Links

Landing zone for all things, loosely categorized!

API Tools

  • Bruno : Fantastic API testing and dev tool
  • Insomnia : Formerly a fantastic API testing and dev tool. Not so good anymore :(
  • Paw : Mac-only API tool
  • docker-http-https-echo : A nice http and https echo server. Dockerized and ready to roll.

Artificial Intelligence / Machine Learning

Agentic AI

  • AI Agent RnD : Research page on AI Agents
  • Langroid : An intuitive, lightweight, extensible and principled Python framework to easily build LLM-powered applications
  • monoid : Build AI Agents directly on top of your APIs
  • Open Agents
  • Agentic Engineering: Outstanding book by Jaymin West
  • Overstory : Multi-agent orchestration for AI coding agents — pluggable runtime adapters for Claude Code, Pi, and more. TypeScript.
  • Gastown : Multi-agent workspace manager
  • Building a Multi-Agent System : A Google tutorial on rolling your own multi-agent system
  • The Code Agent Orchestra - what makes multi-agent coding work : Nice blog post (with tools) from Addy Osmani about multi-agent workflows
  • SkillOpt : Microsoft text-space optimizer that “trains” reusable natural-language agent skills — epochs, batch sizes, validation gates — without touching model weights, emitting deployable best_skill.md artifacts
  • termany : Agent-Native Terminal
  • ponytail : Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote
  • archify : Agent skill for beautiful, verifiable architecture, workflow, sequence, data-flow, and lifecycle diagrams — self-contained HTML with motion and crisp export
  • paseo : Orchestrate multiple coding agents from desktop and mobile
  • vorteo : Custom Paseo fork that adds container sandboxing, frontier account pooling, profiles, server-managed message queues, goal direction, and private cross-device access
  • aubtown : Lightweight, opinionated software factory. Uses GitHub Issues and OpenAI Codex
  • vorton : Visual control plane for AI operating systems and software factories — goals, tasks, councils, and tools to build your own personal apps (replaces vorton-cloud)
  • athena-graphs : Agent-native graph orchestration for Codex, Claude, and skill-compatible agents
  • common-sense : A baseline reasoning skill that helps AI agents understand user intent and apply practical judgment
  • PhanOS : Automated project operating system — Phanes orchestrator, Cyphor documentation/context/tooling substrate, and Blueprompt
  • opencode-auto-provider-models : OpenCode plugin that auto-syncs models for an OpenAI-compatible provider
  • harness-terminal : Native macOS terminal that keeps your sessions running and tells you when a coding agent needs you. GPU-rendered, scriptable, agent-aware
  • lean-ctx : LeanCTX — Context Intelligence for AI systems. Rust
  • headroom : Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. Library, proxy, and MCP server
  • ax : Google’s open agentic orchestration runtime. Go
  • axe : Lightweight CLI for running single-purpose AI agents. Define focused agents in TOML and trigger them from pipes, git hooks, cron, or the terminal. Go
  • openharness : Command center for coding agents across all your machines; extends beyond code into CAD, circuits, robots, games and music
  • agent-beacon : Cross-harness, self-improving memory layer for AI agents. Go
  • agentgateway : Agentic proxy for AI agents and MCP servers. Rust
  • AEVS-sdk : Transparent audit SDK for AI agents
  • classcad-ai : Agent skill for the ClassCAD headless CAD engine — verified API references that help AI agents generate correct ClassCAD code

General

  • AIPRM : ChatGPT prompt management
  • Haystack : End-to-end framework that enables you to build powerful and production-ready pipelines for different search use cases
  • HuggingFace : My profile on HuggingFace
  • Midjourney : Incredible AI-generated art
  • Poe : Multi-chatbot interface
  • SudoLang : LLM modeling language
  • fabric : open-source framework for augmenting humans using AI
  • n8n.io : Automation software
  • Hands-On AI Engineering : Curated collection of practical AI projects — OCR, RAG, agents, and more
  • axolotl : LLM fine-tuning
  • deepmark : Enables a unique testing environment for language models (LLM) assessment on task-specific metrics and on your own data
  • LM Studio : Excellent LLM IDE/Workbench. Integrates with HuggingFace. Provides API
  • ollama : A toolkit for working with LLMs. Bindings for Python and JS.
  • OWASP LLM Top 10 : Top vulnerabilities for LLMs. See the 2025 report.
  • laya-mlx : Native MLX runtime for Laya typed decision models — 7–14 ms short decisions on M3 Max. No text generation, PyTorch, or cloud API
  • distributed-llama : Distributed LLM inference. Connect home devices into a powerful cluster to accelerate LLM inference
  • prima.cpp : Scale your local AI beyond one device
  • SemIf-OpenJev : Semantic ifs from open models, on a 3090 at home
  • jevlike : Train a small model that chooses among a changing list of text options — a Jev-like option-scoring starter model
  • jevify : Prompts to jev-ify your projects
  • laya : Non-autoregressive “System 1” decision engine — typed choice, score, and yes/no decisions over text in a single forward pass, in 100+ languages
  • strands-decider : Small, fast decision model for agentic workflows — pick between options or rate on a scale, with a calibrated confidence on every decision
  • FreeToken : Datacenter-scale model serving on your desktop. Run massive models locally, fast and efficiently
  • pulsar : SSD-streaming inference engine for giant MoE models (Rust + CUDA). Zero-config multi-GPU
  • LiveBench : A challenging, contamination-free LLM benchmark
  • colibri : Run frontier MoE models on hardware you already own — pure C, zero deps, experts streamed from disk
  • Rapid-MLX : Fast local AI engine for Apple Silicon. Drop-in OpenAI replacement; works with Claude Code, Cursor, Aider
  • omlx : LLM inference server with continuous batching & SSD caching for Apple Silicon — managed from the macOS menu bar
  • ds4 : antirez’s local inference engine for DeepSeek 4 Flash and Pro on Metal, CUDA and ROCm. C
  • TensorFold : LLM inference engine for Metal, CUDA and Vulkan
  • Strata : One-click Qwen3.8-Flash-Next on consumer hardware (Windows / Linux), with an OpenAI/Anthropic-compatible API on localhost
  • Edge0 : Run 35B MoE models in ~2.5 GB of RAM by streaming weights from SSD, with a trained router that predicts loads a step ahead
  • DeepSeek-V4.1-Flash-Two-Sparks : DeepSeek-V4.1-Flash across two DGX Sparks — 262k context, vision, and tools
  • deepseek-v41-mlx-three-mac : Original-weight DeepSeek V4.1 Flash on three M5 Max Macs over Thunderbolt RDMA, with measured benchmarks
  • instructor : Structured outputs for LLMs
  • litellm : AI gateway — call 100+ LLM APIs in OpenAI (or native) format with cost tracking, guardrails, load balancing, and logging
  • outlines : Structured outputs for LLMs
  • dspy : The framework for programming—not prompting—language models
  • langfuse : Open source agent evals & observability — trace, evaluate, and improve LLM applications with one platform

AI Cyber Security

  • Arsenal : CALDERA plugin for adversary emulation of AI-enabled systems
  • MITRE ATLAS: ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) is a globally accessible, living knowledge base of adversary tactics and techniques against AI-enabled systems based on real-world attack observations and realistic demonstrations from AI red teams and security groups.
  • MITRE ATLAS Data : Datasets and code from the MITRE ATLAS project
  • AthenaBench : A dynamic benchmark for evaluating LLMs in cyber threat intelligence (WAITI 2025)
  • CTIBench : NeurIPS’24 benchmark for evaluating LLMs in cyber threat intelligence
  • Claude-BugHunter : Claude Code skill bundle for bug hunting and external red-team work — 82 skills, 15 slash commands, 681 disclosed-report patterns across 24 vulnerability classes
  • T3MP3ST : Autonomous red-teaming platform; multi-agent offensive-security meta-harness
  • DeepTeam : Framework to red team LLMs and AI agents
  • Zurp : Meta’s agent-driven tooling for vetted Meta Bug Bounty researchers

AI Agent Tools

  • Keep : AI managed alerts and logs
  • warren : AI-native security alert management — LLM agents that automate SOC triage and investigation, with Slack and threat-intel orchestration

Machine Learning

  • ML Ops : An end-to-end machine learning development process to design, build and manage reproducible, testable, and evolvable ML-powered software.
  • F-LMM : CVPR2025 — Grounding Frozen Large Multimodal Models
  • gamma-models : Generative Temporal Difference Learning for Infinite-Horizon Prediction
  • FaceAnything : 4D Face Reconstruction from Any Image Sequence (ECCV 2026)
  • Chandassu : Python library for analyzing metrical poetry across languages

Asset Management

  • osquery : A SQL-powered operating system instrumentation, monitoring, and analytics framework.

Authentication

  • Auth0 : Best in class Authentication as a service. Great value!
  • jwt.io : Fantastic JWT inspector
  • jwt builder : Web-based tool for constructing custom JWTs. Great for learning.
  • JWT Inspector : Chrome extension to harvest and inspect JWTs

Blockchain

Cloud

  • Cartography : Cartography is a Python tool that consolidates infrastructure assets and the relationships between them in an intuitive graph view powered by a Neo4j database.
  • Cascade: Key/Value API for data manipulation in distributed memory and persistent storage. Very fast. C++
  • CloudCraft : Visualize your cloud infra automatically via introspection. AWS, GCP, Azure, more
  • LocalStack : Fully functional cloud stack (AWS)
  • stackd : Local AWS emulator with AWS-compatible HTTP APIs, optional SQLite persistence, and real compute/database backends. Under active development. Go
  • minio : A High Performance Object Storage for Cloud Storage and Kubernetes
  • rclone : Clone data from Cloud Storage X to Cloud Storage Y. Supports Google GCS, AWS S3, Azure, and more!
  • Cloudflare R2 : Object storage for all your data
  • FluxCloud : Web3 compute and storage
  • Akash Network : Decentralized compute marketplace

Cloud Filesystems

  • s3ql : A full featured file system for online data storage. Backed by S3, GCP, Azure… Supports end-to-end encryption and many other features
  • SeaweedFS : SeaweedFS is a fast distributed storage system for blobs, objects, files, and data lake, for billions of files!

Google Cloud Platform

Google Cloud Public Certs

Console Tools

Google Cloud Forum

Google Issue Trackers

Coding

Diff Tools

  • Meld : Meld Diff Tool

Go Tools

VSCode & Extensions

  • VSCode : Fantastic, portable, and fast IDE – supports most languages.
  • Tab Groups : Save open tabs as a group

Code Signing

Coding Support

CI/CD

Packer

  • Packer Documentation : Packer lets you create identical machine images for multiple platforms from a single source configuration

Collaboration

  • Miro: Amazing whiteboarding and collaboration tool
  • Whimsical : Excellent graphical diagramming tool, rivals Visio, insanely collaborative

Communications

  • Element : Open-source chat, video, file sharing (formerly Riot)
  • Matrix : An open-source standard for communications
  • signal-headless : Headless Signal linked device. Go

Cryptography

Cybersecurity

Continuous Attack Surface Management (CASM)

  • Axonius: Connects to hundreds of data sources; comprehensive inventory, uncovers gaps, and triggers automated response actions whenever devices, users, and SaaS apps deviate from policies, controls, and expectations.
  • JupiterOne : A centralized view of your cyber assets; Cyber Asset Attack Surface Management, Cloud Security Posture, Security Operations, and Compliance.

Cyber Intel

  • AlienVault : Open Threat Intel
  • GreyNoise : Identify internet noise and attacks
  • Talos Intelligence : IP Info and threats by Cisco
  • VirusTotal : Full feature file scanner, ip and url info
  • ThreatDome : CTI platform specialized for ICS and IoT (formerly cyberIntelMatrix)
  • IpInfo : best in class ip enrichment for geolocation, company, RDNS, Whois, etc
  • ip2location : IP geolocation. Generous free tier
  • ipapi.is : Solid ip enrichment for geolocation and more. Generous free tier and API.
  • db-ip : Another good ip enrichment for geolocation. Creative commons, commercial-ready free-tier.
  • MISP : Open-source threat intel sharing platform
  • OpenCTI
  • Fing : Device fingerprinting
  • Pulsedive : Comprehensive and affordable cyber threat intelligence with an API
  • RITA : Real Intelligence Threat Analytics
  • SpiderFoot
  • rodanmaharjan’s ThreatIntelligence : A grassroots GitHub repo for IoCs. Organized by CVE, Threat, and more
  • Lord Alfred IP Ranges : Lord Alfred’s List of IP ranges from: Google (Cloud & GoogleBot), Bing (Bingbot), Amazon (AWS), Microsoft, Oracle (Cloud), GitHub, Facebook (Meta), OpenAI (GPTBot) and others, with daily updates.
  • TweetFeed : Central source for Twitter/X based IoC
  • Phishunt : Central source for phishing IoC
  • OpenAI Crawlers IP Ranges : Complete and updated lists of OpenAI crawler IP addresses

RFC8805 GeoFeeds

Cyber Operations

General

  • OSINT Framework : A slick and comprehensive list of many cyber resources
  • Cloudflare Radar: Cloudflare’s global cyber trends
  • See also: Cyber Page for CMMC resources and publications
  • Open Cybersecurity Schema Framework : OCSF provides a standard schema for common security events, defines versioning criteria to facilitate schema evolution, and includes a self-governance process for security log producers and consumers

Cyber Tools

  • Censys : Attack surface management
  • KeyCaliber : Risk management platform
  • ParrotOS : A debian-based security operating system
  • REx : Rule Explorer : Sweet search engine for all types of rule-based signatures and SIEMs
  • Nmap : The essential network/port scanner and service-version mapper. Pair with the NSE script engine.
  • masscan : Internet-scale asynchronous port scanner; nmap-like syntax
  • RustScan : Ultra-fast port scanner that pipes open ports straight into nmap
  • OpenVAS / Greenbone : Open-source vulnerability scanner and management
  • Nessus : Industry-standard vulnerability scanner
  • Fieldwatch : Receive-only Wi-Fi and Bluetooth LE observer for Android
  • stm32-fault-injection : STM32F2 / F4 fault injection

Web Application Security

  • Burp Suite : The de-facto web app pentest proxy, scanner, and intruder
  • OWASP ZAP : Free, open-source web app scanner and proxy
  • sqlmap : Automated SQL injection detection and exploitation
  • Nuclei : Fast, template-based vulnerability scanner (ProjectDiscovery)
  • ffuf : Fast web fuzzer for content/parameter discovery
  • gobuster : Directory, DNS, and vhost brute-forcer
  • Nikto : Classic web server misconfiguration scanner
  • Amass : OWASP attack-surface / subdomain enumeration
  • ProjectDiscovery : subfinder, httpx, naabu, katana — a superb recon toolkit
  • theHarvester : Email, subdomain, and host OSINT gathering

Exploitation, C2 & Post-Exploitation

  • Metasploit : The industry-standard exploitation and post-exploitation framework
  • Exploit-DB : Archive of public exploits and PoCs (by Offensive Security)
  • Sliver : Modern, open-source cross-platform C2 framework
  • Havoc : Modern malleable C2 framework
  • Mythic : Multiplayer, plugin-based C2 framework
  • Impacket : Python classes for network protocols — essential for AD/network attacks
  • NetExec (nxc) : Network/AD swiss-army knife (the maintained CrackMapExec successor)
  • Responder : LLMNR/NBT-NS/mDNS poisoner and credential capture
  • Evil-WinRM : The go-to WinRM shell for Windows post-exploitation
  • mimikatz : Windows credential extraction (research/red-team)
  • ARES : Authorized red-team engagement automation with dashboard, campaign scope, module orchestration, OPSEC controls, encrypted vault, and reporting

Active Directory

  • BloodHound : Graph-based AD/Azure attack-path mapping
  • Certipy : AD Certificate Services (AD CS) enumeration and abuse
  • GOAD : Game of Active Directory — a vulnerable AD lab for practicing attacks
  • PingCastle : Active Directory security posture assessment

Reverse Engineering

  • Ghidra : NSA’s free, open-source software reverse-engineering suite + decompiler
  • radare2 : Powerful open-source RE/disassembly framework (used in my 42Challenge writeup)
  • Cutter : Modern GUI for radare2/rizin
  • x64dbg : Open-source Windows x64/x32 debugger
  • IDA Free : The classic interactive disassembler (free tier)
  • pwndbg : GDB plugin for exploit development and RE
  • pwntools : CTF and exploit-development framework (Python)
  • FLARE-VM : Mandiant’s installation scripts to easily set up and maintain a reverse engineering environment on a Windows VM
  • recurse : AI-native IDE for reverse engineering. Rust
  • REx-skill : Agentic reverse-engineering skill for binary vulnerability discovery

Password Cracking

  • hashcat : World’s fastest GPU password recovery (also under Cryptography)
  • John the Ripper : Versatile password cracker (jumbo build)
  • hydra : Fast network login brute-forcer

Wordlists, Payloads & Cheatsheets

Malware

  • FAME : FAME Automates Malware Evaluation
  • YARA : The pattern-matching standard for identifying and classifying malware
  • Samplepedia : Fantastic collection of malware w/ training
  • Volatility : The memory-forensics framework for IR and malware analysis
  • Velociraptor : Endpoint visibility, DFIR, and hunting at scale

Security Information and Event Management (SIEM)

  • Arkime : Large scale, open source, indexed packet capture and search system. Verizon-created
  • Armis : Network and asset visibility and monitoring
  • ExtraHop : Security SaaS with a very nice interface
  • Gravwell : Impressive and massively scalable SIEM with powerful DSL
  • Devo : Cyber Platform
  • Grafana with InfluxDB Docker : Quick stack for monitoring and testing
  • TheHive : A scalable Security Incident Response Platform, now developed by StrangeBee
  • JupiterOne : Identify, map, analyze
  • NetWitness : NetWitness XDR and SIEM
  • Sagan: Log Analysis Engine
  • SIGMA : Generic Signature Format for SIEM Systems
  • HuntRule : Sigma Rule feed. Some free ones.
  • Sigma Rule Converter : Convert Sigma Rules to various detection pipelines
  • Splunk : Best in class SIEM
  • Phantom Community Playbooks : Splunk SOAR Playbooks. Good source of inspiration even if you can’t afford Splunk

Detection & Blue Team

  • MITRE ATT&CK : The knowledge base of adversary tactics and techniques
  • ATT&CK Navigator : Annotate and visualize ATT&CK coverage
  • Zeek : Powerful network security monitor / traffic analysis framework (formerly Bro)
  • Suricata : High-performance IDS/IPS and network security monitoring
  • Snort : The classic open-source IDS/IPS
  • Wazuh : Open-source XDR/SIEM with HIDS, FIM, and threat detection
  • Security Onion : Free IDS/NSM/log-management distro
  • Atomic Red Team : Small, portable detection tests mapped to ATT&CK
  • Hunting-Queries-Detection-Rules : KQL hunting and detection queries for Defender for Endpoint and Azure Sentinel — advanced hunting, custom detection, and analytics rules

Threat Emulation

  • Caldera : MITRE Threat Emulation Platform
  • Scythe: Emulates real-world adversarial campaigns. Commercial product.
  • PurpleSharp: Adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Vulnerability Testing / Pentesting Practice

Data Engineering

  • Airbyte : Data integration platform for ELT pipelines from APIs, databases & files to warehouses & lakes. Open source and SaaS. 300+ input and output connectors
  • AirFlow : Programmatically author, schedule and monitor workflows
  • Bacalhau : Platform for fast, cost-efficient, and secure computation by running jobs (WASM workers or Docker containers) in a distributed network
  • Beam : Open source, unified model for defining both batch and streaming data-parallel processing pipelines
  • chDB : chDB is an embedded OLAP SQL Engine 🚀 powered by ClickHouse. Supports many backend and file formats.
  • Cribl: Cribl Stream is an observability and data streaming platform for real-time processing of logs, metrics, traces, and data
  • croc : File xfer all the things peer to peer
  • cube : A powerful middleware between your data source and your data application. Handles modeling, security, cache, API
  • dagster: Orchestrator that’s designed for developing and maintaining data assets, such as tables, data sets, machine learning models, and reports
  • DB Fiddle : Database Fiddle and prototyping
  • DataGrip : SQL + more client
  • datastation : open-source data IDE for developers. Front end for dsq.
  • dsq : Command-line tool for running SQL queries against JSON, CSV, Excel, Parquet, and more.
  • duckdb : Exceptional in-process SQL OLAP database management system. SQL on many backends
  • octosql : CLI tool which lets you query a plethora of databases and file formats using SQL through a unified interface, even do JOINs between them
  • EverSQL : AI-based system to optimize database queries
  • Flowable : Light-weight business process engine written in Java
  • Gaffer : Gaffer is a graph database framework
  • Apache Nifi : Powerful and scalable directed graphs of data routing, transformation, and system mediation logic
  • orchest : Sweet data pipeline and jupyter notebook tool
  • pgAdmin : Capable, mature and free* Postgres Client
  • Dataminr Investigation Insights : Formerly Polarity. Fuses disparate data, tools, and knowledge into one unified view
  • Steampipe : Dynamically query APIs, code and more with SQL. Zero-ETL from 140 data sources. Another SQL all the stuff.
  • Spring Cloud Data Flow : A microservices-based toolkit for building streaming and batch data processing pipelines in Cloud Foundry and Kubernetes
  • DeltaLake : Provides ACID transactions, scalable metadata handling, and unifies streaming and batch data processing on top of existing data lakes, such as S3, ADLS, GCS, and HDFS.
  • delight : A free, amazing Spark UI from DataMechanics
  • Querybuilder : Query Builder is a JavaScript library for building SQL
  • rql: RQL is a resource query language for REST (written in go). It provides a simple and light-weight API for adding dynamic querying capabilities to web applications that use SQL-based databases
  • milvus : Vector database built for scalable similarity search
  • planetscale : Serverless MySQL. Generous free tier
  • Sleeper : Sleeper is a serverless, cloud-native, log-structured merge tree based, scalable key-value store.
  • Meltano : A fantastic middleware + CLI for moving data between various formats and APIs. Singer compatible.
  • Singer : Singer is an open source standard for moving data between databases, web APIs, files, queues, and just about anything else you can think of
  • Data Formulator : Microsoft’s interactive AI-powered data analysis system — connect, explore, and visualize data

Data Systems

Databases

  • Database of databases : fantastic taxonomy of database management systems
  • GUN : Distributed Graph database. Technically, GUN is a graph synchronization protocol with a lightweight embedded engine, capable of doing 20M+ API ops/sec in just ~9KB gzipped size.
  • superDB : A novel data lake based on super-structured data. (Formerly brim)
  • qdrant : High-performance, massive-scale vector database and vector search engine for the next generation of AI. Rust
  • HelixDB : OLTP graph database with native vector and full-text search, built on object storage. Rust

Data Models

Data Sources

Documentation / Doc Management

  • Pandoc : Very capable document translator. Markdown to pdf and more.
  • Joplin : Joplin note-taking app. Markdown / open source / LaTeX.
  • Notion : Notion team collaboration and documentation
  • Obsidian : Powerful markdown based second brain.
  • marker : Convert PDF to markdown + JSON quickly with high accuracy
  • md2cb : Convert Markdown to formatted text on the clipboard. Go
  • mimik : Browser extension that records your clicks and turns them into a step-by-step guide with annotated screenshots

Email Tools

GPU & GPU Programming

  • Unigine Benchmark : Unigine engine GPU benchmarks and stress tests
  • Algorythmic Explorations : Interactive article series with live WebGPU demos — particle worlds, N-body sims, SPH water, and stable fluids

Hosting

  • CoLoco : Coloco colocation services (USA)
  • Equinix : Cloud Infrastructure Provider. Best in class
  • OVH : Cloud Infrastructure Provider. Best in class
  • Vultr : Instantly deploy High Performance Cloud Servers, Cloud GPUs, Bare Metal, and Cloud Storage worldwide.

Infrastructure as Code

  • BrainBoard : Create Terraform from CloudAPI
  • pulumi : Build infrastructure intuitively on any cloud using familiar languages

Infrastructure as Service

  • runpod.io : Globally distributed GPU containers. Pay as you go.
  • fly.io : Deploy containers anywhere in the world. K8s IaaS
  • LimaCharlie : Security Infrastructure as a Service. Handles collection, streaming analytics, and moving data
  • FluxCloud : Web3 compute and storage
  • Akash Network : Decentralized compute marketplace

Interplanetary File System (IPFS)

Kubernetes

Autoscaling

General

K8s Management as a Service

  • plural.sh : Deploy, secure, and scale open-source applications on your cloud in minutes. Slick interface

Languages, Parsers, and Translators

  • elvish: Powerful scripting language & versatile interactive shell written in Go
  • grule: Go-based rule engine
  • gval : Go-based evaluator pkg. Gval can evaluate expressions with parameters, arithmetic, logical, and string operations
  • tengo : An embeddable script language for Go. Use cases: rule engine, state management, CI/CD.

Linux Essentials

Malware

Networking

  • bird : BIRD Internet Routing Daemon. A dynamic router that works across the Internet
  • brightdata : Award-winning proxy networks, AI-powered web scrapers, and business-ready datasets for download. The internet’s most trusted web data platform.
  • OpenZiti : Open-source zero-trust overlay network
  • sniffer : Analyze which processes are generating what traffic
  • wiregasm : Wireshark in the browser. See demo
  • iodine : IPv4 tunneling over DNS
  • netcat : Networking Swiss army knife
  • tailscale : Mesh network VPN SaaS
  • wireguard : Simple, fast, secure VPN
  • scanopy : Network diagrams that update themselves. Rust
  • Twingate : Twingate secure remote network bridge. Like a VPN.
  • Mullvad : Mullvad VPN service. Cheap with support for Wireguard and OpenVPN
  • RIPE Atlas : RIPE Atlas employs a global network of probes that measure Internet connectivity and reachability, providing an unprecedented understanding of the state of the Internet in real time.
  • Cloudflare Radar: Cloudflare’s global cyber and networking trends
  • GlobalPing : Global ping/tracert as a service

DNS Discovery

  • Cloudmare : Cloudmare is a simple tool to find the origin servers of websites protected by Cloudflare, Sucuri, or Incapsula with misconfigured DNS.

DNS Firewall

DNS IP Resolvers

  • https://nip.io/ : Wildcard DNS that resolves to the IP address embedded in the hostname
  • https://sslip.io/ : Another wildcard DNS service that resolves to the embedded IP address
  • xip.io: The original

Proxies

  • gost : Simple proxy written in go. Essential

Network Analysis

  • APackets : Online pcap file analyzer
  • Cloud-PCAP : A CloudShark clone (GitHub)
  • Shodan : Powerful IoC, IoT, crawler, search engine
  • tcpdump : Home web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture.
  • Wireshark : The world-standard network protocol analyzer (and tshark CLI)
  • Teleseer : Best-in-class network visualization and analysis
  • so-crates : Doug Burks’ standalone web app for rapid PCAP/log/file analysis with Suricata, YARA, and Sigma — alerts, metadata, transcripts, and hexdumps
  • Faddom : Agentless application dependency mapping — visualizes on-prem and cloud infrastructure and server dependencies in real time
  • LiveAction Topology Mapping : Automated device discovery and real-time network topology mapping for performance management and incident response
  • Network Perception : Agentless OT/ICS network topology mapping to audit configs and verify segmentation
  • kismet : Kismet is a sniffer, WIDS, and wardriving tool for Wi-Fi, Bluetooth, Zigbee, RF, and more, which runs on Linux and macOS
  • PacketStreamer : Distributed tcpdump
  • GoAccess : Real-time web log analyzer that runs in the terminal or the browser

Network Security

  • CloudFlare : Fantastic batteries-included network as-a-service. DNS, WAF, Bot Detection, Firewall and more. Massive free capabilities.
  • Malcolm : Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
  • OpenSnitch : Free, open-source, self-hosted outbound application firewall made for Linux
  • pfSense : Leading open-source firewall
  • pfsense-mcp-server : MCP server for managing pfSense in natural language — rules, VPNs, DNS, DHCP — with guardrails, config backup, and rollback on every change
  • RockNSM : Open-source security stack
  • Clear NDR (formerly SELKS) : Turn-key Suricata-based IDS/NSM and threat hunting system

Operating Systems

  • Parrot Security : Debian-based security focused OS
  • ReactOS : Open-source Windows NT-compatible operating system

OSINT / Enrichment

  • ThreatDome : CTI platform specialized for ICS and IoT (formerly cyberIntelMatrix)
  • GreyNoise : tracks internet noise / triage false positive
  • OpenCTI
  • SpiderFoot
  • SubMap : Attack surface management scanner search tool
  • God’s Eye View : A spy satellite simulator in your browser, except the data is real — live open source spatial intelligence on a photorealistic 3D globe

Pentest

  • Hak5 : Incredible HW and USB based devices for pentesting
  • hcxdumptool : Command-line tool to collect data from and pentest Wi-Fi networks

Packet Capture

  • cloud-probe : A Software Probe for network packet capturing and forwarding in Cloud/Kubernetes and Virtualized environment
  • etl2pcapng : Utility that converts an .etl file containing a Windows network packet capture into .pcapng format.
  • hcxdumptool : Command-line tool to collect data from and pentest Wi-Fi networks
  • PacketStreamer : Distributed tcpdump for cloud native environments
  • PCAPdroid : No-root network monitor, firewall and PCAP dumper for Android
  • rvi_capture : Capture packets sent from iOS devices
  • WirePenguin : Packet sniffer in Go

Privacy

  • Invidious : an open source alternative front-end to YouTube.
  • doxx.net : Freedom of speech and privacy platform

Office Productivity

  • EtherPad : An open source alternative to Google Docs
  • Grist : An open source alternative to Google Sheets
  • LibreOffice : An open-source alternative to MS Office. Has an unsupported online version
  • OwnCloud : An open-source alternative to Google Drive
  • Cosmos Cloud : The most secure and easy self-hosted home server.

Finance

  • Wealthfolio : Private, local-first personal finance tracker — investments, net worth, spending, and simulations. Rust
  • SETS : Self-improving trading machine

Publications

Robotics

Simulation

Software Development

IDEs

  • Retool : Interesting tool builder for fast custom UIs on data lakes
  • Warp : An agentic development environment, born out of the terminal. Rust

GraphQL

  • graphqlEditor : Nice graphql editor SaaS platform; good for collaboration
  • graphJin : Create graphql from REST APIs
  • Hasura : Phenom GraphQL GW tool with many features

Web Frameworks

  • Datastar : Hypermedia framework for reactive web apps driven from the backend

PlantUML

Testing

  • artillery.io : Cloud-scale performance testing
  • k6.io : Exceptional load testing framework.
  • Playwright: Powerful browser automation framework (javascript)
  • Selenium : Powerful browser automation framework (Python). Primarily it is for automating web applications for testing purposes
  • Stagehand : AI Browser Automation Framework

Training

Video/Audio Tools

Virtualization

Visualization

  • d3js : Phenom js graphics and diagramming library
  • gephi: Network graph visualization application
  • GraphViz : Open source visualization framework in code
  • yEd Live : Another fantastic diagramming tool. Online and desktop versions.
  • KitikiPlot : Python library for visualizing categorical sliding-window data

Web Assembly

Web3

  • Arweave : The first protocol that enables permanent data storage. Its design allows anyone to preserve data forever with just a single, one-time fee.
  • FluxCloud : Decentralized, distributed compute and storage. Affordable!
  • GagaNode : Gaga Node is a decentralized residential IP + Bandwidth marketplace
  • Nostr: Nostr is a simple, open protocol that enables global, decentralized, and censorship-resistant social media.
  • FileCoin : A Web3 distributed filesystem and related ecosystem. Linked to crypto currency economics
  • Tableland : A Web3 decentralized database built on Ethereum, FileCoin, others and based on sqlite
  • Lighthouse : A Web3 storage provider; It is built on IPFS and Filecoin.

Windows Essentials

  • CygWin: Linux like environment on Windows
  • MobaXterm : Enhanced terminal for Windows with X11 server, tabbed SSH client, network tools and much more
  • WSL : Windows Subsystem for Linux
  • PingCastle : Active Directory Vulnerability Management

Workflow Automation / Management

  • Hunchly: Automatically collects, documents, and annotates every web page you visit.
  • WALKOFF: Automatically gather data, analyze data, or visualize data customized to your requirements.
  • Airflow : Fantastic workflow/service automation orchestrator
  • Argo : Workflow execution engine for Kubernetes.
  • Node-Red : A browser-based flow editor that makes it easy to wire together flows using the wide range of nodes in the palette
  • ReactFlow : A highly customizable React component for building node-based editors and interactive diagrams
  • Snakemake : Python workflow management system to create reproducible and scalable data analyses.
  • Concourse : an open-source continuous thing-doer.
  • control-tower : Self-healing IaaS for Concourse
  • Navattic : Clone a website and build a standalone demo. DOM in a box