awesome-pentest
A collection of awesome penetration testing resources, tools and other shiny things
https://github.com/eric-erki/awesome-pentest
Last synced: 12 days ago
JSON representation
-
Awesome Lists
-
Defcon Suggested Reading
- C/C++ Programming - One of the main language for open source security tools.
- .NET Programming - Software framework for Microsoft Windows platform development.
- Shell Scripting - Command line frameworks, toolkits, guides and gizmos.
- Ruby Programming by @markets - The de-facto language for writing exploits.
- JavaScript Programming - In-browser development and scripting.
- Python Programming by @vinta - General Python programming.
- Android Security - Collection of Android security related resources.
- Awesome Awesomness - The List of the Lists.
- AppSec - Resources for learning about application security.
- CTFs - Capture The Flag frameworks, libraries, etc.
- InfoSec § Hacking challenges - Comprehensive directory of CTFs, wargames, hacking challenge websites, pentest practice lab exercises, and more.
- Hacking - Tutorials, tools, and resources.
- Honeypots - Honeypots, tools, components, and more.
- Malware Analysis - Tools and resources for analysts.
- PCAP Tools - Tools for processing network traffic.
- Security - Software, libraries, documents, and other resources.
- .
- AppSecUSA - Annual conference organized by OWASP.
- RSA Conference USA - Annual security conference in San Francisco, California, USA.
- Swiss Cyber Storm - Annual security conference in Lucerne, Switzerland.
- 44Con - Annual Security Conference held in London.
- DEF CON - Annual hacker convention in Las Vegas.
- PhreakNIC - Technology conference held annually in middle Tennessee.
- ShmooCon - Annual US East coast hacker convention.
- CarolinaCon - Infosec conference, held annually in North Carolina.
- DefCamp - Largest Security Conference in Eastern Europe, held annually in Bucharest, Romania.
- Virus Bulletin Conference - Annual conference going to be held in Denver, USA for 2016.
- BalCCon - Balkan Computer Congress, annually held in Novi Sad, Serbia.
- Nullcon - Annual conference in Delhi and Goa, India.
- BalCCon - Balkan Computer Congress, annually held in Novi Sad, Serbia.
- Black Hat - Annual security conference in Las Vegas.
- LayerOne - Annual US security conference held every spring in Los Angeles.
- BalCCon - Balkan Computer Congress, annually held in Novi Sad, Serbia.
- BSides - Framework for organising and holding security conferences.
- Virus Bulletin Conference - Annual conference going to be held in Denver, USA for 2016.
-
-
Information Security Magazines
-
Defcon Suggested Reading
- 2600: The Hacker Quarterly - American publication about technology and computer "underground."
- Phrack Magazine - By far the longest running hacker zine.
-
-
Online Resources
-
Exploit Development
- Shellcode Examples - Shellcodes database.
- Exploit Writing Tutorials - Tutorials on how to develop exploits.
- Shellcode Examples - Shellcodes database.
- Shellcode Tutorial - Tutorial on how to write shellcode.
-
Lock Picking Resources
- /r/lockpicking - Resources for learning lockpicking, equipment recommendations.
-
Operating Systems
- Security related Operating Systems @ Rawsec - Complete list of security related operating systems.
- Digital Evidence & Forensics Toolkit (DEFT) - Live CD for forensic analysis runnable without tampering or corrupting connected devices where the boot process takes place.
- cuckoo - Open source automated malware analysis system.
- Tails - Live OS aimed at preserving privacy and anonymity.
-
OSINT Resources
- NetBootcamp OSINT Tools - Collection of OSINT links and custom Web interfaces to other services such as [Facebook Graph Search](http://netbootcamp.org/facebook.html) and [various paste sites](http://netbootcamp.org/pastesearch.html).
- WiGLE.net - Information about wireless networks world-wide, with user-friendly desktop and web applications.
- OSINT Framework - Collection of various OSINT tools broken out by category.
- Intel Techniques - Collection of OSINT tools. Menu on the left can be used to navigate through the categories.
-
Penetration Testing Resources
- Penetration Testing Framework (PTF) - Outline for performing penetration tests compiled as a general framework usable by vulnerability analysts and penetration testers alike.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- MITRE's Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) - Curated knowledge base and model for cyber adversary behavior.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- PENTEST-WIKI - Free online security knowledge library for pentesters and researchers.
- Metasploit Unleashed - Free Offensive Security Metasploit course.
- Penetration Testing Framework (PTF) - Outline for performing penetration tests compiled as a general framework usable by vulnerability analysts and penetration testers alike.
- Open Web Application Security Project (OWASP) - Worldwide not-for-profit charitable organization focused on improving the security of especially Web-based and Application-layer software.
-
-
Security Courses
-
Defcon Suggested Reading
- Offensive Security Training - Training from BackTrack/Kali developers.
- CTF Field Guide - Everything you need to win your next CTF competition.
- Computer Security Student - Many free tutorials, great for beginners, $10/mo membership unlocks all content.
- SANS Security Training - Computer Security Training & Certification.
- ARIZONA CYBER WARFARE RANGE - 24x7 live fire exercises for beginners through real world operations; capability for upward progression into the real world of cyber warfare.
- Open Security Training - Training material for computer security classes.
-
-
Tools
-
Anonymity Tools
- Tor - Free software and onion routed overlay network that helps you defend against traffic analysis.
- OnionScan - Tool for investigating the Dark Web by finding operational security issues introduced by Tor hidden service operators.
- Nipe - Script to redirect all traffic from the machine to the Tor network.
- oregano - Python module that runs as a machine-in-the-middle (MITM) accepting Tor client requests.
- What Every Browser Knows About You - Comprehensive detection page to test your own Web browser's configuration for privacy and identity leaks.
- I2P - The Invisible Internet Project.
-
Anti-virus Evasion Tools
- Veil - Generate metasploit payloads that bypass common anti-virus solutions.
- peCloak.py - Automates the process of hiding a malicious Windows executable from antivirus (AV) detection.
- UniByAv - Simple obfuscator that takes raw shellcode and generates Anti-Virus friendly executables by using a brute-forcable, 32-bit XOR key.
- Shellter - Dynamic shellcode injection tool, and the first truly dynamic PE infector ever created.
- AntiVirus Evasion Tool (AVET) - Post-process exploits containing executable files targeted for Windows machines to avoid being recognized by antivirus software.
- peCloakCapstone - Multi-platform fork of the peCloak.py automated malware antivirus evasion tool.
- Shellter - Dynamic shellcode injection tool, and the first truly dynamic PE infector ever created.
-
CTF Tools
- ctf-tools - Collection of setup scripts to install various security research tools easily and quickly deployable to new machines.
- Pwntools - Rapid exploit development framework built for use in CTFs.
- RsaCtfTool - Decrypt data enciphered using weak RSA keys, and recover private keys from public keys using a variety of automated attacks.
-
DDoS Tools
- JS LOIC - JavaScript in-browser version of LOIC.
- HOIC - Updated version of Low Orbit Ion Cannon, has 'boosters' to get around common counter measures.
- T50 - Faster network stress tool.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- SlowLoris - DoS tool that uses low bandwidth on the attacking side.
- UFONet - Abuses OSI layer 7 HTTP to create/manage 'zombies' and to conduct different attacks using; `GET`/`POST`, multithreading, proxies, origin spoofing methods, cache evasion techniques, etc.
- Memcrashed - DDoS attack tool for sending forged UDP packets to vulnerable Memcached servers obtained using Shodan API.
- JS LOIC - JavaScript in-browser version of LOIC.
-
Docker for Penetration Testing
-
File Format Analysis Tools
-
GNU/Linux Utilities
- Linux Exploit Suggester - Heuristic reporting on potentially viable exploits for a given GNU/Linux system.
-
Hash Cracking Tools
- CeWL - Generates custom wordlists by spidering a target's website and collecting unique words.
- Rar Crack - RAR bruteforce cracker.
- JWT Cracker - Simple HS256 JWT token brute force cracker.
- BruteForce Wallet - Find the password of an encrypted wallet file (i.e. `wallet.dat`).
- StegCracker - Steganography brute-force utility to uncover hidden data inside files.
- John the Ripper - Fast password cracker.
-
Hex Editors
-
Programming Languages
Categories
Sub Categories
Defcon Suggested Reading
91
Network Tools
53
OSINT Tools
31
DDoS Tools
30
Web Exploitation
28
Network Vulnerability Scanners
19
Reverse Engineering Tools
16
Penetration Testing Resources
15
Windows Utilities
15
Penetration Testing Books
11
Penetration Testing Distributions
11
Social Engineering Tools
9
Hackers Handbook Series
8
Wireless Network Tools
7
Anti-virus Evasion Tools
7
Physical Access Tools
6
Social Engineering Books
6
Multi-paradigm Frameworks
6
Anonymity Tools
6
Hash Cracking Tools
6
Docker for Penetration Testing
5
Operating Systems
4
Transport Layer Security Tools
4
Exploit Development
4
OSINT Resources
4
Lock Picking Books
4
CTF Tools
3
Hex Editors
3
Penetration Testing Report Templates
3
Network Analysis Books
3
Reverse Engineering Books
3
Windows Books
2
macOS Utilities
2
Malware Analysis Books
2
File Format Analysis Tools
2
Defensive Development
2
Lock Picking Resources
1
Side-channel Tools
1
GNU/Linux Utilities
1
Keywords
security
33
python
20
pentesting
18
awesome
15
awesome-list
13
hacking
13
penetration-testing
10
pentest
10
security-tools
8
osint
8
list
7
security-audit
6
scanner
6
reconnaissance
5
linux
5
ruby
5
golang
5
recon
4
vulnerability-scanners
4
active-directory
4
network-security
4
infosec
4
appsec
4
hacking-tool
4
man-in-the-middle
4
windows
4
cybersecurity
3
go
3
dns
3
security-scanner
3
phishing
3
exploit
3
exploitation
3
vulnerability-scanner
3
static-analysis
3
python3
3
javascript
3
bruteforce
3
nodejs
3
mitm
3
pentest-tool
3
ctf
3
enumeration
3
fuzzing
3
vulnerabilities
3
information-gathering
3
owasp
3
network
3
threat-hunting
2
tor
2