Penetration Testing Tools Repo

The purpose of this project is to make a single repository for all the commonly used penetration testing tools, typically tools that don't exist within Kali or other penetration testing distros. In some cases, it makes sense to have the latest version of a tool separate to your distro installed stable binaries or scripts. Installing from GitHub allows you to grab the latest tools specific to your style of pen testing, tools that could be too niche to ever make it into your favorite security distro. Additionally, a seperate self-contained tool set within your home directory or /opt also allows for easy transportation from one (identical) machine to another.

Installation Instructions

1. Fork repo (allows you to make changes to your tools and or push to this repo)
2. Git clone repo:

git clone --recursive https://github.com/Aptive/penetration-testing-tools.git

For some tools further installation will be required, e.g. building binaries / installing configuring tools to suit your requirements, below are links to each distro managers page with installation instructions for each.

Update Instructions

Update a single tool

The following example uses nmap:

cd penetration-testing-tools/infra/nmap/
git pull

Update all the pen test tools

cd penetration-testing-tools/
git submodule foreach git pull

Contributing to the repo

To contribute, send a pull request.

Included Penetration Testing Tools

SSL Testing Tools

Location: /ssl-testing-tools

• testssl - ssl testing

Infrastructure Pen Testing Tools

Location: /infra

Intrastructure pen testing tools:

• Metasploit Framework - metasploit framework
• Responder - LLMNR and NBT-NS Poisoning - capture passwords from typo'd smb \server-addresses on the network
• proxychains-ng - pivoting
• Net-creds - Sniffs sensitive data from interface or pcap
• smbexec - A rapid psexec style attack with samba tools
• dnsftp - Use only DNS queries to download a file, and then execute it
• reGeorg - pivoting via socks proxies
• sonar.js - A framework for identifying and launching exploits against internal network hosts
• sonar.js - A framework for identifying and launching exploits against internal network hosts.
• The Backdoor Factory - Patch PE, ELF, Mach-O binaries with shellcode - backdoor binaries so they continue to work normally
• NMAP - NMAP the network mapper
• Port Scan Automation - Automate NMAP scans and custom Nessus polices.

Redteam

Location: /redteam

• Veil Framework - a red team toolkit focused on evading detection (AV evasion & target delivery)
• Phising Frenzy - Ruby on Rails Phishing Framework

Recon

Location: /recon

• EyeWitness - Take screenshots of websites, provide some server header info, and identify default credentials if possible
• Gitrob - Helps security professionals find sensitive information lingering in publicly available files on GitHub
• recon-ng - Recon-ng is a full-featured Web Reconnaissance framework written in Python.
• SpiderFoot - open source footprinting and intelligence-gathering tool.
• SimplyEmail - Email recon made fast and easy

Shells

Location: /shells

• cmdsql - Command execution, web.config parsing, and SQL query execution
• BlackArch Webshells - BlackArch web shells
• b374k - Web shell
• Python PTY Shells - python pty shells
• MiniReverse Shell - mini reverse shell

Wordlists

Location: /wordlists

• FuzzDB - wordlist
• SecLists - wordlist

Web App Penetration testing Tools

Location: /web-app

• SQLMap - sql injection automation
• WafW00f - identify and fingerprint Web Application Firewall (WAF)
• ICMP Reverse Shell - Simple reverse ICMP shell
• WeBaCoo - Web Backdoor Cookie Script-Kit
• Commix - Commix, automated injection based web vulnerability scanner
• WIG - WebApp Information Gatherer
• CMSmap - CMS vulnerability scanner
• Droop Scan - A CMS vulnerability scanner for Drupal, Wordpress, SilverStripe
• WPScan - WPScan is a black box WordPress vulnerability scanner
• NoSQLMap - Automated Mongo database and NoSQL web application exploitation tool
• HTTPScreenShot - HTTPScreenshot is a tool for grabbing screenshots and HTML of large numbers of websites

Source Code Audit

SAST - SCR - Static Analysis

Location: /source-code-audit

• grAudit - simple script and signature sets that allows you to find potential security flaws in source code using grep
• Brakeman - A static analysis security vulnerability scanner for Ruby on Rails applications

Bruteforce Tools

Location: /bruteforce

• Pator - Patator is a multi-purpose brute-forcer
• Crowbar - Bruteforcer - supports protocols not supported by THC-Hydra

Windows Tools

Location: /windows

• Mimikatz - Extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.
• UAC Script - UAC Bypass Vulnerability in Windows Script Host

Linux Scripts

Location: linux

• Linux Local Enumeration Script - Linux local enumeration script

Powershell

Location: /powershell

• Badadook - Connection-less Powershell Persistent and Resilient Backdoor
• PowerShellEmpire - Empire is a pure PowerShell post-exploitation agent
• PowerSploit - PowerSploit - A PowerShell Post-Exploitation Framework
• Nishang - PowerShell for penetration testing and offensive security
• BloodHound - BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment

Rootkits

Location: /rootkits

• Azael - Azazel is a userland rootkit based off of the original LD_PRELOAD technique from Jynx rootkit

Scripting Tools

Location: /scripting

• Babel SF - Babel Scripting Framework - a collection of custom scripts to facilitate useful pentest related functions via scripting languages

Exploit Development

Location: /exploit-dev

• PEDA - PEDA - Python Exploit Development Assistance for GDB
• ROPEME - ROPEME - ROP Exploit Made Easy
• Ropper - ROP tool
• Shellconv - Small tool for disassembling shellcode (using objdump)
• PWNTools - CTF framework and exploit development library

Misc

Location: /misc

• Gnmap-Parser - Gnmap-Parser takes multiple Nmap scans exported in greppable (.gnmap) format and parses them into various types of plain-text files for easy analysis.
• NullSecurity Tools - pen testing and security tools, exploits, proof of concepts, shellcodes, scripts