Cybersecurity Tools & Software
Tools for network analysis, security testing, forensics, monitoring and auditing, for authorised security work.
Who this toolkit is for
For security analysts, penetration testers, students and administrators working on systems they own or are authorised to assess. These tools support education, authorised testing and defence; Aptorise doesn't provide attack instructions.
Use these tools only on systems and networks you own or have permission to test.
Essential (4)
Core tools that are broadly useful.
Network Analysis
Knowing what normal traffic looks like is how you spot what isn't. These tools capture and map traffic on networks you are responsible for.
Web Application Security Testing
Intercepting proxies sit between a browser and a web application so you can inspect and modify every request. Test only applications you are authorised to assess.
Virtualisation / Lab Environment
Practise and test safely in isolated virtual machines that you can reset after every exercise.
VirtualBoxOpen Source
Why you may need this: Build an isolated lab of virtual machines for safe practice.
Homebrew (verified)brew install --cask virtualbox
Recommended (4)
Useful for particular parts of the work or course.
Network Analysis
Knowing what normal traffic looks like is how you spot what isn't. These tools capture and map traffic on networks you are responsible for.
- tcpdump
Open Source
Why you may need this: Capture traffic on servers.
Visit Official Website
Web Application Security Testing
Intercepting proxies sit between a browser and a web application so you can inspect and modify every request. Test only applications you are authorised to assess.
- Burp Suite Community Edition
Freemium
Why you may need this: Intercept and inspect web traffic during authorised testing.
Homebrew (verified)brew install --cask burp-suite
Digital Forensics
Examine disk images to reconstruct what happened on a system. Always work on a copy so the original evidence stays unchanged.
- Autopsy
Open Source
Why you may need this: Analyse disk images during investigations.
Visit Official Website
Specialist / Optional · Show specialist tools (7)
Consider these for particular modules, tasks or environments.
Digital Forensics
Examine disk images to reconstruct what happened on a system. Always work on a copy so the original evidence stays unchanged.
- The Sleuth Kit
Open Source
Why you may need this: Command-line forensic tools behind Autopsy.
Homebrew (verified)brew install sleuthkit
OSINT
Open-source intelligence tools gather publicly available information about an organisation's online footprint, usually at the start of an authorised assessment. Stay within the agreed scope and the law.
SpiderFootOpen Source
Why you may need this: Automate gathering public information during authorised assessments.
Visit Official Website- theHarvester
Open Source
Why you may need this: Collect public information about a domain.
Homebrew (verified)brew install theharvester
Defensive Monitoring
Detection starts with good data: detailed endpoint logs and network monitoring that alert on suspicious activity.
Incident Response
When something has happened, these help you collect evidence quickly across machines and find what is running or set to run at startup.
- Velociraptor
Open Source
Why you may need this: Collect evidence and visibility from endpoints during an incident.
Visit Official Website
Password Auditing
Test the strength of password hashes you are authorised to audit, for example to check that an organisation's password policy works.
- John the Ripper
Open Source
Why you may need this: Test password strength during authorised audits.
Homebrew (verified)brew install john
About this toolkit
Cybersecurity covers very different jobs. A security operations analyst spends most of their time in the defensive monitoring and incident response tools; a penetration tester lives in the web testing, OSINT and vulnerability assessment categories; a forensic investigator works mainly with disk images. Most people start with network analysis and a lab, because both are useful in every role.
Many security tools are built for Linux first. Greenbone, Lynis and theHarvester, for example, don't run natively on Windows, which is why many security professionals keep a Linux virtual machine or a Linux workstation alongside their main system. Choose your operating system above to see what runs on it, with verified installation commands where Aptorise has them.
Everything here is for systems you own or have written permission to test. Scanning, intercepting or attacking anything outside that scope can break the law, whatever the intention.
Build your Cybersecurity setup
Build My Setup lets you add or remove apps, combine roles, see why each app is included, and get a single install command where verified packages exist. Nothing is installed automatically.