#1Database assessment, SQL injection testing, auditing, encryption, and activity monitoring tools.
Kitploit recommended
rapid7/metasploit-frameworkOpen-source exploitation framework with modular payload, encoder, and auxiliary system for penetration testing, vulnerability validation, and…
dbeaver/dbeaverFree universal database tool and SQL client
sqlmapproject/sqlmapAutomatic SQL injection and database takeover tool
nmap/nmapHigh-performance network discovery and security auditing tool with advanced port scanning, OS detection, service version detection, and scriptable…
gchq/cyberchefThe Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
jumpserver/jumpserverJumpServer is an open-source Privileged Access Management (PAM) platform that provides DevOps and IT teams with on-demand and secure access to SSH,…
projectdiscovery/nucleiFast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…
aquasecurity/trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
gravitational/teleportThe easiest, and most secure way to access and protect all of your infrastructure.
wazuh/wazuhOpen-source XDR and SIEM platform for threat detection, log analysis, file integrity monitoring, vulnerability assessment, and compliance management…
fortra/impacketPython library for low-level network protocol manipulation, featuring SMB, MSRPC, Kerberos, and WMI implementations with tools for authentication…
zaproxy/zaproxyOpen-source web application security scanner for automated vulnerability detection, manual penetration testing, and API security testing with a…
prowler-cloud/prowlerProwler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.…
cisofy/lynisAgentless security auditing tool for Linux, macOS, and UNIX systems. Performs in-depth scans for vulnerabilities, configuration issues, and…
semgrep/semgrepLightweight static analysis for many languages. Find bug variants with patterns that look like source code.
gojue/ecaptureCapturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
misp/mispMISP (core software) - Open Source Threat Intelligence and Sharing Platform
sjzar/chatlogchat log tool, easily use your own chat data. 聊天记录工具，轻松使用自己的聊天数据
