SecAnaly Tools

15 tools you should know as a Security Analyst


Whether you’re looking to break into cyber security, already working in a SOC, penetration tester or consulting, it’s essential to know robust analytical tools. Such tools will help you do your job right, a lot of which you don’t have to pay a penny. The web has a vast range of free available tools to aid you with your projects, regardless of what subset of infosec you’re in. Alright, enough of stating the obvious and I’ll get to the point. Here they are:

VirusTotal


VirusTotal is among the most popular online malware analysis tools. It allows you to upload files, IP Addresses, hashes, and URLs for scanning by multiple antivirus engines. It can help security analysts quickly identify threats and take appropriate actions in investigations. Other notable features are threat intelligence capabilities, detailed analysis reports, and a free API you can use to implement into your code.

URLScan.io


URLScan can check URLs for potential security threats. It uses a combination of reputation checks and static analysis to identify malicious content and generate detailed findings. Key features include custom scans, deep analysis, and an easy-to-use interface.

BrowserLing


Need a quick burner browser for testing? Then this tool is right for you! BrowserLing allows you to detonate suspicious URLs and test website links for compatibility and security issues. It supports a wide range of browsers and operating systems, providing real time visualization analysis. It can really come in handy for phishing email investigations.

Shodan


This is a popular search engine for internet-connected devices, often used by security researchers and penetration testers. The tool can help identify vulnerable IoT systems and servers, providing detailed info on their operating systems, configuration, and potential attack vectors. In my experience, it is useful during OSINT investigations and vulnerability analysis. I’ve come across internet facing web cameras, vulnerable web servers, and even industrial control systems!

Spur


Spur is an open-source threat intelligence platform that allows security analysts to collect, analyze, and share threat intelligence data. The tool provides real-time monitoring, advanced analytics on IPs and endpoints, automated threat detection and response capabilities. Key features include customizable dashboards, flexible data sources, and powerful analytics.

Hybrid Analysis


This is an online malware analysis platform that analyzes suspicious files and URLs in a safe, sandboxed environment. The tool provides comprehensive findings on the behavior and potential impact of the analyzed content, helping analysts identify potential threats and take appropriate action. Key features include advanced malware analysis capabilities, detailed reports, and an easy-to-use interface.

Phish Tank


Phish Tank is a community-driven database of known malicious websites, which can help identify phishing entities. Security professionals and enthusiasts can contribute to the database by reporting new phishing sites.

CheckPhish.ai


CheckPhish.ai is an AI-powered phishing detection tool that quickly identifies threats. The tool uses advanced machine learning algorithms to analyze email content, IP addresses and domain names. In addition, it can passively discover associated subdomains and entities to a particular target.

AlienVault OTX

This is an open threat intelligence platform where you can access and share threat intelligence data. The tool also contains real-time monitoring, threat intel analytics, enhanced threat detection and response capabilities of networks and endpoints. Other notable features include customizable dashboards, flexible data sources, and powerful analytics.

App.any.run


Another online malware analysis platform that allows security analysts to run and analyze suspicious files and URLs in a safe and controlled environment. The tool provides real-time behavioral and threat intelligence analysis. You can choose a variety of windows operating systems (paid version) for testing. Overall, it’s good for threat hunting.

Microsoft Remote Connectivity Analyzer


This is a web-based tool that allows you to evaluate and troubleshoot Microsoft Office 365 and Exchange Server connectivity issues. The tool provides detailed reports and diagnostic information, helping system administrators identify and resolve issues quickly. For security, analysts can use this tool to review email headers for investigations.

Windows Sandbox


This is a built-in feature in Windows 10/11 that allows security analysts to safely run and evaluate untrusted applications and files. The tool creates a secure, isolated environment that does not affect the host operating system or installed applications. Unlike traditional virtual machine environments, nothing is saved or remains persistent on the machine after use. Its only limitations are that it’s available on windows 10/11 pro editions.

NetworkChuck Cloud Browser


Another nifty tool I stumbled across recently. This program provides a secure browsing environment for testing suspicious links and browsing with enhanced privacy. Think of it as like a “burner phone” for your browsing. It’s like windows sandbox, but cloud based. You can view more about it in the link below (note: skip to 7:21).

PolySwarm


PolySwarm is a decentralized threat intelligence marketplace that allows security analysts to access and share threat intelligence data. Features include advanced threat analytics, automated and early detection triage, and response capabilities. Other features include customizable dashboards, flexible data sources, and powerful analytics. It is like virus total, but with a slightly more user-friendly interface.

DNSDumpster


Whether you’re bug bounty hunting or performing OSINT Investigations, DNSDumpster is great for reconnaissance. It provides detailed information on DNS records and domains. One of my favorite features about is the graphical representations of results.

Please note that the tools mentioned have free access features which are limited. Further features are paid. However, in my experience, I haven’t felt a need to pay for further features. Whether you choose to do so is your call. Hope you found this article useful!

Comments

Post a Comment

Popular posts from this blog

Why Certifications Methods?

Image
Hey there, Let’s take a step back and change our perspective: Approach certifications as a means to enrich your knowledge and skills, rather than merely a stepping stone to monetary gain or career advancement. Certifications should be about self-improvement and mastery , not just a checkbox on a resume. Embrace the journey of learning for its own sake, and watch how it transforms your personal and professional life in ways you never imagined. The Real Reason Behind Certifications The commercial marketing driving force of certifications is often centered around securing a new or better job. But I urge you to reconsider if this is your primary motivation . Take a moment to reflect on your personal development and your deepest interests within the realm of technology.  Is your passion in: Programming Crafting elegant code and solving complex problems? System Administration, Ensuring seamless operations and managing vast networks? Data Analytics Unraveling the stories hidden within data?
Read blog »

CCNP 03 - WANS

Image
WAN Problem Areas Certification Objectives Point-to-Point Protocols Switched Protocols      In this chapter, we will discuss troubleshooting point-to-point and switched protocols. It’s very important to understand the concepts and functionality of each protocol. We will discuss the HDLC and SDLC encapsulation methods, as well as both CHAP and PAP authentications via PPP. We will identify ISDN, Frame Relay, X.25, SMDS, and ATM transmissions and common problems associated with each of them. Point-to-Point Protocol      In the 1980s, the Internet really started to come to life due to its usage by the U.S. government, universities, and large corporations. These hosts were being supported by the Internet Protocol (IP) and connected via a series of LANs. The most common of these LANs was the Ethernet. Other hosts were connected through WANs, using technologies such as X.25. This eventually evolved into the need to transmit data via the original method used before networking was ever establis
Read blog »

CEH H9 - Zero Trust

Image
https://hakin9.org/security-of-zero-trust/ Security of Zero Trust Introduction In today's digital age, where cyber threats loom large and data breaches make headlines far too often, the need for robust security measures has never been more critical. Organizations worldwide are grappling with the challenge of protecting their sensitive information and critical assets from increasingly sophisticated attacks.[1] Zero Trust, a revolutionary cybersecurity strategy that challenges the conventional notion of network trust, has arrived. Unlike perimeter-based models that assume users and devices are trusted once inside the network, Zero Trust employs a more cautious and proactive approach. It assumes that no user or device should be inherently trusted, regardless of their location or network connection. But what is Zero Trust exactly? Zero Trust is a security framework that adheres to the concept "never trust, always verify". It advocates for the continuous authentication and aut
Read blog »