Pocket Pentester

Offensive-Security-Toolkit für Android. Reines Rust + Tauri + Vue. 21 Module. Offline-First. Kein Root erforderlich.

---

Module

◉ Recon

#	Tool	Was es macht
01	port-scan	Asynchrone TCP-Port-Erkennung mit Service-Hinweisen
02	subdomain	16 passive Quellen (crt.sh, certspotter, c99, VT, ...) + Brute
03	http-probe	Live-Hosts fingerprinten, Status, Titel, Tech-Stack
21	domain-grab	Massenhaft Domains nach TLD aus Web-Quellen + IANA-Katalog sammeln

⚔ Exploitation

#	Tool	Was es macht
04	takeover	Subdomain-Takeover — 18 Service-Fingerprints (S3/GH/Heroku/Azure/+)
05	sqli	sqlmap-Stil: Error + Boolean-Blind + Union + Time-Blind + Auto-Extract
06	xss	Kontextbewusste Reflection: HTML/Attr/JS/URL-Payloads mit Canary
07	jwt	alg:none + kid-Injection + HMAC-Schwachstellen-Brute + Admin-Forgery
08	xploiter	YAML-Template-Engine — Variablen, Payloads, Matcher, Chains
09	auto-pwn	Vollständige Kette: Recon → Probe → Exploit, Ein-Knopf-Pipeline
12	dir-fuzz	Content-Discovery mit Rekursion + Wildcard-Kalibrierung
14	admin-finder	320+ Admin-Pfade, CMS-Fingerprint, Login-Formular-Erkennung
15	form-brute	Login-Bruteforce: CSRF-bewusst, Regex-Match, Baseline-Delta

✎ Manuell

#	Tool	Was es macht
11	repeater	Burp-Lite: Methoden-/URL-/Header-/Body-Editor + Vorschau + curl-Export

≋ Netzwerk

#	Tool	Was es macht
10	lan-map	LAN-Geräte entdecken: TCP-Sweep + mDNS + SSDP/UPnP
16	dns	A/AAAA/MX/TXT/NS/CNAME/SOA/CAA/SRV + AXFR + DNSSEC
17	ssl-scan	TLS-Zertifikatskette, SANs, Ablauf, schwache Signatur, Versions-Audit
18	banner-grab	TCP-Banner + Service-Fingerprint (SSH/SMTP/FTP/HTTP/Redis/MySQL)

⚙ Dienstprogramm

#	Tool	Was es macht
13	payload-gen	50+ Reverse/Bind-Shells + Webshells + msfvenom + Encoder
19	encoder	Verkettbare b64/url/hex/html/rot13/morse/jwt-Pipeline
20	hash-tools	28+ Hash-Typen identifizieren + MD5/SHA/CRC32 berechnen

---

Screenshots

Recon

port-scan	subdomain	http-probe
domain-grab	dns	ssl-scan
banner-grab	lan-map

Exploitation

auto-pwn	sqli	xss
xploiter	jwt	dir-fuzz
admin-finder	form-brute	takeover