One workspace
Move between investigation tools without unnecessary navigation. A sender domain found in an email is one click from its mail policy and its infrastructure.
Free digital investigation tools
Investigate emails, domains and servers from one place.
Nine practical security tools for everyday investigations. Analyze suspicious emails, inspect domain security, investigate network services and transform data, without creating an account.
- No account required
- Free tools
- Browser-side processing where supported
- Public API
Domain investigation
Illustrative sample
example.com Check
6 related entities
Findings for example.com
3 pass 1 warning 1 critical
- Content-Security-Policy missingInjected scripts would run with the page's rights.
- No DKIM key on common selectorsConfirm the selector used by the sender.
- DMARC set to quarantineSpoofed mail is sent to spam.
SPF and HSTS also pass.
Detailed report →DNS, WHOIS and HTTP checks query public sources · nothing is stored
Files processed in the browser where supported
No account required
Public API
Open port dataset
OSINT tools, email analysis tools, cybersecurity investigation tools online
Tools for every investigation
Pick a tool based on what you have in hand.
- EMAILEML AnalyzerAnalyze EML files and email headers..eml · .msg fileOpen →
- EMAILSPF, DKIM & DMARC CheckerTest a domain's email authentication and anti-spoofing setup.domainOpen →
- WEBSecurity Headers CheckerGrade a website's CSP, HSTS, cookies and HTTP headers.urlOpen →
- NETWORKPort LookupWhat runs on a TCP or UDP port, its risk and how to secure it.port 0-65535Open →
- OSINTOSINT HubExplore open source intelligence tools.domain · ip · hashOpen →
- DATADataForgeEncode, decode, hash & transform data in recipes.text · bytesOpen →
- OFFENSIVEReverse Shell GeneratorGenerate reverse shell payload references.authorized useOpen →
- DATASecure TransferSend end-to-end encrypted, self-destructing files.any fileOpen →
- OFFENSIVELOLBAS CheckerMatch commands to known living-off-the-land binaries.command · binaryOpen →
Built for the work between alerts.
A security analyst often needs several different tools to investigate one suspicious email, domain, server or artifact. CyberHunter brings practical tools together in one accessible workspace.
.eml parsing, hashes, QR codesin your browser DataForge, LOLBAS, shell referencesin your browser DNS, WHOIS, HTTP headerspublic sources Secure Transferencrypted upload
Privacy-conscious workflows
Email files and data transforms are processed in your browser. Domain, DNS and header checks query public sources, and each tool says which one applies.
Content-Security-PolicyCritical Without a CSP, an injected script runs with the page's full rights. Start with a report-only policy.
Practical technical output
Each finding comes with what it means and what to change, so results are usable by a developer as much as by an analyst.
Vulnerability news
Short explainers of the vulnerabilities worth a patch cycle: what the flaw is, who is exposed, what to do.
All news →Built by a SOC analyst, for everyday investigations.
CyberHunter started as a set of utilities an analyst kept open during triage: a header parser, a mail security checker, a WHOIS lookup, a decoder. It brings those commonly used security utilities into one place, free and without an account. The port database is published as an open dataset and every tool has a public API.
About the project →- Tools
- 9
- Ports documented
- 65,536
- Account
- none
- Dataset license
- CC BY 4.0
Start your next investigation.
Open a tool and get straight to work.