~/tools
Tools
The shelf. Two rules, applied honestly: open source we can run, you take from the source. Commercial, we point at the official page and never mirror.
Click a command or type it in the shell at the bottom. Both work, because they are the same command. One caveat about this particular shell: it has no outbound network by design, so the git clone lines below are for your own machine.
Recon
The shelf you build first, because everything else assumes you know what is out there.
| tool | get it | why it is here |
|---|---|---|
| nmap | git clone https://github.com/nmap/nmap | still the reference scanner |
| masscan | git clone https://github.com/robertdavidgraham/masscan | the one you want when nmap is too slow |
| ffuf | git clone https://github.com/ffuf/ffuf | the fuzzer worth learning |
| amass | git clone https://github.com/owasp-amass/amass | attack surface mapping |
| nuclei | git clone https://github.com/projectdiscovery/nuclei | templated checks, so you stop writing the same probe twice |
| whatweb | git clone https://github.com/urbanadventurer/WhatWeb | what the stack is, before you guess at it |
| arp-scan | git clone https://github.com/royhills/arp-scan | who is on the segment, in one command |
OSINT
What was already public before anyone thought about it being public. Collecting it is easy; knowing which of it matters is the skill, and no tool does that part.
| tool | get it | why it is here |
|---|---|---|
| theHarvester | git clone https://github.com/laramies/theHarvester | names, hosts and addresses from public sources, in one pass |
| Sherlock | git clone https://github.com/sherlock-project/sherlock | a username across a few hundred sites. The answer is usually boring, and it is still the first thing worth knowing |
| SpiderFoot | git clone https://github.com/smicallef/spiderfoot | the same collection with a correlation engine attached, for when you want the graph instead of the hits |
| subfinder | git clone https://github.com/projectdiscovery/subfinder | subdomains from passive sources, before you touch the target at all |
Exploitation
Where a lab you own stops being reconnaissance. The line here is the same one everywhere else on this site: your machines, or someone's written word.
| tool | get it | why it is here |
|---|---|---|
| Metasploit | git clone https://github.com/rapid7/metasploit-framework | still the fastest path from a bug to a shell in a lab you own |
| bettercap | git clone https://github.com/bettercap/bettercap | the LAN after you are already on it, which is the part most people skip |
| dsniff | apt install dsniff | credentials on a wire you are allowed to be listening to. Dug Song's own tarball is the upstream; the distro package is where you will actually get it |
| nikto | git clone https://github.com/sullo/nikto | noisy, old, and it still finds the thing the paid scanner missed |
Passwords
Cracking what you already hold, which is a different job from guessing at a login. The wordlist sets the floor and no more than that. Rules, masks and a GPU are where the work actually happens.
| tool | get it | why it is here |
|---|---|---|
| hashcat | git clone https://github.com/hashcat/hashcat | the reason a GPU is worth owning. Rules and masks find it, the wordlist only sets the floor |
| John the Ripper | git clone https://github.com/openwall/john | one command against a shadow file, and it takes the formats hashcat will not |
| SecLists | git clone https://github.com/danielmiessler/SecLists | the wordlists every other tool assumes you already have. Sparse-clone the directories you need, because the full tree is enormous |
Reverse engineering
Where the work actually happens once a target stops being a black box.
| tool | get it | why it is here |
|---|---|---|
| Ghidra | git clone https://github.com/NationalSecurityAgency/ghidra | the decompiler most of this work lives in, headless included |
| rizin | git clone https://github.com/rizinorg/rizin | radare2's fork, and the one that documents itself |
| radare2 | git clone https://github.com/radareorg/radare2 | the disassembler muscle memory comes from |
| objdump and nm | apt install binutils | the ground truth every decompiler is checked against |
| Unicorn | git clone https://github.com/unicorn-engine/unicorn | run one function without the world around it |
| pwndbg | git clone https://github.com/pwndbg/pwndbg | gdb that explains itself while you step |
| Detect It Easy | git clone https://github.com/horsicq/Detect-It-Easy | what packed it, before you lose an evening to it |
Radio
The part of security that is physics rather than a library.
| tool | get it | why it is here |
|---|---|---|
| GNU Radio | git clone https://github.com/gnuradio/gnuradio | where software radio stops being a metaphor |
| gr-ieee802-11 | git clone https://github.com/bastibl/gr-ieee802-11 | a real 802.11 PHY, so frames you build are frames a radio accepts |
| HackRF | https://greatscottgadgets.com/hackrf/ | half duplex, 8-bit, and enough to be dangerous. Finger-tight on the connectors |
| aircrack-ng | https://www.aircrack-ng.org/ | the suite everyone learns monitor mode on |
| Universal Radio Hacker | git clone https://github.com/jopohl/urh | protocol reverse engineering when you have no documentation |
| rtl_433 | git clone https://github.com/merbanan/rtl_433 | the 433 MHz devices already in your house, decoded |
| Kismet | git clone https://github.com/kismetwireless/kismet | passive wireless mapping without announcing yourself |
Forensics and monitoring
What you reach for after the fact, and what watches while you are not looking.
| tool | get it | why it is here |
|---|---|---|
| Volatility 3 | git clone https://github.com/volatilityfoundation/volatility3 | memory is the only place some questions have answers |
| YARA | git clone https://github.com/VirusTotal/yara | write the pattern once, hunt with it forever |
| Sleuth Kit | git clone https://github.com/sleuthkit/sleuthkit | filesystem forensics that does not spook the evidence |
| Autopsy | https://www.autopsy.com/ | Sleuth Kit with a case file and an interface |
| Zeek | https://zeek.org/ | network truth in logs rather than in a capture nobody opens |
| Falco | git clone https://github.com/falcosecurity/falco | what a process is doing right now, which file integrity cannot see |
| AIDE | git clone https://github.com/aide/aide | what changed, with a baseline you own |
| osquery | git clone https://github.com/osquery/osquery | ask a fleet a question in SQL |
| Velociraptor | git clone https://github.com/Velocidex/velociraptor | collect from many endpoints without touching each by hand |
Firmware and embedded
The layer everyone forgets is a computer, which is exactly why it is worth looking at.
| tool | get it | why it is here |
|---|---|---|
| binwalk | git clone https://github.com/ReFirmLabs/binwalk | find the filesystem inside a blob that claims to be opaque |
| UEFITool | git clone https://github.com/LongSoft/UEFITool | firmware volumes, and what is hiding in the padding |
| CHIPSEC | git clone https://github.com/chipsec/chipsec | ask the platform what it actually enabled |
| flashrom | git clone https://github.com/flashrom/flashrom | read the flash before you write to it |
| esptool | git clone https://github.com/espressif/esptool | the boards in this lab run on it |
| OpenOCD | git clone https://github.com/openocd-org/openocd | when the serial console is not enough |
Hardware
The layer under the firmware section, and the one where the laptop stops being the whole tool. Small parts, real buses, and something that lets you watch a wire.
| tool | get it | why it is here |
|---|---|---|
| Proxmark3 | git clone https://github.com/RfidResearchGroup/proxmark3 | the RFID and NFC side, read and write. Cards and fobs you own, and hotel keycards are the honest demo |
| Bus Pirate | git clone https://github.com/BusPirate/Bus_Pirate | talking SPI, I2C and UART to a chip that broke out no pins for you |
| sigrok | https://sigrok.org/ | the open logic analyzer stack. A cheap clone plus sigrok shows you a bus you otherwise cannot see |
Distros
Picking one is the wrong question. Pick the purpose, then the distribution that serves it, and accept that two of these are not things you install on a laptop you also use.
| purpose | distro | why this one |
|---|---|---|
| Anonymous, leave-no-trace sessions | Tails | amnesic by design: nothing survives the shutdown unless you ask for persistence, and asking is the exception |
| Maximum isolation, high-value targets | Qubes OS | advanced, and it is honest about being a hypervisor. Compartments, not a hardened desktop |
| Tor-routed daily driving | Whonix | two virtual machines, a gateway and a workstation. It needs a hypervisor, so it is Qubes minus the compartments rather than a distro you install alone |
| Privacy-first everyday desktop | PureOS | FSF-endorsed and small, built for Purism's own hardware |
| A well-funded default | Fedora | real security work, SELinux and Wayland by default, and telemetry that is on until you turn it off |
| Getting into a network | Kali | the one with the books and the audience. Everything you need, and a lot you do not |
| Getting into a network, with a desktop | Parrot | the same toolbox with more everyday-linux left underneath it |
| Lightweight, old hardware | antiX | the actual answer for a 2010 laptop. Debian underneath, and it stays out of the way |
| Hardened by default | OpenBSD | the defaults are the product. You do not configure your way into this posture, you inherit it |
| Owning the whole stack | Arch, Omarchy | not a privacy distribution, a sovereignty one: your kernel, your packages, no vendor in the path |
| A phone you can trust | GrapheneOS | the privacy answer that is not a desktop, and the reason the others are only half a plan |
Two notes this table will not make for you. Nearly everything here assumes the hardware is already trustworthy, which is the assumption every one of them shares and none of them checks. And an operating system is a layer, not a decision: the same job can be done on three of these, badly, by someone who never read what the defaults were doing.
More being added
Curated, not exhaustive. If a tool is on this shelf it is because someone here uses it, and because it does one job. One job, one tool: a multi-tool is a compromise you carry around, and a shelf is a set of choices someone already made.
The rest earn their place the same way this list did, by being needed on a Tuesday.