foxsecintel / opensource-cybersecurity-tooling

Open Source Tools for Threat Intelligence, Vulnerability Management, and Forensics

As someone working in cybersecurity, I know firsthand the importance of having effective tools for threat intelligence, vulnerability management, and forensics. Fortunately, there are several open source options available that can help organizations address these challenges.

Threat Intelligence:

Product	Description	Link
Threat Stream	This platform aggregates and analyzes threat data from multiple sources, providing real-time visibility into emerging threats
TheHive	This incident response platform integrates with a variety of threat intelligence feeds to help security teams quickly identify and respond to threats.	TheHive Project
MISP	MISP (Malware Information Sharing Platform) is an open source platform for sharing, storing, and collaborating on threat intelligence. It is designed to facilitate the exchange of information about cybersecurity threats, including malware, phishing attacks, and other types of cybercrime.	MISP

Vulnerability Management:

Product	Description	Link
OpenVAS	This vulnerability assessment tool allows organizations to scan their systems for known vulnerabilities and apply patches to mitigate risks.
dirsearch	Web Path Scanner	dirsearch
Shodan	I often use Shodan to help me identify and understand internet-connected devices and systems. Shodan is a search engine for internet-connected devices, including servers, routers, cameras, and industrial control systems. It allows you to search for devices using keywords, IP addresses, and other criteria, and provides detailed information about each device, including its IP address, operating system, and open ports
ScoutSuite	An open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments . Which include, AWS, OCI, GCP, Azure and Alibaba. Ideal for making sure that your infrastructure is compliant with relevant security standards	ScoutSuite
Shodan Browser Extension	The Shodan browser extension allows users to quickly search for devices using the Shodan database directly from their web browser. When a user visits a webpage, the extension will search the Shodan database for any devices associated with the webpage and display the results in a pop-up window. Invaluable !	Shodan Extension
Nmap	As a cybersecurity professional, I frequently use Nmap (Network Mapper) for network scanning and discovery. Nmap is an open source tool that can be run on a variety of platforms, including Windows, Linux, and macOS. It works by sending specialized packets to a target system and analyzing the responses to determine the network configuration and open ports. Nmap has a command-line interface as well as a graphical user interface (GUI) called Zenmap, which provides a more user-friendly interface for running scans and analyzing results. It is an essential tool for tasks such as network inventory, identifying open ports on a system, and detecting security vulnerabilities.
Nessus Essentials:	This popular vulnerability scanner offers a range of features, including patch management and compliance reporting.
Burp Suite Community Edition	A popular toolkit for web application security testing. It includes a range of tools for tasks such as testing web applications for vulnerabilities, intercepting and modifying HTTP traffic, and automating testing processes. Best of all it creates reports and the majority of features are free
Qualys SSL Server Test	Qualys SSL Labs is a website that provides a range of tools for testing and analyzing the security of SSL/TLS (Secure Sockets Layer/Transport Layer Security) implementations. One of the tools offered by Qualys SSL Labs is the SSL Server Test, which allows users to test the SSL/TLS configuration of a server. Very useful tool in your day to day job	SSL Server Test

Forensics:

Product	Description	Link
Autopsy	This open source digital forensics platform provides a range of tools for analyzing and recovering data from digital devices.
Sleuth Kit	This suite of tools allows forensic analysts to extract and analyze data from a variety of sources, including disk images and live systems.

Defensive Tooling:

Product	Description	Link
Wazuh	All in one security platform, that is opensoure and integrate SIEMs and XDR capability	Wazuh platform
OS Query	An open-source, cross-platform query language that allows you to access various information about the hardware and software of a computer system	osquery.io
sysmon	A Windows system monitoring tool that logs system activity to the Windows event log. It is designed to provide detailed information about system activity, such as process creation, network connections, and changes to file creation time. Ideal for malware hunting

Offensive Tooling:

Product	Description	Link
Metasploit	Metasploit is an open source toolkit that is great for developing and executing security exploits. I use this software for tasks such as penetration testing, testing the security of systems and networks, and demonstrating the effects of security vulnerabilities.
Cobalt Strike

By leveraging these open source tools, you can improve your threat intelligence capabilities, identify and mitigate vulnerabilities, and effectively conduct forensic investigations when needed.