4 ms·

I created the largest curated directory of cybersecurity tools and resources

105 points by nkokhreidze 2y ago

nkokhreidze 2y ago
I have also added tags, better search and visibility to help community discover tools even faster! Thanks for all the feedback
xvilka 2y ago
Rizin, Cutter, Radare2, BAP (Binary Analysis Framework), LIEF, and so many other tools aren't in the list. Please add them and probably many other that were missed.
- nkokhreidze 2y ago
  added some from the list. thanks for sharing!
- michaelbuckbee 2y ago
  They have a submission button, but it asks for a lot of info, it would be kind of nice if you could just paste a github repo and it would pull out the information.
  - nkokhreidze 2y ago
    Good idea! However, I want to ensure the high quality of tools through curation. Otherwise, many will submit their tools for backlinks and advertising purposes, turning the platform into a mess. After all, the end goal is to help cybersecurity professionals and leaders find the necessary tools.
fwn 2y ago
There once was an amazing culture (and a sense of community) around the curation of tools. Just as I was browsing cybersectools, I remembered exetools(.com), which amazingly still seems to exist. There are even some aesthetic similarities to this submission, I think. I also vaguely remember a very large registry that specialized in packers for executables, but I can't remember the name. Those were great for reducing the size of executable files, among other things. I don't think that's even a thing anymore. Still good times.
- jarofgreen 2y ago
  I've noticed a lot of people use git repos as a way to crowd source this kind of data, and I'm currently working on tools to help in that situation: https://mastodon.online/@jarofgreen/112506346958981241 https://mastodon.online/@jarofgreen/112506346958981241 I've written in the past about these types of projects: https://opendataservices.coop/blog/2020/05/07/community-data.html https://opendataservices.coop/blog/2020/05/07/community-data... The exetools website seems to be on its way out (domain for sale, no updates), which shows how hard it can be to get these types of projects to go well - I'm hoping I can help a bit!
- bux93 2y ago
  I'm partial to https://tinyapps.org/ https://tinyapps.org/ as an example of a nice curated collection of apps. I also have fond memories of the tucows repository of PocketPC applications.
karmakaze 2y ago
[I'm not the target audience--don't work in security.] To me 'largest' is the antithesis of 'curated'. What is the curation aspect to this collection? Are there comparisons between tools, rankings, etc? If it's just a popular misuse of 'curated' that's fine too, like 'literally' in sportscasting.
- nkokhreidze 2y ago
  Thanks for the comment/feedback. Submitted tools undergo the review and are manually added to ensure high quality and reduce spam. Currently on the tool page you can see alternatives to each tool, but ranking and comparison is the next step.
- zakki 2y ago
  It is possible there are many curated directories for cyber security tools. And this one claims the largest one.
- deleted 2y ago
  [deleted]
- this_steve_j 2y ago
  That was my impression too. Better to have 500 highly enriched items with facets or tags to aid exploration and discovery. There are more than a few Commercial tools flagged as Free, unless it means “free tier available” and not FOSS. A tool usually fits into more than one category, so a 1:1 mapping increases the probability of not finding those tools.
phant0m22 2y ago
This is nice. I used to use tools.tldr.run in the past to find out tools in the past.
raesene9 2y ago
An interesting idea, but it'll be tricky to keep it current, if you try to cover too wide an area. Looking at just my area of interest I came across deprecated/inactive tools. You might find it helpful to have a feedback mechanism on each tools page to let people provide feedback.
- nkokhreidze 2y ago
  Added a feedback button for each tool page
- nkokhreidze 2y ago
  Thanks a lot for the tip. Will include the feedback function.
RALaBarge 2y ago
Thanks for the resource! The style and layout of the page, personally speaking, doesn't work well for me. I had to lean far back in my chair in order to feel like I could comprehend the layout initially. I'd love to see a text-based version of this, but it is just my own personal preference and I may be alone in it.
- robxorb 2y ago
  Text, or something like a CSV including descriptions would be great. A quick grep to find what you need.
laylower 2y ago
I like it, would prefer a really condensed list instead of this. Also, why do I get *featured Mandos products if the goal is to create the largest curated directory? Are you trying to get others to pay you to get featured or are you trying to increase your sales?
- nkokhreidze 2y ago
  Featured will enable tool authors to showcase the product to visitors if they decide to do so. I do not think "largest curated directory" and "featured products" are mutually exclusive. Also curation, feature updates and maintenance takes a significant amount of my time and a portion for infra - already have over 50+ tools in queue to review. So featuring will help support the platform.
mr_mitm 2y ago
It's not finding Metasploit, Impacket or BloodHound (but instead Metasploit Cheat Sheets or PlumHound), which are absolute heavy weights in the offensive security sector. How did you gather that data?
- nkokhreidze 2y ago
  Good catch, I had github link for Metasploit, added all three now.
- kreetx 2y ago
  "Feature Your Cybersecurity Product" - looks more like a marketing site.
popey 2y ago
I submitted two open-source tools. The submission form has a field for 'License' in which the only two options are 'Free' and 'Commercial'. Those aren't licenses. Maybe adjust that field to either say 'cost' or 'terms', or actually have a license field which lets you paste an SPDX entry (or entries) or pick a license from a list.
- nkokhreidze 2y ago
  Updated "License" to "Cost"
- nkokhreidze 2y ago
  Thanks for pointing out and also submitting tools. Will update the fields to clearly reflect the meaning.
vavkamil 2y ago
I have a collection of web security tools and vulnerable apps for training, feel free to use the data: https://github.com/vavkamil/awesome-bugbounty-tools https://github.com/vavkamil/awesome-bugbounty-tools https://github.com/vavkamil/awesome-vulnerable-apps https://github.com/vavkamil/awesome-vulnerable-apps
- nkokhreidze 2y ago
  Thank you for sharing. The list is impressive.
emporas 2y ago
Is there any way to find just Linux or Unix programs? Couldn't spot a way.
- nkokhreidze 2y ago
  I just added tags that can help to filter out: https://cybersectools.com/tags/ https://cybersectools.com/tags/. Not all tags are super accurate but will improve on that as well
tptacek 2y ago
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=lists%20don%27t%20make%20by%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
deleted 2y ago
[deleted]
alephnerd 2y ago
I wouldn't put much weight on this. It's a growth hack by OP for his cybersecurity consultancy (Mandos). In general, you should learn about the tools after you master the fundamentals. Understanding how OS, Networking, Web Development, DevOps, <insert_domain_here> works at a fundamental level will make it easier to become a well versed Security Practitioner. Most attack vectors I've seen in the wild tend to be caused by some kind of misconfiguration (eg. Accidentally leaving a test app internet accesible) or sloppy architecture (eg. Not keeping an inventory of systems and dependencies). The way to remediate that is by actually understanding how your underlying technology works.

105 points by nkokhreidze 2y ago

I have also added tags, better search and visibility to help community discover tools even faster! Thanks for all the feedback

xvilka 2y ago

Rizin, Cutter, Radare2, BAP (Binary Analysis Framework), LIEF, and so many other tools aren't in the list. Please add them and probably many other that were missed.

nkokhreidze 2y ago
added some from the list. thanks for sharing!
michaelbuckbee 2y ago
They have a submission button, but it asks for a lot of info, it would be kind of nice if you could just paste a github repo and it would pull out the information.
- nkokhreidze 2y ago
  Good idea! However, I want to ensure the high quality of tools through curation. Otherwise, many will submit their tools for backlinks and advertising purposes, turning the platform into a mess. After all, the end goal is to help cybersecurity professionals and leaders find the necessary tools.

fwn 2y ago

There once was an amazing culture (and a sense of community) around the curation of tools. Just as I was browsing cybersectools, I remembered exetools(.com), which amazingly still seems to exist. There are even some aesthetic similarities to this submission, I think. I also vaguely remember a very large registry that specialized in packers for executables, but I can't remember the name. Those were great for reducing the size of executable files, among other things. I don't think that's even a thing anymore. Still good times.

jarofgreen 2y ago
I've noticed a lot of people use git repos as a way to crowd source this kind of data, and I'm currently working on tools to help in that situation: https://mastodon.online/@jarofgreen/112506346958981241 https://mastodon.online/@jarofgreen/112506346958981241 I've written in the past about these types of projects: https://opendataservices.coop/blog/2020/05/07/community-data.html https://opendataservices.coop/blog/2020/05/07/community-data... The exetools website seems to be on its way out (domain for sale, no updates), which shows how hard it can be to get these types of projects to go well - I'm hoping I can help a bit!
bux93 2y ago
I'm partial to https://tinyapps.org/ https://tinyapps.org/ as an example of a nice curated collection of apps. I also have fond memories of the tucows repository of PocketPC applications.

karmakaze 2y ago

[I'm not the target audience--don't work in security.] To me 'largest' is the antithesis of 'curated'. What is the curation aspect to this collection? Are there comparisons between tools, rankings, etc? If it's just a popular misuse of 'curated' that's fine too, like 'literally' in sportscasting.

nkokhreidze 2y ago
Thanks for the comment/feedback. Submitted tools undergo the review and are manually added to ensure high quality and reduce spam. Currently on the tool page you can see alternatives to each tool, but ranking and comparison is the next step.
zakki 2y ago
It is possible there are many curated directories for cyber security tools. And this one claims the largest one.
deleted 2y ago
[deleted]
this_steve_j 2y ago
That was my impression too. Better to have 500 highly enriched items with facets or tags to aid exploration and discovery. There are more than a few Commercial tools flagged as Free, unless it means “free tier available” and not FOSS. A tool usually fits into more than one category, so a 1:1 mapping increases the probability of not finding those tools.

phant0m22 2y ago

This is nice. I used to use tools.tldr.run in the past to find out tools in the past.

raesene9 2y ago

An interesting idea, but it'll be tricky to keep it current, if you try to cover too wide an area. Looking at just my area of interest I came across deprecated/inactive tools. You might find it helpful to have a feedback mechanism on each tools page to let people provide feedback.

nkokhreidze 2y ago
Added a feedback button for each tool page
nkokhreidze 2y ago
Thanks a lot for the tip. Will include the feedback function.

RALaBarge 2y ago

Thanks for the resource! The style and layout of the page, personally speaking, doesn't work well for me. I had to lean far back in my chair in order to feel like I could comprehend the layout initially. I'd love to see a text-based version of this, but it is just my own personal preference and I may be alone in it.

robxorb 2y ago
Text, or something like a CSV including descriptions would be great. A quick grep to find what you need.

laylower 2y ago

I like it, would prefer a really condensed list instead of this. Also, why do I get *featured Mandos products if the goal is to create the largest curated directory? Are you trying to get others to pay you to get featured or are you trying to increase your sales?

nkokhreidze 2y ago
Featured will enable tool authors to showcase the product to visitors if they decide to do so. I do not think "largest curated directory" and "featured products" are mutually exclusive. Also curation, feature updates and maintenance takes a significant amount of my time and a portion for infra - already have over 50+ tools in queue to review. So featuring will help support the platform.

mr_mitm 2y ago

It's not finding Metasploit, Impacket or BloodHound (but instead Metasploit Cheat Sheets or PlumHound), which are absolute heavy weights in the offensive security sector. How did you gather that data?

nkokhreidze 2y ago
Good catch, I had github link for Metasploit, added all three now.
kreetx 2y ago
"Feature Your Cybersecurity Product" - looks more like a marketing site.

popey 2y ago

I submitted two open-source tools. The submission form has a field for 'License' in which the only two options are 'Free' and 'Commercial'. Those aren't licenses. Maybe adjust that field to either say 'cost' or 'terms', or actually have a license field which lets you paste an SPDX entry (or entries) or pick a license from a list.

nkokhreidze 2y ago
Updated "License" to "Cost"
nkokhreidze 2y ago
Thanks for pointing out and also submitting tools. Will update the fields to clearly reflect the meaning.

vavkamil 2y ago

I have a collection of web security tools and vulnerable apps for training, feel free to use the data: https://github.com/vavkamil/awesome-bugbounty-tools https://github.com/vavkamil/awesome-bugbounty-tools https://github.com/vavkamil/awesome-vulnerable-apps https://github.com/vavkamil/awesome-vulnerable-apps

nkokhreidze 2y ago
Thank you for sharing. The list is impressive.

emporas 2y ago

Is there any way to find just Linux or Unix programs? Couldn't spot a way.

nkokhreidze 2y ago
I just added tags that can help to filter out: https://cybersectools.com/tags/ https://cybersectools.com/tags/. Not all tags are super accurate but will improve on that as well

tptacek 2y ago

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=lists%20don%27t%20make%20by%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

deleted 2y ago

[deleted]

alephnerd 2y ago

I wouldn't put much weight on this. It's a growth hack by OP for his cybersecurity consultancy (Mandos). In general, you should learn about the tools after you master the fundamentals. Understanding how OS, Networking, Web Development, DevOps, <insert_domain_here> works at a fundamental level will make it easier to become a well versed Security Practitioner. Most attack vectors I've seen in the wild tend to be caused by some kind of misconfiguration (eg. Accidentally leaving a test app internet accesible) or sloppy architecture (eg. Not keeping an inventory of systems and dependencies). The way to remediate that is by actually understanding how your underlying technology works.