The AMP-Research project collects information about amplification vectors in protocols including reproduction possibilities. For each vector the port and protocol are listed, as well as, the amplification factor. A scanning script or payload for scanning with zmap is included too.
angr is a python framework for analyzing binaries. It combines both static and dynamic symbolic ("concolic") analysis, making it applicable to a variety of tasks.
This tool allows you to easily clean the LaTeX code of your paper to submit to arXiv. For example, it removes comments and optimizes images.
Watch Arxiv-papers on as a website.
Test the quality of a client's SSL/TLS stack. The website shows sites which should fail or pass. Sites which fail but do not on the browser viewing are a risiko.
The website lets you search for the cheapest train connection between two cities. It shows the cheapest trip per day and shows the different prices during a single day.
There are various pagers which are more suitable or user friendly than the basic pagers like
bat is an advanced pager, supporting usability features. It comes with syntax highlighting out of the box. It also integrates with git and shows the lines added and removed for a file.
pspg is an advanced pager for usage with psql. It shows the data in table form, allows scrolling through the columns and rows. You can pin header or initial columns, such that they do not move while scrolling around. It supports many different color schemes.
BGPlay shows a graph of the observed BGP routes. It allows replaying historical BGP announcements and displays route changes.
An open-source software framework for live and historical BGP data analysis, supporting scientific research, operational monitoring, and post-event analysis.
BGP streams are freely accesible and provided by Route View, RIPE, and BGPmon.
The cloud version of binary ninja allows free reversing in the cloud. It has a real-time collaboration feature.
Binary Refinery is a collection of Python scripts for transforming data. It is similar in concept to CyberChef but runs locally. For example, Binary Refinery support base64 or hex transformations, hash data, or pack values into binary.
IDA plugin for comparing binaries. Allows to label unkown binaries with annotations from a different IDA database.
Binwalk is a binary file analysis tool. It works by traversing a file and looking for potentially embedded files. These embedded files can also be extraced.
caniuse.rs shows which library functions where stabilized in which Rust version.
Convert the gibberish of C declarations into English and back. The website uses the Clockwise/Spiral Rule to convert between them.
The website allows to execute DNS queries from various locations worldwide to check the returned values.
The website helps in selecting a colorscheme for a map. It provides different presets and shows live how they would look on different maps.
C-DNS is a space efficient file format for storing DNS traffic. It is based on CBOR with a fixed schema as defined in RFC 8618.
Some tools exists to work with C-DNS files. The dns-stats compactor can convert pcap-to-cdns and vice versa. It can be configured flexibly to only record those fields of the DNS message which are of interest, thus saving space in the compacted format.
Desugar C++ code and show how modern C++ features are implemented. This helps in understanding the details of C++ and how modern compilers implement the language standard.
CInsects is a German CTF team. They collect resources of tool, tutorials, and documentation around CTF tools and exploitation.
The CyberChef is a website which provides many recipes and makes it easy to combine them. The recipes are small input/output steps, similar to UNIX tools, and cover a large area of topics, like data formats, encoding, encryption, networking, hashing, compression, etc. The main use case is making it easier in CTFs to chain simple operations together like processing encoded text.
The Dataset Search by Google is a search engine explicitly for datasets. Supported datasets need to be tagged with a special markup, which allows the search to provide more usefull results. This also limits the search engine, since not all datasets will be appropiatly marked.
Debin is a tool to predict the debug information of stripped binaries. It only works relyable with C programs, as this is the only dataset it was trained on. It might be useful to use the website for jeopardy CTFs.
Depix allows to revert pixelization and recover the original text. It works for pixelized images created using linear box filters. The recovery process is not always perfect, but good enough to produce readable text.
deps.dev is a dependency analyzer for multiple language ecosystems (npm, Go modules, Maven, PyPI, Cargo). It shows basic information, such as the metadata (including license) about each package, dependencies, and reverse dependencies. It enhances these information by adding a diff viewer for the versions. Security advisories affecting a package or dependency are highlighted. The OpenSSF scorecard is also integrated, showing more insights about the project health.
The second feature of the website is an advisory viewer. It shows details about each advisory, including affected versions. It also calculates how much of the ecosystem is affected and patched.
Detexify helps in writing complex LaTeX symbols, similar to Shapecatcher for Unicode. It searches for the correct LaTeX macros based on a drawing of the shape the users wants. It is a better way to search for symbols instead of going through the symbols-a4.pdf manually.
The website lets you create polls, which are intended to be used live in front of a large audience. The presenter can configure the poll, select display options, and mark correct answers.
During the presentation, the presenter has a view, which shows the live results of the poll. The audience can join the polls and vote on them live. The results are completly anonymous.
It can be a great tool for interactive PowerPoint presentations, for lectures, or generally for trivia events.
DMAP is a scalable web scanning suit which supports DNS, HTTPS, TLS, and SMTP. It works based on domain names and crawls the domain for all supported protocols. The advantage over other tools is the unified SQL data model with 166 features and the easy scalability over many crawling machines.
Browser-based DNS resolver quality measurement tool. Uses the browser to generate many resolver queries and tests for features they should have, such as EDNS support, IPv6, QNAME Minimisation, etc.
This test is also available as a CLI tool: https://github.com/DNS-OARC/cmdns-cli
Analyze DNSSEC deployment for a zone and show errors in the configuration.
Gives an overview over DNSSEC delegations, response sizes, and name servers.
The website has an online test, which performs DNS lookups. These DNS lookups test if certain resource records are overwritten in the cache. The tool can then determine what DNS software is used, where the server is located, how many caches there are, etc.
Test name server of zones for correct EDNS support.
Shows the trust dependencies in DNS. Given a domain name it can show how zones delegate to each other and why. The delegation is done between IP addresses and zones.
The project used to monitor the first root KSK key rollover. Now it contains the paper "Roll, Roll, Roll your Root: A Comprehensive Analysis of the FirstEver DNSSEC Root KSK Rollover" describing the experiences of the first root KSK rollover
Additionally, it includes a tester for DNSSEC algorithm support, which shows the algorithms supported by the currently used recursive resolver. It provides statistics about support for DNSSEC algorithms. It has a web based test to test your own resolver and provides a live monitoring using the RIPA Atlas.
Tool to replay DNS queries captured in a pcap file with accurate timing between queries. Allows modifying the replay like changing IP addresses, speed up or slow down the queries.
DNS network capture utility. Similar in concept to tcpdump, but with specialized options for DNS.
dnsdumpster.com fetches a lot of DNS information belonging to one domain. It checks the authorative name servers, which records exist, and where the servers are located.
This is a custom DNS server which allows setting and retrieving text based data.
New values can be written as subdomains and retrieved via a normal
dig my-value.my-key.dnskv.com txt +short
dig my-key.dnskv.com txt +short
The service provides many extra options like setting an expiry time or the TTL.
DNS performance measurement tools.
dnsteal provides a fake DNS server and encodes a file into a series of DNS requests. The fake DNS server then reassembles the file. This can be used to hide the file exfiltration as DNS traffic, however, since it doesn't use the default DNS server it is quite noisy.
Top-like utility showing information about captured DNS requests. It shows information about the domains queries, the types, and responses.
Driftnet watches network traffic, and picks out and displays JPEG and GIF images for display.
This is an improvement on Paris traceroute and the classical traceroute. It can detect changing routes and detect NATs along the path.
https://transfer.sh/ allows uploading from the command line and the browser. Files can be up to 10 GB and be stored up to 14 days. It allows limiting the number of downloads.
$ curl --upload-file ./hello.txt https://transfer.sh/hello.txt https://transfer.sh/66nb8/hello.txt
$ curl -H "Max-Downloads: 1" -H "Max-Days: 5" --upload-file ./hello.txt https://transfer.sh/hello.txt https://transfer.sh/66nb8/hello.txt ```
https://instant.io/ share and receive files using WebTorrent.
The Entropy/IP algorithm allows for inspecting and generating IPv6 addresses. Entropy/IP can determine the entropy of different nibbles and relationship between different components. Based on this analysis it can also create valid-looking IPv6 addresses.
Evcxr is a Rust interpreter and also provides a Jupyter kernel. This is a helpfull addition to the online playground as it allows installing and using any crate.
explainshell does what the name suggest: it explains shell commands. It allows to write a shell command and it expains what the program is doing, the meaning of the command line flags, and how the pipeing between different programs works.
FD.io is a very fast userspace networking library, which allows to create programs for packet processing. While DPDK allows fast read and write access to the NICs, FD.io is foccussed on processing the packets. Possible use cases are a packet forwarder, implementing a NAT, or a VPN.
More details also in this APNIC blogpost: https://blog.apnic.net/2020/04/17/kernel-bypass-networking-with-fd-io-and-vpp/
Flamethrower is a small, fast, configurable tool for functional testing, benchmarking, and stress testing DNS servers and networks. It supports IPv4, IPv6, UDP, TCP, DoT, and DoH and has a modular system for generating queries used in the tests.
The Float Toy website allows to interactively explore IEEE floating-point numbers. It shows 16, 32, and 64 variants. It allows flipping individual bit and visualizes the result. The meaning of the bits is also shown and color-coded.
Ghidra software reverse engineering (SRE) framework and IDA Pro alternative.
GNU poke is an interactive, extensible editor for binary data. Not limited to editing basic entities such as bits and bytes, it provides a full-fledged procedural, interactive programming language designed to describe data structures and to operate on them.
poke comes which a online manual and also has a quick start guide.
The Godbolt compiler explorer allows the user to compile a function and see the corresponding assembly code. It can highlight matching parts in the language and assembly, making it easy to understand how individual expressions are compiled. It supports common languages like C, C++, Go, Rust. It can also work with assembler and LLVM IR.
Another nice feature is, that it can show statistics about assembler code, like needed cycles, instructions, and which resources the instructions need. This uses the LLVM Machine Code Analyzer.
THE reverse engineering tool.
The online Image Metadata Viewer shows the EXIF information from uploaded files or files by URL. It supports a wide range of metadata, such as XMP, EXIF, IPTC, and MakerNotes.
iodine allows to tunnel IPv4 traffic through a DNS server. This can be used if network access is restricted, but DNS is unfiltered, for example in when a captive portal is deployed.
IP geolocation services feeding itself from geolocation databases, user provided locations, and most importantly active RTT measurements based on the RIPE Atlas system. It also provides a nice API to query the location. It provides a breakdown on where the results stem from and how much they contribute to the overall result.
The IPv4 heatmap tool draws an image of active IPv4 addresses. The IP addresses are mapped to pixels useing a Hilbert curve or a Z-curve. The image can be extended with annotations about the address space, for example to show which regional internet registry is assigned to the address.
John the Ripper is THE tool to brute force passwords and password hashes. It is very fast in calculating hashes with support of GPU acceleration and supports a wide range of different hash formats.
This is a custom DNS server which allows setting and retrieving text based data.
New values can be written as subdomains and retrieved via a normal
dig @ns.sslip.io put.my-value.my-key.k-v.io txt +short
dig @ns.sslip.io my-key.k-v.io txt +short
dig @ns.sslip.io delete.my-key.k-v.io txt +short
These websites provide tools, which convert JSON data to structs in different programming languages.
These websites provide different features to analyse binaries and especially malware. They provide searching by file hashes or by uploading the binary.
Some of the services provide more detailed analyses, such as as which files were access or snapshots of any windows opened.
These projects either operate DNS based Real-time Blackhole Lists (RBL) or allow checking if an IP is contained. The Multi-RBL websites are helpful in finding a large quantity of RBLs.
"mess with dns" is a tool which allows you to experiment with DNS. The website allows creation of resource records of many types. They are all within a custom 3rd level domain. The website also shows the DNS requests the authoritative DNS server received.
The mini internet project is part of the curiculum by the Networked Systems Group of ETH Zurich. It teaches the students the basic steps how to create a mini internet. It starts with the basics of intra-network routing, by setting up multiple L2 switches. Then the students have to configure L3 routers to connect multiple L2 sites together. Lastly, in a big hackathon style, the students need to connect their local network with the network of the other students, by properly configuring BGP routers and setting up routing policies.
The code and the tasks are all available in the GitHub repository.
The APNIC Blog has a nice introduction to the project too.
Proxy framework for performing MitM attacks/transformations. Provides a Python APi for scriptability
Website quality measurement tool. The website measures the quality of HTTP headers which improve security. Additionally, it provides inspections for the TLS certificate and SSH servers. It also includes many third party tools.
Create variable TLS configurations for all major webservers. It is specialized for each webserver and server version. The configurations supports different TLS configurations, depending on the needed support for old clients.
Multi-level MDA-Lite Paris Traceroute is a traceroute tool, which understands and learns more complex network topologies. Often times the network is not just a line, but multiple paths are possible and chosen at random.
This website measures support for NAT64 in other websites.
The Netlab of 360.com provides some open data streams.
One dataset concerns the number of abused reflectors per protocol.
Overview over IP addresses scanning the internet and which ports are scanned.
A free and configurable DNS resolver. It provides customizable blocking, such as for ads, trackers, or malicious websites. Additionally, statistics can be shown, such as for most blocked website.
A similar self-hosted variant is Pi-hole.
The nPrint project is a collection of open source software and benchmarks for network traffic analysis that aim to replace the built-to-task approach currently taken when examining traffic analysis tasks.
A tool to find the one gadget in libc.
It list all gadgets leading to
execve('/bin/sh', NULL, NULL) including their preconditions.
Website allowing assembly and disassembly of x86 and x64 code.
The online disassembler can disassemble a wide range of binary formats and platforms. It can disassemble free-standing bytes too. It provides a disassembly view, a graph view, a symbols and a function viewer.
OpenWPM is a web privacy measurement framework which makes it easy to collect data for privacy studies on a scale of thousands to millions of websites. OpenWPM is built on top of Firefox, with automation provided by Selenium. It includes several hooks for data collection. Check out the instrumentation section below for more details.
osquery exposes an operating system as a high-performance relational database. This allows you to write SQL-based queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.
Over The Wire provides with the wargames many different challenges, to learn exploitations of different things. There are different wargames based on skill and required tooling. In each level the user has to retrieve a flag to procede to the next level.
The OWASP Amass tool suite obtains subdomain names by scraping data sources, recursive brute forcing, crawling web archives, permuting/altering names and reverse DNS sweeping. Additionally, Amass uses the IP addresses obtained during resolution to discover associated netblocks and ASNs. All the information is then used to build maps of the target networks.
packetqis a command line tool to run SQL queries directly on PCAP files, the results can be outputted as JSON (default), formatted/compact CSV and XML. It also contain a very simplistic web-server in order to inspect PCAP files remotely,
This is an improvement on the traditional traceroute program. It is able to detect multiple distinct routes and display them accordingly. The classical traceroute would produce weird results on changing network routes.
Another similar program is Dublin traceroute.
pdfpc is a tool enabling a presenter mode for presenting PDF files. The presenter mode contains the usual features known from Powerpoint/Libreoffice:
pdfpc is especially adapted to present LaTeX presentations, which otherwise do not have a presenter mode.
pdoc is a Python API documentation generation, which turns doc-strings and type annotations into a simple and elegant documentation.
pdoc auto-generates API documentation that follows your project's Python module hierarchy. It requires no configuration, has first-class support for type annotations, cross-links between identifiers, comes with an integrated live-reloading web server, uses customizable HTML templates, understands numpydoc and Google-style docstrings, and is permissively licensed.
PEERING is an environment where researchers and educators can play with BGP announcements in a real but sandboxed environment.
Description from the website:
The long-term goal of the PEERING system is to enable on-demand, safe, and controlled access to the Internet routing ecosystem for researchers and educators:
A free and configurable DNS stub-resolver. It provides customizable blocking, such as for ads, trackers, or malicious websites. Additionally, statistics can be shown, such as for most blocked website.
It can also function as a DHCP server for clients on the same network.
A similar service is NextDNS.
Play with Docker is a Docker playground which allows users to run Docker commands in a matter of seconds. It gives the experience of having a free Alpine Linux Virtual Machine in browser, where you can build and run Docker containers and even create clusters in Docker Swarm Mode. Under the hood Docker-in-Docker (DinD) is used to give the effect of multiple VMs/PCs. In addition to the playground, PWD also includes a training site composed of a large set of Docker labs and quizzes from beginner to advanced level available at training.play-with-docker.com.
The website takes a Postgres Explain output and displays it as a more readable graph.
The website takes a Postgres Explain output and displays it more readable and highlights the important parts.
preeny helps pwning binaries by disabling many annoying functions such as
It does so by providing different
LDPRELOAD-able libraries for those library functions.
pwntools is one of THE Python tools needed during a CTF. It is useful for both jeopardy and attack-defense CTFs. It provides common abstractions, like connecting to a local or remote program and simplifying I/O. Addtionally, it provides helpers for many exploitation techniques, such as ROP, shellcode, and leaking memory.
pyNTM allows to create a network with circuits between layer 3 nodes. This model then allows to simulate and evaluate how traffic will traverse the topology. This can be used to test different network topologies and fail over scenarios.
Test the quality of a server's or a client's SSL/TLS stack.
Very useful to test a server.
A-F rating scheme and shows vulnerabilities and weak protocols/cipher suites.
Rappel is a pretty janky assembly REPL. It works by creating a shell ELF, starting it under ptrace, then continiously rewriting/running the
.textsection, while showing the register states. It's maybe half done right now, and supports Linux x86, amd64, armv7 (no thumb), and armv8 at the moment.
The website provides an automatic generator for regex patterns by learning from sample sentences. The website requires entering as many sample sentences with as many matching positions as possible. These datasets can also be imported and exported, such that they can be refined over time.
regexr helps in understanding and writing regular expressions (RegEx). It takes a RegEx and explains the different parts of it. It also shows how the RegEx applies to a sample text.
Additionally, it contains a RegEx reference as well as a user supplied library of different RegExs.
This repo describes a testbed to test various DNS resolvers. The purpose of the testbed is to allow researchers to set up many resolvers and run tests on each. For example, a test might see what the resolver emits when it is priming, or when it is responding to a particular query while using DNSSEC validation.
DNS responses gathering and differences analysis toolchain.
A standalone decompiler build and managed by Avast. Works as a standalone program, has a trial version on the website, and there is an IDA Plugin.
Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code. Supported architectures (32b only): Intel x86, ARM, MIPS, PIC32, and PowerPC.
RIPEstat is a network statistics platform by RIPE. The platform shows data for IP addresses, networks, ASNs, and DNS names. This includes information such as the registration information, abuse contacts, blocklist status, BGP information, geolocation lookups, or reverse DNS names. Additionally, the website links to many other useful tools, such as an address space hierarchy viewer, historical whois information, and routing consistency checks.
Overview page for the DNS root servers. It contains links to general news and all the supporting organizations.
The website features a map with all geographic locations. It contains information about locations, IPv4/IPv6 reachability and IP addresses.
Each root server has its own subdomain in the form of http://a.root-servers.org. It contains access to historical performance data like:
Different information regarding reachability and connectiveness of ASs.
These websites allow you to browser the valid RPKI announcements. They show which address ranges are covered by RPKI and who the issuing authority is.
Website, which tests, if your provider filters invalid announcements using RPKI.
The RsaCtfTool is a tool supporting working with RSA keys. The main focus lies in a wide range of known attacks which are implemented and easy to use with it. This makes it suitable for CTFs, especially Jeopardies.
Sometimes it is necessary to run Docker containers for a different CPU architecture.
This Docker containers makes it possible to run other Docker containers with a different architecture.
It works by using
binfmt_misc, a Linux kernel feature to run files with interpreters, and installs qemu binaries for different architectures.
Helps in understanding macro_rules macros by automatically generating syntax diagrams for them.
The Academic Phrasebank is a general resource for academic writers. It aims to provide you with examples of some of the phraseological ‘nuts and bolts’ of writing organised according to the main sections of a research paper or dissertation.
The data bank contains the categories “Introducing Work”, “Referring to Sources”, “Describing Methods”, “Reporting Results”, “Discussing Findings”, and “Writing Conclusions”.
This is esentially regexr for Rust.
Rust regulat expression editor and tester.
SandDance is a tool to quickly visualize and explore data. It comes with a VS Code extension. SandDance provides a few toggles and visualization styles which makes experimentation easy.
The website allows to search for valid scrabble word which can be made from the letters. It supports different dictionaries. The website is only for English scrabble.
Scan a website for the HTTP headers returned and how good the security related headers are.
Shapecatcher looks up Unicode symbols based on a drawing of the symbol. It is conceptually similar to Detexify, but returns Unicode symbols instead of macros.
Execute code block in Markdown files and test if they produce the expected outcome. This is similar to checking doctests using rustdoc.
This tool searches through many services if they have a user with a given username. This can either be used to find usernames, which are still available on the important websites or to check for conflicting accounts.
This is a tcpdump-like program for printing TLS SNI and HTTP/1.1 Host fields in live or captured traffic.
A standalone C decompiler. Also has an IDA plugin.
Supports ARM, x86, and x86-64 architectures. Reads ELF, Mach-O, and PE file formats.
The website offers a large variety of crypto implementations which can be tested. It is helpful to solve unknown crypto challenges during CTFs. It is similar in concept to the CyberChef, but only for crypto.
Simple TLS proxy.
The website can convert between different table formats. It supports CSV, Markdown, SQL, HTML. It is usefull when embedding CSV data into Markdown or similar.
The website let's you create very customizable tables. It supports splitting and merging cells, customized lines around each cell, and coloring. The website supports LaTeX, HTML, and Markdown output.
The website contains different
It starts with basic filters and then builds up ever more complex ones.
This is a good source for looking up complicated filters, if one does not want to write them themself.
A traceroute like tool, that detects where a path crosses an IXP.
The website allows to inspect encoded information in URLs, by parsing the URL with generic or specialized extractors. For example, it can decode the query parameters of Google searches and display what the different parameters mean.
The tool converts an input string into different and sometimes obscure Unicode characters. It is usefull to generate funny looking text or to generate a new username, if the desired on is taken.
For example, the tool supports ⓒⓘⓡⓒⓛⓔⓓ, 𝖋𝖗𝖆𝖐𝖙𝖚𝖗, 🆂🆀🆄🅰🆁🅴🅳, ꜱᴍᴀʟʟ ᴄᴀᴩꜱ, ɐup 𝕠𝕥𝕙𝕖𝕣 wɘiᴙb options.
urlscan.io is a sandbox for URLs. The website generates a report for a URL to get a basic understanding about the network connections involved. The report includes a screenshot, the list of IP addresses and domains the website uses, and detected scripts.
vizAS by APNIC shows the connectiveness between different ASs split by countries. It is usefull to find the ASs which are most central in the graph.
The W3C Link Checker crawls your website and reports broken or outdated links. The tool reports on broken links (e.g., 404), broken or missing websites, and links which should be updated to a new location.
AMP is a system designed to continuously perform active network measurements between a mesh of specialist monitor machines, as well as to other targets of interest. These measurements are used to provide both a view of long-term network performance as well as to detect notable network events when they happen.
The project is run with a custom client and server software. The measurement results can be viewed on the website. It includes traceroutes, latencies (DNS, HTTP, ICMP, TCP), HTTP page sizes, and packet loss. The software is available as open source.
The WebPlotDigitizer is a tool to extract data from plots and images. It guides the user through annotating the image and setting some parameters (such as axis values). This allows the tool to extract the values from the chart. The tools allows many customizations to allow better tuning of the extraction process. WebPlotDigitizer also comes in a desktop version.
These services allow you to create a domain name for any IP address. The IP address is encoded into the domain name. An overview over different services can be found here.
https://nip.io/ provides IPv4 only
https://sslip.io/ provides IPv4 and IPv6
WireDiff is a debugging tool to diff network traffic leveraging Wireshark.
Wirediff lets you open 2 network traces packets side-by-side. You can select a packet from each trace and diff their content at the protocol level you want.
A more thourough introduction is available in the APNIC blog: https://blog.apnic.net/2020/07/01/wirediff-a-new-tool-to-diff-network-captures/.
The Yahtzee position scorer takes the currently filled out values and dice roll and suggests the likely outcome of different game moves.
Yarrp is a active network topology discovery tool. It's goal is to identify router interfaces and interconnections on internet scale. Conceptually this is similar to running many traceroutes and stiching them together into one view. However, traceroutes are designed to understand the connection between two hosts and do not scale easily.
zesplot is an IPv6 visualization tool. It turns a list of IP addresses into a picture, for example as a heatmap representation. It works based on squarified treemaps, since the IPv4 way of space filling curves works poorly for such a sparse space.
Ziggy is a tool to inspect the RPKI ecosystem at arbitrary points in the past. It is developed by NlNetLabs. More details abouut the ziggy tool can be found in the announcement blogpost.
Different utilities for network scanning. Most imporantly the zmap component, which is a packet scanner for different protocols. It also contains other tools like ways to iterate over the IPv4 address space and blacklist/whitelist management.