Toolkit

InfoSec tools

The tools I actually reach for on penetration tests, red team engagements and forensic work. Nothing here is affiliate-linked or sponsored — every entry points at the project's own site, and I have run all of them in anger.

Several of these are classified as hack tools, unwanted programs or even malware by endpoint security products. That is expected: they do exactly what their descriptions say and nothing more. Use them only against systems you are authorised to test.

Reconnaissance and OSINT

Everything the outside world can already see, assembled before an attacker assembles it.

AiiDIS™MineMy own reconnaissance platform — 237 modules across 12 disciplines, started in 2017 as a field tool and hardened on live engagements since. NmapCross-platformThe network mapper. Host discovery, port and service enumeration, OS fingerprinting, and an NSE script engine that does far more than most people ask of it. AmassOWASPAttack-surface mapping by DNS enumeration and external asset discovery — the fastest route to the subdomains nobody remembers owning. theHarvesterPassiveEmails, names, subdomains and hosts gathered from public sources. First tool out of the bag on an external engagement. SpiderFootAutomationAutomated OSINT across 200-odd data sources, correlating what it finds rather than dumping it. Recon-ngFrameworkA reconnaissance framework built like Metasploit — modular, scriptable, and it keeps its findings in a workspace database. ShodanServiceThe search engine for exposed devices. Useful for the same reason it is uncomfortable: it already indexed your estate.

Web application testing

OWASP-aligned testing of applications and APIs.

Burp SuiteProxyThe intercepting proxy the industry standardised on. Repeater and Intruder are where most real findings are actually reproduced by hand. OWASP ZAPOpen sourceThe free intercepting proxy and scanner, and the one to reach for when a client cannot licence Burp for their own pipeline. sqlmapInjectionAutomated detection and exploitation of SQL injection, including the blind and time-based cases nobody wants to prove by hand. ffufFuzzingFast web fuzzing for content discovery, virtual hosts and parameters. Fast enough to change how you scope a test. NiktoScannerNoisy, old and still finds things — misconfigurations and dangerous defaults that modern scanners have quietly stopped checking for. SecListsWordlistsNot a tool but the fuel for most of them: usernames, passwords, payloads, URLs and fuzzing patterns in one maintained collection.

Network analysis and monitoring

Seeing the traffic — on an engagement, and in the SOC afterwards.

WiresharkCross-platformPacket analysis with the dissectors to read almost any protocol. Still the fastest way to tell an attack from a bad deployment. tcpdumpCLICapture on the box, analyse elsewhere. Present on nearly every Unix host you will ever be asked to look at. ZeekMonitoringTurns raw traffic into structured connection, DNS, HTTP and TLS logs. The single highest-value log source most SIEM builds are missing. SuricataIDS/IPSHigh-performance intrusion detection and prevention with multi-threaded rule matching and file extraction. ResponderWindowsLLMNR, NBT-NS and MDNS poisoning. On an internal test it usually produces credentials before the coffee has gone cold.

Exploitation and post-exploitation

Objective-led work, against systems you are authorised to test.

Metasploit FrameworkFrameworkExploit development and delivery, payload generation and post-exploitation, with a module for nearly everything with a CVE. ImpacketWindowsPython implementations of SMB, MSRPC, Kerberos and friends. secretsdump and psexec do most of the heavy lifting on an AD engagement. BloodHoundActive DirectoryGraphs Active Directory relationships so a privilege escalation path stops being a guess and becomes a shortest-path query. NetExecWindowsThe maintained successor to CrackMapExec — network-wide enumeration and execution across SMB, WinRM, LDAP, MSSQL and SSH. MimikatzCredentialsThe tool that taught a generation of defenders what LSASS actually holds. Every EDR product flags it, and rightly so.

Password and credential auditing

Proving that the policy on paper is the policy in the directory.

HashcatGPUGPU-accelerated cracking across hundreds of hash types, with rule and mask attacks that model how people actually choose passwords. John the RipperCPU/GPUThe long-standing cracker, and still the most flexible for the odd formats jumbo supports and nothing else does. HydraOnlineParallelised online brute-forcing across dozens of protocols — for testing lockout policy as much as for guessing credentials.

Wireless

The estate most organisations audit least often.

Aircrack-ngSuiteMonitoring, capture, injection and cracking for 802.11. The reference suite for a wireless assessment. KismetDetectionPassive wireless detection and sniffing across Wi-Fi, Bluetooth and SDR — the way rogue access points get found. hcxdumptoolCaptureCaptures WPA/WPA2 PMKID and handshake material for offline analysis without waiting for a client to reconnect.

Digital forensics and incident response

Acquisition and analysis that has to survive scrutiny — defensible chain of custody, not a screenshot.

AutopsyGUIThe graphical front end to Sleuth Kit: disk image analysis, timeline, keyword search and reporting in one case file. The Sleuth KitCLIThe underlying command-line filesystem forensics tools — scriptable, and what you use when the GUI is in the way. Volatility 3MemoryMemory forensics. Processes, network connections, injected code and credentials recovered from a RAM image. VelociraptorEndpointEndpoint visibility and collection at fleet scale, with a query language that turns a hunch into a hunt across thousands of hosts. Plaso / log2timelineTimelineBuilds a super timeline from every artefact on a system. Tedious to read and frequently the thing that settles what happened when.

Malware analysis and reverse engineering

Understanding a binary without trusting it.

GhidraNSAFull software reverse engineering suite with a decompiler good enough that it changed who can afford to do this work. radare2CLIReverse engineering framework and hex editor. Steep to learn and unmatched once it is in your fingers. CutterGUIThe graphical front end over radare2 and Rizin, with Ghidra's decompiler available inside it. x64dbgWindowsOpen-source x64/x32 debugger for Windows binaries — the practical choice for dynamic analysis of a packed sample. YARADetectionPattern matching for malware researchers. Writing your own rules is how threat intelligence becomes detection content. capaTriageIdentifies what a binary can do — persistence, injection, C2 — mapped to ATT&CK, before you have read a single instruction.

Windows process and PE analysis

The original toolkit on this page, kept because these still earn their place on a suspect Windows host.

Process ExplorerSysinternalsReal-time process monitoring in depth — owner, handles, loaded libraries and memory use, with VirusTotal lookup built in. System InformerWindowsThe maintained continuation of Process Hacker. Monitors processes, services and drivers on 32- and 64-bit Windows. PEStudioTriageInspects an executable in detail without running it, flags suspicious indicators and checks it against VirusTotal. Report exports as XML. PE-bearReversingPE reversing tool for malware analysts, with a quick disassembler and packer signature detection. PE ToolsEditingPE file editor, task viewer, optimiser and packer detector for research on and repair of executables and libraries. EXE ExplorerMiTeCReads and displays executable properties and structure across PE32, PE32+, NE, VxD and .NET binaries. FileAlyzerAnalysisDetailed analysis of arbitrary files — creation date, size, attributes, version resources and embedded structure. Cerbero PE InsiderViewerFree PE viewer sharing the inspection codebase of Cerbero Profiler, so it covers the whole PE specification.
SunPEViewViewerSmall PE32 and PE64 viewer with hex editor, file location calculator and a hex-dec-bin converter. No longer has a maintained home.

No longer maintained

Listed on this page for years and since withdrawn by the vendor. Kept so the record is honest rather than quietly deleted.

McAfee GetSuspRetiredIsolated suspected undetected malware using heuristics and the McAfee GTI file reputation database, without needing deep systems knowledge. Withdrawn after the Trellix transition.
McAfee Ransomware InterceptorRetiredA pilot early-detection tool that used heuristics and machine learning to block ransomware encryption attempts. The pilot ended and the download is gone.
McAfee Real ProtectRetiredReal-time behavioural detection using cloud-side machine learning to catch zero-day malware. Absorbed into the commercial product and no longer a free standalone tool.

How I use these Library