PentestingEverything - Complete Solution for VAPT/AppSec and Pentesting G

项目说明

PentestingE

> Practical penetration testing knowledge base co 23 security domains, with 121 documentation pages, 104 reference PDFs, and 212+ tools. Use the website to quickly explore methodologies, discover the right tools for each testing area, and access documentation and references all organized in one fast, structured, and easy-to-na place.

<di="left">

Li:

</div>

<img width="2048" height="768" alt="pentestingE" src=" />

<details>
<summary><b>Upcoming New Resources</b></summary>

</details>

<details>
<summary><b>Recently Updated Content : 2026</b></summary>

</details>

<details>
<summary><b>Impro and Ad Techniques</b></summary>

</details>

<details>
<summary><strong>Agent Skill</strong></summary>

> Install a portable Agent Skill to use this knowledge base from Cursor, Claude and other agents for Agentic testing, Secure Coding and knowledgebase.

>Who it's for: bug hunters, security testers, and penetration testers running real engagements through an agent, not just browsing static docs. Ground rules keep autonomous use safe: authorization is confirmed before acti, high-impact actions are gated, findings pass a false-positi before being drafted, and automated requests are paced to respect program rate limits.

Install (project-local):

Install globally (a across projects):

Target a specific client (examples):

List without installing:

Skill source: .agents/skills/pentesting-e/.

</details>

<di="right">
<details>
<summary >Language</summary>
<div>
<di="right">
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href=" Việt</a></p>
<p><a href=" Indonesia</a></p>
</div>
</div>
</details>
</div>

---

0.1. Table of Contents

| No. | Types of Pentesting | No. | Types of Pentesting |
| --- | --- | --- | --- |
| 1 | Web Application Pentesting | 13 | MCP Security Assessment |
| 2 | API Pentesting | 14 | LLM Security Assessment |
| 3 | Mobile Pentesting | 15 | Threat Modeling |
| 4 | Thick Client Pentesting | 16 | Configuration Review |
| 5 | Secure Code Review | 17 | Container & Kubernetes Assessment |
| 6 | Cloud Pentesting | 18 | CI/CD Pentesting |
| 7 | De | 19 | IoT Pentesting |
| 8 | Network Pentesting | 20 | BlockChain Pentesting |
| 9 | Wi-Fi Pentesting | 21 | Phishing Assessment |
| 10 | Firewall Penetration | 22 | OSINT |
| 11 | Acti Pentesting | 23 | Forensic |
| 12 | Infrastructure Security | 24 | A2A Security Assessment |

---

Repository Activity

<details>
<summary><strong>Repository Activity</strong> — Latest 20 updates</summary>

> Activity log is automatically updated every 15 days.
<br>

<!--START_SECTION:acti>
| Date & Time (IST) | Activity | Commit |
|:---|:---|:---:|
| 16 Aug 2026 · 11:36 IST | Metasploitable Report Update | 3478b98 |
| 16 Aug 2026 · 11:23 IST | Update Metasploitable Pentest Report formatting | 4f307d1 |
| 16 Aug 2026 · 01:23 IST | docs: update repository activity (#246) | fe6b0b2 |
| 16 Aug 2026 · 01:19 IST | Update README with activity log information | e3dba5b |
| 16 Aug 2026 · 01:15 IST | Update cron schedule for repository activity workflow | 168865f |
| 15 Aug 2026 · 23:35 IST | Update Xamring-DotNet SSL Bypass.md | 0fa47be |
| 15 Aug 2026 · 23:31 IST | Add Xamarin SSL Bypass Setup | c3a2ffb |
| 15 Aug 2026 · 21:24 IST | docs: add Dessalines39394 as a contributor for 代码 (#240) | b37ec50 |
| 15 Aug 2026 · 21:20 IST | Fix broken Star History chart link in README (#239) | d48b431 |
| 08 Aug 2026 · 16:10 IST | Merge pull request #238 from m14r41/m14r41-patch-1 | 91a97a0 |
| 08 Aug 2026 · 15:19 IST | Add MobSF Docker setup instructions | cddc785 |
| 08 Aug 2026 · 14:38 IST | Merge pull request #237 from m14r41/m14r41-patch-1 | 26415b1 |
| 08 Aug 2026 · 14:38 IST | Add SonarQube Docker setup and usage guide | 8b56dcc |
| 25 Jul 2026 · 01:33 IST | Merge pull request #236 from m14r41/m14r41-patch-1 | f0a342d |
| 25 Jul 2026 · 01:32 IST | Agent Skill | 32a4965 |
| 25 Jul 2026 · 01:26 IST | Fix broken CONTRIBUTING.md link: repo default branch is main, not master | 7ca8399 |
| 25 Jul 2026 · 01:16 IST | docs: add Spottie97 as a contributor | 94f517f |
| 25 Jul 2026 · 01:12 IST | Add v2.1.0 changelog entry for the Agent Skill | c6b9e79 |
| 22 Jul 2026 · 22:13 IST | Update README.md with XSS examples and resources | 4e0392f |
| 21 Jul 2026 · 17:34 IST | Add portable Agent Skill for authorized assessments | eca5a36 |
<!--END_SECTION:acti>

</details>

---
<di="left">
<h1> Pentesting & Tools </h1>
<h4> <b> 40 Plus Type of Security Assessment Tools </b> </h4>
</div>

---

1. Penetration Testing and Tools

| Category | Tools |
| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Web Application Pentesting | Acunetix, Burp Suite Professional, Dirb, FFUF, Nmap, Nikto, Nuclei, OWASP ZAP, SQLMap, WhatWeb, WPScan, Invicti (Netsparker), Fortify WebInspect |
| Android Security | adb, APKTool, Apkscan, AndroBugs, Android Studio / Genymotion, AppMon, Dexter/Objection (Objection), Drozer, Frida, Magisk, MITMProxy, MobSF, Quark 引擎, JADX |
| iOS Security | checkra1n, Class-dump, Frida, iMazing, iOS-decrypt, iOS-Hook, MobSF, Needle, Objection, Palera1n, Passionfruit, SSL Kill Switch 2, Cycript |
| API Pentesting | Burp Suite Professional, GraphQL Raider, GraphQL , Insomnia, Kite Runner, Postman, Swagger UI |
| Secure Code Review | Bandit, Checkmarx, CodeQL, FindSecBugs, Gitleaks, Semgrep, SonarQube, Snyk, , Fortify Static (Workbench/Audit) |
| Thick-Client Security | Burp Suite Professional, dnSpy, de4dot, Fiddler, Ghidra, IDA Pro, OllyDbg, Process Explorer, x64dbg, CFF Explorer, Sysinternals Suite, Wireshark |
| Network Pentesting | Bettercap, CrackMapExec, Metasploit, Netcat, Nessus, Nmap, OpenVAS, Responder, Wireshark |

2. Extended

| Category | Tools |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Acti Pentesting | BloodHound, Mimikatz, CrackMapExec, Impacket, Kerbrute, Rubeus, LDAPDomainDump, SharpHound, PowerView, ADRecon |
| Cloud Security | Prowler, ScoutSuite, CloudSploit, Pacu, Steampipe, CloudMapper, NCC Scout, kube-bench, Terrascan, KICS |
| IoT Security | Firmwalker, Binwalk, Firmware-Mod-Kit, Shodan, RIOT, JTAGulator, Qiling, Ghidra, A, Firmadyne |
| Firewall Pentesting | hping3, NPing, Scapy, Zmap, firewalk, FTester, Nmap (Firewall Bypass), Packet Sender, T50, Ettercap, TCPReplay |
| Firmware Analysis | Binwalk, Firmware Analysis Toolkit (FAT), QEMU, Ghidra, IDA Pro, Firmware-Mod-Kit, Radare2, Firmadyne |
| Container Security | Trivy, Aqua Microscanner, Clair, Anchore, Docker Bench, kube-hunter, Falco, Sysdig, Snyk, Grype |
| WiFi Pentesting | Aircrack-ng, Kismet, Bettercap, Reaver, Fluxion, Wireshark, hcxtools, Fern WiFi Cracker, Wifiphisher, Hashcat |
| De | GitHub Ad Security, Trivy, Snyk, Anchore, OWASP Dependency-Check, Jenkins, Checkmarx, , Dagda, Sysdig Secure, Cloud Custodian, Bridgecrew, Kubescape |
| OSINT | theHar, Maltego, SpiderFoot, Recon-ng, Shodan, FOCA, Google Dorks, OSINT Framework, GHunt, Sherlock, PhoneInfoga |
| Configuration Review | Lynis, OpenSCAP, Auditd, Tripwire, cis-cat Pro, Chef InSpec, Prowler, Kubescape |
| Phishing Simulation | GoPhish, SET, E, Phishery, King Phisher, Modlishka, Phishing Frenzy |
| Forensics | Autopsy, , Sleuth Kit, FTK Imager, Redline, Magnet AXIOM, X-Ways, Bulk Extractor, ExifTool |
| Blockchain Security | Mythril, Slither, Manticore, Remix IDE, Oyente, SmartCheck, Echidna, Tenderly |
| Threat Modeling | Microsoft TMT, OWASP Threat Dragon, IriusRisk, SeaSponge, Draw.io, Pytm |
| Red Team Tools | Cobalt Strike, Sliver, Mythic, Empire, Metasploit, Brute Ratel, Koadic, FudgeC2, Nishang, PowerShell Empire |
| Blue Team Tools | , Wazuh, OSQuery, GRR, Sysmon, CrowdStrike Falcon, Elastic Security, Sigma Rules |
| SIEM & Log Analysis | Splunk, ELK Stack, Graylog, Wazuh, AlienVault OSSIM, SIEMonster, Logstash, Fluentd, Loki, Falco, Humio, Kibana, Loggly, Logz.io |
| Password Cracking | Hashcat, John the Ripper, Hydra, CrackStation, Cain & Abel, Medusa, THC-Hydra |
| Reverse Engineering | Ghidra, IDA Pro, x64dbg, OllyDbg, Binary Ninja, Radare2, Cutter |
| Hardware Hacking | ChipWhisperer, Saleae Logic, OpenOCD, JTAGulator, Bus Pirate, Flashrom, Arduino, Raspberry Pi, RTL-SDR |
| Social Engineering | SET, BeEF, King Phisher, E / E, Modlishka, EyeWitness, PhishToolkit, PhishX, Psychological Frameworks (Pretexting, Elicitation) |
| SCADA/ICS Security | Snort, Wireshark, ModScan, ModbusPal, Scadafence, OpenPLC, GasPot, Conpot, PLCScan |
| Supply Chain Security | Snyk, OWASP Dependency-Check, Trivy, Syft, Grype, CycloneDX, Whitesource, Anchore Engine |
| Email Security Testing | GoPhish, Modlishka, SMTPTester, MailSniper, E, Phish5, Email Header Analyzer |
| Mobile Malware Analysis | APKTool, MobSF, Jadx, Frida, Mobile, Droidbox, Bytecode , Drozer, Quark-Engine |
| AI/ML Security | Ad Robustness Toolbox (ART), TextAttack, Foolbox, IBM AI Explainability 360, Cle, Alibi Detect, SecML, DeepExploit |
| Security Automation / SOAR | StackStorm, Cortex XSOAR, Shuffle, DFIR-IR-Playbook, Phantom Cyber, Tines |
| Bug Bounty Toolkit | Amass, Sublist3r, Nuclei, HTTPX, Naabu, FFUF, GF, Dalfox, Kiterunner, Hakrawler, JSParser, ParamSpider |
| Credential Dumping & Cracking | LaZagne, Mimikatz, Hashcat, John the Ripper, Windows Credential Editor, CrackMapExec, GetNPUsers.py |
| Payload Generation | MSFVenom, Unicorn, Shellter, Veil, Nishang, Empire, Obfuscation.io, Metasploit, Donut |
| Honeypots / Deception | Cowrie, Dionaea, Kippo, Honeyd, T-Pot, Conpot, Canarytokens, Artillery |
| MacOS Security | KnockKnock, BlockBlock, OSXCollector, Objecti Suite, MacMonitor, Little Snitch, Dylib Hijack Scanner |
| Windows Post-Exploitation | PowerView, Seatbelt, SharpUp, WinPEAS, Sherlock, Empire, FireEye Red Team Tools, SharpHound |
| Linux Post-Exploitation | LinPEAS, Linux Exploit Suggester, pspy, Chkrootkit, rkhunter, bashark, GTFOBins, Sudomy |
| Browser Security Testing | BeEF, XSStrike, XSSer, Burp Collaborator, NoScript, uBlock Origin, Chrome De Tools |

---

---

2.1. Contributors

> I appreciate your interest in contributing! please read Contribution Guidelines.

> A heartfelt thanks to the amazing indi for their contributions to this project. You can view emoji key to see the ways you can contribute!

<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
<!-- prettier-ignore-start -->
<!-- markdownlint-disable -->
<table>
<tbody>
<tr>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="Marko Žić"/><br />_{<b>Marko Žić</b>}</a><br /><a href="#工具-KurozyOS" title="Tools">🔧</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="m14r41"/><br />_{<b>m14r41</b>}</a><br /><a href=" title="代码">💻</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="0xanon"/><br />_{<b>0xanon</b>}</a><br /><a href=" title="代码">💻</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="InfoBugs"/><br />_{<b>InfoBugs</b>}</a><br /><a href=" title="代码">💻</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="Ratnesh kumar"/><br />_{<b>Ratnesh kumar</b>}</a><br /><a href=" title="代码">💻</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="Chandrabhushan Kumar"/><br />_{<b>Chandrabhushan Kumar</b>}</a><br /><a href=" title="代码">💻</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="Satya Prakash"/><br />_{<b>Satya Prakash</b>}</a><br /><a href=" title="代码">💻</a> <a href=" title="Re Pull Requests">👀</a></td>
</tr>
<tr>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="Wei Lin"/><br />_{<b>Wei Lin</b>}</a><br /><a href="#translation-shps951023" title="Translation">🌍</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="Reinhardt Erasmus"/><br />_{<b>Reinhardt Erasmus</b>}</a><br /><a href=" title="代码">💻</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="Dessalines39394"/><br />_{<b>Dessalines39394</b>}</a><br /><a href=" title="代码">💻</a></td>
<td align="center" ="top" width="14.28%"><a href=" src=" width="100px;" alt="mehdi B"/><br />_{<b>mehdi B</b>}</a><br /><a href=" title="代码">💻</a></td>
</tr>
</tbody>
</table>

---

2.2. Star History

![Star History Chart]()

---

Content and Attribution

This project is open 源码 (MIT) and includes third-party material such as PDFs
and documents that belong to their original owners. It is shared in good faith for
education only. If any of it is yours and you want it credited differently or
removed, just ask and it will be handled promptly. See
CONTENT_REMOVAL.md.

---

<h3 align="left">Support:</h3>
<p><a href=" <img align="left" src=" height="50" width="210" alt="m14r41" /></a></p>

项目信息

开发语言：TypeScript

Star 数：2133

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Complete Solution for VAPT/AppSec and Pentesting Guide: Web | Mobile | API | Thick Client | Source Code Review | De | Wireless | Network Pentesting | SAST | DAST etc...展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。