Myskiv-Ivan/SecTools

Myskiv-Ivan/SecTools has 34 GitHub stars and 6 forks. Star changes are not measured yet. Last checked 2026-11-13 04:07 UTC. Last push 2026-11-09.

Cómo se miden estas cifras

34 estrellas 6 Bifurcaciones

Crecimiento de estrellas medido

in 24h: Actualización retrasada
in 7 days: Actualización retrasada
in 15 days: Actualización retrasada
in 1 month: Actualización retrasada

Cambios netos en períodos que se solapan, no totales diarios. Los datos no disponibles se dejan en blanco. Las estrellas indican interés, no calidad.

Acerca de

List of tools for DevSecOps/Appsec and Pentest

Seguridad

README.md

Original

SecTools

A curated collection of open-source and public tools for OSINT, vulnerability analysis, AppSec (SAST / DAST / SCA), recon, cloud security, and related security workflows.

Most tools are UNIX-compatible. The License column uses icons (see legend below). Tool cells use Name + link on a new line so columns stay readable.

License legend

Icon	Meaning
🟢	Open source — Apache, MIT, GPL, BSD, AGPL, etc.
🟡	Freemium — free / community edition + paid enterprise tiers
🔴	Enterprise — commercial proprietary license
☁️	Service — hosted SaaS / online platform
🌐	Public — free public resource or dataset

In tables, the name is on the first line and the link on the next (<br>).

Activity shows a full ISO date (YYYY-MM-DD), preferred signal first:

Marker	Meaning
`release`	Latest GitHub Release publish date
`tag`	Latest git tag date (no GitHub Release)
`commit`	Latest git commit date (fallback; may include bots)
`—`	No public GitHub repo

Refresh dates:

python3 scripts/update-activity.py

Or let GitHub Actions refresh them on a schedule (see .github/workflows/update-activity.yml).

🔭 OSINT

Open-source intelligence: accounts, DNS, infrastructure, and public metadata.

Tool	Description	License	Activity
Sherlock GitHub	Hunt usernames across hundreds of social networks	🟢	2026-09-08 `release`
theHarvester GitHub	Gather emails, subdomains, hosts, and people from public sources	🟢	2026-06-03 `release`
SpiderFoot GitHub	Automated OSINT with hundreds of modules and a web UI	🟢	2022-04-07 `release`
Recon-ng GitHub	Modular reconnaissance framework (Metasploit-style)	🟢	2021-08-25 `tag`
Photon GitHub	Fast crawler for OSINT data extraction from websites	🟢	2019-04-05 `release`
Maltego maltego.com	Graph visualization of people, domains, and infrastructure	🟡	—
R3CON1Z3R GitHub	Lightweight OSINT script for target footprinting	🟢	2019-07-24 `commit`
Shodan shodan.io	Search engine for Internet-connected devices and services	☁️	—
Censys censys.io	Host, certificate, and service indexing	☁️	—
ZoomEye zoomeye.ai	Network asset and device search (Shodan-like)	☁️	—
FOFA fofa.info	Cyberspace search engine for assets and fingerprints	☁️	—
urlscan.io urlscan.io	URL / page analysis and snapshots	☁️	—
ONYPHE onyphe.io	Cyber threat intelligence aggregator for IPs, domains, services	☁️	—
BuiltWith builtwith.com	Detect a site’s technology stack	☁️	—
Hunter.io hunter.io	Find and verify professional email addresses	☁️	—
crt.sh crt.sh	Certificate Transparency log search (subdomain discovery)	🌐	—
SecurityTrails securitytrails.com	Historical DNS, WHOIS, and domain intelligence	☁️	—
who.is who.is	WHOIS / DNS lookup	🌐	—
DNSstuff dnsstuff.com	DNS diagnostics and lookup utilities	☁️	—
InfoSniper infosniper.net	IP geolocation	🌐	—
scans.io scans.io	Internet-wide scan data archive	🌐	—
Wayback Machine archive.org	Historical snapshots of web pages	🌐	—
IntelX intelx.io	Search engine for leaked / archived data and IDs	☁️	—

Localized search engines

Region	Link
Slovenia	Najdi.si najdi.si
Israel	Walla walla.co.il
Japan	Goo goo.ne.jp
South Korea	Naver naver.com
China	Baidu baidu.com
Russia	Yandex yandex.com

File search

Service	Description	License
FileChef filechef.com	Search publicly exposed files	☁️
File Search Engine filesearch.link	Index of publicly available files	☁️
SearchFiles.de searchfiles.de	Search files by name / type	☁️
FileListing filelisting.com	Catalog of open file listings	☁️

🛡️ Vulnerability Management Platforms

Orchestrate scanner findings, triage, and reporting.

Tool	Description	License	Activity
DefectDojo GitHub	DevSecOps platform: report import, triage, metrics, SLA	🟢	2026-11-09 `release`
Faraday GitHub	Collaborative pentest IDE / vulnerability management	🟢	2026-10-29 `release`
ArcherySec GitHub	Vulnerability assessment & management with scanner integrations	🟢	2024-05-31 `release`
reNgine GitHub	Automated recon + vulnerability management with web UI	🟢	2024-09-07 `release`
Vuls GitHub	Agentless vulnerability scanner for Linux / FreeBSD	🟢	2026-10-15 `release`
OWASP Threat Dragon GitHub	Threat modeling tool for STRIDE-style diagrams	🟢	2026-05-10 `release`

⚒️ Analysis & Exploit Frameworks

Tool	Category	Description	License	Activity
Metasploit GitHub	Exploit Framework	Classic exploit, payload, and post-exploitation framework	🟡	2016-01-07 `tag`
RouterSploit GitHub	Exploit Framework	Exploits and checks for embedded / network devices	🟢	2018-10-17 `release`
BeEF GitHub	Exploit Framework	Browser Exploitation Framework	🟢	2025-10-24 `release`
Sliver GitHub	C2	Open-source adversary emulation / C2 framework	🟢	2026-10-25 `release`
Havoc GitHub	C2	Modern post-exploitation command and control	🟢	2025-12-18 `commit`
MobSF GitHub	Mobile	Static and dynamic analysis for Android / iOS	🟢	2026-10-31 `release`
Frida GitHub	Dynamic Instrumentation	Dynamic instrumentation toolkit for apps	🟢	2026-11-07 `release`
Objection GitHub	Mobile	Runtime mobile exploration powered by Frida	🟢	2026-06-02 `release`
RedTeam C# Scripts GitHub	Red Team	Collection of C# scripts for red team operations	🟢	2021-11-16 `commit`
Atomic Red Team GitHub	Adversary Emulation	Small, focused tests mapped to ATT&CK techniques	🟢	2026-11-06 `commit`
CALDERA GitHub	Adversary Emulation	Automated adversary emulation platform by MITRE	🟢	2025-04-24 `release`

🧰 Web Proxies & Manual Testing

Intercept, replay, and mutate HTTP(S) traffic during web assessments.

Tool	Description	License	Activity
Burp Suite portswigger.net	Industry-standard web security testing platform (Community / Pro)	🟡	—
Caido caido.io	Modern lightweight web proxy for bug bounty and pentest	🟡	2026-10-26 `release`
mitmproxy GitHub	Interactive TLS-capable intercepting HTTP proxy (CLI + web)	🟢	2026-10-25 `release`
OWASP ZAP GitHub	Free proxy + automated scanner	🟢	2025-12-15 `release`
WATOBO GitHub	Intercepting proxy + scanner for pentests	🟢	2020-05-27 `release`

🔎 SAST — Static Analysis

Find vulnerabilities in source code without running the application.

Tool	Languages / scope	Description	License	Activity
Semgrep GitHub	30+ languages	Fast pattern-based SAST with YAML rules; CI-friendly	🟡	2026-11-05 `release`
CodeQL codeql.github.com	Multilang	Semantic code analysis from GitHub (query-as-code)	🟡	—
Bearer GitHub	JS/TS, Ruby, PHP, Java, Go, Python	SAST focused on data flows and privacy	🟢	2026-10-28 `release`
Bandit GitHub	Python	Common security issues in Python	🟢	2026-02-25 `release`
Brakeman GitHub	Ruby on Rails	Rails-focused static security scanner	🟢	2026-09-30 `release`
Find Security Bugs GitHub	Java, Android, Scala, Kotlin, Groovy	SpotBugs plugin for web / Android security	🟢	2025-06-17 `release`
SpotBugs GitHub	Java	Static analysis of Java bytecode	🟢	2026-10-12 `release`
PMD GitHub	Multilang	Static analysis for quality and security rules	🟢	2026-10-30 `release`
Security Code Scan GitHub	C#, VB.NET	Roslyn analyzer for .NET vulnerabilities	🟢	2022-09-05 `release`
Infer# GitHub	C#	Interprocedural .NET analysis based on Facebook Infer	🟢	2023-05-31 `release`
Insider GitHub	Java, Kotlin, Swift, .NET, JS	CLI SAST for multiple stacks	🟢	2021-01-26 `release`
Codechecker GitHub	C/C++	Wrapper around Clang Static Analyzer / Clang-Tidy	🟢	2026-11-05 `release`
Cppcheck GitHub	C/C++	Static analysis focused on undefined behavior	🟢	2026-09-19 `release`
LLVM Clang SA GitHub	C, C++, Obj-C	Clang Static Analyzer	🟢	2026-11-03 `release`
PVS-Studio pvs-studio.com	Multilang	Commercial static analyzer (trial available)	🔴	—
Codemodder GitHub	Java, Python	Auto-fix for security and quality issues	🟢	2025-10-21 `release`
gosec GitHub	Go	Inspector for security problems in Go code	🟢	2026-10-23 `release`
PHP Vulnerability Hunter GitHub	PHP	PHP vulnerability finder (legacy)	🟢	2015-06-10 `commit`
Cobra GitHub	PHP, Java	Source code security audit (legacy)	🟢	2018-04-02 `release`

🎯 DAST / IAST

Dynamic and interactive analysis of running applications.

Tool	Type	Description	License	Activity
OWASP ZAP GitHub	DAST	Free web proxy and automated scanner from OWASP	🟢	2025-12-15 `release`
Nuclei GitHub	DAST	Fast YAML-template scanner for CVE / misconfig (HTTP, DNS, TCP…)	🟢	2026-08-08 `release`
Nikto GitHub	DAST	Classic web scanner for dangerous files and misconfigurations	🟢	2026-07-31 `release`
Wapiti GitHub	DAST	Black-box web scanner (XSS, SQLi, and more)	🟢	2026-08-19 `release`
w3af GitHub	DAST	Web Application Attack and Audit Framework	🟢	2015-04-07 `release`
Dalfox GitHub	XSS	Parameter analysis and XSS scanning / exploitation helper	🟢	2026-11-08 `release`
Commix GitHub	Command Injection	Automated OS command injection detection and exploitation	🟢	2025-12-20 `release`
jwt_tool GitHub	API / Auth	Toolkit for testing, forging, and attacking JWTs	🟢	2025-05-01 `release`
Snyk GitHub	DAST / SCA	Scan code, dependencies, containers, and IaC	🟡	2026-11-04 `release`
SonarQube GitHub	SAST / Quality	Code quality + security hotspots	🟡	2026-11-04 `release`
Contrast Security contrastsecurity.com	IAST	Agent-based interactive analysis at runtime	🔴	—
PT Application Inspector ptsecurity.com	SAST/DAST	Commercial application analyzer (Positive Technologies)	🔴	—
CloudSploit GitHub	Cloud	Misconfiguration checks for AWS / Azure / GCP / Oracle	🟢	2024-09-24 `release`
Mend (WhiteSource) mend.io	SCA / AppSec	Commercial open-source risk platform	🔴	—

📦 SCA / IaC

Dependency and infrastructure-as-code analysis.

Tool	Focus	Description	License	Activity
Trivy GitHub	SCA + IaC + Containers	All-in-one: deps, images, IaC, secrets	🟢	2026-11-05 `release`
Grype GitHub	SCA / Containers	Vulnerability scanner for images and filesystems	🟢	2026-11-09 `release`
OSV-Scanner GitHub	SCA	Scanner powered by OSV.dev (Google)	🟢	2026-11-09 `release`
Dependency-Track GitHub	SCA Platform	Continuous analysis platform for SBOM / dependencies	🟢	2026-10-25 `release`
OWASP Dependency-Check GitHub	SCA	Match dependencies against known CVE	🟢	2025-02-17 `release`
Checkov GitHub	IaC	Policy-as-code for Terraform, K8s, CloudFormation, Docker	🟢	2026-11-02 `release`
KICS GitHub	IaC	Keeping Infrastructure as Code Secure — multi-IaC scanner	🟢	2026-11-09 `release`
tfsec GitHub	IaC	Terraform security scanner (Trivy lineage)	🟢	2025-05-02 `release`
Terrascan GitHub	IaC	Compliance / security scanning for IaC	🟢	2024-09-18 `release`

📋 SBOM

Software Bill of Materials generation.

Tool	Format	Description	License	Activity
Syft GitHub	SPDX, CycloneDX	Generate SBOM from images, directories, and manifests	🟢	2026-11-09 `release`
cdxgen GitHub	CycloneDX	Universal CycloneDX SBOM generator	🟢	2026-11-07 `release`
Trivy GitHub	SPDX, CycloneDX	SBOM as part of scanning	🟢	2026-11-05 `release`

🔐 Secret Detection

Tool	Description	License	Activity
Gitleaks GitHub	Fast secret detection in git history and filesystem	🟢	2026-03-21 `release`
TruffleHog GitHub	Secret detection with live verification (API keys, etc.)	🟢	2026-11-02 `release`
git-secret GitHub	Encrypt secrets in git via GPG	🟢	2022-06-05 `release`
detect-secrets GitHub	Enterprise-friendly baseline secret scanner (Yelp)	🟢	2024-05-06 `release`

🛰️ Scanners

Network, web, and general-purpose vulnerability scanners.

Tool	Type	Description	License	Activity
Nmap GitHub	Network	Reference network discovery / port scanner	🟢	2026-10-12 `tag`
Masscan GitHub	Network	Asynchronous ultra-fast port scanner	🟢	2021-01-31 `release`
RustScan GitHub	Network	Extremely fast port scanner that pipes into Nmap	🟢	2025-02-23 `release`
OpenVAS / Greenbone GitHub	Network VA	Full vulnerability assessment stack	🟢	2026-11-05 `release`
Nessus tenable.com	Network VA	Commercial VA scanner by Tenable	🔴	—
InsightVM (Nexpose) rapid7.com	Network VA	Vulnerability management by Rapid7	🔴	—
Tsunami GitHub	Network	Modular high-severity scanner by Google	🟢	2026-02-19 `release`
testssl.sh GitHub	TLS / SSL	CLI checker for TLS/SSL ciphers, protocols, and vulns	🟢	—
SSLyze GitHub	TLS / SSL	Fast and powerful SSL/TLS scanning library	🟢	2026-03-29 `release`
Sqlmap GitHub	Web / SQLi	Automated SQL Injection detection and exploitation	🟢	2026-01-01 `release`
NoSQLMap GitHub	NoSQL	Audit and exploit NoSQL injection	🟢	2016-01-11 `release`
WhatWeb GitHub	Fingerprint	Identify CMS, frameworks, and site tech	🟢	2026-04-02 `release`
Wappalyzer wappalyzer.com	Fingerprint	Identify technologies used on websites	🟡	—
wappalyzergo GitHub	Fingerprint	Go port of Wappalyzer fingerprinting for CLI / pipelines	🟢	2026-11-08 `release`
Xray GitHub	Web	Passive / active web scanner (Chaitin)	🟢	2024-07-19 `release`
Osmedeus GitHub	Orchestration	Workflow engine for automated recon / scan	🟢	2026-10-04 `release`
OneForAll GitHub	Subdomain / Recon	Powerful subdomain collection	🟢	2022-07-10 `release`
Sn1per GitHub	Pentest Automation	Automated pentest framework	🟡	2023-07-29 `release`
AutoRecon GitHub	Recon	Multi-threaded network recon for CTF / pentest	🟢	2026-11-03 `commit`
Legion GitHub	Network GUI	GUI wrapper around Nmap and other scanners	🟢	2023-11-21 `release`
Raccoon GitHub	Recon	Asynchronous recon / offensive reconnaissance	🟢	2025-06-10 `commit`
Scanless GitHub	Network	Port scan via public online scanners (opsec)	🟢	2023-03-23 `release`
Golismero GitHub	Framework	Security framework with plugins	🟢	2020-04-16 `commit`
Arachni GitHub	Web	Modular web scanner (maintenance mode)	🟢	2022-05-29 `tag`
Acunetix acunetix.com	Web	Commercial DAST	🔴	—
Invicti (Netsparker) invicti.com	Web	Commercial DAST with proof-based scanning	🔴	—
ScanOval bdu.fstec.ru	OVAL / BDU	OVAL-based vulnerability checks (FSTEC BDU)	🌐	—
Puma Scan GitHub	.NET SAST	Roslyn analyzer for .NET security	🟡	2022-02-01 `release`

🧭 Recon & Enumeration

Tool	Description	License	Activity
Amass GitHub	OWASP: deep subdomain enumeration and attack-surface mapping	🟢	2026-10-25 `release`
subfinder GitHub	Passive subdomain discovery (ProjectDiscovery)	🟢	2026-10-08 `release`
httpx GitHub	Fast HTTP probing / tech detection	🟢	2026-09-08 `release`
dnsx GitHub	DNS toolkit for resolve and enumeration	🟢	2026-08-31 `release`
Chaos GitHub	ProjectDiscovery DNS dataset client for passive recon	🟢	2024-04-22 `release`
ffuf GitHub	Fast web fuzzer (dirs, vhosts, params)	🟢	2026-09-09 `release`
gobuster GitHub	Directory, DNS, and vhost brute-forcing	🟢	2025-09-04 `release`
feroxbuster GitHub	Fast, recursive content discovery written in Rust	🟢	2025-12-13 `release`
Arjun GitHub	HTTP parameter discovery suite	🟢	2024-11-03 `release`
knock GitHub	Subdomain enumeration via wordlist + DNS	🟢	2026-02-14 `release`
subDomainsBrute GitHub	Multi-threaded subdomain brute-force	🟢	2022-06-05 `release`
SubDomain3 GitHub	High-speed subdomain scanner	🟢	2020-01-20 `release`
domained GitHub	Wrapper around multiple subdomain tools	🟢	2021-04-11 `commit`
katana GitHub	Next-gen crawling / spidering	🟢	2026-10-05 `release`
gau GitHub	Fetch known URLs from public sources	🟢	2024-10-28 `release`
waybackurls GitHub	Fetch URLs from the Wayback Machine for a domain	🟢	2022-04-05 `release`
hakrawler GitHub	Simple, fast web crawler for gathering URLs / endpoints	🟢	2022-05-23 `release`

🏢 Active Directory & Internal

Identity attack-path mapping and Windows / AD assessment tooling.

Tool	Description	License	Activity
BloodHound GitHub	Graph analysis of AD / Entra ID attack paths	🟡	2026-11-06 `release`
SharpHound GitHub	BloodHound data collector for Active Directory	🟢	2026-10-16 `release`
Impacket GitHub	Python collection of Windows network protocol tools	🟢	2026-05-19 `release`
NetExec GitHub	Network authentication / assessment (CrackMapExec successor)	🟢	2026-02-23 `release`
Responder GitHub	LLMNR / NBT-NS / mDNS poisoner for credential capture	🟢	2026-01-26 `tag`
Certipy GitHub	Active Directory Certificate Services enumeration & abuse	🟢	2026-06-23 `release`
Rubeus GitHub	Kerberos abuse toolkit for offensive AD ops	🟢	2021-08-03 `release`
PowerView GitHub	PowerShell AD situational awareness (PowerSploit)	🟢	2015-12-19 `release`

🔑 Password Cracking

Tool	Description	License	Activity
Hashcat GitHub	Advanced GPU password recovery	🟢	2026-10-25 `release`
John the Ripper GitHub	Fast password cracker (CPU + many formats)	🟢	2013-07-08 `tag`
Hydra GitHub	Parallel online brute-force for network services	🟢	2026-05-03 `release`
Medusa GitHub	Speedy, parallel, modular login brute-forcer	🟢	2025-05-14 `release`

☁️ Cloud & Container Security

CSPM, CNAPP-adjacent OSS, and Kubernetes hardening.

Tool	Focus	Description	License	Activity
Prowler GitHub	CSPM	Multi-cloud security assessment (AWS, Azure, GCP, …)	🟢	2026-11-06 `release`
ScoutSuite GitHub	CSPM	Multi-cloud security auditing tool	🟢	2024-05-10 `release`
CloudMapper GitHub	AWS	Network visualization and inventory for AWS accounts	🟢	2021-11-04 `release`
kube-bench GitHub	Kubernetes	CIS Kubernetes Benchmark checks	🟢	2026-08-05 `release`
kube-hunter GitHub	Kubernetes	Hunt for security weaknesses in K8s clusters	🟢	2022-05-18 `release`
Falco GitHub	Runtime	Cloud-native runtime security / threat detection	🟢	2026-10-29 `release`
Trivy GitHub	Containers / IaC	Image, filesystem, and IaC vulnerability scanner	🟢	2026-11-05 `release`
Docker Bench GitHub	Containers	CIS Docker Benchmark script	🟢	2023-12-20 `release`
Orca Security orca.security	CNAPP	Commercial agentless cloud security platform	🔴	—
Wiz wiz.io	CNAPP	Commercial cloud security platform	🔴	—
Prisma Cloud paloaltonetworks.com	CNAPP	Commercial CNAPP by Palo Alto Networks	🔴	—

📡 Network Analysis & IDS

Tool	Description	License	Activity
Wireshark GitHub	Network protocol analyzer	🟢	2025-08-28 `tag`
tcpdump GitHub	Classic command-line packet analyzer	🟢	2026-09-21 `tag`
Zeek GitHub	Network security monitoring framework (formerly Bro)	🟢	2026-10-26 `release`
Suricata GitHub	High-performance IDS / IPS / NSM engine	🟢	2026-10-29 `release`
Snort GitHub	Network intrusion detection and prevention	🟢	2026-11-05 `release`
Wazuh GitHub	Open-source XDR / SIEM platform	🟢	2026-11-09 `release`
OSSEC GitHub	Host-based intrusion detection system	🟢	2026-10-18 `release`
ModSecurity GitHub	Open-source web application firewall engine	🟢	2026-09-29 `release`

🔬 Forensics & Incident Response

Tool	Description	License	Activity
Volatility 3 GitHub	Advanced memory forensics framework	🟢	2026-09-17 `release`
Velociraptor GitHub	Endpoint visibility and digital forensics / IR	🟢	2026-10-05 `release`
Autopsy GitHub	Digital forensics platform (GUI on The Sleuth Kit)	🟢	2026-05-07 `release`
The Sleuth Kit GitHub	Library and tools for disk image forensics	🟢	2026-04-15 `release`
Plaso GitHub	Super timeline engine for digital forensics	🟢	2026-10-27 `release`
osquery GitHub	SQL-powered operating system instrumentation	🟢	2026-10-29 `release`
TheHive GitHub	Scalable Security Incident Response Platform	🟢	2022-09-13 `release`
Cortex GitHub	Observable analysis & active response engine	🟢	2026-10-20 `release`

🧠 Threat Intelligence

Tool	Description	License	Activity
MISP GitHub	Open-source threat intelligence sharing platform	🟢	2026-10-10 `release`
OpenCTI GitHub	Open Cyber Threat Intelligence platform	🟢	2026-11-06 `release`
OpenTAXII GitHub	TAXII server implementation for CTI exchange	🟢	2026-01-05 `release`
YARA GitHub	Pattern-matching for malware researchers	🟢	2026-10-27 `release`
Sigma GitHub	Generic signature format for SIEM systems	🟢	2026-07-09 `release`
AbuseIPDB abuseipdb.com	IP abuse reporting and reputation database	☁️	—
VirusTotal virustotal.com	Multi-engine file / URL malware analysis	☁️	—
AlienVault OTX otx.alienvault.com	Open Threat Exchange community intel	☁️	—
Hudson Rock hudsonrock.com	Infostealer / cybercrime intelligence	☁️	—

🕳️ Breach & Leak Lookup

Credential and leak monitoring / digital risk protection lookups.

Tool	Description	License	Activity
Have I Been Pwned haveibeenpwned.com	Check if emails / passwords appear in known breaches	☁️	—
DeHashed dehashed.com	Breach data search for credentials, WHOIS, and monitoring	☁️	—
Intelligence X intelx.io	Search leaked and historical data	☁️	—
LeakIX leakix.net	Search engine for publicly exposed services and leaks	☁️	—
Hudson Rock hudsonrock.com	Free / paid infostealer compromise checks	☁️	—

🧬 Binary Analysis & Reverse Engineering

Tool	Description	License	Activity
Ghidra GitHub	NSA open-source software reverse engineering suite	🟢	2026-10-22 `release`
radare2 GitHub	UNIX-like reverse engineering framework	🟢	2026-11-05 `release`
Cutter GitHub	Free GUI for Rizin / reverse engineering	🟢	2026-06-30 `release`
Binary Ninja binary.ninja	Commercial reverse engineering platform	🔴	—
IDA hex-rays.com	Commercial industry-standard disassembler / debugger	🔴	—
Binwalk GitHub	Firmware analysis and extraction tool	🟢	2024-10-31 `release`
PE-bear GitHub	PE file reversing toolkit	🟢	2026-06-05 `release`
Detect It Easy GitHub	Packer / compiler / crypto detection for binaries	🟢	2026-04-16 `tag`

📚 Wordlists & Payloads

Tool	Description	License	Activity
SecLists GitHub	Collection of security wordlists and payloads	🟢	2026-10-27 `release`
PayloadsAllTheThings GitHub	Useful payloads and bypasses for Web AppSec	🟢	2025-07-26 `release`
FuzzDB GitHub	Attack patterns, discovery dictionaries, and injectables	🟢	2020-02-26 `commit`
Assetnote Wordlists assetnote.io	High-quality discovery wordlists	🌐	—

📚 Vulnerability Databases

Source	Description	License
CVE cve.org	Common catalog of public vulnerability identifiers	🌐
NVD (NIST) nvd.nist.gov	U.S. SCAP / CVE repository with CVSS, CPE, and references	🌐
Exploit-DB exploit-db.com	Archive of exploits, shellcode, and advisories	🌐
0day.today 0day.today	Exploit and 0day database for researchers	☁️
VulDB vuldb.com	Documented vulnerabilities and exploits	☁️
Snyk Vuln DB snyk.io	OSS vulnerability DB with remediation guidance	☁️
OSV osv.dev	Distributed open-source vulnerability database	🌐
GitHub Advisory GitHub	Security advisories for package ecosystems	🌐
FSTEC BDU bdu.fstec.ru	Russian threat / vulnerability data bank	🌐

🔗 External directories

Broader catalogs for discovering additional commercial and free products:

Directory	Focus	License
OWASP owasp.org	Projects, cheat sheets, and Top 10 lists	🌐
awesome-security GitHub	Curated awesome-list of security resources	🟢

Category legend

Abbreviation	Meaning
OSINT	Open Source Intelligence
SAST	Static Application Security Testing
DAST	Dynamic Application Security Testing
IAST	Interactive Application Security Testing
SCA	Software Composition Analysis
IaC	Infrastructure as Code
SBOM	Software Bill of Materials
CSPM	Cloud Security Posture Management
CNAPP	Cloud-Native Application Protection Platform
C2	Command and Control
VA	Vulnerability Assessment
DRP	Digital Risk Protection

Disclaimer: These tools are intended for authorized security testing, education, and research. Use them only on systems you own or have explicit permission to assess.