Mitre Caldera — Caldera helps reduce time and resources needed for testing.

Canary Tokens — Canary Tokens - Generate your own tokens here

Canary Server — CanaryServer - SMB Server

CapLoader — CapLoader performs indexing of PCAP/PcapNG files and visualizes their contents

Casper Stager — PoC for persisting .NET payloads in Windows Notification Facility (WNF)

Checkov — Prevent cloud misconfigurations and find vulnerabilities during build-time

Chrome Backdoor — Chromebackdoor is a PoC of pentest tool

CirClean — USB key sanitizer

ClamAV — Open-source antivirus engine

Cloud Burst — red team framework for interacting with cloud providers

Cobalt Strike — Cobalt Strike: Software for Adversary Simulations and Red Team Operations

CrackMapExec — CrackMapExec, A swiss army knife for pentesting networks

CredKing — Password spraying using AWS Lambda for IP rotation

CredSniper — CredSniper: Phishing framework written with Flask and Jinja2 templating

— D —
#

DeppBluCli — DeepBlueCLI: a PowerShell Module for Threat Hunting via Windows Event Logs

dfTimeWolf — dfTimeWolf: framework for orchestrating forensic collection, processing and data export

DNSCat2 — dnscat2: DNS tunnel

— E —
#

Elastic Stack — Download the Elastic Agent for your chosen platform and format

Empire — Empire: Post-exploitation & adversary emulation framework

ESpy — Espy: Sysmon Network Log Collector and Adapter

Evilginx — evilginx: AiTM framework phishing credentials and session cookies, allowing bypass of MFA

EvilnoVNC — EvilnoVNC: Ready to go Phishing Platform.

— F —
#

Faraday — Open Source Vulnerability Manager

FFUF — A fast Web fuzzer written in Go. Fuzz Faster U Fool!

FireProx — FireProx: AWS API tool for on-the-fly HTTP pass-through proxies for unique IP rotation

Flipper Zero — Flipper Zero a Multi-tool Device for Geeks

FlowIntel — An open source platform to support analysts to organise their case and tasks

— G —
#

GhostPack — GhostPack: A collection of security related toolsets

GhostWriter — Ghostwriter: part of your team, manage clients, projects, reports, and infrastructure

GoDap — GoDap, Terminal User Interface (TUI) for LDAP

GoPhish — GoPhish, an Open-Source Phishing Framework

Greenbone Commuity Edition — Greenbone Vulnerability Management, formerly known as OpenVAS

Grype — Grype: A vulnerability scanner for container images and filesystems

— H —
#

HashCat — Hashcat, the world’s fastest and most advanced password recovery utility

HoneyBadger — Honeybadger is an application health monitoring tool built by developers for developers

HoneyPorts — HonyePorts: When a connection is made a FW rule blocking the source IP is created

— I —
#

ICS Advisory Project — ICSAP: CISA ICS Advisories visualized

ICS Network Protocal Parsers (ICSNPP) — Industrial Control Systems protocol parsers plugins for Zeek

ipscope: IP lookup and subdomain discovery — A powerful CLI tool written in Go for IP lookup and subdomain discovery

— J —
#

— K —
#

Kansa — A Powershell incident response framework

KerBrute — A tool to perform Kerberos pre-auth bruteforcing

Kismet — Kismet is a sniffer, WIDS, and wardriving tool for Wi-Fi, Bluetooth, Zigbee, RF, and more

KubeScape — Kubescape is an open-source Kubernetes security platform

— L —
#

Leviathan — Leviathan is a mass audit toolkit

Locksmith — Locksmith: The number 1 ADCS misconfiguration identification tool

Lookyloo — Lookyloo: Web i/f to capture a website and display a tree of domains that call each other

— M —
#

Malcolm — Malcolm is a powerful network traffic analysis tool suite for full packet capture artifacts

MailSniper — MailSniper is a penetration testing tool for Microsoft Exchange

Merlin — Merlin: Cross-platform post-exploitation HTTP/2 C2 server

Metasploit — metasploit - Penetration Testing Platform

modlishka — Modlishka is a powerful and flexible HTTP reverse proxy

MSOLSpray — MS Online Spray is a password spraying tool for Microsoft Online accounts.

MSTIC Jupyter and Python Security Tools — msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks

MISP — MISP - Open Source Threat Intelligence and Sharing Platform

— N —
#

NetFilter — The netfilter project is commonly associated with iptables and its successor nftables

NetworkMiner — network forensics tool that extracts artifacts from PCAPs

— O —
#

openBAS — OpenBAS: Create dynamic attack scenarios, ensuring effective responses during incidents

openCTI — OpenCTI - Open Source TIP

openEDR — OpenEDR is a full-blown EDR capability

OpenTIDE — OpenTIDE: Open Threat Informed Detection Engineering

openUBA — OpenUBA - A flexible open source UEBA platform used for Security Analytics

OPNSense — FreeBSD based firewall and routing platform.

OracleCommander — OracleCommander: query Oracle Databases

— P —
#

PacketFence — OracleCommander: query Oracle Databases

Pandora — Pandora is an analysis framework to discover if a file is suspicious

PFSense — pfSense: a free network firewall distribution

PingCastle — PingCastle: Active Directory Security Health Check

PlumHound — PlumHound - Bloodhound for Blue and Purple Teams

PolarProxy — Transparent TLS and SSL inspection proxy

PowerShellHunter — PowerShell tools to help defenders hunt smarter, hunt harder

pypykatz — Pypykatz: Mimikatz implementation in pure Python

— Q —
#

Qubes — Qubes OS is a free and open-source, security-oriented operating system

Qickemu — Quickemu: Quickly create and run optimised Windows, macOS and Linux virtual machines

— R —
#

RedELK — RedELK: Red Team’s SIEM

RendesvouzRat — RendesvousRAT: Self-healing RAT utilizing libp2p

Responder — Responder: LLMNR, NBT-NS and MDNS poisoner. HTTP/SMB/MSSQL/FTP/LDAP rogue AuthN

Respotter — Respotter is a Responder honeypot

RITA — Real Intelligence Threat Analytics (R-I-T-A)

ROADtools — ROADtools: Rogue Office 365 and Azure Active Directory tools

— S —
#

ScriptSentry — ScriptSentry: finds misconfigured and dangerous logon scripts

Sliver — Sliver: Adversary Emulation Framework

Social Engineer Toolkit — The Social-Engineer Toolkit (SET) repository from TrustedSec

Security Onion — Security Onion: Threat hunting, network security monitoring, and log management

SemGrep — Lightweight static analysis for many languages

SharpFruit — SharpFruit, a C# penetration testing tool

SharpHose — SharpHose, asynchronous Password Spraying Tool in C# for Windows Environments

Shuffle — General purpose security automation platform

Sigma — Sigma - Generic Signature Format for SIEM Systems

Silenttrinity — SilentTrinity, An asynchronous, collaborative post-exploitation agent

sneakycreeper — SneakyCreeper, get your APT on using social media as a tool for data exfiltration

sof-elk — SOF-ELK® is a “big data analytics” platform for InfoSec

Spam Assassin — anti-spam platform giving system administrators a filter to classify email and block spam

spraying toolkit — Scripts to make password spraying attacks a lot quicker, less painful and more efficient

sqlmap — SQLMAP, automatic SQL injection and database takeover tool

Suricata — Suricata is a high performance, FOSS network analysis and threat detection software

Syft — CLI tool and library for generating a Software Bill of Materials

— T —
#

Tachyon — Tachyon is a fast web application security reconnaissance tool

Tails — Tails is a portable operating system that protects against surveillance and censorship

tcpdump, a powerful command-line packet analyzer

thc hydra — THC Hydra, flexible password spraying tool

TimeSketch — Timesketch is an open-source tool for collaborative forensic timeline analysis

trufflehog — Network Analysis tool that provide a network graph

— U —
#

USB Rubber Ducky — The Hak5 RubberDucky

— V —
#

velociraptor — Velociraptor is an advanced digital forensic and incident response tool

VolWeb — DFIR analysis platform that leverages the power of Volatility 3

Vulnerability Lookup — Vulnerability Lookup facilitates quick correlation of vulnerabilities

— W —
#

Wazuh — Wazuh - The Open Source Security Platform

Wireshark — WireShark - The world’s most popular network protocol analyzer

— X —
#

— Y —
#

YARA — The pattern matching swiss knife for malware researchers (and everyone else)

— Z —
#

Zed Attack Proxy (ZAP) — Zed Attack Proxy (ZAP) Web Application Security Scanner

Zeek — Zeek (formerly Bro) is the world’s leading platform for network security monitoring.