Awesome Security

A curated collection of fantastic software, libraries, documents, books, and resources dedicated to security. From network and endpoint protection to threat intelligence and web security — a comprehensive list to enhance your security knowledge and practices.

• Metasploit Framework – tool for developing and executing exploit code against a remote target machine.
• Nmap – free and open source utility for network discovery and security auditing.
• Nuclei – fast, customizable vulnerability scanner based on simple YAML-based templates.
• OpenVAS – framework of services and tools offering comprehensive vulnerability scanning and management.
• pig – Linux packet crafting tool.
• Pompem – open source tool to automate the search for exploits in major databases.
• scapy – Python-based interactive packet manipulation program and library.

• Fibratus – tool for exploration and tracing of the Windows kernel activity.
• httpry – specialized packet sniffer for displaying and logging HTTP traffic.
• justniffer – network protocol analyzer that captures traffic and produces customized logs.
• ngrep – pcap-aware tool applying grep-like features to the network layer.
• ntopng – network traffic probe showing usage similar to the Unix top command.
• passivedns – tool to collect DNS records passively for incident handling and NSM.
• sagan – multi-threaded, real-time log analysis engine with a Snort-like rule set.

• AIEngine – next generation interactive Python/Ruby/Java/Lua packet inspection engine with NIDS functionality.
• Denyhosts – thwart SSH dictionary-based and brute force attacks.
• Fail2Ban – scans log files and takes action on IPs that show malicious behavior.
• Falco – cloud-native runtime security tool for detecting unexpected behavior in Linux systems.
• Lynis – open source security auditing tool for Linux/Unix.
• OSSEC – comprehensive open source HIDS performing log analysis, file integrity, rootkit detection and alerting.
• Security Onion – Linux distro for intrusion detection, network security monitoring, and log management.
• Snort – free and open source network intrusion prevention and detection system.
• SSHGuard – software protecting services in addition to SSH, written in C.
• sshwatch – IPS for SSH written in Python, gathers attacker information during attacks.
• Stealth – file integrity checker that leaves virtually no sediment on the monitored host.
• Suricata – high performance Network IDS, IPS and Network Security Monitoring engine.
• Wazuh – open source security platform unifying SIEM, XDR, and cloud security capabilities.
• Zeek – powerful network analysis framework (formerly Bro).

• Amun – Python-based low-interaction honeypot.
• awesome-honeypots – the canonical awesome honeypot list.
• Bifrozt – NAT device that works as a transparent SSHv2 proxy between an attacker and your honeypot.
• Conpot – ICS/SCADA low-interactive server-side honeypot.
• Cuckoo Sandbox – open source software for automating analysis of suspicious files.
• Dionaea – nepenthes successor honeypot embedding Python as scripting language.
• Glastopf – honeypot emulating thousands of vulnerabilities to gather web attack data.
• HoneyDrive – premier honeypot Linux distro with over 10 pre-installed honeypot packages.
• HoneyPy – low to medium interaction honeypot, easy to deploy and extend.
• HonSSH – high-interaction honeypot sitting between an attacker and a honeypot over SSH.
• Kippo – medium interaction SSH honeypot for logging brute force attacks.
• Kojoney – low level interaction honeypot emulating an SSH server.

• Dshell – network forensic analysis framework enabling rapid development of dissection plugins.
• Moloch – open source large scale IPv4 packet capturing, indexing and database system.
• OpenFPC – lightweight full-packet network traffic recorder and buffering system.
• stenographer – packet capture solution that spools all packets to disk for fast subset access.
• tcpflow – captures TCP connection data and stores it for protocol analysis and debugging.
• Xplico – open source Network Forensic Analysis Tool extracting applications data from captures.

• netsniff-ng – free Linux networking toolkit using zero-copy mechanisms for high performance.
• Wireshark – free and open-source packet analyzer with graphical front-end and filtering options.

• FIR – Fast Incident Response, a cybersecurity incident management platform.
• OSSIM – AT&T Cybersecurity SIEM with event collection, normalization, and correlation.
• Prelude – universal SIEM collecting, normalizing, aggregating and correlating security events.

• OpenVPN – open source VPN using a custom security protocol utilizing SSL/TLS for key exchange.
• WireGuard – extremely simple yet fast and modern VPN utilizing state-of-the-art cryptography.

• DPDK – set of libraries and drivers for fast packet processing.
• netmap – framework for high speed packet I/O available for FreeBSD, Linux and Windows.
• PACKET_MMAP/TPACKET/AF_PACKET – Linux kernel mechanism for high-performance packet capture and transmission.
• PF_RING – network socket dramatically improving packet capture speed.
• PF_RING ZC (Zero Copy) – flexible packet processing framework achieving line rate at any packet size.
• PFQ – functional networking framework for efficient packet capture and in-kernel processing.

• fwknop – protects ports via Single Packet Authorization.
• OPNsense – open source, easy-to-use FreeBSD-based firewall and routing platform.
• pfSense – firewall and Router FreeBSD distribution.

• SpamAssassin – powerful and popular email spam filter employing a variety of detection techniques.

• docker pull kalilinux/kali-rolling – official Kali Linux
• docker pull ghcr.io/zaproxy/zaproxy:stable – official OWASP ZAP
• docker pull wpscanteam/wpscan – official WPScan
• docker pull metasploitframework/metasploit-framework – Metasploit
• docker pull citizenstig/dvwa – Damn Vulnerable Web Application
• docker pull hmlio/vaas-cve-2014-6271 – Vulnerability as a service: Shellshock
• docker pull hmlio/vaas-cve-2014-0160 – Vulnerability as a service: Heartbleed
• docker pull opendns/security-ninjas – Security Ninjas
• docker pull ismisepaul/securityshepherd – OWASP Security Shepherd

• ClamAV – open source antivirus engine for detecting trojans, viruses, malware and other threats.
• Linux Malware Detect – malware scanner for Linux designed around threats in shared hosted environments.

• DocBleach – open-source CDR software sanitizing Office, PDF and RTF documents.

• Rudder – web-driven, role-based solution for IT Infrastructure Automation and Compliance.

• google-authenticator – implementations of one-time passcode generators and a PAM module.

• android-security-awesome – collection of Android security related resources.
• OWASP Mobile Security Testing Guide – comprehensive manual for mobile app security testing and reverse engineering.
• OSX Security Awesome – collection of OSX and iOS security resources.

• grr – GRR Rapid Response is an incident response framework focused on remote live forensics.
• ir-rescue – Windows Batch and Unix Bash scripts to collect host forensic data during incident response.
• mig – platform to perform investigative surgery on remote endpoints in parallel.
• Velociraptor – tool for collecting host-based state information using Velociraptor Query Language.
• Volatility – Python-based memory extraction and analysis framework.

• abuse.ch – tracks Command&Control servers and provides domain and IP blocklists.
• AlienVault Open Threat Exchange – collaborative threat intelligence network.
• AutoShun – Snort plugin correlating attacks across sensors, honeypots and mail filters worldwide.
• CIFv2 – cyber threat intelligence management system combining malicious threat information from many sources.
• CriticalStack – free aggregated threat intel for the Zeek network security monitoring platform.
• DNS-BH – listing of domains known to propagate malware and spyware.
• Emerging Threats - Open Source – open source community providing Suricata and Snort rules, firewall rules and IDS rulesets.
• FireEye OpenIOCs – FireEye publicly shared Indicators of Compromise.
• ICHI - Internet Cyber Health Index – free, source-transparent daily barometer of global Internet cyber health, aggregating telemetry from 100+ public feeds into a single index; creator-maintained.
• IntelMQ – solution for CERTs for collecting and processing security feeds using a message queue protocol.
• Internet Storm Center – free analysis and warning service for Internet threats.
• MISP – open source threat intelligence and sharing platform.
• OpenVAS NVT Feed – public feed of Network Vulnerability Tests containing 35,000+ NVTs.
• PhishTank – collaborative clearing house for phishing data with open API.
• Project Honey Pot – distributed system for identifying spammers and harvesting bots.
• SBL / XBL / PBL / DBL / DROP / ROKSO – Spamhaus real-time anti-spam protection and blocklists.
• TheHive – scalable, open source security incident response platform.
• Tor Bulk Exit List – CollecTor data-collecting service providing Tor network data.
• virustotal – free online service analyzing files and URLs for malicious content detected by 70+ AV engines.

• OWASP – the Open Web Application Security Project, focused on improving the security of software.

• ironbee – open source universal web application security sensor and WAF framework.
• ModSecurity – toolkit for real-time web application monitoring, logging, and access control.
• NAXSI – open-source, high performance, low rules maintenance WAF for NGINX.
• sql_firewall – SQL Firewall extension for PostgreSQL.

• ACSTIS – scans web applications for AngularJS Client-Side Template Injection vulnerabilities.
• Infection Monkey – semi-automatic pen testing tool for mapping and pen-testing networks.
• Nikto – open source web server scanner performing comprehensive tests against web servers.
• OWASP Testing Checklist v4 – list of controls to test during a web vulnerability assessment.
• PTF – Penetration Testers Framework providing modular support for up-to-date tools.
• Recon-ng – full-featured Web Reconnaissance framework written in Python.
• sqlmap – open source penetration testing tool automating detection and exploitation of SQL injection.
• w3af – Web Application Attack and Audit Framework.
• ZAP – OWASP Zed Attack Proxy, easy-to-use integrated penetration testing tool.

• Sqreen – Runtime Application Self-Protection solution instrumenting and monitoring the app at runtime.

• OAuth 2 in Action – book teaching practical use and deployment of OAuth 2.
• Secure by Design – book identifying design patterns and coding styles that reduce security vulnerabilities.
• Securing DevOps – book exploring how DevOps and Security techniques apply together for safer cloud services.
• Semgrep – fast, open source static analysis tool for finding bugs and enforcing code standards.
• Understanding API Security – free eBook on how APIs are put together and how OAuth protects them.

• Usable Security Course – Coursera course on the intersection of security and usability.

• Apache Metron – integrates open source big data technologies for centralized security monitoring and analysis.
• Apache Spot – open source software for leveraging insights from flow and packet analysis.
• binarypig – scalable binary data extraction in Hadoop for malware processing and analytics.
• data_hacking – examples using IPython, Pandas, and Scikit Learn to get the most out of security data.
• hadoop-pcap – Hadoop library to read packet capture (PCAP) files.
• OpenSOC – integrates open source big data technologies for centralized security monitoring.
• Workbench – scalable Python framework for security research and development teams.

• aws-vault – store AWS credentials in the OSX Keychain or an encrypted file.
• blackbox – safely store secrets in a VCS repo using GPG.
• chamber – store secrets using AWS KMS and SSM Parameter Store.
• confidant – stores secrets in AWS DynamoDB, encrypted at rest and integrated with IAM.
• credstash – store secrets using AWS KMS and DynamoDB.
• dotgpg – tool for backing up and versioning production secrets or shared passwords securely.
• passbolt – open source, extensible password manager based on OpenPGP.
• redoctober – server for two-man rule style file encryption and decryption.
• Safe – a Vault CLI making reading and writing to Vault easier.
• Sops – editor of encrypted files supporting YAML, JSON and BINARY formats with AWS KMS and PGP.
• Vault – encrypted datastore secure enough to hold environment and application secrets.

• Checkov – static code analysis tool for infrastructure-as-code detecting security misconfigurations.
• Securing DevOps – book on security techniques for DevOps reviewing state-of-the-art practices.
• tfsec – static analysis security scanner for Terraform code.

• Best Linux Penetration Testing Distributions @ CyberPunk – description of main penetration testing distributions.
• Security @ Distrowatch – website reviewing and tracking open source security operating systems.
• Security related Operating Systems @ Rawsec – complete list of security related operating systems.

• Falco – cloud-native runtime security detecting unexpected behavior and configuration changes.
• Kube-bench – checks whether Kubernetes is deployed according to CIS security benchmarks.
• Kube-hunter – security scanner discovering vulnerabilities and security issues in Kubernetes clusters.
• Kubernetes CIS Benchmark – official CIS benchmark with security configuration guidelines for Kubernetes.
• Kubesec – scans Kubernetes resource manifests for security issues, providing risk scores.
• Open Policy Agent (OPA) – general-purpose policy engine for fine-grained, context-aware policies in Kubernetes.
• Trivy – comprehensive vulnerability scanner for container images, file systems and Kubernetes clusters.

• Azure Defender for Cloud – Microsoft Azure's unified security management with advanced threat protection.
• Cloud Custodian – cloud security policy automation tool managing governance across cloud environments.
• Cloud Security Alliance – provides best practices and security guidance for cloud computing environments.
• GCP Security Command Center – Google Cloud's security and risk management platform for threat detection and compliance.
• Prowler – open source cloud security tool for AWS, Azure and GCP security assessments and audits.
• ScoutSuite – multi-cloud security auditing tool providing comprehensive security posture assessments.

• Grype – vulnerability scanner for container images and filesystems.
• Nessus – widely used commercial vulnerability scanner.
• OpenVAS – open source vulnerability scanner.
• Qualys Community Edition – free version of Qualys vulnerability scanner.
• Rapid7 Nexpose – vulnerability and risk management scanner.
• Vuls – vulnerability scanner for Linux, FreeBSD and containers.
• Website Vulnerability Scanner – self-hosted website vulnerability scanner with 200 deterministic modules covering OWASP, CMS, and AI surfaces.

• HashiCorp Boundary – infrastructure access management.
• Keycloak – open source Identity and Access Management.
• OAuth 2.0 – authorization standard.
• OpenID Connect – identity layer on top of OAuth 2.0.

• OWASP Serverless Top 10 – list of top threats in serverless applications.
• PureSec – security for serverless functions.
• Snyk Serverless – Snyk security scanning for serverless applications.

• Android Security Awesome – collection of Android security related resources.
• Awesome CTF – curated list of CTF frameworks, libraries, resources and software.
• Awesome Cyber Skills – curated list of legal hacking environments to train cyber skills.
• Awesome Hacking – curated list of hacking tutorials, tools and resources.
• Awesome Honeypots – awesome list of honeypot resources.
• Awesome Incident Response – curated list of resources for incident response.
• Awesome Industrial Control System Security – resources related to ICS security.
• Awesome Linux Containers – curated list of Linux Containers frameworks, libraries and software.
• Awesome Malware Analysis – curated list of malware analysis tools and resources.
• Awesome PCAP Tools – tools for processing network traces.
• Awesome Pentest – collection of penetration testing resources, tools and shiny things.
• Awesome Pentest Cheat Sheets – cheat sheets useful for pentesting.
• Awesome Threat Detection and Hunting – curated list of threat detection and hunting resources.
• Awesome Threat Intelligence – curated list of threat intelligence resources.
• Awesome Web Hacking – list for learning about web application security.
• Awesome YARA – curated list of awesome YARA rules, tools, and people.

See CONTRIBUTING.md for guidelines.

MIT © Think Cube