Security Engineering & OSINT Repository

Open Source Cybersecurity Tools Directory

Explore the curated index of authoritative open-source security projects, OSINT scripts, and core threat scanning databases. Supported by the ReconShield security research community.

Last Directory Review: June 6, 2026•License Paradigm: MIT & GPL Permissive

Critical Security Disclaimer & Ethical Usage

All tools cataloged within this directory must be used strictly for ethical security auditing, authorized vulnerability testing, and educational research purposes. Executing active scans, port sweeps, or exploit probes against network infrastructures without explicit, written authorization from the asset owner is illegal and constitutes a violation of computer security laws (such as the US Computer Fraud and Abuse Act - CFAA). Users are fully responsible for ensuring compliance with local legal frameworks prior to launching scanning routines.

ReconShield Open Source Repositories

Security Headers Knowledge Base

Community-driven configuration templates, validation rules, and parser specifications for security headers (CSP, HSTS, XFO).

License: MITBranch: main

View Repository Analyze Site with HTTP Header Grader →

SSL/TLS Knowledge Base

Handshake profiling scripts, cipher suite risk classifications, and CA trust root verification databases.

License: MITBranch: main

View Repository Analyze Site with SSL Checker →

Port Security Knowledge Base

Standard service banner signatures, risk metrics, and firewall configuration syntax definitions (UFW/iptables).

License: MITBranch: main

View Repository Analyze Site with Port Scanner →

Subdomain Intelligence Knowledge Base

Passive enumeration heuristics, Certificate Transparency log parsers, and dangling DNS takeover templates.

License: MITBranch: main

View Repository Analyze Site with Port Scanner →

Curated Industry-Standard Security Directory

OSINT (Open Source Intelligence) Tools

SpiderFoot

Github

An automated OSINT reconnaissance tool that integrates with over 100 public data sources to gather intelligence on IPs, domain names, e-mails, and netblocks.

PRIMARY USE CASE:Perform automated passive attack surface mapping and locate leaking administrative subdomains or leaked files.

Recon-ng

Github

A full-featured Web-based Reconnaissance Framework written in Python, complete with independent modules, database interaction, and API integrations.

PRIMARY USE CASE:Construct open-source intelligence databases of corporate assets, subdomains, and contact email profiles.

DNS & Domain Mapping Tools

OWASP Amass

Github

In-depth DNS active and passive subdomain enumeration, mapping, and attack surface discovery using open-source data aggregation.

PRIMARY USE CASE:Create exhaustive mappings of an organization's external DNS boundaries and monitor asset registration changes.

dnsrecon

Github

A powerful Python script used to perform DNS zone transfers, PTR record checks, wildcard resolution detection, and SRV record enumeration.

PRIMARY USE CASE:Audit nameserver configurations and identify dangling DNS records susceptible to domain hijacking.

Email Security & Authentication Tools

SPF-Tools

Github

A suite of Python scripts designed to parse, analyze, and test SPF records, assisting in resolving lookup limits and syntax structure errors.

PRIMARY USE CASE:Deconstruct nested SPF include blocks to optimize DNS lookup queries below the hard IETF limit of 10.

DKIMpy

Github

A Python library that implements DomainKeys Identified Mail (DKIM) and Author Domain Signing Practices (ADSP) signature verification and generation.

PRIMARY USE CASE:Programmatically sign outbound messages and validate DKIM public selector keys in DNS.

Vulnerability Scanners

Nuclei

Github

A fast and customizable vulnerability scanner based on simple YAML templates, allowing researchers to target specific CVE indicators.

PRIMARY USE CASE:Auditing endpoints for fresh zero-day vulnerabilities and configuration discrepancies across a distributed host fleet.

OWASP ZAP (Zed Attack Proxy)

Github

A popular, open-source web application security testing utility designed to locate vulnerabilities like SQL injection and XSS.

PRIMARY USE CASE:Run automated vulnerability scans against staging applications as part of a secure CI/CD pipeline.

Threat Intelligence Tools

MISP (Malware Information Sharing Platform)

Github

An open-source threat intelligence platform used to share, store, and correlate Indicators of Compromise (IoCs) of targeted attacks.

PRIMARY USE CASE:Store and share IP reputation blocks, file hashes, and active botnet domains across trust groups.

OpenCTI

Github

A modern threat intelligence platform designed to structure, store, and visualize technical and tactical threat intelligence data.

PRIMARY USE CASE:Construct semantic knowledge graphs of threat actor relationships, target profiles, and malware families.

Reconnaissance & Network Auditing Tools

Nmap (Network Mapper)

Github

The industry-standard open-source network scanner used for host discovery, port scanning, OS identification, and service version checks.

PRIMARY USE CASE:Identify active network hosts, discover open TCP/UDP ports, and check banner versions during perimeter security audits.

Masscan

Github

An extremely fast internet port scanner that transmits SYN packets asynchronously, capable of scanning the entire internet in under 6 minutes.

PRIMARY USE CASE:Perform rapid, large-scale sweeps of IP blocks to locate exposed services and databases.

Contributor Covenant Guidelines

We welcome code reviews, issue alerts, and database updates. Please read our official contributor guidelines within the respective repository. Keep pull requests focused on adding vulnerability indicators, fixing documentation discrepancies, or extending Nginx/Apache configuration snippets.

MIT Licensing & Standard Permissions

All databases are free to copy, modify, distribute, and include in commercial applications. We believe that open access to cybersecurity signatures and standards is essential to secure modern digital ecosystems.