anchor.diff:  Forensic;WinHex;http://www.winhex.com/winhex/;A Hexadecimal Editor, Helpful In The Realm Of Computer Forensics, Data Recovery, Low-Level Data Processing, And It Security
   Traffic Analysis/Inspection;WinPcap;http://www.tcpdump.org/wpcap.html;An Extract Of A Message From Guy Harris On State Of Winpcap And Windump.
   Wireless;WirelessMon;http://www.passmark.com/products/wirelessmonitor.htm;Wirelessmon Is A Software Tool That Allows Users To Monitor The Status Of Wireless Wifi Adapter(S) And Gather Information About Nearby Wireless Access Points And Hot Spots In Real Time.
  -Networking;Wireshark;https://www.wireshark.org/;Analyze The Network Dumps
  +Network;Wireshark;https://www.wireshark.org/;The network traffic analysis tool.
   Traffic Analysis/Inspection;Wireshark suit;http://wiki.wireshark.org/Tools;The Well-Known Tool Suit To Support Packet Analyzer And Protocol Decoder. It Also Includes A Few Practical Tools And Scripts To Support Most Of The Common Usage.
   Enumeration;wmi client;http://dev.zenoss.org/svn/trunk/inst/externallibs/;This Dcom/Wmi Client Implementation Is Based On Samba4 Sources. It Uses Rpc/Dcom Mechanisms To Interact With Wmi Services On Windows 2000/Xp/2003 Machines.
   Python Misc;wmiexec.py;https://github.com/CoreSecurity/impacket/blob/master/examples/wmiexec.py;Execute Powershell Commands Quickly And Easily Via Wmi
  
positive.code: Enumeration;LDAP Browser;http://www.ldapbrowser.com/;Ldap Browser Is A Premier Windows Explorer-Like Ldap Directory Client Available For Win32 Platforms.
  Traffic Analysis/Inspection;Libcrafter;http://code.google.com/p/libcrafter/;Is A High Level Library For C++ Designed To Make Easier The Creation And Decoding Of Network Packets. It Is Able To Craft Or Decode Packets Of Most Common Network Protocols, Send Them On The Wire, Capture Them And Match Requests And Replies.
  Python Network;libdnet;http://code.google.com/p/libdnet/;Low-Level Networking Routines, Including Interface Lookup And Ethernet Frame Transmission
  Python Forensics;LibForensics;http://code.google.com/p/libforensics/;Library For Developing Digital Forensics Applications
  Exploits;libformatstr;https://github.com/hellman/libformatstr;Simplify Format String Exploitation.
  Traffic Analysis/Inspection;Libnet;http://libnet.sourceforge.net/;Is A Collection Of Routines To Help With The Construction And Handling Of Network Packets. It Provides A Portable Framework For Low-Level Network Packet Shaping, Handling And Injection. Libnet Features Portable Packet Creation Interfaces At The Ip Layer And Link Layer, As Well As A Host Of Supplementary And Complementary Functionality. Using Libnet, Quick And Simple Packet Assembly Applications Can Be Whipped Up With Little Effort.
  Traffic Analysis/Inspection;Libnids;http://libnids.sourceforge.net/;Designed By Rafal Wojtczuk, Is An Implementation Of An E-Component Of Network Intrusion Detection System. It Emulates The Ip Stack Of Linux 2.0.X. Libnids Offers Ip Defragmentation, Tcp Stream Assembly And Tcp Port Scan Detection. The Most Valuable Feature Of Libnids Is Reliability. A Number Of Tests Were Conducted, Which Proved That Libnids Predicts Behaviour Of Protected Linux Hosts As Closely As Possible.
  Traffic Capture;Libpcap/Tcpdump;http://www.tcpdump.org/;The Official Site Of Tcpdump, A Powerful Command-Line Packet Analyzer  And Libpcap, A Portable C/C++ Library For Network Traffic Capture.
  SSL Analysis Tools;liffy;https://github.com/hvqzao/liffy;Lfi Exploitation Tool
  Web Scanners;LiLith;http://michaelhendrickx.com/lilith;Lilith Is A Tool Written In Perl To Audit Web Applications. This Tool Analyses Webpages And Looks For Html <Form> Tags, Which Often Refer To Dynamic Pages That Might Be Subject To Sql Injection Or Other Flaws.
  Linux Utils;Linux Exploit Suggester;https://github.com/PenturaLabs/Linux_Exploit_Suggester;Linux Exploit Suggester Based On Operating System Release Number.
  Passwords;Lodowep;http://www.cqure.net/wp/lodowep/;Lodowep Is A Tool For Analyzing Password Strength Of Accounts On A Lotus Domino Webserver System. The Tool Supports Both Session- And Basic-Authentication.
  DDoS Tools;LOIC;https://github.com/NewEraCracker/LOIC/;An Open Source Network Stress Tool For Windows
  Python Other useful libraries and tools;lxml;http://lxml.de/;Most Feature-Rich And Easy-To-Use Library For Working With Xml And Html In The Python Language
  Python Other useful libraries and tools;M2Crypto;http://chandlerproject.org/bin/view/Projects/MeTooCrypto;Most Complete Openssl Wrapper
  Network Tools;mallory;https://github.com/justmao945/mallory;Http/Https Proxy Over Ssh
  OSInt Tools;Maltego;http://www.paterva.com/web7/;Proprietary Software For Open Source Intelligence And Forensics, From Paterva.
  Forensics;Malzilla;http://malzilla.sourceforge.net/;Malware Hunting Tool
  Network Tools;Mass Scan;https://github.com/robertdavidgraham/masscan;Tcp Port Scanner, Spews Syn Packets Asynchronously, Scanning Entire Internet In Under 5 Minutes.
  Networking;Masscan;https://github.com/robertdavidgraham/masscan;Mass Ip Port Scanner, Tcp Port Scanner
  Python Other useful libraries and tools;matplotlib;http://matplotlib.sourceforge.net/;Make 2D Plots Of Arrays
  Python Other useful libraries and tools;Mayavi;http://code.enthought.com/projects/mayavi/;3D Scientific Data Visualization And Plotting
  Vuln Scanners;MBSA;http://technet.microsoft.com/en-us/security/cc184923;Microsoft Baseline Security Analyzer (Mbsa) Is An Easy-To-Use Tool Designed For The It Professional That Helps Small And Medium-Sized Businesses Determine Their Security State In Accordance With Microsoft Security Recommendations And Offers Specific Remediation Guidance.
  Passwords;Medusa;http://www.foofus.net/~jmk/medusa/medusa.html;Medusa Is Intended To Be A Speedy, Massively Parallel, Modular, Login Brute-Forcer. The Goal Is To Support As Many Services Which Allow Remote Authentication As Possible.
  Reverse Engineering Tools;Medusa disassembler;https://github.com/wisk/medusa;An Open Source Interactive Disassembler
  OSInt Tools;metagoofil;https://github.com/laramies/metagoofil;Metadata Harvester
  Exploits;Metasploit;http://www.metasploit.com/;Penetration Testing Software
  Vuln Scanners;Metasploit Framework;http://www.metasploit.com/;The Metasploit Framework Is An Advanced Open-Source Platform For Developing, Testing, And Using Exploit Code.
  Vuln Apps;Metasploitable;http://sourceforge.net/projects/metasploitable/;Metasploitable Is An Intentionally Vulnerable Linux Virtual Machine. This Vm Can Be Used To Conduct Security Training, Test Security Tools, And Practice Common Penetration Testing Techniques.
  Windows Utils;mimikatz;http://blog.gentilkiwi.com/mimikatz;Credentials Extraction Tool For Windows Os
  Scanning;MingSweeper;http://www.hoobie.net/mingsweeper/;Mingsweeper Is A Network Reconnaissance Tool Designed To Facilitate Large Address Space,High Speed Node Discovery And Identification.
  Python Fuzzing;Mistress;http://www.packetstormsecurity.org/fuzzer/mistress.rar;Probe File Formats On The Fly And Protocols With Malformed Data, Based On Pre-Defined Patterns
  Network;mitmproxy;https://mitmproxy.org/;An Interactive, Ssl-Capable Man-In-The-Middle Proxy For Http With A Console Interface
  Network;mitmsocks4j;https://github.com/Akdeniz/mitmsocks4j;Man-In-The-Middle Socks Proxy For Java
  Traffic Capture;Moloch;https://github.com/aol/moloch;Moloch Is A Open Source Large Scale Full Pcap Capturing, Indexing And Database System.
  Python Debugging and reverse engineering;mona.py;https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/;Pycommand For Immunity Debugger That Replaces And Improves On Pvefindaddr
  Network Tools;Morpheus;https://github.com/r00t-3xp10it/morpheus;Automated Ettercap Tcp/Ip Hijacking Tool
  Vuln Apps;Moth;http://www.bonsai-sec.com/en/research/moth.php;Moth Is A Vmware Image With A Set Of Vulnerable Web Applications And Scripts, That You May Use For, Testing Web Application Security Scanners, Testing Static Code Analysis Tools (Sca), Giving An Introductory Course To Web Application Security
  Scanning;Multi Threaded TCP Port Scanner 3.0;http://www.secpoint.com/Multi-Threaded-TCP-Port-Scanner.html;This Tool Could Be Used To Scan Ports Of Certain Ip. It Also Could Describe Each Port With Standard Name (Well-Known And Registered Ports).
  Traffic Analysis/Inspection;Multitail;http://www.vanheusden.com/multitail;Now Has A Colorscheme Included For Monitoring The Tcpdump Output. It Can Also Filter, Convert Timestamps To Timestrings And Much More.
  Database Vulnerabilities;MYSQLAudit;http://www.darkoperator.com/tools-and-scripts/;Python Script For Basic Auditing Of Common Security Misconfigurations In Mysql.
  Traffic Capture;n2disk;http://www.ntop.org/products/n2disk/) (Commercial;A Multi-Gigabit Network Traffic Recorder With Indexing Capabilities. N2Disk Is A Network Traffic Recorder Application. With N2Disk You Can Capture Full- Sized Network Packets At Multi-Gigabit Rate (Above 10 Gigabit/S On Adequate Hardware) From A Live Network Interface, And Write Them Into Files Without Any Packet Loss.
  Enumeration;NBTEnum;http://www.secguru.com/link/nbtenum_netbios_enume ration_utility;Netbios Enumeration Utility (Nbtenum) Is A Utility For Windows That Can Be Used To Enumerate Netbios Information From One Host Or A Range Of Hosts.
  
negative.code: Steganography;Stegbreak;https://linux.die.net/man/1/stegbreak;Launches Brute-Force Dictionary Attacks On Jpg Image
  Steganography;Steghide;http://steghide.sourceforge.net/;Hide Data In Various Kind Of Images
  Steganography;Stegsolve;http://www.caesum.com/handbook/Stegsolve.jar;Apply Various Steganography Techniques To Images
  IOC;STIX - Structured Threat Information eXpression;http://stixproject.github.io;Standardized language to represent and share cyber threat information.Related efforts from MITRE
  Storage and Workflow;stoQ;http://stoq.punchcyber.com;Distributed content analysis framework with extensive plugin support, from input to output, and everythingin between.
  Disassemblers;strace;https://sourceforge.net/projects/strace/;Dynamic analysis forLinux executables.
  Networking Tools;Stunnel;http://www.stunnel.org/;The Stunnel Program Is Designed To Work As An Ssl Encryption Wrapper Between Remote Client And Local (Inetd-Startable) Or Remote Server.
  Python Network;SubBrute;https://github.com/TheRook/subbrute;Fast Subdomain Enumeration Tool
  Scanning;subdomain-bruteforcer;https://github.com/TheRook/subbrute;Subdomain-Bruteforcer Is A Multi-Threaded Python Tool For Enumerating Subdomains From A Dictionary File. Particularily Useful For Finding Admin Panels Or Other Dodgy Web Practices.
  Domain analysis;Sucuri SiteCheck;https://sitecheck.sucuri.net/;Free Website Malware and Security Scanner.
  Python Other useful libraries and tools;Suds;https://fedorahosted.org/suds/;Lightweight Soap Client For Consuming Web Services
  Python Fuzzing;Sulley;https://github.com/OpenRCE/sulley;Fuzzer Development And Fuzz Testing Framework Consisting Of Multiple Extensible Components
  Scanning;SuperScan 4;http://www.mcafee.com/us/downloads/free-tools/superscan.aspx;Powerful Tcp Port Scanner, Pinger, Resolver. Superscan 4 Is An Update Of The Highly Popular Windows Port Scanning Tool, Superscan
  Analyze malicious URLs Malware;swftools;http://www.swftools.org/;Tools for working with Adobe Flashfiles.
  Windows Utils;Sysinternals Suite;https://technet.microsoft.com/en-us/sysinternals/bb842062;The Sysinternals Troubleshooting Utilities
  DDoS Tools;T50;https://sourceforge.net/projects/t50/;The More Fast Network Stress Tool
  Python Fuzzing;TAOF;http://sourceforge.net/projects/taof/;Proxyfuzz, A Man-In-The-Middle Non-Deterministic Network Fuzzer
  Scanning;TCP Fast Scan;http://www.stev.org/page/TCP-Fast-Scan.aspx;A Very Very Fast Tcp Port Scanner For Linux. Runs Very Quickly. Can Scan A Lot Of Hosts / Ports + Ranges At A Time.
  Traffic Analysis/Inspection;TCP-Reduce;http://ita.ee.lbl.gov/html/contrib/tcp-reduce.html;Tcp-Reduce Is A Collection Of Bourne Shell Scripts For Reducing Tcpdump Traces To One-Line Summaries Of Each Tcp Connection Present In The Trace. The Scripts Look Only At Tcp Syn/Fin/Rst Packets. Connections Without Syn Packets In The Trace (Such As Those On- Going At The Beginning Of The Trace) Will Not Appear In The Summary. Garbaged Packets (Those Missing Some Of Their Contents) Are Reported To Stderr As Bogon'S And Are Discarded. Occasionally The Script Gets Fooled By Retransmissions With Altered Sequence Numbers, And Reports Erroneous Huge Connection Sizes - Always Check Large Connections (Say 100 Mb Or More) For Plausibility.
  Traffic Analysis/Inspection;Tcpdpriv;http://ita.ee.lbl.gov/html/contrib/tcpdpriv.html;Tcpdpriv Is Program For Eliminating Confidential Information (User Data And Addresses) From Packets Collected On A Network Interface (Or, From Trace Files Created Using The -W Argument To Tcpdump). Tcpdpriv Removes The Payload Of Tcp And Udp, And The Entire Ip Payload For Other Protocols. It Implements Several Address Scrambling Methods  The Sequential Numbering Method And Its Variants, And A Hash Method With Preserving Address Prefix.
  Network;Tcpdump;http://www.tcpdump.org/;Collect network traffic.
  Network Tools;tcpdump/libpcap;http://www.tcpdump.org/;A Common Packet Analyzer That Runs Under The Command Line
  Traffic Analysis/Inspection;Tcpflow;https://github.com/simsong/tcpflow;A Program That Captures Data Transmitted As Part Of Tcp Connections (Flows), And Stores The Data In A Way That Is Convenient For Protocol Analysis Or Debugging. A Program Like Tcpdump Shows A Summary Of Packets Seen On The Wire, But Usually Doesn'T Store The Data That'S Actually Being Transmitted. In Contrast, Tcpflow Reconstructs The Actual Data Streams And Stores Each Flow In A Separate File For Later Analysis.
  Network;tcpick;http://tcpick.sourceforge.net/;Trach and reassemble TCP streams from network traffic.
  Traffic Analysis/Inspection;Tcplook;http://ita.ee.lbl.gov/html/contrib/tracelook.html;Tracelook Is An Tcl/Tk Program For Graphically Viewing The Contents Of Trace Files Created Using The -W Argument To Tcpdump. Tracelook Should Look At All Protocols, But Presently Only Looks At Tcp Connections. The Program Is Slow And Uses System Resources Prodigiously.
  Sniffer;Tcpreplay;http://tcpreplay.synfin.net/trac/;Tcpreplay Is A Suite Of Bsd Licensed Tools Written By Aaron Turner For Unix (And Win32 Under Cygwin) Operating Systems Which Gives You The Ability To Use Previously Captured Traffic In Libpcap Format To Test A Variety Of Network Devices
  Traffic Analysis/Inspection;Tcpslice;ftp://ftp.ee.lbl.gov/tcpslice.tar.gz;Tcpslice Is A Tool For Extracting Portions Of Packet Trace Files Generated Using Tcpdump'S -W Flag. It Can Combine Multiple Trace Files, And/Or Extract Portions Of One Or More Traces Based On Time.
  