Tools Directory

Graphical intercepting proxy for testing web application security.

Automatic SQL injection detection and database takeover tool.

Comprehensive repository of web security payloads and bypass techniques.

Fast web fuzzer written in Go for directory/file/parameter discovery.

Flexible web application security fuzzer for hidden resources.

Web path scanner for finding hidden directories and files.

Intercepting proxy to replay, debug, and fuzz HTTP requests.

Automated Server-Side Template Injection (SSTI) detection and exploitation.

HTTP parameter discovery suite for finding hidden GET/POST parameters.

Context-aware API endpoint brute-forcing tool.

Fast passive subdomain discovery tool.

Multi-purpose HTTP toolkit for probing target domains.

Automated XSS vulnerability detection and exploitation.

Automated OS command injection testing tool.

Dump an exposed .git repository from a website.

Generate gopher links for SSRF payload delivery.

HTTP request smuggling detection and testing.

Bypass 403 Forbidden responses with various techniques.

Interactive JSON Web Token debugger and decoder.

Library of PHP unserialize() payloads for gadget chains.

Generates payloads for Java deserialization vulnerabilities.

Command-line tool for exploiting blind XPath injection vulnerabilities.

Automated NoSQL database vulnerability testing tool.

API testing and HTTP request debugging tool.

Inspect and debug incoming HTTP requests.

Expose local servers via secure tunnels for callbacks.

Web application attack and audit framework.

Browser-based Swiss Army knife for encoding, decoding, encryption and analysis.

Powerful open-source mathematics system for discrete logs, LLL lattice, and ECC.

Automated RSA attacks — FactorDB, Wiener, small-e, common factor, and 50+ more.

Analyse multi-byte XOR cipher and guess key length/key.

Automatically decrypt and decode ciphertext without knowing the cipher.

Online solvers for 200+ classical ciphers and encodings.

Fast automated cryptogram and substitution cipher solver.

Perform hash length extension attacks on MD5, SHA1, and SHA256 MACs.

Automated script for performing PKCS#7 CBC padding oracle attacks.

Online database for integer factorizations used in RSA challenges.

Ethereum smart contract development framework for Web3/Blockchain CTFs.

Modular automated cryptanalysis tool.

Perform hash length extension attacks on MACs.

Break PkZip encryption with known plaintext attack.

Modular online conversion, encoding, and encryption tool.

Online Vigenère cipher breaker using index of coincidence.

Interactive platform for learning modern cryptography through challenges.

Online hash lookup database for MD5, SHA1, and other common hashes.

Calculate RSA and RSA-CRT parameters from prime factors.

Encode and decode Morse code online.

NSA's free open-source RE suite — disassembler, decompiler, multi-architecture.

Industry-standard interactive disassembler and debugger.

Open-source x64/x32 Windows debugger for binary analysis.

Reverse engineering platform with a clean API and decompiler.

UNIX-like portable reverse engineering framework and disassembler.

Fork of radare2 focused on usability, with Cutter GUI.

Free and open-source GUI for Rizin reverse engineering framework.

The GNU Project debugger — standard for Linux binary debugging.

GDB plugin with context display, heap explorer, and ROP gadget finder.

Modern GDB plugin with advanced exploitation features.

Powerful binary analysis platform with symbolic execution.

Microsoft Research's theorem prover — solve constraints from RE challenges.

Dynamic instrumentation toolkit for hooking and tracing any process.

Decompile Android APKs to readable Java source code.

Reverse engineering Android APK files to Smali resources.

Decompyle++ — C++ Python bytecode disassembler and decompiler for Python 3.9+.

Extractor for standalone PyInstaller executables.

Linux toolkit distribution for reverse engineering and malware analysis.

.NET debugger and assembly editor — decompile and patch .NET binaries.

Open-source .NET assembly decompiler and navigation tool.

See how compilers turn C/C++/Rust into assembly, online.

Decompile Python 2 and 3 bytecode (.pyc) back to source.

Python CTF framework for exploit writing, service interaction, and shellcode.

Python Exploit Development Assistance for GDB.

Find ROP gadgets in ELF, PE, and Mach-O binaries.

Display file info and search for ROP/JOP/SYS gadgets.

Fast C++ ROP/COP/JOP gadget finder for x86/x64/ARM binaries.

Find one-shot execve gadgets in libc for quick RCE.

Automate libc patching and pwntools exploit template generation.

Inspect and dump seccomp sandbox filters in ELF binaries.

Simplify format string exploit construction.

Large collection of shellcodes for various architectures.

Check binary security mitigations: NX, PIE, canary, RELRO.

GDB enhanced with pwndbg for exploit development workflow.

Analyse PCAP/PCAPNG network captures and dissect 100s of protocols.

Wireshark's CLI — scriptable packet filtering and field extraction.

Extract processes, files, credentials, and connections from RAM dumps.

End-to-end open source digital forensics platform with GUI.

Suite of Windows registry, MFT, EVTX, and memory parsing utilities.

Windows registry forensic parsing framework.

Data preview and disk image acquisition tool.

Mount virtual memory dumps as a virtual file system.

Kroll Artifact Parser and Extractor for rapid triage.

Scan and extract embedded file signatures from any binary.

Read, write, and edit metadata in images, audio, video, and documents.

Recover files by their headers and footers from disk images.

File data recovery tool for lost/deleted files from any media.

Network forensics tool — extracts files and credentials from PCAPs.

Effortless PCAP analysis in the browser — no install needed.

Free online image forensics — error level analysis, metadata, clones.

High-performance digital forensics scanner for emails, URLs, and more.

CLI tools for disk image analysis and file system forensics.

Hunt for a username across 400+ social networks in seconds.

Collect a dossier on a person by username — checks 3000+ sites.

Fast python tool to enumerate subdomains using OSINT.

Automated OSINT intelligence gathering framework.

Interactive link analysis graph software for OSINT investigations.

Full-featured Web Reconnaissance framework written in Python.

Document metadata and hidden network architecture scanner.

Reverse image search and facial matching engine.

Solar position and shadow calculator for chronolocation.

Interactive tree of OSINT tools categorised by target type.

Search engine for internet-connected devices, banners, and services.

Search TLS certificates and IPv4 hosts for exposed services.

Certificate transparency log search — find all subdomains with certs.

Access cached snapshots of any website at any point in time.

Web UI for username enumeration across hundreds of platforms.

Reverse image search to find locations, objects, and sources.

Gather emails, names, subdomains, and IPs from public sources.

All-in-one image stego solver — runs zsteg, steghide, exiftool, binwalk automatically.

Online image steganography: bit-plane viewer, LSB extraction, channel splitting.

Hide and extract data in JPEG, BMP, WAV, and AU files with a passphrase.

PNG and BMP steganography analysis — checks all common bit-plane combinations.

Lightning-fast steghide passphrase cracker using a wordlist.

Hide and extract data in JPEG Discrete Cosine Transform (DCT) coefficients.

Universal steganography tool for JPEG images.

Polyglot file generator for dual valid file formats.

Java tool to visualise image bit planes and extract hidden data.

Audio file spectrogram viewer — find text/images in frequency domain.

Open-source audio editor for spectrogram and frequency analysis.

Automated stego analysis — runs many checks on an image in one go.

Brute-force steghide passphrases with a wordlist.

Whitespace steganography — hide messages in trailing spaces and tabs.

Online digital photo forensics — error level analysis and metadata.

Hide and extract secret data inside audio files.

Network discovery and security auditing — port scan, service detection, OS fingerprint.

Swiss Army knife for network attacks, MITM, WiFi and Bluetooth scanning.

802.11 wireless network auditing and WPA/WPA2 handshake cracking suite.

Fastest TCP port scanner — can scan the full internet in under 6 minutes.

Open-source network security monitor and traffic analysis framework.

Encrypted command-and-control tunnel over DNS queries.

IP over DNS tunneling tool.

Python packet manipulation and forgery framework.

LLMNR, NBT-NS, and MDNS poisoner for credentials capture.

Comprehensive suite for Man-in-the-Middle (MitM) attacks.

Single-packet network scanner for internet-wide surveys.

TCP/UDP networking Swiss Army knife — connect, listen, forward, pipe.

CLI packet capture and analysis — the Unix PCAP tool.

GPU-accelerated password cracker supporting 300+ hash types.

Classic password security auditing and recovery tool.

Parallelized login brute-forcer supporting 50+ protocols.

Multi-purpose brute-forcer written in Python.

Browser-based Swiss Army knife for encoding, decoding, encryption and analysis.

Run code in 600+ languages and esoteric interpreters in the browser.

Decode Brainfuck, Ook!, Malbolge, Piet, and other esoteric languages.

Interactive QR code reconstruction and debugging GUI.

Test, tamper, and crack JSON Web Tokens.

Identify hash types from a hash string.

Self-hosted jeopardy-style CTF platform.

Open-source CTF engine written in PHP.

Facebook Capture The Flag platform.

Upcoming CTF calendar, team rankings, and writeup archive.