Cybersecurity Tools & Software
Tools for network analysis, security testing, forensics, monitoring and auditing, for authorised security work.
Who this toolkit is for
For security analysts, penetration testers, students and administrators working on systems they own or are authorised to assess. These tools support education, authorised testing and defence; Aptorise doesn't provide attack instructions.
Use these tools only on systems and networks you own or have permission to test.
Essential (4)
Core tools that are broadly useful.
Network Analysis
Knowing what normal traffic looks like is how you spot what isn't. These tools capture and map traffic on networks you are responsible for.
WiresharkOpen Source
Why you may need this: Inspect traffic and protocols in detail.
Winget (verified)winget install --id WiresharkFoundation.Wireshark --exact --source winget
NmapOpen Source
Why you may need this: Map hosts and services on networks you're authorised to assess.
Winget (verified)winget install --id Insecure.Nmap --exact --source winget
Web Application Security Testing
Intercepting proxies sit between a browser and a web application so you can inspect and modify every request. Test only applications you are authorised to assess.
Virtualisation / Lab Environment
Practise and test safely in isolated virtual machines that you can reset after every exercise.
VirtualBoxOpen Source
Why you may need this: Build an isolated lab of virtual machines for safe practice.
Winget (verified)winget install --id Oracle.VirtualBox --exact --source winget
Recommended (5)
Useful for particular parts of the work or course.
Web Application Security Testing
Intercepting proxies sit between a browser and a web application so you can inspect and modify every request. Test only applications you are authorised to assess.
- Burp Suite Community Edition
Freemium
Why you may need this: Intercept and inspect web traffic during authorised testing.
Winget (verified)winget install --id PortSwigger.BurpSuite.Community --exact --source winget
Digital Forensics
Examine disk images to reconstruct what happened on a system. Always work on a copy so the original evidence stays unchanged.
- Autopsy
Open Source
Why you may need this: Analyse disk images during investigations.
Visit Official Website
Defensive Monitoring
Detection starts with good data: detailed endpoint logs and network monitoring that alert on suspicious activity.
Incident Response
When something has happened, these help you collect evidence quickly across machines and find what is running or set to run at startup.
- Process Explorer
Free
Why you may need this: Investigate suspicious processes on Windows.
Winget (verified)winget install --id Microsoft.Sysinternals.ProcessExplorer --exact --source winget - Autoruns
Free
Why you may need this: Check autostart locations for persistence.
Winget (verified)winget install --id Microsoft.Sysinternals.Autoruns --exact --source winget
Specialist / Optional · Show specialist tools (8)
Consider these for particular modules, tasks or environments.
Digital Forensics
Examine disk images to reconstruct what happened on a system. Always work on a copy so the original evidence stays unchanged.
- The Sleuth Kit
Open Source
Why you may need this: Command-line forensic tools behind Autopsy.
Visit Official Website
OSINT
Open-source intelligence tools gather publicly available information about an organisation's online footprint, usually at the start of an authorised assessment. Stay within the agreed scope and the law.
SpiderFootOpen Source
Why you may need this: Automate gathering public information during authorised assessments.
Visit Official Website
Incident Response
When something has happened, these help you collect evidence quickly across machines and find what is running or set to run at startup.
- Velociraptor
Open Source
Why you may need this: Collect evidence and visibility from endpoints during an incident.
Visit Official Website
Security Auditing
Check systems against good configuration practice, and confirm that files and programs are properly signed.
Password Auditing
Test the strength of password hashes you are authorised to audit, for example to check that an organisation's password policy works.
- John the Ripper
Open Source
Why you may need this: Test password strength during authorised audits.
Visit Official Website - Hashcat
Open Source
Why you may need this: GPU-accelerated password auditing for authorised audits.
Visit Official Website
Virtualisation / Lab Environment
Practise and test safely in isolated virtual machines that you can reset after every exercise.
- Windows SandboxBuilt into Windows
Why you may need this: Open untrusted files in a disposable environment.
Turn Windows features on or off > Windows Sandbox 
QEMUOpen Source
Why you may need this: Fast virtual machines on Linux with KVM.
Winget (verified)winget install --id SoftwareFreedomConservancy.QEMU --exact --source winget
About this toolkit
Cybersecurity covers very different jobs. A security operations analyst spends most of their time in the defensive monitoring and incident response tools; a penetration tester lives in the web testing, OSINT and vulnerability assessment categories; a forensic investigator works mainly with disk images. Most people start with network analysis and a lab, because both are useful in every role.
Many security tools are built for Linux first. Greenbone, Lynis and theHarvester, for example, don't run natively on Windows, which is why many security professionals keep a Linux virtual machine or a Linux workstation alongside their main system. Choose your operating system above to see what runs on it, with verified installation commands where Aptorise has them.
Everything here is for systems you own or have written permission to test. Scanning, intercepting or attacking anything outside that scope can break the law, whatever the intention.
Build your Cybersecurity setup
Build My Setup lets you add or remove apps, combine roles, see why each app is included, and get a single install command where verified packages exist. Nothing is installed automatically.