awesome-cyber
A curated list of awesome cybersecurity tools for both red, blue, and purple team operations.
Contributions?
Contributions are welcome! The goal of this repository is to be an up-to-date source of tools for all facets of cybersecurity. The landscape changes constantly and so do the tools. It's hard keeping track of everything! If you want to add (or remove outdated) tools, feel free to create an issue or a PR.
Quick links
- General
- Operating Systems
- Other awesome-Collections
- Red Team Tools
- Defense Evasion
- OSINT
- Reconaissance
- Social Engineering
- Leaked Credentials
- Web Exploitation
- Wireless
- Initial Access
- C2 Frameworks
- Post Exploitation
- Exfiltration
- Credential Dumping
- Blue Team Tools
- Forensics
- Deobfuscation
- Reverse Engineering
- Malware Analysis
- Hardening
- CTF stuff
General
Operating Systems
| OS |
Description |
| FlareVM |
Windows distribution for malware analysis and incident response. |
| Kali |
Open-source, Debian-based Linux distribution geared towards various information security tasks, such as Penetration Testing. |
| Parrot |
Parrot Security (ParrotOS, Parrot) is a Free and Open source GNU/Linux distribution based on Debian Stable designed for security experts, developers and privacy aware people. |
| REMnux |
Linux toolkit for reverse engineering malware. |
Other awesome-Collections
This repository is just a brief (and generalized) list of resources and tools for both sides of cyber: blue and red team operations. As such, this is not meant to be in-depth resources. If you are looking for more specific information and/or tools, this contains a list of resource collections.
| Repository |
Description |
| awesome-reversing |
A curated list of awesome reversing resources. |
| awesome-hacking |
A list of hacking resources and tools: RE, web, forensics, etc. |
| awesome-osint |
A curated list of amazingly awesome OSINT. |
| awesome-pentest |
A collection of awesome penetration testing resources, tools and other shiny things. |
| awesome-social-engineering |
A curated list of awesome social engineering resources. |
| awesome-asset-discovery |
List of Awesome Asset Discovery Resources. |
| awesome-incident-response |
A curated list of tools for incident response. |
| awesome-red-teaming |
List of Awesome Red Teaming Resources. |
| awesome-malware-analysis |
A curated list of awesome malware analysis tools and resources. |
| awesome-ida-x64-olly-plugin |
A list of plugins for IDA, Ghidra, GDB, OllyDBG, etc. |
| awesome-forensics |
A curated list of awesome forensic analysis tools and resources |
| awesome-pcaptools |
Tools for PCAP files |
| awesome-windows-post-exploitation |
Windows post-exploitation tools, resources, techniques and commands to use during post-exploitation phase of penetration test. |
Red Team
Defense Evasion
| Repository |
Description |
| Amsi-Bypass-PowerShell |
AMSI bypasses (most are patched, but can be obfuscated to bypass). |
| AMSITrigger |
Finds which string(s) trigger AMSI. |
| chameleon |
PowerShell script obfuscator. |
| Invisi-Shell |
Used to bypass PowerShell security (logging, AMSI, etc). |
| Invoke-Obfuscation |
PowerShell script obfuscator. |
| ISESteroids |
PowerShell script obfuscator. |
| Invoke-Stealth |
PowerShell script obfuscator. |
| UPX |
PE packer. |
| Unprotect |
Contains malware evasion techniques along with PoC. |
OSINT
| Repository |
Description |
| Cloudmare |
Cloudflare, Sucuri, Incapsula real IP tracker. |
| crt.sh |
Find certificates based on a domain name. Can be used to find subdomains. |
| DorkSearch |
Premade Google dork queries. |
| ExifTool |
Read (and modify) metadata of files. |
| FaceCheck.ID |
Reverse image lookup based on facial-recognition. |
| Hunter |
Find company email format and list of employee email addresses. |
| osintframework |
An online database of OSINT tools. |
| PimEyes |
Reverse image lookup based on facial-recognition. |
| Recon-NG |
Reconaissance and OSINT framework. Has many modules such as port scanning, subdomain finding, Shodan, etc. |
| ScrapeIn |
Scrapes LinkedIn to create a list of employee email addresses (for use in Initial Access). |
| SecurityTrails |
Extensive DNS information. |
| Shodan |
Scans for all digital assets. |
| SpiderFoot |
Automatic OSINT analysis. |
| TheHarvester |
Collects names, emails, IPs, and subdomains of a target. |
Reconaissance
| Repository |
Description |
| altdns |
Subdomain enumeration using mutated wordlists. |
| AWSBucketDump |
Enumerate AWS S3 buckets to find interesting files. |
| CameRadar |
Cameradar hacks its way into RTSP videosurveillance cameraa |
| CloudBrute |
Enumerates "the cloud" (Google, AWS, DigitalOcean, etc) to find infrastructure, files, and apps for a given target. |
| dirb |
Web application directory / file fuzzer to find other pages. |
| DNSDumpster |
Online tool for DNS information of a domain. |
| feroxbuster |
Web application directory / file fuzzer to find other pages. |
| gobuster |
Web application directory / file fuzzer to find other pages, and support for DNS and vhost fuzzing. |
| GoWitness |
Screenshots webpages. Supports multi-domain lists and Nmap output. |
| Masscan |
Like nmap, but faster (thus, not stealthy.) |
| Nikto |
Web server scanner to perform security checks on a web server. |
| Nmap |
Finds open ports on a network. Additionally can detect version, OS, and more. |
| Raccoon |
All-in-one reconaissance. port/service scans, dirbusting, and web application retrieval. |
| Recon-NG |
Reconaissance and OSINT framework. Has many modules such as port scanning, subdomain finding, Shodan, etc. |
| subfinder |
Passive subdomain discovery tool. |
| wappalyzer |
Identify what frameworks a website runs |
| wpscan |
Automatic WordPress scanner to identify information about a WordPress site and possible vulnerabilities. |
Social Engineering
| Repository |
Description |
| evilginx |
Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication |
| GoPhish |
Phishing campaign framework to compromise user credentials. |
| msfvenom |
Generate malicious payloads for social engineering (ie: VBA, .exe, etc) |
| Social Engineering Toolkit |
Social engineering framework. |
| SpoofCheck |
Checks if a domain can be spoofed. |
| zphisher |
Phishing campaign framework to compromise user credentials. |
Leaked Credentials
| Repository |
Description |
| Dehashed |
Leaked credential search engine. |
| LeakCheck |
Leaked credential search engine. |
| Snusbase |
Leaked credential search engine. |
Web Exploitation
| Repository |
Description |
| Arachni |
Web Application Security Scanner Framework |
| burpsuite |
Full web testing suite, including proxied requests. |
| Caido |
Full web testing suite, including proxied requests. (Like Burp but written in Rust) |
| dirb |
Web application directory/file fuzzer. |
| dotGit |
A Firefox and Chrome extension that shows you if there is an exposed .git directory |
| feroxbuster |
Web application directory/file fuzzer. |
| flask-unsign |
Decode, bruteforce, and craft Flask session tokens. |
| gobuster |
Web application directory/file/DNS/vhost fuzzing. |
| Nikto |
Web server scanner to perform security checks on a web server. |
| nosqlmap |
Performs automated NoSQL injection tests. |
| PayloadsAllTheThings |
Useful payloads for a variety of attacks such as SQLi, IDOR, XSS, etc. |
| sqlmap |
Performs automated SQL injection tests. |
| w3af |
Web application attack and audit framework. |
| wappalyzer |
Identify what frameworks a website runs. |
| wpscan |
Automatic WordPress scanner to identify information about a WordPress site and possible vulnerabilities. |
Wireless
| Repository |
Description |
| Aircrack-ng |
Aircrack-ng is a complete suite of tools to assess WiFi network security. |
| Kismet |
sniffer, WIDS, and wardriving tool for Wi-Fi, Bluetooth, Zigbee, RF, and more |
| Reaver |
Reaver implements a brute force attack against Wifi Protected Setup (WPS) registrar PINs in order to recover WPA/WPA2 passphrases |
| Wifite |
Python script to automate wireless auditing using aircrack-ng tools |
| WifiPhisher |
The Rogue Access Point Framework |
Initial Access
| Repository |
Description |
| Easysploit |
Automatic Metasploit payload generator and shell listener. |
| Impacket |
A tool to perform Kerberos pre-auth bruteforcing (ASREP roast) via GetNPUsers.py |
| Kerbrute |
A tool to perform Kerberos pre-auth bruteforcing (ASREP roast) |
| Medusa |
Bruteforcer with multiple protocol support. |
| Metasploit |
Exploit framework that can be used for intial access and/or post-exploitation. |
| NetExec |
Bruteforce common Windows protocols (WinRM, LDAP, RDP, SMB, WMI, etc.). Try username null or '' and password '' for unauthenticated access. |
| Searchsploit |
Search ExploitDB for exploits. |
| TeamFiltration |
Cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts |
| THC-Hydra |
Bruteforcer with multiple protocol support. |
| TREVORspray |
Advanced password spraying tool for Active Directory environments. |
C2 Frameworks
C2 frameworks can be considered both initial access and post-exploitation, as they generate payloads to be used in phishing campaigns (initial access) and will provide access to the host machine when ran (post exploitation).
| Repository |
Description |
| Cobalt Strike |
Most robust and advanced C2 framework (also paid). |
| Pupy |
Python and C C2 framework. |
| Sliver |
Go C2 framework. |
| Villain |
Python and Powershell C2 framework. |
Post Exploitation
Modules for lateral movement, exfiltration, system enumeration, and more.
| Repository |
Description |
| BloodHound |
Active Directory visualizer, useful for finding misconfigurations and/or shortest path to Domain Admin. |
| BloodHound.py |
Remote Python data ingestor for BloodHound. |
| Impacket |
A collection of Python scripts useful for Windows targets: psexec, smbexec, kerberoasting, ticket attacks, etc. |
| Mimikatz |
Mimikatz is both an exploit on Microsoft Windows that extracts passwords stored in memory and software that performs that exploit. |
| nishang |
Offensive PowerShell for red team, penetration testing and offensive security. |
| PowerHub |
Post-exploitation module for bypassing endpoint protection and running arbitrary files. |
| PowerSploit |
A PowerShell post-exploitation framework with many modules: exfiltration, privelege escalation, etc. |
| SharpHound |
C# data ingestor for BloodHound. (Recommend SharpHound.ps1 for Bloodhound Kali version) |
Privilege Escalation
These tools automatically enumerate current user privileges and try to find misconfigurations that would allow escalation to root and/or NT AUTHORITYSYSTEM.
| Repository |
Description |
| BeRoot |
Automated Windows, Linux, and Mac privilege escalation path discovery tool. |
| GTFOBins |
Unix binaries that can be used to bypass local security restrictions in misconfigured systems. |
| Invoke-PrivescCheck |
Automated Windows privilege escalation path discovery tool. |
| PEASS-ng |
Automated Windows, Linux, and Mac privilege escalation path discovery tool. |
| PowerUp |
Automated Windows privilege escalation path discovery tool. |
Exfiltration
Data exfiltration
| Repository |
Description |
| DNSExfiltrator |
Data exfiltration over DNS request covert channel |
Credential Dumping
These tools help dump cached credentials from a system.
| Repository |
Description |
| certsync |
Dump NTDS with golden certificates and UnPAC the hash |
| Dumpert |
LSASS memory dumper using direct system calls and API unhooking. |
| Impacket |
Dump domain credentials via DCSync or from NTDS.DIT/SAM with secretsdump.py. |
| Mimikatz |
Dump local and domain credentials with sekurlsa, lsadump modules. |
Password Cracking
These tools assist in uncovering passwords, whether it be for a hash or for password spraying attempts.
| Repository |
Description |
| CeWL |
Scrape websites to generate wordlists. |
| crunch |
Generate wordlists based on requirements such as minimum and maximum length, character sets, etc. |
| Cupp |
Utilize OSINT to create password candidates for a specific person. |
| hashcat |
Password cracking tool. |
| JohnTheRipper |
Password cracking tool. |
| Mentalist |
A GUI for wordlist generation based on rules such as appending, prepending, etc. |
AI / LLM
This section will probably be outdated quick.
| Repository |
Description |
| HarmBench |
A standardized evaluation framework for automated red teaming and robust refusal. |
| Adversarial Suffix |
Jailbreak based on prepending a potentially malicious query. |
| AutoDAN-Turbo |
Black-box jailbreak method that can automatically discover as many jailbreak strategies as possible from scratch. |
| Best-of-N |
Black-box algorithm that jailbreaks frontier AI systems across modalities (text, image, vision) by mutating the original query. |
Blue Team
Forensics
| Repository |
Description |
| Angle-Grinder |
Parse, aggregate, sum, average, min/max, percentile, and sort log files. |
| Autopsy |
Investigate disk images. |
| Autoruns |
Show persistence on Windows |
| Chainsaw |
Parse and threat hunt Windows EVTX files. |
| FTK Imager |
Investigate disk images. |
| KnockKnock |
Show persistence on macOS |
| Magika |
Detect file content types with deep learning. |
| Velociraptor |
Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries. |
| Volatility |
Analyze memory dump files. |
| ZimmermanTools |
Eric Zimmerman's toolset for Windows forensics: EVTX, registry, ShellBags, ShimCache, and more. |
Network Analysis
| Repository |
Description |
| mitmproxy |
CLI-based HTTP(S) proxy to intercept and modify HTTP requests. |
| Wireshark |
GUI-based pcap, pcapng analyzer and network traffic sniffer. |
Deobfuscation & Unpacking
| Repository |
Description |
| cfxc-deobf |
ConfuserEx unpacker. |
| de4dot-cex |
ConfuserEx unpacker. |
| de4dot |
.NET deobfuscator and unpacker. |
| deobfuscate.io |
Javascript deobfuscator. |
| FLOSS |
Automatically extract obfuscated strings from malware. |
| NoFuserEx |
ConfuserEx unpacker. |
| Packer-specific Unpackers |
List of unpackers for specific packers. |
| PSDecode |
PowerShell deobfuscator. |
| relative.im |
Javascript deobfuscator. |
| UnconfuserExTools |
ConfuserEx deobfuscation toolkit (old). |
Reverse Engineering
| Repository |
Description |
| awesome-ida-x64-olly-plugin |
A list of plugins for IDA, Ghidra, GDB, OllyDBG, etc. |
| Binary Ninja |
Decompiler, disassembler, and debugger GUI. |
| Cerberus |
Unstrips Rust and Go binaries. |
| cutter |
Decompiler, disassembler, and debugger GUI based on Rizin. |
| dnSpy |
.NET debugger and editor. |
| dotPeak |
.NET Decompiler and assembly browser |
| GDB |
CLI debugger for Linux executables. |
| GEF |
GDB addon with advanced features. |
| ghidra |
Decompiler and disassembler GUI. |
| JADX |
JAR, APK, DEX, AAR, AAB, and ZIP decompiler. |
| IDA |
Decompiler and disassembler GUI. |
| OllyDbg |
GUI debugger for Windows executables. |
| pycdc |
Decompile .pyc files into Python source code. |
| pyinstxtractor |
Extract .pyc files from PyInstaller compiled executables. |
| redress |
Analyzes stripped Go binaries. |
| rizin |
Disassembler and debugger CLI. |
| x64dbg |
GUI debugger for Windows executables. |
| XPEViewer |
PE file viewer (headers, libraries, strings, etc). |
Malware Analysis
| Repository |
Description |
| any.run |
Cloud-based sandbox. |
| CAPA |
Identify capabilities in executable files. |
| CAPEv2 |
Self-hosted sandbox. |
| Cuckoo |
Self-hosted sandbox. |
| Detect-It-Easy |
Detect file type and packer used for Windows executables. |
| DRAKVUF |
Self-hosted sandbox. |
| Joe's Sandbox |
Cloud-based sandbox. |
| mac-monitor |
Advanced process monitoring for macOS |
| oletools |
Toolkit for Microsoft Office documents (Word, Excel, etc.) to extract VBA, embedded objects, etc. |
| PEiD |
Detect packer, cryptor, and compiler used for Windows executables. |
| Process Explorer |
Shows parent-child relationships between processes and open DLL handles. |
| Process Hacker |
Process Explorer + more |
| Process Monitor |
Tracks registry, file system, network, and process activity. |
Hardening
| Repository |
Description |
| BLUESPAWN |
An Active Defense and EDR software to empower Blue Teams |
| CISBenchmarks |
Benchmark for security configuration best practices |
| HardeningKitty |
HardeningKitty and Windows Hardening settings and configurations |
| Linux Hardening |
Linux Hardening |
| SteamRoller |
Automating basic security configurations across an Active Directory environment |
CTF
Coming soon?
