All Security Tools
Browse the full catalog of 53 free online security tools - offensive penetration-testing utilities and defensive audit tools, all in one place.
- 98Total Tools
- 46Offensive Security
- 52Defensive Security
- 21Workflows
Offensive SecurityAdvancedWeb Shell FinderDetect web shell uploads on target systems.webshell-finderAPIOffensive SecurityIntermediateWAF DetectorDetect Web Application Firewall on target systems.waf-detectorAPIOffensive SecurityBasicCMS DetectorIdentify the Content Management System used by the target.cms-detectorAPIOffensive SecurityIntermediateTech Stack AnalyzerIdentify technologies used by target websites.tech-stack-analyzerAPIOffensive SecurityIntermediateWAF Test Payload GeneratorGenerate WAF detection and testing payloads to test WAF security.waf-test-generatorAPIOffensive SecurityIntermediateCORS Misconfig ScannerTest CORS misconfiguration: origin reflection, credentials leak, null origin, wildcard abuse.cors-scannerAPIDefensive SecurityIntermediateHash AnalyzerAnalyze, identify, and verify hash types.hash-analyzerAPIDefensive SecurityIntermediateEmail Header AnalyzerParse and analyze email headers for investigation.email-header-analyzerAPIDefensive SecurityIntermediateJWT DecoderDecode and analyze JSON Web Tokens with vulnerability testing.jwt-decoderAPIDefensive SecurityIntermediateMagic DetectorAuto-detect encoding, hash, and data type from input.magic-detectorAPIDefensive SecurityBasicMetadata ExtractorReference guide for extracting metadata from images, PDFs, Office docs, audio, and video (EXIF, GPS, author).metadata-extractorAPIDefensive SecurityIntermediateIOC ExtractorExtract indicators of compromise (IPs, domains, hashes, emails, URLs, CVEs) from pasted text.ioc-extractorAPIOffensive SecurityIntermediateCloud Storage Bucket ScannerCheck whether a name is a publicly listable AWS S3 bucket, Azure Blob container, or Google Cloud Storage bucket.s3-bucket-scannerAPIOffensive SecurityAdvancedContainer Security ScannerCheck a host for unauthenticated Docker and Kubernetes management APIs (Docker Engine, Kubernetes API server, kubelet, etcd) plus a container-hardening checklist.docker-kubernetes-scannerAPIDefensive SecurityBasicCVSS v3.1 CalculatorInteractive CVSS v3.1 base score calculator with per-metric selectors.cvss-calculatorAPIDefensive SecurityIntermediateDGA DetectorDetect algorithmically generated domains (DGA) using entropy, n-gram, and pattern analysis.dga-detectorAPIDefensive SecurityIntermediateLog AnalyzerParse and analyze Apache, Nginx, syslog, and generic logs for anomalies and attack patterns.log-analyzerAPIDefensive SecurityBasicCVE Lookup & EnrichmentLook up CVE details from the NVD: CVSS score, CWE mapping, references, and exploit-DB link.cve-lookupAPIDefensive SecurityIntermediateYARA Rule GeneratorBuild a YARA detection rule from ransomware, web shell, keylogger, or generic string templates.yara-rule-generatorAPIDefensive SecurityIntermediateSigma Rule GeneratorGenerate a Sigma SIEM detection rule (YAML) for a chosen log source.sigma-rule-generatorAPIDefensive SecurityBasicVulnerability FeedBrowse recently published CVEs from the NVD, filterable by severity, keyword, and CISA KEV status.vulnerability-feedAPIOffensive SecurityIntermediateGit & Secrets Exposure ScannerCheck a live web target for publicly exposed .git directories, .env files, backups, and other sensitive paths.git-exposure-scannerAPIDefensive SecurityIntermediateHoneypot Config GeneratorGenerate docker-compose deployment templates for Cowrie, Dionaea, Honeytrap, Wordpot, or Conpot honeypots.honeypot-config-generatorAPIDefensive SecurityIntermediateForensic Timeline BuilderNormalize a pasted JSON array of {timestamp, description} events into a sorted forensic timeline with export format guidance.forensic-timelineAPI
Showing 25 of 98 tools