Awesome Penetration Testing

A collection of awesome penetration testing and offensive cybersecurity resources.

Penetration testing is the practice of launching authorized, simulated attacks against computer systems and their physical infrastructure to expose potential security weaknesses and vulnerabilities. Should you discover a vulnerability, please follow this guidance to report it responsibly.

Your contributions and suggestions are heartily♥ welcome. (✿◕‿◕). Please check the Contributing Guidelines for more details. This work is licensed under a Creative Commons Attribution 4.0 International License.

Contents

• Android Utilities
• Anonymity Tools
  • Tor Tools
• Anti-virus Evasion Tools
• Books
  • Malware Analysis Books
• CTF Tools
• Cloud Platform Attack Tools
• Collaboration Tools
• Conferences and Events
  • Asia
  • Europe
  • North America
  • South America
  • Zealandia
• Exfiltration Tools
• Exploit Development Tools
• File Format Analysis Tools
• GNU/Linux Utilities
• Hash Cracking Tools
• Hex Editors
• Industrial Control and SCADA Systems
• Intentionally Vulnerable Systems
  • Intentionally Vulnerable Systems as Docker Containers
• Lock Picking
• macOS Utilities
• Multi-paradigm Frameworks
• Network Tools
  • DDoS Tools
  • Network Reconnaissance Tools
  • Protocol Analyzers and Sniffers
  • Network Traffic Replay and Editing Tools
  • Proxies and Machine-in-the-Middle (MITM) Tools
  • Transport Layer Security Tools
  • Secure Shell Tools
  • Wireless Network Tools
• Network Vulnerability Scanners
  • Web Vulnerability Scanners
• Open Sources Intelligence (OSINT)
  • Data broker and search engine services
  • Dorking tools
  • Email search and analysis tools
  • Metadata harvesting and analysis
  • Network device discovery tools
  • OSINT Online Resources
  • Source code repository searching tools
  • Web application and resource analysis tools
• Online Resources
  • Online Code Samples and Examples
  • Online Exploit Development Resources
  • Online Lock Picking Resources
  • Online Operating Systems Resources
  • Online Penetration Testing Resources
  • Other Lists Online
  • Penetration Testing Report Templates
• Operating System Distributions
• Periodicals
• Physical Access Tools
• Privilege Escalation Tools
  • Password Spraying Tools
• Reverse Engineering
  • Reverse Engineering Books
  • Reverse Engineering Tools
• Security Education Courses
• Shellcoding Guides and Tutorials
• Side-channel Tools
• Social Engineering
  • Social Engineering Books
  • Social Engineering Online Resources
  • Social Engineering Tools
• Static Analyzers
• Steganography Tools
• Vulnerability Databases
• Web Exploitation
  • Intercepting Web proxies
  • Web file inclusion tools
  • Web injection tools
  • Web path discovery and bruteforcing tools
  • Web shells and C2 frameworks
  • Web-accessible source code ripping tools
  • Web Exploitation Books
• Windows Utilities

Android Utilities

• cSploit - Advanced IT security professional toolkit on Android featuring an integrated Metasploit daemon and MITM capabilities.
• Fing - Network scanning and host enumeration app that performs NetBIOS, UPnP, Bonjour, SNMP, and various other advanced device fingerprinting techniques.
• NullKia - Mobile Security Framework supporting 500+ devices across 18 manufacturers with bootloader unlock, firmware extraction, baseband exploitation, and eSIM tools.
• MPT - MPT (Mobile Pentest Toolkit) is a must-have solutions for your android penetration testing workflow. It allows you to automate tasks.

Anonymity Tools

• I2P - The Invisible Internet Project.
• Metadata Anonymization Toolkit (MAT) - Metadata removal tool, supporting a wide range of commonly used file formats, written in Python3.
• What Every Browser Knows About You - Comprehensive detection page to test your own Web browser's configuration for privacy and identity leaks.

Tor Tools

See also awesome-tor.

• Nipe - Script to redirect all traffic from the machine to the Tor network.
• OnionScan - Tool for investigating the Dark Web by finding operational security issues introduced by Tor hidden service operators.
• Tails - Live operating system aiming to preserve your privacy and anonymity.
• Tor - Free software and onion routed overlay network that helps you defend against traffic analysis.
• dos-over-tor - Proof of concept denial of service over Tor stress test tool.
• kalitorify - Transparent proxy through Tor for Kali Linux OS.

Anti-virus Evasion Tools