wireshark

Tsunami Security Scanner

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.

Maltrail

Malicious traffic detection system

Arkime

Arkime is an open source, large scale, full packet capturing, indexing, and database system.

Dnscat2

dnscat2 is a tool designed to create an encrypted command-and-control (C&C) channel over the DNS protocol. It enables secure communication and data tunneling out of restricted networks by leveraging DNS queries and responses, making it effective for penetration testing and secure remote access. ## Key Features - **Encrypted Communication** — All traffic is encrypted by default using ECDH key exchange, Salsa20 encryption, and SHA3 signatures. - **DNS Protocol Tunneling** — Uses DNS queries/responses to bypass firewalls and network restrictions, appearing as normal DNS traffic. - **Flexible Deployment** — Supports both authoritative DNS server traversal (stealthy) and direct UDP connections (faster). - **Session Management** — Provides an interactive console with multiple windows for managing clients, shells, and tunnels. - **Data Tunneling** — Can tunnel any data, including file transfers, shell sessions, and TCP connections (via port forwarding). - **Cross-Platform Client** — The client is written in C with minimal dependencies, running on Linux, Windows, FreeBSD, and macOS. ## Philosophy dnscat2 is purpose-built for command and control, prioritizing encryption and flexibility over generic internet tunneling. It treats DNS as a transport layer, enabling robust, protocol-agnostic data exchange.