From 93d964d6612e49010702bdf18735fb3c2d66d0a0 Mon Sep 17 00:00:00 2001
From: Jacob Kraniak <113630934+jacob-kraniak@users.noreply.github.com>
Date: Sat, 7 Mar 2026 21:22:40 -0500
Subject: [PATCH] pentest aresenal: 2026-03-07 21:22:40
Affected files:
.obsidian/workspace.json
README.md
tools/security/pentest-recon-enum/pentest-arsenal.md
---
.obsidian/workspace.json | 22 +++----
README.md | 62 -------------------
.../pentest-recon-enum/pentest-arsenal.md | 20 ++++++
3 files changed, 31 insertions(+), 73 deletions(-)
create mode 100644 tools/security/pentest-recon-enum/pentest-arsenal.md
diff --git a/.obsidian/workspace.json b/.obsidian/workspace.json
index 800b472..e3ced84 100644
--- a/.obsidian/workspace.json
+++ b/.obsidian/workspace.json
@@ -13,12 +13,12 @@
"state": {
"type": "markdown",
"state": {
- "file": "README.md",
+ "file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
"mode": "source",
"source": false
},
"icon": "lucide-file",
- "title": "README"
+ "title": "pentest-arsenal"
}
}
]
@@ -94,7 +94,7 @@
"state": {
"type": "backlink",
"state": {
- "file": "README.md",
+ "file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
"collapseAll": false,
"extraContext": false,
"sortOrder": "alphabetical",
@@ -104,7 +104,7 @@
"unlinkedCollapsed": true
},
"icon": "links-coming-in",
- "title": "Backlinks for README"
+ "title": "Backlinks for pentest-arsenal"
}
},
{
@@ -113,12 +113,12 @@
"state": {
"type": "outgoing-link",
"state": {
- "file": "README.md",
+ "file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
"linksCollapsed": false,
"unlinkedCollapsed": true
},
"icon": "links-going-out",
- "title": "Outgoing links from README"
+ "title": "Outgoing links from pentest-arsenal"
}
},
{
@@ -156,13 +156,13 @@
"state": {
"type": "outline",
"state": {
- "file": "README.md",
+ "file": "tools/security/pentest-recon-enum/pentest-arsenal.md",
"followCursor": false,
"showSearch": false,
"searchQuery": ""
},
"icon": "lucide-list",
- "title": "Outline of README"
+ "title": "Outline of pentest-arsenal"
}
},
{
@@ -196,8 +196,10 @@
},
"active": "9b2e89c682f5d2ef",
"lastOpenFiles": [
- "SOP-Navigation-and-Layout.md",
"README.md",
+ "tools/security/pentest-recon-enum/pentest-arsenal.md",
+ "tools/INDEX.md",
+ "SOP-Navigation-and-Layout.md",
"conflict-files-obsidian-git.md",
"tools/_INDEX.md",
"documentation/INDEX.md",
@@ -221,8 +223,6 @@
"tools/network-engineering/dns-dhc-ipam/dns-tools.md",
"tools/tools - (migrate out)/gui-tools.md",
"tools/tools - (migrate out)/web-tools.md",
- "documentation/readme - to refactor.md",
- "documentation/manuals-howtos-guides/shell-tricks-functions.md",
"documentation/manuals-howtos-guides",
"documentation",
"tools/security/hardening-compliance",
diff --git a/README.md b/README.md
index ae08cd2..a5ab3de 100644
--- a/README.md
+++ b/README.md
@@ -995,68 +995,6 @@ CyberTalks - talks, interviews, and article about cybersecurity.
Diffie-Hellman Key Exchange (short version) - how Diffie-Hellman Key Exchange worked.
-#### Hacking/Penetration Testing [[TOC]](#anger-table-of-contents)
-
-##### :black_small_square: Pentesters arsenal tools
-
-
- Sandcat Browser - a penetration-oriented browser with plenty of advanced functionality already built in.
- Metasploit - tool and framework for pentesting system, web and many more.
- Burp Suite - tool for testing web app security, intercepting proxy to replay, inject, scan and fuzz.
- OWASP Zed Attack Proxy - intercepting proxy to replay, inject, scan and fuzz HTTP requests.
- w3af - is a Web Application Attack and Audit Framework.
- mitmproxy - an interactive TLS-capable intercepting HTTP proxy for penetration testers.
- Nikto2 - web server scanner which performs comprehensive tests against web servers for multiple items.
- sqlmap - tool that automates the process of detecting and exploiting SQL injection flaws.
- Recon-ng - is a full-featured Web Reconnaissance framework written in Python.
- AutoRecon - is a network reconnaissance tool which performs automated enumeration of services.
- Faraday - an Integrated Multiuser Pentest Environment.
- Photon - incredibly fast crawler designed for OSINT.
- XSStrike - most advanced XSS detection suite.
- Sn1per - automated pentest framework for offensive security experts.
- vuls - is an agent-less vulnerability scanner for Linux, FreeBSD, and other.
- tsunami - is a general purpose network security scanner with an extensible plugin system.
- aquatone - a tool for domain flyovers.
- BillCipher - information gathering tool for a website or IP address.
- WhatWaf - detect and bypass web application firewalls and protection systems.
- Corsy - CORS misconfiguration scanner.
- Raccoon - is a high performance offensive security tool for reconnaissance and vulnerability scanning.
- dirhunt - find web directories without bruteforce.
- John The Ripper - is a fast password cracker, currently available for many flavors of Unix, Windows, and other.
- hashcat - world's fastest and most advanced password recovery utility.
- p0f - is a tool to identify the players behind any incidental TCP/IP communications.
- ssh_scan - a prototype SSH configuration and policy scanner.
- LeakLooker - find open databases - powered by Binaryedge.io
- exploitdb - searchable archive from The Exploit Database.
- getsploit - is a command line utility for searching and downloading exploits.
- ctf-tools - some setup scripts for security research tools.
- pwntools - CTF framework and exploit development library.
- security-tools - collection of small security tools created mostly in Python. CTFs, pentests and so on.
- pentestpackage - is a package of Pentest scripts.
- python-pentest-tools - python tools for penetration testers.
- fuzzdb - dictionary of attack patterns and primitives for black-box application fault injection.
- AFL - is a free software fuzzer maintained by Google.
- AFL++ - is AFL with community patches.
- syzkaller - is an unsupervised, coverage-guided kernel fuzzer.
- pwndbg - exploit development and reverse engineering with GDB made easy.
- GDB PEDA - Python Exploit Development Assistance for GDB.
- IDA - multi-processor disassembler and debugger useful for reverse engineering malware.
- radare2 - framework for reverse-engineering and analyzing binaries.
- routersploit - exploitation framework for embedded devices.
- Ghidra - is a software reverse engineering (SRE) framework.
- Cutter - is an SRE platform integrating Ghidra's decompiler.
- Vulnreport - open-source pentesting management and automation platform by Salesforce Product Security.
- Mentalist - is a graphical tool for custom wordlist generation.
- archerysec - vulnerability assessment and management helps to perform scans and manage vulnerabilities.
- Osmedeus - fully automated offensive security tool for reconnaissance and vulnerability scanning.
- beef - the browser exploitation framework project.
- AutoSploit - automated mass exploiter.
- SUDO_KILLER - is a tool to identify and exploit sudo rules' misconfigurations and vulnerabilities.
- yara - the pattern matching swiss knife.
- mimikatz - a little tool to play with Windows security.
- sherlock - hunt down social media accounts by username across social networks.
- OWASP Threat Dragon - is a tool used to create threat model diagrams and to record possible threats.
-
##### :black_small_square: Pentests bookmarks collection
diff --git a/tools/security/pentest-recon-enum/pentest-arsenal.md b/tools/security/pentest-recon-enum/pentest-arsenal.md
new file mode 100644
index 0000000..8a4c73f
--- /dev/null
+++ b/tools/security/pentest-recon-enum/pentest-arsenal.md
@@ -0,0 +1,20 @@
+### Pentesters Arsenal Tools
+
+| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
+|-------------------|-----------------------------------------|--------------------------------------|--------------------------------------------------------|-------------------------------------------|------------------|---------------|---------|
+| Sandcat Browser | [syhunt.com/sandcat](https://www.syhunt.com/sandcat) | [syhunt/sandcat](https://github.com/syhunt/sandcat) | Penetration-oriented browser with built-in headers, Lua scripting, and dev tools. | [browser, pentest, lua, headers, web] | ~2023 | 2010s | — |
+| Metasploit | [metasploit.com](https://www.metasploit.com) | [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) | Exploitation framework for pentesting systems, networks, and web apps. | [exploit, framework, ruby, metasploit] | 2026-03 | 2003 | 33k+ |
+| Burp Suite | [portswigger.net/burp](https://portswigger.net/burp) | — | Industry-standard web vuln scanner, proxy, and testing toolkit. | [web, proxy, scanner, intercept, burp] | Active 2026 | 2006 | — |
+| OWASP ZAP | [zaproxy.org](https://www.zaproxy.org) | [zaproxy/zaproxy](https://github.com/zaproxy/zaproxy) | Open-source intercepting proxy and web app scanner (DAST). | [web, proxy, scanner, zap, owasp] | 2026 | 2010 | 12k+ |
+| mitmproxy | [mitmproxy.org](https://mitmproxy.org) | [mitmproxy/mitmproxy](https://github.com/mitmproxy/mitmproxy) | Interactive HTTPS-capable HTTP proxy for traffic inspection/modification. | [proxy, intercept, tls, python] | 2026 | 2010 | 37k+ |
+| sqlmap | [sqlmap.org](http://sqlmap.org) | [sqlmapproject/sqlmap](https://github.com/sqlmapproject/sqlmap) | Automatic SQL injection detection and exploitation tool. | [sql, injection, exploit, automation] | 2026 | 2006 | 31k+ |
+| Nikto | [cirt.net/Nikto2](https://cirt.net/Nikto2) | [sullo/nikto](https://github.com/sullo/nikto) | Web server scanner for misconfigs, outdated software, and files. | [web, scanner, perl] | ~2024 | 2001 | 7k+ |
+| Recon-ng | — | [lanmaster53/recon-ng](https://github.com/lanmaster53/recon-ng) | Full-featured web reconnaissance framework. | [recon, osint, framework, python] | ~2023 | 2012 | 10k+ |
+| Nuclei | [projectdiscovery.io](https://projectdiscovery.io) | [projectdiscovery/nuclei](https://github.com/projectdiscovery/nuclei) | Fast, template-based vulnerability scanner (highly recommended modern addition). | [scanner, yaml, fast, recon] | 2026 | 2020 | 20k+ |
+| hashcat | [hashcat.net](https://hashcat.net/hashcat/) | [hashcat/hashcat](https://github.com/hashcat/hashcat) | World's fastest password recovery utility (GPU-accelerated). | [cracker, gpu, password, hash] | 2026 | 2009 | 20k+ |
+| John the Ripper | [openwall.com/john](https://www.openwall.com/john/) | [openwall/john](https://github.com/openwall/john) | Fast password cracker supporting many hash types. | [cracker, password, c] | 2026 | 1996 | 9k+ |
+| Ghidra | [nsa.gov/ghidra](https://ghidra-sre.org/) | [NationalSecurityAgency/ghidra](https://github.com/NationalSecurityAgency/ghidra) | NSA-released SRE framework with decompiler. | [reverse, decompiler, java] | 2026 | 2019 | 50k+ |
+| radare2 | [rada.re](https://rada.re) | [radareorg/radare2](https://github.com/radareorg/radare2) | Advanced reverse-engineering framework for binaries. | [reverse, framework, disassembler] | 2026 | 2009 | 20k+ |
+| yara | [virustotal.github.io/yara](https://virustotal.github.io/yara/) | [VirusTotal/yara](https://github.com/VirusTotal/yara) | Pattern-matching tool for malware research/rules. | [malware, rules, pattern] | 2026 | 2013 | 12k+ |
+| mimikatz | [github.com/gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) | [gentilkiwi/mimikatz](https://github.com/gentilkiwi/mimikatz) | Windows credential extraction and manipulation tool. | [windows, credential, post-exploit] | ~2024 | 2011 | 20k+ |
+| pwndbg | — | [pwndbg/pwndbg](https://github.com/pwndbg/pwndbg) | Exploit dev / GDB enhancements for reverse engineering. | [gdb, exploit, reverse, python] | 2026 | 2015 | 7k+ |
\ No newline at end of file