I created the largest curated directory of cybersecurity tools and resources | Hacker News Reader

I created the largest curated directory of cybersecurity tools and resources

cybersectools.com

105 pointsnkokhreidze32 comments

I have a collection of web security tools and vulnerable apps for training, feel free to use the data:

https://github.com/vavkamil/awesome-bugbounty-tools

https://github.com/vavkamil/awesome-vulnerable-apps

Thank you for sharing. The list is impressive.

It's not finding Metasploit, Impacket or BloodHound (but instead Metasploit Cheat Sheets or PlumHound), which are absolute heavy weights in the offensive security sector. How did you gather that data?

"Feature Your Cybersecurity Product" - looks more like a marketing site.

Good catch, I had github link for Metasploit, added all three now.

I wouldn't put much weight on this.

It's a growth hack by OP for his cybersecurity consultancy (Mandos).

In general, you should learn about the tools after you master the fundamentals.

Understanding how OS, Networking, Web Development, DevOps, <insert_domain_here> works at a fundamental level will make it easier to become a well versed Security Practitioner.

Most attack vectors I've seen in the wild tend to be caused by some kind of misconfiguration (eg. Accidentally leaving a test app internet accesible) or sloppy architecture (eg. Not keeping an inventory of systems and dependencies).

The way to remediate that is by actually understanding how your underlying technology works.

An interesting idea, but it'll be tricky to keep it current, if you try to cover too wide an area.

Looking at just my area of interest I came across deprecated/inactive tools.

You might find it helpful to have a feedback mechanism on each tools page to let people provide feedback.

Thanks a lot for the tip. Will include the feedback function.

Added a feedback button for each tool page

I like it, would prefer a really condensed list instead of this.

Also, why do I get *featured Mandos products if the goal is to create the largest curated directory? Are you trying to get others to pay you to get featured or are you trying to increase your sales?

Featured will enable tool authors to showcase the product to visitors if they decide to do so. I do not think "largest curated directory" and "featured products" are mutually exclusive. Also curation, feature updates and maintenance takes a significant amount of my time and a portion for infra - already have over 50+ tools in queue to review. So featuring will help support the platform.

Thanks for the resource!

The style and layout of the page, personally speaking, doesn't work well for me. I had to lean far back in my chair in order to feel like I could comprehend the layout initially.

I'd love to see a text-based version of this, but it is just my own personal preference and I may be alone in it.

Text, or something like a CSV including descriptions would be great. A quick grep to find what you need.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

There once was an amazing culture (and a sense of community) around the curation of tools. Just as I was browsing cybersectools, I remembered exetools(.com), which amazingly still seems to exist. There are even some aesthetic similarities to this submission, I think.

I also vaguely remember a very large registry that specialized in packers for executables, but I can't remember the name. Those were great for reducing the size of executable files, among other things. I don't think that's even a thing anymore. Still good times.

I've noticed a lot of people use git repos as a way to crowd source this kind of data, and I'm currently working on tools to help in that situation: https://mastodon.online/@jarofgreen/112506346958981241

I've written in the past about these types of projects: https://opendataservices.coop/blog/2020/05/07/community-data...

The exetools website seems to be on its way out (domain for sale, no updates), which shows how hard it can be to get these types of projects to go well - I'm hoping I can help a bit!

I'm partial to https://tinyapps.org/ as an example of a nice curated collection of apps.

I also have fond memories of the tucows repository of PocketPC applications.

Rizin, Cutter, Radare2, BAP (Binary Analysis Framework), LIEF, and so many other tools aren't in the list. Please add them and probably many other that were missed.

They have a submission button, but it asks for a lot of info, it would be kind of nice if you could just paste a github repo and it would pull out the information.

Good idea! However, I want to ensure the high quality of tools through curation. Otherwise, many will submit their tools for backlinks and advertising purposes, turning the platform into a mess. After all, the end goal is to help cybersecurity professionals and leaders find the necessary tools.

added some from the list. thanks for sharing!

I submitted two open-source tools. The submission form has a field for 'License' in which the only two options are 'Free' and 'Commercial'. Those aren't licenses. Maybe adjust that field to either say 'cost' or 'terms', or actually have a license field which lets you paste an SPDX entry (or entries) or pick a license from a list.

Thanks for pointing out and also submitting tools. Will update the fields to clearly reflect the meaning.

Updated "License" to "Cost"

I have also added tags, better search and visibility to help community discover tools even faster! Thanks for all the feedback

[I'm not the target audience--don't work in security.]

To me 'largest' is the antithesis of 'curated'. What is the curation aspect to this collection? Are there comparisons between tools, rankings, etc? If it's just a popular misuse of 'curated' that's fine too, like 'literally' in sportscasting.

Thanks for the comment/feedback. Submitted tools undergo the review and are manually added to ensure high quality and reduce spam. Currently on the tool page you can see alternatives to each tool, but ranking and comparison is the next step.

It is possible there are many curated directories for cyber security tools. And this one claims the largest one.

That was my impression too. Better to have 500 highly enriched items with facets or tags to aid exploration and discovery.

There are more than a few Commercial tools flagged as Free, unless it means “free tier available” and not FOSS.

A tool usually fits into more than one category, so a 1:1 mapping increases the probability of not finding those tools.

Is there any way to find just Linux or Unix programs? Couldn't spot a way.

I just added tags that can help to filter out: https://cybersectools.com/tags/. Not all tags are super accurate but will improve on that as well

This is nice. I used to use tools.tldr.run in the past to find out tools in the past.

Reply on news.ycombinator.com