Security research

Scans a website's HTTP security response headers (CSP, HSTS, X-Frame-Options, and more) and gives it a letter grade with fixes.

The definitive deep test of a site's SSL/TLS configuration: protocols, ciphers, certificate chain, and known weaknesses, with an A-to-F grade.

Scans a site's security posture (headers, TLS, and cookies) and returns a letter grade with prioritised fixes. A strong companion to Security Headers and SSL Labs.

An all-in-one posture report covering TLS, DNS, email, and HTTP headers for a domain on a single page.

A free, in-depth TLS/SSL test that also flags PCI DSS and HIPAA compliance gaps in the configuration.

MX, DNS, blacklist, and email-deliverability (SPF/DKIM/DMARC) lookups in one place. A daily-driver for email and DNS troubleshooting.

DNS recon and subdomain discovery with a visual network map. Great for mapping a domain's public footprint.

Searches Certificate Transparency logs. A quick way to enumerate subdomains from certificates that have been issued for a domain.

Official WHOIS registration details for a domain: registrar, registration and expiry dates, and name servers.

A fast, free WHOIS lookup that returns a domain's registration, registrar, name servers, and DNS records in one clean view.

WHOIS lookups with registrar, registration and expiry details, plus domain availability. A useful second source when another WHOIS lookup is rate-limited or sparse.

WHOIS and registration information for .nz domains (the New Zealand registry).

Historical DNS and WHOIS data plus subdomain discovery. Excellent for mapping a domain's past and present footprint.

A powerful free multi-tool for ASN, IP, BGP, and DNS lookups, and for seeing how networks connect to each other.

Visualises and troubleshoots a domain's DNSSEC chain, making broken or misconfigured signing easy to spot.

A broad suite of free DNS and IP tools in one place: reverse IP, DNS records, WHOIS history, port testing, and more.

Checks DNS record propagation from servers around the world.

Deep DNS and network research: records, related domains, and hosting relationships.

Automates OSINT collection across hundreds of sources to map a target's footprint.

Gathers emails, subdomains, hosts, and names for a domain from public sources.

A fast passive subdomain enumeration tool from ProjectDiscovery.

A modular reconnaissance framework with a Metasploit-like workflow.

A search engine for internet-exposed devices and services, similar to Shodan.

An internet asset search engine for discovering exposed hosts, services, and technologies.

A cyber-defence search engine that indexes internet-facing assets and threat data.

Search and monitor internet-connected hosts, certificates, and attack surface.

Discovers and monitors a company's external attack surface and exposed assets.

Searches publicly exposed cloud storage buckets and files. Useful for spotting data leaks.

The search engine for internet-connected devices: exposed ports, running services, and banners for an IP, host, or organisation.

Check an IP address's abuse history and reputation, useful for triaging suspicious sources in logs.

Find other domains hosted on the same IP address. Handy for shared-hosting and footprint mapping. Also offers a free API.

Internet-wide search of hosts and certificates. The natural companion to Shodan for finding exposed services and assets.

Tells you whether an IP is mass-scanning the whole internet (background noise) or targeting you specifically. Invaluable for triaging log sources.

Clean, accurate IP geolocation, ASN, and hosting-provider details for any address.

Checks an IP address against blacklists and reputation sources.

A searchable archive of public exploits and proof-of-concept code.

The official US National Vulnerability Database: CVE details, severity scores, and affected products.

Browse and pivot CVEs by vendor, product, and year, with statistics and trends.

CISA's catalogue of vulnerabilities known to be actively exploited in the wild. Patch these first.

A vulnerability search engine aggregating CVEs, exploits, and advisories from many sources.

A fast search engine for exploits and proof-of-concept code across public sources.

A curated list of Unix binaries that can be abused to bypass local security restrictions.

The Windows equivalent of GTFOBins: living-off-the-land binaries, scripts, and libraries.

The reference framework of real-world adversary tactics and techniques.

The industry-standard web application testing proxy. The free Community edition covers the basics.

A free, open-source web application vulnerability scanner and testing proxy.

A fast, template-driven vulnerability scanner from ProjectDiscovery.

An open-source web server scanner that checks for thousands of known issues.

Automates the detection and exploitation of SQL injection flaws.

A fast web fuzzer for content discovery, parameter fuzzing, and virtual-host brute forcing.

Identifies the technologies, frameworks, and services a website runs on.

Fingerprints websites to reveal their technologies, servers, and versions.

Profiles a site's full technology stack, from analytics to hosting.

The definitive network scanner for host discovery, port scanning, and service detection.

The standard tool for capturing and analysing network traffic packet by packet.

An interactive online sandbox for detonating and observing malware in real time.

A free automated malware sandbox with detailed behavioural reports.

A fast, free malware analysis sandbox from Recorded Future.

Deep, detailed malware analysis across Windows, macOS, Linux, Android, and iOS.

Analyses files by genetic code reuse to attribute and classify malware.

A community repository of malware samples for research, run by abuse.ch.

GCHQ's 'cyber swiss-army knife' for encoding, decoding, encryption, and data analysis in the browser.

A huge collection of tools for ciphers, encodings, and puzzle solving.

Looks up unsalted password hashes against a massive precomputed table.

Identifies hash types and attempts to crack them via a distributed service.

Checks a file, URL, domain, or IP against dozens of antivirus engines and threat feeds. The essential first stop for reputation.

Safely sandbox-scans a URL and shows what it loads, the requests it makes, a screenshot, and a verdict. Ideal for investigating a suspicious link.

Reputation for an IP, domain, or email sender, backed by one of the largest threat-telemetry networks.

Community-run malware and indicator feeds (URLhaus, ThreatFox, and MalwareBazaar) for tracking active threats and IOCs.

An open threat-intelligence community sharing indicators of compromise.

Searches and enriches threat indicators (IPs, domains, URLs) with risk scoring.

IBM's threat-intelligence platform for researching IPs, domains, malware, and vulnerabilities.

Pivots across threat-intel indicators to enrich an investigation.

Daily threat analysis and handy lookup tools from the SANS community.

A browser extension that one-click looks up selected IOCs (IPs, domains, hashes, URLs, CVEs) across dozens of search and threat-intel engines.

Check whether an email address or password has appeared in a known data breach, and subscribe to be alerted if it happens again.

Finds the email-address format and known addresses for a domain. Useful for understanding an organisation's email footprint.

The Internet Archive's snapshot history of web pages over time.

Captures an on-demand, permanent snapshot of a specific web page.

Searches the web by page source code, useful for finding sites sharing a snippet, tag, or tracker.

Searches code across public Git repositories in an instant.

A browsable directory that maps OSINT tools to what you are trying to find.

A large community-curated collection of cybersecurity tools and learning resources.