{"id":13844430,"url":"https://github.com/r0eXpeR/pentest","last_synced_at":"2025-07-11T22:32:04.377Z","repository":{"id":45585495,"uuid":"355226258","full_name":"r0eXpeR/pentest","owner":"r0eXpeR","description":"内网渗透中的一些工具及项目资料","archived":false,"fork":false,"pushed_at":"2021-04-06T14:51:23.000Z","size":7,"stargazers_count":282,"open_issues_count":0,"forks_count":51,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-08-05T17:41:46.864Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/r0eXpeR.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-04-06T14:49:21.000Z","updated_at":"2024-08-03T02:54:38.000Z","dependencies_parsed_at":"2022-08-12T11:52:25.014Z","dependency_job_id":null,"html_url":"https://github.com/r0eXpeR/pentest","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/r0eXpeR%2Fpentest","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/r0eXpeR%2Fpentest/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/r0eXpeR%2Fpentest/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/r0eXpeR%2Fpentest/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/r0eXpeR","download_url":"https://codeload.github.com/r0eXpeR/pentest/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225763414,"owners_count":17520456,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:02:42.194Z","updated_at":"2024-11-21T16:31:29.944Z","avatar_url":"https://github.com/r0eXpeR.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"# 内网渗透中的一些工具及项目资料\n\n\u003e 入侵与渗透是两个不同的概念，很多人喜欢混为一谈，简单来说，入侵是从信息收集到打点，渗透是横向移动，获取目标，稳固权限。本页是针对内网渗透中整理的一些工具以及项目资料，方便安全从业人员查阅.\n\n此项目同步至：https://forum.ywhack.com/bountytips.php?pentest\n\n## 目录\n\n* [信息收集](#信息收集)\n* [漏洞利用](#漏洞利用)\n* [免杀系列](#免杀系列)\n* [代理隧道](#代理隧道)\n* [权限提升](#权限提升)\n* [权限维持](#权限维持)\n* [横向移动](#横向移动)\n* [技术资料](#技术资料)\n\n\n### 信息收集\n\n* [2021.04.06] - [https://github.com/shadow1ng/fscan](https://github.com/shadow1ng/fscan) - 一款内网扫描工具，方便一键大保健~\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Golang | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/Heart-Sky/ListRDPConnections](https://github.com/Heart-Sky/ListRDPConnections) - 读取本机对外RDP连接记录和其他主机对该主机的连接记录\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: C# | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/CaiJiJi/VulScritp](https://github.com/CaiJiJi/VulScritp) - 内网渗透的一些Python脚本\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: Python | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/r0eXpeR/redteam-tools](https://github.com/r0eXpeR/redteam-tools/blob/main/getinfo.sh) - Linux 内网信息收集shell脚本\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: Shell | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/k8gege/Ladon](https://github.com/k8gege/Ladon) - Ladon一款用于大型网络渗透的多线程插件化综合扫描神器\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: C# | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/dafthack/MailSniper](https://github.com/dafthack/MailSniper) - Exchange敏感数据检索工具\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: PowerShell | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/pandasec888/taowu-cobalt-strike](https://github.com/pandasec888/taowu-cobalt-strike) - 梼杌 cobalt strike3.x与cobalt strike4.x的插件\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/We5ter/Scanners-Box](https://github.com/We5ter/Scanners-Box/blob/master/README_CN.md) - Scanners Box也被称为 scanbox，是一个强大完备的黑客工具箱\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/QAX-A-Team/BrowserGhost](https://github.com/QAX-A-Team/BrowserGhost) - BrowserGhost 一个抓取浏览器密码的工具\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: C# | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/uknowsec/SharpDecryptPwd](https://github.com/uknowsec/SharpDecryptPwd) - 对Win系统上的密码程序进行解析(Navicat,TV,FileZilla,Xshell...)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/shack2/SNETCracker](https://github.com/shack2/SNETCracker) - SNETCracker是Windows下的超级弱口令检查工具\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: C# | 仍在维护：×\n\n### 漏洞利用\n\n* [2021.04.06] - [https://github.com/rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) - Metasploit Framework\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: Ruby | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/EmpireProject/Empire](https://github.com/EmpireProject/Empire) - Empire 基于 poweshell 的命令执行框架 后渗透利器\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: PowerShell | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/zhzyker/exphub](https://github.com/zhzyker/exphub) - Exphub[漏洞利用脚本库]\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Python | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/HatBoy/Struts2-Scan](https://github.com/HatBoy/Struts2-Scan) - Struts2全漏洞扫描利用工具\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Python | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/c0ny1/FastjsonExploit](https://github.com/c0ny1/FastjsonExploit) - Fastjson漏洞快速利用框架\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Java | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/0nise/weblogic-framework](https://github.com/0nise/weblogic-framework) - Weblogic 利用框架 Weblogic-Framework\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Java | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/SafeGroceryStore/MDAT](https://github.com/SafeGroceryStore/MDAT) - MDAT 多种主流的数据库攻击利用工具\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Java | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/j1anFen/shiro_attack](https://github.com/j1anFen/shiro_attack) - shiro反序列化漏洞综合利用\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Java | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/xinyu2428/TDOA_RCE](https://github.com/xinyu2428/TDOA_RCE) - 通达OA综合利用工具\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: Java | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/k8gege/K8tools](https://github.com/k8gege/K8tools) - K8漏洞利用工具合集\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n### 免杀系列\n\n* [2021.04.06] - [https://forum.ywhack.com/bountytips.php?BypassAV](https://forum.ywhack.com/bountytips.php?BypassAV) - 免杀系列项目及工具\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n### 代理隧道\n\n* [2021.03.07] - [proxifier 全平台代理工具，支持多种socks协议](https://www.proxifier.com/)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: C++ | 仍在维护：√\n\n* [2021.03.07] - [frp 专注于内网穿透的高性能的反向代理应用](https://github.com/fatedier/frp)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: Golang | 仍在维护：√\n\n* [2021.03.07] - [nps 轻量级、高性能、功能强大的内网穿透代理服务器](https://github.com/ehang-io/nps)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: Golang | 仍在维护：√\n\n* [2021.03.07] - [iox 端口转发 \u0026 内网代理工具](https://github.com/EddieIvan01/iox)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: Golang | 仍在维护：√\n\n* [2021.03.07] - [SwitchyOmega 浏览器的代理插件](https://github.com/FelisCatus/SwitchyOmega)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言:CoffeeScript | 仍在维护：√\n\n* [2021.03.07] - [Neo-reGeorg 改进的reGeorg版本](https://github.com/L-codes/Neo-reGeorg)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言:Python | 仍在维护：√\n\n* [2021.03.07] - [dns2tcp是一款利用dns协议传输tcp数据的工具](https://github.com/alex-sector/dns2tcp)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:C | 仍在维护：×\n\n* [2021.03.07] - [dnscat2 是一个DNS隧道工具](https://github.com/iagox86/dnscat2)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:C++ | 仍在维护：×\n\n* [2021.03.07] - [ABPTTS 基于ssl加密的http隧道工具](https://github.com/nccgroup/ABPTTS)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Python | 仍在维护：×\n\n* [2021.03.07] - [Termite 内网渗透代理、端口转发工具](http://rootkiter.com/Termite/)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:C | 仍在维护：×\n\n* [2021.03.07] - [SSTap, 一款利用虚拟网卡在网络层实现的代理工具](https://github.com/FQrabbit/SSTap-Rule)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言:未知 | 仍在维护：×\n\n* [2021.03.07] - [ew 用于开启 SOCKS v5 代理服务的工具(跨平台)](https://github.com/idlefire/ew)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Golang | 仍在维护：×\n\n* [2021.03.07] - [n2n 开源的点对点穿透工具](https://github.com/ntop/n2n)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:C | 仍在维护：√\n\n* [2021.03.07] - [icmpsh 一个简单的 reverse ICMP shell](https://github.com/inquisb/icmpsh)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:C | 仍在维护：×\n\n* [2021.03.08] - [ngrok 正/反向代理，内网穿透，端口转发](https://github.com/inconshreveable/ngrok)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Golang | 仍在维护：×\n\n* [2021.03.08] - [ssf 全平台的加密隧道 端口转发工具](https://securesocketfunneling.github.io/ssf/)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:未知 | 仍在维护：√\n\n* [2021.03.14] - [proxychains 命令行代理神器](https://github.com/haad/proxychains)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:C | 仍在维护：√\n\n* [2021.03.14] - [switcher 一个多功能的端口转发/端口复用工具](https://github.com/crabkun/switcher)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Golang | 仍在维护：√\n\n* [2021.03.22] - [pingtunnel 是把 tcp/udp/sock5 流量伪装成 icmp 流量进行转发的工具](https://github.com/esrrhs/pingtunnel)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Golang | 仍在维护：√\n\n* [2021.03.26] - [chisel - 一款快速稳定的隧道工具](https://github.com/jpillora/chisel)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Golang | 仍在维护：√\n\n* [2021.03.29] - [pystinger - 一款使用webshell进行流量转发的出网工具](https://github.com/FunnyWolf/pystinger)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Python | 仍在维护：√\n\n* [2021.03.29] - [pivotnacci - 通过HTTP代理建立socks连接的工具](https://github.com/blackarrowsec/pivotnacci)\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言:Python | 仍在维护：√\n\n* [2021.04.06] - [lanproxy是一个将局域网个人电脑、服务器代理到公网的内网穿透工具](https://github.com/ffay/lanproxy)\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言:Java | 仍在维护：√\n\n### 权限提升\n\n* [2021.04.06] - [https://i.hacking8.com/tiquan/](https://i.hacking8.com/tiquan/) - 提权辅助网页 Windows提权辅助\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: PHP | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/Ascotbe/Kernelhub](https://github.com/Ascotbe/Kernelhub) - Windows 提权漏洞合集(带有编译环境/详细说明)\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/SecWiki/windows-kernel-exploits](https://github.com/SecWiki/windows-kernel-exploits) - windows-kernel-exploits Windows平台提权漏洞集合\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/SecWiki/linux-kernel-exploits](https://github.com/SecWiki/linux-kernel-exploits) - linux-kernel-exploits Linux平台提权漏洞集合\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/worawit/CVE-2021-3156](https://github.com/worawit/CVE-2021-3156) - CVE-2021-3156 sudo 提权漏洞 各平台下的EXP\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: Python | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/FireFart/dirtycow](https://github.com/FireFart/dirtycow) - CVE-2016-5195 脏牛漏洞提权EXP\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: C | 仍在维护：×\n\n### 权限维持\n\n* [2021.04.06] - [https://github.com/360-Linton-Lab/Telemetry](https://github.com/360-Linton-Lab/Telemetry) - WINDOWS TELEMETRY权限维持\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: C# | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/Lhaihai/PythonPersistence](https://github.com/Lhaihai/PythonPersistence) - python3 写的一些权限维持脚本\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: Python | 仍在维护：×\n\n* [2021.04.06] - [https://github.com/AV1080p/Schtasks-Backdoor](https://github.com/AV1080p/Schtasks-Backdoor) - 一款权限维持后门PowerShell脚本\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: PowerShell | 仍在维护：×\n\n* [2021.04.06] - [https://xz.aliyun.com/t/8095](https://xz.aliyun.com/t/8095) - Windows权限维持技术整理\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: 未知 | 仍在维护：×\n\n* [2021.04.06] - [https://www.cnblogs.com/-mo-/p/12337766.html](https://www.cnblogs.com/-mo-/p/12337766.html) - [总结]Linux权限维持\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: 未知 | 仍在维护：×\n\n* [2021.04.06] - [https://bypass007.github.io/Emergency-Response-Notes](https://bypass007.github.io/Emergency-Response-Notes/privilege/) - bypass007 权限维持篇\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: 未知 | 仍在维护：×\n\n* [2021.04.06] - [https://www.yuque.com/tidesec/redteam/sgfxkl](https://www.yuque.com/tidesec/redteam/sgfxkl) - TideSec 红蓝WIKI windows权限维持\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: 未知 | 仍在维护：×\n\n* [2021.04.06] - [https://www.yuque.com/tidesec/redteam/myy0vw](https://www.yuque.com/tidesec/redteam/myy0vw) - TideSec 红蓝WIKI Linux权限维持\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: 未知 | 仍在维护：×\n\n* [2021.04.06] - [https://attack.mitre.org/tactics/TA0004/](https://attack.mitre.org/tactics/TA0004/) - ATT\u0026CK 权限提升 总结技巧\n\n\u003e 推荐：![](images/3stars.gif) | 编程语言: 未知 | 仍在维护：×\n\n### 横向移动\n\n* [2021.04.06] - [https://github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) - Mimikatz Windows 密码抓取神器\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: C | 仍在维护：√\n\n* [2021.04.06] - [https://github.com/QAX-A-Team/sharpwmi](https://github.com/QAX-A-Team/sharpwmi) - sharpwmi基于rpc的横向移动工具，具有上传和执行命令功能\n\n\u003e 推荐：![](images/4stars.gif) | 编程语言: C# | 仍在维护：√\n\n* [2021.04.06] - [https://forum.ywhack.com/bountytips.php?download](https://forum.ywhack.com/bountytips.php?download) - 文件下载命令快捷生成\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n* [2021.04.06] - [https://forum.ywhack.com/shell.php](https://forum.ywhack.com/shell.php) - 反弹Shell命令一键生成\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n* [2021.04.06] - [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/) - ATT\u0026CK 横向移动总结技巧\n\n\u003e 推荐：![](images/5stars.gif) | 编程语言: 未知 | 仍在维护：√\n\n### 内网学习资料\n\n* [2021.04.06] - [https://github.com/l3m0n/pentest_study](https://github.com/l3m0n/pentest_study) - 从零开始内网渗透学习\n* [2021.04.06] - [https://github.com/Ridter/Intranet_Penetration_Tips](https://github.com/Ridter/Intranet_Penetration_Tips) - 2018年初整理的一些内网渗透TIPS\n* [2021.04.06] - [https://attack.mitre.org/](https://attack.mitre.org/) - MITRE ATT\u0026CK安全知识库\n* [2021.04.06] - [https://micro8.gitbook.io/micro8/](https://micro8.gitbook.io/micro8/) - Micro8 系列 渗透测试/APT模拟攻击\n\n\n\n此项目不定期进行更新......\n\n[点此返回顶部](javascript:;)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fr0eXpeR%2Fpentest","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fr0eXpeR%2Fpentest","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fr0eXpeR%2Fpentest/lists"}