197 lines
8.3 KiB
Markdown
197 lines
8.3 KiB
Markdown
# Cybersecurity Tools
|
|
|
|
Essential tools for security professionals, organized by category.
|
|
|
|
## Network Analysis & Monitoring
|
|
|
|
**Packet Analysis:**
|
|
- [Wireshark](https://www.wireshark.org/) - Network protocol analyzer
|
|
- [tcpdump](https://www.tcpdump.org/) - Command-line packet analyzer
|
|
- [tshark](https://www.wireshark.org/docs/man-pages/tshark.html) - Terminal-based Wireshark
|
|
|
|
**Network Scanning:**
|
|
- [Nmap](https://nmap.org/) - Network discovery and security auditing
|
|
- [Masscan](https://github.com/robertdavidgraham/masscan) - Fast port scanner
|
|
- [Angry IP Scanner](https://angryip.org/) - Fast network scanner
|
|
|
|
**Network Monitoring:**
|
|
- [ntopng](https://www.ntop.org/) - Network traffic monitoring
|
|
- [NetworkMiner](https://www.netresec.com/?page=NetworkMiner) - Network forensic analysis
|
|
- [Zeek](https://zeek.org/) - Network security monitor
|
|
|
|
---
|
|
|
|
## Vulnerability Assessment
|
|
|
|
**Vulnerability Scanners:**
|
|
- [Nessus](https://www.tenable.com/products/nessus) - Vulnerability scanner
|
|
- [OpenVAS](https://www.openvas.org/) - Open-source vulnerability scanner
|
|
- [Qualys](https://www.qualys.com/) - Cloud-based vulnerability management
|
|
- [Rapid7 Nexpose](https://www.rapid7.com/products/nexpose/) - Vulnerability management
|
|
|
|
**Web Application Scanners:**
|
|
- [Burp Suite](https://portswigger.net/burp) - Web application security testing
|
|
- [OWASP ZAP](https://www.zaproxy.org/) - Web app security scanner
|
|
- [Nikto](https://cirt.net/Nikto2) - Web server scanner
|
|
- [Acunetix](https://www.acunetix.com/) - Automated web vulnerability scanner
|
|
|
|
**Dependency & Container Scanning:**
|
|
- [Snyk](https://snyk.io/) - Developer security platform
|
|
- [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/) - Software composition analysis
|
|
- [Trivy](https://github.com/aquasecurity/trivy) - Container vulnerability scanner
|
|
- [Clair](https://github.com/quay/clair) - Container static analysis
|
|
|
|
---
|
|
|
|
## Penetration Testing
|
|
|
|
**Exploitation Frameworks:**
|
|
- [Metasploit](https://www.metasploit.com/) - Penetration testing framework
|
|
- [Cobalt Strike](https://www.cobaltstrike.com/) - Adversary simulation
|
|
- [Empire](https://github.com/BC-SECURITY/Empire) - Post-exploitation framework
|
|
- [Covenant](https://github.com/cobbr/Covenant) - .NET command and control
|
|
|
|
**Password Attacks:**
|
|
- [Hashcat](https://hashcat.net/hashcat/) - Password recovery
|
|
- [John the Ripper](https://www.openwall.com/john/) - Password cracker
|
|
- [Hydra](https://github.com/vanhauser-thc/thc-hydra) - Network login cracker
|
|
- [Medusa](https://github.com/jmk-foofus/medusa) - Brute force tool
|
|
|
|
**Wireless Security:**
|
|
- [Aircrack-ng](https://www.aircrack-ng.org/) - WiFi security auditing
|
|
- [Kismet](https://www.kismetwireless.net/) - Wireless network detector
|
|
- [Wifite](https://github.com/derv82/wifite2) - Automated wireless attack tool
|
|
|
|
---
|
|
|
|
## Security Information & Event Management (SIEM)
|
|
|
|
**SIEM Platforms:**
|
|
- [Splunk](https://www.splunk.com/) - Data analytics and SIEM
|
|
- [ELK Stack](https://www.elastic.co/elastic-stack) - Elasticsearch, Logstash, Kibana
|
|
- [QRadar](https://www.ibm.com/qradar) - IBM security intelligence
|
|
- [ArcSight](https://www.microfocus.com/en-us/products/siem-security-information-event-management/overview) - Security analytics
|
|
|
|
**Log Management:**
|
|
- [Graylog](https://www.graylog.org/) - Log management
|
|
- [Logstash](https://www.elastic.co/logstash) - Data processing pipeline
|
|
- [Fluentd](https://www.fluentd.org/) - Unified logging layer
|
|
|
|
---
|
|
|
|
## Endpoint Detection & Response (EDR)
|
|
|
|
**EDR Solutions:**
|
|
- [CrowdStrike Falcon](https://www.crowdstrike.com/products/endpoint-security/falcon-platform/) - Cloud-native endpoint protection
|
|
- [SentinelOne](https://www.sentinelone.com/) - Autonomous endpoint protection
|
|
- [Carbon Black](https://www.vmware.com/products/carbon-black-cloud.html) - Endpoint security
|
|
- [Microsoft Defender for Endpoint](https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint) - Enterprise endpoint security
|
|
|
|
**Open-Source EDR:**
|
|
- [Wazuh](https://wazuh.com/) - Open-source security platform
|
|
- [OSQuery](https://osquery.io/) - SQL-powered operating system instrumentation
|
|
- [OSSEC](https://www.ossec.net/) - Host-based intrusion detection
|
|
|
|
---
|
|
|
|
## Static & Dynamic Analysis
|
|
|
|
**Static Application Security Testing (SAST):**
|
|
- [SonarQube](https://www.sonarqube.org/) - Code quality and security
|
|
- [Checkmarx](https://www.checkmarx.com/) - Application security testing
|
|
- [Fortify](https://www.microfocus.com/en-us/products/static-code-analysis-sast/overview) - Static code analyzer
|
|
- [Semgrep](https://semgrep.dev/) - Lightweight static analysis
|
|
|
|
**Dynamic Application Security Testing (DAST):**
|
|
- [Burp Suite Pro](https://portswigger.net/burp/pro) - Web vulnerability scanner
|
|
- [OWASP ZAP](https://www.zaproxy.org/) - Dynamic security testing
|
|
- [Acunetix](https://www.acunetix.com/) - Automated DAST
|
|
|
|
**Malware Analysis:**
|
|
- [Cuckoo Sandbox](https://cuckoosandbox.org/) - Automated malware analysis
|
|
- [Any.run](https://any.run/) - Interactive malware sandbox
|
|
- [VirusTotal](https://www.virustotal.com/) - File and URL analysis
|
|
- [Hybrid Analysis](https://www.hybrid-analysis.com/) - Free malware analysis
|
|
|
|
---
|
|
|
|
## Forensics & Incident Response
|
|
|
|
**Forensic Tools:**
|
|
- [Autopsy](https://www.autopsy.com/) - Digital forensics platform
|
|
- [Volatility](https://www.volatilityfoundation.org/) - Memory forensics
|
|
- [FTK Imager](https://www.exterro.com/ftk-imager) - Forensic imaging
|
|
- [EnCase](https://www.opentext.com/products/encase-forensic) - Digital investigation
|
|
|
|
**Incident Response:**
|
|
- [TheHive](https://thehive-project.org/) - Incident response platform
|
|
- [GRR Rapid Response](https://github.com/google/grr) - Incident response framework
|
|
- [Velociraptor](https://www.velocidex.com/) - Endpoint visibility and collection
|
|
|
|
---
|
|
|
|
## Cloud Security
|
|
|
|
**Cloud Security Tools:**
|
|
- [Prowler](https://github.com/prowler-cloud/prowler) - AWS security assessment
|
|
- [ScoutSuite](https://github.com/nccgroup/ScoutSuite) - Multi-cloud security auditing
|
|
- [CloudSploit](https://github.com/aquasecurity/cloudsploit) - Cloud security configuration scanner
|
|
- [Cloud Custodian](https://cloudcustodian.io/) - Cloud security and governance
|
|
|
|
**Container Security:**
|
|
- [Trivy](https://github.com/aquasecurity/trivy) - Container vulnerability scanner
|
|
- [Falco](https://falco.org/) - Runtime security monitoring
|
|
- [Anchore](https://anchore.com/) - Container analysis and compliance
|
|
|
|
---
|
|
|
|
## Threat Intelligence
|
|
|
|
**Threat Intel Platforms:**
|
|
- [MISP](https://www.misp-project.org/) - Threat intelligence sharing
|
|
- [OpenCTI](https://www.opencti.io/) - Cyber threat intelligence platform
|
|
- [ThreatConnect](https://threatconnect.com/) - Threat intelligence operations
|
|
- [Anomali](https://www.anomali.com/) - Threat intelligence management
|
|
|
|
**Threat Hunting:**
|
|
- [Yara](https://virustotal.github.io/yara/) - Pattern matching for malware
|
|
- [Sigma](https://github.com/SigmaHQ/sigma) - Generic signature format for SIEM
|
|
- [RITA](https://github.com/activecm/rita) - Real intelligence threat analytics
|
|
|
|
---
|
|
|
|
## Operating Systems & Distributions
|
|
|
|
**Security Distributions:**
|
|
- [Kali Linux](https://www.kali.org/) - Penetration testing distribution
|
|
- [Parrot Security OS](https://www.parrotsec.org/) - Security and privacy-focused
|
|
- [BlackArch Linux](https://blackarch.org/) - Penetration testing distribution
|
|
|
|
**General Operating Systems:**
|
|
- [Ubuntu](https://ubuntu.com/) - Popular Linux distribution
|
|
- [Red Hat Enterprise Linux](https://www.redhat.com/en) - Enterprise Linux
|
|
- [Windows Server](https://www.microsoft.com/en-us/windows-server) - Microsoft server OS
|
|
|
|
**Virtualization:**
|
|
- [Oracle VirtualBox](https://www.oracle.com/virtualization/technologies/vm/downloads/virtualbox-downloads.html) - Virtual machines
|
|
- [VMware Workstation](https://www.vmware.com/products/workstation-pro.html) - Virtualization platform
|
|
- [Docker](https://www.docker.com/) - Container platform
|
|
|
|
---
|
|
|
|
## Development & Collaboration
|
|
|
|
**Version Control:**
|
|
- [GitHub](https://github.com/) - Version control and collaboration
|
|
- [GitLab](https://gitlab.com/) - DevOps platform
|
|
- [Bitbucket](https://bitbucket.org/) - Git repository management
|
|
|
|
**CI/CD Security:**
|
|
- [GitGuardian](https://www.gitguardian.com/) - Secrets detection
|
|
- [TruffleHog](https://github.com/trufflesecurity/trufflehog) - Find credentials in git repos
|
|
- [Gitleaks](https://github.com/gitleaks/gitleaks) - Detect hardcoded secrets
|
|
|
|
---
|
|
|
|
[Back to Resources](./README.md) | [Back to Main](../README.md)
|