Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-pentest-cheat-sheets

Collection of cheat sheets useful for pentesting
https://github.com/ByteSnipers/awesome-pentest-cheat-sheets

Last synced: 18 days ago
JSON representation

Active Directory

Azure

Binary Exploitation

🗝 Privilege Escalation

Privilege Escalation

Bug Bounty

Defence Topics

Payloads

  • Fuzzdb - Dictionary of attack patterns and primitives for black-box application testing Polyglot Challenge with submitted solutions.
  • SecList - A collection of multiple types of lists used during security assessments. List types include usernames, passwords, URLs, sensitive data grep strings, fuzzing payloads, and many more.

🗝 Privilege Escalation

Privilege Escalation

Programming

Tools

Tools Online

  • XSS'OR Encoder/Decoder - Online Decoder/Encoder for testing purposes (@evilcos)
  • WebGun - WebGun, XSS Payload Creator (@brutelogic)
  • revshells.com - Reverse shell payload generator (Source code)
  • Segfault - Segfault: Free disposable root servers (by @THC)
  • suip.biz - Various free online pentesting tools like nmap, wpscan, sqlmap (...)
  • XSS'OR Encoder/Decoder - Online Decoder/Encoder for testing purposes (@evilcos).
  • Hackvertor - Tool to convert various encodings and generate attack vectors (@garethheyes).
  • suip.biz - Various free online pentesting tools like nmap, wpscan, sqlmap.
  • revshells.com - Reverse shell payload generator (Source code).
  • Hackvertor - Tool to convert various encodings and generate attack vectors (@garethheyes).

Wireless Hacking

  • wifite2 - Full automated WiFi security testing script .

Write-Ups

☁️ Cloud Pentesting

Azure

Kubernetes

Cloud Pentesting

Azure

Kubernetes

General cheat sheets

Learning Platforms

🗝 Privilege Escalation

  • TryHackMe - Free online platform for learning cyber security & penetration testing

Privilege Escalation

📱 Mobile Pentesting

  • Mobexler - Customised virtual machine, designed to help in penetration testing of Android & iOS applications.

Mobile Pentesting

Android

Apple

📎 Pentest Methodology

🎯 Exploitation

🧿 Post-Exploitation

🗝 Privilege Escalation

Pentest Methodology

Azure

Discovery

  • Google Dorks - Google Dorks Hacking Database (Exploit-DB).
  • ZoomEye - Zoomeye is a Cyberspace Search Engine recording information of devices, websites, services and components etc.
  • Censys - Similar to shodan, search engine for specific devices including IoT.
  • Amass - OWASP Network mapping of attack surfaces and external asset discovery using open source information.

Enumeration

Exploitation

Post-Exploitation

Privilege Escalation

  • linux-exploit-suggester.sh - Linux privilege escalation auditing tool written in bash (updated).
  • LinEnum - This tool is great at running through a heap of things you should check on a Linux system in the post exploit process. This include file permissions, cron jobs if visible, weak credentials etc.(@Rebootuser).
  • linPEAS - LinPEAS - Linux Privilege Escalation Awesome Script. Check the Local Linux Privilege Escalation checklist from book.hacktricks.xyz.
  • MimiPenguin - A tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. .
  • Windows Exploit Suggester - Tool for detection of missing security patches on the windows operating system and mapping with the public available exploits.
  • Sherlock - PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.
  • Watson - Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities.
  • Precompiled Windows Exploits - Collection of precompiled Windows exploits.
  • Metasploit Modules
  • Linux_Exploit_Suggester.pl - Linux Exploit Suggester written in Perl (last update 3 years ago).
  • linuxprivchecker.py - This script is intended to be executed locally on a Linux box to enumerate basic system info and search for common privilege escalation vectors such as world writable files, misconfigurations, clear-text passwords and applicable exploits (@SecuritySift).

🖥 Security Talks and Videos

Security Talks and Videos

🕷️ Web Pentesting

🗝 Privilege Escalation

Web Pentesting

Privilege Escalation