ngosangns Knowledge Base

Security Tools

#technology#security#tools

Updated: 2026-10-07

Source

Security Tools is a working list of tools for the security tasks that come up in day to day engineering. It groups them by job rather than by vendor. Secret management covers HashiCorp Vault, Google Secret Manager, and AWS Secrets Manager. Vulnerability scanning covers osv-scanner and npq, with a note on what each one checks before you install or ship. Later sections cover cryptography libraries, security analytics and monitoring, penetration testing, and PII detection and data privacy. Every entry includes a link, so you can read the vendor documentation before you adopt a tool. Use the list as a shortlist when you need to pick a tool for one specific job.

Secret Management

Tools for managing secrets (API keys, passwords, certificates) centrally and securely.

  • HashiCorp Vault: The standard tool for managing secrets, encrypting data at rest and providing dynamic secrets with a TTL. Website
  • Google Secret Manager: Secret management service on Google Cloud Platform. Website
  • AWS Secrets Manager: Secret management service on Amazon Web Services. Website

Vulnerability Scanning & Auditing

Tools that scan source code, packages and containers for security vulnerabilities.

  • osv-scanner: Google's vulnerability scanner built on the osv.dev database. Supports scanning source directories and containers, and license checks. GitHub
  • npq: Installs npm packages safely by checking for vulnerabilities before installation. GitHub
  • HarborGuard: A modern platform for container security scanning that integrates multiple scanners. GitHub

Cryptography Libraries

Libraries that provide secure, easy-to-use cryptographic algorithms.

  • Tink: Google's multi-language, cross-platform cryptography library that helps implement encryption safely and avoid common mistakes. GitHub

Security Analytics & Monitoring

Monitoring user behavior and detecting fraud in applications.

  • Tirreno: An open-source security analytics platform that protects products from account threats and fraud by tracking detailed in-app events. Website

Penetration Testing & Exploitation

Tools that support penetration testing and exploitation.

  • DroneSploit: A pentesting framework dedicated to drones, with a Metasploit-like interface. GitHub
  • HExHTTP: Generates HTTP request variants to test for backend Header Exploitation flaws. GitHub

Security & Pentesting (Additional)

  • https://github.com/KeygraphHQ/shannon — Autonomous white-box AI pentester that analyzes source code and executes real exploits against web apps/APIs.
  • https://github.com/LarsenCundric/port-whisperer — Beautiful CLI tool to inspect, manage, and kill processes listening on local ports with framework detection.
  • https://github.com/Eljakani/ward — Security scanner built specifically for Laravel; checks .env, config, dependencies (live CVEs), and 40+ YAML rules.
  • https://github.com/slimtoolkit/slim — CNCF Sandbox toolkit to inspect, minify, and secure Docker containers; auto-generates Seccomp/AppArmor profiles.
  • https://github.com/sherlock-project/sherlock — Hunt down social media accounts by username across 400+ social networks; popular OSINT reconnaissance tool.
  • https://github.com/nvidia/skillspector — NVIDIA security scanner for AI agent skills; detects vulnerabilities and malicious patterns (64 patterns across 16 categories) via static + optional LLM analysis before you install a skill.
  • https://github.com/trailofbits/skills — Trail of Bits Claude Code skills marketplace for security research, vulnerability detection, and audit workflows; smart-contract auditing, static analysis, fuzzing, crypto side-channel checks, and more.
  • https://github.com/zhaoxuya520/reverse-skill — Skill router pack for reverse engineering, authorized penetration testing, and security research; AI-powered routing, on-demand toolchain bootstrapping, and a self-evolving knowledge base for Claude Code, Kiro, Cursor, Cline, and other AI coding clients.
  • https://github.com/flipperdevices/flipperzero-firmware — Official firmware source for the Flipper Zero, the portable multi-tool for hardware hacking, RF/NFC/RFID/infrared experimentation, and pentesting.
  • https://github.com/PentesterFlow/agent — Terminal-based AI agent for professional pentesters and bug hunters; automates recon-to-report with human-in-the-loop control, built-in skills for IDOR/SSRF/SSTI/JWT/GraphQL/race conditions, Burp Suite integration, local learning across sessions, 20+ slash commands, and support for Ollama/LM Studio/Kimi/Groq/OpenRouter/DeepSeek/Gemini backends.
  • https://github.com/uphiago/recon-skills — Collection of 212 field-validated attack/recon skills distilled from real engagements across 600+ companies in 28 industries; organized into recon, redteam, meta, chains, auth, and infra categories, designed for AI agent integration (e.g. Claude Code).
  • https://github.com/weirdmachine64/GhidraGPT — Ghidra plugin that integrates LLMs (GPT, Claude, Gemini, Cohere, Mistral, DeepSeek, Grok, and local models via Ollama) to automate reverse engineering: renames variables, infers types, adds comments, explains logic, and flags vulnerabilities with streamed responses.
  • https://github.com/morluto/rea — REA (npm rea-agents 6.8.0, MIT, TypeScript). Local CLI and MCP. Deep native analysis uses Hopper, Ghidra, IDA, or Kuna. Static JavaScript and .NET need no native engine. Node ^22.23.4 || ^24.22.1 || >=26.12.1. Checked 2 November 2026: 420,599 stars. Process capture runs with the user account and is not a sandbox. See REA.
  • https://github.com/cr0hn/dockerscan — All-in-one Docker security scanner; scans images for vulnerabilities and leaked secrets, audits container/host configuration (root containers, exposed Docker socket), analyzes Docker network exposure, and aligns with CIS Benchmark/NIST SP 800-190.
  • https://github.com/evyatarmeged/Raccoon — High-performance recon and vulnerability scanning tool (3.2k+ stars); DNS enumeration, WHOIS/TLS lookups, port scanning with Nmap scripts, subdomain enumeration, URL fuzzing with SecLists wordlists, WAF detection, Tor/proxy routing, and async performance via Python asyncio.
  • https://github.com/openai/codex-security — OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities.
  • https://github.com/samugit83/redamon — RedAmon (MIT, self-hosted Docker): maps an authorized target into a Neo4j graph, runs an agent from a Kali sandbox behind approval gates, and can open a GitHub pull request for a fix. Web UI at http://localhost:3000 after ./redamon.sh install. Own code is MIT; the Kali image bundles WPScan under a license that limits commercial SaaS use. master changelog is 6.25.1 (2026-10-07); the latest GitHub Release tag is still v6.14.1 (2026-09-11). See RedAmon.
  • https://github.com/ffuf/ffuf — Fast web fuzzer in Go (Fuzz Faster U Fool, MIT). Puts a FUZZ keyword in the URL, a header, or the body, then keeps or drops responses by status, size, word count, line count, regex, or time to first byte. Wordlists (several keywords at once: clusterbomb, pitchfork, sniper), recursion, rate limit, autocalibration, and an interactive console that retunes filters mid-run. Config: $XDG_CONFIG_HOME/ffuf/ffufrc, overridable with -config (repeated flags such as -H are appended). Install: release binary, brew install ffuf, scoop install ffuf, winget install ffuf.ffuf, or go install github.com/ffuf/ffuf/v2@latest. Latest release v2.3.0 (2026-09-09) still has go 1.20 in go.mod and adds preflight/postflight requests; the README help banner still says v2.1.0. v2.2.0 bounds the decompressed response body (gzip-bomb) and adds audit logging; v2.3.0 also bounds the -od/audit-log snapshot and the response header size. v2.2.1 prints git-<date>-<hash> for a build that is not a release tag. Master after 2026-09-24 (PR #951) raises the source and CI floor to Go 1.26 because golang.org/x/net and x/sys require it; release binaries stay on the old floor, and the README still says Go 1.20 or greater. Output formats: json, ejson, html, md, csv, ecsv. Checked 2026-10-07: 16,835 stars, 1,620 forks, default branch master, last push 2026-09-26. Docs: https://github.com/ffuf/ffuf/wiki
  • https://github.com/alexgaoth/awesome-reverse-engineered — Searchable index of about 12,900 open-source projects built by reverse engineering closed apps, APIs, devices, protocols, file formats and games (code MIT, data CC0), with an agent skill that searches it. Check it before reverse engineering something yourself. See Awesome Reverse Engineered.
  • https://github.com/ptn1411/skill — "Authorized Artifact Auditor": about 35 agent skills and Python CLIs for unpacking, decompiling and auditing software you own. No license file, and several skills (master-unlock, dotnet-keygen, binary-patcher) are written as keygen and bypass tools, contradicting its own MASTER_POLICY.md. See Authorized Artifact Auditor.

PII Detection & Data Privacy

Tools that detect/mask personally identifiable information (PII) in text data.

  • https://huggingface.co/openai/privacy-filter — OpenAI's token-classification model for detecting/masking PII in text (account number, address, email, person name, phone, URL, date, secret). It is a transformer with 1.5B total / 50M active parameters (grouped-query attention + sparse MoE) that uses constrained Viterbi decoding so that labeled spans stay coherent instead of predicting each token independently. Runs locally in the browser/on a laptop, with a 128K-token context; precision/recall can be tuned at runtime and the model can be fine-tuned per domain. Apache 2.0; trained mainly on English (limited multilingual robustness). Note: it is only one supporting layer, not a complete anonymization solution — false positives/negatives still occur, especially with rare names or text outside the training distribution.

See also: Authentication Security · CVE-2026-40175 Axios IMDS Bypass