penetration-testing-tools

Modlishka. Reverse Proxy.

Next generation web scanner

📦 Make security testing of K8s, Docker, and Containerd easier.

一款适用于以HW行动/红队/渗透测试团队为场景的移动端(Android、iOS、WEB、H5、静态网站)信息收集扫描工具，可以帮助渗透测试工程师、攻击队成员、红队成员快速收集到移动端或者静态WEB站点中关键的资产信息并提供基本的信息输出,如：Title、Domain、CDN、指纹信息、状态信息等。

An HTTP/HTTPS intercept proxy written in Go.

Kubesploit is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in Golang, focused on containerized environments.

JustTryHarder, a cheat sheet which will aid you through the PWK course & the OSCP Exam. (Inspired by PayloadAllTheThings)

Dangerously fast DNS/network/port scanner

Statically-linked ssh server with reverse shell functionality for CTFs and such

An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically.

A rapid API for the Project Sonar dataset

Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).

A Golang implant that uses Slack as a command and control server

A repository of tools for pentesting of restricted and isolated environments.

Automated brute-forcing attack tool.

A tool to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies

Penetration Testing and Hacking CTF's Swiss Army Knife with: Reverse Shell Handling - Encoding/Decoding - Encryption/Decryption - Cracking Hashes / Hashing

Login hunter of default credentials for administrative web interfaces leveraging NNdefaccts dataset.

Second-order subdomain takeover scanner

Automate installation of extra pentest tools on Kali Linux

A tool to test security of json web token

Recsech is a tool for doing Footprinting and Reconnaissance on the target web. Recsech collects information such as DNS Information, Sub Domains, HoneySpot Detected, Subdomain takeovers, Reconnaissance On Github and much more you can see in Features in tools .

A Post exploitation tool written in C# uses either CIM or WMI to query remote systems.

🍉一款基于Python-Django的多功能Web安全渗透测试工具，包含漏洞扫描，端口扫描，指纹识别，目录扫描，旁站扫描，域名扫描等功能。

Modular personalized dictionary generator.

An organizational asset and vulnerability management tool, with Jira integration, designed for generating application security reports.

Collection of Pentest Notes and Cheatsheets from a lot of repos (SofianeHamlaoui,dostoevsky,mantvydasb,adon90,BriskSec)

A Security Tool for Enumerating WebSockets

Shadow Workers is a free and open source C2 and proxy designed for penetration testers to help in the exploitation of XSS and malicious Service Workers (SW)

PENIOT: Penetration Testing Tool for IoT