Tool-List

Open Source (ish) Tool List

---

Project maintained by citizen27 Hosted on GitHub Pages — Theme by mattgraham

Database Browsing and Analysis

• DB Browser for SQLite
  • Visual tool to create and edit database files with SQlite databases
  • Plug and play SQL commands for indexing and searching
• DBeaver
  • A versatile database tool that supports multiple databases and provides a user-friendly interface for viewing, querying, and managing database systems.
  • Supports SQL Variants and Apache Family databases
  • Licensed version supports more databses (MongoDB, BigQuery)
• DBVisualizer
  • Database management and analyiss tool, offers a pleasing visual interface
  • Supports an immense amount of database structures
• pgAdmin
  • A comprehensive administration and management platform specifically designed for PostgreSQL databases. It offers advanced features for database development and maintenance.
• MySQL Workbench
  • An official graphical tool provided by MySQL for database design, development, and administration. It supports MySQL databases and offers visual modeling features.

Deletion Utilities

• CCleaner
  • Free version does standard cleaning, but there are much better utilities
• Darik's Boot and Nuke (DBAN)
  • Supports Gutmann Method, as well as DoD Short and 5220.22
  • Many options for network wide deployment or pass settings
• Nwipe
  • Command line utility for wiping
• WinDirStat
  • Disk usage statistic viewer and cleanup tool

Exploitation

• Bloodhound
  • Windows domain pen-testing suite
  • Uses graph theory to link relationships in an AD environment
• BeEF
  • Penetration testing tool for web browsers
  • Uses client side attack vectors
• Metasploit
  • Vulnerability tester and exploiter
  • Lots and lots of modules and exploits
• Mimikatz
  • Getting windows passwords from memory
  • Build Golden Tickets and pass-the-hash
• Mitmproxy
  • HTTP traffic interception utility
  • Debugging and pentesting tool
• Nikto
  • Web server scanner
• Impacket
  • Python classes for packet analysis over the wire
• OWASP ZAP
  • Web spider and penetration testing suite

File System Forensics

Full Forensic Suites

• Autopsy
  • An open-source digital forensics platform that provides a web-based interface and supports a wide range of forensic tasks, including disk imaging, keyword searching, timeline analysis, and more.
• SANS SIFT Workstation
  • A collection of open-source tools designed for forensic practitioners. It includes various tools for digital evidence processing and analysis.
• CAINE (Computer Aided INvestigative Environment)
  • A Linux distribution focused on digital forensics and incident response. It includes a range of open-source tools for various forensic tasks.
• PALADIN
  • A Linux distribution specifically designed for digital forensics and incident response. It comes with a suite of open-source tools and is known for its ease of use.
• Sleuth Kit with Autopsy
  • The Sleuth Kit, coupled with the Autopsy graphical interface, provides a powerful open-source solution for digital forensics investigations.
• DFIR ORC
  • A collection of open-source digital forensics tools packaged together for easy installation and usage. It focuses on automation and efficiency.

General Tools

• Command Line
• Dc3dd
  • On the fly hashing
  • Pattern wiping
  • Writing errors to file
• dd
• FTK Imager
  • Imaging software of creating disk images with hash validation
  • Also useful for recovering simple deleted files from personal machine or image
• Powershell

Hashing

• HashCheck
  • Calculate and verify checksums from Windows Explorer
• HashMyFiles
  • NirSoft tool to calculate MD5 and SHA1 hashes

Hex Editors

• HxD
  • Fast and lightweight
  • Raw disk and memory editing
  • Supports files of any size
• wxHexEditor
  • For Linux, Windows and MacOS

Image and Video Tools

Malware Tools

• APIMonitor
  • Monitor and control API calls from apps and services
  • Very useful form malware call analysis
• CFF Explorer
  • Built in hex editor and unpacker
  • Portable Executable / Executable analysis
  • Useful for DLL viewing, Imported Libraries
• Detect It Easy
  • File type and information detector
  • Checks entropy, strings and built in hex editor
• PEStudio
  • Malware assessment tool
  • MITRE and VirusTotal built in to check against known hashsets
• Resource Hacker
  • Compiler and Decompiler for Windows applications
  • Useful for stepping through malware resource usage and processes
• X64dbg
  • Debugger for Windows systems
  • Useful for stepping through malware or patching

Memory Forensics

• Memory Analysis
  • Volatility
    • V2.5 for Workbench
    • V2.6 for CLI
    • Can pull DLLs, previous commands and connections from a memory image
  • YARA
    • User defined rule sets to find files matching parameters on disk or in memory
• Memory Capture
  • Belkasoft Live RAM Capturer
    • Windows
    • Extract entire dump of all volatile memory
    • Only requires sign up for use and download
  • Magnet Ram Capture
    • Windows
    • Extract entire dump of all volatile memory
    • Only requires sign up for use and download
  • WinPMem
    • Windows
    • RAM capture with three different acquisition modes

Monitoring Tools

• Event Viewer
  • Built-in to Windows
• SNORT
  • Open Source IDS
  • Network traffic analyzer with multiple configuration options
• SysInternals
  • Full published suite by Microsoft
  • Most useful tools for monitoring or ProcMon and SysMon
• Zabbix
  • Open Source SIEM for many forms of monitoring

Network Tools

• Angry IP Scanner
  • Scans any specified IP range or network by network mask
  • Runs on Linux, MacOS and Windows
• GNS3
  • Build and deploy test networks that are completely virtualized
  • Similar to Cisco Packet Tracer
• Network Miner
  • Passive network scanner / network forensic tool
  • Intuitive UI
• NMAP
  • Network discovery and basic vulnerability scanner
  • Full suite includes Zenmap, Ncat, Ndiff and Nping
• OpenVAS
  • Full featured vulnerability scanner across networks
  • Can run large scale scans and has internal programming language
• Wireshark
  • Network protocol analyzer
  • Supports both live capture and offline analysis
  • Widely used in all IT industries

Operating System Forensics

• RegShot
  • Registry comparison utility
• Rifiuti
  • Recycle Bin analysis
  • Supported through multiple versions of Windows (95 to 10)
• Zimmerman Tools
  • All of Eric Zimmerman's tools are absolutely wonderful, and the full list is linked above, but below are the tools I have found most useful.
  • JLECmd
    • JumpList artifact parser
  • KAPE
    • Collection and processing of files, super fast
  • LECmd
    • LNK file parser
  • PECmd
    • Prefetch file parser
  • RBCmd
    • Recycle Bin parser
  • RECmd
    • Windows Registry modifier and examiner

Packing and Compression

• 7-Zip
  • Compression utility widely used
• Detect It Easy
  • File type determiner
  • Also finds out entropy, strings and hashes
• UPX
  • Compression and decompression of files with no memory overhead

Passwords

• Aircrack-NG
  • Wi-Fi network security tester with monitoring, attacking, testing and cracking modes
• Hashcat
  • Password cracker
  • Very fast and robust supporting over 300 hashing algorithms
• Hydra
  • Kali Linux built in program for password and login breaking based off of wordlists
• John
  • John and John The Ripper
  • Password security auditing and recovery
• Ncrack
  • Fast network authentication cracking tool
• NirSoft Password Utilities
  • Hyper-specific tools for niche password recovery / extractions
• Ophcrack
  • Rainbow table based password cracker for Windows
• Rainbowcrack
  • Hash cracker based off of rainbow tables
  • Supports AMD and NVIDIA GPU acceleration

Randomization

• ISAAC
  • Pseudorandom number generator and stream cipher
• Mersenne Twister
  • Pseudorandom number generator
  • More widely used than ISAAC

Removable Media

• Rufus
  • Create bootable disk images from ISOs
• USBDetective
  • Process USB artifacts for all versions of Windows

OSINT

• DNS Dumpster
  • Discovers hosts related to domains
  • Only shows visible hosts for the domain
• Intelx.io
  • Search engine for darknet, private servers and more
• Metagoofil
  • Metadata extractor for public documents from target websites
• Spokeo
  • People finder
  • Essentially open source White Pages
• Thatsthem.com
  • Similar to Spokeo
• TheHarvester
  • Early stage red team engagement for assessing threat landscape

Vulnerability reference

• Exploit-db
  • Exploit database for pentesters and researchers
• MITRE
  • Attack framework for enterprise, personal, and virtual networks
• OWASP
  • Open Web Application Security Project
  • Identifies most common vulnerabilities for web applications
• VulnHub
  • Purposely vulnerable virtual machines for practice and testing