# Choose a tool



Find a tool for your task and start with an example that runs.



Search for the job you need to do, then open a tool for a downloadable example, its inputs, and the result to look for. Run `GET /v1/tools` to check which tools are ready in your own deployment.



Find a toolCategoryAll categoriescloud-containers-and-iacdetection-engineeringfile-and-binary-analysisforensics-and-event-logsfuzzinghost-assessmentnetwork-discoveryobservation-componentsoffensive-validationpacket-analysispassword-auditingsource-and-dependenciesweb-testing



66 tools



| Tool / task | Category | Version | AWS snapshot |
| --- | --- | --- | --- |
| [AFL++](https://www.security.run/docs/tool-aflplusplus.html)Time-bounded instrumented fuzzing | fuzzing | `4.21c-5` | Qualified |
| [Amass](https://www.security.run/docs/tool-amass.html)Asset and domain discovery | network-discovery | `5.1.3-sr1` | Qualified |
| [Apktool](https://www.security.run/docs/tool-apktool.html)Android package inspection | file-and-binary-analysis | `2.7.0+dfsg-7` | Qualified |
| [Atomic Red Team](https://www.security.run/docs/tool-atomic-red-team.html)Native detection-test execution | detection-engineering | `2026.11.06-a0e3f9bc` | Qualified |
| [Bandit](https://www.security.run/docs/tool-bandit.html)Python source security checks | source-and-dependencies | `1.8.6` | Qualified |
| [BloodHound](https://www.security.run/docs/tool-bloodhound.html)Analysis of supplied identity graph data | offensive-validation | `9.9.2` | Qualified |
| [boofuzz](https://www.security.run/docs/tool-boofuzz.html)Time-bounded protocol fuzzing | fuzzing | `0.4.2` | Qualified |
| [Burp Suite](https://www.security.run/docs/tool-burpsuite.html)Automated web assessment integration | web-testing | `2026.10.1-0kali1` | Qualified |
| [Caido](https://www.security.run/docs/tool-caido.html)Web testing workflow integration | web-testing | `0.59.0` | Qualified |
| [CALDERA](https://www.security.run/docs/tool-caldera.html)Bounded adversary emulation job | detection-engineering | `5.3.0-0kali2-sr1` | Qualified |
| [capa](https://www.security.run/docs/tool-capa.html)Executable capability analysis | file-and-binary-analysis | `10.0.0` | Qualified |
| [Chainsaw](https://www.security.run/docs/tool-chainsaw.html)Search supplied Windows forensic artifacts | forensics-and-event-logs | `2.17.1` | Qualified |
| [Checkov](https://www.security.run/docs/tool-checkov.html)Infrastructure configuration checks | cloud-containers-and-iac | `3.2.495` | Qualified |
| [ClamAV](https://www.security.run/docs/tool-clamav.html)Signature checks on supplied files | file-and-binary-analysis | `1.4.3+dfsg-1` | Qualified |
| [CodeQL](https://www.security.run/docs/tool-codeql.html)Source query evaluation | source-and-dependencies | `2.27.4` | Qualified |
| [dnsx](https://www.security.run/docs/tool-dnsx.html)DNS queries and enumeration | network-discovery | `1.3.1` | Qualified |
| [ExifTool](https://www.security.run/docs/tool-exiftool.html)File metadata extraction | file-and-binary-analysis | `13.25+dfsg-1` | Qualified |
| [feroxbuster](https://www.security.run/docs/tool-feroxbuster.html)Web content discovery | web-testing | `2.13.1` | Qualified |
| [ffuf](https://www.security.run/docs/tool-ffuf.html)Bounded HTTP input fuzzing | web-testing | `2.1.0-1+b9` | Qualified |
| [FLOSS](https://www.security.run/docs/tool-floss.html)Executable string extraction | file-and-binary-analysis | `3.2.0` | Qualified |
| [Ghidra](https://www.security.run/docs/tool-ghidra.html)Headless binary analysis | file-and-binary-analysis | `12.2` | Qualified |
| [Gitleaks](https://www.security.run/docs/tool-gitleaks.html)Secret detection in supplied source | source-and-dependencies | `8.30.1` | Qualified |
| [Gobuster](https://www.security.run/docs/tool-gobuster.html)Directory and DNS discovery | web-testing | `3.6.0-1+b10` | Qualified |
| [Greenbone Vulnerability Management](https://www.security.run/docs/tool-gvm.html)Vulnerability management and scanning | web-testing | `25.04.3` | Qualified |
| [Grype](https://www.security.run/docs/tool-grype.html)Vulnerability checks on supplied inventory | cloud-containers-and-iac | `0.121.3` | Qualified |
| [Hashcat](https://www.security.run/docs/tool-hashcat.html)Bounded offline password audit | password-auditing | `6.2.6+ds2-1+b1` | Qualified |
| [Hayabusa](https://www.security.run/docs/tool-hayabusa.html)Windows event log detection and timelines | forensics-and-event-logs | `4.3.1` | Qualified |
| [httpx (ProjectDiscovery)](https://www.security.run/docs/tool-httpx.html)HTTP endpoint probing | network-discovery | `1.12.0` | Qualified |
| [Impacket](https://www.security.run/docs/tool-impacket.html)Network protocol tools and Python API | offensive-validation | `0.13.1` | Qualified |
| [John the Ripper](https://www.security.run/docs/tool-john.html)Bounded offline password audit | password-auditing | `1.9.0-jumbo-g37bebbe4` | Qualified |
| [Katana](https://www.security.run/docs/tool-katana.html)Scoped web crawling | network-discovery | `1.8.0` | Qualified |
| [kube-bench](https://www.security.run/docs/tool-kube-bench.html)Kubernetes benchmark checks | cloud-containers-and-iac | `0.16.0` | Qualified |
| [Kubescape](https://www.security.run/docs/tool-kubescape.html)Kubernetes configuration assessment | cloud-containers-and-iac | `4.0.20` | Qualified |
| [Lynis](https://www.security.run/docs/tool-lynis.html)Guest system audit | host-assessment | `3.1.4-1` | Qualified |
| [Metasploit Framework](https://www.security.run/docs/tool-metasploit.html)Native framework modules and payload tooling | offensive-validation | `6.5.7-0kali1` | Qualified |
| [NetExec](https://www.security.run/docs/tool-netexec.html)Scoped network service assessment | offensive-validation | `1.5.1` | Qualified |
| [Nikto](https://www.security.run/docs/tool-nikto.html)Web server checks | web-testing | `2.6.1` | Qualified |
| [Nmap](https://www.security.run/docs/tool-nmap.html)Service and port inventory | network-discovery | `7.95+dfsg-3` | Qualified |
| [Nuclei](https://www.security.run/docs/tool-nuclei.html)Template-based vulnerability checks | web-testing | `3.11.1` | Qualified |
| [oletools](https://www.security.run/docs/tool-oletools.html)Office document inspection | file-and-binary-analysis | `0.60.2` | Qualified |
| [OpenSCAP](https://www.security.run/docs/tool-openscap.html)Security content and benchmark evaluation | host-assessment | `1.4.2+dfsg-1` | Qualified |
| [osquery](https://www.security.run/docs/tool-osquery.html)Bounded guest inventory queries | host-assessment | `5.24.1` | Qualified |
| [OSV-Scanner](https://www.security.run/docs/tool-osv-scanner.html)Dependency vulnerability assessment | source-and-dependencies | `2.7.1` | Qualified |
| [OWASP Dependency-Check](https://www.security.run/docs/tool-dependency-check.html)Dependency vulnerability assessment | source-and-dependencies | `13.0.0` | Qualified |
| [OWASP ZAP](https://www.security.run/docs/tool-zap.html)Bounded automated web assessment | web-testing | `2.17.0` | Qualified |
| [PEASS-ng](https://www.security.run/docs/tool-peass-ng.html)Guest privilege configuration enumeration | offensive-validation | `20261109-f4fdadd7` | Qualified |
| [Plaso](https://www.security.run/docs/tool-plaso.html)Timeline extraction from supplied evidence | forensics-and-event-logs | `20241006-3` | Qualified |
| [PowerShell](https://www.security.run/docs/tool-powershell.html)Explicit script and inventory tasks | host-assessment | `7.6.9` | Qualified |
| [radare2](https://www.security.run/docs/tool-radare2.html)Scripted binary inspection | file-and-binary-analysis | `6.2.6` | Qualified |
| [SearchSploit / Exploit-DB](https://www.security.run/docs/tool-searchsploit.html)Search pinned exploit metadata | offensive-validation | `2026.10.27-f08907b1` | Qualified |
| [Semgrep](https://www.security.run/docs/tool-semgrep.html)Source rule evaluation | source-and-dependencies | `1.145.0` | Qualified |
| [Sigma CLI](https://www.security.run/docs/tool-sigma-cli.html)Rule conversion and validation | detection-engineering | `4.0.0` | Qualified |
| [sqlmap](https://www.security.run/docs/tool-sqlmap.html)Scoped SQL injection validation | web-testing | `1.9.6-1` | Qualified |
| [Subfinder](https://www.security.run/docs/tool-subfinder.html)Subdomain discovery | network-discovery | `2.17.0` | Qualified |
| [Suricata](https://www.security.run/docs/tool-suricata.html)Rule evaluation on supplied packet capture | packet-analysis | `1:7.0.10-1+deb13u4` | Qualified |
| [Syft](https://www.security.run/docs/tool-syft.html)Software inventory and SBOM generation | cloud-containers-and-iac | `1.57.1` | Qualified |
| [Sysmon](https://www.security.run/docs/tool-sysmon.html)Linux guest process and file event collection | observation-components | `1.6.0` | Qualified |
| [testssl.sh](https://www.security.run/docs/tool-testssl.html)TLS configuration checks | network-discovery | `3.2.5` | Qualified |
| [Tetragon](https://www.security.run/docs/tool-tetragon.html)Linux guest execution and IO collection | observation-components | `1.8.0` | Qualified |
| [Trivy](https://www.security.run/docs/tool-trivy.html)Image and configuration assessment | cloud-containers-and-iac | `0.76.2` | Qualified |
| [TruffleHog](https://www.security.run/docs/tool-trufflehog.html)Secret discovery and optional verification | source-and-dependencies | `3.99.8` | Qualified |
| [Volatility 3](https://www.security.run/docs/tool-volatility3.html)Supplied memory image analysis | forensics-and-event-logs | `2.28.2` | Qualified |
| [WhatWeb](https://www.security.run/docs/tool-whatweb.html)Web technology identification | network-discovery | `0.5.5-1` | Qualified |
| [WPScan](https://www.security.run/docs/tool-wpscan.html)WordPress assessment | web-testing | `4.2.0` | Qualified |
| [YARA](https://www.security.run/docs/tool-yara.html)Rules against supplied files | file-and-binary-analysis | `4.5.4` | Qualified |
| [Zeek](https://www.security.run/docs/tool-zeek.html)Protocol analysis of supplied packet capture | packet-analysis | `9.0.1` | Qualified |