From 2f06ae82ac101f16a754566a9ad50d8973c4328b Mon Sep 17 00:00:00 2001
From: Jacob Kraniak <113630934+jacob-kraniak@users.noreply.github.com>
Date: Sat, 7 Mar 2026 21:28:39 -0500
Subject: [PATCH] pentest arsenal: 2026-03-07 21:28:39
Affected files:
.obsidian/workspace.json
tools/security/pentest-recon-enum/pentest-arsenal.md
---
.obsidian/workspace.json | 2 +-
.../pentest-recon-enum/pentest-arsenal.md | 220 ++++++++++++++++--
2 files changed, 202 insertions(+), 20 deletions(-)
diff --git a/.obsidian/workspace.json b/.obsidian/workspace.json
index e3ced84..44f3f09 100644
--- a/.obsidian/workspace.json
+++ b/.obsidian/workspace.json
@@ -14,7 +14,7 @@
"type": "markdown",
"state": {
"file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
- "mode": "source",
+ "mode": "preview",
"source": false
},
"icon": "lucide-file",
diff --git a/tools/security/pentest-recon-enum/pentest-arsenal.md b/tools/security/pentest-recon-enum/pentest-arsenal.md
index 8a4c73f..a29306c 100644
--- a/tools/security/pentest-recon-enum/pentest-arsenal.md
+++ b/tools/security/pentest-recon-enum/pentest-arsenal.md
@@ -1,20 +1,202 @@
-### Pentesters Arsenal Tools
+# Pentesters Arsenal Tools
-| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
-|-------------------|-----------------------------------------|--------------------------------------|--------------------------------------------------------|-------------------------------------------|------------------|---------------|---------|
-| Sandcat Browser | [syhunt.com/sandcat](https://www.syhunt.com/sandcat) | [syhunt/sandcat](https://github.com/syhunt/sandcat) | Penetration-oriented browser with built-in headers, Lua scripting, and dev tools. | [browser, pentest, lua, headers, web] | ~2023 | 2010s | — |
-| Metasploit | [metasploit.com](https://www.metasploit.com) | [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) | Exploitation framework for pentesting systems, networks, and web apps. | [exploit, framework, ruby, metasploit] | 2026-03 | 2003 | 33k+ |
-| Burp Suite | [portswigger.net/burp](https://portswigger.net/burp) | — | Industry-standard web vuln scanner, proxy, and testing toolkit. | [web, proxy, scanner, intercept, burp] | Active 2026 | 2006 | — |
-| OWASP ZAP | [zaproxy.org](https://www.zaproxy.org) | [zaproxy/zaproxy](https://github.com/zaproxy/zaproxy) | Open-source intercepting proxy and web app scanner (DAST). | [web, proxy, scanner, zap, owasp] | 2026 | 2010 | 12k+ |
-| mitmproxy | [mitmproxy.org](https://mitmproxy.org) | [mitmproxy/mitmproxy](https://github.com/mitmproxy/mitmproxy) | Interactive HTTPS-capable HTTP proxy for traffic inspection/modification. | [proxy, intercept, tls, python] | 2026 | 2010 | 37k+ |
-| sqlmap | [sqlmap.org](http://sqlmap.org) | [sqlmapproject/sqlmap](https://github.com/sqlmapproject/sqlmap) | Automatic SQL injection detection and exploitation tool. | [sql, injection, exploit, automation] | 2026 | 2006 | 31k+ |
-| Nikto | [cirt.net/Nikto2](https://cirt.net/Nikto2) | [sullo/nikto](https://github.com/sullo/nikto) | Web server scanner for misconfigs, outdated software, and files. | [web, scanner, perl] | ~2024 | 2001 | 7k+ |
-| Recon-ng | — | [lanmaster53/recon-ng](https://github.com/lanmaster53/recon-ng) | Full-featured web reconnaissance framework. | [recon, osint, framework, python] | ~2023 | 2012 | 10k+ |
-| Nuclei | [projectdiscovery.io](https://projectdiscovery.io) | [projectdiscovery/nuclei](https://github.com/projectdiscovery/nuclei) | Fast, template-based vulnerability scanner (highly recommended modern addition). | [scanner, yaml, fast, recon] | 2026 | 2020 | 20k+ |
-| hashcat | [hashcat.net](https://hashcat.net/hashcat/) | [hashcat/hashcat](https://github.com/hashcat/hashcat) | World's fastest password recovery utility (GPU-accelerated). | [cracker, gpu, password, hash] | 2026 | 2009 | 20k+ |
-| John the Ripper | [openwall.com/john](https://www.openwall.com/john/) | [openwall/john](https://github.com/openwall/john) | Fast password cracker supporting many hash types. | [cracker, password, c] | 2026 | 1996 | 9k+ |
-| Ghidra | [nsa.gov/ghidra](https://ghidra-sre.org/) | [NationalSecurityAgency/ghidra](https://github.com/NationalSecurityAgency/ghidra) | NSA-released SRE framework with decompiler. | [reverse, decompiler, java] | 2026 | 2019 | 50k+ |
-| radare2 | [rada.re](https://rada.re) | [radareorg/radare2](https://github.com/radareorg/radare2) | Advanced reverse-engineering framework for binaries. | [reverse, framework, disassembler] | 2026 | 2009 | 20k+ |
-| yara | [virustotal.github.io/yara](https://virustotal.github.io/yara/) | [VirusTotal/yara](https://github.com/VirusTotal/yara) | Pattern-matching tool for malware research/rules. | [malware, rules, pattern] | 2026 | 2013 | 12k+ |
-| mimikatz | [github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) | [gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) | Windows credential extraction and manipulation tool. | [windows, credential, post-exploit] | ~2024 | 2011 | 20k+ |
-| pwndbg | — | [pwndbg/pwndbg](https://github.com/pwndbg/pwndbg) | Exploit dev / GDB enhancements for reverse engineering. | [gdb, exploit, reverse, python] | 2026 | 2015 | 7k+ |
\ No newline at end of file
+Comprehensive, categorized collection of penetration testing tools.
+Grouped by primary function following common pentest phases.
+All entries adhere to the [TOOL-TABLE-SCHEMA.md](../../TOOL-TABLE-SCHEMA.md).
+
+Use browser search (Ctrl+F) or expand sections below.
+
+[↑ Back to Tools Overview](../../_INDEX.md) | [↑ Back to Pentest Recon & Enum INDEX](./INDEX.md)
+
+
+Reconnaissance & OSINT
+
+### Reconnaissance & OSINT
+
+Tools for information gathering, domain/IP enumeration, crawling, username hunting, etc.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| Photon | — | [s0md3v/Photon](https://github.com/s0md3v/Photon) | Incredibly fast crawler designed for OSINT data extraction. | [osint, crawler, recon, python] | ~2022 | 2018 | 10k+ |
+| Recon-ng | — | [lanmaster53/recon-ng](https://github.com/lanmaster53/recon-ng) | Full-featured web reconnaissance framework written in Python. | [recon, osint, framework, python] | ~2023 | 2012 | 10k+ |
+| AutoRecon | — | [Tib3rius/AutoRecon](https://github.com/Tib3rius/AutoRecon) | Automated network reconnaissance tool for enumerating services and hosts. | [recon, automation, enumeration, python] | ~2024 | 2020 | 8k+ |
+| aquatone | — | [michenriksen/aquatone](https://github.com/michenriksen/aquatone) | Tool for visual inspection of website screenshots during domain flyovers. | [recon, screenshot, domain, go] | ~2020 | 2017 | 5k+ |
+| BillCipher | — | [m4ll0k/BillCipher](https://github.com/m4ll0k/BillCipher) | Information gathering tool for websites or IP addresses. | [recon, osint, enumeration, python] | ~2021 | 2018 | 1k+ |
+| sherlock | — | [sherlock-project/sherlock](https://github.com/sherlock-project/sherlock) | Hunts down social media accounts by username across networks. | [osint, username, recon, python] | 2026 | 2018 | 50k+ |
+| Osmedeus | [osmedeus.com](https://osmedeus.com) | [j3ssie/osmedeus](https://github.com/j3ssie/osmedeus) | Fully automated offensive security tool for recon and vulnerability scanning. | [automation, recon, scanner, python] | 2026 | 2019 | 5k+ |
+| LeakLooker | — | — | Finds open databases powered by Binaryedge.io data. | [osint, database, leak, recon] | — | ~2020 | — |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Web Proxies & Interception
+
+### Web Proxies & Interception
+
+Intercepting proxies and traffic manipulation tools (core for web app testing).
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| Sandcat Browser | [syhunt.com/sandcat](https://www.syhunt.com/sandcat) | [syhunt/sandcat](https://github.com/syhunt/sandcat) | Penetration-oriented browser with Lua scripting, headers, and dev tools built-in. | [browser, pentest, lua, web, headers] | ~2023 | ~2015 | — |
+| Burp Suite | [portswigger.net/burp](https://portswigger.net/burp) | — | Industry-standard web app security testing suite with proxy, scanner, and repeater. | [web, proxy, scanner, intercept, burp] | Active 2026 | 2006 | — |
+| OWASP Zed Attack Proxy | [zaproxy.org](https://www.zaproxy.org) | [zaproxy/zaproxy](https://github.com/zaproxy/zaproxy) | Open-source intercepting proxy and automated web app vulnerability scanner. | [web, proxy, scanner, zap, owasp] | 2026 | 2010 | 12k+ |
+| mitmproxy | [mitmproxy.org](https://mitmproxy.org) | [mitmproxy/mitmproxy](https://github.com/mitmproxy/mitmproxy) | Interactive TLS-capable HTTP/HTTPS intercepting proxy for traffic manipulation. | [proxy, intercept, tls, python, http] | 2026 | 2010 | 37k+ |
+| WhatWaf | — | [Ekultek/WhatWaf](https://github.com/Ekultek/WhatWaf) | Detects and bypasses web application firewalls and protection systems. | [waf, bypass, detection, python] | ~2023 | 2018 | 3k+ |
+| Corsy | — | [s0md3v/Corsy](https://github.com/s0md3v/Corsy) | Scanner for finding CORS misconfigurations and vulnerabilities. | [web, cors, scanner, python] | ~2022 | 2019 | 2k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Web Vulnerability Scanners & Auditors
+
+### Web Vulnerability Scanners & Auditors
+
+Web-specific scanners, directory enumeration, XSS/SQL injection focused tools.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| Nikto2 | [cirt.net/Nikto2](https://cirt.net/Nikto2) | [sullo/nikto](https://github.com/sullo/nikto) | Web server scanner performing comprehensive tests for misconfigs and issues. | [web, scanner, perl, server] | ~2024 | 2001 | 7k+ |
+| w3af | [w3af.org](http://w3af.org) | [andresriancho/w3af](https://github.com/andresriancho/w3af) | Web application attack and audit framework for finding and exploiting vulns. | [web, framework, scanner, python] | ~2020 | 2007 | 4k+ |
+| sqlmap | [sqlmap.org](http://sqlmap.org) | [sqlmapproject/sqlmap](https://github.com/sqlmapproject/sqlmap) | Automates detection and exploitation of SQL injection flaws. | [sql, injection, exploit, automation, python]| 2026 | 2006 | 31k+ |
+| XSStrike | — | [s0md3v/XSStrike](https://github.com/s0md3v/XSStrike) | Most advanced XSS detection suite with payload generation and evasion. | [web, xss, scanner, python] | ~2023 | 2018 | 13k+ |
+| dirhunt | — | [mkdocs/dirhunt](https://github.com/mkdocs/dirhunt) | Finds web directories and files without bruteforcing. | [web, directory, enumeration, python] | ~2023 | 2018 | 2k+ |
+| Raccoon | — | [evyatarmeged/Raccoon](https://github.com/evyatarmeged/Raccoon) | High performance offensive security tool for recon and vulnerability scanning. | [recon, scanner, vuln, python] | ~2021 | 2019 | 4k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+General/Network Vulnerability Scanners
+
+### General/Network Vulnerability Scanners
+
+Broader system/network vuln scanning, often agentless or plugin-extensible.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| vuls | [vuls.io](https://vuls.io) | [future-architect/vuls](https://github.com/future-architect/vuls) | Agent-less vulnerability scanner for Linux/FreeBSD and other systems. | [scanner, vuln, linux, go] | 2026 | 2016 | 10k+ |
+| tsunami | [google.github.io/tsunami-security-scanner](https://google.github.io/tsunami-security-scanner/) | [google/tsunami-security-scanner](https://github.com/google/tsunami-security-scanner) | General-purpose network security scanner with extensible plugin system. | [scanner, network, plugin, java] | ~2024 | 2019 | 8k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Exploitation Frameworks & Automation
+
+### Exploitation Frameworks & Automation
+
+Full frameworks and automated exploit chains for offensive operations.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| Metasploit | [metasploit.com](https://www.metasploit.com) | [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) | Exploitation framework for pentesting systems, networks, web, and more. | [exploit, framework, ruby, metasploit] | 2026 | 2003 | 33k+ |
+| Sn1per | [sn1persecurity.com](https://sn1persecurity.com) | [1N3/Sn1per](https://github.com/1N3/Sn1per) | Automated pentest framework for offensive security experts. | [automation, framework, recon, exploit] | ~2025 | 2015 | 7k+ |
+| AutoSploit | — | [AutoSploit/AutoSploit](https://github.com/AutoSploit/AutoSploit) | Automated mass exploiter using public exploits. | [exploit, automation, mass] | ~2018 | 2018 | 2k+ |
+| routersploit | — | [threat9/routersploit](https://github.com/threat9/routersploit) | Exploitation framework dedicated to embedded devices and routers. | [exploit, router, embedded, python] | 2026 | 2015 | 12k+ |
+| beef | [beefproject.com](http://beefproject.com) | [beefproject/beef](https://github.com/beefproject/beef) | Browser exploitation framework focused on client-side attacks. | [browser, exploit, framework, ruby] | 2026 | 2010 | 8k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Password & Hash Cracking
+
+### Password & Hash Cracking
+
+High-performance crackers for hashes and passwords.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| John The Ripper | [openwall.com/john](https://www.openwall.com/john/) | [openwall/john](https://github.com/openwall/john) | Fast password cracker supporting many hash types and platforms. | [cracker, password, hash, c] | 2026 | 1996 | 9k+ |
+| hashcat | [hashcat.net](https://hashcat.net/hashcat/) | [hashcat/hashcat](https://github.com/hashcat/hashcat) | World's fastest and most advanced password recovery utility (GPU-accelerated). | [cracker, gpu, password, hash, c] | 2026 | 2009 | 20k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Fuzzing & Fault Injection
+
+### Fuzzing & Fault Injection
+
+Coverage-guided fuzzers and attack pattern dictionaries.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| fuzzdb | — | [fuzzdb-project/fuzzdb](https://github.com/fuzzdb-project/fuzzdb) | Dictionary of attack patterns and primitives for black-box fault injection. | [fuzz, dictionary, patterns, attack] | ~2023 | 2010 | 3k+ |
+| AFL | [lcamtuf.coredump.cx/afl](https://lcamtuf.coredump.cx/afl/) | [google/AFL](https://github.com/google/AFL) | Free software fuzzer focused on security-oriented coverage-guided fuzzing. | [fuzzer, coverage, security, c] | ~2018 | 2013 | 5k+ |
+| AFL++ | [aflplus.plus](https://aflplus.plus) | [AFLplusplus/AFLplusplus](https://github.com/AFLplusplus/AFLplusplus) | AFL with community patches and improvements for better fuzzing. | [fuzzer, coverage, security, c++] | 2026 | 2019 | 5k+ |
+| syzkaller | — | [google/syzkaller](https://github.com/google/syzkaller) | Unsupervised coverage-guided kernel fuzzer for OS kernels. | [fuzzer, kernel, coverage, go] | 2026 | 2015 | 5k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Reverse Engineering & Debugging
+
+### Reverse Engineering & Debugging
+
+Disassemblers, decompilers, and GDB enhancements for binary analysis.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| pwndbg | — | [pwndbg/pwndbg](https://github.com/pwndbg/pwndbg) | Exploit development and reverse engineering enhancements for GDB. | [gdb, exploit, reverse, python] | 2026 | 2015 | 7k+ |
+| GDB PEDA | — | [longld/peda](https://github.com/longld/peda) | Python Exploit Development Assistance for GDB. | [gdb, exploit, reverse, python] | ~2022 | 2012 | 6k+ |
+| IDA | [hex-rays.com/ida-pro](https://hex-rays.com/ida-pro/) | — | Multi-processor disassembler and debugger for reverse engineering malware. | [reverse, disassembler, debugger] | Active 2026 | 1991 | — |
+| radare2 | [rada.re](https://rada.re) | [radareorg/radare2](https://github.com/radareorg/radare2) | Framework for reverse-engineering and analyzing binaries. | [reverse, framework, disassembler, c] | 2026 | 2009 | 20k+ |
+| Ghidra | [nsa.gov/ghidra](https://ghidra-sre.org/) | [NationalSecurityAgency/ghidra](https://github.com/NationalSecurityAgency/ghidra) | Software reverse engineering framework with decompiler from NSA. | [reverse, decompiler, java, framework] | 2026 | 2019 | 50k+ |
+| Cutter | [cutter.re](https://cutter.re) | [rizinorg/cutter](https://github.com/rizinorg/cutter) | SRE platform integrating Ghidra's decompiler with modern UI. | [reverse, gui, decompiler, cpp] | 2026 | 2017 | 15k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Post-Exploitation & Credential Tools
+
+### Post-Exploitation & Credential Tools
+
+Credential dumping, privilege escalation, and post-compromise utilities.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| mimikatz | — | [gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) | Tool to play with Windows security features like credential extraction. | [windows, credential, post-exploit, c] | ~2024 | 2011 | 20k+ |
+| SUDO_KILLER | — | [TH3xACE/SUDO_KILLER](https://github.com/TH3xACE/SUDO_KILLER) | Tool to identify and exploit sudo rules misconfigurations and vulns. | [linux, sudo, privilege, escalation] | ~2023 | 2019 | 1k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
+
+
+Miscellaneous / Specialized
+
+### Miscellaneous / Specialized
+
+Reporting, threat modeling, CTF helpers, collections, and other utilities.
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------------------|-------------------------------------------------------|-----------------------------------------------------------------------------------|-----------------------------------------------|------------------|---------------|---------|
+| Faraday | [faradaysec.com](https://faradaysec.com) | [infobyte/faraday](https://github.com/infobyte/faraday) | Integrated multiuser pentest environment for collaboration and reporting. | [collaboration, reporting, pentest, python] | 2026 | 2012 | 4k+ |
+| Vulnreport | — | [salesforce/vulnreport](https://github.com/salesforce/vulnreport) | Open-source pentesting management and automation platform. | [management, reporting, pentest, ruby] | ~2022 | 2015 | 1k+ |
+| Mentalist | — | [sc0tfree/mentalist](https://github.com/sc0tfree/mentalist) | Graphical tool for custom wordlist generation. | [wordlist, generator, gui, python] | ~2020 | 2017 | 2k+ |
+| archerysec | [archerysec.info](https://archerysec.info) | [archerysec/archerysec](https://github.com/archerysec/archerysec) | Vulnerability assessment and management platform for scans and tracking. | [vuln, management, scanner, python] | ~2025 | 2018 | 2k+ |
+| yara | [virustotal.github.io/yara](https://virustotal.github.io/yara/) | [VirusTotal/yara](https://github.com/VirusTotal/yara) | Pattern matching swiss knife for malware research and rules. | [malware, rules, pattern, c] | 2026 | 2013 | 12k+ |
+| exploitdb | [exploit-db.com](https://www.exploit-db.com) | [offensive-security/exploitdb](https://github.com/offensive-security/exploitdb) | Searchable archive of exploits and vulnerable software from Exploit Database. | [exploit, database, archive] | 2026 | 2004 | 9k+ |
+| getsploit | — | [vulnerables/getsploit](https://github.com/vulnerables/getsploit) | Command-line utility for searching and downloading exploits. | [exploit, search, cli, python] | ~2021 | 2017 | 1k+ |
+| ctf-tools | — | [zardus/ctf-tools](https://github.com/zardus/ctf-tools) | Collection of setup scripts for security research and CTF tools. | [ctf, setup, tools, python] | ~2022 | 2015 | 2k+ |
+| pwntools | — | [Gallopsled/pwntools](https://github.com/Gallopsled/pwntools) | CTF framework and exploit development library. | [ctf, exploit, python, library] | 2026 | 2013 | 12k+ |
+| p0f | [lcamtuf.coredump.cx/p0f3](https://lcamtuf.coredump.cx/p0f3/) | [lcamtuf/p0f](https://github.com/lcamtuf/p0f) | Passive TCP/IP stack fingerprinting tool to identify OS and apps. | [fingerprint, passive, network, c] | ~2014 | ~2000 | 1k+ |
+| ssh_scan | — | [mozilla/ssh_scan](https://github.com/mozilla/ssh_scan) | Prototype SSH configuration and policy scanner. | [ssh, scanner, security, ruby] | ~2020 | 2015 | 2k+ |
+| OWASP Threat Dragon | [owasp.org/www-project-threat-dragon](https://owasp.org/www-project-threat-dragon/) | [OWASP/Threat-Dragon](https://github.com/OWASP/Threat-Dragon) | Tool to create threat model diagrams and record possible threats. | [threat, modeling, diagram, security] | 2026 | 2015 | 2k+ |
+
+[↑ Back to Top](#pentesters-arsenal-tools)
+
+
\ No newline at end of file