awesome-hacking - A curated list of awesome Hacking tutorials, tools

项目说明

Awesome Hacking -An Amazing Project ![Awesome]()

A curated list of awesome Hacking. Inspired by awesome-machine-learning

If you want to contribute to this list (please do), send me a pull request!

For a list of free hacking books a for download, go here

Table of Contents

<!-- MarkdownTOC depth=4 -->

System

- Tutorials
- Tools
- Docker
- General

Reverse Engineering

- Tutorials
- Tools
- General

Web

- Tools
- General

Network

- Tools

Forensic

- Tools

Cryptography

- Tools

Wargame

- System
- Reverse Engineering
- Web
- Cryptography
- Bug bounty

CTF

- Competition
- General

OS

- Online resources

Post exploitation

- tools

ETC

<!-- /MarkdownTOC -->

System

Tutorials

* Roppers Computing Fundamentals
* Free, self-paced curriculum that builds a base of knowledge in computers and networking. Intended to build up a student with no prior technical knowledge to be confident in their ability to learn anything and continue their security education. Full text a as a gitbook.
* Corelan Team's Exploit writing tutorial
* Exploit Writing Tutorials for Pentesters
* Understanding the basics of Linux Binary Exploitation
* Shells
* Missing Semester

Tools

* Metasploit A computer security project that provides information about security and aids in penetration testing and IDS signature de.
* mimikatz - A little 工具 to play with Windows security
* Hackers tools - Tutorial on tools.

Docker Images for Penetration Testing & Security

* docker pull kalilinux/kali-linux-docker official Kali Linux
* docker pull owasp/zap2docker-stable - official OWASP ZAP
* docker pull wpscanteam/wpscan - official WPScan
* docker pull metasploitframework/metasploit-framework
- Official Metasploit
* docker pull citizenstig/dvwa - Damn Web Application (DVWA)
* docker pull wpscanteam/ - WordPress Installation
* docker pull hmlio/ - as a service: Shellshock
* docker pull hmlio/ - as a service: Heartbleed
* docker pull opendns/security-ninjas - Security Ninjas
* docker pull noncetonic/archlinux-pentest-lxde - Arch Linux Penetration Tester
* docker pull diogomonica/docker-bench-security - Docker Bench for Security
* docker pull ismisepaul/securityshepherd - OWASP Security Shepherd
* docker pull danmx/docker-owasp-webgoat - OWASP WebGoat Project docker image
* docker pull /web-owasp-nodegoat - OWASP NodeGoat
* docker pull citizenstig/nowasp - OWASP Mutillidae II Web Pen-Test Practice Application
* docker pull bkimminich/juice-shop - OWASP Juice Shop
* docker pull phocean/msf - Docker Metasploit

General

* Exploit 数据库 - An ultimate archive of exploits and software

Reverse Engineering

Tutorials

* Begin RE: A Reverse Engineering Tutorial Workshop
* Malware Analysis Tutorials: a Reverse Engineering Approach
* Malware Unicorn Reverse Engineering Tutorial
* Lena151: Re With Lena

Tools

Disassemblers and debuggers

* IDA - IDA is a Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger
* OllyDbg - A 32-bit assembler le debugger for Windows
* x64dbg - An open-源码 x64/x32 debugger for Windows
* radare2 - A portable re framework
* plasma - Interacti for x86/ARM/MIPS. Generates indented pseudo-代码 with colored syntax 代码.
* ScratchABit - Easily retargetable and hackable interacti with IDAPython-compatible plugin API
* Capstone
* Ghidra - A software reverse engineering (SRE) suite of tools de by NSA's Research Directorate in support of the Cybersecurity mission

Decompilers

* J languages
* Krakatau - the best decompiler I have used. Is able to decompile apps written in Scala and Kotlin into Java 代码. JD-界面 and Luyten ha to do it fully.
* JD-GUI
* procyon
* Luyten - one of the best, though a bit slow, hangs on some binaries and not very well maintained.
* JAD - JAD Ja (closed-源码, unmaintained)
* JADX - a decompiler for Android apps. Not related to JAD.

* .net-based languages
* dotPeek - a free-of-charge .NET decompiler from JetBrains
* ILSpy - an open-源码 .NET assembly browser and decompiler
* dnSpy - .NET assembly editor, decompiler, and debugger

* native code
* Hopper - A OS X and Linux Disassembler/Decompiler for 32/64-bit Windows/Mac/Linux/iOS executables.
* cutter - a decompiler based on radare2.
* retdec
* snowman
* Hex-Rays

* Python
* uncompyle6 - decompiler for the over 20 releases and 20 years of CPython.

Deobfuscators

* de4dot - .NET deobfuscator and unpacker.
* JS Beautifier
* JS Nice - a web service guessing JS names and types based on the model derived from open 源码.

Other

* nudge4j - Java 工具 to let the browser talk to the JVM
* dex2jar - Tools to work with Android .dex and Ja files
* androguard - Reverse engineering, malware and goodware analysis of Android applications
* antinet - .NET anti-managed debugger and anti-profiler 代码
* UPX - the Ultimate Packer (and unpacker) for eXecutables

Execution logging and tracing

* Wireshark - A free and open-源码 packet analyzer
* tcpdump - A powerful command-line packet analyzer; and libpcap, a portable C/C++ library for 网络 traffic capture
* mitmproxy - An interacti man-in-the-middle proxy for HTTP with a console interface
* Charles Proxy - A cross-platform 界面 web debugging proxy to view intercepted HTTP and HTTPS/SSL li
* usbmon - USB capture for Linux.
* USBPcap - USB capture for Windows.
* dynStruct - structures recovery instrumentation.
* drltrace - shared library calls tracing.

Binary files examination and editing

#### Hex editors
* HxD - A hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size
* WinHex - A hexadecimal editor, helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security
* wxHexEditor
* Synalize It/Hexinator -

#### Other
* Binwalk - Detects signatures, unpacks archives, entropy.
* Veles - a for statistical properties of blobs.
* Kaitai Struct - a DSL for creating parsers in a of programming languages. The Web IDE is particularly useful for re.
* Protobuf inspector
* DarunGrim - executable differ.
* DBeaver - a DB editor.
* Dependencies - a FOSS replacement to Dependency Walker.
* PEview - A quick and easy way to view the structure and content of 32-bit Portable Executable (PE) and Component Object File Format (COFF) files
* BinText - A small, very fast and powerful text extractor that will be of particular interest to programmers.

General

* Open Malware

Web

Tools

* Spyse - Data gathering service that collects web info using OSINT. Provided info: IPv4 hosts, domains/whois, ports/banners/protocols, technologies, OS, AS, maintains huge SSL/TLS DB, and more... All the data is stored in its own 数据库 allowing get the data without scanning.
* sqlmap - Automatic SQL injection and 数据库 takeover 工具
* NoSQLMap - Automated NoSQL 数据库 enumeration and web application exploitation 工具.
* tools.web-max.ca - base64 base85 md4,5 hash, sha1 hash encoding/decoding
* - A host scanner that performs reverse lookups, can be used with pi, detect catch-all scenarios, aliases and dynamic default pages.
* SubFinder - SubFinder is a subdomain discovery 工具 that discovers valid subdomains for any target using passi sources.
* Findsubdomains - A subdomains discovery 工具 that collects all possible subdomains from open 源码 internet and them through tools to provide accurate results.
* badtouch - Scriptable 网络 authentication cracker
* PhpSploit - Full-featured C2 框架 which silently persists on webserver via evil PHP oneliner
* Git-Scanner - A 工具 for bug hunting or pentesting for targeting websites that have open .git repositories a in public
* CSP Scanner - Analyze a site's Content-Security-Policy (CSP) to find bypasses and missing directives.
* Shodan - A web-crawling search 引擎 that lets users search for types of servers connected to the internet.
* masscan - Internet scale portscanner.
* Keyscope - an extensible key and secret 工具 for auditing acti against multiple SaaS
* Decompiler.com - Ja, Python, C# online decompiler.

General

* Strong node.js - An exhausti to assist in the 源码 代码 security analysis of a node.js web service.

Network

Tools

* NetworkMiner - A 网络 Forensic Analysis 工具 (NFAT)
* Paros - A Ja HTTP/HTTPS proxy for assessing web application
* pig - A Linux packet crafting tool
* findsubdomains - really fast subdomains scanning service that has much greater opportunities than simple subs finder(works using OSINT).
* cirt-fuzzer - A simple TCP/UDP 协议 fuzzer.
* ASlookup - a useful 工具 for exploring autonomous systems and all related info (CIDR, ASN, Org...)
* ZAP - The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing 工具 for finding in web applications
* mitmsocks4j - Man-in-the-middle SOCKS Proxy for Java
* ssh-mitm - An SSH/SFTP man-in-the-middle 工具 that logs interacti and passwords.
* nmap - Nmap (网络 Mapper) is a security scanner
* Aircrack-ng - An 802.11 WEP and WPA-PSK keys cracking program
* Nipe - A script to make Tor 网络 your default gateway.
* Habu - Python Network Hacking Toolkit
* Wifi Jammer - Free program to jam all wifi clients in range
* Firesheep - Free program for HTTP session hijacking attacks.
* Scapy - A Python 工具 and library for low le creation and manipulation
* Amass - In-depth subdomain enumeration 工具 that performs scraping, recursi forcing, crawling of web archives, name altering and reverse DNS sweeping
* sniffglue - Secure multithreaded packet sniffer
* Netz - Disco misconfigurations, using zgrab2 and others.
* RustScan - Extremely fast port scanner built with Rust, designed to scan all ports in a couple of seconds and utilizes nmap to perform port enumeration in a fraction of the time.
* PETEP - Extensible TCP/UDP proxy with 界面 for traffic analysis & modification with SSL/TLS support.

Forensic

Tools

* Autopsy - A digital forensics platform and graphical interface to The Sleuth Kit and other digital forensics tools
* sleuthkit - A library and collection of command-line digital forensics tools
* EnCase - The shared technology within a suite of digital in products by Guidance Software
* malzilla - Malware hunting tool
* IPED - Indexador e Processador de Evidências Digitais - Brazilian Federal Police 工具 for Forensic In
* CyLR - NTFS forensic image collector
* CAINE- CAINE is a Ubuntu-based app that offers a complete forensic en that provides a graphical interface. This 工具 can be integrated into existing software tools as a module. It automatically extracts a timeline from RAM.

Cryptography

Tools

* xortool - A 工具 to analyze multi-byte XOR cipher
* John the Ripper - A fast password cracker
* Aircrack - Aircrack is 802.11 WEP and WPA-PSK keys cracking program.
* Ciphey - Automated decryption 工具 using artificial intelligence & natural language processing.

Wargame

System

* O - Semtex
* O -
* O - Drifter
* pwnable.kr - Provide pwn challenges regarding system security
* Exploit Exercises - Nebula
* SmashTheStack
* HackingLab

Reverse Engineering

* Re.kr - This site tests your ability to Cracking & Reverse 代码 Engineering
* CodeEngn - (Korean)
* simples.kr - (Korean)
* Crackmes.de - The world first and largest community website for crackmes and re.

Web

* Hack This Site! - a free, safe and legal training ground for hackers to test and expand their hacking skills
* Hack The Box - a free site to perform pentesting in a of different systems.
* Webhacking.kr
* 0xf.at - a website without logins or ads where you can sol (so called hackits).
* fuzzy.land - Website by an Austrian group. Lots of challenges taken from CTFs they participated in.
* Gruyere
* Others
* TryHackMe - Hands-on cyber security training through real-world scenarios.

Cryptography

* O - Krypton

Bug bounty

* Awesome bug bounty resources by EdO

Bug bounty - Earn Some Money

* Bugcrowd
* Hackerone
* Intigriti Europe's #1 ethical hacking and bug bounty program.

CTF

Competition

* DEF CON
* CSAW CTF
* hack.lu CTF
* Pliad CTF
* RuCTFe
* Ghost in the Shellcode
* PHD CTF
* SECUINSIDE CTF
* Codegate CTF
* Boston Key Party CTF
* ZeroDays CTF
* Insomni’hack
* Pico CTF
* prompt(1) to win - XSS Challenges
* HackTheBox

General

* Hack+ - An Intelligent 网络 of bots that fetch the latest InfoSec content.
* CTFtime.org - All about CTF (Capture The Flag)
* WeChall
* CTF archives (shell-storm)
* Rookit Arsenal - OS RE and rootkit de
* Pentest Cheat Sheets - Collection of cheat sheets useful for pentesting
* Movies For Hackers - A curated list of movies every hacker & cyberpunk must watch.
* Roppers CTF Fundamentals Course - Free course designed to get a student crushing CTFs as quickly as possible. Teaches the mentality and skills required for crypto, forensics, and more. Full text a as a gitbook.

OS

Online resources

* Security related Operating Systems @ Rawsec - Complete list of security related operating systems
* Best Linux Penetration Testing Distributions @ CyberPunk - Description of main penetration testing distributions
* Security @ Distrowatch - Website dedicated to talking about, re and keeping up to date with open 源码 operating systems

Post exploitation

tools

* empire - A post exploitation 框架 for powershell and python.
* silenttrinity - A post exploitation 工具 that uses iron python to get past powershell restrictions.
* PowerSploit - A PowerShell post exploitation 框架
* ebowla - 框架 for Making En Keyed Payloads

ETC

* SecTools - Top 125 网络 Security Tools
* Roppers Security Fundamentals - Free course that teaches a beginner how security works in the real world. Learn security theory and execute defensi so that you are better prepared against threats online and in the physical world. Full text a as a gitbook.
* Roppers Practical Networking - A hands-on, wildly practical introduction to networking and making packets dance. No wasted time, no memorizing, just learning the fundamentals.
* Rawsec's CyberSecurity In - An open-源码 in of tools, resources, CTF platforms and Operating Systems about CyberSecurity. (源码)
* The Cyberclopaedia - The open-源码 encyclopedia of cybersecurity. GitHub Repository

项目信息

开发语言：未知

Star 数：17200

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of awesome Hacking tutorials, tools and resources展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。