Free cybersecurity tools: choose by task and evidence

A useful security tool answers a specific question. Decoding a JWT, comparing HTTP responses and calculating a CVSS score are different tasks. Combining their outputs can document a problem, but does not by itself demonstrate a vulnerability.

The rootzero toolbox provides free utilities that run in your browser. This guide explains which to open and how to interpret their output. They process material you supply; they do not replace observing an application or obtaining permission to test it.

Choose by input and decision

Your input	Tool	Useful outcome	What remains to verify
A JWT	JWT Inspector	Read claims and inspect structure	The server’s actual validation
A login URL	OAuth Inspector	Examine OAuth and OIDC parameters	Provider configuration and behaviour
An API document	OpenAPI Inspector	Prepare a route inventory	Deployed routes and permissions
Two HTTP exchanges	HTTP Diff	Compare status, headers and bodies	Account identity and business meaning
A CSP	CSP Analyzer	Identify directives to examine	The effective browser policy and page context
A log excerpt	IOC Extractor	Extract and normalise indicators	Their origin and relationship to hostile activity
A severity assessment	CVSS Calculator	Reproduce a vector’s score	Metric assumptions and business priority
Evidence to share	Evidence Sanitizer	Prepare a redacted excerpt	Final review and retained evidential value

A parser also depends on input quality. A truncated response or an undated log may remain insufficient even when its output is readable.

Workflow 1: investigate authentication

Start with demonstration data or an authorised excerpt. Identify token format, claims and expiry. Decoding a payload does not establish authenticity. Distinguish reading a token, verifying its signature and observing the application accept it.

For OAuth, examine the authorisation URL and callback next. Retain what the analysis needs, without sharing a live login code or client secret. A useful diagnosis connects an observation to its preconditions. An unusual field alone is insufficient to establish a flaw.

For a broader assessment, prepare accounts, roles and workflows as described in the SpectrAI methodology. The AI pentesting guide explains its scope and limitations.

Workflow 2: compare API access

Keep reference requests and responses for each authorised role. Compare headers and bodies in HTTP Diff. A size change may be caused by a date or identifier; identical responses may still require a closer look at context. HTTP status alone cannot settle the question.

In a fictional example, two accounts both receive status 200 for a document. Establish its expected organisation and whether the second account should have access. Retain the account-object-response association. Do not include active session credentials in a public report.

OpenAPI helps organise declared routes; it does not prove that access controls are enforced. Tools make observations comparable, while analysis establishes their impact.

Workflow 3: prepare an actionable finding

An evidence excerpt should preserve preconditions, the asset, steps and outcome. Redact secrets before sharing a copy. Check that replacements have not destroyed the relationship between request and response. Automated redaction still needs review.

For CVSS, retain the vector and justify its metrics. The FIRST specification describes severity and metric groups. Remediation priority also requires exposure and business context.

The SpectrAI sample report illustrates a reporting format. It does not predict findings for a different application.

What local processing means

Catalogue utilities perform calculations in the browser. Loading the website remains a network request. Copying results, saving files or following external links may move information outside that context through your own actions. Local processing cannot protect a compromised workstation or make confidential data public.

Use demonstration data when explaining a method. MSPs should separate customer material and define what may enter a report. Subscribe to rootzero RSS feeds for new guides.