Useful Links

Ahmia

A search engine for Tor hidden services and other dark web content.

Censys

Up-to-date map of the internet for assessing attack surface for Internet connected devices.

Certificate Search

A web interface that lets you search for web certificates.

CertStream

An intelligence feed that gives you real-time updates from the Certificate Transparency Log network.

Columbus Project

A subdomain enumeration service with advanced queries.

Cookiedatabase

Cookie details and the services that place these cookies.

CVExploits

A comprehensive database for CVE exploits from across the internet.

Dehashed

Data-mining and deep web asset search engine.

FOFA Search Engine

Search engine for cyberspace.

FullHunt

Attack surface database of the entire Internet.

Grayhatwarfare

Search for Open Amazon s3 Buckets and their contents.

GreyNoise Visualizer

A platform that collects and analyzes Internet-wide scan and attack traffic.

Hudson Rock

Free cybercrime intelligence tools.

IBM X-Force Exchange

Search the latest global security threats.

Intelligence X

A search engine and data archive for leaked datasets, darknet content and historical web pages.

Merklemap

Search engine for Certificate Transparency logs, useful for subdomain and asset discovery.

Open Bug Bounty

A community-driven platform for coordinated disclosure of website vulnerabilities.

Phonebook.cz

Phonebook lists all domains, email addresses, or URLs for the given input domain with 121 billion records.

PimEyes

PimEyes is an online face search engine.

PublicWWW

Source code search engine to find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code.

RansomLook

Tracks and archives ransomware group leak sites and victim disclosures.

RocketReach

A data broker that curates a massive database containing contact information.

Shodan

Search engine for Internet-connected devices.

Simple Email Reputation

Search and discover the reputation behind an email address.

TableConvert

Convert Excel data to Textile Table.

Tranco List

A research-oriented ranked list of top domains, useful for target and wordlist research.

VulnCheck

Vulnerability intelligence platform with exploit and threat data.

Web-Check

An all-in-one OSINT tool that aggregates DNS, SSL, headers, technology and hosting details for a website.

ZoomEye

A cyberspace search engine.

vx-underground

A large archive of malware samples and source code for research purposes.

whatismytenantid

Find the Microsoft Azure and Microsoft 365 tenant ID for a domain name.

whatsmyname

Enumerate username usage across hundreds of websites.

DNSLog Platform

Allows anyone to get a random subdomain under 'dnslog.cn'. The website allows you to monitor any resolution requests for the random subdomain you generated.

ExpiredDomains

All the information on expired domains that are pending delete.

Google Public DNS

Online DNS name resolver.

OpenDNS

Domain tagging.

Robtex

Robtex uses various sources to gather public information about IP numbers, domain names, host names, Autonomous systems, routes etc.

Symantec Sitereview

Check and dispute the current WebPulse categorization for any URL.

ViewDNS.info

Gather a large amount of data about a given website or IP address.

WhoisXML API (WHOIS History)

WHOIS history tools to check domain name ownership history.

WhoisXML API (WHOIS Lookup)

Perform live WHOIS lookups for domain names and IP addresses.

XploreDomains

Search and explore domain registration, ownership and availability data.

42Crunch

Online API security scanner.

AntiScan

Scan your file with over 26 anti-viruses.

API Security Audit

Online audit tool that checks an OpenAPI/Swagger definition for common API security issues.

CSP Evaluator

Checks a Content Security Policy for common bypasses and misconfigurations.

Hacker Target

Hosted vulnerability scanners.

Lynis

Open-source security auditing tool for Linux, macOS and Unix-based systems, maintained by CISOfy.

Mozilla Observatory

Set of tools to analyze a website and inform you if it is not using the many available methods to secure it.

Netcraft

Scan and discover the web technologies and internet infrastructure powering any site.

Pentest Tools

Various online pentesting and scanning tools.

ProjectDiscovery Cloud

Hosted platform for running Nuclei scans and managing results at scale.

Qualys SSL Labs

SSL server test that performs a deep analysis of the configuration of any SSL web server on the public Internet.

VirusTotal

Analyse suspicious files, domains, IPs and URLs to detect malware and other breaches, automatically share them with the security community.

Wappalyzer

Find out the technology stack of any website.

AbuseIPDB

A central blacklist for webmasters, system administrators, and other interested parties to report and find IP addresses that have been associated with malicious activity online.

AtSameIP

Find other domains and websites hosted on the same IP address.

Cisco Talos

Various intelligence on IPs, domains etc.

Cloudflare IP Ranges

Published list of IP ranges used by Cloudflare, useful for recon and WAF identification.

Cloudflare Radar

Visibility into global Internet traffic, outages and attack trends collected by Cloudflare.

Hurricane Electric BGP Toolkit

Look up ASN, BGP route and IP allocation data for a given network.

IPaddress.com

IP lookup, geolocation and subnet calculator tools.

IPaddressguide

Free IP address and other Internet related tools.

IPcalc

Takes an IP address and netmask and calculates the resulting broadcast, network, Cisco wildcard mask, and host range.

IPinfo

IP geolocation, company, carrier and IP type data sets.

IPvoid

A range of IP address tools to discover details about IP addresses. IP blacklist check, whois lookup, dns lookup, ping etc.

Ifconfig.me

An online tool to get your public IP address.

NetworksDB

Information about the public IPv4 and IPv6 addresses, networks and domains owned by companies and organization's across the world along with city-level IP geolocation data and autonomous system information.

Project Honey Pot

List of compromised and Malicious IPs and other data.

Tunnel Broker

Hurricane Electric's free IPv6 tunnel broker service.

YouGetSignal

Network tools including port forwarding tests and reverse IP domain checks.

AADInternals

The ultimate Entra ID (Azure AD) / Microsoft 365 hacking and admin toolkit.

AADInternals Techniques

Blog documenting AADInternals techniques and Entra ID / Microsoft 365 attack research.

AMSI.fail

Generates obfuscated PowerShell snippets that break or disable AMSI for the current process.

Anonbin

A minimal-logging pastebin alternative for sharing text and data anonymously.

ANY.RUN

Interactive online malware analysis service.

APKCombo

Download Android APK mobile apps from Google Play store.

APK Downloader (Evozi)

Extract a direct APK download link from a Google Play Store app page.

ASCII Character Chart

ASCII character chart with decimal, binary and hexadecimal conversions.

ASP.NET ViewState Decoder

Decode the ASP.NET ViewState strings and display in tree view format online.

Basic Authenticator Header Generator

Create basic authenticator headers online.

Browserling

Online cross-browser testing tool.

Canarytokens

Create payloads that trigger an alert when a victim accesses them.

Code Beautify

Code Formatter, JSON Beautifier, XML Viewer, Hex Converters and more.

CORS Tester

Test an endpoint for Cross-Origin Resource Sharing misconfigurations.

CSP Bypass

A database of Content Security Policy bypass gadgets by CDN and domain.

CVSS Calculator

Official FIRST.org calculator for scoring vulnerabilities under the CVSS v3 standard.

DB Fiddle

Testing SQL commands across a variety of database schemas.

dCode.fr

A collection of over 900 tools to help solve games, riddles, ciphers, mathematics, puzzles, etc.

de4js

Online JavaScript deobfuscator and unpacker.

Excalidraw

A whiteboard tool that lets you sketch diagrams that have a hand-drawn feel to them.

File.kiwi

Temporary, link-based file sharing with automatic expiry.

GraphiQL Online

Online available instance of GraphiQL.

iKat

Aid security consultants with the task of auditing the security of Kiosk terminals.

JSON Web Tokens Builder

Creating JSON Web Tokens online for use in testing.

JWT

Decode, verify and generate JWT.

Living Off Trusted Sites (LOTS) Project

List of websites that allow attackers to use their domain or subdomain for hosting phishing, C&C etc.

msportals.io

A directory of Microsoft 365 and Azure admin portal links.

Online Reverse Shell Generator

An online reverse shell generator.

OpenCRE

Common Requirement Enumeration - links topics across OWASP and other security standards to relevant guidance.

OWASP Application Security Verification Standard

A framework of security requirements for verifying the security of web applications.

OWASP Risk Rating Calculator

Risk Rating Calculator based on OWASP's Risk Rating Methodology.

OWASP Web Security Testing Guide

A comprehensive methodology guide for testing the security of web applications.

Pastebin

Store any text online for easy sharing. Find leaked creds etc.

Pine Tools

Generate a list of numbers online.

PInvoke.net

A community wiki of .NET P/Invoke signatures for calling native Windows APIs.

PostBin (Original)

The original request bin service for capturing and inspecting HTTP requests, useful for testing webhooks and out-of-band interactions.

PostBin (Toptal)

Collect all requests to a special URL which you can use to test for out-of-band vulnerabilities.

Regular Expressions Reference

A regex reference and tutorial site, including detailed guidance on validating emails and other common patterns.

Replit

Online integrated development environment.

Reviews

Google review link generator

Sandboxie-Plus

A sandbox-based isolation software for 32- and 64-bit Windows NT-based operating systems

SQL Fiddle

Online SQL compiler that lets you write, edit, and execute any SQL query.

Tenant Partition Lookup

Look up which Microsoft 365 cloud partition a tenant belongs to.

Text ASCII Art Generator

Generate ASCII art text banners for scripts, reports and terminal output.

The Hacker Recipes

A structured, community-maintained methodology reference covering attack techniques across many protocols and technologies.

Unit Conversion

A comprehensive unit conversion website.

User Agent String Parser

Parses a user agent string into its component browser, engine and OS details.

UUID Generator

Online UUID Generator.

W3cub Tools

HTML escape and unescape online.

W3Schools iFrame

Online iFrame tool. Create and test iFrames online.

WhatIsMyBrowser

Know what browser you're using, with a list of your web browser's settings.

Wormhole

Share files with end-to-end encryption and a link that automatically expires. Useful for data exfiltration.

promptfoo

An open-source tool for red-teaming and evaluating LLM applications.

regex101

An online regex tester and debugger with real-time explanation.

CrackStation

CrackStation uses massive pre-computed lookup tables to crack password hashes.

CyberChef

The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis.

dCode.fr

A collection of over 900 tools to help solve games, riddles, ciphers, mathematics, puzzles, etc.

Dehashed

Data-mining and deep web asset search engine.

Hashcat Example Hashes

Reference list of example hashes for every mode supported by hashcat.

Hashes

Decrypt MD5, SHA1, MySQL, NTLM, SHA256, MD5 Email, SHA256 Email, SHA512 hashes.

HashMob

A community hash cracking platform with leaderboards and hash lookup.

NTLM to Password

NTLM to plaintext password "cracking" service, using a custom high performance database with billions of precomputed password hashes

MD5Hashing.net

Hash and decode various hashes.

Nitrxgen MD5 Database

A look-up tool for typical unsalted MD5 cryptographic hashes. The database currently contains 1.1+ trillion passwords.

Online Hash Crack

Professional Cloud Password Testing & Recovery Services.

Online Hash Tools

Online hash tools is a collection of useful utilities for cryptographically hashing data.

WPA-sec

A distributed WPA/WPA2 handshake cracking service backed by a shared wordlist.