free security tools by me
for download

my CV
and pgp key

my CV in english

my CV in german

my public pgp key

mh-iso9001.pdf iso 9001:2015 certificate

marc_heuse-tisax-summary.pdf tisax 5.0 high protection level (certificate may sadly not be made public. please contact me.)

security advisories

normally I do not publish security announcements and leave this up to the vendors. in the rare case a vendor however doesn't want to fix a security problem or purposely put a backdoor in his product, I release a security advisory.

local LAN denial-of-service affecting all windows, cisco ios/asa, netscreen and freebsd systems by flooding the network with ICMPv6 router advertisements

the network storage (NAS) products from QNAP contain a crypto backdoor which allows access to the encrypted partitions

open and free

I believe in open source software, where everyone can read the source, learn and improve it. Therefore I publish my software with source code for free for over 20 years. currently I use the Affero Gnu Public License (AGP-3) for most of my code.

software by me at thc

innovative, the first, best and most-used network password tester, for over 40 services, on rank 15 of the 100 best security tools, is mentioned and recommended in many security books (all operating systems)

innovative, the first and still only toolkit for security testing ipv6 networks (linux)

innovative, the first exsting tool for service fingerprinting, although obsolete it is still rank 19 of the 100 best security tools (all operating systems, obsolete) - better is currently nmap
for many years the best wardialer in the world - maybe still today (all operating systems with dos/windows emulation, no further development)

one of the first tools for secure data deletion on hard disks and ram, with todays hard disk technology however putting too much effort in there (all operating systems, no further development)
proof-of-concept too show how to reverse tunnel a connection from the internet through firewalls and proxies to an internal machine - from 1999 (platform independant, no further development)

identifies encrypted areas in a file (eg. AES keys) by calculating the entropy of area (all operating systems)

read and write data directly to the harddisk level, which circumvents rootkits (linux, no further development)

tests the protection of services against massive connections (linux, BSD, cygwin, no further development)

this was once one of the first arp spoofer, which allows sniffing and man-in-the-middle on local networks (linux, obsolete)

proof-of-concept tool to tunnel TCP/UDP connections transparently via multiple jump points (linux, no further development)

software directly by me

the best afl version and the best overall fuzzer out there - according to Google's fuzzbench.

blackbox fuzzing of programs with afl through dyninst

afl patches
a collection of afl patches that improve performance, coverage, features and fixes bugs

blackbox fuzzing of programs with afl through dynamorio

blackbox fuzzing of programs with afl through pintool

simulates afl-fuzz for benchmarking of afl-pin, afl-dyninst, afl-dynamorio, etc.

audit scripts
audit scripts collect all necessary configuration data for offline analysis. they are used by some of the big five auditing companies (windows, linux, solaris, hp-ux, aix)

a flexible fuzzer, not only for web, has a CSV output for efficient output analysis (platform independant)

an efficient dumb file fuzzer with many options (C, platform independant)
starts systems that are shutdown if the wake-up-on-lan feature is active. also systems which are turned off can be attacked, this is from 1998 ;-) (plattform independant, no further development)

cracks SAP passwords in the usr02 table, integrated in the password cracking tool from red database security gmbh

oracle sql code checker
analysis of oracle sql code on sql injection, cross-site-scripting etc. - this is the only commercial tool of mine and is sold via red database security gmbh (windows)

beside these tools, there are several other powerful program for automotive, network & webapp pentests and reverse engineering which I do not publish however - yet

software by me
at suse linux

the firewall script which comes with all OpenSuSE/SLES Linux installations

runs programs in a secure environment/compartment (chroot, capabilities, fd-security, etc.) (no further development)

security check scripts which evaluate daily, weekly and monthly various security parameters (no further development)

creates a boot disk(!) which contains integrity information. When booting, it checks the system for manipulations (obviously depricated)
script to harden old SuSE Linux servers (obsolete) (recommended in the BSI study on Apache Security)