APIDetector APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false positives. It’s particularly useful for security professionals and developers who...
The post apidetector: Efficiently scan for exposed Swagger endpoints across web domains and subdomains appeared first on Penetration Testing Tools.
T3SF – Technical Tabletop Exercises Simulation Framework T3SF is a framework that offers a modular structure for the orchestration of events based on a master scenario events list (MSEL) together with a set of...
The post T3SF: Technical Tabletop Exercises Simulation Framework appeared first on Penetration Testing Tools.
PingRAT PingRAT secretly passes C2 traffic through firewalls using ICMP payloads. Features: Uses ICMP for Command and Control Undetectable by most AV/EDR solutions Written in Go Use Server Client Download Copyright (C) 2023
The post PingRAT: secretly passes C2 traffic through firewalls using ICMP payloads appeared first on Penetration Testing Tools.
ExtractBitlockerKeys A system administration or post-exploitation script to automatically extract the bitlocker recovery keys from a domain. Features Automatically gets the list of all computers from the domain controller’s LDAP. Multithreaded connections to extract...
The post ExtractBitlockerKeys: automatically extract the bitlocker recovery keys from a domain appeared first on Penetration Testing Tools.
Sekiryu This Ghidra Toolkit is a comprehensive suite of tools designed to streamline and automate various tasks associated with running Ghidra in Headless mode. This toolkit provides a wide range of scripts that can...
The post Sekiryu: Comprehensive toolkit for Ghidra headless appeared first on Penetration Testing Tools.
Detection Replay Framework DeRF (Detection Replay Framework) is an “Attacks As A Service” framework, allowing the emulation of offensive techniques and generation of repeatable detection samples from a UI – without the need for...
The post Detection Replay Framework: Unleashing Attack Emulation for Security Validation appeared first on Penetration Testing Tools.
Bob the Smuggler “Bob the Smuggler” is a tool that leverages HTML Smuggling Attack and allows you to create HTML files with embedded 7z/zip archives. The tool would compress your binary (EXE/DLL) into 7z/zip...
The post BobTheSmuggler: Leverages HTML Smuggling Attack appeared first on Penetration Testing Tools.
Honeyscanner – A vulnerability analyzer for Honeypots Honeyscanner is a vulnerability analyzer for honeypots designed to automatically attack a given honeypot, in order to determine if the honeypot is vulnerable to specific types of...
The post Honeyscanner – A vulnerability analyzer for Honeypots appeared first on Penetration Testing Tools.
Reaper Reaper is a proof-of-concept designed to exploit BYOVD (Bring Your Own Vulnerable Driver) driver vulnerability. This malicious technique involves inserting a legitimate, vulnerable driver into a target system, which allows attackers to exploit...
The post Reaper: PoC designed to exploit BYOVD driver vulnerability appeared first on Penetration Testing Tools.
ThievingFox ThievingFox is a collection of post-exploitation tools to gather credentials from various password managers and Windows utilities. Each module leverages a specific method of injecting into the target process and then hooks internal...
The post ThievingFox: gather credentials from various password managers and Windows utilities appeared first on Penetration Testing Tools.
POSTDump Another tool to perform a minidump of the LSASS process using a few technics to avoid detection. POSTDump is the C# / .NET implementation of the ReactOS minidump function (like nanodump), thus avoiding...
The post POSTDump: perform minidump of LSASS process using few technics to avoid detection appeared first on Penetration Testing Tools.
Hardening Meter HardeningMeter is an open-source Python tool carefully designed to comprehensively assess the security hardening of binaries and systems. Its robust capabilities include thorough checks of various binary exploitation protection mechanisms, including Stack...
The post HardeningMeter: The Python Tool for Thorough Security Hardening Evaluation appeared first on Penetration Testing Tools.
PipeViewer A GUI tool for viewing Windows Named Pipes and searching for insecure permissions. PipeViewer is a GUI tool that allows users to view details about Windows-named pipes and their permissions. It is designed...
The post PipeViewer: shows detailed information about named pipes in Windows appeared first on Penetration Testing Tools.
RedCloud OS RedCloud OS is a Debian-based Cloud Adversary Simulation Operating System for Red Teams to assess the security of leading Cloud Service Providers (CSPs). It includes tools optimized for adversary simulation tasks within Amazon Web...
The post RedCloud-OS: a Cloud Adversary Simulation Operating System for Red Teams appeared first on Penetration Testing Tools.
apk2url apk2url easily extracts URL and IP endpoints from an APK file to a .txt output. This is suitable for information gathering by the red team, penetration testers, and developers to quickly identify endpoints...
The post apk2url: quickly extract IP and URL endpoints from APKs appeared first on Penetration Testing Tools.
CAZT (Cloud AuthoriZation Trainer) CAZT (Cloud AuthoriZation Trainer) is a simulator of cloud-provider responsible REST APIs. It includes a lab manual for getting hands-on practice with how to attack authorization vulnerabilities in a cloud...
The post Cloud AuthoriZation Trainer: A simulator of cloud-provider responsible REST APIs appeared first on Penetration Testing Tools.
Patching – Interactive Binary Patching for IDA Pro Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research....
The post patching: Interactive Binary Patching Plugin for IDA Pro appeared first on Penetration Testing Tools.
PEnetration TEsting Proxy PETEP (PEnetration TEsting Proxy) is an open-source Java application for creating proxies for traffic analysis & modification. The main goal of PETEP is to provide a useful tool for performing penetration tests...
The post PEnetration TEsting Proxy: open-source Java application for traffic analysis & modification appeared first on Penetration Testing Tools.
C2 Tracker Free to use IOC feed for various tools/malware. It started for just C2 tools but has morphed into tracking infostealers and botnets as well. It uses Shodan searches to collect the IPs....
The post C2 Tracker: Live Feed of C2 servers, tools, and botnets appeared first on Penetration Testing Tools.
MELEE: A Tool to Detect Ransomware Infections in MySQL Instances Attackers are abusing MySQL instances for conducting nefarious operations on the Internet. The cybercriminals are targeting exposed MySQL instances and triggering infections at scale...
The post melee: Detect Infections in MySQL Instances appeared first on Penetration Testing Tools.
