Furkan İkkan Türkçe
Back to posts
Post

· Network & System Administrator

Lesser-Known Cybersecurity Tools That Security Pros Actually Use

Discover lesser-known but effective cybersecurity tools that pros rely on daily. From BloodHound to TruffleHog, these are the tools most people overlook.

Siber GüvenlikBloodHoundTruffleHogActive Directory SecuritySecret ScanningSBOMReconnaissance ToolsDevSecOps

When people ask me about lesser-known cybersecurity tools that security professionals actually use, I immediately think of the ones that never show up in marketing slides but quietly do the heavy lifting. In my environment, tools like BloodHound, TruffleHog, and Chaos are the ones I reach for when mainstream solutions miss the point. These aren't toys — they're the workhorses that help me find exposure before someone else does.

As I mentioned before in my post about CI/CD pipeline vulnerabilities (https://furkanikkan.com/urun/ci-cd-pipeline-guvenlik-aciklari-devops-sureclerinde-sizan-zafiyetler-48), the gap between what a tool claims to do and what it actually catches in production is huge. The tools below sit in that gap.

BloodHound: Mapping Active Directory Attack Paths

Everyone knows Active Directory is a mess. But most people still audit it by clicking around AD Users and Computers. BloodHound changes that completely. It uses graph theory to map out exactly how an attacker could go from a low-privilege user to Domain Admin.

I run BloodHound during internal audits, and it consistently surprises people. You think your nested group memberships are clean? They're probably not. BloodHound shows you the shortest attack path — the exact chain of ACLs, group memberships, and session data that gets you compromised.

# Install SharpHound collector
pip install bloodhound
# Run collection from a domain-joined machine
bloodhound-python -u 'username' -p 'password' -d 'domain.local' -ns '10.0.0.1' -c All

Once you ingest the JSON output into the BloodHound GUI, you can query things like "Find All Paths from User X to Domain Admins" in seconds. If you've never run this against your own domain, you're flying blind.

TruffleHog: Catching Secrets in Repos and CI Pipelines

As I mentioned before in my CI/CD security post, hardcoded secrets in repositories are one of the most common ways systems get breached. TruffleHog scans your git history, not just the current state of the repo. That's the key difference.

Someone might have committed an AWS key two years ago, rotated it, but left the old one sitting in commit history. TruffleHog finds it. It also verifies secrets — meaning it actually checks if a found AWS key works rather than just reporting a regex match.

# Scan a repo for secrets with verification
trufflehog git https://github.com/yourorg/yourrepo --only-verified
# Scan a local directory
trufflehog filesystem /path/to/project --only-verified

I run this across every repo before it goes to production. It catches Slack tokens, database connection strings, private keys — stuff that static analyzers often miss because they're looking for patterns, not actual secret formats.

Chaos: DNS Reconnaissance at Scale

Chaos is a tool from ProjectDiscovery that lets you search for subdomains across a massive dataset. It's not your typical wordlist-based brute force. It pulls from a continuously updated index of DNS records.

When I'm doing external attack surface mapping, Chaos gives me a starting point that's faster and more accurate than running subfinder with a huge wordlist. It's especially useful for finding forgotten dev/staging environments that someone spun up and never decommissioned.

# Get subdomains for a domain using Chaos
chaos -d target.com -key your-api-key
# Pipe to httpx for live host detection
chaos -d target.com -key your-api-key | httpx -sc -title -tech-detect

Note: You need a free API key from ProjectDiscovery's Chaos portal. The free tier is generous enough for most internal use cases.

Syft and Grype: SBOM Generation and Vulnerability Matching

SBOM (Software Bill of Materials) is becoming mandatory in more compliance frameworks. But most admins I talk to still don't generate one. Syft creates an SBOM from container images, filesystems, or even running containers. Grype then takes that SBOM and matches it against vulnerability databases.

Here's what I do in my environment for container security:

# Generate SBOM from a Docker image
syft myapp:latest -o json > sbom.json
# Scan the SBOM for vulnerabilities
grype sbom:sbom.json --fail-on high

The --fail-on high flag makes Grype exit with a non-zero status if it finds high or critical vulnerabilities. I plug this directly into CI pipelines so builds fail automatically when serious issues are detected.

What I like about this combo:

  • Syft is fast — it scans most images in seconds
  • Grype's vulnerability database updates daily
  • Both tools work offline once the initial database is downloaded
  • Output formats include JSON, CycloneDX, and SPDX for compliance

Chaos vs Nuclei: Don't Confuse Them

Quick clarification because people mix these up. Chaos finds subdomains. Nuclei takes those subdomains and probes them for known vulnerability templates. They're complementary, not alternatives.

My typical workflow:

  1. Use Chaos to enumerate subdomains
  2. Pipe results to httpx to find live HTTP services
  3. Run nuclei against the live hosts with appropriate templates
  4. Feed findings into a ticketing system or SIEM
# Full chain example
chaos -d target.com -key your-api-key | \
  httpx -silent | \
  nuclei -t cves/ -t exposures/ -severity high,critical

Other Tools Worth Knowing

A few more that don't get enough attention:

  • Sliver: A competitor to Cobalt Strike that's open source. I use it for red team engagements where Metasploit is too noisy.
  • PwnDoc: A self-hosted alternative to ReportLab for generating pentest reports. Saves me hours on formatting.
  • Corsy: Scans for CORS misconfigurations. Simple but catches real issues that scanners like Nessus often flag as informational.
  • CloudFox: Maps out cloud permissions in AWS, Azure, and GCP. Answers the question "who can do what" without clicking through 50 IAM screens.

Final Thoughts

The tools that show up in vendor demos aren't always the ones doing the real work. In my experience, the lesser-known tools I've listed here often outperform their mainstream counterparts because they're built by practitioners solving specific problems, not by marketing teams.

If you're responsible for security in your environment, pick two or three from this list and actually run them. Not in a lab — against your real infrastructure. That's where the surprises live.

Cover image: CNE CNA C6F · PDM (Openverse / kamu malı) · https://www.flickr.com/photos/94966166@N02/52401145106