awesome-pentest - 一系列出色的渗透测试资源

项目说明

Awesome Penetration Testing ![Awesome]()

> A collection of awesome penetration testing and offensi resources.

Penetration testing is the practice of launching authorized, simulated attacks against computer systems and their physical infrastructure to expose potential security weaknesses and . Should you discover a , please follow this guidance to report it responsibly.

Your contributions and suggestions are heartily♥ welcome. (✿◕‿◕). Please check the Contributing Guidelines for more details. This work is licensed under a Creati Attribution 4.0 International License.

Contents

* Android Utilities
* Anonymity Tools
* Tor Tools
* Anti-virus E Tools
* Books
* Malware Analysis Books
* CTF Tools
* Cloud Platform Attack Tools
* Collaboration Tools
* Conferences and Events
* Asia
* Europe
* North America
* South America
* Zealandia
* Exfiltration Tools
* Exploit De Tools
* File Format Analysis Tools
* GNU/Linux Utilities
* Hash Cracking Tools
* Hex Editors
* Industrial Control and SCADA Systems
* Intentionally Systems
* Intentionally Systems as Docker Containers
* Lock Picking
* macOS Utilities
* Multi-paradigm Frameworks
* Network Tools
* DDoS Tools
* Network Reconnaissance Tools
* Protocol Analyzers and Sniffers
* 网络 Traffic Replay and Editing Tools
* Proxies and Machine-in-the-Middle (MITM) Tools
* Transport Layer Security Tools
* Secure Shell Tools
* Wireless Network Tools
* Network Scanners
* Web Scanners
* Open Sources Intelligence (OSINT)
* Data broker and search engine services
* Dorking tools
* Email search and analysis tools
* Metadata har and analysis
* Network device discovery tools
* OSINT Online Resources
* Source code repository searching tools
* Web application and resource analysis tools
* Online Resources
* Online Code Samples and Examples
* Online Exploit De Resources
* Online Lock Picking Resources
* Online Operating Systems Resources
* Online Penetration Testing Resources
* Other Lists Online
* Penetration Testing Report Templates
* Operating System Distributions
* Periodicals
* Physical Access Tools
* Pri Escalation Tools
* Password Spraying Tools
* Reverse Engineering
* Reverse Engineering Books
* Reverse Engineering Tools
* Security Education Courses
* Shellcoding Guides and Tutorials
* Side-channel Tools
* Social Engineering
* Social Engineering Books
* Social Engineering Online Resources
* Social Engineering Tools
* Static Analyzers
* Steganography Tools
* Databases
* Web Exploitation
* Intercepting Web proxies
* Web file inclusion tools
* Web injection tools
* Web path discovery and bruteforcing tools
* Web shells and C2 frameworks
* Web-accessible 源码 代码 ripping tools
* Web Exploitation Books
* Windows Utilities

Android Utilities

* cSploit - Ad IT security professional toolkit on Android featuring an integrated Metasploit daemon and MITM capabilities.
* Fing - 网络 scanning and host enumeration app that performs NetBIOS, UPnP, Bonjour, SNMP, and other ad device fingerprinting techniques.
* NullKia - Mobile Security 框架 supporting 500+ devices across 18 manufacturers with bootloader unlock, firmware extraction, baseband exploitation, and eSIM tools.
* MPT - MPT (Mobile Pentest Toolkit) is a must-ha for your android penetration testing workflow. It allows you to automate tasks.

Anonymity Tools

* I2P - The In Internet Project.
* Metadata Anonymization Toolkit (MAT) - Metadata removal 工具, supporting a wide range of commonly used file formats, written in Python3.
* What Every Browser Knows About You - Comprehensi page to test your own Web browser's configuration for privacy and identity leaks.

Tor Tools

See also awesome-tor.

* Nipe - Script to redirect all traffic from the machine to the Tor 网络.
* OnionScan - 工具 for in the Dark Web by finding operational security issues introduced by Tor hidden service operators.
* Tails - Li system aiming to preserve your privacy and anonymity.
* Tor - Free software and onion routed o 网络 that helps you defend against traffic analysis.
* dos-o - Proof of concept denial of service over Tor stress test 工具.
* kalitorify - Transparent proxy through Tor for Kali Linux OS.

Anti-virus E Tools

* AntiVirus E 工具 (AVET) - Post-process exploits containing executable files targeted for Windows machines to avoid being recognized by antivirus software.
* CarbonCopy - 工具 that creates a spoofed certificate of any online website and signs an Executable for A.
* Hyperion - Runtime encryptor for 32-bit portable executables ("PE .exes").
* Shellter - Dynamic shellcode injection 工具, and the first truly dynamic PE infector e.
* UniByA obfuscator that takes raw shellcode and generates Anti-Virus friendly executables by using a brute-forcable, 32-bit XOR key.
* Veil - Generate metasploit payloads that bypass common anti-virus solutions.
* peCloakCapstone - Multi-platform fork of the peCloak.py automated malware antivirus e 工具.
* Amber - Reflective PE packer for con native PE files to position-independent shellcode.

Books

See also DEF CON Suggested Reading.

* Ad Penetration Testing by Wil Allsopp, 2017
* Ad Penetration Testing for Highly-Secured En by Lee Allen, 2012
* Ad Persistent Threat Hacking: The Art and Science of Hacking Any Organization by Tyler Wrightson, 2014
* Android Hacker's Handbook by Joshua J. Drake et al., 2014
* BTFM: Blue Team Field Manual by Alan J White & Ben Clark, 2017
* Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014
* Bug Hunter's Diary by Tobias Klein, 2011
* Car Hacker's Handbook by Craig Smith, 2016
* Effecti Testing, 2021
* Fuzzing: Brute Force Discovery by Michael Sutton et al., 2007
* Metasploit: The Penetration Tester's Guide by Da et al., 2011
* Penetration Testing: A Hands-On Introduction to Hacking by Georgia Weidman, 2014
* Penetration Testing: Procedures & Methodologies by EC-Council, 2010
* Professional Penetration Testing by Thomas Wilhelm, 2013
* RTFM: Red Team Field Manual by Ben Clark, 2014
* The Art of Exploitation by Jon Erickson, 2008
* The Art of 网络 Penetration Testing, 2020
* The Basics of Hacking and Penetration Testing by Patrick Engebretson, 2013
* The 数据库 Hacker's Handbook, Da et al., 2005
* The Hacker Playbook by Peter Kim, 2014
* The Mac Hacker's Handbook by Charlie Miller & Dino Dai Zovi, 2009
* The Mobile Application Hacker's Handbook by Dominic Chell et al., 2015
* Unauthorised Access: Physical Penetration Testing For IT Security Teams by Wil Allsopp, 2010
* Python by TJ O'Connor, 2012
* iOS Hacker's Handbook by Charlie Miller et al., 2012

Malware Analysis Books

See awesome-malware-analysis § Books.

CTF Tools

* CTF Field Guide - E you need to win your next CTF competition.
* Ciphey - Automated decryption 工具 using artificial intelligence and natural language processing.
* RsaCtfTool - Decrypt data enciphered using weak RSA keys, and reco keys from public keys using a of automated attacks.
* ctf-tools - Collection of setup scripts to install security research tools easily and quickly deployable to new machines.
* shellpop - Easily generate sophisticated reverse or bind shell commands to help you save time during penetration tests.

Cloud Platform Attack Tools

See also *HackingThe.cloud*.

* Cloud Container Attack 工具 (CCAT) - 工具 for testing security of container en.
* CloudHunter - Looks for AWS, Azure and Google cloud storage buckets and lists permissions for buckets.
* Cloudsplaining - Identifies of least pri in AWS IAM policies and generates a pretty HTML report with a triage worksheet.
* Endgame - AWS Pentesting 工具 that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account.
* GCPBucketBrute - Script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be pri escalated.

Collaboration Tools

* Dradis - Open-源码 reporting and collaboration 工具 for IT security professionals.
* Hexway Hive - Commercial collaboration, data aggregation, and reporting 框架 for red teams with a limited free self-hostable option.
* Lair - Reacti collaboration 框架 and web application built with meteor.
* Pentest Collaboration 框架 (PCF) - Open 源码, cross-platform, and portable toolkit for automating routine pentest processes with a team.
* Reconmap - Open-源码 collaboration platform for InfoSec professionals that streamlines the pentest process.
* RedELK - Track and alarm about Blue Team acti while pro better usability in long term offensi.

Conferences and Events

* BSides - 框架 for organising and holding security conferences.
* CTFTime.org - Directory of upcoming and archive of past Capture The Flag (CTF) competitions with links to challenge writeups.

Asia

* HITB - Deep-knowledge security conference held in Malaysia and The Netherlands.
* HITCON - Hacks In Taiwan Conference held in Taiwan.
* Nullcon - Annual conference in Delhi and Goa, India.
* SECUINSIDE - Security Conference in Seoul.

Europe

* 44Con - Annual Security Conference held in London.
* BalCCon - Balkan Computer Congress, annually held in Novi Sad, Serbia.
* BruCON - Annual security conference in Belgium.
* CCC - Annual meeting of the international hacker scene in Germany.
* DeepSec - Security Conference in , Austria.
* DefCamp - Largest Security Conference in Eastern Europe, held annually in Bucharest, Romania.
* FSec - FSec - Croatian Information Security Gathering in Varaždin, Croatia.
* Hack.lu - Annual conference held in Luxembourg.
* Infosecurity Europe - Europe's number one information security event, held in London, UK.
* SteelCon - Security conference in Sheffield UK.
* Swiss Cyber Storm - Annual security conference in Lucerne, Switzerland.
* Troopers - Annual international IT Security event with workshops held in Heidelberg, Germany.
* HoneyCON - Annual Security Conference in Guadalajara, Spain. Organized by the HoneySEC association.

North America

* AppSecUSA - Annual conference organized by OWASP.
* Black Hat - Annual security conference in Las Vegas.
* CarolinaCon - Infosec conference, held annually in North Carolina.
* DEF CON - Annual hacker con in Las Vegas.
* DerbyCon - Annual hacker conference based in Louisville.
* Hackers Next Door - Cybersecurity and social technology conference held in New York City.
* Hackers On Planet Earth (HOPE) - Semi-annual conference held in New York City.
* Hackfest - Largest hacking conference in Canada.
* LayerOne - Annual US security conference held every spring in Los Angeles.
* National Cyber Summit - Annual US security conference and Capture the Flag event, held in Huntsville, Alabama, USA.
* PhreakNIC - Technology conference held annually in middle Tennessee.
* RSA Conference USA - Annual security conference in San Francisco, California, USA.
* ShmooCon - Annual US East coast hacker con.
* SkyDogCon - Technology conference in Nashville.
* SummerCon - One of the oldest hacker con in America, held during Summer.
* ThotCon - Annual US hacker conference held in Chicago.
* Virus Bulletin Conference - Annual conference going to be held in Denver, USA for 2016.

South America

* Ekoparty - Largest Security Conference in Latin America, held annually in Buenos Aires, Argentina.

Zealandia

* CHCon - Christchurch Hacker Con, Only South Island of New Zealand hacker con.

Exfiltration Tools

* DET - Proof of concept to perform data exfiltration using either single or multiple channel(s) at the same time.
* Iodine - Tunnel IPv4 data through a DNS 服务端; useful for exfiltration from networks where Internet access is firewalled, but DNS queries are allowed.
* TrevorC2 - 客户端/服务端 工具 for masking command and control and data exfiltration through a normally browsable website, not typical HTTP POST requests.
* dnscat2 - 工具 designed to create an encrypted command and control channel over the DNS 协议, which is an effecti out of almost every 网络.
* pwnat - Punches holes in firewalls and NATs.
* tgcd - Simple Unix 网络 utility to extend the accessibility of TCP/IP based 网络 services beyond firewalls.
* QueenSono - 客户端/Ser for data exfiltration with ICMP. Useful in a 网络 where ICMP 协议 is less monitored than others (which is a common case).

Exploit De Tools

See also *Reverse Engineering Tools*.

* H26Forge - Domain-specific infrastructure for analyzing, generating, and manipulating syntactically correct but semantically spec-non-compliant video files.
* Magic Unicorn - Shellcode generator for numerous attack , including Microsoft Office macros, PowerShell, HTML applications (HTA), or certutil (using fake certificates).
* Pwntools - Rapid exploit de 框架 built for use in CTFs.
* Wordpress Exploit 框架 - Ruby 框架 for de and using modules which aid in the penetration testing of WordPress powered websites and systems.
* peda - Python Exploit De Assistance for GDB.

File Format Analysis Tools

* ExifTool - Platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide of files.
* Hachoir - Python library to view and edit a binary stream as tree of fields and tools for metadata extraction.
* Kaitai Struct - File formats and 网络 protocols dissection language and web IDE, generating parsers in C++, C#, Ja, Perl, PHP, Python, Ruby.
* peepdf - Python 工具 to explore PDF files in order to find out if the file can be harmful or not.
* Veles - Binary data and analysis tool.

GNU/Linux Utilities

* Hwacha - Post-exploitation 工具 to quickly execute payloads via SSH on one or more Linux systems simultaneously.
* Linux Exploit Suggester - Heuristic reporting on potentially exploits for a given GNU/Linux system.
* Lynis - Auditing 工具 for UNIX-based systems.
* checksec.sh - Shell script designed to test what standard Linux OS and PaX security features are being used.

Hash Cracking Tools

* BruteForce 钱包 - Find the password of an encrypted 钱包 file (i.e. wallet.dat).
* CeWL - Generates custom wordlists by spidering a target's website and collecting unique words.
* duplicut - Quickly remo, without changing the order, and without getting OOM on huge wordlists.
* GoCrack - Management Web frontend for distributed password cracking sessions using hashcat (or other supported tools) written in Go.
* Hashcat - The more fast hash cracker.
* hate_crack - 工具 for automating cracking methodologies through Hashcat.
* JWT Cracker - Simple HS256 JSON Web Token (JWT) token brute force cracker.
* John the Ripper - Fast password cracker.
* Rar Crack - RAR bruteforce cracker.

Hex Editors

* Bless - High quality, full featured, cross-platform graphical hex editor written in Gtk#.
* Frhed - Binary file editor for Windows.
* Hex Fiend - Fast, open 源码, hex editor for macOS with support for binary diffs.
* HexEdit.js - Browser-based hex editing.
* Hexinator - World's finest (proprietary, commercial) Hex Editor.
* hexedit - Simple, fast, console-based hex editor.
* wxHexEditor - Free 界面 hex editor for GNU/Linux, macOS, and Windows.

Industrial Control and SCADA Systems

See also awesome-industrial-control-system-security.

* Industrial Exploitation 框架 (ISF) - Metasploit-like exploit 框架 based on routersploit designed to target Industrial Control Systems (ICS), SCADA devices, PLC firmware, and more.
* s7scan - Scanner for enumerating Siemens S7 PLCs on a TCP/IP or LLC 网络.
* OpalOPC - Commercial OPC UA assessment 工具, sold by Molemmat.

Intentionally Systems

See also awesome-.
* Pentest-Ground.
* OopsSec Store - Run npx create-oss-store, open your browser, and start hunting flags.

Intentionally Systems as Docker Containers

* Damn Web Application (DVWA) - docker pull citizenstig/dvwa.
* OWASP Juice Shop - docker pull bkimminich/juice-shop.
* OWASP Mutillidae II Web Pen-Test Practice Application - docker pull citizenstig/nowasp.
* OWASP NodeGoat - docker-compose build && docker-compose up.
* OWASP Security Shepherd - docker pull ismisepaul/securityshepherd.
* OWASP WebGoat Project 7.1 docker image - docker pull webgoat/webgoat-7.1.
* OWASP WebGoat Project 8.0 docker image - docker pull webgoat/webgoat-8.0.
* as a service: Heartbleed - docker pull hmlio/.
* as a service: SambaCry - docker pull /c.
* as a service: Shellshock - docker pull hmlio/.
* WordPress Installation - docker pull wpscanteam/.

Lock Picking

See awesome-lockpicking.

macOS Utilities

* Bella - Pure Python post-exploitation data mining and remote administration 工具 for macOS.
* E - Modular RAT that uses numerous e and exfiltration techniques out-of-the-box.

Multi-paradigm Frameworks

* Armitage - Ja 界面 front-end for the Metasploit 框架.
* AutoSploit - Automated mass exploiter, which collects target by employing the Shodan.io API and programmatically chooses Metasploit exploit modules based on the Shodan query.
* Decker - Penetration testing orchestration and automation 框架, which allows writing declarati configurations capable of ingesting and using outputs of tools it has run as inputs to others.
* Faraday - Multiuser integrated pentesting en for red teams performing cooperati tests, security audits, and risk assessments.
* Metasploit - Software for offensi teams to help and manage security assessments.
* Pupy - Cross-platform (Windows, Linux, macOS, Android) remote administration and post-exploitation 工具.
* Ronin - Free and Open 源码 Ruby Toolkit for Security Research and De, pro many different libraries and commands for a of security tasks, such as recon, scanning, exploit de, exploitation, post-exploitation, and more.

Network Tools

* CrackMapExec - Swiss army knife for pentesting networks.
* IKEForce - Command line IPSEC forcing 工具 for Linux that allows group name/ID enumeration and XAUTH brute forcing capabilities.
* Intercepter-NG - Multifunctional 网络 toolkit.
* Legion - Graphical semi-automated discovery and reconnaissance 框架 based on Python 3 and forked from SPARTA.
* Ncrack - High-speed 网络 authentication cracking 工具 built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords.
* Praeda - Automated multi-function printer data har for gathering usable data during security assessments.
* Printer Exploitation Toolkit (PRET) - 工具 for printer security testing capable of IP and USB connectivity, fuzzing, and exploitation of PostScript, PJL, and PCL printer language features.
* SPARTA - Graphical interface offering scriptable, configurable access to existing 网络 infrastructure scanning and enumeration tools.
* SigPloit - Signaling security testing 框架 dedicated to telecom security for researching in the signaling protocols used in mobile (cellular phone) operators.
* Smart Install Exploitation 工具 (SIET) - Scripts for identifying Cisco Smart Install-enabled switches on a 网络 and then manipulating them.
* THC Hydra - Online password cracking 工具 with built-in support for many 网络 protocols, including HTTP, SMB, FTP, telnet, ICQ, MySQL, LDAP, IMAP, VNC, and more.
* Tsunami - General purpose 网络 security scanner with an extensible plugin system for detecting high se with high confidence.
* Zarp - 网络 attack 工具 centered around the exploitation of local networks.
* dnstwist - Domain name permutation 引擎 for detecting typo squatting, phishing and corporate espionage.
* dsniff - Collection of tools for 网络 auditing and pentesting.
* impacket - Collection of Python classes for working with 网络 protocols.
* pi - Portable, platform independent and powerful 网络 pi toolkit.
* routersploit - Open 源码 exploitation 框架 similar to Metasploit but dedicated to embedded devices.
* rshijack - TCP connection hijacker, Rust rewrite of shijack.

DDoS Tools

* Anevicon - Powerful UDP-based load generator, written in Rust.
* D(HE)ater - D(HE)ater sends forged cryptographic handshake messages to enforce the Diffie-Hellman key exchange.
* HOIC - Updated of Low Orbit Ion Cannon, has 'boosters' to get around common counter measures.
* Low Orbit Ion Canon (LOIC) - Open 源码 网络 stress 工具 written for Windows.
* Memcrashed - DDoS attack 工具 for sending forged UDP packets to Memcached servers obtained using Shodan API.
* SlowLoris - DoS 工具 that uses low bandwidth on the attacking side.
* T50 - Faster network stress tool.
* UFONet - Abuses OSI layer 7 HTTP to create/manage 'zombies' and to conduct different attacks using; GET/POST, multithreading, proxies, origin spoofing methods, cache e techniques, etc.

Network Reconnaissance Tools

* ACLight - Script for ad discovery of sensiti Accounts - includes Shadow Admins.
* AQUATONE - Subdomain discovery 工具 utilizing open sources producing a report that can be used as input to other tools.
* CloudFail - Unmask 服务端 IP addresses hidden behind Cloudflare by searching old 数据库 records and detecting misconfigured DNS.
* DNSDumpster - Online DNS recon and search service.
* Mass Scan - TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
* OWASP Amass - Subdomain enumeration , web archives, brute forcing, permutations, reverse DNS sweeping, TLS certificates, passive DNS data sources, etc.
* ScanCannon - POSIX-compliant BASH script to quickly enumerate large networks by calling masscan to quickly identify open ports and then nmap to gain details on the systems/services on those ports.
* XRay - 网络 (sub)domain discovery and reconnaissance automation 工具.
* dnsenum - Perl script that enumerates DNS information from a domain, attempts zone transfers, performs a brute force dictionary style attack, and then performs reverse look-ups on the results.
* dnsmap - Passive DNS network mapper.
* dnsrecon - DNS enumeration script.
* dnstracer - Determines where a given DNS 服务端 gets its information from, and follows the chain of DNS servers.
* fierce - Python3 port of the original fierce.pl DNS reconnaissance 工具 for locating non-contiguous IP space.
* netdiscover - 网络 address discovery scanner, based on ARP sweeps, de mainly for those wireless networks without a DHCP 服务端.
* nmap - Free security scanner for 网络 exploration & security audits.
* passi - Library and query 工具 for querying several passive DNS pro.
* passivedns - 网络 sniffer that logs all DNS ser for use in a passive DNS setup.
* RustScan - Lightweight and quick open-源码 port scanner designed to automatically pipe open ports into Nmap.
* scanless - Utility for using websites to perform port scans on your behalf so as not to reveal your own IP.
* smbmap - Handy SMB enumeration tool.
* subbrute - DNS meta-query spider that enumerates DNS records, and subdomains.
* zmap - Open 源码 网络 scanner that enables researchers to easily perform Internet-wide 网络 studies.
* Have I Been Squatted - A fast domain typosquatting detection 工具
* Subfinder - Fast passi enumeration 工具.
* Naabu - Fast port scanner written in Go with focus on reliability.
* Katana - Next-generation crawling and spidering 框架.

Protocol Analyzers and Sniffers

See also awesome-pcaptools.

* Debookee - Simple and powerful 网络 traffic analyzer for macOS.
* Dshell - 网络 forensic analysis 框架.
* Netzob - Reverse engineering, traffic generation and fuzzing of communication protocols.
* Wireshark - Widely-used graphical, cross-platform 网络 协议 analyzer.
* netsniff-ng - Swiss army knife for 网络 sniffing.
* sniffglue - Secure multithreaded packet sniffer.
* tcpdump/libpcap - Common packet analyzer that runs under the command line.
* Sniffnet - App to comfortably monitor your Internet traffic.

网络 Traffic Replay and Editing Tools

* snort - Open 源码 Intrusion Pre System
* TraceWrangler - 网络 capture file toolkit that can edit and merge pcap or pcapng files with batch editing features.
* WireEdit - Full stack WYSIWYG pcap editor (requires a free license to edit packets).
* bittwist - Simple yet powerful libpcap-based Ethernet packet generator useful in simulating networking traffic or scenario, testing firewall, IDS, and IPS, and troubleshooting 网络 problems.
* hping3 - 网络 工具 able to send custom TCP/IP packets.
* pig - GNU/Linux packet crafting tool.
* scapy - Python-based interacti manipulation program and library.
* tcpreplay - Suite of free Open 源码 utilities for editing and replaying pre captured 网络 traffic.

Proxies and Machine-in-the-Middle (MITM) Tools

See also *Intercepting Web proxies*.

* BetterCAP - Modular, portable and easily extensible MITM 框架.
* Ettercap - Comprehensi suite for machine-in-the-middle attacks.
* Habu - Python utility implementing a of 网络 attacks, such as ARP poisoning, DHCP star, and more.
* Lambda-Proxy - Utility for testing SQL Injection on AWS Lambda ser functions.
* MITMf - 框架 for Man-In-The-Middle attacks.
* Morpheus - Automated ettercap TCP/IP Hijacking 工具.
* SSH MITM - Intercept SSH connections with a proxy; all plaintext passwords and sessions are logged to disk.
* dnschef - Highly configurable DNS proxy for pentesters.
* e - Modular 框架 to take ad of poor upgrade implementations by injecting fake updates.
* mallory - HTTP/HTTPS proxy over SSH.
* oregano - Python module that runs as a machine-in-the-middle (MITM) accepting Tor 客户端 requests.
* sylkie - Command line 工具 and library for testing networks for common address spoofing security in IPv6 networks using the Neighbor Discovery 协议.
* PETEP - Extensible TCP/UDP proxy with 界面 for traffic analysis & modification with SSL/TLS support.
* friTap - Intercept SSL/TLS connections with frida; Allows TLS key extraction and decryption of TLS payload as PCAP in real time.

Transport Layer Security Tools

* CryptoLyzer - Fast and flexible ser (TLS/SSL/SSH/HTTP) settings analyzer library for Python with CLI.
* SSLyze - Fast and comprehensive TLS/SSL configuration analyzer to help identify security mis-configurations.
* crackpkcs12 - Multithreaded program to crack PKCS#12 files (.p12 and .pfx extensions), such as TLS/SSL certificates.
* testssl.sh - Command line 工具 which checks a 服务端's service on any port for the support of TLS/SSL ciphers, protocols as well as some cryptographic flaws.
* tls_prober - Fingerprint a 服务端's SSL/TLS implementation.
* tlsmate - 框架 to create arbitrary TLS test cases. Comes with a TLS ser plugin.

Secure Shell Tools

* ssh-audit - SSH 服务端 & 客户端 auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc).

Wireless Network Tools

* Aircrack-ng - Set of tools for auditing wireless networks.
* Airgeddon - Multi-use bash script for Linux systems to audit wireless networks.
* BoopSuite - Suite of tools written in Python for wireless auditing.
* Bully - Implementation of the WPS brute force attack, written in C.
* Cowpatty - Brute-force dictionary attack against WPA-PSK.
* Fluxion - Suite of automated social engineering based WPA attacks.
* KRACK Detector - Detect and prevent KRACK attacks in your 网络.
* Kismet - Wireless 网络 detector, sniffer, and IDS.
* PSKracker - Collection of WPA/WPA2/WPS default algorithms, password generators, and PIN generators written in C.
* Reaver - Brute force attack against WiFi Protected Setup.
* WiFi Pineapple - Wireless auditing and penetration testing platform.
* WiFi-Pumpkin3 - 框架 for rogue Wi-Fi access point attack.
* Wifite - Automated wireless attack 工具.
* infernal-twin - Automated wireless hacking 工具.
* krackattacks-scripts - WPA2 Krack attack scripts.
* pwnagotchi - Deep reinforcement learning based AI that learns from the Wi-Fi en and instruments BetterCAP in order to maximize the WPA key material captured.
* wifi-arsenal - Resources for Wi-Fi Pentesting.

Network Scanners

* celerystalk - Asynchronous enumeration and scanner that "runs all the tools on all the hosts" in a configurable manner.
* kube-hunter - Open-源码 工具 that runs a set of tests ("hunters") for security issues in Kubernetes clusters from either outside ("attacker's view") or inside a cluster.
* Nessus - Commercial management, configuration, and compliance assessment platform, sold by Tenable.
* Netsparker Application Security Scanner - Application security scanner to automatically find security flaws.
* Nexpose - Commercial and risk management assessment 引擎 that integrates with Metasploit, sold by Rapid7.
* OpenVAS - Free software implementation of the popular Nessus assessment system.
* Vuls - Agentless scanner for GNU/Linux and FreeBSD, written in Go.

Web Scanners

* ACSTIS - Automated 客户端-side template injection (sandbox escape/bypass) detection for AngularJS.
* Arachni - Scriptable 框架 for e the security of web applications.
* JCS - Joomla Component Scanner with automatic 数据库 updater from exploitdb and packetstorm.
* Nikto - Noisy but fast black box web 服务端 and web application scanner.
* SQLmate - Friend of sqlmap that identifies SQLi based on a given dork and (optional) website.
* SecApps - In-browser web application security testing suite.
* WPScan - Black box WordPress scanner.
* Wapiti - Black box web application scanner with built-in fuzzer.
* WebReaver - Commercial, graphical web application scanner designed for macOS.
* cms-explorer - Reveal the specific modules, plugins, components and themes that websites powered by content management systems are running.
* joomscan - Joomla scanner.
* skipfish - Performant and adaptable active web application security reconnaissance 工具.
* w3af - Web application attack and audit 框架.
* WAFtester - WAF security testing CLI that fingerprints 197+ WAF , benchmarks rule co with quantitati, and automates bypass discovery with 70+ e techniques.
* nuclei - Fast and customizable scanner based on simple YAML based DSL.
* Lonkero - Enterprise-grade web scanner with 60+ attack modules, built in Rust for penetration testing and security assessments.
* jiraffe - Security reconnaissance and scanner for Atlassian Jira, focused on misconfigurations, unauthenticated access and C.
* Dalfox - Fast parameter analysis and XSS scanner.
* Ghauri - Ad SQL injection detection and exploitation 工具.

Online Resources

Online Operating Systems Resources

* DistroWatch.com's Security Category - Website dedicated to talking about, re, and keeping up to date with open 源码 operating systems.

Online Penetration Testing Resources

* MITRE's Ad Tactics, Techniques & Common Knowledge (ATT&CK) - Curated knowledge base and model for cyber ad behavior.
* Metasploit Unleashed - Free Offensi Metasploit course.
* Open Web Application Security Project (OWASP) - Worldwide not-for-profit charitable organization focused on improving the security of especially Web-based and Application-layer software.
* PENTEST-WIKI - Free online security knowledge library for pentesters and researchers.
* Penetration Testing Execution Standard (PTES) - Documentation designed to provide a common language and scope for performing and reporting the results of a penetration test.
* Penetration Testing 框架 (PTF) - Outline for performing penetration tests compiled as a general 框架 usable by analysts and penetration testers alike.
* 客户端 XSS Introduction - Comprehensi to 客户端-side cross-site scripting (XSS) attacks.

Other Lists Online

* .NET Programming - Software 框架 for Microsoft Windows platform de.
* Infosec/hacking recorded by cooper - Collection of security conferences recorded by Cooper.
* Android Exploits - Guide on Android Exploitation and Hacks.
* Android Security - Collection of Android security related resources.
* AppSec - Resources for learning about application security.
* Awesome Awesomeness - The List of the Lists.
* Awesome Malware - Curated collection of awesome malware, botnets, and other post-exploitation tools.
* Awesome Shodan Queries - Awesome list of useful, funny, and depressing search queries for Shodan.
* Awesome Censys Queries - A collection of fascinating and bizarre Censys Search Queries.
* AWS 工具 Arsenal - List of tools for testing and securing AWS en.
* Blue Team - Awesome resources, tools, and other shiny things for cybersecurity blue teams.
* C/C++ Programming - One of the main language for open 源码 security tools.
* CTFs - Capture The Flag frameworks, libraries, etc.
* Forensics - Free (mostly open 源码) forensic analysis tools and resources.
* Hacking - Tutorials, tools, and resources.
* Honeypots - Honeypots, tools, components, and more.
* InfoSec § Hacking challenges - Comprehensi of CTFs, wargames, hacking challenge websites, pentest practice lab exercises, and more.
* Infosec - Information security resources for pentesting, forensics, and more.
* Ja Programming - In-browser de and scripting.
* Kali Linux Tools - List of tools present in Kali Linux.
* Node.js Programming by - Curated list of delightful Node.js packages and resources.
* Pentest Cheat Sheets - Awesome Pentest Cheat Sheets.
* Python Programming by @s - General Python programming.
* Python Programming by - General Python programming.
* Python tools for penetration testers - Lots of pentesting tools are written in Python.
* Rawsec's CyberSecurity In - An open-源码 in of tools, resources, CTF platforms and Operating Systems about CyberSecurity. (源码)
* Red Teaming - List of Awesome Red Teaming Resources.
* Ruby Programming by - The de-facto language for writing exploits.
* Ruby Programming by - The de-facto language for writing exploits.
* Ruby Programming by - The de-facto language for writing exploits.
* SecLists - Collection of multiple types of lists used during security assessments.
* SecTools - Top 125 网络 Security Tools.
* Security Talks - Curated list of security conferences.
* Security - Software, libraries, documents, and other resources.
* Ser Security - Curated list of awesome ser security resources such as (e)books, articles, whitepapers, blogs and research papers.
* Shell Scripting - Command line frameworks, toolkits, guides and gizmos.
* YARA - YARA rules, tools, and people.
* Awesome ElectronJS Hacking - A curated list of awesome resources about Electron.js (in)security

Penetration Testing Report Templates

* Public Pentesting Reports - Curated list of public penetration test reports released by several consulting firms and academic security groups.
* Pentest reports - Information hub with list of public penetration test reports, companies, tools and all in one place.
* T& Report Template - Pentest report template provided by Test and Services, Ltd.
* Web Application Security Assessment Report Template - Sample Web application security assessment reporting template provided by Lucideus.

Open Sources Intelligence (OSINT)

See also awesome-osint.

* DataSploit - OSINT utilizing Shodan, Censys, Clearbit, EmailHunter, FullContact, and Zoomeye behind the scenes.
* Depix - 工具 for reco passwords from pixelized screenshots (by de-pixelating text).
* GyoiThon - GyoiThon is an Intelligence Gathering 工具 using Machine Learning.
* Intrigue - Automated OSINT & Attack Surface discovery 框架 with powerful API, UI and CLI.
* Maltego - Proprietary software for open sources intelligence and forensics.
* PacketTotal - Simple, free, high-quality packet capture file analysis facilitating the quick detection of 网络-borne malware (using Zeek and Suricata IDS signatures under the hood).
* Skiptracer - OSINT scraping 框架 that utilizes basic Python webscraping (BeautifulSoup) of PII paywall sites to compile passi on a target on a ramen noodle budget.
* Sn1per - Automated Pentest Recon Scanner.
* Spiderfoot - Multi-源码 OSINT automation 工具 with a Web UI and report .
* creepy - Geolocation OSINT tool.
* gOSINT - OSINT 工具 with multiple modules and a
* image-match - Quickly search o of images.
* recon-ng - Full-featured Web Reconnaissance 框架 written in Python.
* sn0int - Semi-automatic OSINT 框架 and package manager.
* Keyscope - An extensible key and secret for auditing acti against multiple SaaS .
* Facebook Friend List Scraper - 工具 to scrape names and usernames from large friend lists on Facebook, without being rate limited.
* wayparam - Tools designed to disco or undocumented parameters and endpoints by generating or normalizing request inputs, often used to identify input handling issues and unexpected application behavior.

Data Broker and Search Engine Services

* Hunter.io - Data broker pro a Web search interface for disco the email addresses and other organizational details of a company.
* Leaker - Passive leak enumeration CLI 工具 that searches across 10 breach databases simultaneously.
* Threat Crowd - Search 引擎 for threats.
* Virus Total - Free service that analyzes suspicious files and URLs and facilitates the quick detection of , worms, trojans, and all kinds of malware.
* surfraw - Fast UNIX command line interface to a of popular WWW search engines.

Dorking tools

* BinGoo - GNU/Linux bash based Bing and Google Dorking 工具.
* dorkbot - Command-line 工具 to scan Google (or other) search results for .
* github-dorks - CLI 工具 to scan GitHub repos/organizations for potential sensiti leaks.
* GooDork - Command line Google dorking 工具.
* Google Hacking 数据库 - 数据库 of Google dorks; can be used for recon.
* dork-cli - Command line Google dork 工具.
* dorks - Google hack 数据库 automation 工具.
* fast-recon - Perform Google dorks against a domain.
* pagodo - Automate Google Hacking 数据库 scraping.
* snitch - Information gathering .

Email search and analysis tools

* SimplyEmail - Email recon made fast and easy.
* WhatBreach - Search email addresses and discover all known breaches that this email has been seen in, and download the breached 数据库 if it is publicly a.

Metadata har and analysis

* FOCA (Fingerprinting Organizations with Collected Archives) - Automated document har that searches Google, Bing, and DuckDuckGo to find and extrapolate internal company organizational structures.
* metagoofil - Metadata har.
* theHar - E-mail, subdomain and people names har.

Network device discovery tools

* Censys - Collects data on hosts and websites through daily ZMap and ZGrab scans.
* Shodan - World's first search 引擎 for Internet-connected devices.
* ZoomEye - Search 引擎 for cyberspace that lets the user find specific 网络 components.

OSINT Online Resources

* CertGraph - Crawls a domain's SSL/TLS certificates for its certificate alternati.
* GhostProject - Searchable 数据库 of billions of cleartext passwords, partially for free.
* NetBootcamp OSINT Tools - Collection of OSINT links and custom Web interfaces to other services.
* OSINT 框架 - Collection of OSINT tools broken out by category.
* WiGLE.net - Information about wireless networks world-wide, with user-friendly desktop and web applications.
* certgrep - A fast Certificate Transparency Log regex domain lookup 工具

Source code repository searching tools

See also *Web-accessible 源码 代码 ripping tools*.

* - Plugin-based 工具 to scan public control systems for sensiti.
* Yar - Clone git repositories to search through the whole commit history in order of commit time for secrets, tokens, or passwords.

Web application and resource analysis tools

* BlindElephant - Web application fingerprinter.
* EyeWitness - 工具 to take screenshots of websites, provide some ser info, and identify default credentials if possible.
* GraphQL - Represent any GraphQL API as an interacti, letting you explore data models from any Web site with a GraphQL query endpoint.
* - host scanner that performs reverse lookups, can be used with pi, detect catch-all scenarios, aliases and dynamic default pages.
* Wappalyzer - Wappalyzer uncovers the technologies used on websites.
* WhatWaf - Detect and bypass web application firewalls and protection systems.
* WhatWeb - Website fingerprinter.
* wafw00f - Identifies and fingerprints Web Application Firewall (WAF) products.
* webscreenshot - Simple script to take screenshots of websites from a list of sites.

Operating System Distributions

* Android Tamer - Distribution built for Android security professionals that includes tools required for Android security testing.
* ArchStrike - Arch GNU/Linux repository for security professionals and enthusiasts.
* AttifyOS - GNU/Linux distribution focused on tools useful during Internet of Things (IoT) security assessments.
* BlackArch - Arch GNU/Linux-based distribution for penetration testers and security researchers.
* Buscador - GNU/Linux machine that is pre-configured for online in.
* Kali - Rolling Debian-based GNU/Linux distribution designed for penetration testing and digital forensics.
* 网络 Security Toolkit (NST) - Fedora-based GNU/Linux bootable li System designed to provide easy access to best-of-breed open 源码 网络 security applications.
* Parrot - Distribution similar to Kali, with support for multiple hardware architectures.
* NullSec Linux - Debian-based security distribution with 135+ tools including specialized editions for cloud, AI/ML, hardware, automotive, and mobile security testing.
* PentestBox - Open 源码 pre-configured portable penetration testing en for the Windows Operating System.
* The Pentesters 框架 - Distro organized around the Penetration Testing Execution Standard (PTES), pro a curated collection of utilities that omits less frequently used utilities.

Periodicals

* 2600: The Hacker Quarterly - American publication about technology and computer "underground" culture.
* Phrack Magazine - By far the longest running hacker zine.

Physical Access Tools

* AT Commands - Use AT commands over an Android device's USB port to rewrite device firmware, bypass security mechanisms, exfiltrate sensiti, perform screen unlocks, and inject touch events.
* Hak5 - Commercial pentest hardware shop for USB attack platforms and 网络 implants, including the USB Rubber Ducky, Bash Bunny, Key Croc, Packet Squirrel, and LAN Turtle.
* PCILeech - Uses PCIe hardware devices to read and write from the target system memory Memory Access (DMA) over PCIe.
* Poisontap - Siphons cookies, exposes internal (LAN-side) router and installs web backdoor on locked computers.
* Proxmark3 - RFID/NFC cloning, replay, and spoofing toolkit often used for analyzing and attacking proximity cards/readers, wireless keys/keyfobs, and more.
* Thunderclap - Open 源码 I/O security research platform for auditing physical DMA-enabled hardware peripheral ports.

Pri Escalation Tools

* Acti and Pri Escalation (ADAPE) - Umbrella script that automates numerous useful PowerShell modules to disco misconfigurations and attempt pri escalation against Acti.
* GTFOBins - Curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.
* LOLBAS (Living Off The Land Binaries and Scripts) - Documents binaries, scripts, and libraries that can be used for "Living Off The Land" techniques, i.e., binaries that can be used by an attacker to perform actions beyond their original purpose.
* LinEnum - Scripted local Linux enumeration and pri escalation checker useful for auditing a host and during CTF gaming.
* Postenum - Shell script used for enumerating possible pri escalation opportunities on a local GNU/Linux system.
* unix-pri - Shell script to check for simple pri escalation on UNIX systems.
* mcafee-xpass – Decrypts encrypted administrator passwords from McAfee Sitelist.xml files using known XOR + 3DES logic. Useful for Red Team pri escalation and forensic recovery.
* pspy - Unpri Linux process sniffer that monitors commands and cron jobs as they execute scans and inotify.

Password Spraying Tools

* DomainPasswordSpray - 工具 written in PowerShell to perform a password spray attack against users of a domain.
* SprayingToolkit - Scripts to make password spraying attacks against Lync/S4B, Outlook Web Access (OWA) and Office 365 (O365) a lot quicker, less painful and more efficient.

Reverse Engineering

See also awesome-re, *Exploit De Tools*.

Reverse Engineering Books

* Gray Hat Hacking The Ethical Hacker's Handbook by Daniel Regalado et al., 2015
* Hacking the Xbox by Andrew Huang, 2003
* Practical Reverse Engineering by Bruce Dang et al., 2014
* Reverse Engineering for Beginners by Dennis Yurichev
* The IDA Pro Book by Chris Eagle, 2011

Reverse Engineering Tools

* angr - Platform-agnostic binary analysis 框架.
* Capstone - Lightweight multi-platform, multi-architecture disassembly 框架.
* Detect It Easy(DiE) - Program for determining types of files for Windows, Linux and MacOS.
* Evan's Debugger - OllyDbg-like debugger for GNU/Linux.
* Frida - Dynamic instrumentation toolkit for de, re, and security researchers.
* Fridax - Read and intercept/hook functions in Xamarin/Mono JIT and AOT compiled iOS/Android applications.
* Ghidra - Suite of free software reverse engineering tools de by NSA's Research Directorate originally exposed in WikiLeaks's "Vault 7" publication and now maintained as open 源码 software.
* Immunity Debugger - Powerful way to write exploits and analyze malware.
* Interacti (IDA Pro) - Proprietary multi-processor disassembler and debugger for Windows, GNU/Linux, or macOS; also has a free , IDA Free.
* Medusa - Open 源码, cross-platform interacti.
* OllyDbg - x86 debugger for Windows binaries that emphasizes binary 代码 analysis.
* PyREBox - Python scriptable Reverse Engineering sandbox by Cisco-Talos.
* Radare2 - Open 源码, crossplatform reverse engineering 框架.
* UEFITool - UEFI firmware image and editor.
* - Extensible debugger UI toolkit written in Python.
* WDK/WinDbg - Windows Driver Kit and WinDbg.
* binwalk - Fast, easy to use 工具 for analyzing, reverse engineering, and extracting firmware images.
* boxxy - Linkable sandbox explorer.
* dnSpy - 工具 to reverse engineer .NET assemblies.
* plasma - Interacti for x86/ARM/MIPS. Generates indented pseudo-代码 with colored syntax 代码.
* pwndbg - GDB plug-in that eases debugging with GDB, with a focus on features needed by low-le de, hardware hackers, re, and exploit de.
* rVMI - Debugger on steroids; inspect userspace processes, kernel drivers, and preboot en in a single 工具.
* x64dbg - Open 源码 x64/x32 debugger for windows.
* Cutter - Free and open 源码 reverse engineering platform powered by Rizin.
* rizin - Free and open-源码 Reverse Engineering 框架, fork of radare2.
* ImHex - Feature-rich hex editor for reverse engineers and programmers.
* Brida - Burp Suite extension that, working as a bridge between Burp and Frida, lets you use and manipulate applications' own methods while tampering the traffic exchanged between the applications and their back-end services.

Security Education Courses

* ARIZONA CYBER WARFARE RANGE - 24x7 live fire exercises for beginners through real world operations; capability for upward progression into the real world of cyber warfare.
* Cybrary - Free courses in ethical hacking and ad penetration testing. Ad penetration testing courses are based on the book 'Penetration Testing for Highly Secured En'.
* European Union Agency for 网络 and Information Security - ENISA Cyber Security Training material.
* Offensi Training - Training from BackTrack/Kali de.
* Open Security Training - Training material for computer security classes.
* Roppers Academy Training - Free courses on computing and security fundamentals designed to train a beginner to crush their first CTF.
* SANS Security Training - Computer Security Training & Certification.

Shellcoding Guides and Tutorials

* Exploit Writing Tutorials - Tutorials on how to develop exploits.
* Shellcode Examples - Shellcodes 数据库.
* Shellcode Tutorial - Tutorial on how to write shellcode.
* The Shellcoder's Handbook by Chris Anley et al., 2007

Side-channel Tools

* ChipWhisperer - Complete open-源码 toolchain for side-channel power analysis and glitching attacks.
* SGX-Step - Open-源码 框架 to facilitate side-channel attack research on Intel x86 processors in general and Intel SGX (Software Guard Extensions) platforms in particular.
* TRRespass - Many-sided rowhammer 工具 suite able to reverse engineer the contents of DDR3 and DDR4 memory chips protected by Target Row Refresh mitigations.

Social Engineering

See also awesome-social-engineering.

Social Engineering Books

* Ghost in the Wires by Kevin D. Mitnick & William L. Simon, 2011
* No Tech Hacking by Johnny Long & Jack Wiles, 2008
* Social Engineering in IT Security: Tools, Tactics, and Techniques by Sharon Conheady, 2014
* The Art of Deception by Kevin D. Mitnick & William L. Simon, 2002
* The Art of Intrusion by Kevin D. Mitnick & William L. Simon, 2005
* Unmasking the Social Engineer: The Human Element of Security by Christopher Hadnagy, 2014

Social Engineering Online Resources

* Social Engineering 框架 - Information resource for social engineers.

Social Engineering Tools

* Catphish - 工具 for phishing and corporate espionage written in Ruby.
* E - Standalone Machine-in-the-Middle (MitM) reverse proxy attack 框架 for setting up phishing pages capable of defeating most forms of 2FA security schemes.
* FiercePhish - Full-fledged phishing 框架 to manage all phishing engagements.
* GitPhish - GitHub Device 代码 phishing security assessment 工具 with dynamic de generation and automated landing page deployment.
* Gophish - Open-源码 phishing 框架.
* King Phisher - Phishing campaign toolkit used for creating and managing multiple simultaneous phishing attacks with custom email and ser.
* Modlishka - Flexible and powerful reverse proxy with real-time two-factor authentication.
* ReelPhish - Real-time two-factor phishing 工具.
* Social Engineer Toolkit (SET) - Open 源码 pentesting 框架 designed for social engineering featuring a number of custom attack to make believable attacks quickly.
* SocialFish - Social media phishing 框架 that can run on an Android phone or in a Docker container.
* phishery - TLS/SSL enabled Basic Auth credential har.
* wifiphisher - Automated phishing attacks against WiFi networks.

Static Analyzers

* Brakeman - Static analysis security scanner for Ruby on Rails applications.
* FindBugs - Free software static analyzer to look for bugs in Java 代码.
* Progpilot - Static security analysis 工具 for PHP 代码.
* RegEx-DoS - Analyzes 源码 代码 for Regular Expressions susceptible to Denial of Service attacks.
* bandit - Security oriented static analyser for Python 代码.
* cppcheck - Extensible C/C++ static analyzer focused on finding bugs.
* sobelow - Security-focused static analysis for the Phoenix 框架.
* cwe_checker - Suite of tools built atop the Binary Analysis Platform (BAP) to heuristically detect CWEs in compiled binaries and firmware.
* Agentic Radar - Open-源码 CLI security scanner for agentic AI workflows.

Steganography Tools

* Cloakify - Textual steganography toolkit that converts any filetype into lists of e strings.
* StegOnline - Web-based, enhanced, and open-源码 port of StegSolve.
* StegCracker - Steganography brute-force utility to unco data inside files.

Databases

* Bugtraq (BID) - Software security bug identification 数据库 compiled from submissions to the SecurityFocus mailing list and other sources, operated by Symantec, Inc.
* CISA Known 数据库 (KEV) - in systems already known to America's cyber defense agency, the Cybersecurity and Infrastructure Security Agency, to be actively exploited.
* CXSecurity - Archive of published CVE and Bugtraq software cross-referenced with a Google dork 数据库 for disco the listed .
* China National 数据库 (CNNVD) - Chinese go 数据库 analoguous to the United States's C hosted by Mitre Corporation.
* Common and Exposures (CVE) - Dictionary of common names (i.e., C) for publicly known security .
* Exploit-DB - Non-profit project hosting exploits for software , provided as a public service by Offensi.
* Full-Disclosure - Public, forum for detailed discussion of , often publishes details before many other sources.
* GitHub Ad - Public ad published by or affecting codebases hosted by GitHub, including open 源码 projects.
* HPI-VDB - Aggregator of cross-referenced software offering free-of-charge API access, provided by the Hasso-Plattner Institute, Potsdam.
* Inj3ct0r - Exploit marketplace and information aggregator. (Onion service.)
* Microsoft Security Ad and Bulletins - Archive and announcements of security ad impacting Microsoft software, published by the Microsoft Security Response Center (MSRC).
* Mozilla Foundation Security Ad - Archive of security ad impacting Mozilla software, including the Firefox Web Browser.
* National 数据库 (NVD) - United States go's National 数据库 provides additional meta-data (CPE, C) of the standard CVE List along with a fine-grained search 引擎.
* Open 源码 (OSV) - 数据库 of affecting open 源码 software, queryable by project, Git commit, or .
* Packet Storm - Compendium of exploits, ad, tools, and other security-related resources aggregated from across the industry.
* SecuriTeam - Independent 源码 of software information.
* Snyk DB - Detailed information and remediation guidance for known by Snyk.
* US-CERT Notes 数据库 - Summaries, technical details, remediation information, and lists of affected by software , aggregated by the United States Computer Emergency Response Team (US-CERT).
* VulDB - Independent 数据库 with user community, exploit details, and additional meta data (e.g. CPE, CVSS, CWE)
* Lab - Open forum for security ad organized by category of exploit target.
* - Security database of software .
* - search 引擎 with intelligence features that conducts full text searches in its 数据库.
* Zero Day Initiative - Bug bounty program with publicly accessible archive of published security ad, operated by TippingPoint.

Web Exploitation

* FuzzDB - Dictionary of attack patterns and primitives for black-box application fault injection and resource discovery.
* Offensive Web Testing 框架 (OWTF) - Python-based 框架 for pentesting Web applications based on the OWASP Testing Guide.
* Raccoon - High performance offensi 工具 for reconnaissance and scanning.
* WPSploit - Exploit WordPress-powered websites with Metasploit.
* autochrome - Chrome browser profile preconfigured with appropriate settings needed for web application testing.
* authoscope - Scriptable 网络 authentication cracker.
* gobuster - Lean multipurpose brute force search/fuzzing 工具 for Web (and DNS) reconnaissance.
* sslstrip2 - SSLStrip to defeat HSTS.
* sslstrip - Demonstration of the HTTPS stripping attacks.

Intercepting Web proxies

See also *Proxies and Machine-in-the-Middle (MITM) Tools*.

* Burp Suite - Integrated platform for performing security testing of web applications.
* Fiddler - Free cross-platform web debugging proxy with user-friendly companion tools.
* OWASP Zed Attack Proxy (ZAP) - Feature-rich, scriptable HTTP intercepting proxy and fuzzer for penetration testing web applications.
* mitmproxy - Interacti intercepting HTTP proxy for penetration testers and software de.

Web file inclusion tools

* Kadimus - LFI scan and exploit tool.
* LFISuite - Automatic LFI scanner and exploiter.
* fimap - Find, prepare, audit, exploit and e automatically for LFI/RFI bugs.
* liffy - LFI exploitation tool.

Web injection tools

* Commix - Automated all-in-one operating system command injection and exploitation 工具.
* NoSQLmap - Automatic NoSQL injection and 数据库 takeover 工具.
* SQLmap - Automatic SQL injection and 数据库 takeover 工具.
* tplmap - Automatic ser template injection and Web ser 工具.

Web path discovery and bruteforcing tools

* DotDotPwn - Directory tra fuzzer.
* dirsearch - Web path scanner.
* recursebuster - Content discovery 工具 to perform directory and file bruteforcing.

Web shells and C2 frameworks

* Browser Exploitation 框架 (BeEF) - Command and control 服务端 for deli exploits to commandeered Web browsers.
* DAws - Ad Web shell.
* Merlin - Cross-platform post-exploitation HTTP/2 Command and Control 服务端 and agent written in Golang.
* PhpSploit - Full-featured C2 框架 which silently persists on webserver via evil PHP oneliner.
* Reverse Shell as a Service - Easy to remember reverse shell that should work on most Unix-like systems.
* SharPyShell - Tiny and obfuscated ASP.NET webshell for C# web applications.
* weevely3 - Weaponized PHP-based web shell.

Web-accessible 源码 代码 ripping tools

* D - Rip web accessible (distributed) control systems: SVN/GIT/HG/BZR.
* GitTools - Automatically find and download Web-accessible .git repositories.
* git-dumper - 工具 to dump a git repository from a website.
* git-scanner - 工具 for bug hunting or pentesting websites that have open .git repositories a in public.

Web Exploitation Books

* The Browser Hacker's Handbook by Wade Alcorn et al., 2014
* The Web Application Hacker's Handbook by D. Stuttard, M. Pinto, 2011

Windows Utilities

* Bloodhound - Graphical Acti trust relationship explorer.
* Commando VM - Automated installation of over 140 Windows software packages for penetration testing and red teaming.
* Co - ASP.NET Core application that serves as a collaborati and control platform for red teamers.
* ctftool - Interacti Translation 框架 (CTF) exploration 工具 capable of launching cross-session edit session attacks.
* DeathStar - Python script that uses Empire's RESTful API to automate gaining Domain Admin rights in Acti en.
* Empire - Post-exploitation and ad emulation 框架 with PowerShell, Python, and C# agents.
* Fibratus - 工具 for exploration and tracing of the Windows kernel.
* Inveigh - Windows PowerShell ADIDNS/LLMNR/mDNS/NBNS spoofer/machine-in-the-middle 工具.
* LaZagne - Credentials recovery project.
* MailSniper - Modular 工具 for searching through email in a Microsoft Exchange en, gathering the Global Address List from Outlook Web Access (OWA) and Exchange Web Services (EWS), and more.
* PowerSploit - PowerShell Post-Exploitation 框架.
* RID_ENUM - Python script that can enumerate all users from a Windows Domain Controller and crack those user's passwords using brute-force.
* Responder - Link-Local Multicast Name Resolution (LLMNR), NBT-NS, and mDNS poisoner.
* Rubeus - Toolset for raw Kerberos interaction and abuses.
* Ruler - Abuses 客户端-side Outlook features to gain a remote shell on a Microsoft Exchange 服务端.
* SCOMDecrypt - Retrieve and decrypt RunAs credentials stored within Microsoft System Center Operations Manager (SCOM) databases.
* Sysinternals Suite - The Sysinternals Troubleshooting Utilities.
* Windows Credentials Editor - Inspect logon sessions and add, change, list, and delete associated credentials, including Kerberos tickets.
* Windows Exploit Suggester - Detects potential missing patches on the target.
* mimikatz - Credentials extraction 工具 for Windows operating system.
* redsnarf - Post-exploitation 工具 for retrieving password hashes and credentials from Windows workstations, servers, and domain controllers.
* wePWNise - Generates architecture independent VBA 代码 to be used in Office documents or templates and automates bypassing application control and exploit mitigation software.
* WinPwn - Internal penetration test script to perform local and domain reconnaissance, pri escalation and exploitation.

License

![CC-BY]()

This work is licensed under a Creati Attribution 4.0 International License.

项目信息

开发语言：未知

Star 数：27349

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of awesome penetration testing resources and tools展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。