Tools Reference
Categorized list of every tool used in AYSEC, with module references.
AYSEC Tools Reference
A categorized list of every tool used across the AYSEC tracks, with one-line descriptions and module references.
Reconnaissance & OSINT
| Tool |
Purpose |
Module |
| Subfinder |
Passive subdomain enum |
101.02, 106.03 |
| Amass |
Passive + active subdomain enum |
101.02 |
| crt.sh |
Certificate transparency logs |
101.02 |
| httpx |
Live host probing + tech detect |
101.02 |
| ffuf |
Fast web fuzzer |
101.02, 106.03 |
| gobuster |
Directory and DNS busting |
101.02 |
| feroxbuster |
Recursive content discovery |
106.03 |
| katana |
Crawler |
106.03 |
| hakrawler |
JS-aware crawler |
106.03 |
| LinkFinder |
Extract URLs from JS |
106.03 |
| SecretFinder |
Find secrets in JS |
106.03 |
| trufflehog |
Repo secret scanning |
101.02, 105.09 |
| gitleaks |
Pre-commit secret detector |
105.09 |
| gau |
Get-all-URLs from archives |
106.03 |
| waybackurls |
Wayback Machine URL pull |
101.02 |
| Shodan / Censys |
Internet-wide host search |
101.02 |
| Arjun, x8 |
Hidden parameter discovery |
106.03 |
| linkedin2username |
Username generation from LinkedIn |
101.02 |
Scanning & Enumeration
| Tool |
Purpose |
Module |
| Nmap |
Network scanner with NSE |
101.03 |
| masscan |
Fast initial port sweep |
101.03 |
| Nessus Essentials |
Vulnerability scanner |
101.04 |
| OpenVAS |
Open-source vuln scanner |
101.04 |
| Nuclei |
Template-based scanner |
101.04 |
| enum4linux-ng |
SMB enumeration |
101.03 |
| smbclient |
SMB client |
101.03 |
| onesixtyone |
SNMP brute |
101.03 |
| snmpwalk |
SNMP enum |
101.03 |
| ldapsearch |
LDAP queries |
101.11 |
Exploitation Frameworks
| Tool |
Purpose |
Module |
| Metasploit Framework |
Industry-standard exploit framework |
101.07 |
| msfvenom |
Payload generator |
101.07 |
| searchsploit |
ExploitDB CLI |
101.07 |
| pwncat-cs |
Modern reverse-shell handler |
101.07 |
| nc |
Classic listener / connector |
101.07 |
| Sliver |
Modern open-source C2 |
101.14 |
| Havoc |
C2 with polished GUI |
101.14 |
| Mythic |
Modular C2 |
101.14 |
| Caldera |
Adversary emulation |
101.14 |
| Atomic Red Team |
Per-technique tests |
101.14, 102.06 |
Active Directory
| Tool |
Purpose |
Module |
| BloodHound CE |
AD attack-path graph |
101.11–12 |
| SharpHound |
BloodHound collector (Windows) |
101.11 |
| bloodhound-python |
Linux AD collector |
101.11 |
| NetExec (nxc) |
Multi-protocol AD swiss army |
101.11–12 |
| Impacket suite |
Python implementations of Windows protocols |
101.11–12 |
| Responder |
LLMNR/NBT-NS poisoning |
101.11 |
| ntlmrelayx |
NTLM relay |
101.11 |
| Mimikatz |
Windows credential dumper |
101.12 |
| Rubeus |
Kerberos abuse on Windows |
101.12 |
| pypykatz |
Pure Python Mimikatz |
101.10 |
| Kerbrute |
Kerberos username enum / spray |
101.11 |
| evil-winrm |
WinRM client |
101.12 |
Pivoting
| Tool |
Purpose |
Module |
| chisel |
TCP-over-HTTP tunnel |
101.13 |
| ligolo-ng |
TUN-based pivoting |
101.13 |
| ssh -L/-R/-D |
Native port forwarding |
101.13 |
| proxychains |
TCP proxy chainer |
101.13 |
| sshuttle |
Sudo-free SSH VPN |
101.13 |
Web AppSec
| Tool |
Purpose |
Module |
| Burp Suite (Pro/Community) |
Web proxy, manual testing, BSCP exam |
106.02+ |
| Caido |
Burp alternative (Rust) |
106.02 |
| OWASP ZAP |
Open-source proxy + scanner |
106.02 |
| sqlmap |
SQL injection automation |
101.06, 106.06 |
| Postman |
API testing client |
106.10 |
| InQL |
Burp GraphQL extension |
106.10 |
| GraphQLmap |
GraphQL exploitation |
106.10 |
| jwt_tool |
JWT attack toolkit |
106.04 |
| tplmap |
SSTI scanner |
106.09 |
| Autorize |
Burp IDOR detection |
106.05 |
| Param Miner |
Burp hidden-param finder |
106.03, 106.11 |
| HTTP Request Smuggler |
Burp smuggling probes |
106.11 |
Defensive / SOC
| Tool |
Purpose |
Module |
| Splunk (Free) |
SIEM |
102.03 |
| Microsoft Sentinel |
Cloud SIEM |
102.04 |
| Wazuh |
Open SIEM + EDR-lite |
102.01 |
| Elastic / OpenSearch |
SIEM stack |
102.02 |
| Sysmon (+ SwiftOnSecurity / Olaf cfg) |
Windows endpoint telemetry |
102.06 |
| EvtxECmd |
Parse Windows EVTX |
103.04 |
| Hayabusa |
EVTX Sigma triage |
103.04 |
| Chainsaw |
EVTX detection runner |
103.04 |
| Sigma + sigma-cli |
Portable detection rules |
102.07 |
| LetsDefend |
SOC training |
102.01 |
| Atomic Red Team |
Detection coverage testing |
102.07 |
| MISP |
Threat intel platform |
102.08 |
| ANY.RUN / Hybrid Analysis |
Public sandboxes |
102.10 |
| Velociraptor |
DFIR at scale |
103.12 |
DFIR
| Tool |
Purpose |
Module |
| FTK Imager |
Imaging |
103.01 |
| Eric Zimmerman tools |
Windows forensics suite |
103.02–05 |
| KAPE |
Triage collector |
103.06 |
| Plaso / log2timeline |
Super-timelines |
103.09 |
| Timesketch |
Collaborative timeline |
103.09 |
| Volatility 3 |
Memory forensics |
103.07 |
| AVML |
Linux memory acquisition |
103.07 |
| LiME |
Linux memory acquisition |
103.07 |
| ssdeep |
Fuzzy hashing |
103.08 |
| YARA |
Malware pattern matching |
103.08 |
| Microsoft Extractor Suite |
M365 forensic collector |
103.11 |
| HAWK |
M365 forensics |
103.11 |
| pffexport (libpff) |
PST/OST parser |
103.05 |
| OneDriveExplorer |
OneDrive sync metadata |
103.05 |
| FSEventsParser |
macOS FS events |
103.06 |
GRC
| Tool |
Purpose |
Module |
| Vanta / Drata / Secureframe |
Compliance automation |
104.06 |
| Archer / ServiceNow GRC |
Enterprise GRC |
104.10 |
| FAIR-U |
Quantitative risk training |
104.02 |
| MISP |
Threat intel |
104.06 |
| OneTrust |
Privacy + risk |
104.07 |
| ROADtools |
Entra ID enumeration |
105.12 |
Cloud Security
| Tool |
Purpose |
Module |
| Prowler |
Multi-cloud CSPM |
105.10 |
| ScoutSuite |
Multi-cloud audit |
105.10 |
| CloudQuery |
Cloud config to SQL |
105.10 |
| CloudGoat |
Vulnerable AWS scenarios |
105.06, 105.12 |
| Pwned Labs |
Cloud attack labs |
105.06 |
| Pacu |
AWS exploitation framework |
105.12 |
| AzureHound |
Azure BloodHound graph |
105.12 |
| ROADtools/ROADrecon |
Azure/Entra recon |
105.12 |
| MicroBurst |
Azure exploitation |
105.12 |
| GCPGoat |
Vulnerable GCP env |
105.12 |
| Wiz / Prisma / Defender for Cloud |
CNAPP suites |
105.10 |
| Terraform / OpenTofu |
IaC |
105.08 |
| Checkov |
IaC scanner |
105.08 |
| tfsec |
Terraform-specific scanner |
105.08 |
| OPA / Conftest |
Policy-as-Code |
105.08 |
Container / Kubernetes
| Tool |
Purpose |
Module |
| Trivy |
Image scanner |
105.07 |
| Grype |
Vulnerability scanner |
105.07 |
| Syft |
SBOM generator |
105.07 |
| Cosign / Sigstore |
Image signing |
105.07 |
| kube-bench |
CIS Kubernetes benchmark |
105.07 |
| kube-hunter |
K8s offensive enum |
105.07 |
| Falco |
K8s runtime anomaly detection |
105.07 |
| Kyverno / OPA Gatekeeper |
Admission policies |
105.07 |
Mobile
| Tool |
Purpose |
Module |
| apktool |
APK disassembler |
106.13 |
| jadx |
dex → Java decompiler |
106.13 |
| MobSF |
Mobile auto-analyzer |
106.13 |
| Frida |
Dynamic instrumentation |
106.13 |
| Objection |
Frida wrapper |
106.13 |
| adb |
Android Debug Bridge |
106.13 |
Source Code Review
| Tool |
Purpose |
Module |
| Semgrep |
Modern SAST |
106.12, 106.14 |
| CodeQL |
Taint analysis |
106.14 |
| Snyk |
SCA + Code |
105.09 |
| OWASP Dependency-Check |
SCA |
105.09 |
Binary / Reverse Engineering (preview — AYSEC-202)
| Tool |
Purpose |
| Ghidra |
Decompiler |
| IDA Free |
Disassembler |
| Cutter / radare2 |
Reverse engineering |
| x64dbg |
Windows debugger |
| GDB + pwndbg |
Linux debugger |
| Binary Ninja |
Modern reversing |
| dnSpy / ILSpy |
.NET decompilation |
| pwntools |
Exploit dev |
Notes
- Always check provenance — install from official repos / GitHub releases, verify checksums where applicable.
- Don't install attack tools on personal devices you use for daily work.
- Some tools (Cobalt Strike, etc.) are commercial; community equivalents exist for nearly all.