https://DevOpsCloud.io -- Cloud Monk Losang Jinpa

User Tools

Site Tools

Trace: • awesome_pentesting
awesome_pentesting

Awesome Pentesting

Return to Awesome, GitHub Pentesting, Pentesting

  1. Awesome Penetration Testing [![Awesome](https://awesome.re/badge-flat2.svg)](https://awesome.re)
A collection of awesome penetration testing and offensive cybersecurity resources.

[Penetration testing](https://en.wikipedia.org/wiki/Penetration_test) is the practice of launching authorized, simulated attacks against computer systems and their physical infrastructure to expose potential security weaknesses and vulnerabilities. Should you discover a vulnerability, please follow [this guidance](https://kb.cert.org/vuls/guidance/) to report it responsibly.

Your contributions and suggestions are heartily♥ welcome. (✿◕‿◕). Please check the [Contributing Guidelines](CONTRIBUTING.md) for more details. This work is licensed under a [Creative Commons Attribution 4.0 International License](https://creativecommons.org/licenses/by/4.0/).

[This project is supported by Netsparker Web Application Security Scanner](https://www.netsparker.com/?utm_source=github.com&utm_content=awesome+penetration+testing&utm_medium=referral&utm_campaign=generic+advert)

  1. Contents
  • [Android Utilities](#android-utilities)
  • [Anonymity Tools](#anonymity-tools)
     * [Tor Tools](#tor-tools)
  • [Anti-virus Evasion Tools](#anti-virus-evasion-tools)
  • [Books](#books)
     * [Malware Analysis Books](#malware-analysis-books)
  • [CTF Tools](#ctf-tools)
  • [Cloud Platform Attack Tools](#cloud-platform-attack-tools)
  • [Collaboration Tools](#collaboration-tools)
  • [Conferences and Events](#conferences-and-events)
     * [Asia](#asia)
 * [Europe](#europe)
 * [North America](#north-america)
 * [South America](#south-america)
 * [Zealandia](#zealandia)
  • [Exfiltration Tools](#exfiltration-tools)
  • [Exploit Development Tools](#exploit-development-tools)
  • [File Format Analysis Tools](#file-format-analysis-tools)
  • [GNU/Linux Utilities](#gnulinux-utilities)
  • [Hash Cracking Tools](#hash-cracking-tools)
  • [Hex Editors](#hex-editors)
  • [Industrial Control and SCADA Systems](#industrial-control-and-scada-systems)
  • [Intentionally Vulnerable Systems](#intentionally-vulnerable-systems)
     * [Intentionally Vulnerable Systems as Docker Containers](#intentionally-vulnerable-systems-as-docker-containers)
  • [Lock Picking](#lock-picking)
  • [macOS Utilities](#macos-utilities)
  • [Multi-paradigm Frameworks](#multi-paradigm-frameworks)
  • [Network Tools](#network-tools)
     * [DDoS Tools](#ddos-tools)
 * [Network Reconnaissance Tools](#network-reconnaissance-tools)
 * [Protocol Analyzers and Sniffers](#protocol-analyzers-and-sniffers)
 * [Network Traffic Replay and Editing Tools](#network-traffic-replay-and-editing-tools)
 * [Proxies and Machine-in-the-Middle (MITM) Tools](#proxies-and-machine-in-the-middle-mitm-tools)
 * [Transport Layer Security Tools](#transport-layer-security-tools)
 * [Wireless Network Tools](#wireless-network-tools)
  • [Network Vulnerability Scanners](#network-vulnerability-scanners)
     * [Web Vulnerability Scanners](#web-vulnerability-scanners)
  • [Open Sources Intelligence (OSINT)](#open-sources-intelligence-osint)
     * [Data broker and search engine services](#data-broker-and-search-engine-services)
 * [Dorking tools](#dorking-tools)
 * [Email search and analysis tools](#email-search-and-analysis-tools)
 * [Metadata harvesting and analysis](#metadata-harvesting-and-analysis)
 * [Network device discovery tools](#network-device-discovery-tools)
 * [OSINT Online Resources](#osint-online-resources)
 * [Source code repository searching tools](#source-code-repository-searching-tools)
 * [Web application and resource analysis tools](#web-application-and-resource-analysis-tools)
  • [Online Resources](#online-resources)
     * [Online Code Samples and Examples](#online-code-samples-and-examples)
 * [Online Exploit Development Resources](#online-exploit-development-resources)
 * [Online Lock Picking Resources](#online-lock-picking-resources)
 * [Online Operating Systems Resources](#online-operating-systems-resources)
 * [Online Penetration Testing Resources](#online-penetration-testing-resources)
 * [Other Lists Online](#other-lists-online)
 * [Penetration Testing Report Templates](#penetration-testing-report-templates)
  • [Operating System Distributions](#operating-system-distributions)
  • [Periodicals](#periodicals)
  • [Physical Access Tools](#physical-access-tools)
  • [Privilege Escalation Tools](#privilege-escalation-tools)
     * [Password Spraying Tools](#password-spraying-tools)
  • [Reverse Engineering](#reverse-engineering)
     * [Reverse Engineering Books](#reverse-engineering-books)
 * [Reverse Engineering Tools](#reverse-engineering-tools)
  • [Security Education Courses](#security-education-courses)
  • [Shellcoding Guides and Tutorials](#exploit-development-online-resources)
  • [Side-channel Tools](#side-channel-tools)
  • [Social Engineering](#social-engineering)
     * [Social Engineering Books](#social-engineering-books)
 * [Social Engineering Online Resources](#social-engineering-online-resources)
 * [Social Engineering Tools](#social-engineering-tools)
  • [Static Analyzers](#static-analyzers)
  • [Steganography Tools](#steganography-tools)
  • [Vulnerability Databases](#vulnerability-databases)
  • [Web Exploitation](#web-exploitation)
     * [Intercepting Web proxies](#intercepting-web-proxies)
 * [Web file inclusion tools](#web-file-inclusion-tools)
 * [Web injection tools](#web-injection-tools)
 * [Web path discovery and bruteforcing tools](#web-path-discovery-and-bruteforcing-tools)
 * [Web shells and C2 frameworks](#web-shells-and-c2-frameworks)
 * [Web-accessible source code ripping tools](#web-accessible-source-code-ripping-tools)
 * [Web Exploitation Books](#web-exploitation-books)
  • [Windows Utilities](#windows-utilities)
  1. Android Utilities
  • [cSploit](https://www.csploit.org/) - Advanced IT security professional toolkit on Android featuring an integrated Metasploit daemon and MITM capabilities.
  • [Fing](https://www.fing.com/products/fing-app/) - Network scanning and host enumeration app that performs NetBIOS, UPnP, Bonjour, SNMP, and various other advanced device fingerprinting techniques.
  1. Anonymity Tools
  • [I2P](https://geti2p.net/) - The Invisible Internet Project.
  • [Metadata Anonymization Toolkit (MAT)](https://0xacab.org/jvoisin/mat2) - Metadata removal tool, supporting a wide range of commonly used file formats, written in Python3.
  • [What Every Browser Knows About You](http://webkay.robinlinus.com/) - Comprehensive detection page to test your own Web browser's configuration for privacy and identity leaks.
  1. Tor Tools

See also [awesome-tor](https://github.com/ajvb/awesome-tor).

  1. Anti-virus Evasion Tools
  1. Books

See also [DEF CON Suggested Reading](https://www.defcon.org/html/links/book-list.html).

  1. Malware Analysis Books

See [awesome-malware-analysis § Books](https://github.com/rshipp/awesome-malware-analysis#books).

  1. CTF Tools
  1. Cloud Platform Attack Tools

See also *[HackingThe.cloud](https://hackingthe.cloud/)*.

  1. Collaboration Tools
  1. Conferences and Events
  • [BSides](http://www.securitybsides.com/) - Framework for organising and holding security conferences.
  • [CTFTime.org](https://ctftime.org/) - Directory of upcoming and archive of past Capture The Flag (CTF) competitions with links to challenge writeups.
  1. Asia
  1. Europe
  1. North America
  1. South America
  • [Ekoparty](http://www.ekoparty.org) - Largest Security Conference in Latin America, held annually in Buenos Aires, Argentina.
  • [Hackers to Hackers Conference (H2HC)](https://www.h2hc.com.br/) - Oldest security research (hacking) conference in Latin America and one of the oldest ones still active in the world.
  1. Zealandia
  • [CHCon](https://chcon.nz) - Christchurch Hacker Con, Only South Island of New Zealand hacker con.
  1. Exfiltration Tools
  • [DET](https://github.com/sensepost/DET) - Proof of concept to perform data exfiltration using either single or multiple channel(s) at the same time.
  • [Iodine](https://code.kryo.se/iodine/) - Tunnel IPv4 data through a DNS server; useful for exfiltration from networks where Internet access is firewalled, but DNS queries are allowed.
  • [TrevorC2](https://github.com/trustedsec/trevorc2) - Client/server tool for masking command and control and data exfiltration through a normally browsable website, not typical HTTP POST requests.
  • [dnscat2](https://github.com/iagox86/dnscat2) - Tool designed to create an encrypted command and control channel over the DNS protocol, which is an effective tunnel out of almost every network.
  • [pwnat](https://github.com/samyk/pwnat) - Punches holes in firewalls and NATs.
  • [tgcd](http://tgcd.sourceforge.net/) - Simple Unix network utility to extend the accessibility of TCP/IP based network services beyond firewalls.
  • [QueenSono](https://github.com/ariary/QueenSono) - Client/Server Binaries for data exfiltration with ICMP. Useful in a network where ICMP protocol is less monitored than others (which is a common case).
  1. Exploit Development Tools

See also *[Reverse Engineering Tools](#reverse-engineering-tools)*.

  1. File Format Analysis Tools
  1. GNU/Linux Utilities
  1. Hash Cracking Tools
  1. Hex Editors
  1. Industrial Control and SCADA Systems

See also [awesome-industrial-control-system-security](https://github.com/hslatman/awesome-industrial-control-system-security).

  1. Intentionally Vulnerable Systems

See also [awesome-vulnerable](https://github.com/kaiiyer/awesome-vulnerable).

  1. Intentionally Vulnerable Systems as Docker Containers
  1. Lock Picking

See [awesome-lockpicking](https://github.com/fabacab/awesome-lockpicking).

  1. macOS Utilities
  1. Multi-paradigm Frameworks
  • [Armitage](http://fastandeasyhacking.com/) - Java-based GUI front-end for the Metasploit Framework.
  • [AutoSploit](https://github.com/NullArray/AutoSploit) - Automated mass exploiter, which collects target by employing the Shodan.io API and programmatically chooses Metasploit exploit modules based on the Shodan query.
  • [Decker](https://github.com/stevenaldinger/decker) - Penetration testing orchestration and automation framework, which allows writing declarative, reusable configurations capable of ingesting variables and using outputs of tools it has run as inputs to others.
  • [Faraday](https://github.com/infobyte/faraday) - Multiuser integrated pentesting environment for red teams performing cooperative penetration tests, security audits, and risk assessments.
  • [Metasploit](https://www.metasploit.com/) - Software for offensive security teams to help verify vulnerabilities and manage security assessments.
  • [Pupy](https://github.com/n1nj4sec/pupy) - Cross-platform (Windows, Linux, macOS, Android) remote administration and post-exploitation tool.
  1. Network Tools
  1. DDoS Tools
  1. Network Reconnaissance Tools
  1. Protocol Analyzers and Sniffers

See also [awesome-pcaptools](https://github.com/caesar0301/awesome-pcaptools).

  1. Network Traffic Replay and Editing Tools
  1. Proxies and Machine-in-the-Middle (MITM) Tools

See also *[Intercepting Web proxies](#intercepting-web-proxies)*.

  1. Transport Layer Security Tools
  1. Wireless Network Tools
  1. Network Vulnerability Scanners
  1. Web Vulnerability Scanners
  1. Online Resources
  1. Online Operating Systems Resources
  1. Online Penetration Testing Resources
  1. Other Lists Online
  1. Penetration Testing Report Templates
  1. Open Sources Intelligence (OSINT)

See also [awesome-osint](https://github.com/jivoi/awesome-osint).

  1. Data Broker and Search Engine Services
  • [Hunter.io](https://hunter.io/) - Data broker providing a Web search interface for discovering the email addresses and other organizational details of a company.
  • [Threat Crowd](https://www.threatcrowd.org/) - Search engine for threats.
  • [Virus Total](https://www.virustotal.com/) - Free service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware.
  • [surfraw](https://github.com/kisom/surfraw) - Fast UNIX command line interface to a variety of popular WWW search engines.
  1. Dorking tools
  1. Email search and analysis tools
  1. Metadata harvesting and analysis
  1. Network device discovery tools
  1. OSINT Online Resources
  1. Source code repository searching tools

See also *[Web-accessible source code ripping tools](#web-accessible-source-code-ripping-tools)*.

  1. Web application and resource analysis tools
  1. Operating System Distributions
  • [Android Tamer](https://androidtamer.com/) - Distribution built for Android security professionals that includes tools required for Android security testing.
  • [ArchStrike](https://archstrike.org/) - Arch GNU/Linux repository for security professionals and enthusiasts.
  • [AttifyOS](https://github.com/adi0x90/attifyos) - GNU/Linux distribution focused on tools useful during Internet of Things (IoT) security assessments.
  • [BlackArch](https://www.blackarch.org/) - Arch GNU/Linux-based distribution for penetration testers and security researchers.
  • [Buscador](https://inteltechniques.com/buscador/) - GNU/Linux virtual machine that is pre-configured for online investigators.
  • [Kali](https://www.kali.org/) - Rolling Debian-based GNU/Linux distribution designed for penetration testing and digital forensics.
  • [Network Security Toolkit (NST)](http://networksecuritytoolkit.org/) - Fedora-based GNU/Linux bootable live Operating System designed to provide easy access to best-of-breed open source network security applications.
  • [Parrot](https://parrotlinux.org/) - Distribution similar to Kali, with support for multiple hardware architectures.
  • [PentestBox](https://pentestbox.org/) - Open source pre-configured portable penetration testing environment for the Windows Operating System.
  • [The Pentesters Framework](https://github.com/trustedsec/ptf) - Distro organized around the Penetration Testing Execution Standard (PTES), providing a curated collection of utilities that omits less frequently used utilities.
  1. Periodicals
  1. Physical Access Tools
  • [AT Commands](https://atcommands.org/) - Use AT commands over an Android device's USB port to rewrite device firmware, bypass security mechanisms, exfiltrate sensitive information, perform screen unlocks, and inject touch events.
  • [Bash Bunny](https://www.hak5.org/gear/bash-bunny) - Local exploit delivery tool in the form of a USB thumbdrive in which you write payloads in a DSL called BunnyScript.
  • [LAN Turtle](https://lanturtle.com/) - Covert “USB Ethernet Adapter” that provides remote access, network intelligence gathering, and MITM capabilities when installed in a local network.
  • [PCILeech](https://github.com/ufrisk/pcileech) - Uses PCIe hardware devices to read and write from the target system memory via Direct Memory Access (DMA) over PCIe.
  • [Packet Squirrel](https://www.hak5.org/gear/packet-squirrel) - Ethernet multi-tool designed to enable covert remote access, painless packet captures, and secure VPN connections with the flip of a switch.
  • [Poisontap](https://samy.pl/poisontap/) - Siphons cookies, exposes internal (LAN-side) router and installs web backdoor on locked computers.
  • [Proxmark3](https://proxmark3.com/) - RFID/NFC cloning, replay, and spoofing toolkit often used for analyzing and attacking proximity cards/readers, wireless keys/keyfobs, and more.
  • [Thunderclap](https://thunderclap.io/) - Open source I/O security research platform for auditing physical DMA-enabled hardware peripheral ports.
  • [USB Rubber Ducky](http://usbrubberducky.com/) - Customizable keystroke injection attack platform masquerading as a USB thumbdrive.
  1. Privilege Escalation Tools
  • [Active Directory and Privilege Escalation (ADAPE)](https://github.com/hausec/ADAPE-Script) - Umbrella script that automates numerous useful PowerShell modules to discover security misconfigurations and attempt privilege escalation against Active Directory.
  • [GTFOBins](https://gtfobins.github.io/) - Curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
  • [LOLBAS (Living Off The Land Binaries and Scripts)](https://lolbas-project.github.io/) - Documents binaries, scripts, and libraries that can be used for “Living Off The Land” techniques, i.e., binaries that can be used by an attacker to perform actions beyond their original purpose.
  • [LinEnum](https://github.com/rebootuser/LinEnum) - Scripted local Linux enumeration and privilege escalation checker useful for auditing a host and during CTF gaming.
  • [Postenum](https://github.com/mbahadou/postenum) - Shell script used for enumerating possible privilege escalation opportunities on a local GNU/Linux system.
  • [unix-privesc-check](https://github.com/pentestmonkey/unix-privesc-check) - Shell script to check for simple privilege escalation vectors on UNIX systems.
  1. Password Spraying Tools
  1. Reverse Engineering

See also [awesome-reversing](https://github.com/tylerha97/awesome-reversing), [*Exploit Development Tools*](#exploit-development-tools).

  1. Reverse Engineering Books
  1. Reverse Engineering Tools
  1. Security Education Courses
  1. Shellcoding Guides and Tutorials
  1. Side-channel Tools
  • [ChipWhisperer](http://chipwhisperer.com) - Complete open-source toolchain for side-channel power analysis and glitching attacks.
  • [SGX-Step](https://github.com/jovanbulck/sgx-step) - Open-source framework to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX (Software Guard Extensions) platforms in particular.
  • [TRRespass](https://github.com/vusec/trrespass) - Many-sided rowhammer tool suite able to reverse engineer the contents of DDR3 and DDR4 memory chips protected by Target Row Refresh mitigations.
  1. Social Engineering

See also [awesome-social-engineering](https://github.com/v2-dev/awesome-social-engineering).

  1. Social Engineering Books
  1. Social Engineering Online Resources
  1. Social Engineering Tools
  1. Static Analyzers
  1. Steganography Tools
  1. Vulnerability Databases
  • [Bugtraq (BID)](http://www.securityfocus.com/bid/) - Software security bug identification database compiled from submissions to the SecurityFocus mailing list and other sources, operated by Symantec, Inc.
  • [CXSecurity](https://cxsecurity.com/) - Archive of published CVE and Bugtraq software vulnerabilities cross-referenced with a Google dork database for discovering the listed vulnerability.
  • [China National Vulnerability Database (CNNVD)](http://www.cnnvd.org.cn/) - Chinese government-run vulnerability database analoguous to the United States's CVE database hosted by Mitre Corporation.
  • [Common Vulnerabilities and Exposures (CVE)](https://cve.mitre.org/) - Dictionary of common names (i.e., CVE Identifiers) for publicly known security vulnerabilities.
  • [Exploit-DB](https://www.exploit-db.com/) - Non-profit project hosting exploits for software vulnerabilities, provided as a public service by Offensive Security.
  • [Full-Disclosure](http://seclists.org/fulldisclosure/) - Public, vendor-neutral forum for detailed discussion of vulnerabilities, often publishes details before many other sources.
  • [GitHub Advisories](https://github.com/advisories/) - Public vulnerability advisories published by or affecting codebases hosted by GitHub, including open source projects.
  • [HPI-VDB](https://hpi-vdb.de/) - Aggregator of cross-referenced software vulnerabilities offering free-of-charge API access, provided by the Hasso-Plattner Institute, Potsdam.
  • [Inj3ct0r](https://www.0day.today/) - Exploit marketplace and vulnerability information aggregator. ([Onion service](http://mvfjfugdwgc5uwho.onion/).)
  • [Microsoft Security Advisories and Bulletins](https://docs.microsoft.com/en-us/security-updates/) - Archive and announcements of security advisories impacting Microsoft software, published by the Microsoft Security Response Center (MSRC).
  • [Mozilla Foundation Security Advisories](https://www.mozilla.org/security/advisories/) - Archive of security advisories impacting Mozilla software, including the Firefox Web Browser.
  • [National Vulnerability Database (NVD)](https://nvd.nist.gov/) - United States government's National Vulnerability Database provides additional meta-data (CPE, CVSS scoring) of the standard CVE List along with a fine-grained search engine.
  • [Open Source Vulnerabilities (OSV)](https://osv.dev/) - Database of vulnerabilities affecting open source software, queryable by project, Git commit, or version.
  • [Packet Storm](https://packetstormsecurity.com/files/) - Compendium of exploits, advisories, tools, and other security-related resources aggregated from across the industry.
  • [SecuriTeam](http://www.securiteam.com/) - Independent source of software vulnerability information.
  • [Snyk Vulnerability DB](https://snyk.io/vuln/) - Detailed information and remediation guidance for vulnerabilities known by Snyk.
  • [US-CERT Vulnerability Notes Database](https://www.kb.cert.org/vuls/) - Summaries, technical details, remediation information, and lists of vendors affected by software vulnerabilities, aggregated by the United States Computer Emergency Response Team (US-CERT).
  • [Vulnerability Lab](https://www.vulnerability-lab.com/) - Open forum for security advisories organized by category of exploit target.
  • [Vulners](https://vulners.com/) - Security database of software vulnerabilities.
  • [Vulmon](https://vulmon.com/) - Vulnerability search engine with vulnerability intelligence features that conducts full text searches in its database.
  • [Zero Day Initiative](http://zerodayinitiative.com/advisories/published/) - Bug bounty program with publicly accessible archive of published security advisories, operated by TippingPoint.
  1. Web Exploitation
  1. Intercepting Web proxies

See also *[Proxies and Machine-in-the-Middle (MITM) Tools](#proxies-and-machine-in-the-middle-mitm-tools)*.

  • [Burp Suite](https://portswigger.net/burp/) - Integrated platform for performing security testing of web applications.
  • [Fiddler](https://www.telerik.com/fiddler) - Free cross-platform web debugging proxy with user-friendly companion tools.
  • [OWASP Zed Attack Proxy (ZAP)](https://www.zaproxy.org/) - Feature-rich, scriptable HTTP intercepting proxy and fuzzer for penetration testing web applications.
  • [mitmproxy](https://mitmproxy.org/) - Interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.
  1. Web file inclusion tools
  1. Web injection tools
  1. Web path discovery and bruteforcing tools
  1. Web shells and C2 frameworks
  1. Web-accessible source code ripping tools
  1. Web Exploitation Books
  1. Windows Utilities
  1. License

[![CC-BY](https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/by.svg)](https://creativecommons.org/licenses/by/4.0/)

This work is licensed under a [Creative Commons Attribution 4.0 International License](https://creativecommons.org/licenses/by/4.0/).

awesome_pentesting.txt · Last modified: 2024/04/28 03:36 by 127.0.0.1