Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

awesome-hacking-tools

😱An awesome curated list for hacking & pentesting tools!
https://github.com/Jackelele/awesome-hacking-tools

Last synced: 4 days ago
JSON representation

  • Android Security

  • Asset Discovery

    • Domain / Subdomain Discovery

      • SubFinder - SubFinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.
      • Amass - A subdomain enumeration utility
      • Sublist3r - Subdomains enumeration tool with multiple sources
      • Aiodnsbrute - Asynchronous DNS brute force utility
      • LDNS - A DNS library useful for DNS tool programming
      • Nsec3map - A tool to NSEC and NSEC3 walking
      • Ct-exposer - A tool to discovers sub-domains by searching Certificate Transparency logs
      • Certgraph - A tool to crawl the graph of certificate Alternate Names
      • Appsecco - The art of subdomain enumeration - The supplement material for the book "The art of sub-domain enumeration"
      • SSLScrape - A scanning tool to scrape hostnames from SSL certificates
      • GoBuster - Directory/File, DNS and VHost busting tool written in Go
      • Bluto - Recon, Subdomain Bruting, Zone Transfers
      • Dns-nsec3-enum - Nmap NSE Script for NSEC3 walking
      • Crt.sh
      • Wolframalpha - Computational knowledge engine
      • Project Sonar - Forward DNS Data
      • Project Sonar - Reverse DNS Data

    • Content Discovery

      • RustButer - Files, directories and vhost buster written in Rust.

    • IP Address Discovery

      • Massdns - A DNS resolver utility for bulk lookups
      • Mxtoolbox - Bulk Domain/IP lookup tool
      • Domaintoipconverter - Bulk domain to IP converter
      • Googleapps Dig - Online Dig tool by Google
      • DataSploit (IP Address Modules) - An OSINT Framework to perform various recon techniques
      • Domain Dossier - Investigate domains and IP addresses
      • Bgpview - Search ASN, IPv4/IPv6 or resource name
      • Viewdns
      • Ultratools ipv6Info - Multiple information related to IPv6 address
      • Whois - Command line utility usually used to find information about registered users/assignees of an Internet resource.
      • Linux - us/windows-server/administration/windows-commands/nslookup) - Command line utility usually used for querying the DNS records
      • ICANN Whois - Whois service by Internet Corporation for Assigned Names and Numbers (ICANN)
      • bgp - Internet Backbone and Colocation Provider ... Hurricane Electric IP Transit. Our Global Internet Backbone provides IP Transit with low latency, access to thousands of networks, and dual-stack

    • Email Discovery

    • Network/Port Scanning

      • Zmap - A fast network scanner designed for Internet-wide network surveys
      • Masscan - An asynchronously TCP port scanner
      • ZMapv6 - A modified version of Zmap with IPv6 support.
      • Nmap - A free and open source utility for network discovery. The most popular port scanner.

    • Business Communication Infrastructure Discovery

    • Source Code Aggregators / Search - Information Discovery

      • Gitrob - Reconnaissance tool for GitHub organizations
      • Github - Github Advanced Search
      • Gitlab - Search Gitlab projects
      • Publicwww - Source Code Search Engine
      • builtwith - Web technology information profiler tool. Find out what a website is built with.

    • Cloud Infrastructure Discovery

      • CloudScraper - A tool to spider websites for cloud resources (S3 Buckets, Azure Blobs, DigitalOcean Storage Space)
      • InSp3ctor - AWS S3 Bucket/Object finder
      • Spaces-finder - A tool to hunt for publicly accessible DigitalOcean Spaces
      • GCPBucketBrute - A Google Storage buckets enumeration script
      • CloudStorageFinder - Tools to find public data in cloud storage systems
      • Buckets Grayhatwarfare - Search for Open Amazon s3 Buckets and their contents

    • Social Media / Employee Profiling

      • LinkedInt - A LinkedIn scraper for reconnaissance
      • Glassdoor - Company review and rating search
      • SocialBlade - Track user statistics for different platforms including YouTube and Twitter
      • Social-Searcher - Social Media Search Engine

    • Data Leaks

      • Scavenger - Paste sites crawler (bot) looking for leaked credentials
      • Pwnbin - Python based Pastebin crawler for keywords.
      • PwnedOrNot - Tool to find passwords for compromised accounts
      • Dumpmon - A twitter bot which monitors multiple paste sites for password dumps and other sensitive information
      • Pastebin_scraper - Automated tool to monitor pastebin for interesting information

    • Company Information and Associations

      • Crunchbase - Information about companies (funding, acquisition, merger etc.) and the people behind them
      • OverSeas Registries - List of company registries located around the world
      • Companieshouse - United Kingdom's registrar of companies

    • Internet Survey Data

      • Project Sonar - Rapid7’s internet-wide surveys data across different services and protocols
      • Portradar - Free and open port scan data by packet.tel

    • Internet Scan / Archived Information

  • Application Security

    • Websites

      • Juice Shop - An intentionally insecure Javascript Web Application.
      • OWASP NodeGoat - Purposly vulnerable to the OWASP Top 10 Node.JS web application, with [tutorials](https://nodegoat.herokuapp.com/tutorial), [security regression testing with the OWASP Zap API](https://github.com/OWASP/NodeGoat/wiki/NodeGoat-Security-Regression-tests-with-ZAP-API), [docker image](https://github.com/owasp/nodegoat#option-3---run-nodegoat-on-docker). With several options to get up and running fast.
      • Web App Sec Quiz - Self-assessment quiz for web application security
      • SecurePasswords.info - Secure passwords in several languages/frameworks.
      • Security News Feeds Cheat-Sheet - A list of security news sources.
      • MicroCorruption - Capture The Flag - Learn Assembly and Embedded Device Security
      • Open Security Training - Video courses on low-level x86 programming, hacking, and forensics.

    • Application Security Learning Resources

    • Blogs

      • NCC Group - Blog - The blog of NCC Group, formerly Matasano, iSEC Partners, and NGS Secure.

    • Tools

  • Credits

Programming Languages
Python 36 Java 12 C 11 JavaScript 7 Go 6 Shell 2 Rust 2 PHP 1 Ruby 1 PowerShell 1
Categories
Android Security 104 Asset Discovery 72 Application Security 10 Credits 2
Sub Categories
Dynamic Analysis Tools 22 Domain / Subdomain Discovery 17 Vulnerabilities 14 IP Address Discovery 13 Static Analysis Tools 13 Reverse Engineering 12 Misc Tools 11 Websites 7 Online Analyzers 7 Others 6 Cloud Infrastructure Discovery 6 Market Crawlers 6 Internet Scan / Archived Information 6 Source Code Aggregators / Search - Information Discovery 5 Data Leaks 5 Business Communication Infrastructure Discovery 5 Fuzz Testing 5 Network/Port Scanning 4 Social Media / Employee Profiling 4 Application Vulnerability Scanners 4 Company Information and Associations 3 Email Discovery 3 Research Papers 2 Internet Survey Data 2 Application Security Learning Resources 1 Content Discovery 1 Tools 1 Books 1 Application Repackaging Detectors 1 Blogs 1
Keywords
android 12 security 11 pentesting 10 osint 9 reverse-engineering 6 reconnaissance 6 dns 6 mobile-security 5 security-tools 5 python 5 hacking 5 owasp 4 recon 4 dynamic-analysis 4 static-analysis 4 apk 4 android-security 3 bugbounty 3 subdomain 3 enumeration 3 application-security 3 ios-security 2 owasp-top-ten 2 malware-analysis 2 javascript 2 android-application 2 dnssec 2 nodejs 2 brute-force 2 frida 2 ios-app 2 network-security 2 golang 2 go 2 crawler 2 infosec 2 penetration-testing 2 dex 2 vulnerabilities 2 java 2 riskindroid 1 fuzzing 1 c 1 analyzer 1 android-analyzer 1 android-development 1 linux 1 macos 1 odex 1 rust 1