Security Tools
Small, practical tools for security analysis, alert investigation, and web security posture auditing. Built to solve real workflow friction for analysts and developers.
Only assess domains, URLs, or hosts you own or have explicit authorization to test. This tool is intended solely for defensive security analysis, posture auditing, and authorized assessment.
Data Collected: Publicly observable HTTP response headers and standard DNS TXT/MX records. No active probing, port scanning, or intrusive payloads.
Find these free security tools useful? Buy me a coffee!
All tools run without ads, telemetry tracking, or paid subscriptions. If this saved you time during an incident triage, header audit, or threat hunt, a small coffee contribution helps keep the servers alive and fuels new tool development.
Web Security
Website Security Check
AvailablePassive assessment of website security posture including HTTP security headers, TLS observations, and DNS security records.
- •Checks HTTP Security Headers (CSP, HSTS, X-Frame-Options, etc.)
- •Inspects DNS email security records (SPF, DMARC, MX)
- •Detects exposed web server software banners
- •Provides copy-pasteable remediation configs for Nginx, Apache, and Next.js
Security Header Analyzer
AvailableEvaluates individual HTTP response headers against current defensive best practices and provides remediation guidance.
- •Comprehensive audit of 6 essential defensive headers
- •Semantic color coding (Pass, Warning, Missing)
- •Detailed rationale and threat mitigation context for each header
- •Direct copy-ready configuration snippets
SOC Utilities
IOC Extractor & Defanger
AvailableExtracts, deduplicates, and defangs Indicators of Compromise (IPs, domains, hashes, URLs, CVEs) from raw logs and text.
- •Extracts IPv4, IPv6, Domains, URLs, Email Addresses, MD5, SHA-1, SHA-256, and CVEs
- •One-click defanging toggle to neutralize dangerous links and addresses
- •Local-only in-browser execution with zero server data retention
- •Export results as formatted plain text or structured JSON
Phishing Email Header Analyzer
In developmentParses raw RFC 822 email headers to trace Received hop latency, verify SPF/DKIM/DMARC authentication, and flag spoofed return paths.
- •Hop-by-hop Received header timeline parsing
- •Authentication-Results header validation
- •Display name spoofing and envelope mismatch detection
Threat Intelligence
Suspicious URL Analyzer
AvailableInspects URLs for heuristic risk factors such as suspicious TLDs, IP hosts, excessive subdomains, and obfuscated query strings without visiting the target.
- •100% safe inspection: Does not send outbound HTTP requests to the target URL
- •Identifies IP-based hostnames, deceptive subdomains, and suspicious keywords
- •Decodes URL-encoded parameters and character sets
- •Outputs standardized defanged URL format (hxxps[://]...)
Developer Security
CVE & Vulnerability Advisory Search
In developmentSearch utility for National Vulnerability Database (NVD) entries, CVSS scores, and known exploited vulnerabilities (KEV).
- •NVD API synchronization
- •CISA Known Exploited Vulnerabilities catalog integration
- •CVSS v3.1 vector metric breakdown