0xrafasec

Tools

Security tools and developer resources

Tools I build and use — from firewalls to crypto libraries. Plus curated resources to help developers think about security.

Built by 0xrafasec

rfirewall

User-centric firewall for Linux

A lean, modern firewall built in Rust. Designed for top-tier security with an exceptional user experience — minimal overhead, intuitive interface, and seamless integration with your Linux environment. In active development.

RustIn development

ecies-bls12381

ECIES encryption with BLS12381

Go package for keypair generation, encryption, and decryption using ECIES with the BLS12381 elliptic curve. Leverages Kyber for secure operations. Suitable for proxy re-encryption and secure data sharing.

GoAvailable

More tools coming as I build them.

Recon & Discovery

ToolDescriptionLink
SubfinderPassive subdomain enumeration. 100+ sources, blazing fast. Essential first step in any recon chain.
httpxHTTP probing toolkit. Title, status, tech detection, follow redirects. Filters live hosts fast.
KatanaNext-gen web crawler. JS parsing, headless mode, scope control. Finds endpoints others miss.
NmapNetwork discovery classic. Port scanning, service detection, OS fingerprinting. 25+ years, still the standard.
NaabuFast port scanner in Go. SYN/CONNECT scans, service discovery. Designed for automation pipelines.
AmassAttack surface mapping. DNS enumeration, ASN discovery, data sources integration. OWASP project.

Vulnerability Scanning

ToolDescriptionLink
NucleiTemplate-based vuln scanner. 9000+ community templates. CVEs, misconfigs, exposures. The GOAT for automation.
TrivyAll-in-one security scanner. Containers, IaC, SBOM, secrets, licenses. CI/CD native. Aqua Security.
SemgrepFind bugs and vulns in code. 2000+ rules. Fast. Works with any language. Free for open source.
NiktoWeb server scanner. Checks for dangerous files, outdated software, misconfigs. Classic but effective.

Web Application Testing

ToolDescriptionLink
Burp SuiteIndustry standard web proxy. Intercept, scan, exploit. Massive extensions ecosystem. PortSwigger.
CaidoModern Burp alternative. Rust-based, lightweight, clean UI. 10 projects free. Rising fast in 2025-2026.
FfufDirectory discovery, parameter fuzzing, vhost discovery. Written in Go. Blazing fast.
SQLMapAutomated SQL injection. Detection and exploitation. Database takeover capabilities. The SQLi tool.
DalfoxXSS scanner and parameter analysis. WAF bypass, DOM XSS detection. Modern and actively maintained.
ArjunHTTP parameter discovery. Finds hidden GET/POST parameters. Essential for fuzzing prep.

Secrets & Credentials

ToolDescriptionLink
GitleaksFind API keys, passwords, tokens before they leak. Scans commits, branches, diffs. Easy CI integration.
TruffleHogCredential scanner. Git history, S3, filesystems. High entropy and regex detection.
HashcatPassword recovery tool. GPU-accelerated cracking. Rules, masks, wordlists. Industry standard.
John the RipperPassword cracker. Multiple formats, wordlist attacks, incremental mode. The classic.

Active Directory & Internal

ToolDescriptionLink
BloodHoundAD attack path mapping. Graph-based privilege escalation discovery. CE v8 adds OpenGraph for cloud.
ImpacketPython network protocols. SMB, MSRPC, Kerberos attacks. GetNPUsers, secretsdump, psexec.
NetExecCrackMapExec successor. SMB, WinRM, LDAP, MSSQL, SSH. Credential spraying, enumeration.
CertipyAD Certificate Services attacks. ESC1-ESC8 exploitation. Find and abuse PKI misconfigs.
RubeusKerberos abuse toolkit. Kerberoasting, AS-REP roasting, ticket manipulation. C# for Windows.
ResponderLLMNR/NBT-NS/MDNS poisoner. Credential capture on internal networks. Essential for internals.

Cloud Security

ToolDescriptionLink
ProwlerAWS/Azure/GCP security assessments. CIS benchmarks, compliance checks. 300+ controls.
ScoutSuiteMulti-cloud security auditing. AWS, Azure, GCP, Alibaba, Oracle. Risk assessment reports.
PacuAWS exploitation framework. Post-compromise, privesc, persistence. Like Metasploit for AWS.
CloudBruteCloud infrastructure enumeration. Find company assets across AWS, Azure, GCP, DigitalOcean.

Exploitation & C2

ToolDescriptionLink
MetasploitPenetration testing framework. Exploit database, payloads, post-exploitation modules. The classic.
SliverModern C2 framework. Open source Cobalt Strike alternative. mTLS, WireGuard, HTTP(S), DNS C2.
HavocModern post-exploitation C2. Demon agent, BOFs support, cloud API abuse. Rising fast in 2025-2026.
MythicFlexible C2 platform. Web UI, multi-agent (Python/Go/.NET/Swift). Modular and extensible.

Network Analysis

ToolDescriptionLink
WiresharkNetwork protocol analyzer. Packet capture and deep inspection. Essential for traffic analysis.
mitm6IPv6 attack tool. DNS takeover via DHCPv6. Combines with ntlmrelayx for relay attacks.
BettercapNetwork attack and monitoring. MITM, WiFi, BLE, HID. Swiss army knife for network hacking.

Smart Contract Security

ToolDescriptionLink
SlitherSolidity static analyzer. 90+ detectors, inheritance graph, call graph. Trail of Bits.
MythrilEVM bytecode analyzer. Symbolic execution, taint analysis. Find exploits in smart contracts.
FoundrySmart contract dev toolkit. Forge (testing), Cast (interactions), Anvil (local node). Rust-based, fast.
EchidnaEthereum smart contract fuzzer. Property-based testing. Find edge cases automatically.
AderynRust-based Solidity analyzer. Fast static analysis, custom detectors. Cyfrin.

Utility & Automation

ToolDescriptionLink
AnewAppend lines to file if unique. Essential for deduping recon output. Tomnomnom.
qsreplaceReplace query string values. Useful for mass parameter testing. Tomnomnom.
gauFetch known URLs from AlienVault OTX, Wayback, Common Crawl. URL discovery gold.
waybackurlsFetch URLs from Wayback Machine. Historical endpoint discovery. Tomnomnom.
unfurlParse and extract URL components. Domains, paths, params, values. Tomnomnom.

Developer resources

Essential references for security-aware development.