Home / Cybersecurity
Cybersecurity Research Toolbox
A categorized toolbox of the industry-standard tools we use for security operations, incident response, threat intel, privacy research and analysis. Links point to official sources — swap the placeholders for your preferred mirrors any time.
Research & defense tooling
Every tool below is a well-known, publicly available project. Download only to systems you own or are explicitly authorized to test.
Jump to
Security Operations (SOC)
Wireshark
The world standard for packet capture and deep inspection — see exactly what your network is really saying.
Zeek
Passive traffic analysis framework that turns raw packets into rich, high-level security logs.
Suricata
High-performance engine for intrusion detection, prevention and network security monitoring.
Snort 3
Real-time traffic analysis and packet logging to detect and block a broad range of attacks.
Security Onion
A free, open platform for threat hunting, enterprise security monitoring and log management.
Wazuh
Open-source platform for threat detection, integrity monitoring and compliance.
Incident Response
Velociraptor
Query-driven endpoint monitoring and forensic collection at scale.
TheHive
Collaborative case management for security teams running investigations.
KAPE
Rapid, targeted collection and processing of forensic artifacts from a live system.
Volatility
Extract forensic artifacts from RAM captures — processes, network state, injected code and more.
Autopsy
GUI for The Sleuth Kit — recovers and analyzes evidence from disk images.
MVT — Mobile Verification Toolkit
Consensual forensic analysis of iOS and Android devices to hunt for signs of compromise. (GitHub)
Threat Intelligence
MISP
Collect, correlate and share structured threat indicators across trusted communities.
OpenCTI
Structure, store and visualize technical and non-technical threat intelligence.
AbuseIPDB
Check and report IP addresses engaged in abusive or malicious online activity.
ThreatFox
Share and search indicators of compromise associated with active malware.
VirusTotal
Scan files and URLs against dozens of antivirus engines and threat-intel sources.
Privacy Research
SilverArrow
Our own tracking-URL wiping, super-cookie blocking and fingerprint defense suite for Chrome, iOS and desktop.
NextDNS
Cloud DNS resolver with tracker, ad and malware blocking plus per-device profiles.
Pi-hole
DNS sinkhole you run yourself to block ads and trackers for every device on your network.
Quad9
Free recursive DNS that blocks known-malicious domains and doesn't sell your query data.
AdGuard DNS
Public and self-hosted DNS filtering for ads, trackers and phishing domains.
Tails
Boots from USB into an amnesic OS that forces all traffic through Tor and leaves no trace on the host machine.
Endpoint Visibility
OSQuery
Treats a fleet of endpoints like a queryable database of system state.
Sysmon
Logs detailed process creation, network connection and file-change activity on Windows.
Falco
Detects anomalous behavior in containers, Kubernetes and Linux hosts in real time.
CrowdSec
Behavior-based intrusion detection that shares attacker IPs across a global community.
Analyst Utilities
CyberChef
Browser-based tool for encoding, decoding, encryption and data manipulation, built by GCHQ.
YARA
Write rules that identify and classify malware samples based on textual or binary patterns.
Nmap
Host discovery, port scanning and service/version detection. The reconnaissance backbone of any assessment.
tcpdump
The classic command-line packet sniffer underlying most network capture tooling.
OWASP ZAP
Find vulnerabilities in web applications during development and testing.
Offensive & Red Team
Metasploit Framework
Develop, test and execute exploit code against a target in a controlled, authorized environment.
Infection Monkey
Safely simulate an attacker moving laterally through your network to expose weak segmentation.
Rubber Ducky
Keystroke-injection USB device that impersonates a keyboard to run pre-programmed payloads on connection.