Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

penetration-testing

A collection of awesome penetration testing and offensive cybersecurity resources.
https://github.com/txuswashere/penetration-testing

Last synced: 8 days ago
JSON representation

  • Network Tools

    • Proxies and Machine-in-the-Middle (MITM) Tools

      • oregano - Python module that runs as a machine-in-the-middle (MITM) accepting Tor client requests.
      • sylkie - Command line tool and library for testing networks for common address spoofing security vulnerabilities in IPv6 networks using the Neighbor Discovery Protocol.
      • PETEP - Extensible TCP/UDP proxy with GUI for traffic analysis & modification with SSL/TLS support.

    • Transport Layer Security Tools

      • SSLyze - Fast and comprehensive TLS/SSL configuration analyzer to help identify security mis-configurations.
      • crackpkcs12 - Multithreaded program to crack PKCS#12 files (`.p12` and `.pfx` extensions), such as TLS/SSL certificates.
      • tls_prober - Fingerprint a server's SSL/TLS implementation.
      • testssl.sh - Command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as some cryptographic flaws.

    • Wireless Network Tools

      • Aircrack-ng - Set of tools for auditing wireless networks.
      • Airgeddon - Multi-use bash script for Linux systems to audit wireless networks.
      • BoopSuite - Suite of tools written in Python for wireless auditing.
      • Bully - Implementation of the WPS brute force attack, written in C.
      • Cowpatty - Brute-force dictionary attack against WPA-PSK.
      • Fluxion - Suite of automated social engineering based WPA attacks.
      • KRACK Detector - Detect and prevent KRACK attacks in your network.
      • Kismet - Wireless network detector, sniffer, and IDS.
      • Reaver - Brute force attack against WiFi Protected Setup.
      • WiFi-Pumpkin - Framework for rogue Wi-Fi access point attack.
      • Wifite - Automated wireless attack tool.
      • infernal-twin - Automated wireless hacking tool.
      • krackattacks-scripts - WPA2 Krack attack scripts.
      • pwnagotchi - Deep reinforcement learning based AI that learns from the Wi-Fi environment and instruments BetterCAP in order to maximize the WPA key material captured.
      • wifi-arsenal - Resources for Wi-Fi Pentesting.

  • Network Vulnerability Scanners

    • Web Vulnerability Scanners

      • ACSTIS - Automated client-side template injection (sandbox escape/bypass) detection for AngularJS.
      • JCS - Joomla Vulnerability Component Scanner with automatic database updater from exploitdb and packetstorm.
      • Nikto - Noisy but fast black box web server and web application vulnerability scanner.
      • SecApps - In-browser web application security testing suite.
      • WebReaver - Commercial, graphical web application vulnerability scanner designed for macOS.
      • joomscan - Joomla vulnerability scanner.
      • skipfish - Performant and adaptable active web application security reconnaissance tool.
      • w3af - Web application attack and audit framework.
      • Wapiti - Black box web application vulnerability scanner with built-in fuzzer.

    • Wireless Network Tools

      • celerystalk - Asynchronous enumeration and vulnerability scanner that "runs all the tools on all the hosts" in a configurable manner.
      • Netsparker Application Security Scanner - Application security scanner to automatically find security flaws.
      • Nexpose - Commercial vulnerability and risk management assessment engine that integrates with Metasploit, sold by Rapid7.
      • Vuls - Agentless vulnerability scanner for GNU/Linux and FreeBSD, written in Go.
      • kube-hunter - Open-source tool that runs a set of tests ("hunters") for security issues in Kubernetes clusters from either outside ("attacker's view") or inside a cluster.

  • Online Resources

  • Open Sources Intelligence (OSINT)

      • Hunter.io - Data broker providing a Web search interface for discovering the email addresses and other organizational details of a company.
      • Threat Crowd - Search engine for threats.
      • Virus Total - Free service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware.
      • surfraw - Fast UNIX command line interface to a variety of popular WWW search engines.

    • Dorking tools

      • BinGoo - GNU/Linux bash based Bing and Google Dorking Tool.
      • dorkbot - Command-line tool to scan Google (or other) search results for vulnerabilities.
      • github-dorks - CLI tool to scan GitHub repos/organizations for potential sensitive information leaks.
      • GooDork - Command line Google dorking tool.
      • dork-cli - Command line Google dork tool.
      • dorks - Google hack database automation tool.
      • fast-recon - Perform Google dorks against a domain.
      • pagodo - Automate Google Hacking Database scraping.
      • snitch - Information gathering via dorks.
      • Google Hacking Database - Database of Google dorks; can be used for recon.
      • SimplyEmail - Email recon made fast and easy.
      • WhatBreach - Search email addresses and discover all known breaches that this email has been seen in, and download the breached database if it is publicly available.

    • Metadata harvesting and analysis

    • Network device discovery tools

      • Shodan - World's first search engine for Internet-connected devices.
      • ZoomEye - Search engine for cyberspace that lets the user find specific network components.

    • OSINT Online Resources

      • CertGraph - Crawls a domain's SSL/TLS certificates for its certificate alternative names.
      • GhostProject - Searchable database of billions of cleartext passwords, partially visible for free.
      • NetBootcamp OSINT Tools - Collection of OSINT links and custom Web interfaces to other services.
      • WiGLE.net - Information about wireless networks world-wide, with user-friendly desktop and web applications.
      • OSINT Framework - Collection of various OSINT tools broken out by category.

    • Penetration Testing Report Templates

      • awesome-osint
      • Depix - Tool for recovering passwords from pixelized screenshots (by de-pixelating text).
      • GyoiThon - GyoiThon is an Intelligence Gathering tool using Machine Learning.
      • Intrigue - Automated OSINT & Attack Surface discovery framework with powerful API, UI and CLI.
      • Skiptracer - OSINT scraping framework that utilizes basic Python webscraping (BeautifulSoup) of PII paywall sites to compile passive information on a target on a ramen noodle budget.
      • Sn1per - Automated Pentest Recon Scanner.
      • creepy - Geolocation OSINT tool.
      • gOSINT - OSINT tool with multiple modules and a telegram scraper.
      • image-match - Quickly search over billions of images.
      • recon-ng - Full-featured Web Reconnaissance framework written in Python.
      • sn0int - Semi-automatic OSINT framework and package manager.
      • PacketTotal - Simple, free, high-quality packet capture file analysis facilitating the quick detection of network-borne malware (using Zeek and Suricata IDS signatures under the hood).
      • Facebook Friend List Scraper - Tool to scrape names and usernames from large friend lists on Facebook, without being rate limited.
      • DataSploit - OSINT visualizer utilizing Shodan, Censys, Clearbit, EmailHunter, FullContact, and Zoomeye behind the scenes.

    • Source code repository searching tools

      • vcsmap - Plugin-based tool to scan public version control systems for sensitive information.

    • Web application and resource analysis tools

      • EyeWitness - Tool to take screenshots of websites, provide some server header info, and identify default credentials if possible.
      • GraphQL Voyager - Represent any GraphQL API as an interactive graph, letting you explore data models from any Web site with a GraphQL query endpoint.
      • VHostScan - Virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.
      • Wappalyzer - Wappalyzer uncovers the technologies used on websites.
      • WhatWaf - Detect and bypass web application firewalls and protection systems.
      • WhatWeb - Website fingerprinter.
      • wafw00f - Identifies and fingerprints Web Application Firewall (WAF) products.
      • webscreenshot - Simple script to take screenshots of websites from a list of sites.
      • BlindElephant - Web application fingerprinter.

  • Operating System Distributions

    • Web application and resource analysis tools

      • Android Tamer - Distribution built for Android security professionals that includes tools required for Android security testing.
      • ArchStrike - Arch GNU/Linux repository for security professionals and enthusiasts.
      • AttifyOS - GNU/Linux distribution focused on tools useful during Internet of Things (IoT) security assessments.
      • BlackArch - Arch GNU/Linux-based distribution for penetration testers and security researchers.
      • Buscador - GNU/Linux virtual machine that is pre-configured for online investigators.
      • Kali - Rolling Debian-based GNU/Linux distribution designed for penetration testing and digital forensics.
      • Parrot - Distribution similar to Kali, with support for multiple hardware architectures.
      • PentestBox - Open source pre-configured portable penetration testing environment for the Windows Operating System.
      • The Pentesters Framework - Distro organized around the Penetration Testing Execution Standard (PTES), providing a curated collection of utilities that omits less frequently used utilities.

  • Periodicals

    • Web application and resource analysis tools

  • Physical Access Tools

    • Web application and resource analysis tools

      • AT Commands - Use AT commands over an Android device's USB port to rewrite device firmware, bypass security mechanisms, exfiltrate sensitive information, perform screen unlocks, and inject touch events.
      • PCILeech - Uses PCIe hardware devices to read and write from the target system memory via Direct Memory Access (DMA) over PCIe.
      • Poisontap - Siphons cookies, exposes internal (LAN-side) router and installs web backdoor on locked computers.
      • Proxmark3 - RFID/NFC cloning, replay, and spoofing toolkit often used for analyzing and attacking proximity cards/readers, wireless keys/keyfobs, and more.
      • Thunderclap - Open source I/O security research platform for auditing physical DMA-enabled hardware peripheral ports.

  • Privilege Escalation Tools

    • Password Spraying Tools

      • DomainPasswordSpray - Tool written in PowerShell to perform a password spray attack against users of a domain.
      • SprayingToolkit - Scripts to make password spraying attacks against Lync/S4B, Outlook Web Access (OWA) and Office 365 (O365) a lot quicker, less painful and more efficient.

    • Web application and resource analysis tools

      • Active Directory and Privilege Escalation (ADAPE) - Umbrella script that automates numerous useful PowerShell modules to discover security misconfigurations and attempt privilege escalation against Active Directory.
      • GTFOBins - Curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
      • LOLBAS (Living Off The Land Binaries and Scripts) - Documents binaries, scripts, and libraries that can be used for "Living Off The Land" techniques, i.e., binaries that can be used by an attacker to perform actions beyond their original purpose.
      • LinEnum - Scripted local Linux enumeration and privilege escalation checker useful for auditing a host and during CTF gaming.
      • Postenum - Shell script used for enumerating possible privilege escalation opportunities on a local GNU/Linux system.
      • unix-privesc-check - Shell script to check for simple privilege escalation vectors on UNIX systems.

  • Reverse Engineering

  • Security Education Courses

  • Shellcoding Guides and Tutorials

  • Side-channel Tools

    • Reverse Engineering Tools

      • SGX-Step - Open-source framework to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX (Software Guard Extensions) platforms in particular.
      • TRRespass - Many-sided rowhammer tool suite able to reverse engineer the contents of DDR3 and DDR4 memory chips protected by Target Row Refresh mitigations.
      • ChipWhisperer - Complete open-source toolchain for side-channel power analysis and glitching attacks.

  • Social Engineering

Programming Languages
Python 86 C 23 Go 16 Shell 14 PHP 7 Rust 7 Ruby 6 JavaScript 5 PowerShell 5 C# 5
Categories
Network Tools 90 Open Sources Intelligence (OSINT) 50 Online Resources 43 Web Exploitation 33 Conferences and Events 27 Vulnerability Databases 26 Books 23 Reverse Engineering 21 Windows Utilities 20 Social Engineering 15 Network Vulnerability Scanners 14 Anonymity Tools 10 Operating System Distributions 9 Static Analyzers 8 Privilege Escalation Tools 8 Exfiltration Tools 7 Hash Cracking Tools 7 Collaboration Tools 7 Multi-paradigm Frameworks 6 Anti-virus Evasion Tools 6 Security Education Courses 5 CTF Tools 5 Intentionally Vulnerable Systems 5 Hex Editors 5 Exploit Development Tools 5 Physical Access Tools 5 Industrial Control and SCADA Systems 4 Cloud Platform Attack Tools 4 Shellcoding Guides and Tutorials 4 Side-channel Tools 3 File Format Analysis Tools 3 Android Utilities 3 Steganography Tools 2 GNU/Linux Utilities 2 macOS Utilities 2 Periodicals 1 Lock Picking 1
Sub Categories
Social Engineering Tools 54 Zealandia 36 Tor Tools 35 Other Lists Online 34 Web application and resource analysis tools 30 Intentionally Vulnerable Systems as Docker Containers 29 Reverse Engineering Tools 29 Web Exploitation Books 22 Network Reconnaissance Tools 22 Wireless Network Tools 20 Malware Analysis Books 18 Penetration Testing Report Templates 17 Proxies and Machine-in-the-Middle (MITM) Tools 12 North America 12 Dorking tools 10 Web Vulnerability Scanners 9 Europe 8 Protocol Analyzers and Sniffers 7 DDoS Tools 7 Web shells and C2 frameworks 6 Network Traffic Replay and Editing Tools 6 OSINT Online Resources 5 Online Penetration Testing Resources 5 Web file inclusion tools 4 Web-accessible source code ripping tools 4 Social Engineering Books 4 Asia 4 Transport Layer Security Tools 4 Data Broker and Search Engine Services 4 Reverse Engineering Books 4 Metadata harvesting and analysis 3 Password Spraying Tools 3 Web injection tools 3 Intercepting Web proxies 3 Web path discovery and bruteforcing tools 3 Network device discovery tools 2 Email search and analysis tools 2 Source code repository searching tools 1 Online Operating Systems Resources 1 South America 1
Keywords
security 45 pentesting 27 python 23 hacking 22 awesome 21 awesome-list 20 pentest 15 security-tools 15 penetration-testing 14 osint 11 scanner 9 security-audit 9 hacking-tool 8 golang 8 infosec 8 pentest-tool 7 linux 7 list 7 bugbounty 6 reverse-engineering 6 enumeration 6 reconnaissance 6 recon 6 rust 5 ruby 5 network 5 cybersecurity 5 vulnerability-scanners 5 security-scanner 5 go 5 post-exploitation 5 python3 5 phishing 5 windows 5 mitm 4 malware-analysis 4 dns 4 static-analysis 4 ctf 4 active-directory 4 tor 4 vulnerabilities 4 appsec 4 hacking-tools 4 shell 4 network-security 4 vulnerability-scanner 4 fuzzing 4 redteam 4 cryptography 3