The AMP-Research project collects information about amplification vectors in protocols including reproduction possibilities. For each vector, the port and protocol are listed, as well as, the amplification factor. A scanning script or payload for scanning with zmap is included too.

APNIC REx shows general information about IPv4 and IPv6 usage and delegations. It features on overview of all AS connections. This is the replacement of the earlier vizAS tool.

Watch Arxiv-papers on as a website.

monocle is a command line tool that is part of the BGPKIT. It has various modes to help with and around BGP including integration with Cloudflare Radar. monocle whois provides AS and organization information. monocle time converts between different time formats like RFC3339 and Unix timestamp. monocle radar interacts with Cloudflare Radar.

An open-source software framework for live and historical BGP data analysis, supporting scientific research, operational monitoring, and post-event analysis.

BGP streams are freely accessible and provided by Route View, RIPE, and BGPmon.

BGPlay shows a graph of the observed BGP routes. It allows replaying historical BGP announcements and displays route changes.

Documentation
GitHub

There are various pagers which are more suitable or user-friendly than the basic pagers like more or less.

bat – A cat(1) clone with wings

bat is an advanced pager, supporting usability features. It comes with syntax highlighting out of the box. It also integrates with git and shows the lines added and removed for a file.

pspg – Postgres Pager

pspg is an advanced pager for usage with psql. It shows the data in table form, allows scrolling through the columns and rows. You can pin header or initial columns, such that they do not move while scrolling around. It supports many different color schemes.

IDA plugin for comparing binaries. Allows to label unknown binaries with annotations from a different IDA database.

The cloud version of binary ninja allows free reversing in the cloud. It has a real-time collaboration feature.

Binary Refinery is a collection of Python scripts for transforming data. It is similar in concept to CyberChef but runs locally. For example, Binary Refinery supports base64 or hex transformations, hash data, or packing values into binary.

C2Rust is a project for converting (legacy) C code into equivalent Rust code. The resulting Rust code is very low level and uses pointers and unsafe. The website offers an online demo to show the capabilities of the tool.

Desugar C++ code and show how modern C++ features are implemented. This helps in understanding the details of C++ and how modern compilers implement the language standard.

CInsects is a German CTF team. They collect resources of tool, tutorials, and documentation around CTF tools and exploitation.

The website allows executing DNS queries from various locations worldwide to check the returned values.

C-DNS is a space efficient file format for storing DNS traffic. It is based on CBOR with a fixed schema as defined in RFC 8618.

Some tools exist to work with C-DNS files. The dns-stats compactor can convert PCAP-to-CDNS and vice versa. It can be configured flexibly to only record those fields of the DNS message which are of interest, thus saving space in the compacted format.

The website offers an interactive tool to encode and encrypt data. It presents a visual pipeline through which the data travels, being transformed in each step. It is conceptually similar to CyberChef, but with a focus on encryption.

The CyberChef is a website which provides many recipes and makes it easy to combine them. The recipes are small input/output steps, similar to UNIX tools, and cover a large area of topics, like data formats, encoding, encryption, networking, hashing, compression, etc. The main use case is making it easier in CTFs to chain simple operations together, like processing encoded text.

DMAP is a scalable web scanning suit which supports DNS, HTTPS, TLS, and SMTP. It works based on domain names and crawls the domain for all supported protocols. The advantage over other tools is the unified SQL data model with 166 features and the easy scalability over many crawling machines.

Check My DNS

Browser-based DNS resolver quality measurement tool. Uses the browser to generate many resolver queries and tests for features they should have, such as EDNS support, IPv6, QNAME Minimization, etc.

This test is also available as a CLI tool: https://github.com/DNS-OARC/cmdns-cli

DNSSEC Debugger

Analyze DNSSEC deployment for a zone and show errors in the configuration.

DNSViz

Gives an overview of DNSSEC delegations, response sizes, and name servers.

GitHub: https://github.com/dnsviz/dnsviz

DNS X-Ray

The website has an online test, which performs DNS lookups. These DNS lookups test if certain resource records are overwritten in the cache. The tool can then determine what DNS software is used, where the server is located, how many caches there are, etc.

EDNS Compliance Tester

Test name server of zones for correct EDNS support.

The Transitive Trust and DNS Dependency Graph Portal

Shows the trust dependencies in DNS. Given a domain name, it can show how zones delegate to each other and why. The delegation is done between IP addresses and zones.

Root Canary Project

The project used to monitor the first root KSK key rollover. Now it contains the paper "Roll, Roll, Roll your Root: A Comprehensive Analysis of the First Ever DNSSEC Root KSK Rollover" describing the experiences of the first root KSK rollover

Additionally, it includes a tester for DNSSEC algorithm support, which shows the algorithms supported by the currently used recursive resolver. It provides statistics about support for DNSSEC algorithms. It has a web-based test to test your own resolver and provides a live monitoring using the RIPE Atlas.

DNSSEC algorithms resolver test

Tool to replay DNS queries captured in a PCAP file with accurate timing between queries. Allows modifying the replay, like changing IP addresses, speeding up or slowing down the queries.

DNS Toys is an authoritative DNS server offering different unit conversion and lookup tools.

Some examples from the website include:

# Lookup time by city name
dig newyork.time @dns.toys

# or weather
dig newyork.weather @dns.toys

# Return the client IP address
dig ip @dns.toys

# Number conversion from decimal to hex
dig 100dec-hex.base @dns.toys

DNS network capture utility. Similar in concept to tcpdump, but with specialized options for DNS.

Top-like utility showing information about captured DNS requests. It shows information about the domains queries, the types, and responses.

Dangerzone is a tool for converting documents into safe PDFs. This allows converting potentially dangerous office documents, PDFs, or images into a new PDF without copying any metadata or macros. It works by converting the original documents into bitmaps and afterward turning the bitmaps into new PDFs, optionally also with OCR for searchable PDFs.

The Dataset Search by Google is a search engine explicitly for datasets. Supported datasets need to be tagged with a special markup, which allows the search to provide more useful results. This also limits the search engine, since not all datasets will be appropriately marked.

Debin is a tool to predict the debug information of stripped binaries. It only works reliable with C programs, as this is the only dataset it was trained on. It might be useful to use the website for jeopardy CTFs.

Depix allows reverting pixelization and recover the original text. It works for pixelated images created using linear box filters. The recovery process is not always perfect, but good enough to produce readable text.

Detexify helps in writing complex LaTeX symbols, similar to Shapecatcher for Unicode. It searches for the correct LaTeX macros based on a drawing of the shape the users wants. It is a better way to search for symbols instead of going through the symbols-a4.pdf manually.

The website provides a simple interface for dig. You can specify the various CLI arguments of dig with a web-based form.

The website lets you create polls, which are intended to be used live in front of a large audience. The presenter can configure the poll, select display options, and mark correct answers.

During the presentation, the presenter has a view, which shows the live results of the poll. The audience can join the polls and vote on them live. The results are completely anonymous.

It can be a great tool for interactive PowerPoint presentations, for lectures, or generally for trivia events.

The distributed randomness beacon is a verifiable, unpredictable and unbiased random numbers as a service. A network of multiple entities computes the random numbers. They are a good source of true entropy. Another use is in verifiable lotteries, by using these random numbers to pick a winner at random.

Dogbolt is an online interactive decompiler explorer. A binary can be uploaded and the decompiled C-like output of multiple decompilers compared. The website collects all uploaded binaries, so be wary of which files to upload. The big advantage of the website is having so many available decompilers (angr, Binary Ninja, Boomerang, Ghidra, IDA Pro, REC Studio, Reko, RetDec, Snowman). A downside is that no alterations to the decompilation are possible, for example, to provide function signatures.

Driftnet watches network traffic, and picks out and displays JPEG and GIF images for display.

This is an improvement on Paris traceroute and the classical traceroute. It can detect changing routes and detect NATs along the path.

• https://transfer.sh/ allows uploading from the command line and the browser. Files can be up to 10 GB and be stored up to 14 days. It allows limiting the number of downloads.

  # Upload using cURL
  $ curl --upload-file ./hello.txt https://transfer.sh/hello.txt
  https://transfer.sh/66nb8/hello.txt
  
  $ curl -H "Max-Downloads: 1" -H "Max-Days: 5" --upload-file ./hello.txt https://transfer.sh/hello.txt
  https://transfer.sh/66nb8/hello.txt
  

• https://instant.io/ share and receive files using WebTorrent.

• https://send.tresorit.com/ allows anonymous file shares. Files can be up to 5 GB and be stored for up to 7 days.

The Entropy/IP algorithm allows for inspecting and generating IPv6 addresses. Entropy/IP can determine the entropy of different nibbles and the relationship between different components. Based on this analysis, it can also create valid-looking IPv6 addresses.

Evcxr is a Rust interpreter and also provides a Jupyter kernel. This is a helpful addition to the online playground as it allows installing and using any crate.

FD.io is a very fast userspace networking library, which allows creating programs for packet processing. While DPDK allows fast read and write access to the NICs, FD.io is focussed on processing the packets. Possible use cases are a packet forwarder, implementing a NAT or a VPN.

More details also in this APNIC blog post: https://blog.apnic.net/2020/04/17/kernel-bypass-networking-with-fd-io-and-vpp/

The Firefox Profiler is a web-based tool displaying profile data as a flame graph. It can show and display native profiling data, such as Linux perf. Profiles can be uploaded to the website and shared with other people.

# Capture the profile
$ perf record --call-graph <command>

# Convert the profile
$ perf script -F +pid > /tmp/test.perf

# Upload the profile to profiler.firefox.com

Flamethrower is a small, fast, configurable tool for functional testing, benchmarking, and stress testing DNS servers and networks. It supports IPv4, IPv6, UDP, TCP, DoT, and DoH and has a modular system for generating queries used in the tests.

The Float Exposed website allows exploring IEEE floating-point numbers interactively. It shows 16, 32, and 64 variants. It allows flipping individual bit and visualizes the result. The meaning of the bits is also shown and color-coded.

The Float Toy website allows exploring IEEE floating-point numbers interactively. It shows 16, 32, and 64 variants. It allows flipping individual bit and visualizes the result. The meaning of the bits is also shown and color-coded.

GNU poke is an interactive, extensible editor for binary data. Not limited to editing basic entities such as bits and bytes, it provides a full-fledged procedural, interactive programming language designed to describe data structures and to operate on them.

poke comes which an online manual and also has a quick start guide.

Ghidra software reverse engineering (SRE) framework and IDA Pro alternative.

The Godbolt compiler explorer allows the user to compile a function and see the corresponding assembly code. It can highlight matching parts in the language and assembly, making it easy to understand how individual expressions are compiled. It supports common languages like C, C++, Go, Rust. Furthermore, it can also work with assembler and LLVM IR.

Another nice feature is, that it can show statistics about assembler code, like needed cycles, instructions, and which resources the instructions need. This uses the LLVM Machine Code Analyzer.

THE reverse engineering tool.

IP geolocation services feeding itself from geolocation databases, user provided locations, and most importantly, active RTT measurements based on the RIPE Atlas system. It also provides a nice API to query the location. It provides a breakdown on where the results stem from and how much they contribute to the overall result.

The IPv4 heatmap tool draws an image of active IPv4 addresses. The IP addresses are mapped to pixels using a Hilbert curve or a Z-curve. The image can be extended with annotations about the address space, for example, to show which regional internet registry is assigned to the address.

• THC IPv6 Attack Toolkit
  Different small tools to test different network conditions.
• SI6 Networks' Toolkit
  Different utilities for understanding and debugging IPv6 traffic.

The online Image Metadata Viewer shows the EXIF information from uploaded files or files by URL. It supports a wide range of metadata, such as XMP, EXIF, IPTC, and MakerNotes.

Scans a website for TLS configuration problems. It shows information about the certificate, ciphers, standard compliance, and industry best practices.

The Internet Society gathers data to show the general health and availability of the internet. They measure four categories: internet shutdowns, technology use, resilience, and concentration. Under internet shutdowns, they show which countries are performing what kind of disruption, e.g., regional or national. The technology sections lists basic statistics about HTTPS, IPv6, TLS, DNSSEC.

John the Ripper is THE tool to brute force passwords and password hashes. It is very fast in calculating hashes with support of GPU acceleration and supports a wide range of different hash formats.

These websites provide tools, which convert JSON data to structs in different programming languages.

• https://transform.tools/json-to-rust-serde
  The website supports data type generation for a large set of languages. It also supports SVG, HTML, CSS, and GraphQL as input to convert.
• https://typegen.vestera.as/
• https://app.quicktype.io/
  The website supports data type generation for a large set of languages.
• https://schema-analysis.com/ Support JSON, YAML, CBOR, TOML, and XML as input. Multiple output formats are supported too.

These websites provide different features to analyze binaries and especially malware. They provide searching by file hashes or by uploading the binary.

Some services provide more detailed analyzes, such as which files were accessed or snapshots of any windows opened.

• ANY.RUN
• Hybrid Analysis
• VirusTotal

These projects either operate DNS based Real-time Blackhole Lists (RBL) or allow checking if an IP is contained. The Multi-RBL websites are helpful in finding a large quantity of RBLs.

• https://multirbl.valli.org/
  • Contains hundreds of RBLs, including descriptions of them and their return values.
• http://www.anti-abuse.org/multi-rbl-check/
• https://dnsbllookup.com
• https://www.dnsbl.info
• https://www.spamhaus.org/
  • Operates different RBLs such as for spam, exploits, domains with bad reputation, do-no-route ("drop-all-traffic"), and known spam operators.

The website provides a tool to select a list of autonomous systems with a fairer probe distribution. Probes are not distributed equally, but rather cluster based on population. This leads to large biases towards western locations and certain autonomous systems. The website offers different distance metrics. The output is a list of autonomous system numbers for use in the RIPE Atlas API.

Microsoft PowerToys has many tools for advanced Windows usage. It supports better window tiling with more zones, batch file renaming, and a host file editor, as well as a bunch more features.

The mini internet project is part of the curriculum by the Networked Systems Group of ETH Zurich. It teaches the students the basic steps of how to create a mini internet. It starts with the basics of intra-network routing, by setting up multiple L2 switches. Then the students have to configure L3 routers to connect multiple L2 sites together. Lastly, in a big hackathon style, the students need to connect their local network with the network of the other students, by properly configuring BGP routers and setting up routing policies.

The code and the tasks are all available in the GitHub repository.

The APNIC Blog has a nice introduction to the project too.

Website quality measurement tool. The website measures the quality of HTTP headers which improve security. Additionally, it provides inspections for the TLS certificate and SSH servers. It also includes many third-party tools.

Create variable TLS configurations for all major web servers. It is specialized for each web server and server version. The configurations support different TLS configurations, depending on the needed support for old clients.

Multi-level MDA-Lite Paris Traceroute is a traceroute tool, which understands and learns more complex network topologies. Often times, the network is not just a line, but multiple paths are possible and chosen at random.

A good description of the tool can be found in the RIPE Labs post or in the IMC 2018 paper.

The Netlab of 360.com provides some open data streams.

One dataset concerns the number of abused reflectors per protocol.

Overview of IP addresses scanning the internet and which ports are scanned.

A free and configurable DNS resolver. It provides customizable blocking, such as for ads, trackers, or malicious websites. Additionally, statistics can be shown, such as for most blocked websites.

A similar self-hosted variant is Pi-hole.

The OWASP Amass tool suite obtains subdomain names by scraping data sources, recursive brute forcing, crawling web archives, permuting/altering names and reverse DNS sweeping. Additionally, Amass uses the IP addresses obtained during resolution to discover associated net blocks and ASNs. All the information is then used to build maps of the target networks.

A tool to find the one gadget in libc. It lists all gadgets leading to execve('/bin/sh', NULL, NULL) including their preconditions.

Website allowing assembly and disassembly of x86 and x64 code.

The online disassembler can disassemble a wide range of binary formats and platforms. It can disassemble freestanding bytes too. It provides a disassembly view, a graph view, a symbol and a function viewer.

Open Traffic Generator (OTG) is an open standard, specifying a declarative and vendor neutral API for testing Layer 2-7 network devices and applications (at any scale).

PGP relies on a web of trust to authenticate the created PGP keys. Governikus will sign PGP keys after authenticating with a German eID. This provides a simpler way to get a trusted signature on your PGP key.

OpenWPM is a web privacy measurement framework which makes it easy to collect data for privacy studies on a scale of thousands to millions of websites. OpenWPM is built on top of Firefox, with automation provided by Selenium. It includes several hooks for data collection. Check out the instrumentation section below for more details.

Over The Wire provides with the wargames many different challenges, to learn exploitations of different things. There are different wargames based on skill and required tooling. In each level, the user has to retrieve a flag to proceed to the next level.

PEERING is an environment where researchers and educators can play with BGP announcements in a real but sandboxed environment.

Description from the website:

The long-term goal of the PEERING system is to enable on-demand, safe, and controlled access to the Internet routing ecosystem for researchers and educators:

• PEERING for researchers. Today, it is hard for researchers to conduct Internet routing experiments. To perform a routing experiment, a research institution has to obtain Internet resources (IP addresses and ASNs) and establish relations with upstream networks. PEERING eliminates these obstacles and provides researchers controlled on-demand access to the routing ecosystem.
• PEERING for educators. Educators can use the PEERING infrastructure in teaching students the Internet routing architecture. The students access to live BGP sessions to multiple ISPs.

packetq is a command line tool to run SQL queries directly on PCAP files, the results can be outputted as JSON (default), formatted/compact CSV and XML. It also contains a very simplistic web-server to inspect PCAP files remotely,

This is an improvement on the traditional traceroute program. It can detect multiple distinct routes and display them accordingly. The classical traceroute would produce weird results on changing network routes.

Another similar program is Dublin traceroute.

Traceroutes can be difficult to understand. PathVis visualizes the network connections of your computer. It creates a tree of network nodes, with the root being the PathVis computer. The tree shows the paths to the other endpoints the computer is talking too.

The blog post introduces PathVis and explains the motivation behind it.

A free and configurable DNS stub-resolver. It provides customizable blocking, such as for ads, trackers, or malicious websites. Additionally, statistics can be shown, such as for the most blocked website.

It can also function as a DHCP server for clients on the same network.

A similar service is NextDNS.

Play with Docker is a Docker playground which allows users to run Docker commands in a matter of seconds. It gives the experience of having a free Alpine Linux Virtual Machine in the browser, where you can build and run Docker containers and even create clusters in Docker Swarm Mode. Under the hood, Docker-in-Docker (DinD) is used to give the effect of multiple VMs/PCs. In addition to the playground, PWD also includes a training site composed of a large set of Docker labs and quizzes from beginner to advanced level available at training.play-with-docker.com.

The website takes a Postgres execution plan and an optional query and displays it as a more readable graph.

The website takes a Postgres Explain output and displays it more readable and highlights the important parts.

The website takes a Postgres Explain output and displays it as a more readable graph.

• https://play.rust-lang.org/
  • The Rust playground.
• https://www.rustexplorer.com/
  • Rust playground with the top 10k crates.
• https://repl.it/languages
  • REPLs for many languages.
• https://www.tutorialspoint.com/codingground.htm
  • Programming playgrounds for a wide variety of languages.
• https://jvns.ca/blog/2023/04/17/a-list-of-programming-playgrounds/
  • Curated list of programming playgrounds.
• https://dev.java/playground/
  • The Java Playground

Test the quality of a server's or a client's SSL/TLS stack. Very useful to test a server. Provides a A-F rating scheme and shows vulnerabilities and weak protocols/cipher suites.

The repository contains code for a better probe selection for the RIPE Atlas measurement system. Probes are not distributed equally, but rather cluster based on population. This leads to large biases towards western locations and certain autonomous systems. The goal of the repository is to find a more equal, thus fairer probe selection.

RIPEstat is a network statistics platform by RIPE. The platform shows data for IP addresses, networks, ASNs, and DNS names. This includes information such as the registration information, abuse contacts, blocklist status, BGP information, geolocation lookups, or reverse DNS names. Additionally, the website links to many other useful tools, such as an address space hierarchy viewer, historical whois information, and routing consistency checks.

These websites allow you to browser the valid RPKI announcements. They show which address ranges are covered by RPKI and who the issuing authority is.

• https://rpki.cloudflare.com/
• https://rpki-validator.ripe.net/ui/
• https://rpkiviz.zdns.cn/

Website, which tests, if your provider filters invalid announcements using RPKI.

Rappel is a pretty janky assembly REPL. It works by creating a shell ELF, starting it under ptrace, then continuously rewriting/running the .text section, while showing the register states. It's maybe half done right now, and supports Linux x86, amd64, armv7 (no thumb), and armv8 at the moment.

The website provides an automatic generator for regex patterns by learning from sample sentences. The website requires entering as many sample sentences with as many matching positions as possible. These datasets can also be imported and exported, such that they can be refined over time.

This repo describes a testbed to test various DNS resolvers. The purpose of the testbed is to allow researchers to set up many resolvers and run tests on each. For example, a test might see what the resolver emits when it is priming, or when it is responding to a particular query while using DNSSEC validation.

A standalone decompiler, built and managed by Avast. Works as a standalone program, has a trial version on the website, and there is an IDA Plugin.

Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code. Supported architectures (32b only): Intel x86, ARM, MIPS, PIC32, and PowerPC.

The website provides a generator for quickly configuring a reverse shell. After entering an IP address and port number, the website shows code snippets for many languages. It also provides the option to create bind shells or use the metasploit framework.

Overview page for the DNS root servers. It contains links to general news and all the supporting organizations.

The website features a map with all geographic locations. It contains information about locations, IPv4/IPv6 reachability and IP addresses.

Each root server has its own subdomain in the form of https://a.root-servers.org. It contains access to historical performance data like:

• Size and time of zone updates
• RCODE volume
• query and response sizes for UDP and TCP
• traffic volume (packets per time)
• Unique sources

Different information regarding reachability and connectivity of ASes.

The RsaCtfTool is a tool supporting working with RSA keys. The main focus lies in a wide range of known attacks which are implemented and easy to use with it. This makes it suitable for CTFs, especially Jeopardies.

Sometimes it is necessary to run Docker containers for a different CPU architecture. This Docker container makes it possible to run other Docker containers with a different architecture. It works by using binfmt_misc, a Linux kernel feature to run files with interpreters, and installs QEMU binaries for different architectures.

Helps in understanding macro_rules macros by automatically generating syntax diagrams for them.

This is essentially regexr for Rust. It helps in understanding and writing regular expressions (regex). It takes a regex and explains the different parts of it. Likewise, it also shows how the regex applies to a sample text.

Rust regular expression editor and tester.

SQLFluff is a Python program for formatting and linting SQL. It supports many SQL dialects. It comes with an auto-fix mode where it repairs the found issues and comes with a VS Code Extension.

Simple TLS proxy.

SandDance is a tool to quickly visualize and explore data. It comes with a VS Code extension. SandDance provides a few toggles and visualization styles, which makes experimentation easy.

The website allows searching for valid scrabble word which can be made from the letters. It supports different dictionaries. The website is only for English scrabble.

Scan a website for the HTTP headers returned and how good the security related headers are.

This software analyzes the formats of given files and outputs RDF description of their contents. It offers the following features:

• Format Extraction: Supports over 50 different formats including common media formats, archives, executables, and documents.
• Rich Metadata: Collects rich metadata, including common file properties and format-specific properties such as image dimensions.
• Hashing: Computes hashes using various algorithms to describe and identify the data.
• RDF Encoding: Encodes all the extracted information in RDF using common vocabularies found on the semantic web.
• Serialization: Allows saving the resulting RDF in one of the many RDF serialization formats.
• SPARQL Support: Provides the ability to use SPARQL to extract information or data using the processed RDF.

The software comes as an online version and as an installable and downloadable version.

Shapecatcher looks up Unicode symbols based on a drawing of the symbol. It is conceptually similar to Detexify, but returns Unicode symbols instead of macros.

This tool searches through many services if they have a user with a given username. This can either be used to find usernames, which are still available on the important websites, or to check for conflicting accounts.

A standalone C decompiler. Also has an IDA plugin.

Supports ARM, x86, and x86-64 architectures. Reads ELF, Mach-O, and PE file formats.

The website offers a large variety of crypto implementations which can be tested. It is helpful to solve unknown crypto challenges during CTFs. It is similar in concept to the CyberChef, but only for crypto.

The website can convert between different table formats. It supports dozens of formats like Excel, CSV, HTML tables, Markdown, arrays in many languages, or LaTeX.

The website can convert between different table formats. It supports CSV, Markdown, SQL, HTML. It is useful when embedding CSV data into Markdown or similar.

The website lets you create very customizable tables. It supports splitting and merging cells, customized lines around each cell, and coloring. The website supports LaTeX, HTML, and Markdown output.

The website contains different tcpdump filters. It starts with basic filters and then builds up ever more complex ones. This is a good source for looking up complicated filters, if one does not want to write them themselves.

Timevault is an implementation of timelock encryption. Timelock encryption encrypts a message based on a timestamp. After that time has passed, anyone can decrypt the message. This is useful for embargoed messages, which should be distributed before the reveal time, for example, vulnerability notifications.

The blog post by the drand project introduces the concept and contains further tools.

A command line version for timelock encryption is available.

The tool converts an input string into different and sometimes obscure Unicode characters. It is useful to generate funny-looking text or to generate a new username if the desired one is taken.

For example, the tool supports ⓒⓘⓡⓒⓛⓔⓓ, 𝖋𝖗𝖆𝖐𝖙𝖚𝖗, 🆂🆀🆄🅰🆁🅴🅳, ꜱᴍᴀʟʟ ᴄᴀᴩꜱ, ɐup 𝕠𝕥𝕙𝕖𝕣 wɘiᴙb options.

The W3C Link Checker crawls your website and reports broken or outdated links. The tool reports on broken links (e.g., 404), broken or missing websites, and links which should be updated to a new location.

Many more W3C checkers exist, for example HTML, CSS, or RSS validation. https://www.w3.org/developers/tools/ provides an overview.

https://www.webpagetest.org/

Allows scanning a website for different performance characteristics. There are five test kinds: 1) Site Performance, 2) Core Web Vitals, 3) Lighthouse, 4) Visual Comparison, and 5) Traceroute. It reports many web performance problems, like download times, first paints or problems with mobile devices.

https://pagespeed.web.dev/

Reports basic web performance data for mobile and desktop browsers.

The WebPlotDigitizer is a tool to extract data from plots and images. It guides the user through annotating the image and setting some parameters (such as axis values). This allows the tool to extract the values from the chart. The tool allows many customizations to allow better tuning of the extraction process. WebPlotDigitizer also comes in a desktop version.

WebWormhole is a website-based file transfer service. You can create a new wormhole and have others join it too. Then each side can provide and download files. The connection is done with WebRTC, such that it works without a central server.

The website scans a URL and gives recommendations for better security and privacy settings. This includes checking basics like TLS encryption, security headers that can be enabled (CSP, SRI), and privacy recommendations (like referrers).

These services allow you to create a domain name for any IP address. The IP address is encoded into the domain name. An overview of different services can be found here.

Online Services

• https://nip.io/ provides IPv4 only

  • Supports both . and - separators.
  • 10.0.0.1.nip.io resolves to 10.0.0.1
  • 192-168-1-250.nip.io resolves to 192.168.1.250
  • customer1.app.10.0.0.1.nip.io resolves to 10.0.0.1
  • magic-127-0-0-1.nip.io resolves to 127.0.0.1

• https://sslip.io/ provides IPv4 and IPv6

  • Supports both . and - separators.
  • Provides the ability to use the service with your own branding.
  • 192.168.0.1.sslip.io resolves to 192.168.0.1
  • 192-168-1-250.sslip.io resolves to 192.168.1.250
  • www.192-168-0-1.sslip.io resolves to 192.168.0.1
  • –1.sslip.io resolves to ::1
  • 2a01-4f8-c17-b8f--2.sslip.io resolves to 2a01:4f8:c17:b8f::2

• https://ip.addr.tools/ provides IPv4 and IPv6

  • Supports both . and - separators.
  • 192.168.0.1.ip.addr.tools resolves to 192.168.0.1
  • 192-168-1-250.ip.addr.tools resolves to 192.168.1.250
  • www.192-168-0-1.ip.addr.tools resolves to 192.168.0.1
  • 2a01-4f8-c17-b8f--2.ip.addr.tools resolves to 2a01:4f8:c17:b8f::2

Self-hosted Options

• hipio is a Haskell service for IPv4.

The Yahtzee position scorer takes the currently filled out values and dice roll and suggests the likely outcome of different game moves.

Yarrp is an active network topology discovery tool. Its goal is to identify router interfaces and interconnections on internet scale. Conceptually, this is similar to running many traceroutes and stitching them together into one view. However, traceroutes are designed to understand the connection between two hosts and do not scale easily.

The website offers an interactive tool to encode and encrypt data. It is based around blocks performing individual operations. These blocks can then pull or push their input/outputs from variables. This allows chaining them together to achieve more complex operations It is conceptually similar to CyberChef, but with a focus on encryption.

Different utilities for network scanning. Most importantly, the zmap component, which is a packet scanner for different protocols. It also contains other tools like ways to iterate over the IPv4 address space and denylist/allowlist management.

Ziggy is a tool to inspect the RPKI ecosystem at arbitrary points in the past. It is developed by NLnet Labs. More details about the ziggy tool can be found in the announcement blog post.

The zonemaster website runs various checks on the name servers for a zone. It covers various basics like IP reachability, consistency, diversity in the operators, various correctness tests like QNAME case insensitivity, and checking the quality of the EDNS setup. It is similar to Zonemaster.se.

The zonemaster website runs various checks on the name servers for a zone. It covers various basics like IP reachability, consistency, diversity in the operators, various correctness tests like QNAME case insensitivity, and checking the quality of the EDNS setup. It is similar to Zonemaster by cz.nic.

• https://challenges.addr.tools This is a helper tool for performing dns-01 ACME challenges. It serves the DNS validation and acts as a CNAME target.

• https://dyn.addr.tools Simple dynamic DNS server that can be used without an account.

• https://header-echo.addr.tools See the HTTP request headers. With URL parameters, the returned response can be customized.

• https://info.addr.tools Get information about IP addresses or domains.

  https://info.addr.tools/example.com
  https://info.addr.tools/1.1.1.1
  https://info.addr.tools/2606:4700:4700::1111
  https://info.addr.tools/me

• https://ip.addr.tools Return any IP address, e.g., 192-0-2-1.ip.addr.tools. Dynamic DNS updates for _acme-challenge are possible.

• https://myip.addr.tools Query your own IP address.

• https://dnscheck.tools Prints information about the currently used recursive DNS resolver and the DNSSEC implementation support.

• https://myaddr.tools Free dynamic DNS service.

angr is a python framework for analyzing binaries. It combines both static and dynamic symbolic ("concolic") analysis, making it applicable to various tasks.

This tool allows you to easily clean the LaTeX code of your paper to submit to arXiv. For example, it removes comments and optimizes images.

Test the quality of a client's SSL/TLS stack. The website shows sites which should fail or pass. Bad sites, that should fail but do not, show risks in the client.

The website lets you search for the cheapest train connection between two cities. It shows the cheapest trip per day and shows the different prices during a single day.

Binwalk is a binary file analysis tool. It works by traversing a file and looking for potentially embedded files. These embedded files can also be extracted.

https://caniuse.rs shows which library functions were stabilized in which Rust version.

Convert the gibberish of C declarations into English and back. The website uses the Clockwise/Spiral Rule to convert between them.

The website helps with selecting a color scheme for a map. It provides different presets and shows live how they would look on different maps.

deps.dev is a dependency analyzer for multiple language ecosystems (npm, Go modules, Maven, PyPI, Cargo). It shows basic information, such as the metadata (including license) about each package, dependencies, and reverse dependencies. It enhances this information by adding a diff viewer for the versions. Security advisories affecting a package or dependency are highlighted. The OpenSSF scorecard is also integrated, showing more insights about the project health.

The second feature of the website is an advisory viewer. It shows details about each advisory, including affected versions. It also calculates how much of the ecosystem is affected and patched.

diffdiff is a small online diff utility to compare two texts. It can show the difference inside a line, such as added words. The website runs local.

The created diffs can be shared, in which case they are uploaded to the server. Diffs can be exported as HTML or image file.

dnsdumpster.com fetches a lot of DNS information belonging to one domain. It checks the authoritative name servers, which records exist, and where the servers are located.

This is a custom DNS server which allows setting and retrieving text-based data. New values can be written as subdomains and retrieved via a normal TXT lookup.

• To set a key: dig my-value.my-key.dnskv.com txt +short
• To get a key: dig my-key.dnskv.com txt +short

The service provides many extra options like setting an expiry time or the TTL.

DNS performance measurement tools.

dnsteal provides a fake DNS server and encodes a file into a series of DNS requests. The fake DNS server then reassembles the file. This can be used to hide the file exfiltration as DNS traffic, however, since it doesn't use the default DNS server it is quite noisy.

explainshell does what the name suggests: it explains shell commands. It allows writing a shell command, and it explains what the program is doing, the meaning of the command line flags, and how the piping between different programs works.

This is a super simple service for generating different HTTP codes. It's useful for testing how your own scripts deal with varying responses. Just add the status code you want to the URL, like this: https://httpstat.us/200

The service allows many status codes, can add delays to the response, or return random ones. This can be useful for testing tools or code.

iodine allows to tunnel IPv4 traffic through a DNS server. This can be used if network access is restricted, but DNS is unfiltered, for example in when a captive portal is deployed.

jc JSONifies the output of many CLI tools, file-types, and common strings for easier parsing in scripts, e.g., dig example.com | jc --dig. It can parse the output of many basic Unix tools and system management tools. This list shows the supported parsers. jc is available via pip and Linux repositories.

This is a custom DNS server which allows setting and retrieving text-based data. New values can be written as subdomains and retrieved via a normal TXT lookup.

• To set a key: dig @ns.sslip.io put.my-value.my-key.k-v.io txt +short
• To get a key: dig @ns.sslip.io my-key.k-v.io txt +short
• To delete a key: dig @ns.sslip.io delete.my-key.k-v.io txt +short

"mess with dns" is a tool which allows you to experiment with DNS. The website allows creation of resource records of many types. They are all within a custom 3rd level domain. The website also shows the DNS requests the authoritative DNS server received.

Proxy framework for performing MitM attacks/transformations. Provides a Python API for scriptability.

The nPrint project is a collection of open-source software and benchmarks for network traffic analysis that aim to replace the built-to-task approach currently taken when examining traffic analysis tasks.

osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.

pdfpc is a tool enabling a presenter mode for presenting PDF files. The presenter mode contains the usual features known from PowerPoint/LibreOffice:

• Slide previews
• Notes
• Timer

pdfpc is especially adapted to present LaTeX presentations, which otherwise do not have a presenter mode.

pdoc is a Python API documentation generation, which turns doc-strings and type annotations into a simple and elegant documentation.

pdoc auto-generates API documentation that follows your project's Python module hierarchy. It requires no configuration, has first-class support for type annotations, cross-links between identifiers, comes with an integrated live-reloading web server, uses customizable HTML templates, understands numpydoc and Google-style docstrings, and is permissively licensed.

preeny helps pwning binaries by disabling many annoying functions, such as random or alarm. It does so by providing different LDPRELOAD-able libraries for those library functions.

pwntools is one of THE Python tools needed during a CTF. It is useful for both jeopardy and attack-defense CTFs. It provides common abstractions, like connecting to a local or remote program, and simplifying I/O. Additionally, it provides helpers for many exploitation techniques, such as ROP, shellcode, and leaking memory.

pyNTM allows creating a network with circuits between layer 3 nodes. This model then allows simulating and evaluate how traffic will traverse the topology. This can be used to test different network topologies and fail over scenarios.

regex101 helps in understanding and writing regular expressions (regex). It takes a regex and explains the different parts of it. It also shows how the regex applies to a sample text.

Additionally, it contains a regex reference as well as a user supplied library of different regexes.

regexr helps in understanding and writing regular expressions (regex). It takes a regex and explains the different parts of it. It also shows how the regex applies to a sample text.

Additionally, it contains a regex reference as well as a user supplied library of different regexes.

DNS responses gathering and differences analysis toolchain.

Execute code blocks in Markdown files and test if they produce the expected outcome. This is similar to checking doctests using rustdoc.

This is a tcpdump-like program for printing TLS SNI and HTTP/1.1 Host fields in live or captured traffic.

Test the quality of a server's TLS stack It shows the enabled TLS versions on the server, tests for available ciphers, checks the TLS handshake, looks at the HTTP security headers, and tests for known vulnerabilities.

A traceroute like tool, that detects where a path crosses an IXP.

The website allows inspecting encoded information in URLs, by parsing the URL with generic or specialized extractors. For example, it can decode the query parameters of Google searches and display what the different parameters mean.

urlscan.io is a sandbox for URLs. The website generates a report for a URL to get a basic understanding about the network connections involved. The report includes a screenshot, the list of IP addresses and domains the website uses, and detected scripts.

WireDiff is a debugging tool to diff network traffic leveraging Wireshark.

Wirediff lets you open 2 network traces packets side-by-side. You can select a packet from each trace and diff their content at the protocol level you want.

A more thorough introduction is available in the APNIC blog: https://blog.apnic.net/2020/07/01/wirediff-a-new-tool-to-diff-network-captures/.

zesplot is an IPv6 visualization tool. It turns a list of IP addresses into a picture, for example as a heatmap representation. It works based on squarified treemaps, since the IPv4 way of space-filling curves works poorly for such a sparse space.