All about Tools

Content

AMP-Research: Amplification Research angr arXiv LaTeX Cleaner Arxiv Vanity badssl bahn.guru Bahn-Preiskalender Better Pagers BGPlay BGPStream (CAIDA) Binary Ninja Cloud Binary Refinery BinDiff (zynamics) binwalk caniuse.rs cdecl: C gibberish ↔ English Check Propagation of DNS Records colorbrewer Compacted-DNS (C-DNS): A Format for DNS Packet Capture CPP Insights CTF Tools by CInsects CyberChef Dataset Search by Google Debin: Predicting Debug Information in Stripped Binaries Depix: Recover passwords from pixelized screenshots deps.dev Detexify DirectPoll: Large Polls with Audience Participation DMAP Domain Mapper by SIDN Labs DNS Quality/Overview Tools DNS Replay Tool (drool) DNSCAP dnsdumpster dnskv: DNS-based Key-Value Storage dnsperf and resperf dnsteal DNS Exfiltration Tool DNSTOP Driftnet Dublin Traceroute Easy File Sharing without Accounts Entropy/IP Evcxr: Rust Interpreter and Jupyter Kernel explainshell FD.io: The World's Secure Networking Data Plane Flamethrower Float Toy Ghidra GNU poke: The extensible editor for structured binary data Godbolt Compiler Explorer IDA - Interative Disassembler Image Metadata Viewer iodine DNS Tunnel IPmap RIPE IPv4 Heatmap IPv6 Security/Network Tools John the Ripper k-v.io: DNS-based Key-Value Store List of JSON to Struct Converters List of Malware Analysis Websites Lists of DNS Blacklists mess with dns Mini Internet Project mitmproxy - an interactive HTTPS proxy Mozilla Observatory Mozilla TLS Configuration Generator Multilevel MDA-Lite Paris **Traceroute** NAT64 Testers Netlab 360 OpenData Project NetworkScan Mon NextDNS nPrint One Gadget Online Dis-Assembler Online Disassembler OpenWPM: A web privacy measurement framework osquery Over The Wire: Wargames OWASP Amass PacketQ: Query PCAPs using SQL Paris Traceroute pdfpc: PDF Presenter Console pdoc: API Documentation for Python Projects PEERING: The BGP Testbed Pi-hole Play with Docker Postgres Explain Visualizer PostgreSQL's Explain Analyze made Readable preeny Programming Playgrounds pwntools pyNTM: Network Traffic Modeler Qualys SSL Labs Rappel: Linux Assembly REPL RegexGenerator++ regexr Resolver Testbed respdiff RetDec - Retargetable Decompiler RIPEstat: Providing open data and insights for Internet resources Root Servers Routing Information Service (RIS) RPKI Browsers RPKI Tester RsaCtfTool Run Foreign-Achitecture Docker Containers Rust Macro Railroad Rust Regex Explanations and Testing Rustexp SandDance: Visualize Data Scrabble Word Finder Securityheaders Shapecatcher shelldoc Sherlock: Find usernames across social networks snidump Snowman Decompiler Solve Crypto with Force! SSLsplit - transparent SSL/TLS interception Table Magic: Convert between table formats Tables Generator Tcpdump advanced filters traIXroute unfurl Unicode Text Converter urlscan.io vizAS W3C Link Checker WAND Active Measurement Project WebPlotDigitizer Wildcard DNS for IP Addresses wirediff Yahtzee Position Scorer Yarrp: Yelling at Random Routers Progressively zesplot: IPv6 Visualisation Ziggy: the RPKI Wayback Machine ZMap Project

AMP-Research: Amplification Research

 https://github.com/Phenomite/AMP-Research

Amplification | Datasets | Denial-of-Service | Networks

The AMP-Research project collects information about amplification vectors in protocols including reproduction possibilities. For each vector the port and protocol are listed, as well as, the amplification factor. A scanning script or payload for scanning with zmap is included too.


angr

 https://angr.io/

CTF | Python | Reverse Engineering

angr is a python framework for analyzing binaries. It combines both static and dynamic symbolic ("concolic") analysis, making it applicable to a variety of tasks.


arXiv LaTeX Cleaner

 https://github.com/google-research/arxiv-latex-cleaner

TeX

This tool allows you to easily clean the LaTeX code of your paper to submit to arXiv. For example, it removes comments and optimizes images.


Arxiv Vanity

 https://www.arxiv-vanity.com/

Paper Writing

Watch Arxiv-papers on as a website.


badssl

 https://badssl.com/

Certificates | TLS

Test the quality of a client's SSL/TLS stack. The website shows sites which should fail or pass. Sites which fail but do not on the browser viewing are a risiko.


bahn.guru Bahn-Preiskalender

 https://bahn.guru/

The website lets you search for the cheapest train connection between two cities. It shows the cheapest trip per day and shows the different prices during a single day.


Better Pagers

There are various pagers which are more suitable or user friendly than the basic pagers like more or less.

bat – A cat(1) clone with wings

bat is an advanced pager, supporting usability features. It comes with syntax highlighting out of the box. It also integrates with git and shows the lines added and removed for a file.

pspg – Postgres Pager

pspg is an advanced pager for usage with psql. It shows the data in table form, allows scrolling through the columns and rows. You can pin header or initial columns, such that they do not move while scrolling around. It supports many different color schemes.


BGPlay

 https://stat.ripe.net/special/bgplay

BGP | Datasets | Networks

BGPlay shows a graph of the observed BGP routes. It allows replaying historical BGP announcements and displays route changes.

Documentation
GitHub


BGPStream (CAIDA)

 https://bgpstream.caida.org/

Autonomous Systems | BGP | Datasets | Networks

An open-source software framework for live and historical BGP data analysis, supporting scientific research, operational monitoring, and post-event analysis.

BGP streams are freely accesible and provided by Route View, RIPE, and BGPmon.


Binary Ninja Cloud

 https://cloud.binary.ninja/

CTF | Reverse Engineering

The cloud version of binary ninja allows free reversing in the cloud. It has a real-time collaboration feature.


Binary Refinery

 https://github.com/binref/refinery

CTF

Binary Refinery is a collection of Python scripts for transforming data. It is similar in concept to CyberChef but runs locally. For example, Binary Refinery support base64 or hex transformations, hash data, or pack values into binary.


BinDiff (zynamics)

 https://zynamics.com/software.html

Reverse Engineering

IDA plugin for comparing binaries. Allows to label unkown binaries with annotations from a different IDA database.


binwalk

 https://github.com/ReFirmLabs/binwalk

CTF

Binwalk is a binary file analysis tool. It works by traversing a file and looking for potentially embedded files. These embedded files can also be extraced.


caniuse.rs

 https://caniuse.rs/

Datasets | Rust

caniuse.rs shows which library functions where stabilized in which Rust version.


cdecl: C gibberish ↔ English

 https://cdecl.org/

Convert the gibberish of C declarations into English and back. The website uses the Clockwise/Spiral Rule to convert between them.


Check Propagation of DNS Records

 https://dnschecker.org/

DNS

The website allows to execute DNS queries from various locations worldwide to check the returned values.


colorbrewer

 https://colorbrewer2.org/

The website helps in selecting a colorscheme for a map. It provides different presets and shows live how they would look on different maps.


Compacted-DNS (C-DNS): A Format for DNS Packet Capture

 https://tools.ietf.org/html/rfc8618

DNS

C-DNS is a space efficient file format for storing DNS traffic. It is based on CBOR with a fixed schema as defined in RFC 8618.

Some tools exists to work with C-DNS files. The dns-stats compactor can convert pcap-to-cdns and vice versa. It can be configured flexibly to only record those fields of the DNS message which are of interest, thus saving space in the compacted format.


CPP Insights

 https://cppinsights.io/

Desugar C++ code and show how modern C++ features are implemented. This helps in understanding the details of C++ and how modern compilers implement the language standard.


CTF Tools by CInsects

 https://cinsects.de/category/resources.html

CTF

CInsects is a German CTF team. They collect resources of tool, tutorials, and documentation around CTF tools and exploitation.


CyberChef

 https://gchq.github.io/CyberChef/

CTF

The CyberChef is a website which provides many recipes and makes it easy to combine them. The recipes are small input/output steps, similar to UNIX tools, and cover a large area of topics, like data formats, encoding, encryption, networking, hashing, compression, etc. The main use case is making it easier in CTFs to chain simple operations together like processing encoded text.


 https://datasetsearch.research.google.com/

The Dataset Search by Google is a search engine explicitly for datasets. Supported datasets need to be tagged with a special markup, which allows the search to provide more usefull results. This also limits the search engine, since not all datasets will be appropiatly marked.


Debin: Predicting Debug Information in Stripped Binaries

 https://debin.ai

CTF | Reverse Engineering

Debin is a tool to predict the debug information of stripped binaries. It only works relyable with C programs, as this is the only dataset it was trained on. It might be useful to use the website for jeopardy CTFs.


Depix: Recover passwords from pixelized screenshots

 https://github.com/beurtschipper/Depix

CTF

Depix allows to revert pixelization and recover the original text. It works for pixelized images created using linear box filters. The recovery process is not always perfect, but good enough to produce readable text.


deps.dev

 https://deps.dev/

Security

deps.dev is a dependency analyzer for multiple language ecosystems (npm, Go modules, Maven, PyPI, Cargo). It shows basic information, such as the metadata (including license) about each package, dependencies, and reverse dependencies. It enhances these information by adding a diff viewer for the versions. Security advisories affecting a package or dependency are highlighted. The OpenSSF scorecard is also integrated, showing more insights about the project health.

The second feature of the website is an advisory viewer. It shows details about each advisory, including affected versions. It also calculates how much of the ecosystem is affected and patched.


Detexify

 http://detexify.kirelabs.org/classify.html

TeX

Detexify helps in writing complex LaTeX symbols, similar to Shapecatcher for Unicode. It searches for the correct LaTeX macros based on a drawing of the shape the users wants. It is a better way to search for symbols instead of going through the symbols-a4.pdf manually.


DirectPoll: Large Polls with Audience Participation

 https://directpoll.com/

The website lets you create polls, which are intended to be used live in front of a large audience. The presenter can configure the poll, select display options, and mark correct answers.

During the presentation, the presenter has a view, which shows the live results of the poll. The audience can join the polls and vote on them live. The results are completly anonymous.

It can be a great tool for interactive PowerPoint presentations, for lectures, or generally for trivia events.


DMAP Domain Mapper by SIDN Labs

 https://dmap.sidnlabs.nl/

Datasets | DNS | Networks

DMAP is a scalable web scanning suit which supports DNS, HTTPS, TLS, and SMTP. It works based on domain names and crawls the domain for all supported protocols. The advantage over other tools is the unified SQL data model with 166 features and the easy scalability over many crawling machines.


DNS Quality/Overview Tools

Datasets | DNS | DNSSEC | Networks

Check My DNS

Browser-based DNS resolver quality measurement tool. Uses the browser to generate many resolver queries and tests for features they should have, such as EDNS support, IPv6, QNAME Minimisation, etc.

This test is also available as a CLI tool: https://github.com/DNS-OARC/cmdns-cli

DNSSEC Debugger

Analyze DNSSEC deployment for a zone and show errors in the configuration.

DNSViz

Gives an overview over DNSSEC delegations, response sizes, and name servers.

GitHub: https://github.com/dnsviz/dnsviz

DNS X-Ray

The website has an online test, which performs DNS lookups. These DNS lookups test if certain resource records are overwritten in the cache. The tool can then determine what DNS software is used, where the server is located, how many caches there are, etc.

EDNS Compliance Tester

Test name server of zones for correct EDNS support.

The Transitive Trust and DNS Dependency Graph Portal

Shows the trust dependencies in DNS. Given a domain name it can show how zones delegate to each other and why. The delegation is done between IP addresses and zones.

Root Canary Project

The project used to monitor the first root KSK key rollover. Now it contains the paper "Roll, Roll, Roll your Root: A Comprehensive Analysis of the FirstEver DNSSEC Root KSK Rollover" describing the experiences of the first root KSK rollover

Additionally, it includes a tester for DNSSEC algorithm support, which shows the algorithms supported by the currently used recursive resolver. It provides statistics about support for DNSSEC algorithms. It has a web based test to test your own resolver and provides a live monitoring using the RIPA Atlas.


DNS Replay Tool (drool)

 https://www.dns-oarc.net/tools/drool

DNS | IP | Networks | PCAPs

Tool to replay DNS queries captured in a pcap file with accurate timing between queries. Allows modifying the replay like changing IP addresses, speed up or slow down the queries.


DNSCAP

 https://www.dns-oarc.net/tools/dnscap

DNS | IP | Networks | PCAPs

DNS network capture utility. Similar in concept to tcpdump, but with specialized options for DNS.


dnsdumpster

 https://dnsdumpster.com/

Datasets | DNS

dnsdumpster.com fetches a lot of DNS information belonging to one domain. It checks the authorative name servers, which records exist, and where the servers are located.


dnskv: DNS-based Key-Value Storage

 https://dnskv.com/

DNS

This is a custom DNS server which allows setting and retrieving text based data. New values can be written as subdomains and retrieved via a normal TXT lookup.

  • To set a key: dig my-value.my-key.dnskv.com txt +short
  • To get a key: dig my-key.dnskv.com txt +short

The service provides many extra options like setting an expiry time or the TTL.


dnsperf and resperf

 https://www.dns-oarc.net/tools/dnsperf

DNS | IP | Networks | PCAPs

DNS performance measurement tools.


dnsteal DNS Exfiltration Tool

 https://github.com/m57/dnsteal

CTF | DNS

dnsteal provides a fake DNS server and encodes a file into a series of DNS requests. The fake DNS server then reassembles the file. This can be used to hide the file exfiltration as DNS traffic, however, since it doesn't use the default DNS server it is quite noisy.


DNSTOP

 http://dns.measurement-factory.com/tools/dnstop/

DNS | Networks

Top-like utility showing information about captured DNS requests. It shows information about the domains queries, the types, and responses.


Driftnet

 https://github.com/deiv/driftnet

CTF | Networks

Driftnet watches network traffic, and picks out and displays JPEG and GIF images for display.


Dublin Traceroute

 https://dublin-traceroute.net/README.md

IP | Networks

This is an improvement on Paris traceroute and the classical traceroute. It can detect changing routes and detect NATs along the path.


Easy File Sharing without Accounts

  • https://transfer.sh/ allows uploading from the command line and the browser. Files can be up to 10 GB and be stored up to 14 days. It allows limiting the number of downloads.

    ```sh

    Upload using cURL

    $ curl --upload-file ./hello.txt https://transfer.sh/hello.txt https://transfer.sh/66nb8/hello.txt

    $ curl -H "Max-Downloads: 1" -H "Max-Days: 5" --upload-file ./hello.txt https://transfer.sh/hello.txt https://transfer.sh/66nb8/hello.txt ```

  • https://instant.io/ share and receive files using WebTorrent.

  • https://send.tresorit.com/ allows anonymous file shares. Files can up up to 5 GB and be stored for up to 7 days.

Entropy/IP

 https://github.com/akamai/entropy-ip

IP

The Entropy/IP algorithm allows for inspecting and generating IPv6 addresses. Entropy/IP can determine the entropy of different nibbles and relationship between different components. Based on this analysis it can also create valid-looking IPv6 addresses.


Evcxr: Rust Interpreter and Jupyter Kernel

 https://github.com/google/evcxr

Rust

Evcxr is a Rust interpreter and also provides a Jupyter kernel. This is a helpfull addition to the online playground as it allows installing and using any crate.


explainshell

 https://explainshell.com/

Cheatsheet

explainshell does what the name suggest: it explains shell commands. It allows to write a shell command and it expains what the program is doing, the meaning of the command line flags, and how the pipeing between different programs works.


FD.io: The World's Secure Networking Data Plane

 https://github.com/tim-fiola/network_traffic_modeler_py3

Networks

FD.io is a very fast userspace networking library, which allows to create programs for packet processing. While DPDK allows fast read and write access to the NICs, FD.io is foccussed on processing the packets. Possible use cases are a packet forwarder, implementing a NAT, or a VPN.

More details also in this APNIC blogpost: https://blog.apnic.net/2020/04/17/kernel-bypass-networking-with-fd-io-and-vpp/


Flamethrower

 https://github.com/DNS-OARC/flamethrower

DNS | IP | Networks

Flamethrower is a small, fast, configurable tool for functional testing, benchmarking, and stress testing DNS servers and networks. It supports IPv4, IPv6, UDP, TCP, DoT, and DoH and has a modular system for generating queries used in the tests.


Float Toy

 https://evanw.github.io/float-toy/

The Float Toy website allows to interactively explore IEEE floating-point numbers. It shows 16, 32, and 64 variants. It allows flipping individual bit and visualizes the result. The meaning of the bits is also shown and color-coded.


Ghidra

 https://ghidra-sre.org/

CTF | Reverse Engineering

Ghidra software reverse engineering (SRE) framework and IDA Pro alternative.


GNU poke: The extensible editor for structured binary data

 https://www.jemarch.net/poke.html

GNU poke is an interactive, extensible editor for binary data. Not limited to editing basic entities such as bits and bytes, it provides a full-fledged procedural, interactive programming language designed to describe data structures and to operate on them.

poke comes which a online manual and also has a quick start guide.


Godbolt Compiler Explorer

 https://godbolt.org/

x86 | CTF

The Godbolt compiler explorer allows the user to compile a function and see the corresponding assembly code. It can highlight matching parts in the language and assembly, making it easy to understand how individual expressions are compiled. It supports common languages like C, C++, Go, Rust. It can also work with assembler and LLVM IR.

Another nice feature is, that it can show statistics about assembler code, like needed cycles, instructions, and which resources the instructions need. This uses the LLVM Machine Code Analyzer.


IDA - Interative Disassembler

 https://hex-rays.com/ida-free/

Reverse Engineering

THE reverse engineering tool.


Image Metadata Viewer

 http://exif.regex.info/exif.cgi

CTF

The online Image Metadata Viewer shows the EXIF information from uploaded files or files by URL. It supports a wide range of metadata, such as XMP, EXIF, IPTC, and MakerNotes.


iodine DNS Tunnel

 https://code.kryo.se/iodine/

DNS

iodine allows to tunnel IPv4 traffic through a DNS server. This can be used if network access is restricted, but DNS is unfiltered, for example in when a captive portal is deployed.


IPmap RIPE

 https://ipmap.ripe.net/

BGP | Datasets | Maps | Networks

IP geolocation services feeding itself from geolocation databases, user provided locations, and most importantly active RTT measurements based on the RIPE Atlas system. It also provides a nice API to query the location. It provides a breakdown on where the results stem from and how much they contribute to the overall result.


IPv4 Heatmap

 https://github.com/measurement-factory/ipv4-heatmap

IP

The IPv4 heatmap tool draws an image of active IPv4 addresses. The IP addresses are mapped to pixels useing a Hilbert curve or a Z-curve. The image can be extended with annotations about the address space, for example to show which regional internet registry is assigned to the address.


IPv6 Security/Network Tools

IP


John the Ripper

 https://github.com/openwall/john

CTF | Hashes | Passwords

John the Ripper is THE tool to brute force passwords and password hashes. It is very fast in calculating hashes with support of GPU acceleration and supports a wide range of different hash formats.


k-v.io: DNS-based Key-Value Store

 https://k-v.io/

DNS

This is a custom DNS server which allows setting and retrieving text based data. New values can be written as subdomains and retrieved via a normal TXT lookup.

  • To set a key: dig @ns.sslip.io put.my-value.my-key.k-v.io txt +short
  • To get a key: dig @ns.sslip.io my-key.k-v.io txt +short
  • To delete a key: dig @ns.sslip.io delete.my-key.k-v.io txt +short

List of JSON to Struct Converters

JSON | Rust

These websites provide tools, which convert JSON data to structs in different programming languages.


List of Malware Analysis Websites

 https://gitlab.labs.nic.cz/knot/respdiff

These websites provide different features to analyse binaries and especially malware. They provide searching by file hashes or by uploading the binary.

Some of the services provide more detailed analyses, such as as which files were access or snapshots of any windows opened.


Lists of DNS Blacklists

Datasets | DNS | IP | Networks | Spam

These projects either operate DNS based Real-time Blackhole Lists (RBL) or allow checking if an IP is contained. The Multi-RBL websites are helpful in finding a large quantity of RBLs.


mess with dns

 https://messwithdns.net/

DNS

"mess with dns" is a tool which allows you to experiment with DNS. The website allows creation of resource records of many types. They are all within a custom 3rd level domain. The website also shows the DNS requests the authoritative DNS server received.


Mini Internet Project

 https://github.com/nsg-ethz/mini_internet_project

BGP | IP | Networks

The mini internet project is part of the curiculum by the Networked Systems Group of ETH Zurich. It teaches the students the basic steps how to create a mini internet. It starts with the basics of intra-network routing, by setting up multiple L2 switches. Then the students have to configure L3 routers to connect multiple L2 sites together. Lastly, in a big hackathon style, the students need to connect their local network with the network of the other students, by properly configuring BGP routers and setting up routing policies.

The code and the tasks are all available in the GitHub repository.

The APNIC Blog has a nice introduction to the project too.


mitmproxy - an interactive HTTPS proxy

 https://mitmproxy.org/

Proxys | TLS

Proxy framework for performing MitM attacks/transformations. Provides a Python APi for scriptability


Mozilla Observatory

 https://observatory.mozilla.org/

Certificates | TLS

Website quality measurement tool. The website measures the quality of HTTP headers which improve security. Additionally, it provides inspections for the TLS certificate and SSH servers. It also includes many third party tools.


Mozilla TLS Configuration Generator

 https://ssl-config.mozilla.org/

TLS

Create variable TLS configurations for all major webservers. It is specialized for each webserver and server version. The configurations supports different TLS configurations, depending on the needed support for old clients.


Multilevel MDA-Lite Paris **Traceroute**

 https://gitlab.planet-lab.eu/cartography/

IP | Networks

Multi-level MDA-Lite Paris Traceroute is a traceroute tool, which understands and learns more complex network topologies. Often times the network is not just a line, but multiple paths are possible and chosen at random.

A good description of the tool can be found in the RIPE Labs post or in the IMC 2018 paper.


NAT64 Testers

 https://www.nat64check.org

DNS | Networks

This website measures support for NAT64 in other websites.


Netlab 360 OpenData Project

 https://data.netlab.360.com/

Amplification | Datasets | Networks

The Netlab of 360.com provides some open data streams.

One dataset concerns the number of abused reflectors per protocol.


NetworkScan Mon

 https://scan.netlab.360.com/

Amplification | Datasets | Networks

Overview over IP addresses scanning the internet and which ports are scanned.


NextDNS

 https://nextdns.io/

DNS

A free and configurable DNS resolver. It provides customizable blocking, such as for ads, trackers, or malicious websites. Additionally, statistics can be shown, such as for most blocked website.

A similar self-hosted variant is Pi-hole.


nPrint

 https://nprint.github.io/

Networks

The nPrint project is a collection of open source software and benchmarks for network traffic analysis that aim to replace the built-to-task approach currently taken when examining traffic analysis tasks.


One Gadget

 https://github.com/david942j/one_gadget

Reverse Engineering

A tool to find the one gadget in libc. It list all gadgets leading to execve('/bin/sh', NULL, NULL) including their preconditions.


Online Dis-Assembler

 https://defuse.ca/online-x86-assembler.htm

CTF | x86

Website allowing assembly and disassembly of x86 and x64 code.


Online Disassembler

 https://onlinedisassembler.com/odaweb/

CTF | Reverse Engineering | x86

The online disassembler can disassemble a wide range of binary formats and platforms. It can disassemble free-standing bytes too. It provides a disassembly view, a graph view, a symbols and a function viewer.


OpenWPM: A web privacy measurement framework

 https://github.com/mozilla/OpenWPM

OpenWPM is a web privacy measurement framework which makes it easy to collect data for privacy studies on a scale of thousands to millions of websites. OpenWPM is built on top of Firefox, with automation provided by Selenium. It includes several hooks for data collection. Check out the instrumentation section below for more details.


osquery

 https://github.com/osquery/osquery

osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.


Over The Wire: Wargames

 https://overthewire.org/wargames/

CTF | Datasets

Over The Wire provides with the wargames many different challenges, to learn exploitations of different things. There are different wargames based on skill and required tooling. In each level the user has to retrieve a flag to procede to the next level.


OWASP Amass

 https://github.com/OWASP/Amass

CTF | DNS

The OWASP Amass tool suite obtains subdomain names by scraping data sources, recursive brute forcing, crawling web archives, permuting/altering names and reverse DNS sweeping. Additionally, Amass uses the IP addresses obtained during resolution to discover associated netblocks and ASNs. All the information is then used to build maps of the target networks.


PacketQ: Query PCAPs using SQL

 https://github.com/DNS-OARC/PacketQ

DNS

packetq is a command line tool to run SQL queries directly on PCAP files, the results can be outputted as JSON (default), formatted/compact CSV and XML. It also contain a very simplistic web-server in order to inspect PCAP files remotely,


Paris Traceroute

 https://paris-traceroute.net/

IP | Networks

This is an improvement on the traditional traceroute program. It is able to detect multiple distinct routes and display them accordingly. The classical traceroute would produce weird results on changing network routes.

Another similar program is Dublin traceroute.


pdfpc: PDF Presenter Console

 https://github.com/pdfpc/pdfpc

pdfpc is a tool enabling a presenter mode for presenting PDF files. The presenter mode contains the usual features known from Powerpoint/Libreoffice:

  • Slide previews
  • Notes
  • Timer

pdfpc is especially adapted to present LaTeX presentations, which otherwise do not have a presenter mode.


pdoc: API Documentation for Python Projects

 https://pdoc.dev/

Python

pdoc is a Python API documentation generation, which turns doc-strings and type annotations into a simple and elegant documentation.

pdoc auto-generates API documentation that follows your project's Python module hierarchy. It requires no configuration, has first-class support for type annotations, cross-links between identifiers, comes with an integrated live-reloading web server, uses customizable HTML templates, understands numpydoc and Google-style docstrings, and is permissively licensed.


PEERING: The BGP Testbed

 https://peering.ee.columbia.edu/

BGP | Networks

PEERING is an environment where researchers and educators can play with BGP announcements in a real but sandboxed environment.

Description from the website:

The long-term goal of the PEERING system is to enable on-demand, safe, and controlled access to the Internet routing ecosystem for researchers and educators:

  • PEERING for researchers. Today, it is hard for researchers to conduct Internet routing experiments. To perform a routing experiment, a research institution has to obtain Internet resources (IP addresses and ASNs) and establish relations with upstream networks. PEERING eliminates these obstacles and provides researchers controlled on-demand access to the routing ecosystem.
  • PEERING for educators. Educators can use the PEERING infrastructure in teaching students the Internet routing architecture. The students access to live BGP sessions to multiple ISPs.

Pi-hole

 https://pi-hole.net/

DNS

A free and configurable DNS stub-resolver. It provides customizable blocking, such as for ads, trackers, or malicious websites. Additionally, statistics can be shown, such as for most blocked website.

It can also function as a DHCP server for clients on the same network.

A similar service is NextDNS.


Play with Docker

 https://labs.play-with-docker.com/

Docker

Play with Docker is a Docker playground which allows users to run Docker commands in a matter of seconds. It gives the experience of having a free Alpine Linux Virtual Machine in browser, where you can build and run Docker containers and even create clusters in Docker Swarm Mode. Under the hood Docker-in-Docker (DinD) is used to give the effect of multiple VMs/PCs. In addition to the playground, PWD also includes a training site composed of a large set of Docker labs and quizzes from beginner to advanced level available at training.play-with-docker.com.


Postgres Explain Visualizer

 https://tatiyants.com/pev/#/plans/new

The website takes a Postgres Explain output and displays it as a more readable graph.


PostgreSQL's Explain Analyze made Readable

 https://explain.depesz.com/s/w1Wko

The website takes a Postgres Explain output and displays it more readable and highlights the important parts.


preeny

 https://github.com/zardus/preeny

CTF

preeny helps pwning binaries by disabling many annoying functions such as random or alarm. It does so by providing different LDPRELOAD-able libraries for those library functions.


Programming Playgrounds

Python | Rust


pwntools

 https://pwntools.readthedocs.io/en/stable/

CTF

pwntools is one of THE Python tools needed during a CTF. It is useful for both jeopardy and attack-defense CTFs. It provides common abstractions, like connecting to a local or remote program and simplifying I/O. Addtionally, it provides helpers for many exploitation techniques, such as ROP, shellcode, and leaking memory.


pyNTM: Network Traffic Modeler

 https://github.com/tim-fiola/network_traffic_modeler_py3

Networks

pyNTM allows to create a network with circuits between layer 3 nodes. This model then allows to simulate and evaluate how traffic will traverse the topology. This can be used to test different network topologies and fail over scenarios.


Qualys SSL Labs

 https://www.ssllabs.com/

Certificates | TLS

Test the quality of a server's or a client's SSL/TLS stack. Very useful to test a server. Provides a A-F rating scheme and shows vulnerabilities and weak protocols/cipher suites.


Rappel: Linux Assembly REPL

 https://github.com/yrp604/rappel

x86

Rappel is a pretty janky assembly REPL. It works by creating a shell ELF, starting it under ptrace, then continiously rewriting/running the .text section, while showing the register states. It's maybe half done right now, and supports Linux x86, amd64, armv7 (no thumb), and armv8 at the moment.


RegexGenerator++

 http://regex.inginf.units.it/

The website provides an automatic generator for regex patterns by learning from sample sentences. The website requires entering as many sample sentences with as many matching positions as possible. These datasets can also be imported and exported, such that they can be refined over time.


regexr

 https://regexr.com/

Cheatsheet

regexr helps in understanding and writing regular expressions (RegEx). It takes a RegEx and explains the different parts of it. It also shows how the RegEx applies to a sample text.

Additionally, it contains a RegEx reference as well as a user supplied library of different RegExs.


Resolver Testbed

 https://github.com/icann/resolver-testbed

DNS

This repo describes a testbed to test various DNS resolvers. The purpose of the testbed is to allow researchers to set up many resolvers and run tests on each. For example, a test might see what the resolver emits when it is priming, or when it is responding to a particular query while using DNSSEC validation.


respdiff

 https://gitlab.labs.nic.cz/knot/respdiff

DNS | Networks

DNS responses gathering and differences analysis toolchain.


RetDec - Retargetable Decompiler

 https://retdec.com/

Reverse Engineering

A standalone decompiler build and managed by Avast. Works as a standalone program, has a trial version on the website, and there is an IDA Plugin.

Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code. Supported architectures (32b only): Intel x86, ARM, MIPS, PIC32, and PowerPC.


RIPEstat: Providing open data and insights for Internet resources

 https://stat.ripe.net/

Autonomous Systems | BGP | Datasets | DNS | Networks

RIPEstat is a network statistics platform by RIPE. The platform shows data for IP addresses, networks, ASNs, and DNS names. This includes information such as the registration information, abuse contacts, blocklist status, BGP information, geolocation lookups, or reverse DNS names. Additionally, the website links to many other useful tools, such as an address space hierarchy viewer, historical whois information, and routing consistency checks.


Root Servers

 https://root-servers.org

Datasets | DNS

Overview page for the DNS root servers. It contains links to general news and all the supporting organizations.

The website features a map with all geographic locations. It contains information about locations, IPv4/IPv6 reachability and IP addresses.

Each root server has its own subdomain in the form of http://a.root-servers.org. It contains access to historical performance data like:

  • Size and time of zone updates
  • RCODE volume
  • query and response sizes for UDP and TCP
  • traffic volume (packets per time)
  • Unique sources

Routing Information Service (RIS)

 https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris

BGP | Datasets | DNS | Networks

Different information regarding reachability and connectiveness of ASs.


RPKI Browsers

Datasets | Networks | RPKI

These websites allow you to browser the valid RPKI announcements. They show which address ranges are covered by RPKI and who the issuing authority is.


RPKI Tester

 https://www.ripe.net/s/rpki-test

Networks | RPKI

Website, which tests, if your provider filters invalid announcements using RPKI.


RsaCtfTool

 https://github.com/Ganapati/RsaCtfTool

Certificates | CTF

The RsaCtfTool is a tool supporting working with RSA keys. The main focus lies in a wide range of known attacks which are implemented and easy to use with it. This makes it suitable for CTFs, especially Jeopardies.


Run Foreign-Achitecture Docker Containers

 https://npmccallum.gitlab.io/post/foreign-architecture-docker/

CTF | Docker

Sometimes it is necessary to run Docker containers for a different CPU architecture. This Docker containers makes it possible to run other Docker containers with a different architecture. It works by using binfmt_misc, a Linux kernel feature to run files with interpreters, and installs qemu binaries for different architectures.


Rust Macro Railroad

 https://lukaslueg.github.io/macro_railroad_wasm_demo/

Cheatsheet | Rust

Helps in understanding macro_rules macros by automatically generating syntax diagrams for them.


Rust Regex Explanations and Testing

 https://bestia.dev/rust_regex_explanation_pwa/

Rust

The Academic Phrasebank is a general resource for academic writers. It aims to provide you with examples of some of the phraseological ‘nuts and bolts’ of writing organised according to the main sections of a research paper or dissertation.

The data bank contains the categories “Introducing Work”, “Referring to Sources”, “Describing Methods”, “Reporting Results”, “Discussing Findings”, and “Writing Conclusions”.

This is esentially regexr for Rust.


Rustexp

 https://rustexp.lpil.uk/

Rust

Rust regulat expression editor and tester.


SandDance: Visualize Data

 https://microsoft.github.io/SandDance/

VS Code

SandDance is a tool to quickly visualize and explore data. It comes with a VS Code extension. SandDance provides a few toggles and visualization styles which makes experimentation easy.


Scrabble Word Finder

 https://www.crosswordsolver.com/scrabble-word-finder

Games

The website allows to search for valid scrabble word which can be made from the letters. It supports different dictionaries. The website is only for English scrabble.


Securityheaders

 https://securityheaders.com/

Scan a website for the HTTP headers returned and how good the security related headers are.


Shapecatcher

 http://shapecatcher.com/

Unicode

Shapecatcher looks up Unicode symbols based on a drawing of the symbol. It is conceptually similar to Detexify, but returns Unicode symbols instead of macros.


shelldoc

 https://github.com/endocode/shelldoc

Execute code block in Markdown files and test if they produce the expected outcome. This is similar to checking doctests using rustdoc.


Sherlock: Find usernames across social networks

 https://github.com/sherlock-project/sherlock

This tool searches through many services if they have a user with a given username. This can either be used to find usernames, which are still available on the important websites or to check for conflicting accounts.


snidump

 https://github.com/kontaxis/snidump

CTF | Networks

This is a tcpdump-like program for printing TLS SNI and HTTP/1.1 Host fields in live or captured traffic.


Snowman Decompiler

 https://derevenets.com/

Reverse Engineering

A standalone C decompiler. Also has an IDA plugin.

Supports ARM, x86, and x86-64 architectures. Reads ELF, Mach-O, and PE file formats.


Solve Crypto with Force!

 https://scwf.dima.ninja/

CTF

The website offers a large variety of crypto implementations which can be tested. It is helpful to solve unknown crypto challenges during CTFs. It is similar in concept to the CyberChef, but only for crypto.


SSLsplit - transparent SSL/TLS interception

 https://www.roe.ch/SSLsplit

Proxys | TLS

Simple TLS proxy.


Table Magic: Convert between table formats

 https://stevecat.net/table-magic/

The website can convert between different table formats. It supports CSV, Markdown, SQL, HTML. It is usefull when embedding CSV data into Markdown or similar.


Tables Generator

 https://www.tablesgenerator.com/

The website let's you create very customizable tables. It supports splitting and merging cells, customized lines around each cell, and coloring. The website supports LaTeX, HTML, and Markdown output.


Tcpdump advanced filters

 https://blog.wains.be/2007/2007-10-01-tcpdump-advanced-filters/

Cheatsheet | Networks | Tutorials

The website contains different tcpdump filters. It starts with basic filters and then builds up ever more complex ones. This is a good source for looking up complicated filters, if one does not want to write them themself.


traIXroute

 http://www.inspire.edu.gr/traIXroute/

IP | Networks

A traceroute like tool, that detects where a path crosses an IXP.


unfurl

 https://dfir.blog/unfurl/

The website allows to inspect encoded information in URLs, by parsing the URL with generic or specialized extractors. For example, it can decode the query parameters of Google searches and display what the different parameters mean.


Unicode Text Converter

 https://qaz.wtf/u/convert.cgi

Unicode

The tool converts an input string into different and sometimes obscure Unicode characters. It is usefull to generate funny looking text or to generate a new username, if the desired on is taken.

For example, the tool supports ⓒⓘⓡⓒⓛⓔⓓ, 𝖋𝖗𝖆𝖐𝖙𝖚𝖗, 🆂🆀🆄🅰🆁🅴🅳, ꜱᴍᴀʟʟ ᴄᴀᴩꜱ, ɐup 𝕠𝕥𝕙𝕖𝕣 wɘiᴙb options.


urlscan.io

 https://urlscan.io/

urlscan.io is a sandbox for URLs. The website generates a report for a URL to get a basic understanding about the network connections involved. The report includes a screenshot, the list of IP addresses and domains the website uses, and detected scripts.


vizAS

 https://stats.apnic.net/vizas/

Autonomous Systems | BGP | Networks | Datasets

vizAS by APNIC shows the connectiveness between different ASs split by countries. It is usefull to find the ASs which are most central in the graph.


 https://validator.w3.org/checklink

The W3C Link Checker crawls your website and reports broken or outdated links. The tool reports on broken links (e.g., 404), broken or missing websites, and links which should be updated to a new location.


WAND Active Measurement Project

 https://amp.wand.net.nz/

Autonomous Systems | Datasets | DNS | Networks

AMP is a system designed to continuously perform active network measurements between a mesh of specialist monitor machines, as well as to other targets of interest. These measurements are used to provide both a view of long-term network performance as well as to detect notable network events when they happen.

The project is run with a custom client and server software. The measurement results can be viewed on the website. It includes traceroutes, latencies (DNS, HTTP, ICMP, TCP), HTTP page sizes, and packet loss. The software is available as open source.


WebPlotDigitizer

 https://automeris.io/WebPlotDigitizer/

The WebPlotDigitizer is a tool to extract data from plots and images. It guides the user through annotating the image and setting some parameters (such as axis values). This allows the tool to extract the values from the chart. The tools allows many customizations to allow better tuning of the extraction process. WebPlotDigitizer also comes in a desktop version.


Wildcard DNS for IP Addresses

DNS | IP | Networks

These services allow you to create a domain name for any IP address. The IP address is encoded into the domain name. An overview over different services can be found here.

Online Services

  • https://nip.io/ provides IPv4 only

    • Supports both . and - separators.
    • 10.0.0.1.nip.io resolves to 10.0.0.1
    • 192-168-1-250.nip.io resolves to 192.168.1.250
    • customer1.app.10.0.0.1.nip.io resolves to 10.0.0.1
    • magic-127-0-0-1.nip.io resolves to 127.0.0.1
  • https://sslip.io/ provides IPv4 and IPv6

    • Supports both . and - separators.
    • Provides the ability to use the service with your own branding.
    • 192.168.0.1.sslip.io resolves to 192.168.0.1
    • 192-168-1-250.sslip.io resolves to 192.168.1.250
    • www.192-168-0-1.sslip.io resolves to 192.168.0.1
    • –1.sslip.io resolves to ::1
    • 2a01-4f8-c17-b8f--2.sslip.io resolves to 2a01:4f8:c17:b8f::2

Self-hosted Options

  • hipio is a Haskell service for IPv4.

wirediff

 https://github.com/aaptel/qtwirediff

Networks | PCAPs

WireDiff is a debugging tool to diff network traffic leveraging Wireshark.

Wirediff lets you open 2 network traces packets side-by-side. You can select a packet from each trace and diff their content at the protocol level you want.

A more thourough introduction is available in the APNIC blog: https://blog.apnic.net/2020/07/01/wirediff-a-new-tool-to-diff-network-captures/.


Yahtzee Position Scorer

 http://www-set.win.tue.nl/~wstomv/misc/yahtzee/osyp.php

Games

The Yahtzee position scorer takes the currently filled out values and dice roll and suggests the likely outcome of different game moves.


Yarrp: Yelling at Random Routers Progressively

 https://www.cmand.org/yarrp/

IP | Networks

Yarrp is a active network topology discovery tool. It's goal is to identify router interfaces and interconnections on internet scale. Conceptually this is similar to running many traceroutes and stiching them together into one view. However, traceroutes are designed to understand the connection between two hosts and do not scale easily.


zesplot: IPv6 Visualisation

 https://github.com/zesplot/zesplot

IP

zesplot is an IPv6 visualization tool. It turns a list of IP addresses into a picture, for example as a heatmap representation. It works based on squarified treemaps, since the IPv4 way of space filling curves works poorly for such a sparse space.


Ziggy: the RPKI Wayback Machine

 https://github.com/NLnetLabs/ziggy

Networks | RPKI

Ziggy is a tool to inspect the RPKI ecosystem at arbitrary points in the past. It is developed by NlNetLabs. More details abouut the ziggy tool can be found in the announcement blogpost.


ZMap Project

 https://zmap.io/

DNS | IP | Networks

Different utilities for network scanning. Most imporantly the zmap component, which is a packet scanner for different protocols. It also contains other tools like ways to iterate over the IPv4 address space and blacklist/whitelist management.