\ud83d\udd38 Sandcat Browser<\/strong><\/a> – a penetration-oriented browser with plenty of advanced functionality already built in. \ud83d\udd38 PTES<\/strong><\/a> – the penetration testing execution standard. \ud83d\udd38 PHP-backdoors<\/strong><\/a> – a collection of PHP backdoors. For educational or testing purposes only.<\/p>\n\n\n\n \ud83d\udd38 Weakpass<\/strong><\/a> – for any kind of bruteforce find wordlists or unleash the power of them all at once! \ud83d\udd38 YesWeHack<\/strong><\/a> – bug bounty platform with infosec jobs.
\ud83d\udd38 Metasploit<\/strong><\/a> – tool and framework for pentesting system, web and many more, contains a lot a ready to use exploit.
\ud83d\udd38 Burp Suite<\/strong><\/a> – tool for testing web app security, intercepting proxy to replay, inject, scan and fuzz.
\ud83d\udd38 OWASP Zed Attack Proxy<\/strong><\/a> – intercepting proxy to replay, inject, scan and fuzz HTTP requests.
\ud83d\udd38 w3af<\/strong><\/a> – is a Web Application Attack and Audit Framework.
\ud83d\udd38 mitmproxy<\/strong><\/a> – an interactive TLS-capable intercepting HTTP proxy for penetration testers.
\ud83d\udd38 Nikto2<\/strong><\/a> – web server scanner which performs comprehensive tests against web servers for multiple items.
\ud83d\udd38 sqlmap<\/strong><\/a> – tool that automates the process of detecting and exploiting SQL injection flaws.
\ud83d\udd38 Recon-ng<\/strong><\/a> – is a full-featured Web Reconnaissance framework written in Python.
\ud83d\udd38 AutoRecon<\/strong><\/a> – is a network reconnaissance tool which performs automated enumeration of services.
\ud83d\udd38 Faraday<\/strong><\/a> – an Integrated Multiuser Pentest Environment.
\ud83d\udd38 Photon<\/strong><\/a> – incredibly fast crawler designed for OSINT.
\ud83d\udd38 XSStrike<\/strong><\/a> – most advanced XSS detection suite.
\ud83d\udd38 Sn1per<\/strong><\/a> – automated pentest framework for offensive security experts.
\ud83d\udd38 vuls<\/strong><\/a> – is an agent-less vulnerability scanner for Linux, FreeBSD, and other.
\ud83d\udd38 tsunami<\/strong><\/a> – is a general purpose network security scanner with an extensible plugin system.
\ud83d\udd38 aquatone<\/strong><\/a> – a tool for domain flyovers.
\ud83d\udd38 BillCipher<\/strong><\/a> – information gathering tool for a website or IP address.
\ud83d\udd38 WhatWaf<\/strong><\/a> – detect and bypass web application firewalls and protection systems.
\ud83d\udd38 Corsy<\/strong><\/a> – CORS misconfiguration scanner.
\ud83d\udd38 Raccoon<\/strong><\/a> – is a high performance offensive security tool for reconnaissance and vulnerability scanning.
\ud83d\udd38 dirhunt<\/strong><\/a> – find web directories without bruteforce.
\ud83d\udd38 John The Ripper<\/strong><\/a> – is a fast password cracker, currently available for many flavors of Unix, Windows, and other.
\ud83d\udd38 hashcat<\/strong><\/a> – world’s fastest and most advanced password recovery utility.
\ud83d\udd38 p0f<\/strong><\/a> – is a tool to identify the players behind any incidental TCP\/IP communications.
\ud83d\udd38 ssh_scan<\/strong><\/a> – a prototype SSH configuration and policy scanner.
\ud83d\udd38 LeakLooker<\/strong><\/a> – find open databases – powered by Binaryedge.io
\ud83d\udd38 exploitdb<\/strong><\/a> – searchable archive from The Exploit Database.
\ud83d\udd38 getsploit<\/strong><\/a> – is a command line utility for searching and downloading exploits.
\ud83d\udd38 ctf-tools<\/strong><\/a> – some setup scripts for security research tools.
\ud83d\udd38 pwntools<\/strong><\/a> – CTF framework and exploit development library.
\ud83d\udd38 security-tools<\/strong><\/a> – collection of small security tools created mostly in Python. CTFs, pentests and so on.
\ud83d\udd38 pentestpackage<\/strong><\/a> – is a package of Pentest scripts.
\ud83d\udd38 python-pentest-tools<\/strong><\/a> – python tools for penetration testers.
\ud83d\udd38 fuzzdb<\/strong><\/a> – dictionary of attack patterns and primitives for black-box application fault injection.
\ud83d\udd38 AFL<\/strong><\/a> – is a free software fuzzer maintained by Google.
\ud83d\udd38 AFL++<\/strong><\/a> – is AFL with community patches.
\ud83d\udd38 syzkaller<\/strong><\/a> – is an unsupervised, coverage-guided kernel fuzzer.
\ud83d\udd38 pwndbg<\/strong><\/a> – exploit development and reverse engineering with GDB made easy.
\ud83d\udd38 GDB PEDA<\/strong><\/a> – Python Exploit Development Assistance for GDB.
\ud83d\udd38 IDA<\/strong><\/a> – multi-processor disassembler and debugger useful for reverse engineering malware.
\ud83d\udd38 radare2<\/strong><\/a> – framework for reverse-engineering and analyzing binaries.
\ud83d\udd38 routersploit<\/strong><\/a> – exploitation framework for embedded devices.
\ud83d\udd38 Ghidra<\/strong><\/a> – is a software reverse engineering (SRE) framework.
\ud83d\udd38 Vulnreport<\/strong><\/a> – open-source pentesting management and automation platform by Salesforce Product Security.
\ud83d\udd38 Mentalist<\/strong><\/a> – is a graphical tool for custom wordlist generation.
\ud83d\udd38 archerysec<\/strong><\/a> – vulnerability assessment and management helps to perform scans and manage vulnerabilities.
\ud83d\udd38 Osmedeus<\/strong><\/a> – fully automated offensive security tool for reconnaissance and vulnerability scanning.
\ud83d\udd38 beef<\/strong><\/a> – the browser exploitation framework project.
\ud83d\udd38 AutoSploit<\/strong><\/a> – automated mass exploiter.
\ud83d\udd38 SUDO_KILLER<\/strong><\/a> – is a tool to identify and exploit sudo rules’ misconfigurations and vulnerabilities.
\ud83d\udd38 yara<\/strong><\/a> – the pattern matching swiss knife.
\ud83d\udd38 mimikatz<\/strong><\/a> – a little tool to play with Windows security.
\ud83d\udd38 sherlock<\/strong><\/a> – hunt down social media accounts by username across social networks.
\ud83d\udd38 OWASP Threat Dragon<\/strong><\/a> – is a tool used to create threat model diagrams and to record possible threats.<\/p>\n\n\n\n<\/a>\u25aa\ufe0f Pentests bookmarks collection<\/h5>\n\n\n\n
\ud83d\udd38 Pentests MindMap<\/strong><\/a> – amazing mind map with vulnerable apps and systems.
\ud83d\udd38 WebApps Security Tests MindMap<\/strong><\/a> – incredible mind map for WebApps security tests.
\ud83d\udd38 Brute XSS<\/strong><\/a> – master the art of Cross Site Scripting.
\ud83d\udd38 XSS cheat sheet<\/strong><\/a> – contains many vectors that can help you bypass WAFs and filters.
\ud83d\udd38 Offensive Security Bookmarks<\/strong><\/a> – security bookmarks collection, all things that author need to pass OSCP.
\ud83d\udd38 Awesome Pentest Cheat Sheets<\/strong><\/a> – collection of the cheat sheets useful for pentesting.
\ud83d\udd38 Awesome Hacking by HackWithGithub<\/strong><\/a> – awesome lists for hackers, pentesters and security researchers.
\ud83d\udd38 Awesome Hacking by carpedm20<\/strong><\/a> – a curated list of awesome hacking tutorials, tools and resources.
\ud83d\udd38 Awesome Hacking Resources<\/strong><\/a> – collection of hacking\/penetration testing resources to make you better.
\ud83d\udd38 Awesome Pentest<\/strong><\/a> – collection of awesome penetration testing resources, tools and other shiny things.
\ud83d\udd38 Awesome-Hacking-Tools<\/strong><\/a> – is a curated list of awesome Hacking Tools.
\ud83d\udd38 Hacking Cheat Sheet<\/strong><\/a> – author hacking and pentesting notes.
\ud83d\udd38 blackhat-arsenal-tools<\/strong><\/a> – official Black Hat arsenal security tools repository.
\ud83d\udd38 Penetration Testing and WebApp Cheat Sheets<\/strong><\/a> – the complete list of Infosec related cheat sheets.
\ud83d\udd38 Cyber Security Resources<\/strong><\/a> – includes thousands of cybersecurity-related references and resources.
\ud83d\udd38 Pentest Bookmarks<\/strong><\/a> – there are a LOT of pentesting blogs.
\ud83d\udd38 Cheatsheet-God<\/strong><\/a> – Penetration Testing Reference Bank – OSCP\/PTP & PTX Cheatsheet.
\ud83d\udd38 ThreatHunter-Playbook<\/strong><\/a> – to aid the development of techniques and hypothesis for hunting campaigns.
\ud83d\udd38 Beginner-Network-Pentesting<\/strong><\/a> – notes for beginner network pentesting course.
\ud83d\udd38 OSCPRepo<\/strong><\/a> – is a list of resources that author have been gathering in preparation for the OSCP.
\ud83d\udd38 PayloadsAllTheThings<\/strong><\/a> – a list of useful payloads and bypass for Web Application Security and Pentest\/CTF.
\ud83d\udd38 payloads<\/strong><\/a> – git all the Payloads! A collection of web attack payloads.
\ud83d\udd38 command-injection-payload-list<\/strong><\/a> – command injection payload list.
\ud83d\udd38 Awesome Shodan Search Queries<\/strong><\/a> – great search queries to plug into Shodan.
\ud83d\udd38 AwesomeXSS<\/strong><\/a> – is a collection of Awesome XSS resources.
\ud83d\udd38 php-webshells<\/strong><\/a> – common php webshells.
\ud83d\udd38 Pentesting Tools Cheat Sheet<\/strong><\/a> – a quick reference high level overview for typical penetration testing.
\ud83d\udd38 OWASP Cheat Sheet Series<\/strong><\/a> – is a collection of high value information on specific application security topics.
\ud83d\udd38 OWASP dependency-check<\/strong><\/a> – is an open source solution the OWASP Top 10 2013 entry.
\ud83d\udd38 OWASP ProActive Controls<\/strong><\/a> – OWASP Top 10 Proactive Controls 2018.
\ud83d\udd38 PENTESTING-BIBLE<\/strong><\/a> – hacking & penetration testing & red team & cyber security resources.
\ud83d\udd38 pentest-wiki<\/strong><\/a> – is a free online security knowledge library for pentesters\/researchers.
\ud83d\udd38 DEF CON Media Server<\/strong><\/a> – great stuff from DEFCON.
\ud83d\udd38 Awesome Malware Analysis<\/strong><\/a> – a curated list of awesome malware analysis tools and resources.
\ud83d\udd38 SQL Injection Cheat Sheet<\/strong><\/a> – detailed technical stuff about the many different variants of the SQL Injection.
\ud83d\udd38 Entersoft Knowledge Base<\/strong><\/a> – great and detailed reference about vulnerabilities.
\ud83d\udd38 HTML5 Security Cheatsheet<\/strong><\/a> – a collection of HTML5 related XSS attack vectors.
\ud83d\udd38 XSS String Encoder<\/strong><\/a> – for generating XSS code to check your input validation filters against XSS.
\ud83d\udd38 GTFOBins<\/strong><\/a> – list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.
\ud83d\udd38 Guifre Ruiz Notes<\/strong><\/a> – collection of security, system, network and pentest cheatsheets.
\ud83d\udd38 SSRF Tips<\/strong><\/a> – a collection of SSRF Tips.
\ud83d\udd38 shell-storm repo CTF<\/strong><\/a> – great archive of CTFs.
\ud83d\udd38 ctf<\/strong><\/a> – CTF (Capture The Flag) writeups, code snippets, notes, scripts.
\ud83d\udd38 My-CTF-Web-Challenges<\/strong><\/a> – collection of CTF Web challenges.
\ud83d\udd38 MSTG<\/strong><\/a> – The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing.
\ud83d\udd38 Internal-Pentest-Playbook<\/strong><\/a> – notes on the most common things for an Internal Network Penetration Test.
\ud83d\udd38 KeyHacks<\/strong><\/a> – shows quick ways in which API keys leaked by a bug bounty program can be checked.
\ud83d\udd38 securitum\/research<\/strong><\/a> – various Proof of Concepts of security research performed by Securitum.
\ud83d\udd38 public-pentesting-reports<\/strong><\/a> – is a list of public pentest reports released by several consulting security groups.
\ud83d\udd38 awesome-bug-bounty<\/strong><\/a> – is a comprehensive curated list of available Bug Bounty.
\ud83d\udd38 bug-bounty-reference<\/strong><\/a> – is a list of bug bounty write-ups.
\ud83d\udd38 Awesome-Bugbounty-Writeups<\/strong><\/a> – is a curated list of bugbounty writeups.
\ud83d\udd38 Bug bounty writeups<\/strong><\/a> – list of bug bounty writeups (2012-2020).
\ud83d\udd38 hackso.me<\/strong><\/a> – a great journey into security.<\/p>\n\n\n\n<\/a>\u25aa\ufe0f Backdoors\/exploits<\/h5>\n\n\n\n
<\/a>\u25aa\ufe0f Wordlists and Weak passwords<\/h5>\n\n\n\n
\ud83d\udd38 Hashes.org<\/strong><\/a> – is a free online hash resolving service incorporating many unparalleled techniques.
\ud83d\udd38 SecLists<\/strong><\/a> – collection of multiple types of lists used during security assessments, collected in one place.
\ud83d\udd38 Probable-Wordlists<\/strong><\/a> – sorted by probability originally created for password generation and testing.
\ud83d\udd38 skullsecurity passwords<\/strong><\/a> – password dictionaries and leaked passwords repository.
\ud83d\udd38 Polish PREMIUM Dictionary<\/strong><\/a> – official dictionary created by the team on the forum bezpieka.org.*<\/strong> 1<\/a><\/sup>
\ud83d\udd38 <\/a>statistically-likely-usernames<\/strong><\/a> – wordlists for creating statistically likely username lists.<\/p>\n\n\n\n<\/a>\u25aa\ufe0f Bounty platforms<\/h5>\n\n\n\n
\ud83d\udd38