Knowledge base
Open-Source Security Tools
The testing toolbox professionals actually keep loaded: scanners, sniffers, crackers, and web proxies explained the way they are used on real engagements — commands, flags, outputs, and where each one sits in a methodology.
25 topics · 25 articles
- Nmap: The Scanner That Started Them All
Nmap answers the first real question of any engagement: what is out there and what is it running. Host discovery, port scanning, s…
- Wireshark: Reading Packets Like a Professional
Wireshark takes a capture file and makes the network legible: every protocol dissected, every stream followable, every filter a qu…
- tcpdump: The Packet Tool That Never Leaves the Server
tcpdump is the capture half of network analysis, and it lives on every server we touch. When an incident or an engagement needs ev…
- Maltego: Mapping an Attack Surface
Maltego is the OSINT graph: domains on one end, subdomains, mail servers, certificate names, exposed documents, and people on the …
- Metasploit: Framework, not Toy
Metasploit Framework is a workbench for exploitation: thousands of modules for finding, exploiting, and post-processing on one con…
- SearchSploit: The Offline Exploit Index
SearchSploit is Exploit-DB's command-line mirror: the full exploit and shellcode database local on your laptop, searchable offline…
- Burp Suite: The Web Proxy Professionals Live In
Burp Suite is the man-in-the-middle workbench for web testing: an intercepting proxy that turns every browser-session request into…
- sqlmap: Finding Injections Before They're Found
sqlmap automates SQL injection testing: it fingerprints a backend, enumerates databases and schema, and (with flags you should thi…
- Nikto: The Loud Old Web Scanner Worth Keeping
Nikto is the veteran web server scanner from 2001 that never died: it checks for dangerous files, outdated software banner strings…
- John the Ripper: Password Auditing Done Right
John the Ripper is password auditing's original workhorse: extract hashes, feed them in, and let CPU loops and wordlist rules find…
- hashcat: GPU Cracking, Rules, and Reality
hashcat is the GPU cracking engine: hash modes by the hundreds, wordlist and rule pipelines, mask attacks, and --show/--left bookk…
- THC-Hydra: Brute Force Across Protocols
Hydra is protocol brute-force plumbing: username/password testing against SSH, FTP, HTTP forms, RDP, and dozens more services from…
- Aircrack-ng: Wireless Auditing Suite
Aircrack-ng is the classic wireless suite: airmon-ng puts a card into monitor mode, airodump-ng surveys and logs, aireplay-ng gene…
- Kismet: Wireless Detection Beyond Buttons
Kismet is passive wireless detection: it listens, aggregates, and maps every access point, client, and Bluetooth-class device in r…
- Kali Linux: The Operator's Toolkit as an Operating System
Kali Linux is the penetration-testing distribution with several hundred security tools preinstalled and a rolling Debian base unde…
- Parrot Security OS: The Quieter Pentest Distribution
Parrot Security OS is the Debian-based security distribution positioned between offensive tooling and privacy posture: pentest met…
- BlackArch: The Arch Pentest Repository
BlackArch is the Arch Linux-based security distribution with a repository spanning thousands of offensive tools, installed pieceme…
- Snort: The Open-Source Signature Engine That Named the Category
Snort is the open-source intrusion detection system that defined the category two decades ago: signature rules decoded against tra…
- Suricata: The Multithreaded Network Engine with JSON-by-Default
Suricata is the OISF-backed network IDS/IPS built multithreaded from the start, with protocol parsing (HTTP, DNS, TLS metadata) an…
- Snort vs Suricata: Which Engine Watches Your Wire?
Snort and Suricata share the detection-ecosystem DNA (rule syntax, ET rules, pcap processing) and differ on architecture and outpu…
- Wazuh: The Open-Source SIEM That Actual Teams Run
Wazuh is the open-source SIEM/XDR platform built on an OSSEC lineage: agents on endpoints collecting logs and metrics, a manager a…
- Falco: Runtime Threat Detection for Containers
Falco is the CNCF runtime security tool that watches system calls; rules describe behaviors that should never happen (a shell spaw…
- Trivy: The All-in-One Vulnerability Scanner for Images and Code
Trivy is Aquasecurity's open-source scanner that checks almost everything in a modern stack: container images and filesystems, IaC…
- OpenVAS/Greenbone: The Open-Source Vulnerability Scanner
OpenVAS is the open-source vulnerability scanner at the heart of the Greenbone suite: network-level scanning of live services acro…
- Lynis: The Linux Auditing CLI for One-Command Posture Checks
Lynis is the host configuration auditor: a portable CLI that audits a Unix host's security posture in one run, hundreds of checks …
Field notes
Every tool in this category earns inclusion the same way: it has produced a finding on a real, contracted engagement for us, and it has a place in a written methodology rather than a Kali menu position. Free tools are not lesser tools; unverified claims are.
The enemy of every one of these tools is the shotgun approach: firing flags without a hypothesis, reporting scanner output without verification, and letting a script make decisions only an analyst should make. Scanning is cheap; credibility is not.
Authorization is not a footnote. Each guide repeats it in its own terms because the details change per tool — Maltego asks what data you gathered about real people, sqlmap asks whether you may copy real rows, Hydra asks whose locks you may test. The scope document answers all of it before any command runs.
Tool versions are engagement state: we pin and snapshot the toolkit at engagement start so a mid-test update cannot change behavior behind our back, and the report can always state exactly what ran.
What we publish here is what we run. When a client asks how we found the thing, every section of these guides traces from the command to the evidence file to the report line, and clients who audit the audit tend to stay clients.
Related areas
Related services
Server problem? Hacked site? Slow website?
Critical issues answered within 30 minutes, 24 hours a day, 7 days a week.