Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
paralax-awesome-pentest
https://github.com/r3p3r/paralax-awesome-pentest
Last synced: 3 days ago
JSON representation
-
Books
-
Penetration Testing Books
- Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014
- Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014
- Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014
- Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014
- Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014
- Fuzzing: Brute Force Vulnerability Discovery by Michael Sutton et al., 2007
- Rtfm: Red Team Field Manual by Ben Clark, 2014
- Advanced Penetration Testing for Highly-Secured Environments by Lee Allen, 2012
- Unauthorised Access: Physical Penetration Testing For IT Security Teams by Wil Allsopp, 2010
- Advanced Persistent Threat Hacking: The Art and Science of Hacking Any Organization by Tyler Wrightson, 2014
-
Malware Analysis Books
-
Social Engineering Books
- The Art of Deception by Kevin D. Mitnick & William L. Simon, 2002
- The Art of Intrusion by Kevin D. Mitnick & William L. Simon, 2005
- Ghost in the Wires by Kevin D. Mitnick & William L. Simon, 2011
- Social Engineering: The Art of Human Hacking by Christopher Hadnagy, 2010
- Unmasking the Social Engineer: The Human Element of Security by Christopher Hadnagy, 2014
- Social Engineering in IT Security: Tools, Tactics, and Techniques by Sharon Conheady, 2014
-
Lock Picking Books
-
Hackers Handbook Series
- The Database Hacker's Handbook, David Litchfield et al., 2005
- The Shellcoders Handbook by Chris Anley et al., 2007
- The Mac Hacker's Handbook by Charlie Miller & Dino Dai Zovi, 2009
- The Web Application Hackers Handbook by D. Stuttard, M. Pinto, 2011
- iOS Hackers Handbook by Charlie Miller et al., 2012
- Android Hackers Handbook by Joshua J. Drake et al., 2014
- The Browser Hackers Handbook by Wade Alcorn et al., 2014
- The Mobile Application Hackers Handbook by Dominic Chell et al., 2015
-
Defensive Development
-
Network Analysis Books
-
Reverse Engineering Books
-
Defcon Suggested Reading
-
Windows Books
-
-
Tools
-
Network Tools
- Debookee - Simple and powerful network traffic analyzer for macOS.
- Intercepter-NG - Multifunctional network toolkit.
- DNSDumpster - Online DNS recon and search service.
- zmap - Open source network scanner that enables researchers to easily perform Internet-wide network studies.
- nmap - Free security scanner for network exploration & security audits.
- Wireshark - Widely-used graphical, cross-platform network protocol analyzer.
- dnstracer - Determines where a given DNS server gets its information from, and follows the chain of DNS servers.
- dsniff - Collection of tools for network auditing and pentesting.
- Dripcap - Caffeinated packet analyzer.
- Praeda - Automated multi-function printer data harvester for gathering usable data during security assessments.
- Debookee - Simple and powerful network traffic analyzer for macOS.
-
DDoS Tools
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- HOIC - Updated version of Low Orbit Ion Cannon, has 'boosters' to get around common counter measures.
- T50 - Faster network stress tool.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
- JS LOIC - JavaScript in-browser version of LOIC.
-
Web Exploitation
- sslstrip - Demonstration of the HTTPS stripping attacks.
- OWASP Zed Attack Proxy (ZAP) - Feature-rich, scriptable HTTP intercepting proxy and fuzzer for penetration testing web applications.
- Fiddler - Free cross-platform web debugging proxy with user-friendly companion tools.
- autochrome - Easy to install a test browser with all the appropriate setting needed for web application testing with native Burp support, from NCCGroup.
-
Hex Editors
-
File Format Analysis Tools
- Kaitai Struct - File formats and network protocols dissection language and web IDE, generating parsers in C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.
- Veles - Binary data visualization and analysis tool.
-
Hash Cracking Tools
- CeWL - Generates custom wordlists by spidering a target's website and collecting unique words.
-
Windows Utilities
-
macOS Utilities
- Bella - Pure Python post-exploitation data mining and remote administration tool for macOS.
-
Penetration Testing Distributions
- Kali - GNU/Linux distribution designed for digital forensics and penetration testing.
- ArchStrike - Arch GNU/Linux repository for security professionals and enthusiasts.
- BlackArch - Arch GNU/Linux-based distribution for penetration testers and security researchers.
- Parrot - Distribution similar to Kali, with multiple architecture.
- Buscador - GNU/Linux virtual machine that is pre-configured for online investigators.
-
Docker for Penetration Testing
-
Multi-paradigm Frameworks
- Metasploit - Software for offensive security teams to help verify vulnerabilities and manage security assessments.
- Armitage - Java-based GUI front-end for the Metasploit Framework.
- ExploitPack - Graphical tool for automating penetration tests that ships with many pre-packaged exploits.
-
Vulnerability Scanners
- Nexpose - Commercial vulnerability and risk management assessment engine that integrates with Metasploit, sold by Rapid7.
- Nikto - Noisy but fast black box web server and web application vulnerability scanner.
- SecApps - In-browser web application security testing suite.
- WebReaver - Commercial, graphical web application vulnerability scanner designed for macOS.
- WPScan - Black box WordPress vulnerability scanner.
- cms-explorer - Reveal the specific modules, plugins, components and themes that various websites powered by content management systems are running.
-
Wireless Network Tools
- Aircrack-ng - Set of tools for auditing wireless networks.
- Kismet - Wireless network detector, sniffer, and IDS.
- Reaver - Brute force attack against WiFi Protected Setup.
-
OSINT Tools
- Google-dorks - Common Google dorks and others you probably don't know.
- Shodan - World's first search engine for Internet-connected devices.
- recon-ng - Full-featured Web Reconnaissance framework written in Python.
- Threat Crowd - Search engine for threats.
- Censys - Collects data on hosts and websites through daily ZMap and ZGrab scans.
- Maltego - Proprietary software for open source intelligence and forensics, from Paterva.
-
Anonymity Tools
- Tor - Free software and onion routed overlay network that helps you defend against traffic analysis.
-
Reverse Engineering Tools
- Interactive Disassembler (IDA Pro) - Proprietary multi-processor disassembler and debugger for Windows, GNU/Linux, or macOS; also has a free version, [IDA Free](https://www.hex-rays.com/products/ida/support/download_freeware.shtml).
- OllyDbg - x86 debugger for Windows binaries that emphasizes binary code analysis.
- Immunity Debugger - Powerful way to write exploits and analyze malware.
-
Physical Access Tools
- Poisontap - Siphons cookies, exposes internal (LAN-side) router and installs web backdoor on locked computers.
-
-
Vulnerability Databases
-
Defcon Suggested Reading
- SecuriTeam - Independent source of software vulnerability information.
- Common Vulnerabilities and Exposures (CVE) - Dictionary of common names (i.e., CVE Identifiers) for publicly known security vulnerabilities.
- National Vulnerability Database (NVD) - United States government's National Vulnerability Database provides additional meta-data (CPE, CVSS scoring) of the standard CVE List along with a fine-grained search engine.
- US-CERT Vulnerability Notes Database - Summaries, technical details, remediation information, and lists of vendors affected by software vulnerabilities, aggregated by the United States Computer Emergency Response Team (US-CERT).
- Bugtraq (BID) - Software security bug identification database compiled from submissions to the SecurityFocus mailing list and other sources, operated by Symantec, Inc.
- Exploit-DB - Non-profit project hosting exploits for software vulnerabilities, provided as a public service by Offensive Security.
- CXSecurity - Archive of published CVE and Bugtraq software vulnerabilities cross-referenced with a Google dork database for discovering the listed vulnerability.
- Vulnerability Lab - Open forum for security advisories organized by category of exploit target.
- Vulners - Security database of software vulnerabilities.
- Inj3ct0r - Exploit marketplace and vulnerability information aggregator.
- Open Source Vulnerability Database (OSVDB) - Historical archive of security vulnerabilities in computerized equipment, no longer adding to its vulnerability database as of April, 2016.
- Packet Storm - Compendium of exploits, advisories, tools, and other security-related resources aggregated from across the industry.
- Zero Day Initiative - Bug bounty program with publicly accessible archive of published security advisories, operated by TippingPoint.
-
-
Online Resources
-
Penetration Testing Resources
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- Vulnerability Assessment Framework - Penetration Testing Framework.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
- Metasploit Unleashed - Free Offensive Security Metasploit course.
- XSS-Payloads - Ultimate resource for all things cross-site including payloads, tools, games and documentation.
-
Operating Systems
- Security related Operating Systems @ Rawsec - Complete list of security related operating systems.
- Security related Operating Systems @ Rawsec - Complete list of security related operating systems.
- Digital Evidence & Forensics Toolkit (DEFT) - Live CD for forensic analysis runnable without tampering or corrupting connected devices where the boot process takes place.
- Best Linux Penetration Testing Distributions @ CyberPunk - Description of main penetration testing distributions.
-
Exploit Development
- Shellcode Examples - Shellcodes database.
- Exploit Writing Tutorials - Tutorials on how to develop exploits.
-
OSINT Resources
- Intel Techniques - Collection of OSINT tools. Menu on the left can be used to navigate through the categories.
- NetBootcamp OSINT Tools - Collection of OSINT links and custom Web interfaces to other services such as [Facebook Graph Search](http://netbootcamp.org/facebook.html) and [various paste sites](http://netbootcamp.org/pastesearch.html).
-
Lock Picking Resources
- /r/lockpicking - Resources for learning lockpicking, equipment recommendations.
-
-
Security Courses
-
Defcon Suggested Reading
- Offensive Security Training - Training from BackTrack/Kali developers.
- SANS Security Training - Computer Security Training & Certification.
- Open Security Training - Training material for computer security classes.
-
-
Information Security Conferences
-
Defcon Suggested Reading
- CCC - Annual meeting of the international hacker scene in Germany.
- DerbyCon - Annual hacker conference based in Louisville.
- PhreakNIC - Technology conference held annually in middle Tennessee.
- CHCon - Christchurch Hacker Con, Only South Island of New Zealand hacker con.
- Hack.lu - Annual conference held in Luxembourg.
- HITB - Deep-knowledge security conference held in Malaysia and The Netherlands.
- Hack3rCon - Annual US hacker conference.
- DeepSec - Security Conference in Vienna, Austria.
- SECUINSIDE - Security Conference in [Seoul](https://en.wikipedia.org/wiki/Seoul).
- AppSecUSA - Annual conference organised by OWASP.
- RSA Conference USA - Annual security conference in San Francisco, California, USA.
- Swiss Cyber Storm - Annual security conference in Lucerne, Switzerland.
- 44Con - Annual Security Conference held in London.
- SummerCon - One of the oldest hacker conventions, held during Summer.
- DEF CON - Annual hacker convention in Las Vegas.
- Virus Bulletin Conference - Annual conference going to be held in Denver, USA for 2016.
-
-
Information Security Magazines
-
Defcon Suggested Reading
- 2600: The Hacker Quarterly - American publication about technology and computer "underground."
- Phrack Magazine - By far the longest running hacker zine.
-
-
Awesome Lists
-
Defcon Suggested Reading
- C/C++ Programming - One of the main language for open source security tools.
- .NET Programming - Software framework for Microsoft Windows platform development.
- Shell Scripting - Command line frameworks, toolkits, guides and gizmos.
- Ruby Programming by @markets - The de-facto language for writing exploits.
- JavaScript Programming - In-browser development and scripting.
- Python Programming by @vinta - General Python programming.
- Android Security - Collection of Android security related resources.
- Awesome Awesomness - The List of the Lists.
- AppSec - Resources for learning about application security.
- CTFs - Capture The Flag frameworks, libraries, etc.
- InfoSec § Hacking challenges - Comprehensive directory of CTFs, wargames, hacking challenge websites, pentest practice lab exercises, and more.
- Hacking - Tutorials, tools, and resources.
- Honeypots - Honeypots, tools, components, and more.
- Malware Analysis - Tools and resources for analysts.
- PCAP Tools - Tools for processing network traffic.
- Security - Software, libraries, documents, and other resources.
-
Programming Languages
Categories
Sub Categories
Defcon Suggested Reading
51
DDoS Tools
25
Network Tools
11
Penetration Testing Books
10
Penetration Testing Resources
10
Hackers Handbook Series
8
OSINT Tools
6
Social Engineering Books
6
Vulnerability Scanners
6
Penetration Testing Distributions
5
Operating Systems
4
Web Exploitation
4
Docker for Penetration Testing
4
Reverse Engineering Books
3
Wireless Network Tools
3
Reverse Engineering Tools
3
Lock Picking Books
3
Multi-paradigm Frameworks
3
Hex Editors
2
Network Analysis Books
2
File Format Analysis Tools
2
Malware Analysis Books
2
Defensive Development
2
Exploit Development
2
OSINT Resources
2
Windows Utilities
2
Windows Books
1
Hash Cracking Tools
1
Anonymity Tools
1
macOS Utilities
1
Lock Picking Resources
1
Physical Access Tools
1
Keywords
awesome
10
awesome-list
8
list
5
security
4
python-framework
1
python
1
collections
1
ruby-libraries
1
python-library
1
ruby
1
curated-list
1
collection
1
zsh
1
shell
1
fish
1
cli
1
bash
1
fsharp
1
dotnet
1
csharp
1
clr
1
resources
1
programming-tutorial
1
lists
1
libraries
1
cppcon
1
cpp-library
1
cpp
1
c-plus-plus
1
threatintel
1
threat-sharing
1
threat-intelligence
1
static-analysis
1
network-traffic
1
malware-samples
1
malware-research
1
malware-collection
1
malware-analysis
1
dynamic-analysis
1
drop-ice
1
domain-analysis
1
chinese-translation
1
chinese
1
automated-analysis
1
analysis-framework
1
honeypot
1
honeyd
1
hacking
1
penetration
1
ctf
1