Penetration Testing
Browse 1,275 penetration testing tools
FEATURED
TikiTorch is a process injection tool that executes code within the address space of other processes using various injection techniques.
A comprehensive reference guide to Nmap's scripting engine and its various options, scripts, and target specifications.
A powerful interactive packet manipulation program and library for network exploration and security testing.
Linux-based operating system intentionally vulnerable for cybersecurity practice.
A virtual machine with numerous security vulnerabilities for testing exploits with Metasploit.
A collection of Yara rules for the Burp Yara-Scanner extension that helps identify malicious software and infected web pages during web application security assessments.
iOS Reverse Engineering Toolkit for automating common tasks in iOS penetration testing.
A honeypot mimicking Tomcat manager endpoints to log requests and save attacker's WAR files for analysis.
PwnAuth is an open-source tool for generating and managing authentication tokens across multiple protocols, designed for penetration testing and red team exercises.
Innovative tool for mobile security researchers to analyze targets with static and dynamic analysis capabilities and sharing functionalities.
A deliberately vulnerable GraphQL application designed for security testing and educational purposes, containing multiple intentional flaws for learning GraphQL attack and defense techniques.
ReFlutter is a reverse engineering framework that uses patched Flutter libraries to enable dynamic analysis and traffic monitoring of Flutter mobile applications on Android and iOS platforms.
A comprehensive repository documenting security vulnerabilities in regular expressions used by Web Application Firewalls, including bypass examples and SAST tools for vulnerability identification.
A proof-of-concept tool that generates Excel BIFF8 files with embedded 4.0 macros programmatically without requiring Microsoft Excel installation.
CrackMapExec (CME) - A tool for querying internal database for host and credential information in cybersecurity.
RedELK is a SIEM tool designed for red teams to monitor and receive alerts about blue team detection activities during penetration testing engagements.
A Docker container that starts a SSH honeypot and reports statistics to the SANS ISC DShield project
A comprehensive repository of open-source security tools organized by attack phases for red team operations, adversary simulation, and threat hunting purposes.
A wargaming network for penetration testers to practice their skills in a realistic environment.
An industrial control system testing tool that enables security researchers to enumerate SCADA controllers, read register values, and modify register data across different testing modes.
A collection of Python scripts for conducting penetration testing activities against Amazon Web Services (AWS) environments.
Sublist3r is a python tool for enumerating subdomains using OSINT and various search engines.
A collection of 20 cross-site scripting challenges covering various XSS attack vectors and filtering bypass techniques for educational purposes.
