enaqx/awesome-pentestA collection of awesome penetration testing resources and tools
# Awesome Penetration Testing [](https://awesome.re)
> A collection of awesome penetration testing and offensive cybersecurity resources.
[Penetration testing](https://en.wikipedia.org/wiki/Penetration_test) is the practice of launching authorized, simulated attacks against computer systems and their physical infrastructure to expose potential security weaknesses and vulnerabilities. Should you discover a vulnerability, please follow [this guidance](https://kb.cert.org/vuls/guidance/) to report it responsibly.
Your contributions and suggestions are heartily♥ welcome. (✿◕‿◕). Please check the [Contributing Guidelines](https://github.com/enaqx/awesome-pentest/blob/master/CONTRIBUTING.md) for more details. This work is licensed under a [Creative Commons Attribution 4.0 International License](https://creativecommons.org/licenses/by/4.0/).
## Contents
* [Android Utilities](#android-utilities)
* [Anonymity Tools](#anonymity-tools)
* [Tor Tools](#tor-tools)
* [Anti-virus Evasion Tools](#anti-virus-evasion-tools)
* [Books](#books)
* [Malware Analysis Books](#malware-analysis-books)
* [CTF Tools](#ctf-tools)
* [Cloud Platform Attack Tools](#cloud-platform-attack-tools)
* [Collaboration Tools](#collaboration-tools)
* [Conferences and Events](#conferences-and-events)
* [Asia](#asia)
* [Europe](#europe)
* [North America](#north-america)
* [South America](#south-america)
* [Zealandia](#zealandia)
* [Exfiltration Tools](#exfiltration-tools)
* [Exploit Development Tools](#exploit-development-tools)
* [File Format Analysis Tools](#file-format-analysis-tools)
* [GNU/Linux Utilities](#gnulinux-utilities)
* [Hash Cracking Tools](#hash-cracking-tools)
* [Hex Editors](#hex-editors)
* [Industrial Control and SCADA Systems](#industrial-control-and-scada-systems)
* [Intentionally Vulnerable Systems](#intentionally-vulnerable-systems)
* [Intentionally Vulnerable Systems as Docker Containers](#intentionally-vulnerable-systems-as-docker-containers)
* [Lock Picking](#lock-picking)
* [macOS Utilities](#macos-utilities)
* [Multi-paradigm Frameworks](#multi-paradigm-frameworks)
* [Network Tools](#network-tools)
* [DDoS Tools](#ddos-tools)
* [Network Reconnaissance Tools](#network-reconnaissance-tools)
* [Protocol Analyzers and Sniffers](#protocol-analyzers-and-sniffers)
* [Network Traffic Replay and Editing Tools](#network-traffic-replay-and-editing-tools)
* [Proxies and Machine-in-the-Middle (MITM) Tools](#proxies-and-machine-in-the-middle-mitm-tools)
* [Transport Layer Security Tools](#transport-layer-security-tools)
* [Secure Shell Tools](#secure-shell-tools)
* [Wireless Network Tools](#wireless-network-tools)
* [Network Vulnerability Scanners](#network-vulnerability-scanners)
* [Web Vulnerability Scanners](#web-vulnerability-scanners)
* [Open Sources Intelligence (OSINT)](#open-sources-intelligence-osint)
* [Data broker and search engine services](#data-broker-and-search-engine-services)
* [Dorking tools](#dorking-tools)
* [Email search and analysis tools](#email-search-and-analysis-tools)
* [Metadata harvesting and analysis](#metadata-harvesting-and-analysis)
* [Network device discovery tools](#network-device-discovery-tools)
* [OSINT Online Resources](#osint-online-resources)
* [Source code repository searching tools](#source-code-repository-searching-tools)
* [Web application and resource analysis tools](#web-application-and-resource-analysis-tools)
* [Online Resources](#online-resources)
* [Online Code Samples and Examples](#online-code-samples-and-examples)
* [Online Exploit Development Resources](#online-exploit-development-resources)
* [Online Lock Picking Resources](#online-lock-picking-resources)
* [Online Operating Systems Resources](#online-operating-systems-resources)
* [Online Penetration Testing Resources](#online-penetration-testing-resources)
* [Other Lists Online](#other-lists-online)
* [Penetration Testing Report Templates](#penetration-testing-report-templates)
* [Operating System Distributions](#operating-system-distributions)
* [Periodicals](#periodicals)
* [Physical Access Tools](#physical-access-tools)
* [Privilege Escalation Tools](#privilege-escalation-tools)
* [Password Spraying Tools](#password-spraying-tools)
* [Reverse Engineering](#reverse-engineering)
* [Reverse Engineering Books](#reverse-engineering-books)
* [Reverse Engineering Tools](#reverse-engineering-tools)
* [Security Education Courses](#security-education-courses)
* [Shellcoding Guides and Tutorials](#exploit-development-online-resources)
* [Side-channel Tools](#side-channel-tools)
* [Social Engineering](#social-engineering)
* [Social Engineering Books](#social-engineering-books)
* [Social Engineering Online Resources](#social-engineering-online-resources)
* [Social Engineering Tools](#social-engineering-tools)
* [Static Analyzers](#static-analyzers)
* [Steganography Tools](#steganography-tools)
* [Vulnerability Databases](#vulnerability-databases)
* [Web Exploitation](#web-exploitation)
* [Intercepting Web proxies](#intercepting-web-proxies)
* [Web file inclusion tools](#web-file-inclusion-tools)
* [Web injection tools](#web-injection-tools)
* [Web path discovery and bruteforcing tools](#web-path-discovery-and-bruteforcing-tools)
* [Web shells and C2 frameworks](#web-shells-and-c2-frameworks)
* [Web-accessible source code ripping tools](#web-accessible-source-code-ripping-tools)
* [Web Exploitation Books](#web-exploitation-books)
* [Windows Utilities](#windows-utilities)
## Android Utilities
* [cSploit](https://github.com/cSploit/android) - Advanced IT security professional toolkit on Android featuring an integrated Metasploit daemon and MITM capabilities.
* [Fing](https://www.fing.com/products/fing-app/) - Network scanning and host enumeration app that performs NetBIOS, UPnP, Bonjour, SNMP, and various other advanced device fingerprinting techniques.
* [NullKia](https://github.com/bad-antics/nullkia) - Mobile Security Framework supporting 500+ devices across 18 manufacturers with bootloader unlock, firmware extraction, baseband exploitation, and eSIM tools.
* [MPT](https://github.com/ByteSnipers/mobile-pentest-toolkit) - MPT (Mobile Pentest Toolkit) is a must-have solutions for your android penetration testing workflow. It allows you to automate tasks.
## Anonymity Tools
* [I2P](https://geti2p.net/) - The Invisible Internet Project.
* [Metadata Anonymization Toolkit (MAT)](https://0xacab.org/jvoisin/mat2) - Metadata removal tool, supporting a wide range of commonly used file formats, written in Python3.
* [What Every Browser Knows About You](http://webkay.robinlinus.com/) - Comprehensive detection page to test your own Web browser's configuration for privacy and identity leaks.
### Tor Tools
See also [awesome-tor](https://github.com/ajvb/awesome-tor).
* [Nipe](https://github.com/GouveaHeitor/nipe) - Script to redirect all traffic from the machine to the Tor network.
* [OnionScan](https://onionscan.org/) - Tool for investigating the Dark Web by finding operational security issues introduced by Tor hidden service operators.
* [Tails](https://tails.boum.org/) - Live operating system aiming to preserve your privacy and anonymity.
* [Tor](https://www.torproject.org/) - Free software and onion routed overlay network that helps you defend against traffic analysis.
* [dos-over-tor](https://github.com/skizap/dos-over-tor) - Proof of concept denial of service over Tor stress test tool.
* [kalitorify](https://github.com/brainfuckSec/kalitorify) - Transparent proxy through Tor for Kali Linux OS.
## Anti-virus Evasion Tools
* [AntiVirus Evasion Tool (AVET)](https://github.com/govolution/avet) - Post-process exploits containing executable files targeted for Windows machines to avoid being recognized by antivirus software.
* [CarbonCopy](https://github.com/paranoidninja/CarbonCopy) - Tool that creates a spoofed certificate of any online website and signs an Executable for AV evasion.
* [Hyperion](http://nullsecurity.net/tools/binary.html) - Runtime encryptor for 32-bit portable executables ("PE `.exe`s").
* [Shellter](https://www.shellterproject.com/) - Dynamic shellcode injection tool, and the first truly dynamic PE infector ever created.
* [UniByAv](https://github.com/Mr-Un1k0d3r/UniByAv) - Simple obfuscator that takes raw shellcode and generates Anti-Virus friendly executables by using a brute-forcable, 32-bit XOR key.
* [Veil](https://www.veil-framework.com/) - Generate metasploit payloads that bypass common anti-virus solutions.
* [peCloakCapstone](https://github.com/v-p-b/peCloakCapstone) - Multi-platform fork of the peCloak.py automated malware antivirus evasion tool.
* [Amber](https://github.com/EgeBalci/amber) - Reflective PE packer for converting native PE files to position-independent shellcode.
## Books
See also [DEF CON Suggested Reading](https://www.defcon.org/html/links/book-list.html).
* [Advanced Penetration Testing by Wil Allsopp, 2017](https://www.amazon.com/Advanced-Penetration-Testing-Hacking-Networks/dp/1119367689/)
* [Advanced Penetration Testing for Highly-Secured Environments by Lee Allen, 2012](http://www.packtpub.com/networking-and-servers/advanced-penetration-testing-highly-secured-environments-ultimate-security-gu)
* [Advanced Persistent Threat Hacking: The Art and Science of Hacking Any Organization by Tyler Wrightson, 2014](http://www.amazon.com/Advanced-Persistent-Threat-Hacking-Organization/dp/0071828362)
* [Android Hacker's Handbook by Joshua J. Drake et al., 2014](http://www.wiley.com/WileyCDA/WileyTitle/productCd-111860864X.html)
* [BTFM: Blue Team Field Manual by Alan J White & Ben Clark, 2017](https://www.amazon.de/Blue-Team-Field-Manual-BTFM/dp/154101636X)
* [Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014](http://www.amazon.com/Black-Hat-Python-Programming-Pentesters/dp/1593275900)
* [Bug Hunter's Diary by Tobias Klein, 2011](https://nostarch.com/bughunter)
* [Car Hacker's Handbook by Craig Smith, 2016](https://nostarch.com/carhacking)
* [Effective Software Testing, 2021](https://www.manning.com/books/effective-software-testing)
* [Fuzzing: Brute Force Vulnerability Discovery by Michael Sutton et al., 2007](http://www.fuzzing.org/)
* [Metasploit: The Penetration Tester's Guide by David Kennedy et al., 2011](https://nostarch.com/metasploit)
* [Penetration Testing: A Hands-On Introduction to Hacking by Georgia Weidman, 2014](https://nostarch.com/pentesting)
* [Penetration Testing: Procedures & Methodologies by EC-Council, 2010](http://www.amazon.com/Penetration-Testing-Procedures-Methodologies-EC-Council/dp/1435483677)
* [Professional Penetration Testing by Thomas Wilhelm, 2013](https://www.elsevier.com/books/professional-penetration-testing/wilhelm/978-1-59749-993-4)
* [RTFM: Red Team Field Manual by Ben Clark, 2014](http://www.amazon.com/Rtfm-Red-Team-Field-Manual/dp/1494295504/)
* [The Art of Exploitation by Jon Erickson, 2008](https://nostarch.com/hacking2.htm)
* [The Art of Network Penetration Testing, 2020](https://www.manning.com/books/the-art-of-network-penetration-testing)
* [The Basics of Hacking and Penetration Testing by Patrick Engebretson, 2013](https://www.elsevier.com/books/the-basics-of-hacking-and-penetration-testing/engebretson/978-1-59749-655-1)
* [The Database Hacker's Handbook, David Litchfield et al., 2005](http://www.wiley.com/WileyCDA/WileyTitle/productCd-0764578014.html)
* [The Hacker Playbook by Peter Kim, 2014](http://www.amazon.com/The-Hacker-Playbook-Practical-Penetration/dp/1494932636/)
* [The Mac Hacker's Handbook by Charlie Miller & Dino Dai Zovi, 2009](http://www.wiley.com/WileyCDA/WileyTitle/productCd-0470395362.html)
* [The Mobile Application Hacker's Handbook by Dominic Chell et al., 2015](http://www.wiley.com/WileyCDA/WileyTitle/productCd-1118958500.html)
* [Unauthorised Access: Physical Penetration Testing For IT Security Teams by Wil Allsopp, 2010](http://www.amazon.com/Unauthorised-Access-Physical-Penetration-Security-ebook/dp/B005DIAPKE)
* [Violent Python by TJ O'Connor, 2012](https://www.elsevier.com/books/violent-python/unknown/978-1-59749-957-6)
* [iOS Hacker's Handbook by Charlie Miller et al., 2012](http://www.wiley.com/WileyCDA/WileyTitle/productCd-1118204123.html)
### Malware Analysis Books
See [awesome-malware-analysis § Books](https://github.com/rshipp/awesome-malware-analysis#books).
## CTF Tools
* [CTF Field Guide](https://trailofbits.github.io/ctf/) - Everything you need to win your next CTF competition.
* [Ciphey](https://github.com/ciphey/ciphey) - Automated decryption tool using artificial intelligence and natural language processing.
* [RsaCtfTool](https://github.com/Ganapati/RsaCtfTool) - Decrypt data enciphered using weak RSA keys, and recover private keys from public keys using a variety of automated attacks.
* [ctf-tools](https://github.com/zardus/ctf-tools) - Collection of setup scripts to install various security research tools easily and quickly deployable to new machines.
* [shellpop](https://github.com/0x00-0x00/shellpop) - Easily generate sophisticated reverse or bind shell commands to help you save time during penetration tests.
## Cloud Platform Attack Tools
See also *[HackingThe.cloud](https://hackingthe.cloud/)*.
* [Cloud Container Attack Tool (CCAT)](https://rhinosecuritylabs.com/aws/cloud-container-attack-tool/) - Tool for testing security of container environments.
* [CloudHunter](https://github.com/belane/CloudHunter) - Looks for AWS, Azure and Google cloud storage buckets and lists permissions for vulnerable buckets.
* [Cloudsplaining](https://cloudsplaining.readthedocs.io/) - Identifies violations of least privilege in AWS IAM policies and generates a pretty HTML report with a triage worksheet.
* [Endgame](https://endgame.readthedocs.io/) - AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account's resources with a rogue AWS account.
* [GCPBucketBrute](https://github.com/RhinoSecurityLabs/GCPBucketBrute) - Script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be privilege escalated.
## Collaboration Tools
* [Dradis](https://dradis.com/) - Open-source reporting and collaboration tool for IT security professionals.
* [Hexway Hive](https://hexway.io/hive/) - Commercial collaboration, data aggregation, and reporting framework for red teams with a limited free self-hostable option.
* [Lair](https://github.com/lair-framework/lair/wiki) - Reactive attack collaboration framework and web application built with meteor.
* [Pentest Collaboration Framework (PCF)](https://gitlab.com/invuls/pentest-projects/pcf) - Open source, cross-platform, and portable toolkit for automating routine pentest processes with a team.
* [Reconmap](https://reconmap.com/) - Open-source collaboration platform for InfoSec professionals that streamlines the pentest process.
* [RedELK](https://github.com/outflanknl/RedELK) - Track and alarm about Blue Team activities while providing better usability in long term offensive operations.
## Conferences and Events
* [BSides](http://www.securitybsides.com/) - Framework for organising and holding security conferences.
* [CTFTime.org](https://ctftime.org/) - Directory of upcoming and archive of past Capture The Flag (CTF) competitions with links to challenge writeups.
### Asia
* [HITB](https://conference.hitb.org/) - Deep-knowledge security conference held in Malaysia and The Netherlands.
* [HITCON](https://hitcon.org/) - Hacks In Taiwan Conference held in Taiwan.
* [Nullcon](http://nullcon.net/website/) - Annual conference in Delhi and Goa, India.
* [SECUINSIDE](http://secuinside.com) - Security Conference in Seoul.
### Europe
* [44Con](https://44con.com/) - Annual Security Conference held in London.
* [BalCCon](https://www.balccon.org) - Balkan Computer Congress, annually held in Novi Sad, Serbia.
* [BruCON](http://brucon.org) - Annual security conference in Belgium.
* [CCC](https://events.ccc.de/congress/) - Annual meeting of the international hacker scene in Germany.
* [DeepSec](https://deepsec.net/) - Security Conference in Vienna, Austria.
* [DefCamp](http://def.camp/) - Largest Security Conference in Eastern Europe, held annually in Bucharest, Romania.
* [FSec](http://fsec.foi.hr) - FSec - Croatian Information Security Gathering in Varaždin, Croatia.
* [Hack.lu](https://hack.lu/) - Annual conference held in Luxembourg.
* [Infosecurity Europe](http://www.infosecurityeurope.com/) - Europe's number one information security event, held in London, UK.
* [SteelCon](https://www.steelcon.info/) - Security conference in Sheffield UK.
* [Swiss Cyber Storm](https://www.swisscyberstorm.com/) - Annual security conference in Lucerne, Switzerland.
* [Troopers](https://www.troopers.de) - Annual international IT Security event with workshops held in Heidelberg, Germany.
* [HoneyCON](https://honeycon.eu/) - Annual Security Conference in Guadalajara, Spain. Organized by the HoneySEC association.
### North America
* [AppSecUSA](https://appsecusa.org/) - Annual conference organized by OWASP.
* [Black Hat](http://www.blackhat.com/) - Annual security conference in Las Vegas.
* [CarolinaCon](https://carolinacon.org/) - Infosec conference, held annually in North Carolina.
* [DEF CON](https://www.defcon.org/) - Annual hacker convention in Las Vegas.
* [DerbyCon](https://www.derbycon.com/) - Annual hacker conference based in Louisville.
* [Hackers Next Door](https://hnd.techlearningcollective.com/) - Cybersecurity and social technology conference held in New York City.
* [Hackers On Planet Earth (HOPE)](https://hope.net/) - Semi-annual conference held in New York City.
* [Hackfest](https://hackfest.ca) - Largest hacking conference in Canada.
* [LayerOne](http://www.layerone.org/) - Annual US security conference held every spring in Los Angeles.
* [National Cyber Summit](https://www.nationalcybersummit.com/) - Annual US security conference and Capture the Flag event, held in Huntsville, Alabama, USA.
* [PhreakNIC](http://phreaknic.info/) - Technology conference held annually in middle Tennessee.
* [RSA Conference USA](https://www.rsaconference.com/) - Annual security conference in San Francisco, California, USA.
* [ShmooCon](http://shmoocon.org/) - Annual US East coast hacker convention.
* [SkyDogCon](http://www.skydogcon.com/) - Technology conference in Nashville.
* [SummerCon](https://www.summercon.org/) - One of the oldest hacker conventions in America, held during Summer.
* [ThotCon](http://thotcon.org/) - Annual US hacker conference held in Chicago.
* [Virus Bulletin Conference](https://www.virusbulletin.com/conference/index) - Annual conference going to be held in Denver, USA for 2016.
### South America
* [Ekoparty](http://www.ekoparty.org) - Largest Security Conference in Latin America, held annually in Buenos Aires, Argentina.
### Zealandia
* [CHCon](https://chcon.nz) - Christchurch Hacker Con, Only South Island of New Zealand hacker con.
## Exfiltration Tools
* [DET](https://github.com/sensepost/DET) - Proof of concept to perform data exfiltration using either single or multiple channel(s) at the same time.
* [Iodine](https://code.kryo.se/iodine/) - Tunnel IPv4 data through a DNS server; useful for exfiltration from networks where Internet access is firewalled, but DNS queries are allowed.
* [TrevorC2](https://github.com/trustedsec/trevorc2) - Client/server tool for masking command and control and data exfiltration through a normally browsable website, not typical HTTP POST requests.
* [dnscat2](https://github.com/iagox86/dnscat2) - Tool designed to create an encrypted command and control channel over the DNS protocol, which is an effective tunnel out of almost every network.
* [pwnat](https://github.com/samyk/pwnat) - Punches holes in firewalls and NATs.
* [tgcd](http://tgcd.sourceforge.net/) - Simple Unix network utility to extend the accessibility of TCP/IP based network services beyond firewalls.
* [QueenSono](https://github.com/ariary/QueenSono) - Client/Server Binaries for data exfiltration with ICMP. Useful in a network where ICMP protocol is less monitored than others (which is a common case).
## Exploit Development Tools
See also *[Reverse Engineering Tools](#reverse-engineering-tools)*.
* [H26Forge](https://github.com/h26forge/h26forge) - Domain-specific infrastructure for analyzing, generating, and manipulating syntactically correct but semantically spec-non-compliant video files.
* [Magic Unicorn](https://github.com/trustedsec/unicorn) - Shellcode generator for numerous attack vectors, including Microsoft Office macros, PowerShell, HTML applications (HTA), or `certutil` (using fake certificates).
* [Pwntools](https://github.com/Gallopsled/pwntools) - Rapid exploit development framework built for use in CTFs.
* [Wordpress Exploit Framework](https://github.com/rastating/wordpress-exploit-framework) - Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.
* [peda](https://github.com/longld/peda) - Python Exploit Development Assistance for GDB.
## File Format Analysis Tools
* [ExifTool](https://www.sno.phy.queensu.ca/~phil/exiftool/) - Platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide variety of files.
* [Hachoir](https://hachoir.readthedocs.io/) - Python library to view and edit a binary stream as tree of fields and tools for metadata extraction.
* [Kaitai Struct](http://kaitai.io/) - File formats and network protocols dissection language and web IDE, generating parsers in C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.
* [peepdf](https://eternal-todo.com/tools/peepdf-pdf-analysis-tool) - Python tool to explore PDF files in order to find out if the file can be harmful or not.
* [Veles](https://codisec.com/veles/) - Binary data visualization and analysis tool.
## GNU/Linux Utilities
* [Hwacha](https://github.com/n00py/Hwacha) - Post-exploitation tool to quickly execute payloads via SSH on one or more Linux systems simultaneously.
* [Linux Exploit Suggester](https://github.com/PenturaLabs/Linux_Exploit_Suggester) - Heuristic reporting on potentially viable exploits for a given GNU/Linux system.
* [Lynis](https://cisofy.com/lynis/) - Auditing tool for UNIX-based systems.
* [checksec.sh](https://www.trapkit.de/tools/checksec.html) - Shell script designed to test what standard Linux OS and PaX security features are being used.
## Hash Cracking Tools
* [BruteForce Wallet](https://github.com/glv2/bruteforce-wallet) - Find the password of an encrypted wallet file (i.e. `wallet.dat`).
* [CeWL](https://digi.ninja/projects/cewl.php) - Generates custom wordlists by spidering a target's website and collecting unique words.
* [duplicut](https://github.com/nil0x42/duplicut) - Quickly remove duplicates, without changing the order, and without getting OOM on huge wordlists.
* [GoCrack](https://github.com/fireeye/gocrack) - Management Web frontend for distributed password cracking sessions using hashcat (or other supported tools) written in Go.
* [Hashcat](http://hashcat.net/hashcat/) - The more fast hash cracker.
* [hate_crack](https://github.com/trustedsec/hate_crack) - Tool for automating cracking methodologies through Hashcat.
* [JWT Cracker](https://github.com/lmammino/jwt-cracker) - Simple HS256 JSON Web Token (JWT) token brute force cracker.
* [John the Ripper](http://www.openwall.com/john/) - Fast password cracker.
* [Rar Crack](http://rarcrack.sourceforge.net) - RAR bruteforce cracker.
## Hex Editors
* [Bless](https://github.com/bwrsandman/Bless) - High quality, full featured, cross-platform graphical hex editor written in Gtk#.
* [Frhed](http://frhed.sourceforge.net/) - Binary file editor for Windows.
* [Hex Fiend](http://ridiculousfish.com/hexfiend/) - Fast, open source, hex editor for macOS with support for viewing binary diffs.
* [HexEdit.js](https://hexed.it) - Browser-based hex editing.
* [Hexinator](https://hexinator.com/) - World's finest (proprietary, commercial) Hex Editor.
* [hexedit](https://github.com/pixel/hexedit) - Simple, fast, console-based hex editor.
* [wxHexEditor](http://www.wxhexeditor.org/) - Free GUI hex editor for GNU/Linux, macOS, and Windows.
## Industrial Control and SCADA Systems
See also [awesome-industrial-control-system-security](https://github.com/hslatman/awesome-industrial-control-system-security).
* [Industrial Exploitation Framework (ISF)](https://github.com/dark-lbp/isf) - Metasploit-like exploit framework based on routersploit designed to target Industrial Control Systems (ICS), SCADA devices, PLC firmware, and more.
* [s7scan](https://github.com/klsecservices/s7scan) - Scanner for enumerating Siemens S7 PLCs on a TCP/IP or LLC network.
* [OpalOPC](https://opalopc.com/) - Commercial OPC UA vulnerability assessment tool, sold by Molemmat.
## Intentionally Vulnerable Systems
See also [awesome-vulnerable](https://github.com/kaiiyer/awesome-vulnerable).
* [Pentest-Ground](https://pentest-ground.com/).
* [OopsSec Store](https://github.com/kOaDT/oss-oopssec-store) - Run `npx create-oss-store`, open your browser, and start hunting flags.
### Intentionally Vulnerable Systems as Docker Containers
* [Damn Vulnerable Web Application (DVWA)](https://hub.docker.com/r/citizenstig/dvwa/) - `docker pull citizenstig/dvwa`.
* [OWASP Juice Shop](https://github.com/bkimminich/juice-shop#docker-container--) - `docker pull bkimminich/juice-shop`.
* [OWASP Mutillidae II Web Pen-Test Practice Application](https://hub.docker.com/r/citizenstig/nowasp/) - `docker pull citizenstig/nowasp`.
* [OWASP NodeGoat](https://github.com/owasp/nodegoat) - `docker-compose build && docker-compose up`.
* [OWASP Security Shepherd](https://hub.docker.com/r/ismisepaul/securityshepherd/) - `docker pull ismisepaul/securityshepherd`.
* [OWASP WebGoat Project 7.1 docker image](https://hub.docker.com/r/webgoat/webgoat-7.1/) - `docker pull webgoat/webgoat-7.1`.
* [OWASP WebGoat Project 8.0 docker image](https://hub.docker.com/r/webgoat/webgoat-8.0/) - `docker pull webgoat/webgoat-8.0`.
* [Vulnerability as a service: Heartbleed](https://hub.docker.com/r/hmlio/vaas-cve-2014-0160/) - `docker pull hmlio/vaas-cve-2014-0160`.
* [Vulnerability as a service: SambaCry](https://hub.docker.com/r/vulnerables/cve-2017-7494/) - `docker pull vulnerables/cve-2017-7494`.
* [Vulnerability as a service: Shellshock](https://hub.docker.com/r/hmlio/vaas-cve-2014-6271/) - `docker pull hmlio/vaas-cve-2014-6271`.
* [Vulnerable WordPress Installation](https://hub.docker.com/r/wpscanteam/vulnerablewordpress/) - `docker pull wpscanteam/vulnerablewordpress`.
## Lock Picking
See [awesome-lockpicking](https://github.com/fabacab/awesome-lockpicking).
## macOS Utilities
* [Bella](https://github.com/kdaoudieh/Bella) - Pure Python post-exploitation data mining and remote administration tool for macOS.
* [EvilOSX](https://github.com/Marten4n6/EvilOSX) - Modular RAT that uses numerous evasion and exfiltration techniques out-of-the-box.
## Multi-paradigm Frameworks
* [Armitage](http://fastandeasyhacking.com/) - Java-based GUI front-end for the Metasploit Framework.
* [AutoSploit](https://github.com/NullArray/AutoSploit) - Automated mass exploiter, which collects target by employing the Shodan.io API and programmatically chooses Metasploit exploit modules based on the Shodan query.
* [Decker](https://github.com/stevenaldinger/decker) - Penetration testing orchestration and automation framework, which allows writing declarative, reusable configurations capable of ingesting variables and using outputs of tools it has run as inputs to others.
* [Faraday](https://github.com/infobyte/faraday) - Multiuser integrated pentesting environment for red teams performing cooperative penetration tests, security audits, and risk assessments.
* [Metasploit](https://www.metasploit.com/) - Software for offensive security teams to help verify vulnerabilities and manage security assessments.
* [Pupy](https://github.com/n1nj4sec/pupy) - Cross-platform (Windows, Linux, macOS, Android) remote administration and post-exploitation tool.
* [Ronin](https://ronin-rb.dev) - Free and Open Source Ruby Toolkit for Security Research and Development, providing many different libraries and commands for a variety of security tasks, such as recon, vulnerability scanning, exploit development, exploitation, post-exploitation, and more.
## Network Tools
* [CrackMapExec](https://github.com/byt3bl33d3r/CrackMapExec) - Swiss army knife for pentesting networks.
* [IKEForce](https://github.com/SpiderLabs/ikeforce) - Command line IPSEC VPN brute forcing tool for Linux that allows group name/ID enumeration and XAUTH brute forcing capabilities.
* [Intercepter-NG](http://sniff.su/) - Multifunctional network toolkit.
* [Legion](https://github.com/GoVanguard/legion) - Graphical semi-automated discovery and reconnaissance framework based on Python 3 and forked from SPARTA.
* [Ncrack](https://nmap.org/ncrack/) - High-speed network authentication cracking tool built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords.
* [Praeda](http://h.foofus.net/?page_id=218) - Automated multi-function printer data harvester for gathering usable data during security assessments.
* [Printer Exploitation Toolkit (PRET)](https://github.com/RUB-NDS/PRET) - Tool for printer security testing capable of IP and USB connectivity, fuzzing, and exploitation of PostScript, PJL, and PCL printer language features.
* [SPARTA](https://sparta.secforce.com/) - Graphical interface offering scriptable, configurable access to existing network infrastructure scanning and enumeration tools.
* [SigPloit](https://github.com/SigPloiter/SigPloit) - Signaling security testing framework dedicated to telecom security for researching vulnerabilites in the signaling protocols used in mobile (cellular phone) operators.
* [Smart Install Exploitation Tool (SIET)](https://github.com/Sab0tag3d/SIET) - Scripts for identifying Cisco Smart Install-enabled switches on a network and then manipulating them.
* [THC Hydra](https://github.com/vanhauser-thc/thc-hydra) - Online password cracking tool with built-in support for many network protocols, including HTTP, SMB, FTP, telnet, ICQ, MySQL, LDAP, IMAP, VNC, and more.
* [Tsunami](https://github.com/google/tsunami-security-scanner) - General purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence.
* [Zarp](https://github.com/hatRiot/zarp) - Network attack tool centered around the exploitation of local networks.
* [dnstwist](https://github.com/elceef/dnstwist) - Domain name permutation engine for detecting typo squatting, phishing and corporate espionage.
* [dsniff](https://www.monkey.org/~dugsong/dsniff/) - Collection of tools for network auditing and pentesting.
* [impacket](https://github.com/CoreSecurity/impacket) - Collection of Python classes for working with network protocols.
* [pivotsuite](https://github.com/RedTeamOperations/PivotSuite) - Portable, platform independent and powerful network pivoting toolkit.
* [routersploit](https://github.com/reverse-shell/routersploit) - Open source exploitation framework similar to Metasploit but dedicated to embedded devices.
* [rshijack](https://github.com/kpcyrd/rshijack) - TCP connection hijacker, Rust rewrite of `shijack`.
### DDoS Tools
* [Anevicon](https://github.com/rozgo/anevicon) - Powerful UDP-based load generator, written in Rust.
* [D(HE)ater](https://github.com/Balasys/dheater) - D(HE)ater sends forged cryptographic handshake messages to enforce the Diffie-Hellman key exchange.
* [HOIC](https://sourceforge.net/projects/high-orbit-ion-cannon/) - Updated version of Low Orbit Ion Cannon, has 'boosters' to get around common counter measures.
* [Low Orbit Ion Canon (LOIC)](https://github.com/NewEraCracker/LOIC) - Open source network stress tool written for Windows.
* [Memcrashed](https://github.com/649/Memcrashed-DDoS-Exploit) - DDoS attack tool for sending forged UDP packets to vulnerable Memcached servers obtained using Shodan API.
* [SlowLoris](https://github.com/gkbrk/slowloris) - DoS tool that uses low bandwidth on the attacking side.
* [T50](https://gitlab.com/fredericopissarra/t50/) - Faster network stress tool.
* [UFONet](https://github.com/epsylon/ufonet) - Abuses OSI layer 7 HTTP to create/manage 'zombies' and to conduct different attacks using; `GET`/`POST`, multithreading, proxies, origin spoofing methods, cache evasion techniques, etc.
---
[Read more](https://github.com/enaqx/awesome-pentest)