Pentest Bookmarks List Sofiane Hamlaoui

在 Google 上查看更多 : https://g.co/kgs/FUZgoXi

黑客媒体

博客

有很多渗透测试博客，以下是我在日常测试工作中持续关注并重视的。

• Carnal 0wnage - atom
• McGrew Security
• GNUCITIZEN
• Darknet - The Darkside - rss
• spylogic - rss
• TaoSecurity - atom
• Room362
• SIPVicious - rss
• portswigger
• pentestmonkeyblog
• jeremiahgrossman
• i8jesus
• c22
• Skull Security - rss
• metasploit
• darkoperator
• skeptikal
• preachsecurity
• tssci-security
• gdssecurityl
• websec
• bernardodamele
• laramies
• andlabs
• xs-sniperblog
• commonexploits
• sensepostblog
• wepma
• Exploit KB - rss
• securityreliks
• Mad Irish - rss
• sirdarckcat
• reusablesec
• myne-us
• notsosecure
• spiderlabs
• corelan
• DigiNinja - rss
• pauldotcom
• attackvector
• deviating
• alphaonelabs
• smashingpasswords
• wirewatcher
• gynvael
• nullthreat
• question-defense
• archangelamael
• memset
• sickness
• punter-infosec
• securityninja
• securityandrisk
• pentestit

论坛:

为帮助工具使用、语法、攻击技术以及脚本和工具的收集而创建的论坛。

• EH-Net Forums
• Hak5 Forums
• Kali Linux Forums
• Hack Forums
• Hackthissite Forums
• Security Override Forums
• Government Security

维基

• Pwn Wiki
• Skull Security
• BlindSeeker Wiki
• SQL Injection Wiki
• Forgotten Security's CTF Wiki

杂志:

• (In)Secure Magazine
• Hackin9

视频:

• SecurityTube

---

方法论:

• Penetration Testing Framework
• The Penetration Testing Execution Standard
• The WASC Threat Classification
• OWASP Top Ten Project
• The Social Engineering Framework

---

开源情报

人员与组织:

• http://www.spokeo.com/
• http://www.123people.com/
• http://www.xing.com/
• http://www.zoominfo.com/search
• http://pipl.com/
• http://www.zabasearch.com/
• http://www.searchbug.com/default.aspx
• http://theultimates.com/
• http://skipease.com/
• http://addictomatic.com/
• http://socialmention.com/
• http://entitycube.research.microsoft.com/
• http://www.yasni.com/
• http://tweepz.com/
• http://tweepsearch.com/
• http://www.glassdoor.com/index.htm
• http://www.jigsaw.com/
• http://searchwww.sec.gov/EDGARFSClient/jsp/EDGAR_MainAccess.jsp
• http://www.tineye.com/
• http://www.peekyou.com/
• http://picfog.com/
• http://twapperkeeper.com/index.php

基础设施:

• http://uptime.netcraft.com/
• http://www.serversniff.net/
• http://www.domaintools.com/
• http://centralops.net/co/
• http://hackerfantastic.com/
• http://whois.webhosting.info/
• https://www.ssllabs.com/ssldb/analyze.html
• http://www.clez.net/
• http://www.my-ip-neighbors.com/
• https://www.shodan.io/
• http://www.exploit-db.com/google-dorks/
• http://www.hackersforcharity.org/ghdb/

---

漏洞利用与公告:

• http://www.exploit-db.com/
• http://www.cvedetails.com/
• https://cxsecurity.com/
• http://www.packetstormsecurity.org/
• http://www.securityforest.com/wiki/index.php/Main_Page
• http://www.securityfocus.com/bid
• http://nvd.nist.gov/
• http://osvdb.org/
• http://www.nullbyte.org.il/Index.html
• http://secdocs.lonerunners.net/
• http://www.phenoelit-us.org/whatSAP/index.html
• http://secunia.com/
• http://cve.mitre.org/

---

速查表与语法:

• http://cirt.net/ports_dl.php?export=services
• http://www.cheat-sheets.org/
• http://blog.securitymonks.com/2009/08/15/whats-in-your-folder-security-cheat-sheets/

敏捷黑客:

• http://www.gnucitizen.org/blog/agile-hacking-a-homegrown-telnet-based-portscanner/
• http://blog.commandlinekungfu.com/
• http://www.securityaegis.com/simple-yet-effective-directory-bruteforcing/
• http://isc.sans.edu/diary.html?storyid=2376
• http://isc.sans.edu/diary.html?storyid=1229
• http://ss64.com/nt/
• http://pauldotcom.com/2010/02/running-a-command-on-every-mac.html
• http://synjunkie.blogspot.com/2008/03/command-line-ninjitsu.html
• http://www.zonbi.org/2010/06/09/wmic-the-other-other-white-meat/
• http://rstcenter.com/forum/22324-hacking-without-tools-windows.rst
• http://www.coresecurity.com/files/attachments/Core_Define_and_Win_Cmd_Line.pdf
• http://www.scribd.com/Penetration-Testing-Ninjitsu2-Infrastructure-and-Netcat-without-Netcat/d/3064507
• http://www.pentesterscripting.com/
• http://www.sans.org/reading_room/whitepapers/hackers/windows-script-host-hack-windows_33583
• http://www.blackhat.com/presentations/bh-dc-10/Bannedit/BlackHat-DC-2010-Bannedit-Advanced-Command-Injection-Exploitation-1-wp.pdf

操作系统与脚本:

• http://en.wikipedia.org/wiki/IPv4_subnetting_reference
• http://www.nixtutor.com/linux/all-the-best-linux-cheat-sheets/
• http://shelldorado.com/shelltips/beginner.html
• http://www.linuxsurvival.com/
• http://mywiki.wooledge.org/BashPitfalls
• http://rubular.com/
• http://www.iana.org/assignments/port-numbers
• http://www.robvanderwoude.com/ntadmincommands.php
• http://www.nixtutor.com/linux/all-the-best-linux-cheat-sheets/

工具: