AWSBucketDump - Security Tool to Look For Interesting Files in S3 Buckets.
enumerate-iam - Enumerate the permissions associated with AWS credential set.
lazys3 - A Ruby script to bruteforce for AWS s3 buckets using different permutations.
s3-inspector - Tool to check AWS S3 bucket permissions.
S3Scanner - Scan for open S3 buckets and dump the contents.
slurp - A blazing fast & feature rich Amazon S3 bucket enumerator.
File Viewers and Pretty Printers
gron - gron transforms JSON into discrete assignments to make it easier to grep for what you want and see the absolute 'path' to it. It eases the exploration of APIs that return large blobs of JSON but have terrible documentation.
jless - jless is a command-line JSON viewer designed for reading, exploring, and searching through JSON data.
Hardware Security
Binwalk - Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
chipsec - CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities.
CAN Bus
Korlan USB2CAN - With USB2CAN you can monitor a CAN network, write a CAN program and communicate with industrial, medical, automotive or another type of CAN bus network devices.
Logic Analyzers
DSLogic - DSLogic is a series of USB-based logic analyzer, with max sample rate up to 1GHz, and max sample depth up to 16G.
Saleae - Saleae logic analyzers are used by electrical engineers, firmware developers, enthusiasts, and engineering students to record, measure, visualize, and decode the signals in their electrical circuits.
Misc Hardware Tools
Bus Pirate - The Bus Pirate is an open source hacker multi-tool that talks to electronic stuff.
ChipWhisperer - The complete open-source toolchain for side-channel power analysis and glitching attacks.
HydraBus - The HydraBus (hardware) with HydraFW (firmware) are used as an open source multi-tool for anyone interested in learning/developping/debugging/hacking/Penetration Testing for basic or advanced embedded hardware.
Hash Cracking Tools
haiti - A CLI tool (and library) to identify hash types (hash type identifier).
Hashview - A web front-end for password cracking and analytics.
hate_crack - A tool for automating cracking methodologies through Hashcat from the TrustedSec team.
Hex Editors
ImHex - A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.
Lab Setup
AutomatedLab - AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts.
BadBlood - BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world.
Mobile Security
Android
Apktool - A tool for reverse engineering 3rd party, closed, binary Android apps.
dex2jar - Tools to work with android .dex and java .class files.
rootAVD - root your Android Studio Virtual Device (AVD), with Magisk (Stable, Canary or Alpha).
Simplify - Android virtual machine and deobfuscator.
iOS
iHide - A utility for hiding jailbreak from iOS applications.
iOS App Signer - iOS App Signer can (re)sign apps and bundle them into ipa files that are ready to be installed on an iOS device.
Keychain-Dumper - A tool to check which keychain items are available to an attacker once an iOS device has been jailbroken.
MGSpoof - Hook MGCopyAnswer + custom helper so user can spoof some keys.
plistsubtractor - Read a plist file, write out any embedded plist files.
Shadow - A jailbreak detection bypass for modern iOS jailbreaks.
Sideloadly - Sideloadly is a Cydia impactor alternative that allows you to install IPA for your iPhone or iPad.
sigh - sigh can create, renew, download and repair provisioning profiles (with one command). It supports App Store, Ad Hoc, Development and Enterprise profiles and supports nice features, like auto-adding all test devices.
ipwndfu - open-source jailbreaking tool for many iOS devices.
Mobile Security Framework (MobSF) - Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
objection - objection is a runtime mobile exploration toolkit, powered by Frida.
Proxy Helper - Proxy Helper is a WiFi Pineapple module that will automatically configure the Pineapple for use with a proxy such as Burp Suite.
Vulnerable Apps
AndroGoat - AndroGoat is purposely developed open source vulnerable/insecure app using Kotlin.
Damn-Vulnerable-Bank - Damn Vulnerable Bank is designed to be an intentionally vulnerable android application.
igoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar. Objective-C
iGoat-Swift - A Damn Vulnerable Swift Application for iOS. Swift
InsecureShop - An Intentionally designed Vulnerable Android Application built in Kotlin. Kotlin
MASTG-Hacking-Playground - The MASTG Hacking Playground is a collection of educational iOS and Android mobile apps, that are intentionally build insecure in order to give practical guidance to developers, security researches and penetration testers.
ovaa - OVAA (Oversecured Vulnerable Android App) is an Android app that aggregates all the platform's known and popular security vulnerabilities.
Network Tools
Certipy -Tool for Active Directory Certificate Services enumeration and abuse.
Coercer - A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.
Nginxpwner - Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities.
Nuclei - Fast and customizable vulnerability scanner based on simple YAML based DSL.
SSHScan - SSHScan is a testing tool that enumerates SSH Ciphers. Using SSHScan, weak ciphers can be easily detected.
OSINT
Amass - n-depth Attack Surface Mapping and Asset Discovery
github-search - Tools to perform basic search on GitHub.
subfinder - Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.
Metadata Tools
Goca - Goca is a FOCA fork written in Go, which is a tool used mainly to find metadata and hidden information in the documents its scans.
Privilege Escalation Tools
IDiagnosticProfileUAC - Just another UAC bypass using auto-elevated COM object Virtual Factory for DiagCpl (12C21EA7-2EB8-4B55-9249-AC243DA8C666).
appshark - Appshark is a static taint analysis platform to scan vulnerabilities in an Android app.
route-sixty-sink - an open source tool that enables defenders and security researchers alike to quickly identify vulnerabilities in any .NET assembly using automated source-to-sink analysis.
jwt_tool - jwt_tool.py is a toolkit for validating, forging, scanning and tampering JWTs (JSON Web Tokens).
lfimap - Local file inclusion discovery and exploitation tool
Burp Suite Plugins
burp-awesome-tls - This extension hijacks Burp's HTTP/TLS stack and allows you to spoof any browser fingerprint in order to make it more powerful and less prone to fingerprinting by all kinds of WAFs.
GraphQL
clairvoyance - Obtain GraphQL API schema despite disabled introspection!
graphql-voyager - Represent any GraphQL API as an interactive graph.
Wordlists
google-10000-english - This repo contains a list of the 10,000 most common English words in order of frequency, as determined by n-gram frequency analysis of the Google's Trillion Word Corpus.
SecLists - It's a collection of multiple types of lists used during security assessments, collected in one place.
kc57/awesome-pentest
