pentest-tools - 一组自定义安全工具，用于快速

项目说明

<h1 align="center">pentest-tools</h1>

<h4 align="center">A collection of custom security tools for quick needs.</h4>

<p align="center">
<img src=" alt="bash badge">
<img src=" alt="python badge">
<img src=" alt="php badge">
<img src=" alt="MIT license badge">
<a href=" target="_blank"><img src=" alt="twitter badge"></a>
</p>

<!-- <p align="center">
<img src=" alt="github stars badge">
<img src=" alt="github watchers badge">
<img src=" alt="github forks badge">
</p> -->

---

Important note

‼ A big clean occured in 2022-11 ‼

Some useless/not working scripts have been archived and some others have been moved to their own repository to get more , feel free to check them:

apk-analyzer

cloudflare-origin-ip

csp-analyzer

detectify-cves

extract-endpoints

fa

google-search

graphql-introspection-analyzer

keyhacks.sh

related-domains

---

Install

---

arpa.sh

Converts IP address in arpa format to classical format.

bbhost.sh

Performs host command on a gi list using parallel to make it fast.

codeshare.php

Performs a string search on codeshare.io.

cors.py

Test CORS issue on a given list of hosts.

crlf.py

Test CRLF issue on a given list of hosts.

crtsh.php

Grabs subdomains of a gi from crt.sh.

detect-.sh

Tests if ports 3389 and 5900 are open on a given IP range using netcat.

dnsenum-brute.sh

Performs brute force through wordlist to find subdomains.

dnsenum-bruten.sh

Performs brute force through numeric to find subdomains.

dnsenum-reverse.sh

Apply reverse DNS method on a given IP range to find subdomains.

dnsenum-re.sh

Same thing but IP ranges are read from an input file.

dnsenum-zonetransfer.sh

Tests Zone Transfer of a gi.

dnsreq-alltypes.sh

Performs all types of DNS requests for a given (sub)domain.

extract-domains.py

Extracts domain of a given URL or a list of URLs.

extract_links.php

Extracts links from a given HTML file.

filterurls.py

Classifies and displays URLs by types.

flash-regexp.sh

Performs regexps listed in flash-regexp.txt for Flash apps testing purpose.

gdorks.php

Generates Google dorks for a gi (searches are not performed).

hashall.php

Uses about 40 algorithms to hash a gi.

ip-con.php

Converts a given IP address to different format, see Nicolas Grégoire presentation.

ip-listing.php

Generates a list of IPs addresses from the gi to the given end, range and mask supported.

mass_axfr.sh

Mass test zone transfer on a given list of domains.

mass-smtp-user-enum-bruteforce.sh

Performs SMTP user enumeration on a given list of IP address using smtp-user-enum.

mass-smtp-user-enum-check.sh

Tests if SMTP user enumeration is possible on a given list of IP address using smtp-user-enum.

myutils.sh

Just few common Bash functions.

node-uuid.js

Encode/Decode UUID using base36.

nrpe.sh

Test Nagios Remote Plugin Executor Arbitrary Command Execution on a given host using Metasploit.

openredirect.py

Test Open Redirect issue on a given list of hosts.

pass-permut.php

Creates words permutation with different separators and output the hashes using about 40 algorithms.

pastebin.php

Performs a string search on pastebin.com.

phantom-xss.js

See xss.py.

ping-sweep-nc.sh

Determines what IPs are alive in a gi of IPs addresses using netcat.

ping-sweep-nmap.sh

Determines what IPs are alive in a gi of IPs addresses using nmap.

ping-sweep-ping.sh

Determines what IPs are alive in a gi of IPs addresses using ping.

portscan-nc.sh

Determines the open ports of a given IP address using netcat.

quick-hits.php

Tests a given list of path on a given list of hosts.

quickhits.py

Same but the Python . Tests a given list of path on a given list of hosts.

rce.py

Test RCE issue on a given list of hosts.

resolve.py

Resolves a give list of hosts to check which ones are alive and which ones are dead.

screensite.sh

Takes screenshots of a given url+port using xvfb.

shodan.php

Performs searches on Shodan using their API.

smuggler.py

Test HTTP request smuggling issue on a given list of hosts.

sr.sh

Perform very small tests of a given IP address.

ssh-timing-b4-pass.sh

Tries to guess SSH users using timing attack.

ssrf-generate-ip.php

Generate random IP address:port inside private 网络 range for SSRF scans.

subalt.py

Generates subdomains alterations and permutations.

test-ip-wordlist.sh

Brute force a wordlist on IPs range and ports list.

testhttp.php

Tries to determine if an url (subdomain+port) is a web thing.

testnc.sh

Performs fuzzing on a given IP address+port using netcat.

Utils.php

Just few common PHP functions.

webda.sh

Perform brute force on a given url that use WebDav using Davtest.

xss.py

Test XSS issue on a given list of hosts using phantomjs.

---

Feel free to open an issue if you have any problem with the script.

项目信息

开发语言：Python

Star 数：3336

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of custom security tools for quick needs.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。