The purpose of this project is to make a single repository for all the commonly used penetration testing tools, typically tools that don't exist within Kali or other penetration testing distros. In some cases, it makes sense to have the latest version of a tool separate to your distro installed stable binaries or scripts. Installing from GitHub allows you to grab the latest tools specific to your style of pen testing, tools that could be too niche to ever make it into your favorite security distro. Additionally, a seperate self-contained tool set within your home directory or /opt also allows for easy transportation from one (identical) machine to another.
- Fork repo (allows you to make changes to your tools and or push to this repo)
- Git clone repo:
git clone --recursive https://github.com/Aptive/penetration-testing-tools.gitFor some tools further installation will be required, e.g. building binaries / installing configuring tools to suit your requirements, below are links to each distro managers page with installation instructions for each.
The following example uses nmap:
cd penetration-testing-tools/infra/nmap/
git pullcd penetration-testing-tools/
git submodule foreach git pullTo contribute, send a pull request.
Location: /ssl-testing-tools
- testssl - ssl testing
Location: /infra
Intrastructure pen testing tools:
- Metasploit Framework - metasploit framework
- Responder - LLMNR and NBT-NS Poisoning - capture passwords from typo'd smb \server-addresses on the network
- proxychains-ng - pivoting
- Net-creds - Sniffs sensitive data from interface or pcap
- smbexec - A rapid psexec style attack with samba tools
- dnsftp - Use only DNS queries to download a file, and then execute it
- reGeorg - pivoting via socks proxies
- sonar.js - A framework for identifying and launching exploits against internal network hosts
- sonar.js - A framework for identifying and launching exploits against internal network hosts.
- The Backdoor Factory - Patch PE, ELF, Mach-O binaries with shellcode - backdoor binaries so they continue to work normally
- NMAP - NMAP the network mapper
- Port Scan Automation - Automate NMAP scans and custom Nessus polices.
Location: /redteam
- Veil Framework - a red team toolkit focused on evading detection (AV evasion & target delivery)
- Phising Frenzy - Ruby on Rails Phishing Framework
Location: /recon
- EyeWitness - Take screenshots of websites, provide some server header info, and identify default credentials if possible
- Gitrob - Helps security professionals find sensitive information lingering in publicly available files on GitHub
- recon-ng - Recon-ng is a full-featured Web Reconnaissance framework written in Python.
- SpiderFoot - open source footprinting and intelligence-gathering tool.
- SimplyEmail - Email recon made fast and easy
Location: /shells
- cmdsql - Command execution, web.config parsing, and SQL query execution
- BlackArch Webshells - BlackArch web shells
- b374k - Web shell
- Python PTY Shells - python pty shells
- MiniReverse Shell - mini reverse shell
Location: /wordlists
Location: /web-app
- SQLMap - sql injection automation
- WafW00f - identify and fingerprint Web Application Firewall (WAF)
- ICMP Reverse Shell - Simple reverse ICMP shell
- WeBaCoo - Web Backdoor Cookie Script-Kit
- Commix - Commix, automated injection based web vulnerability scanner
- WIG - WebApp Information Gatherer
- CMSmap - CMS vulnerability scanner
- Droop Scan - A CMS vulnerability scanner for Drupal, Wordpress, SilverStripe
- WPScan - WPScan is a black box WordPress vulnerability scanner
- NoSQLMap - Automated Mongo database and NoSQL web application exploitation tool
- HTTPScreenShot - HTTPScreenshot is a tool for grabbing screenshots and HTML of large numbers of websites
SAST - SCR - Static Analysis
Location: /source-code-audit
- grAudit - simple script and signature sets that allows you to find potential security flaws in source code using grep
- Brakeman - A static analysis security vulnerability scanner for Ruby on Rails applications
Location: /bruteforce
- Pator - Patator is a multi-purpose brute-forcer
- Crowbar - Bruteforcer - supports protocols not supported by THC-Hydra
Location: /windows
- Mimikatz - Extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.
- UAC Script - UAC Bypass Vulnerability in Windows Script Host
Location: linux
- Linux Local Enumeration Script - Linux local enumeration script
Location: /powershell
- Badadook - Connection-less Powershell Persistent and Resilient Backdoor
- PowerShellEmpire - Empire is a pure PowerShell post-exploitation agent
- PowerSploit - PowerSploit - A PowerShell Post-Exploitation Framework
- Nishang - PowerShell for penetration testing and offensive security
- BloodHound - BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment
Location: /rootkits
- Azael - Azazel is a userland rootkit based off of the original LD_PRELOAD technique from Jynx rootkit
Location: /scripting
- Babel SF - Babel Scripting Framework - a collection of custom scripts to facilitate useful pentest related functions via scripting languages
Location: /exploit-dev
- PEDA - PEDA - Python Exploit Development Assistance for GDB
- ROPEME - ROPEME - ROP Exploit Made Easy
- Ropper - ROP tool
- Shellconv - Small tool for disassembling shellcode (using objdump)
- PWNTools - CTF framework and exploit development library
Location: /misc
- Gnmap-Parser - Gnmap-Parser takes multiple Nmap scans exported in greppable (.gnmap) format and parses them into various types of plain-text files for easy analysis.
- NullSecurity Tools - pen testing and security tools, exploits, proof of concepts, shellcodes, scripts