Offensive Security
Ethical hacking tools and resources for penetration testing and red team operations.
Explore 276 curated tools and resources
RELATED TASKS
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Commercial
Resources
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Commercial
Application Security
Check Point CloudGuard WAF
A cloud-native web application and API security solution that uses contextual AI to protect against known and zero-day threats without signature-based detection.
Commercial
Application Security
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
Commercial
Cloud Security
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.
Commercial
Application Security
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Commercial
Cloud Security
LATEST ADDITIONS
CLI tool for offensive and defensive security assessments on the Joi validator library with a wide range of attacks.
GraphSpy is a token management tool that allows users to store and manage access and refresh tokens for multiple users and scopes in one location.
Generate a variety of suspect actions detected by Falco rulesets.
A document that helps inform red team planning by contrasting against the very specific red team style described in Red Teams.
CrossC2 enables generation of cross-platform payloads for CobaltStrike, enhancing operational flexibility.
A tutorial on how to use Apache mod_rewrite to randomly serve payloads in phishing attacks
A blog post discussing the often overlooked dangers of CSV injection in applications.
Wfuzz is a tool designed for bruteforcing Web Applications with multiple features like multiple injection points, recursion, and payload combinations.
A tool for automated security scanning of web applications and manual penetration testing.
Learn how to create new Malleable C2 profiles for Cobalt Strike to avoid detection and signatured toolset
Utilizes dirtyc0w kernel exploit for privilege escalation in a Docker container.
A powerful enumeration tool for discovering assets and subdomains.
Tool for attacking Active Directory environments through SQL Server access.
Using Apache mod_rewrite rules to rewrite incident responder or security appliance requests to an innocuous website or the target's real website.