These are the tools of a generalist, if you need to get something done without a fuss, look here.
A real person (me!) curated this list based on years of experience of IT/IR/SOC/Compliance/DevOps. I used Kagi Assistant & GLM-5.2 to handle formatting, scraping links, and fact-checking my memory.
For manipulating data to and from JSON-based APIs. Also great for templating when combined with go-task.
Ansible requires a lot of YAML, so I often build with yq. One of its benefits is that it also supports CSV — I prefer working with CSV over proprietary Excel formats (best when there aren't multiple sheets in a single workbook).
I've worked with developers on Linux, macOS, and Windows, and it's nice to have a tool that works across all of them. Multi-platform support is key.
A common thread with these tools: they run as a single binary with no prerequisites, which makes it easy to quickly transfer them to any system I'm troubleshooting or pulling data from.
When setting up a new machine, I rely on Ninite. My typical install:
- Vivaldi — Chromium-based, so well supported. Supports RSS feeds directly in the client, and Vivaldi Sync lets you define an encryption key so not even Vivaldi can see your data.
- Spotify — I've been a member since it was a UK-only service.
- Audacity — For editing sound clips for soundboards during streams and Discord calls.
- Discord — For game-based communities and talking to friends.
- 7-Zip — Because really, who's paying for WinRAR?
- Paint.NET — For quick image edits like removing transparencies.
- ShareX — For quickly marking up screenshots (redaction, step ordering, highlights, OCR via Tesseract).
- Everything (voidtools) — The fastest file search tool, and super lightweight.
- Notepad++ — It's lost some ground to VS Code and other editors, but the plugin support is still top-notch.
- WinSCP — The most reliable SFTP client I've found over years of troubleshooting.
- JsonTools — The tree view and filtering are extremely helpful for debugging API outputs.
- XML Tools — shudder If you have to work with XML, this is a huge help.
VS Code is my preferred markdown editor, with a few extensions:
- Markdown All in One — Adds nice QoL keyboard shortcuts, table building support, and other formatting autocompletes.
- Markdownlint — A linter is important because it catches inconsistencies and style issues as you write, ensuring your markdown renders correctly across different platforms and stays readable for both humans and tools.
- Markdown Preview Enhanced — Works great when combined with Pandoc. LaTeX support enables quite a lot of possibilities. Also allows previewing GitHub Flavored Markdown.
A one-liner to install the above on a new machine.
code --install-extension yzhang.markdown-all-in-one \
--install-extension davidanson.vscode-markdownlint \
--install-extension shd101wyy.markdown-preview-enhancedRemote Development: Admittedly, one major benefit of VS Code is its built-in support for attaching to containers and remote machines, which makes both local and remote development seamless. Your editor, extensions, and terminal all run in the context of the remote environment, so there's no need to replicate your setup on every machine. Not my style, but worth mentioning.
For testing markdown, I prefer markdown-it due to its adherence to CommonMark — arguably the original design spec for Markdown.
I've been following Figma since the early days. Adobe attempted to acquire them, but the deal fell through due to regulatory scrutiny — Figma subsequently went public via IPO instead. What fascinated me most about Figma was that they were one of the first companies to really incorporate multiplayer collaboration besides Google Docs.
Steve Ruiz seems like a really cool guy — some of his demos show just how expansive and customizable TLDraw is. Take a look at this ever-growingly prophetic demo.
TLDraw has roots in PartyKit, which is now used in Cloudflare Durable Objects. Go figure — Sunil Pai, the inventor of PartyKit, currently works at Cloudflare.
Another excellent whiteboard tool. Funny bit of history: Excalidraw runs on Socket.IO, which was invented by Guillermo Rauch — the founder of Vercel.
It's funny to imagine the origins of the Cloudflare vs Vercel rivalry starting out over whiteboard apps.
Notion is the most extensive platform I've used for building a knowledge repo. The extreme flexibility of everything being blocks allows you to easily build reusable templates, manage user access, and create beautiful dashboards. The only downside is that trying to leave Notion is quite a pain — the export capabilities are quite primitive. It's a cloud product, so I can quickly drop notes in from anywhere and access them from anywhere.
Obsidian is the gold standard of notes apps. The main flaw is that every non-local storage option has been kind of hacky. This has been changing in recent years as they improve Obsidian Sync and roll out mobile apps.
Extremely useful for trimming shortform clips, for when only a light touch is needed.
Uses the wonderful, internet load-bearing software FFmpeg. The middleweight of video editing.
If you are making a very big project that you want to be movie-grade, bring out the heavyweight.
Fully extensible, allows you to create product demos with ease. A great feature is the customizable instant replay feature — it allows you to have always-on recording but save on disc space.
Wrangle CSV files in scripts and search. Blazing-fast data-wrangling toolkit built in Rust.
A better Excel — terminal based, not for the faint of heart. True data lovers only. Use with WSL2 in windows. Use a modern terminal client as well.
I've recently converted and I'm a huge fan for its ease of use and impressed by its security features. I'd be willing to pay a few bucks to them to keep up the good work. Has SSO, MFA, clean logging .
This is a clean alternative to TeamViewer, open-source. I've found it works on every platform I've tried. I've moved my family IT support away from using Chrome Remote Desktop and just have them install RustDesk. If I can coach my grandma to install it, you can too .
I've personally not set this up, but I hear it's quite simple. The streets say easier than OpenVPN management.
I like to keep my homelab simple, but if you are interested in a well-supported software-based firewall, I'd pick one of these — leaning towards OPNsense for its open-source nature. There are plenty of guides on how to get it running on Proxmox .
Tried and true, verified over 10,000s of installs during my time at an MSP. There are free versions for home PC backup. Buy an external drive, be sure to encrypt your backup, check for data integrity, and run a full backup every two weeks. The peace of mind is priceless.
If you need a dead-easy, set-and-forget backup for your family members, cough up a couple bucks and get a Backblaze subscription. Loved by /r/datahoarders around the world.
Are you a true data hoarder? Running out of tape drives? Throw it all in an S3 Glacier bucket. It's the cheapest I've found.
The Swiss Army knife for email deliverability. MXToolbox SuperTool lets you run DNS lookups, blacklist checks, SMTP diagnostics, and SPF/DKIM/DMARC validation from a single web interface. Start with the blacklist check — enter your domain or IP and it checks 100+ DNS-based blacklists in seconds to see if you're flagged. The SMTP Diagnostic tool walks a mail server's EHLO handshake, STARTTLS, and authentication to pinpoint where delivery is breaking down. Free tier covers most day-to-day needs; paid Monitor service for ongoing alerting.
DMARC is the protocol that tells receiving servers what to do when SPF or DKIM alignment fails — and dmarcian is the tool that makes it manageable. Founded by Tim Draegen, one of the original co-authors of the DMARC specification. Upload your DMARC aggregate (RUA) XML reports and dmarcian's Domain Overview Dashboard shows you which sources are sending email as you, which are passing SPF/DKIM alignment, and which are failing — visually, in a way that actually makes sense. Free for a single domain; paid tiers for multi-domain visibility and ongoing monitoring . If you're responsible for email deliverability and haven't implemented DMARC, start here.
For most basic webpage troubleshooting, you can get by using the built in debugger of Chrome/Firefox. For closed source software, you gotta bring out the big guns.
An interactive HTTPS proxy that lets you intercept, inspect, and modify HTTP and HTTPS traffic in real time. Great for debugging API calls and seeing exactly what your apps are sending.
A classic web debugging proxy for inspecting HTTP/HTTPS traffic. The go-to for many Windows-based workflows.
The gold standard for network protocol analysis. When you need to dig into packets at every layer of the stack, this is the tool.
A modern, developer-friendly alternative to Fiddler/Charles. Open-source and great for intercepting and debugging HTTP from browsers, apps, and more.
It's one of the most widely adopted API clients for building, testing, and documenting HTTP requests. Supports environment variables, collections, and automated testing, making it a staple for anyone working with REST or GraphQL APIs. PayPal, Datadog, DocuSign, Microsoft, and others are all part of the Postman API Network and provide easy-to-use collections for testing.
If you're new to network troubleshooting, you can often find the basics by searching "tool + cheat sheet". Nmap cheat sheet will get you running with the basics, but I encourage you to do your own research.
A graphical traceroute and ping tool that's actively maintained — great for visualizing network latency and packet loss over time. Useful for diagnosing connectivity issues, gaming lag, and ISP problems. The 14 day trial provides enough time to diagnose most issues, but a license is pretty cheap.
A lightweight bandwidth testing tool. Run it between two machines to quickly diagnose network throughput issues. When they say the VPN makes their connection slow, you can use this do to point to point testing to prove, it was the user's home internet.
The undisputed standard for network scanning — 25+ years old and still actively maintained. Discovers hosts, maps open ports, and identifies services and OS fingerprints. Essential for answering "is this port actually open?" Runs as a single binary with no prerequisites. Available on Windows with the Zenmap GUI. Onboarding a new client? Help find those old boxes on the network hidden in the ceiling somewhere.
One of nmap's most powerful features is the Nmap Scripting Engine (NSE) — a built-in framework with over 600 Lua scripts that extend nmap from a port scanner into a full vulnerability detection, service enumeration, and network discovery platform. Scripts are categorized by purpose (vuln, brute, default, safe, etc.) and can be run with simple flags like --script vuln. A sample of scripts can be found here
The internet's most ubiquitous CLI tool, shipping on virtually every OS for 25+ years. If you need to test an HTTP request from a script or terminal, this is the tool. Single binary, no dependencies, transfers easily to any system.
A free command-line tool that checks a server's TLS/SSL configuration — ciphers, protocols, and known vulnerabilities (Heartbleed, POODLE, etc.). Single script, no dependencies. Widely recommended in sysadmin communities.
The industry-standard benchmark for TLS configuration. Enter a hostname and SSL Labs performs a deep analysis of your SSL/TLS setup — certificate chain, protocol support, cipher suites, key exchange strength, and known vulnerabilities (Heartbleed, POODLE, ROBOT, etc.) — then assigns an easy-to-understand A–F grade. The grading system makes executives happy when they see they have an A, but between you and me, a B is fine.
The world's most widely used network protocol analyzer — and for good reason. Wireshark captures live traffic from any interface, decodes over 3,000 protocols, and lets you drill into individual packets with a level of detail that borders on absurd. If you've ever needed to figure out exactly what's happening on the wire — a slow TLS handshake, a DNS resolution loop, a misbehaving RPC call — Wireshark is where you end up.
tshark is the CLI counterpart — same decoding engine, no GUI, perfect for remote servers and scripted analysis. Pipe traffic through tshark, filter with display filters, and export to JSON for downstream processing with jq. Captures can be taken with tshark on a headless server and opened in Wireshark on your desktop — the .pcap format is universal.
A few power-user tips:
- Use capture filters (BPF syntax) before capture to reduce noise:
tcp port 443 and host 10.0.0.5 - Use display filters after capture to drill down:
http.request.method == "POST"ortls.handshake.type == 1 - Follow TCP Stream (right-click a packet → Follow → TCP Stream) reassembles a full conversation into a single readable view — invaluable for debugging application-layer issues
- Wireshark can decode TLS traffic if you provide the session keys (set
SSLKEYLOGFILEenvironment variable in your browser/app) - For encrypted traffic you can't decrypt, the TLS dissector still shows you SNI, certificate details, cipher negotiation, and ALPN — often enough to diagnose the problem
Cross-platform (Windows, macOS, Linux), open-source (GPLv2), and actively maintained — Wireshark 4.5.0 shipped in 2025. The project began in 1998 as Ethereal and was renamed Wireshark in 2006 due to trademark issues. Supported by the Wireshark Foundation and a global community of contributors.
Pairs with nmap for discovery, testssl.sh for TLS auditing, and tcpdump for lightweight captures on systems where Wireshark isn't installed.
Mark Russinovich and Bryce Cogswell's legendary collection of over 70 Windows troubleshooting and diagnostic utilities, now maintained by Microsoft. Most tools are single EXEs — no install, no bloat, just unzip and run as Administrator. Standouts include Process Explorer (Task Manager on steroids), Process Monitor (real-time file system and registry activity), Autoruns (what's actually starting up on your machine), and PsExec (remote command execution). The full suite fits on a USB stick — a must-have troubleshooting kit.
The standout: Sysmon (System Monitor). Sysmon is a Windows system service and kernel-level device driver that, once installed, remains resident across reboots to monitor and log detailed system activity to the Windows Event Log — process creations with full command lines, network connections, file creation time changes, driver loads, and more. This is the kind of deep telemetry that Windows doesn't provide by default, and it's the foundation of serious endpoint detection and incident response on Windows.
Sysmon is so important that Microsoft has begun shipping it as a native built-in feature in Windows 11 and Windows Server 2025 — essentially "productizing" it due to its critical role in security monitoring. The built-in version supports the same custom configuration files and filtering rules, and events still go to the Windows Event Log .
Pair Sysmon with a community configuration like the SwiftOnSecurity config or NextronSystems fork for a solid baseline. Check out the TrustedSec Sysmon Community Guide for deeper guidance. I personally prefer https://github.com/olafhartong/sysmon-modular, but all the above are great references.
If you're doing any kind of security work on Windows and you don't have Sysmon deployed, you're flying blind.
The successor to Process Hacker (and Process Explorer by nature) — same team, same codebase, actively maintained under a new name. A free, powerful, multi-purpose tool for monitoring system resources, debugging software, and detecting malware. Provides real-time visibility into processes, services, network connections, GPU usage, and disk activity at a granularity that exposes even the stealthiest runaway processes. Supports light/dark themes, a detailed process tree with parent-child relationships, and plugin extensions.
Note: James Forshaw is, frankly, a genius. As a security researcher at Google Project Zero, he has uncovered countless Windows privilege escalation vulnerabilities and built an unmatched toolkit for analyzing Windows internals. He's also the author of Attacking Network Protocols and Windows Security Internals. Follow him on X/Twitter @tiraniddo, Mastodon @tiraniddo@infosec.exchange, or his GitHub @tyranid.
A PowerShell module that exposes the Windows NT Object Manager namespace — the internal kernel structure that manages all objects: processes, threads, files, events, sections, tokens, and more. Built on NtApiDotNet, it adds a PowerShell provider and cmdlets that let you navigate and inspect NT objects like a filesystem. Essential for sandbox attack surface analysis, security descriptor auditing, and deep Windows internals debugging.
The fastest open-source port scanner in existence — capable of transmitting 10 million packets per second and scanning the entire IPv4 internet in under 6 minutes from a single machine. Created by Robert Graham in 2013, its usage and parameters are similar to nmap, but it's designed for internet-scale reconnaissance rather than in-depth scanning of individual hosts. A common workflow is to use masscan for rapid broad discovery of open ports, then hand off the results to nmap for detailed service fingerprinting.
Caution: Do not run this tool against the entire internet all willy-nilly. You will get your home IP blacklisted from A LOT of websites and it will be a pain for everyone on your network.
A fast, customizable vulnerability scanner built on a simple YAML-based DSL, powered by a community-curated library of templates. It can scan thousands of hosts in minutes, making it a go-to for bug bounty hunters and security researchers.
Praise for PD: Nuclei is part of ProjectDiscovery, an open-source security company that builds an entire suite of tools following the Unix philosophy — each tool does one thing well and they pipe together seamlessly. Other standout tools in the ecosystem include subfinder (passive subdomain enumeration), httpx (multi-purpose HTTP probing), and naabu (fast port scanner written in Go). A typical recon pipeline:
subfinderto find subdomains →httpxto identify live hosts →nucleito scan for vulnerabilities.
I can't stress enough, they are really good at what they do.
The world's first search engine for internet-connected devices. Often called "the most dangerous search engine on the internet," Shodan indexes internet-facing devices and services — routers, webcams, industrial control systems, databases — rather than web pages. Invaluable for reconnaissance and understanding your own attack surface. I recommend following them on their socials, at some point every year they usually do a cheap $5 lifetime upgrade. It's a no-brainer pick up if you have any interest in cybersecurity.
A threat intelligence platform that helps you separate internet "noise" from real threats. GreyNoise collects and labels data on IPs that mass-scan the internet, so you can confidently identify which alerts are background noise vs. actual targeted attacks. Integrates with SIEMs, SOAR, and EDR platforms. The founder Andrew Morris is a bit of an odd guy, but that's what I like about em. Greynoise saves a lot of time during IR response.
The creator of GeoIP and the industry standard for IP geolocation data, trusted by businesses for 20+ years and covering 99.9999% of IP addresses in use. Offers downloadable databases (no per-query charges, no network latency) and API web services. Also provides GeoLite2, a free GeoIP dataset built with open source values. No need to pay platforms like IPInfo (still love them, but they are costly).
My advice? Setup a cronjob to download the updated GeoIP Database and tie it into your Elastic Search ingestion pipeline for effective and effcient coarse location tracking. For extra points, throw in ElastAlert2 and write a superman rule (impossible travel) to find out if your users are compromised.
A web-based Certificate Transparency (CT) log search engine that lets you find SSL/TLS certificates issued for a given domain or organization. An essential passive recon tool — search by domain name, organization, or certificate fingerprint to discover subdomains and exposed assets without generating any traffic against the target. CRT.SH is a reminder to not use Let's Encrypt for internal services even though it makes it simple. You may expose your internal hostnames unexpectedly.
Privacy note: crt.sh searches all CT logs, not just Let's Encrypt — any publicly-trusted certificate from any CA will appear here, because modern browsers require CT log submission for public trust. This is a reminder to be careful using public CAs like Let's Encrypt for internal/non-internet-facing services: your internal hostnames become publicly discoverable. For internal services, consider a private CA like step-ca or HashiCorp Vault to avoid exposing internal infrastructure through CT logs.
Forget how to use diskpart? Trying to find the right DISM command? SS64 has your back. A comprehensive command-line reference for Windows CMD, PowerShell, macOS/Linux bash, and SQL Server.
"An Excruciatingly Detailed Guide To SSH (But Only The Things I Actually Find Useful)." SSH tunnels are a red teamer's best friend, but they're also insanely practical for everyday sysadmin work. This guide breaks down port forwarding, jump hosts, and SSH config in a way that actually makes sense.
The Cyber Swiss Army Knife — a web app for encryption, encoding, compression, and data analysis, built by GCHQ. Found some malware? Start decoding that base64 with CyberChef. Runs entirely in your browser with no server-side component, so your data never leaves your machine.
Did you know SSH has a little-known secret menu? Rebane is a mystical computer wizard and the reason I have a strong appreciation for CSS — they also built x86CSS, a working x86 CPU emulator written entirely in CSS with no JavaScript.
Tony Redmond has made a career on explaining the dark hidden magic of Microsoft cloud products. This repo holds over 300 PowerShell scripts for interacting with Microsoft 365 and Entra ID, companion to the Office 365 for IT Pros eBook .
A curated list of awesome Microsoft Entra tools, guides, and resources. Merill Fernando is a Principal Product Manager on the Microsoft Entra team — as far as I'm concerned, he's the Father of Entra. He also runs a weekly Entra podcast and regularly shares Entra ID masterclass labs for free.
A long legacy of killer freeware utilities for Windows — password recovery, system tools, browser history viewers, network sniffers, and much more. All developed by Nir Sofer. Portable and incredibly useful for troubleshooting.
Pray you never need this tool. Microsoft's own MAPI editor that provides low-level access to Exchange and Outlook stores for troubleshooting the deepest, darkest mailbox corruption issues. Actively maintained — the June 2026 release is current.
User Profile Wizard (ProfWiz) and TransWiz are worth paying for. ProfWiz migrates user profiles between domains (including Azure AD) without copying data — it reconfigures the profile in place. TransWiz transfers a full user profile to a new machine. lifesavers for domain migrations and machine replacements.
Don't pay the big guys to migrate Exchange. These people are the real deal — their Kernel-branded tools handle EDB-to-PST conversion, Exchange migration, and PST repair. I've saved countless CEOs with multiple 50GB archives using their tooling.
The best disk space analyzer for Windows — period. WizTree reads the NTFS Master File Table (MFT) directly from the disk, bypassing Windows entirely, which gives it a massive performance advantage over every other tool in this category. Where WinDirStat crawls your drive file by file, WizTree scans an entire drive in seconds — often before WinDirStat has even finished loading.
DM Disk Editor and Data Recovery Software — the deep-recovery tool you reach for when everything else has failed. Developed by Dmitry Sidorov since 2006, DMDE uses special algorithms to reconstruct directory structure and recover files in complex cases where other tools fall short: formatted drives, partition manager failures, corrupted file systems, and RAID reconstruction. This tool is up there with Kernel for when your business needs a miracle.
Note: Adam (the person behind Hexacorn) is, like James Forshaw, a genuine pillar of the IT security community — a relentless researcher who has been publishing deep-dive Windows internals and malware analysis content since 2011. His "Beyond good ol' Run key" series alone is a masterclass in Windows persistence mechanisms, now spanning 155+ parts and still going. Follow him on X/Twitter @Hexacorn or his GitHub @hexacorn.
Over 15 years of original, previously-unpublished research on Windows internals, reverse engineering, malware analysis, and DFIR . Adam's background spans two decades working with law enforcement, governments, financial authorities, defense contractors, and consulting companies worldwide .
The blog is a treasure trove of obscure Windows knowledge — deep dives into persistence mechanisms (the "Beyond good ol' Run key" series is the definitive reference), LOLBins, atoms, mutexes, events, LNK file internals, and file format analysis. If you're trying to understand how malware actually persists on Windows — not just the well-known techniques, but the hundreds of obscure, undocumented ones — Hexacorn is where you end up. Referenced in books, conference presentations, and research by prominent security academics and practitioners worldwide.
His GitHub includes clean_exports (for export table analysis) and cleanset (clean file hashes for goodware baseline comparisons) .
Note: Eric Zimmerman is a SANS Principal Instructor, former FBI agent, and two-time SANS DFIR NetWars champion (2014, 2015) who has quite literally redefined digital forensics with his open-source tools — now global standards for cybercrime investigations. He teaches FOR508 (Advanced Digital Forensics, Incident Response and Threat Hunting) and is the award-winning author of X-Ways Forensics Practitioner's Guide . His work has directly enabled faster evidence analysis, rescued exploited children, and set new benchmarks in forensic response. If you do DFIR on Windows and you're not using his tools, you're making your life harder than it needs to be.
A suite of 30+ free, open-source Windows forensic tools — all actively maintained (current version 2026.5.0), digitally signed, and built on .NET 9. Most handle locked files (critical when working on live systems), and there's a PowerShell script (Get-ZimmermanTools) to download and auto-update everything at once.
Note: PingCastle was created by Vincent Le Toux — a renowned AD security expert, former CERT team lead at ENGIE Group, and contributor to mimikatz itself (he authored the DCSync, setntlm, and DCShadow features). He built PingCastle in his spare time, deployed it in a real-world enterprise setting at Vinci, and shaped it into the go-to tool for Active Directory security assessment. Follow him on X/Twitter @mysmartlogon or GitHub @vletoux.
"Get Active Directory Security at 80% in 20% of the time." PingCastle is a free, open-source tool that evaluates your AD security posture using a risk-based maturity framework inspired by CMMI. It maps known vulnerabilities exposed by tools like mimikatz and resources like adsecurity.org into actionable, prioritized recommendations. Produces a health check report with a letter grade (A–F) across multiple risk categories, a visual map of your domain, and immediate remediation steps. Now also supports Entra ID assessments. If you're responsible for an AD environment and you haven't run PingCastle, do yourself a favor and take it for a spin.
Note: Benjamin Delpy (gentilkiwi) is, without exaggeration, the godfather of modern Windows credential attack research. He originally wrote mimikatz to learn C and experiment with Windows security. It went on to expose and popularize virtually every major Windows credential attack technique: pass-the-hash, pass-the-ticket, Golden Tickets, Kerberoasting, DCSync, and more. Every blue teamer and defender owes him a debt — mimikatz forced Microsoft to confront and patch decades of weak credential handling in Windows. He currently works as Head of Security Services at Banque de France. Follow him on X/Twitter @gentilkiwi or GitHub @gentilkiwi.
A little tool to play with Windows security — and the single most influential credential dumping tool ever created. mimikatz extracts plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory, and can perform pass-the-hash, pass-the-ticket, Golden Ticket, and DCSync attacks. Written in C, it's the tool that red teamers reach for first and blue teamers study to understand what they're up against. The GitHub repo has 21.7k stars and is still maintained. Not a tool you deploy in production — a tool you learn from, test your defenses against, and respect.
Note: Sean Metcalf (@PyroTek3) is one of the most respected voices in Active Directory security. He is one of only about 100 people worldwide who hold the Microsoft Certified Master (MCM) Directory Services certification — an elite, invite-only credential that Microsoft retired in 2013. He is a former Microsoft MVP, has presented at Black Hat, DEF CON, BlueHat, RSA, Troopers, and BSides, and is co-host of the Enterprise Security Weekly podcast. Founder of Trimarc Security, now Identity Security Architect at TrustedSec. Follow him on X/Twitter @PyroTek3. Trimarc Security is Sean's consulting company performing work on behalf of TrustedSec.
ADSecurity.org is the definitive reference for Active Directory attack and defense. When mimikatz exposed DCSync, Golden Tickets, and Kerberoasting to the world, ADSecurity.org was where sysadmins went to understand what these attacks meant and how to stop them . The site covers AD architecture, Kerberos internals, attack methods, detection strategies, and hardening guidance — all written with the depth of someone who has personally assessed some of the largest, most complex AD environments in the world. If you've ever Googled "how does DCSync work" or "Kerberos Golden Ticket detection," you've landed on his work.
⚠️ Important: These are public cloud services — anything you submit may be visible to other users or the platform operators. Never submit potentially sensitive documents, internal files, or anything containing PII/credentials. For sensitive analysis, use a local sandbox (e.g., FlareVM, REMnux, or a dedicated VM) instead.
A sandbox for the web. Submit a URL and urlscan.io browses to it like a regular user in an isolated environment, recording everything — domains and IPs contacted, resources loaded, redirects, and a screenshot of the rendered page. Free, with a searchable public database of past scans that's invaluable for phishing investigations and threat intelligence.
An online browser sandbox that lets you interact with real browsers — Chrome, Firefox, Safari, Edge, Opera, even old IE versions — running in isolated virtual machines streamed to your browser. Great for safely opening suspicious links or files without risking your own machine, as well as cross-browser testing. Supports SSH tunnels for testing local apps without deploying them publicly.
Take potentially dangerous PDFs, Office documents, or images and convert them into safe PDFs. Originally created by Micah Lee at First Look Media, now maintained by the Freedom of the Press Foundation. Works like a photocopier — it renders your document into raw pixels inside a gVisor sandbox, then reconstructs a clean PDF from those pixels outside the sandbox, stripping any embedded malware or macros. Open-source (AGPLv3).
The OG of malware scanning — submit a file, URL, or hash and VirusTotal runs it against 70+ antivirus engines and website scanners simultaneously. Owned by Google (via Chronicle). Great for quick reputation checks, but remember that submitted files may be shared with security vendors.
An interactive malware sandbox — the standout feature is that you can actually control the VM in real-time, clicking through dialog boxes and interacting with the malware as it runs, just like a real user would. Extracts IOCs and maps behavior to MITRE ATT&CK in real-time. Free community tier with public submissions; paid tier for private analysis.
A free automated malware analysis service powered by CrowdStrike's Falcon Sandbox technology. Performs both static and dynamic analysis, generating detailed reports with network activity, API calls, and dropped files. Also includes a searchable public database of previously analyzed samples.
Deep malware analysis across Windows, macOS, Linux, and Android. Generates some of the most comprehensive reports in the industry — detailed behavioral analysis, network traffic, memory dumps, and signed/unsigned certificate analysis. Free "Cloud Basic" tier (public submissions); "Cloud Pro" for private analysis with full privacy.
A state-of-the-art malware analysis sandbox, now owned by Recorded Future (rebranded as "Recorded Future: Sandbox"). Known for its clean, fast interface and high-volume sample submission capabilities. Performs static and behavioral analysis with TTP mapping and configuration extraction for many malware families. Free individual tier with unlimited uploads (public results); paid tiers for private analysis.
If you've made it this far down the list. Thanks for reading. We're in the weeds now.
The modern Windows terminal experience. Windows Terminal brings tabs, panes, profiles, and GPU-accelerated rendering. Pair it with PowerShell 7 (the cross-platform, .NET-based version) for a shell that finally feels like it belongs in this century.
A fast, GPU-accelerated terminal emulator built in Zig by Mitchell Hashimoto (founder of HashiCorp). Prioritizes performance, low latency, and native platform integration without the bloat. A newer project but already making waves for its speed.
The minimal, blazing-fast, and infinitely customizable prompt for any shell — Bash, Fish, ZSH, PowerShell, Nushell, and more . Written in Rust, works on any OS, and shows relevant context (Git branch, language versions, k8s context) at a glance .
tmux is the battle-tested, ubiquitous terminal multiplexer — available on virtually every Unix system and remote server you'll ever touch . Zellij is a more modern alternative written in Rust, with sane defaults, on-screen keybindings (no memorization required), floating panes, and a WebAssembly plugin system . If you're learning from scratch, Zellij's discoverability is a huge win; if you're working on remote servers, tmux's near-universal availability makes it the safer bet .
Vim is not that hard, and it's worth learning due to its prevalence on every Unix distro ever. LazyVim transforms Neovim into a full-featured IDE with sensible defaults, LSP support, and lazy-loaded plugins — without the days of configuration that used to be required. Learn the basics on vim-hero.com or vim-adventures.com.
Replaces your shell history with a SQLite database, recording full context — timestamp, hostname, exit code, and working directory — for every command . Gives you fast, searchable history across all terminals and sessions, with optional end-to-end encrypted sync across machines . Host your own sync server or use theirs.
- broot — A new way to see and navigate directory trees. Think of it as an interactive
tree+cdreplacement. - lsd —
lsdeluxe. Adds icons, colors, and tree view to your directory listings. - bat — A
catclone with syntax highlighting and Git integration. - eza — A modern, maintained replacement for
exa(which was a replacement forls). Adds Git status, colors, and icons. - zoxide — A smarter
cdcommand that learns your most-used directories. Jump withzinstead of typing full paths. - fd — A simple, fast, user-friendly alternative to
find. Sensible defaults, no regex gymnastics required. - fzf — A general-purpose command-line fuzzy finder. Pipe anything into it for instant interactive filtering. Pairs perfectly with zoxide, fd, and shell history.
- ripgrep — The fastest recursive search tool available. Replaces
grepfor most use cases with sane defaults and respect for.gitignore. - zenith — A system monitor like
htopbut with graphs for CPU, GPU, disk, and network history. Rust-based. - jc — Converts the output of many CLI tools (ping, ifconfig, netstat, etc.) to JSON. Pipe
jcbefore your command and get structured data out. Pairs beautifully withjq. - gdu — A very fast disk usage analyzer written in Go. Finds what's eating your disk space in seconds.
- gum — A tool for creating glamorous shell scripts. Adds prompts, spinners, and interactive selection menus to your bash scripts with zero effort.
- delta — A syntax-highlighting pager for
git diff,grep, andblameoutput. Makes Git diffs actually readable. Configure it as your default Git pager. - toolong — A terminal application to view, tail, merge, and search log files (including very large ones). From the Textualize team.
- choose — A human-friendly and fast alternative to
awkandcut. Makes column-based text processing approachable. - jqfmt — A
jqprogram formatter and parser. Useful for cleaning up complexjqone-liners and making them readable.
- conda — For machine learning and data science when you need a full suite of pre-built packages and don't want to fight with native compilation.
- miniconda — For when you just need a nice, lightweight Python environment with conda's package management without the full Anaconda distribution.
- uv — An extremely fast Python package installer and resolver written in Rust, from the makers of
ruff. A better alternative tovenv— handles virtual environments, package installation, and Python version management all in one tool. 10–100x faster than pip. - ruff — An extremely fast Python linter and formatter written in Rust, also from Astral. Replaces flake8, isort, pydocstyle, and Black with a single tool and one config. 10–100x faster than existing Python linters — lints an entire large codebase in milliseconds.
- mise — A polyglot dev tool manager that handles language runtimes, environment variables, and task running from a single
mise.tomlfile. Supports Node, Python, Go, Rust, Terraform, and hundreds of other tools. Basically "uv for every language, not just Python." - Bun — An all-in-one JavaScript/TypeScript runtime, package manager, bundler, and test runner written in Zig. Ships as a single dependency-free binary. The "uv moment" for JS.
- Biome — A Rust-based linter and formatter (formerly Rome) that replaces both ESLint and Prettier with a single tool and one config. 97% Prettier-compatible formatting, 500+ lint rules from ESLint, and built-in import sorting.
- proto — A pluggable multi-language version manager from the moonrepo team (Rust-based). Supports Bun, Deno, Node, Python, Rust, Go, and 800+ tools through a single CLI with a WASM plugin architecture.
Made by the folks at Rackspace and trusted by the companies that manage your 401k. An identity-aware access proxy that consolidates access to all your infrastructure — SSH, Kubernetes, databases (PostgreSQL, MySQL, MongoDB, CockroachDB), Windows hosts, internal web apps, and even MCP for AI agents — into a single gateway. Uses short-lived certificate-based auth instead of shared SSH keys or static tokens, with MFA and SSO (GitHub, OIDC, SAML) for everything. Ships as a single Go binary, making it easy to deploy alongside the single-binary ethos of the other tools on this list.
A cross-platform GUI for magic-wormhole that lets you easily and safely share files, folders, and text between devices with end-to-end encryption. Built in Go, it compiles to a single native binary with no runtime dependencies and interoperates with other wormhole clients. The magic-wormhole protocol uses a short code (e.g., 7-banana-apple) that both parties enter to establish a secure transfer — no accounts, no servers storing your data.
A browser-based end-to-end encrypted file sharing service from Feross Aboukhadijeh (creator of WebTorrent) and John Hiesey. Files up to 5 GB are stored encrypted on their servers for 24 hours then permanently deleted; files larger than 5 GB transfer peer-to-peer directly from your browser to the recipient. All files are encrypted with 128-bit AES-GCM before they leave the browser, so the server can never read them. Free to use, with a Pro plan planned for larger file limit.
The open-source password manager — end-to-end encrypted, zero-knowledge architecture, and audited by third-party security firms. Offers free personal vaults with unlimited entries across unlimited devices, with affordable premium tiers for advanced features like TOTP, file storage, and hardware key support. I personally pay for bitwarden premium, as it's extremely affordable at less than $2/month, but self hosted open-source options are available. Cross-platform with clients for every browser, OS, and mobile device.
The lightweight, self-hosted Bitwarden server written in Rust — formerly known as bitwarden_rs. An unofficial but API-compatible alternative implementation that works with all official Bitwarden clients (browser extensions, desktop, iOS, Android). Runs on hardware as modest as a Raspberry Pi using under 50 MB of RAM. Pairs perfectly with Tailscale for secure remote access to your vault from anywhere.
The official Bitwarden command-line interface — access and manage your vault entirely from the terminal. Search passwords, retrieve items, generate secure passwords, and even pipe credentials into scripts without ever leaving the shell. Supports session-based unlocking so you authenticate once per shell session. Particularly powerful when combined with tools like fzf for interactive vault search or jq for parsing vault exports.
Brave does good work at helping stop tracking with its built-in ad blocker (Brave Shields) and anti-fingerprinting measures. Chromium-based, so extensions and web compatibility are well supported. A solid default for privacy-conscious browsing without sacrificing performance.
A community-driven Firefox derivative that lives on in the spirit of the discontinued Arc browser — clean, beautiful, and great for reading. Built on the Gecko engine, with a focus on minimalism, vertical tabs, and a distraction-free browsing experience.
From the Kagi team, Orion is the only browser I know of that has some support for standard browser extensions on macOS/iOS — supporting both Chrome and Firefox extensions on Apple platforms where extension support is typically locked down.
A privacy-focused browser developed in collaboration with the Tor Project, built to minimize tracking and fingerprinting. It has the same anti-fingerprinting protections as the Tor Browser, but connects to the internet via a VPN instead of the Tor network — giving you Tor-level privacy without the speed tradeoffs. All users share a similar fingerprint, making you blend into the crowd rather than stand out. No telemetry, private browsing by default.
A privacy-hardened Firefox fork with telemetry, DRM, and tracking removed by default. The Firefox-side equivalent of Brave's privacy-first approach — no accounts, no sponsored shortcuts, just a clean browser.
A Firefox fork with engine-level anti-fingerprinting written in C++ — modifies the browser at the deepest levels to spoof fingerprints in a way that can't be detected by JavaScript, making it extremely difficult for anti-bot systems to identify. Designed for automation and AI agents that need to bypass bot detection (Cloudflare, Google, etc.). Not a daily driver — this is a specialized tool for when you need a browser that genuinely looks like a real user to even the most aggressive fingerprinting systems.
A truly independent web browser built from scratch — a new engine, not based on Chromium or Firefox — by Andreas Kling (formerly Apple WebKit). Originally part of SerenityOS, now a standalone nonprofit project. An alpha release is planned for 2026, with beta in 2027 and stable in 2028. I'm following it closely but don't recommend it for daily use yet — it's still pre-alpha.