What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy (a measure of randomness) and if they are a Linux/Unix ELF type executable. Some malware for...
The post sandfly-entropyscan: detect packed or encrypted binaries related to malware appeared first on Penetration Testing Tools.
This repository contains a suite of Burp Suite extensions developed in Jython, designed to enhance the capabilities of penetration testers and security researchers when interacting with AI applications and performing prompt-based security testing. The...
The post Verizon Burp Extensions: Powering AI Security Testing with Jython Tools appeared first on Penetration Testing Tools.
Admin Panel Finder A Burp Suite extension that enumerates infrastructure and application Admin Interfaces. OWASP References: Classification: Web Application Security Testing > 02-Configuration and Deployment Management Testing OTG v4: OWASP OTG-CONFIG-005 WSTG: WSTG-CONF-05 Why should...
The post Admin Panel Finder: enumerates infrastructure and application Admin Interfaces appeared first on Penetration Testing Tools.
Welcome to the RedInfraCraft (V2) Tool – your gateway to automating the deployment of robust red team infrastructures! RedInfraCraft is your trusted companion in effortlessly setting up and managing red team infrastructures, streamlining the process so...
The post RedInfraCraft V2: Automate Your Red Team Infrastructure with Ease appeared first on Penetration Testing Tools.
WordPress webshell plugin for RCE A webshell plugin and interactive shell for pentesting a WordPress website. Features Webshell plugin for WordPress. Execute system commands via an API with ?action=exec. Download files from the remote system...
The post WordPress webshell plugin for RCE: webshell plugin and interactive shell for pentesting a WordPress website appeared first on Penetration Testing Tools.
Plaguards is a cutting-edge security tool built to streamline and automate the deobfuscation of obfuscated PowerShell scripts, empowering security teams to rapidly identify Indicators of Compromise (IOCs) and determine whether they represent valid threats...
The post Plaguards: Open Source PowerShell Deobfuscation and IOC Detection Engine for Blue Teams appeared first on Penetration Testing Tools.
goreplay GoReplay is an open-source network monitoring tool which can record your live traffic and use it for shadowing, load testing, monitoring, and detailed analysis. As your application grows, the effort required to test...
The post goreplay: open-source network monitoring tool appeared first on Penetration Testing Tools.
BOAZ (Bypass, Obfuscate, Adapt, Zero-trace) evasion was inspired by the concept of multi-layered approach which is the evasive version of defence-in-depth first mentioned in “One packer to rule them all” at BH USA14 (Swinnen...
The post BOAZ Evasion and Antivirus Testing Tool: Multilayered AV/EDR Evasion Framework appeared first on Penetration Testing Tools.
SilentMoonwalk SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from the control flow....
The post SilentMoonwalk: PoC Implementation of a fully dynamic call stack spoofer appeared first on Penetration Testing Tools.
Firebase, a versatile platform by Google, powers countless web and mobile applications with its extensive suite of services including real-time databases, authentication, cloud storage, and hosting. Its ubiquity and ease of use make it...
The post agneyastra: Firebase Misconfiguration Detection Toolkit appeared first on Penetration Testing Tools.
Quiet Riot An enumeration tool for scalable, unauthenticated validation of AWS principals; including AWS Account IDs, root e-mail addresses, users, and roles. Featureploitation Limits Throttling After performing extensive analysis of scaling methods using the...
The post Quiet Riot: enumeration tool for scalable, unauthenticated validation of AWS principals appeared first on Penetration Testing Tools.
A tool specifically designed for Kubernetes environments aims to efficiently and automatically discover hidden vulnerable APIs within clusters. It reveals and demonstrates a common error through a workshop format, which could lead to API...
The post KubeAPI-Inspector: Discover the secrets hidden in apis appeared first on Penetration Testing Tools.
BlackStone Project BlackStone project or “BlackStone Project” is a tool created in order to automate the work of drafting and submitting a report on audits of ethical hacking or pentesting. In this tool we...
The post BlackStone: Pentesting Reporting Tool appeared first on Penetration Testing Tools.
DetentionDodger is a tool designed to find users whose credentials have been leaked/compromised and the impact they have on the target. Install Local Installation To install, the only thing needed, is to install the...
The post DetentionDodger: Unmasking Leaked Credentials & Their Organizational Impact appeared first on Penetration Testing Tools.
WindowSpy WindowSpy is a Cobalt Strike Beacon Object File meant for targeted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents,...
The post WindowSpy: Cobalt Strike Beacon Object File meant for targeted user surveillance appeared first on Penetration Testing Tools.
In recent years, attacks targeting the Web Application Platform have been increasing rapidly. sisakulint is a static and fast SAST for GitHub Actions. This great tool can automatically validate yaml files according to the guidelines...
The post Boost Your GitHub Actions Security with sisakulint: Fast SAST for YAML appeared first on Penetration Testing Tools.
KubeStalk KubeStalk is a tool to discover Kubernetes and related infrastructure-based attack surfaces from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around...
The post kubestalk: discovers Kubernetes and related infrastructure based attack surface appeared first on Penetration Testing Tools.
SupplyShield is an open-source application security orchestration framework designed to secure your software supply chain from vulnerabilities, malicious dependencies, and unapproved base images. It provides a comprehensive solution to automate the detection, prioritization, and...
The post SupplyShield: Fortify Your Software Supply Chain appeared first on Penetration Testing Tools.
sh4d0wup Have you ever wondered if the update you downloaded is the same one everybody else gets or did you get a different one that was made just for you? Shadow updates are updates that...
The post sh4d0wup: Signing-key abuse and update exploitation framework appeared first on Penetration Testing Tools.
An AI-powered, self-hosted GitHub bot designed to detect and mitigate supply chain attacks in pull requests. SadGuard combines intelligent code analysis with executable behavior monitoring to secure your software pipeline. SadGuard was inspired by...
The post SadGuard: Dynamic Code Analysis + Supply Chain Detection Attack appeared first on Penetration Testing Tools.
