Where to get each tool

Why we don’t keep copies

Admin utilities are a favourite disguise for malware precisely because the people who use them run them with elevated rights. Look-alike sites borrow the names of popular SSH clients and scanners, then serve a repackaged binary that looks right and behaves right, with something extra attached. The defence is a habit rather than a product: get every tool from the organisation that makes it, and check what you received before it runs. A copy from us could never be more trustworthy than the original, so there are no copies here — only links to each vendor’s own product page.

A five-minute check before first run

1. Arrive by address, not by ad. Type the vendor’s domain or use the links above. Look-alike domains usually add a word (“-free”, “-client”, “-app”), swap the top-level domain, or sit on a generic hosting subdomain.
2. Walk away from anything unusual. None of the tools on this site asks you to disable antivirus, type a password to open an archive, or accept “recommended offers”. A page that does is not the vendor.
3. Check the Authenticode signature on Windows. Right-click the file, open Properties, then Digital Signatures — or from PowerShell:

   Get-AuthenticodeSignature .\the-file-you-received.exe |
     Format-List Status, StatusMessage, SignerCertificate

   Status should be Valid, and the signer should match the vendor in the table.
4. Compare the published hash. Wireshark, PuTTY and WinSCP publish checksums for their releases, and LizardSystems lists one for Network Scanner. Compute yours and compare every character, not just the first few:

   # Windows (PowerShell)
   Get-FileHash .\the-file-you-received.exe -Algorithm SHA256
   # macOS Terminal
   shasum -a 256 the-file-you-received
   # Linux shell
   sha256sum the-file-you-received

5. Stage it once, then distribute. If a tool goes on every admin laptop, verify one copy, store it on an internal share with its hash alongside, and deploy from there — through Intune, a GPO software installation, or winget pointed at the vendor’s own package — rather than having five people fetch it five ways.

Package managers and stores

winget’s community repository includes manifests for several of these tools, and each manifest points at the vendor’s own release URL with a SHA-256 attached, so winget refuses a file that doesn’t match. PuTTY and the Sysinternals tools are also listed in the Microsoft Store by their own publishers. On Linux, your distribution’s packages for Wireshark and PuTTY are signed by the distribution and are usually the simplest trustworthy route.

When antivirus complains

Security products sometimes flag scanners, remote-execution tools such as PsExec, and packet-capture drivers as “potentially unwanted”, because those are exactly the capabilities an intruder would want. If a file you obtained from the vendor passes the signature and hash checks above, raise a change request and exclude just that file or its folder. Turning protection off across the board is never the fix — and a site advising you to do so is not your friend. If a signature or hash doesn’t match, delete the file and start again from the vendor’s page.

After it’s installed

Point it only at networks and hosts you administer, or have written permission to work on. TheLAN scanner comparison helps you pick a sweeper, and thehow-tos walk through the common jobs with the actual settings and commands.