25 KiB
25 KiB
Pentesters Arsenal Tools
Comprehensive, categorized collection of penetration testing tools.
Grouped by primary function following common pentest phases.
All entries adhere to the TOOL-TABLE-SCHEMA.md.
Use browser search (Ctrl+F) or expand sections below.
↑ Back to Tools Overview | ↑ Back to Pentest Recon & Enum INDEX
Reconnaissance & OSINT
Reconnaissance & OSINT
Tools for information gathering, domain/IP enumeration, crawling, username hunting, etc.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| Photon | — | s0md3v/Photon | Incredibly fast crawler designed for OSINT data extraction. | [osint, crawler, recon, python] | ~2022 | 2018 | 10k+ |
| Recon-ng | — | lanmaster53/recon-ng | Full-featured web reconnaissance framework written in Python. | [recon, osint, framework, python] | ~2023 | 2012 | 10k+ |
| AutoRecon | — | Tib3rius/AutoRecon | Automated network reconnaissance tool for enumerating services and hosts. | [recon, automation, enumeration, python] | ~2024 | 2020 | 8k+ |
| aquatone | — | michenriksen/aquatone | Tool for visual inspection of website screenshots during domain flyovers. | [recon, screenshot, domain, go] | ~2020 | 2017 | 5k+ |
| BillCipher | — | m4ll0k/BillCipher | Information gathering tool for websites or IP addresses. | [recon, osint, enumeration, python] | ~2021 | 2018 | 1k+ |
| sherlock | — | sherlock-project/sherlock | Hunts down social media accounts by username across networks. | [osint, username, recon, python] | 2026 | 2018 | 50k+ |
| Osmedeus | osmedeus.com | j3ssie/osmedeus | Fully automated offensive security tool for recon and vulnerability scanning. | [automation, recon, scanner, python] | 2026 | 2019 | 5k+ |
| LeakLooker | — | — | Finds open databases powered by Binaryedge.io data. | [osint, database, leak, recon] | — | ~2020 | — |
Web Proxies & Interception
Web Proxies & Interception
Intercepting proxies and traffic manipulation tools (core for web app testing).
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| Sandcat Browser | syhunt.com/sandcat | syhunt/sandcat | Penetration-oriented browser with Lua scripting, headers, and dev tools built-in. | [browser, pentest, lua, web, headers] | ~2023 | ~2015 | — |
| Burp Suite | portswigger.net/burp | — | Industry-standard web app security testing suite with proxy, scanner, and repeater. | [web, proxy, scanner, intercept, burp] | Active 2026 | 2006 | — |
| OWASP Zed Attack Proxy | zaproxy.org | zaproxy/zaproxy | Open-source intercepting proxy and automated web app vulnerability scanner. | [web, proxy, scanner, zap, owasp] | 2026 | 2010 | 12k+ |
| mitmproxy | mitmproxy.org | mitmproxy/mitmproxy | Interactive TLS-capable HTTP/HTTPS intercepting proxy for traffic manipulation. | [proxy, intercept, tls, python, http] | 2026 | 2010 | 37k+ |
| WhatWaf | — | Ekultek/WhatWaf | Detects and bypasses web application firewalls and protection systems. | [waf, bypass, detection, python] | ~2023 | 2018 | 3k+ |
| Corsy | — | s0md3v/Corsy | Scanner for finding CORS misconfigurations and vulnerabilities. | [web, cors, scanner, python] | ~2022 | 2019 | 2k+ |
Web Vulnerability Scanners & Auditors
Web Vulnerability Scanners & Auditors
Web-specific scanners, directory enumeration, XSS/SQL injection focused tools.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| Nikto2 | cirt.net/Nikto2 | sullo/nikto | Web server scanner performing comprehensive tests for misconfigs and issues. | [web, scanner, perl, server] | ~2024 | 2001 | 7k+ |
| w3af | w3af.org | andresriancho/w3af | Web application attack and audit framework for finding and exploiting vulns. | [web, framework, scanner, python] | ~2020 | 2007 | 4k+ |
| sqlmap | sqlmap.org | sqlmapproject/sqlmap | Automates detection and exploitation of SQL injection flaws. | [sql, injection, exploit, automation, python] | 2026 | 2006 | 31k+ |
| XSStrike | — | s0md3v/XSStrike | Most advanced XSS detection suite with payload generation and evasion. | [web, xss, scanner, python] | ~2023 | 2018 | 13k+ |
| dirhunt | — | mkdocs/dirhunt | Finds web directories and files without bruteforcing. | [web, directory, enumeration, python] | ~2023 | 2018 | 2k+ |
| Raccoon | — | evyatarmeged/Raccoon | High performance offensive security tool for recon and vulnerability scanning. | [recon, scanner, vuln, python] | ~2021 | 2019 | 4k+ |
General/Network Vulnerability Scanners
General/Network Vulnerability Scanners
Broader system/network vuln scanning, often agentless or plugin-extensible.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| vuls | vuls.io | future-architect/vuls | Agent-less vulnerability scanner for Linux/FreeBSD and other systems. | [scanner, vuln, linux, go] | 2026 | 2016 | 10k+ |
| tsunami | google.github.io/tsunami-security-scanner | google/tsunami-security-scanner | General-purpose network security scanner with extensible plugin system. | [scanner, network, plugin, java] | ~2024 | 2019 | 8k+ |
Exploitation Frameworks & Automation
Exploitation Frameworks & Automation
Full frameworks and automated exploit chains for offensive operations.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| Metasploit | metasploit.com | rapid7/metasploit-framework | Exploitation framework for pentesting systems, networks, web, and more. | [exploit, framework, ruby, metasploit] | 2026 | 2003 | 33k+ |
| Sn1per | sn1persecurity.com | 1N3/Sn1per | Automated pentest framework for offensive security experts. | [automation, framework, recon, exploit] | ~2025 | 2015 | 7k+ |
| AutoSploit | — | AutoSploit/AutoSploit | Automated mass exploiter using public exploits. | [exploit, automation, mass] | ~2018 | 2018 | 2k+ |
| routersploit | — | threat9/routersploit | Exploitation framework dedicated to embedded devices and routers. | [exploit, router, embedded, python] | 2026 | 2015 | 12k+ |
| beef | beefproject.com | beefproject/beef | Browser exploitation framework focused on client-side attacks. | [browser, exploit, framework, ruby] | 2026 | 2010 | 8k+ |
Password & Hash Cracking
Password & Hash Cracking
High-performance crackers for hashes and passwords.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| John The Ripper | openwall.com/john | openwall/john | Fast password cracker supporting many hash types and platforms. | [cracker, password, hash, c] | 2026 | 1996 | 9k+ |
| hashcat | hashcat.net | hashcat/hashcat | World's fastest and most advanced password recovery utility (GPU-accelerated). | [cracker, gpu, password, hash, c] | 2026 | 2009 | 20k+ |
Fuzzing & Fault Injection
Fuzzing & Fault Injection
Coverage-guided fuzzers and attack pattern dictionaries.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| fuzzdb | — | fuzzdb-project/fuzzdb | Dictionary of attack patterns and primitives for black-box fault injection. | [fuzz, dictionary, patterns, attack] | ~2023 | 2010 | 3k+ |
| AFL | lcamtuf.coredump.cx/afl | google/AFL | Free software fuzzer focused on security-oriented coverage-guided fuzzing. | [fuzzer, coverage, security, c] | ~2018 | 2013 | 5k+ |
| AFL++ | aflplus.plus | AFLplusplus/AFLplusplus | AFL with community patches and improvements for better fuzzing. | [fuzzer, coverage, security, c++] | 2026 | 2019 | 5k+ |
| syzkaller | — | google/syzkaller | Unsupervised coverage-guided kernel fuzzer for OS kernels. | [fuzzer, kernel, coverage, go] | 2026 | 2015 | 5k+ |
Reverse Engineering & Debugging
Reverse Engineering & Debugging
Disassemblers, decompilers, and GDB enhancements for binary analysis.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| pwndbg | — | pwndbg/pwndbg | Exploit development and reverse engineering enhancements for GDB. | [gdb, exploit, reverse, python] | 2026 | 2015 | 7k+ |
| GDB PEDA | — | longld/peda | Python Exploit Development Assistance for GDB. | [gdb, exploit, reverse, python] | ~2022 | 2012 | 6k+ |
| IDA | hex-rays.com/ida-pro | — | Multi-processor disassembler and debugger for reverse engineering malware. | [reverse, disassembler, debugger] | Active 2026 | 1991 | — |
| radare2 | rada.re | radareorg/radare2 | Framework for reverse-engineering and analyzing binaries. | [reverse, framework, disassembler, c] | 2026 | 2009 | 20k+ |
| Ghidra | nsa.gov/ghidra | NationalSecurityAgency/ghidra | Software reverse engineering framework with decompiler from NSA. | [reverse, decompiler, java, framework] | 2026 | 2019 | 50k+ |
| Cutter | cutter.re | rizinorg/cutter | SRE platform integrating Ghidra's decompiler with modern UI. | [reverse, gui, decompiler, cpp] | 2026 | 2017 | 15k+ |
Post-Exploitation & Credential Tools
Post-Exploitation & Credential Tools
Credential dumping, privilege escalation, and post-compromise utilities.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| mimikatz | — | gentilkiwi/mimikatz | Tool to play with Windows security features like credential extraction. | [windows, credential, post-exploit, c] | ~2024 | 2011 | 20k+ |
| SUDO_KILLER | — | TH3xACE/SUDO_KILLER | Tool to identify and exploit sudo rules misconfigurations and vulns. | [linux, sudo, privilege, escalation] | ~2023 | 2019 | 1k+ |
Miscellaneous / Specialized
Miscellaneous / Specialized
Reporting, threat modeling, CTF helpers, collections, and other utilities.
| Name | Vendor/Webpage | GitHub Repo | Brief Description | Tags | Latest Commit | Creation Date | Stars |
|---|---|---|---|---|---|---|---|
| Faraday | faradaysec.com | infobyte/faraday | Integrated multiuser pentest environment for collaboration and reporting. | [collaboration, reporting, pentest, python] | 2026 | 2012 | 4k+ |
| Vulnreport | — | salesforce/vulnreport | Open-source pentesting management and automation platform. | [management, reporting, pentest, ruby] | ~2022 | 2015 | 1k+ |
| Mentalist | — | sc0tfree/mentalist | Graphical tool for custom wordlist generation. | [wordlist, generator, gui, python] | ~2020 | 2017 | 2k+ |
| archerysec | archerysec.info | archerysec/archerysec | Vulnerability assessment and management platform for scans and tracking. | [vuln, management, scanner, python] | ~2025 | 2018 | 2k+ |
| yara | virustotal.github.io/yara | VirusTotal/yara | Pattern matching swiss knife for malware research and rules. | [malware, rules, pattern, c] | 2026 | 2013 | 12k+ |
| exploitdb | exploit-db.com | offensive-security/exploitdb | Searchable archive of exploits and vulnerable software from Exploit Database. | [exploit, database, archive] | 2026 | 2004 | 9k+ |
| getsploit | — | vulnerables/getsploit | Command-line utility for searching and downloading exploits. | [exploit, search, cli, python] | ~2021 | 2017 | 1k+ |
| ctf-tools | — | zardus/ctf-tools | Collection of setup scripts for security research and CTF tools. | [ctf, setup, tools, python] | ~2022 | 2015 | 2k+ |
| pwntools | — | Gallopsled/pwntools | CTF framework and exploit development library. | [ctf, exploit, python, library] | 2026 | 2013 | 12k+ |
| p0f | lcamtuf.coredump.cx/p0f3 | lcamtuf/p0f | Passive TCP/IP stack fingerprinting tool to identify OS and apps. | [fingerprint, passive, network, c] | ~2014 | ~2000 | 1k+ |
| ssh_scan | — | mozilla/ssh_scan | Prototype SSH configuration and policy scanner. | [ssh, scanner, security, ruby] | ~2020 | 2015 | 2k+ |
| OWASP Threat Dragon | owasp.org/www-project-threat-dragon | OWASP/Threat-Dragon | Tool to create threat model diagrams and record possible threats. | [threat, modeling, diagram, security] | 2026 | 2015 | 2k+ |