This is a collection of tools you can use to build a security framework in a project, a company or any other organization. Some of these tools are open-source software or provide a free plan (community edition).
I couldn't clearly categorize all of these tools. So I put some of them in category that seemed most appropriate to me.
| Asset Management |
|
AssetTiger
|
AssetTiger makes it easy to track, manage, and audit your assets - from IT equipment to tools, vehicles, and furniture - all in one clean, web-based platform.
|
|
ERPNext
|
Powerful, Intuitive and Open-Source ERP.
|
|
GLPI
|
Open source tool to manage Helpdesk and IT assets.
|
|
i-doit
|
i-doit is the platform solution for integrated IT service management, efficient IT documentation, seamless IT inventory, and powerful add-ons. Automatically create IT audits, network plans, operating manuals, or any other documentation you need.
|
|
Inventory360
|
Analyze, manage, and optimize all IT assets centrally—from hardware, software, and licenses to orders, rentals, and contracts.
|
|
Kuwaiba
|
An enterprise grade, open source Network Inventory System (which covers some aspects of NGOSS/Frameworx), built on top of the Netbeans Platform and Java EE, focused on scalability, reliability, usability and interoperability
|
|
Open-AudIT
|
Open-AudIT intelligently scans an organization’s network and stores the configurations of the discovered devices. A powerful reporting framework enables information such as software licensing, configuration changes, non-authorized devices, capacity utilization and hardware warranty status to be extracted and explored.
|
|
Ralph
|
Full-featured Asset Management, DCIM and CMDB system for data centers and back offices.
|
|
ResourceSpace
|
Easy to use open source Digital Asset Management software from an ethical employee-owned Certified B Corporation®.
|
|
Snipe-IT
|
Open Source Asset Management System.
|
| Risk Assessment & Vulnerability Scanning |
|
Eramba
|
A community driven GRC solution.
|
|
Monarc
|
MONARC is a tool and a method allowing an optimised, precise and repeatable risk assessment.
|
|
Nexpose
|
A powerful vulnerability management solution providing comprehensive asset visibility across an environment, while also aiding in the prioritization and remediation of risks.
|
|
Nikto2
|
An Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers.
|
|
OpenVas
|
A full-featured vulnerability scanner. Its capabilities include unauthenticated and authenticated testing, various high-level and low-level internet and industrial protocols, performance tuning for large-scale scans and a powerful internal programming language to implement any type of vulnerability test.
|
|
SimpleRisk
|
A comprehensive GRC solution.
|
|
Vega
|
A free and open source web security scanner and web security testing platform to test the security of web applications.
|
| Penetration Testing |
|
AutoRecon
|
A multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing environments (e.g. OSCP).
|
|
Burp Suite
|
Burp Suite is a proprietary software tool for security assessment and penetration testing of web applications.
|
|
John the ripper (Github)
|
An Open Source password security auditing and password recovery tool available for many operating systems.
|
|
Kali Linux
|
Kali Linux is an open-source, Debian-based Linux distribution geared towards various information security tasks, such as Penetration Testing, Security Research, Computer Forensics and Reverse Engineering.
|
|
Maltego
|
The all-in-one investigation platform that accelerates complex cyber investigations from hours to minutes.
|
|
Metasploit Framework (Github)
|
The world's most used penetration testing framework.
|
|
Mitmproxy
|
A free and open source interactive HTTPS proxy. Your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, HTTP/3, WebSockets, or any other SSL/TLS-protected protocols.
|
|
Nmap
|
Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing.
|
|
Recon-ng
|
Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
|
|
SpiderFoot
|
An open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.
|
|
theHarvester
|
A simple to use, yet powerful tool designed to be used during the reconnaissance stage of a red team assessment or penetration test. It performs open source intelligence (OSINT) gathering to help determine a domain's external threat landscape. The tool gathers names, emails, IPs, subdomains, and URLs by using multiple public resources.
|
|
Wapiti (Github)
|
Wapiti is a web vulnerability scanner written in Python. It performs black-box scans of the web application by crawling the webpages of the deployed webapp, looking for scripts and forms where it can inject data.
|
|
ZAP - OWASP Zed Attack Proxy (Github)
|
The Zed Attack Proxy (ZAP) by Checkmarx is the world’s most widely used web app scanner. It can help you automatically find security vulnerabilities in your web applications while you are developing and testing your applications. It's also a great tool for experienced pentesters to use for manual security testing.
|
| Access Control |
|
Apache Syncope
|
An Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology.
|
|
CredoID
|
A modern, cloud-based access control software platform for multiple controller brands and generations . Whether you manage a single site or a multi-location enterprise, CredoID delivers intuitive, robust control over who gets in — and when.
|
|
FreeIPA
|
Manage Linux users and client hosts in your realm from one central location with CLI, Web UI or RPC access. Enable Single Sign On authentication for all your systems, services and applications.
|
|
Keycloak
|
Open Source Identity and Access Management. Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more.
|
|
OpenAM (Github)
|
Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements, and Web Services Security.
|
|
OpenIAM
|
OpenIAM's easy-to-use converged platform supports Zero Trust initiatives while improving productivity, compliance, and end user experience by implementing a cohesive strategy based on Identity-First Security.
|
|
Shibboleth
|
Secure Identity Management Solutions. Shibboleth products keep workforces connected to vital resources and applications across and between organisations of all sizes.
|
|
Soffid
|
Digital Identity Management: Simple, secure and scalable. With Soffid, you get an agile, secure, and ready-to-use solution that empowers your business growth — while keeping everything under control.
|
|
WSO2 Identity Service
|
A modern, open source access management solution that keeps you ahead of evolving threats and business needs. WSO2’s AI-assisted, API-centric approach ensures your identity infrastructure supports your business growth now and in the future.
|
| IDS / IPS |
|
OpenWIPS-ng
|
An open source and modular Wireless IPS (Intrusion Prevention System).
|
|
OSSEC
|
A free, open-source host-based intrusion detection system (HIDS). It performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, time-based alerting, and active response. It provides intrusion detection for most operating systems, including Linux, OpenBSD, FreeBSD, OS X, Solaris and Windows. OSSEC has a centralized, cross-platform architecture allowing multiple systems to be easily monitored and managed. OSSEC has a log analysis engine that is able to correlate and analyze logs from multiple devices and formats.
|
|
Snort
|
Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.
|
|
Suricata
|
A high performance, open source network analysis and threat detection software used by most private and public organizations, and embedded by major vendors to protect their assets.
|
|
Zeek
|
An Open Source Network Security Monitoring Tool. Unlike traditional security tools such as firewalls or intrusion prevention systems, Zeek is not an active defense mechanism. Instead, it operates quietly on a sensor—whether hardware, software, virtual, or cloud-based—analyzing network traffic in real-time. Zeek captures high-fidelity transaction logs, file contents, and customizable data outputs, which are ideal for manual review or integration into SIEM systems for security analysts.
|
| API Management |
|
3Scale
|
3scale API Management makes it easy to manage your APIs. Share, secure, distribute, control, and monetize your APIs on an infrastructure platform built for performance, customer control, and future growth.
|
|
APIman.io
|
Extensible Open Source API Management.
|
|
API Umbrella
|
An open source API management platform for exposing web service APIs. The basic goal of API Umbrella is to make life easier for both API creators and API consumers.
|
|
DreamFactory
|
Automate the building, securing, and documenting of REST APIs for data products with built-in enterprise security on bare-metal, VMs, or containers.
|
|
Fusio
|
Self-Hosted API Management for Builders.
|
|
Gravitee.io
|
Comprehensive API management software.
|
|
Kong
|
The most widely adopted API gateway and service mesh, powering the world's APIs for modern architectures.
|
|
Tyk.io
|
Tyk is the foundation for secure, governed AI infrastructure, combining API control, LLM safety, and AI-ready transformation in one platform.
|
|
WSO2 API Manager
|
A fully open source platform that gives enterprises complete control and governance over every API—ingress, egress, AI-powered, and agent APIs. With a unified control plane, multiple API gateways, and an AI gateway for managing LLM and agent APIs, WSO2 ensures seamless scalability, security, and flexibility—without vendor lock-in.
|
| VPN |
|
Algo VPN
|
Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers.
|
|
Freelan
|
A free, open-source, multi-platform, peer-to-peer VPN software that abstracts a LAN over the Internet. It works on Windows, Linux and Mac OSX.
|
|
OpenVPN
|
A virtual private network (VPN) system that implements techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It implements both client and server applications.
|
|
Outline VPN
|
Outline makes it easy to create a VPN server, giving anyone access to the free and open internet.
|
|
PriTunl
|
Pritunl is the best open source alternative to proprietary commercial vpn products such as Aviatrix and Pulse Secure. Create larger cloud vpn networks supporting thousands of concurrent users and get more control over your vpn server without any per-user pricing.
|
|
SoftEther
|
An Open-Source Free Cross-platform Multi-protocol VPN Program, as an academic project from University of Tsukuba.
|
|
Streisand
|
Streisand sets up a new server running your choice of WireGuard, OpenConnect, OpenSSH, OpenVPN, Shadowsocks, sslh, Stunnel, or a Tor bridge. It also generates custom instructions for all of these services. At the end of the run you are given an HTML file with instructions that can be shared with friends, family members, and fellow activists.
|
|
StrongSwan
|
Open-source, modular and portable IPsec-based VPN solution.
|
|
WireGuard
|
An extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography. It aims to be faster, simpler, leaner, and more useful than IPsec, while avoiding the massive headache. It intends to be considerably more performant than OpenVPN. WireGuard is designed as a general purpose VPN for running on embedded interfaces and super computers alike, fit for many different circumstances.
|
| Mail Protection |
|
Hermes SEG
|
Hermes Secure Email Gateway Community is a Free Open Source Ubuntu based Email Gateway that provides Spam, Virus and Malware protection, full email encryption as well as email archiving.
|
|
MailScanner (Github)
|
MailScanner is an open source email gateway that processes email for spam, viruses, phishing, and other malicious content. MailScanner leverages other open source software such as ClamAV and Spamassassin. MailScanner will run on any NIX platform and includes install packages for popular distributions such as Redhat, Debian, and SUSE in addition to any generic NIX package.
|
|
Proxmox
|
Proxmox Mail Gateway is the leading open-source email security solution helping you to protect your mail server against all email threats from the moment they emerge. The flexible architecture combined with the userfriendly, web-based management interface, allows IT professionals and businesses to control all incoming and outgoing emails with ease, and to protect their users from spam, viruses, phishing and trojans.
|
|
ScrolloutF1
|
An easy to use, already adjusted email gateway (firewall) offering free anti-spam, anti-virus protection in order to secure all existing email servers, such as Microsoft Exchange, Lotus Domino, Postfix, Exim, Qmail and more.
|
|
SpamAssassin
|
Apache SpamAssassin is the #1 Open Source anti-spam platform giving system administrators a filter to classify email and block spam (unsolicited bulk email). It uses a robust scoring framework and plug-ins to integrate a wide range of advanced heuristic and statistical analysis tests on email headers and body text including text analysis, Bayesian filtering, DNS blocklists, and collaborative filtering databases.
|
| SIEM & Monitoring |
|
Apache Metron
|
A scalable advanced security analytics framework built with the Hadoop Community evolving from the Cisco OpenSOC Project. A cyber security application framework that provides organizations the ability to detect cyber anomalies and enable organizations to rapidly respond to identified anomalies.
|
|
ELK
|
It's comprised of Elasticsearch, Kibana, Beats, and Logstash (also known as the ELK Stack) and more. Reliably and securely take data from any source, in any format, then search, analyze, and visualize.
|
|
Maltrail
|
A malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user defined lists, where trail can be anything from domain name, URL, IP address or HTTP User-Agent header value. Also, it uses (optional) advanced heuristic mechanisms that can help in discovery of unknown threats.
|
|
PatrOwl
|
Open Source, Free and Scalable Security Operations Orchestration Platform.
|
|
Rudder.io
|
Build and enforce your security model with an infrastructure security automation platform designed for visibility and control.
|
|
SecurityOnion
|
A free and open platform for threat hunting, network security monitoring, and log management. Security Onion includes best-of-breed free and open tools including Suricata, Zeek, the Elastic Stack and many others.
|
|
SIEMonster
|
A Multi Tenant White label SIEM solution that runs in your own AWS environment.
|
| Forensics |
|
Autopsy®
|
Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.
|
|
Belkasoft X Forensic
|
Belkasoft X Forensic (Belkasoft Evidence Center X) is a flagship tool by Belkasoft for computer, mobile, drone, car, and cloud forensics. It can help you to acquire and analyze a wide range of mobile and computer devices, run various analytical tasks, perform case-wide searches, bookmark artifacts, and create reports.
Note: This tool is offered to Government customers only.
|
|
bulk_extractor
|
A high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input (disk images, files, directories of files, etc) and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets without parsing the file system or file system structures. The results are stored in text files that are easily inspected, searched, or used as inputs for other forensic processing. bulk_extractor also creates histograms of certain kinds of features that it finds, such as Google search terms and email addresses, as previous research has shown that such histograms are especially useful in investigative and law enforcement applications.
|
|
CAINE
|
CAINE (Computer Aided INvestigative Environment) is an Italian GNU/Linux live distribution. It offers a complete forensic environment that is organized to integrate existing software tools as software modules and to provide a friendly graphical interface.
|
|
DC3 Tools
|
Various Open Source Tools from the DoD Cyber Crime Center (DC3).
|
|
dcfldd
|
Enhanced version of dd for forensics and security.
|
|
dfTimewolf
|
A framework for orchestrating forensic collection, processing and data export. dfTimewolf consists of collectors, processors and exporters (modules) that pass data on to one another. How modules are orchestrated is defined in predefined "recipes".
|
|
Digital Forensics Framework (DFF)
|
DFF is an Open Source computer forensics platform built on top of a dedicated Application Programming Interface (API). DFF proposes an alternative to the aging digital forensics solutions used today. Designed for simple use and automation, DFF interface guides the user through the main steps of a digital investigation so it can be used by both professional and non-expert to quickly and easily conduct a digital investigation and perform incident response.
|
|
Dislocker
|
FUSE driver to read/write Windows' BitLocker-ed volumes under Linux / Mac OSX.
|
|
Eric Zimmerman's Tools
|
Various forensic tools from Eric Zimmerman.
|
|
EVTXtract
|
EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.
|
|
GRR Rapid Response
|
GRR Rapid Response is an incident response framework focused on remote live forensics.
|
|
Magnet Axiom
|
Examine digital evidence from mobile, cloud, computer, and vehicle sources, alongside third-party extractions all in one case file. Use powerful and intuitive analytical tools to automatically surface case-relevant evidence quickly.
|
|
Malice
|
Malice's mission is to be a free open source version of VirusTotal that anyone can use at any scale from an independent researcher to a fortune 500 company.
|
|
NetworkMiner
|
NetworkMiner is an open source network forensics tool that extracts artifacts, such as files, images, emails and passwords, from captured network traffic in PCAP files. NetworkMiner can also be used to capture live network traffic by sniffing a network interface.
|
|
olefile
|
olefile is a Python package to parse, read and write Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office 97-2003 documents, vbaProject.bin in MS Office 2007+ files, Image Composer and FlashPix files, Outlook messages, StickyNotes, several Microscopy file formats, McAfee antivirus quarantine files, etc.
|
|
OSForensics
|
OSForensics lets you extract forensic evidence from computers quickly with high performance file searches and indexing. Identify suspicious files and activity with hash matching, drive signature comparisons, e-mails, memory and binary data. Manage your digital investigation and create reports from collected forensic data.
|
|
Plaso
|
Plaso (Plaso Langar Að Safna Öllu), or super timeline all the things, is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creating more targeted timelines.
|
|
RegRipper
|
Tool to parse Windows registry files and dig for useful data.
|
|
Rifiuti2 (Github)
|
A tool for analyzing Windows Recycle Bin INFO2 file. Rifiuti2 can extract file deletion time, original path and size of deleted files and whether the trashed files have been permanently removed.
|
|
TestDisk
|
TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table).
|
|
The Sleuth Kit® (TSK)
|
The Sleuth Kit® (TSK) is a library and collection of command line tools that allow you to investigate disk images.
|
|
The Volatility Framework
|
The Volatility Framework has become the world’s most widely used memory forensics tool - relied upon by law enforcement, military, academia, and commercial investigators around the world. The Volatility Foundation helps keep Volatility going so that it may be used in perpetuity, free and open to all.
|
|
TimeSketch
|
Timesketch is an open-source tool for collaborative forensic timeline analysis.
|
|
WinHex
|
WinHex is in its core a universal hexadecimal editor, particularly helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security. An advanced tool for everyday and emergency use: inspect and edit all kinds of files, recover deleted files or lost data from hard drives with corrupt file systems or from digital camera cards. Features depend on the license type.
|
|
Wireshark
|
Network protocol analyzer useful for network forensics and traffic analysis.
|
|
X-Ways Forensics
|
X-Ways Forensics is an advanced work environment for computer forensic examiners. Runs under Windows 7/8/8.1/10/11/Server 2008/2012/2016/2019/2022/2025*, 32 Bit/64 Bit, standard/PE/FE.
|
