Home › Tool
Tool
Security tools worth installing — the frameworks, CLIs and utilities you actually run, on both sides of the fence. Each entry is an honest, short note on what it does and a link to the source; no rewrites of the docs, no affiliate fluff.
On the offensive side: BloodHound for Active Directory attack paths, Pacu for AWS exploitation, and recon CLIs like ZoomEye. On the defensive side: Wazuh (open-source XDR/SIEM) and CVE Prioritizer for cutting a patch backlog down with CVSS, EPSS and KEV.
Prefer a command reference to a tool to install? The cheat sheets cover the day-to-day commands; these are the bigger pieces of kit you set up once and keep.
Wazuh — open source XDR/SIEM
Wazuh is an open source platform that combines endpoint detection and response with security information and event management in a single deployment. The appeal here is…
UAC — Unix-like Artifacts Collector
UAC is a forensic collection framework that pulls artifacts from Unix-like systems in a structured, repeatable way. For incident response teams, this matters because manual artifact…
ZoomeyeSearch — ZoomEye recon CLI
CLI wrapper for ZoomEye's search API, designed to script reconnaissance at scale. Pulls data on exposed services and infrastructure from ZoomEye's public internet scans. Useful for…
BloodHound — AD attack path management
BloodHound maps Active Directory relationships and permission chains to surface attack paths that would be invisible in raw logs or GUI tools. It builds a graph…
CAI — agent-based cybersecurity AI framework
Agent-based framework for building AI-driven security tools and simulations. Sits between raw ML and operational security work—lets you model threats, test defenses, and prototype detection logic…
SkyEye — AWS IAM enumeration
AWS IAM enumeration tool that maps permissions, roles, and trust relationships across an AWS account. Built for penetration testers and cloud security auditors who need to…
CVE Prioritizer — CVSS + EPSS + KEV triage
A triage tool that layers CVSS severity scores with EPSS exploit probability and CISA's known-exploited list to rank which vulnerabilities actually need your attention first. The…
DSViper — AV evasion / post-exploitation
DSViper is a tool that generates evasion-capable binaries designed to bypass antivirus detection. The creator acknowledges the default output gets flagged immediately and provides scripting to…
Pacu — AWS exploitation framework
Open-source framework for simulating attacks against AWS environments. Pacu automates reconnaissance and exploitation workflows across IAM, networking, and data storage — useful for red teams validating…