EscalateGPT A powerful Python tool that leverages the power of OpenAI to analyze AWS IAM misconfigurations. Features 🛠️ EscalateGPT is a Python tool to identify IAM policy issues and enhance Tenable Cloud Security 💻 EscalateGPT retrieves...
The post EscalateGPT: leverages the power of OpenAI to analyze AWS IAM misconfigurations appeared first on Penetration Testing Tools.
sharem SHAREM is intended to be the ultimate Windows shellcode tool, with support to emulate over 12,000 WinAPIs, virtually all user-mode Windows syscalls, and SHAREM provides numerous new features. SHAREM was released on September...
The post sharem: ultimate Windows shellcode tool appeared first on Penetration Testing Tools.
Process Stomping A variation of ProcessOverwriting to execute shellcode on an executable’s section What is it Process Stomping, is a variation of hasherezade’s Process Overwriting and it has the advantage of writing a shellcode payload on...
The post Process Stomping: execute shellcode on an executable’s section appeared first on Penetration Testing Tools.
PurpleOps PurpleOps is a free, open-source web app to track Purple Team assessments. Create assessments aligned with MITRE ATT&CK, leveraging data from sources like Atomic Red Team and SIGMA. Centralise blue and red team...
The post PurpleOps: open-source self-hosted purple team management web application appeared first on Penetration Testing Tools.
What is BinAbsInspector? BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation...
The post BinAbsInspector: Vulnerability Scanner for Binaries appeared first on Penetration Testing Tools.
Invoke-SessionHunter Retrieve and display information about active user sessions on remote computers. No admin privileges are required. The tool leverages the remote registry service to query the HKEY_USERS registry hive on the remote computers....
The post Invoke-SessionHunter: Retrieve & display information about active user sessions on remote computers appeared first on Penetration Testing Tools.
shortscan Shortscan is designed to quickly determine which files with short filenames exist on an IIS webserver. Once a short filename has been identified the tool will try to automatically identify the full filename....
The post shortscan: An IIS short filename enumeration tool appeared first on Penetration Testing Tools.
Perform malware scan analysis of on-prem servers using AWS services Challenges with on-premises malware detection It can be difficult for security teams to continuously monitor all on-premises servers due to budget and resource constraints....
The post drs-malware-scan: Perform file-based malware scan on your on-prem servers with AWS appeared first on Penetration Testing Tools.
Amnesiac Amnesiac is a post-exploitation framework designed to assist with lateral movement within active directory environments. Amnesiac is being developed to bridge a gap on Windows OS, where post-exploitation frameworks are not readily available...
The post Amnesiac: lateral movement within active directory environments appeared first on Penetration Testing Tools.
DIAL Workloads on the cloud provide equal opportunities for hackers as much as they do for internal teams. Cloud-native companies are open to attacks from both outside forces and from within. With the ever-growing...
The post DIAL: centralised security misconfiguration detection framework appeared first on Penetration Testing Tools.
reFlutter This framework helps with Flutter apps reverse engineering using the patched version of the Flutter library which is already compiled and ready for app repacking. This library has a snapshot deserialization process modified...
The post reFlutter: Flutter Reverse Engineering Framework appeared first on Penetration Testing Tools.
RTI-Toolkit RTI-Toolkit is an open-source PowerShell toolkit for Remote Template Injection attacks. This toolkit includes a PowerShell script named PS-Templator.ps1 which can be used from both an attacking and defensive perspective. The following tables present...
The post RTI-Toolkit: open-source PowerShell toolkit for Remote Template Injection attacks appeared first on Penetration Testing Tools.
MSSqlPwner MSSqlPwner is an advanced and versatile pentesting tool designed to seamlessly interact and pwn MSSQL servers. That tool is based on impacket, which allows attackers to authenticate to databases using clear-text passwords NTLM...
The post MSSqlPwner: pentesting tool designed to seamlessly interact and pwn MSSQL servers appeared first on Penetration Testing Tools.
APIDetector APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false positives. It’s particularly useful for security professionals and developers who...
The post apidetector: Efficiently scan for exposed Swagger endpoints across web domains and subdomains appeared first on Penetration Testing Tools.
T3SF – Technical Tabletop Exercises Simulation Framework T3SF is a framework that offers a modular structure for the orchestration of events based on a master scenario events list (MSEL) together with a set of...
The post T3SF: Technical Tabletop Exercises Simulation Framework appeared first on Penetration Testing Tools.
PingRAT PingRAT secretly passes C2 traffic through firewalls using ICMP payloads. Features: Uses ICMP for Command and Control Undetectable by most AV/EDR solutions Written in Go Use Server Client Download Copyright (C) 2023
The post PingRAT: secretly passes C2 traffic through firewalls using ICMP payloads appeared first on Penetration Testing Tools.
ExtractBitlockerKeys A system administration or post-exploitation script to automatically extract the bitlocker recovery keys from a domain. Features Automatically gets the list of all computers from the domain controller’s LDAP. Multithreaded connections to extract...
The post ExtractBitlockerKeys: automatically extract the bitlocker recovery keys from a domain appeared first on Penetration Testing Tools.
Sekiryu This Ghidra Toolkit is a comprehensive suite of tools designed to streamline and automate various tasks associated with running Ghidra in Headless mode. This toolkit provides a wide range of scripts that can...
The post Sekiryu: Comprehensive toolkit for Ghidra headless appeared first on Penetration Testing Tools.
Detection Replay Framework DeRF (Detection Replay Framework) is an “Attacks As A Service” framework, allowing the emulation of offensive techniques and generation of repeatable detection samples from a UI – without the need for...
The post Detection Replay Framework: Unleashing Attack Emulation for Security Validation appeared first on Penetration Testing Tools.
Bob the Smuggler “Bob the Smuggler” is a tool that leverages HTML Smuggling Attack and allows you to create HTML files with embedded 7z/zip archives. The tool would compress your binary (EXE/DLL) into 7z/zip...
The post BobTheSmuggler: Leverages HTML Smuggling Attack appeared first on Penetration Testing Tools.
