Pentesting Libraries

98 Components & Libraries

Sortby

Pentesting Libraries

⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡

Input encrypted text, get the decrypted text back. "What type of encryption?" That's the point. You don't know, you just know it's possibly encrypted. Ciphey will figure it out for you. Ciphey can so…

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

SpiderFoot can be used offensively (e.g. in a red team exercise or penetration test) for reconnaissance of your target or defensively to gather information about what you or your organisation might h…

Web path scanner

An advanced web path brute-forcer Choose one of these installation options: dirsearch allows you to pause the scanning progress with CTRL+C, from here, you can save the progress (and continue later),…

A recursive internet scanner for hackers.

Special features include: Below are some short help sections to get you up and running. Targets can be any of the following: Similar to Amass or Subfinder, BBOT supports API keys for various third-pa…

pocsuite3 is an open-sourced remote vulnerability testing framework developed by the Knownsec 404 Team.

Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only 未经事先双方同意，使用 pocsuite3 攻击目标是非法的。 pocsuite3 仅用于安全测试目的 write dockerfile …

A collection of custom security tools for quick needs.

‼ A big clean occured in 2022-11 ‼ Some useless/not working scripts have been archived and some others have been moved to their own repository to get more visibility, feel free to check them: Test CO…

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management

💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

Used for penetration testing and/or red-teaming etc. I created this tool because i needed a third party tool to generate a bunch of PDF files with various links. Output will be written as: test1.pdf,…

🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.

ReconSpider is most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be us…

pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

Have a look at the following commands to better understand this behaviour: Be advised that it is not reliable to send files via UDP Why unbreakable? Because it will keep coming back to you, even …

📡 A python program to create a fake AP and sniff data.

I'm not responsible for anything you do with this program, so please only use it for good and educational purposes.

Find web directories without bruteforce

If you have Pip installed on your system, you can use it to install the latest Dirhunt stable version: This software must not be used on third-party servers without permission. Dirhunt has been creat…

Fully featured and community-driven hacking environment

Exegol is a community-driven hacking environment, powerful and yet simple enough to be used by anyone in day to day engagements. Exegol is the best solution to deploy powerful hacking environments se…

Uses Empire's (https://github.com/BC-SECURITY/Empire) RESTful API to automate gaining Domain and/or Enterprise Admin rights in Active Directory environments using some of the most common offensive TTPs.

The primary motivation behind the creation of this was to demonstrate how a lot of the commonly exploited Active Directory misconfiguration can be chained together to gain Administrator level privile…

Tool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access.

Possibly missing python packages will be installed during the installation process.

The iOS Security Testing Framework

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

RecoverPy is a powerful tool that leverages your system capabilities to recover lost files. Every block of your partition will be scanned. You can even find a string in binary files. To install all d…

An XSS exploitation command-line interface and payload generator.

toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting (XSS) vulnerabilities. It consists of an https server that works as an interpreter for…

Python based backdoor that uses Gmail to exfiltrate data through attachment. This RAT will help during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends it to an attacker as an e-mail attachment.

Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity …

AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.

AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically. AutoPWN Suite has a very user friendly easy to read output. You can install it using pip. (sudo recommend…

My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty.

Small security related tools created in Python and Bash for CTF players, bug bounty hunters, pentesters and developers.

Automated Penetration Testing Reporting System

The tool has been tested using Python 3.8.10 on Kali Linux 2022.2/3, Ubuntu 20.04.5 LTS, Windows 10/11. Windows Installation Linux Installation Windows Linux This project is supported by:

Open source pre-operation C2 server based on python and powershell

Octopus is an open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S. The main purpose of creating Octopus is for use before any red team op…

Username enumeration and password spraying tool aimed at Microsoft O365.

For educational, authorized and/or research purposes only. WARNING: The Autologon, oAuth2, and RST user enumeration modules work by submitting a single authentication attempt per user. If the modules…

fireELF - Fileless Linux Malware Framework

fireELF is a opensource fileless linux malware framework thats crossplatform and allows users to easily create and manage payloads. By default is comes with 'memfd_create' which is a new way to run l…

Python 3.5+ DNS asynchronous brute force utility

A Python 3.5+ tool that uses asyncio to brute force domain names asynchronously. Alternately you can install the usual way: Get help: Run a brute force with some custom options: Run a brute force, su…