Home / Cybersecurity
Cybersecurity Research Toolbox
A categorized toolbox of the industry-standard tools we use for security operations, incident response, threat intel, privacy research and analysis. Links point to official sources — swap the placeholders for your preferred mirrors any time.
Research & defense tooling
Every tool below is a well-known, publicly available project. Download only to systems you own or are explicitly authorized to test.
Security Operations (SOC)
Wireshark
The world standard for packet capture and deep inspection — see exactly what your network is really saying.
Zeek
Passive traffic analysis framework that turns raw packets into rich, high-level security logs.
Suricata
High-performance engine for intrusion detection, prevention and network security monitoring.
Snort 3
Real-time traffic analysis and packet logging to detect and block a broad range of attacks.
Security Onion
A free, open platform for threat hunting, enterprise security monitoring and log management.
Incident Response
Threat Intelligence
MISP
Collect, correlate and share structured threat indicators across trusted communities.
Privacy Research
SilverArrow
Our own tracking-URL wiping, super-cookie blocking and fingerprint defense suite for Chrome, iOS and desktop.
Pi-hole
DNS sinkhole you run yourself to block ads and trackers for every device on your network.
Quad9
Free recursive DNS that blocks known-malicious domains and doesn't sell your query data.
Tails
Boots from USB into an amnesic OS that forces all traffic through Tor and leaves no trace on the host machine.
Endpoint Visibility
Analyst Utilities
CyberChef
Browser-based tool for encoding, decoding, encryption and data manipulation, built by GCHQ.
YARA
Write rules that identify and classify malware samples based on textual or binary patterns.
Nmap
Host discovery, port scanning and service/version detection. The reconnaissance backbone of any assessment.
Offensive & Red Team
Metasploit Framework
Develop, test and execute exploit code against a target in a controlled, authorized environment.
Infection Monkey
Safely simulate an attacker moving laterally through your network to expose weak segmentation.
Rubber Ducky
Keystroke-injection USB device that impersonates a keyboard to run pre-programmed payloads on connection.