pentest aresenal: 2026-03-07 21:22:40
Affected files: .obsidian/workspace.json README.md tools/security/pentest-recon-enum/pentest-arsenal.md
This commit is contained in:
Jacob Kraniak
parent
8b4fb8784b
commit
93d964d661
|
|
@ -13,12 +13,12 @@
|
|||
"state": {
|
||||
"type": "markdown",
|
||||
"state": {
|
||||
"file": "README.md",
|
||||
"file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
|
||||
"mode": "source",
|
||||
"source": false
|
||||
},
|
||||
"icon": "lucide-file",
|
||||
"title": "README"
|
||||
"title": "pentest-arsenal"
|
||||
}
|
||||
}
|
||||
]
|
||||
|
|
@ -94,7 +94,7 @@
|
|||
"state": {
|
||||
"type": "backlink",
|
||||
"state": {
|
||||
"file": "README.md",
|
||||
"file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
|
||||
"collapseAll": false,
|
||||
"extraContext": false,
|
||||
"sortOrder": "alphabetical",
|
||||
|
|
@ -104,7 +104,7 @@
|
|||
"unlinkedCollapsed": true
|
||||
},
|
||||
"icon": "links-coming-in",
|
||||
"title": "Backlinks for README"
|
||||
"title": "Backlinks for pentest-arsenal"
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -113,12 +113,12 @@
|
|||
"state": {
|
||||
"type": "outgoing-link",
|
||||
"state": {
|
||||
"file": "README.md",
|
||||
"file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
|
||||
"linksCollapsed": false,
|
||||
"unlinkedCollapsed": true
|
||||
},
|
||||
"icon": "links-going-out",
|
||||
"title": "Outgoing links from README"
|
||||
"title": "Outgoing links from pentest-arsenal"
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -156,13 +156,13 @@
|
|||
"state": {
|
||||
"type": "outline",
|
||||
"state": {
|
||||
"file": "README.md",
|
||||
"file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
|
||||
"followCursor": false,
|
||||
"showSearch": false,
|
||||
"searchQuery": ""
|
||||
},
|
||||
"icon": "lucide-list",
|
||||
"title": "Outline of README"
|
||||
"title": "Outline of pentest-arsenal"
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -196,8 +196,10 @@
|
|||
},
|
||||
"active": "9b2e89c682f5d2ef",
|
||||
"lastOpenFiles": [
|
||||
"SOP-Navigation-and-Layout.md",
|
||||
"README.md",
|
||||
"tools/security/pentest-recon-enum/pentest-arsenal.md",
|
||||
"tools/INDEX.md",
|
||||
"SOP-Navigation-and-Layout.md",
|
||||
"conflict-files-obsidian-git.md",
|
||||
"tools/_INDEX.md",
|
||||
"documentation/INDEX.md",
|
||||
|
|
@ -221,8 +223,6 @@
|
|||
"tools/network-engineering/dns-dhc-ipam/dns-tools.md",
|
||||
"tools/tools - (migrate out)/gui-tools.md",
|
||||
"tools/tools - (migrate out)/web-tools.md",
|
||||
"documentation/readme - to refactor.md",
|
||||
"documentation/manuals-howtos-guides/shell-tricks-functions.md",
|
||||
"documentation/manuals-howtos-guides",
|
||||
"documentation",
|
||||
"tools/security/hardening-compliance",
|
||||
|
|
|
|||
62
README.md
62
README.md
|
|
@ -995,68 +995,6 @@ CyberTalks</b></a> - talks, interviews, and article about cybersecurity.<br>
|
|||
<a href="https://www.youtube.com/watch?v=3QnD2c4Xovk"><b>Diffie-Hellman Key Exchange (short version)</b></a> - how Diffie-Hellman Key Exchange worked.<br>
|
||||
</p>
|
||||
|
||||
#### Hacking/Penetration Testing [<sup>[TOC]</sup>](#anger-table-of-contents)
|
||||
|
||||
##### :black_small_square: Pentesters arsenal tools
|
||||
|
||||
<p>
|
||||
<a href="http://www.syhunt.com/sandcat/"><b>Sandcat Browser</b></a> - a penetration-oriented browser with plenty of advanced functionality already built in.<br>
|
||||
<a href="https://www.metasploit.com/"><b>Metasploit</b></a> - tool and framework for pentesting system, web and many more.<br>
|
||||
<a href="https://portswigger.net/burp"><b>Burp Suite</b></a> - tool for testing web app security, intercepting proxy to replay, inject, scan and fuzz.<br>
|
||||
<a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project"><b>OWASP Zed Attack Proxy</b></a> - intercepting proxy to replay, inject, scan and fuzz HTTP requests.<br>
|
||||
<a href="http://w3af.org/"><b>w3af</b></a> - is a Web Application Attack and Audit Framework.<br>
|
||||
<a href="https://mitmproxy.org/"><b>mitmproxy</b></a> - an interactive TLS-capable intercepting HTTP proxy for penetration testers.<br>
|
||||
<a href="https://cirt.net/Nikto2"><b>Nikto2</b></a> - web server scanner which performs comprehensive tests against web servers for multiple items.<br>
|
||||
<a href="http://sqlmap.org/"><b>sqlmap</b></a> - tool that automates the process of detecting and exploiting SQL injection flaws.<br>
|
||||
<a href="https://github.com/lanmaster53/recon-ng"><b>Recon-ng</b></a> - is a full-featured Web Reconnaissance framework written in Python.<br>
|
||||
<a href="https://github.com/Tib3rius/AutoRecon"><b>AutoRecon</b></a> - is a network reconnaissance tool which performs automated enumeration of services.<br>
|
||||
<a href="https://www.faradaysec.com/"><b>Faraday</b></a> - an Integrated Multiuser Pentest Environment.<br>
|
||||
<a href="https://github.com/s0md3v/Photon"><b>Photon</b></a> - incredibly fast crawler designed for OSINT.<br>
|
||||
<a href="https://github.com/s0md3v/XSStrike"><b>XSStrike</b></a> - most advanced XSS detection suite.<br>
|
||||
<a href="https://github.com/1N3/Sn1per"><b>Sn1per</b></a> - automated pentest framework for offensive security experts.<br>
|
||||
<a href="https://github.com/future-architect/vuls"><b>vuls</b></a> - is an agent-less vulnerability scanner for Linux, FreeBSD, and other.<br>
|
||||
<a href="https://github.com/google/tsunami-security-scanner"><b>tsunami</b></a> - is a general purpose network security scanner with an extensible plugin system.<br>
|
||||
<a href="https://github.com/michenriksen/aquatone"><b>aquatone</b></a> - a tool for domain flyovers.<br>
|
||||
<a href="https://github.com/GitHackTools/BillCipher"><b>BillCipher</b></a> - information gathering tool for a website or IP address.<br>
|
||||
<a href="https://github.com/Ekultek/WhatWaf"><b>WhatWaf</b></a> - detect and bypass web application firewalls and protection systems.<br>
|
||||
<a href="https://github.com/s0md3v/Corsy"><b>Corsy</b></a> - CORS misconfiguration scanner.<br>
|
||||
<a href="https://github.com/evyatarmeged/Raccoon"><b>Raccoon</b></a> - is a high performance offensive security tool for reconnaissance and vulnerability scanning.<br>
|
||||
<a href="https://github.com/Nekmo/dirhunt"><b>dirhunt</b></a> - find web directories without bruteforce.<br>
|
||||
<a href="https://www.openwall.com/john/"><b>John The Ripper</b></a> - is a fast password cracker, currently available for many flavors of Unix, Windows, and other.<br>
|
||||
<a href="https://hashcat.net/hashcat/"><b>hashcat</b></a> - world's fastest and most advanced password recovery utility.<br>
|
||||
<a href="http://lcamtuf.coredump.cx/p0f3/"><b>p0f</b></a> - is a tool to identify the players behind any incidental TCP/IP communications.<br>
|
||||
<a href="https://github.com/mozilla/ssh_scan"><b>ssh_scan</b></a> - a prototype SSH configuration and policy scanner.<br>
|
||||
<a href="https://github.com/woj-ciech/LeakLooker"><b>LeakLooker</b></a> - find open databases - powered by Binaryedge.io<br>
|
||||
<a href="https://github.com/offensive-security/exploitdb"><b>exploitdb</b></a> - searchable archive from The Exploit Database.<br>
|
||||
<a href="https://github.com/vulnersCom/getsploit"><b>getsploit</b></a> - is a command line utility for searching and downloading exploits.<br>
|
||||
<a href="https://github.com/zardus/ctf-tools"><b>ctf-tools</b></a> - some setup scripts for security research tools.<br>
|
||||
<a href="https://github.com/Gallopsled/pwntools"><b>pwntools</b></a> - CTF framework and exploit development library.<br>
|
||||
<a href="https://github.com/bl4de/security-tools"><b>security-tools</b></a> - collection of small security tools created mostly in Python. CTFs, pentests and so on.<br>
|
||||
<a href="https://github.com/leonteale/pentestpackage"><b>pentestpackage</b></a> - is a package of Pentest scripts.<br>
|
||||
<a href="https://github.com/dloss/python-pentest-tools"><b>python-pentest-tools</b></a> - python tools for penetration testers.<br>
|
||||
<a href="https://github.com/fuzzdb-project/fuzzdb"><b>fuzzdb</b></a> - dictionary of attack patterns and primitives for black-box application fault injection.<br>
|
||||
<a href="https://github.com/google/AFL"><b>AFL</b></a> - is a free software fuzzer maintained by Google.<br>
|
||||
<a href="https://github.com/AFLplusplus/AFLplusplus"><b>AFL++</b></a> - is AFL with community patches.<br>
|
||||
<a href="https://github.com/google/syzkaller"><b>syzkaller</b></a> - is an unsupervised, coverage-guided kernel fuzzer.<br>
|
||||
<a href="https://github.com/pwndbg/pwndbg"><b>pwndbg</b></a> - exploit development and reverse engineering with GDB made easy.<br>
|
||||
<a href="https://github.com/longld/peda"><b>GDB PEDA</b></a> - Python Exploit Development Assistance for GDB.<br>
|
||||
<a href="https://www.hex-rays.com/products/ida/index.shtml"><b>IDA</b></a> - multi-processor disassembler and debugger useful for reverse engineering malware.<br>
|
||||
<a href="https://github.com/radare/radare2"><b>radare2</b></a> - framework for reverse-engineering and analyzing binaries.<br>
|
||||
<a href="https://github.com/threat9/routersploit"><b>routersploit</b></a> - exploitation framework for embedded devices.<br>
|
||||
<a href="https://github.com/NationalSecurityAgency/ghidra"><b>Ghidra</b></a> - is a software reverse engineering (SRE) framework.<br>
|
||||
<a href="https://cutter.re/"><b>Cutter</b></a> - is an SRE platform integrating Ghidra's decompiler.<br>
|
||||
<a href="https://github.com/salesforce/vulnreport"><b>Vulnreport</b></a> - open-source pentesting management and automation platform by Salesforce Product Security.<br>
|
||||
<a href="https://github.com/sc0tfree/mentalist"><b>Mentalist</b></a> - is a graphical tool for custom wordlist generation.<br>
|
||||
<a href="https://github.com/archerysec/archerysec"><b>archerysec</b></a> - vulnerability assessment and management helps to perform scans and manage vulnerabilities.<br>
|
||||
<a href="https://github.com/j3ssie/Osmedeus"><b>Osmedeus</b></a> - fully automated offensive security tool for reconnaissance and vulnerability scanning.<br>
|
||||
<a href="https://github.com/beefproject/beef"><b>beef</b></a> - the browser exploitation framework project.<br>
|
||||
<a href="https://github.com/NullArray/AutoSploit"><b>AutoSploit</b></a> - automated mass exploiter.<br>
|
||||
<a href="https://github.com/TH3xACE/SUDO_KILLER"><b>SUDO_KILLER</b></a> - is a tool to identify and exploit sudo rules' misconfigurations and vulnerabilities.<br>
|
||||
<a href="https://github.com/VirusTotal/yara"><b>yara</b></a> - the pattern matching swiss knife.<br>
|
||||
<a href="https://github.com/gentilkiwi/mimikatz"><b>mimikatz</b></a> - a little tool to play with Windows security.<br>
|
||||
<a href="https://github.com/sherlock-project/sherlock"><b>sherlock</b></a> - hunt down social media accounts by username across social networks.<br>
|
||||
<a href="https://owasp.org/www-project-threat-dragon/"><b>OWASP Threat Dragon</b></a> - is a tool used to create threat model diagrams and to record possible threats.<br>
|
||||
</p>
|
||||
|
||||
##### :black_small_square: Pentests bookmarks collection
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,20 @@
|
|||
### Pentesters Arsenal Tools
|
||||
|
||||
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|
||||
|-------------------|-----------------------------------------|--------------------------------------|--------------------------------------------------------|-------------------------------------------|------------------|---------------|---------|
|
||||
| Sandcat Browser | [syhunt.com/sandcat](https://www.syhunt.com/sandcat) | [syhunt/sandcat](https://github.com/syhunt/sandcat) | Penetration-oriented browser with built-in headers, Lua scripting, and dev tools. | [browser, pentest, lua, headers, web] | ~2023 | 2010s | — |
|
||||
| Metasploit | [metasploit.com](https://www.metasploit.com) | [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) | Exploitation framework for pentesting systems, networks, and web apps. | [exploit, framework, ruby, metasploit] | 2026-03 | 2003 | 33k+ |
|
||||
| Burp Suite | [portswigger.net/burp](https://portswigger.net/burp) | — | Industry-standard web vuln scanner, proxy, and testing toolkit. | [web, proxy, scanner, intercept, burp] | Active 2026 | 2006 | — |
|
||||
| OWASP ZAP | [zaproxy.org](https://www.zaproxy.org) | [zaproxy/zaproxy](https://github.com/zaproxy/zaproxy) | Open-source intercepting proxy and web app scanner (DAST). | [web, proxy, scanner, zap, owasp] | 2026 | 2010 | 12k+ |
|
||||
| mitmproxy | [mitmproxy.org](https://mitmproxy.org) | [mitmproxy/mitmproxy](https://github.com/mitmproxy/mitmproxy) | Interactive HTTPS-capable HTTP proxy for traffic inspection/modification. | [proxy, intercept, tls, python] | 2026 | 2010 | 37k+ |
|
||||
| sqlmap | [sqlmap.org](http://sqlmap.org) | [sqlmapproject/sqlmap](https://github.com/sqlmapproject/sqlmap) | Automatic SQL injection detection and exploitation tool. | [sql, injection, exploit, automation] | 2026 | 2006 | 31k+ |
|
||||
| Nikto | [cirt.net/Nikto2](https://cirt.net/Nikto2) | [sullo/nikto](https://github.com/sullo/nikto) | Web server scanner for misconfigs, outdated software, and files. | [web, scanner, perl] | ~2024 | 2001 | 7k+ |
|
||||
| Recon-ng | — | [lanmaster53/recon-ng](https://github.com/lanmaster53/recon-ng) | Full-featured web reconnaissance framework. | [recon, osint, framework, python] | ~2023 | 2012 | 10k+ |
|
||||
| Nuclei | [projectdiscovery.io](https://projectdiscovery.io) | [projectdiscovery/nuclei](https://github.com/projectdiscovery/nuclei) | Fast, template-based vulnerability scanner (highly recommended modern addition). | [scanner, yaml, fast, recon] | 2026 | 2020 | 20k+ |
|
||||
| hashcat | [hashcat.net](https://hashcat.net/hashcat/) | [hashcat/hashcat](https://github.com/hashcat/hashcat) | World's fastest password recovery utility (GPU-accelerated). | [cracker, gpu, password, hash] | 2026 | 2009 | 20k+ |
|
||||
| John the Ripper | [openwall.com/john](https://www.openwall.com/john/) | [openwall/john](https://github.com/openwall/john) | Fast password cracker supporting many hash types. | [cracker, password, c] | 2026 | 1996 | 9k+ |
|
||||
| Ghidra | [nsa.gov/ghidra](https://ghidra-sre.org/) | [NationalSecurityAgency/ghidra](https://github.com/NationalSecurityAgency/ghidra) | NSA-released SRE framework with decompiler. | [reverse, decompiler, java] | 2026 | 2019 | 50k+ |
|
||||
| radare2 | [rada.re](https://rada.re) | [radareorg/radare2](https://github.com/radareorg/radare2) | Advanced reverse-engineering framework for binaries. | [reverse, framework, disassembler] | 2026 | 2009 | 20k+ |
|
||||
| yara | [virustotal.github.io/yara](https://virustotal.github.io/yara/) | [VirusTotal/yara](https://github.com/VirusTotal/yara) | Pattern-matching tool for malware research/rules. | [malware, rules, pattern] | 2026 | 2013 | 12k+ |
|
||||
| mimikatz | [github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) | [gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) | Windows credential extraction and manipulation tool. | [windows, credential, post-exploit] | ~2024 | 2011 | 20k+ |
|
||||
| pwndbg | — | [pwndbg/pwndbg](https://github.com/pwndbg/pwndbg) | Exploit dev / GDB enhancements for reverse engineering. | [gdb, exploit, reverse, python] | 2026 | 2015 | 7k+ |
|
||||
Loading…
Reference in New Issue