GhostStrike GhostStrike is an advanced cybersecurity tool designed for Red Team operations, featuring sophisticated techniques to evade detection and perform process hollowing on Windows systems. Feature Dynamic API Resolution: Utilizes a custom hash-based method to dynamically...
The post GhostStrike: The Undetectable Red Team Weapon appeared first on Penetration Testing Tools.
RustScan The Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting engine (Python, Lua, Shell supported). ✨ Features Scans all 65k ports in 3 seconds. Full scripting engine support. Automatically...
The post RustScan: Find all open ports fast with Rustscan appeared first on Penetration Testing Tools.
Vector Vector is a high-performance, end-to-end (agent & aggregator) observability data pipeline that puts you in control of your observability data. Collect, transform, and route all your logs, metrics, and traces to any vendors you want today and...
The post vector: High-Performance, Logs, Metrics, & Events Router appeared first on Penetration Testing Tools.
Infiltrax Infiltrax is a post-exploitation reconnaissance tool for penetration testers and red teams, designed to capture screenshots, retrieve clipboard contents, log keystrokes, bypass UAC and install AnyDesk for persistent remote access. Feature Screenshot Capture:...
The post InfiltraxInfiltrax: UAC Bypass, Keylogging, and Persistent Access for Penetration Testers appeared first on Penetration Testing Tools.
Ligolo-ng : Tunneling like a VPN An advanced, yet simple, tunneling tool that uses a TUN interface. Ligolo-ng is a simple, lightweight, and fast tool that allows pentesters to establish tunnels from a reverse TCP/TLS connection without the need of...
The post ligolo-ng: advanced tunneling/pivoting tool appeared first on Penetration Testing Tools.
echidna Echidna is a weird creature that eats bugs and is highly electrosensitive (with apologies to Jacob Stanley) More seriously, Echidna is a Haskell program designed for fuzzing/property-based testing of Ethereum smart contracts. It...
The post echidna: Ethereum fuzz testing framework appeared first on Penetration Testing Tools.
COMThanasia With this tool, you will be able to detect: Incorrect access control to a COM object (LaunchPermission , AccessPermission) – LPE through abusable COM methods, DCOM Authentication relaying. That’s PermissionHunter. Incorrect registry rights to...
The post COMThanasia: analyzing common vulnerabilities in COM appeared first on Penetration Testing Tools.
grapheneX In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more...
The post grapheneX: Automated System Hardening Framework appeared first on Penetration Testing Tools.
Termineter Termineter is a Python framework that provides a platform for the security testing of smart meters. It implements the C1218 and C1219 protocols for communication over an optical interface. Currently supported are Meters...
The post Termineter: Smart Meter Security Testing Framework appeared first on Penetration Testing Tools.
BAADTokenBroker BAADTokenBroker is a post-exploitation tool designed to leverage device-stored keys (Device key, Transport key etc..) to authenticate to Microsoft Entra ID. Use Import BAADTokenBroker in your target machine. PS C:\ > import-module .\BAADTokenBroker.ps1...
The post BAADTokenBroker: Bypassing Entra ID Conditional Access appeared first on Penetration Testing Tools.
lsassy Python library to remotely extract credentials. This library uses impacket projects to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Different lsass dumping methods are implemented in lsassy, and some option are provided to...
The post lsassy: Extract credentials from lsass remotely appeared first on Penetration Testing Tools.
BLAKE3 BLAKE3 is a cryptographic hash function that is: Much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2. Secure, unlike MD5 and SHA-1. And secure against length extension, unlike SHA-2. Highly parallelizable across any number of...
The post BLAKE3: The BLAKE3 cryptographic hash function appeared first on Penetration Testing Tools.
Argus Argus is an all-in-one, Python-powered toolkit designed to streamline the process of information gathering and reconnaissance. With a user-friendly interface and a suite of powerful modules, Argus empowers you to explore networks, web...
The post Argus: The Ultimate Information Gathering Toolkit appeared first on Penetration Testing Tools.
Loki: like Prometheus, but for logs. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost-effective and easy to operate. It does not index the contents...
The post Loki: horizontally-scalable, highly-available, multi-tenant log aggregation system appeared first on Penetration Testing Tools.
ssh-mitm – intercept ssh traffic ssh-mitm is an intercepting (mitm) proxy server for security audits. Redirect/mirror Shell to another ssh client supported in 0.2.8 Replace File in SCP supported in 0.2.6 Replace File in SFTP...
The post ssh-mitm: intercepting proxy server for security audits appeared first on Penetration Testing Tools.
Kraken Kraken is a powerful, Python-based tool designed to centralize and streamline various brute-forcing tasks. Kraken provides a suite of tools for cybersecurity professionals to efficiently perform brute-force attacks across a range of protocols and...
The post Kraken: All-in-One Toolkit for BruteForce Attacks appeared first on Penetration Testing Tools.
Cryptomator Cryptomator is provided free of charge as an open-source project despite the high development effort and is therefore dependent on donations. Cryptomator offers multi-platform transparent client-side encryption of your files in the cloud....
The post cryptomator: Multi-platform transparent client-side encryption of your files in the cloud appeared first on Penetration Testing Tools.
kics KICS stands for Keeping Infrastructure as Code Secure, it is open source and is a must-have for any cloud-native project. Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx....
The post kics: Find security vulnerabilities, compliance issues, and infrastructure misconfigurations appeared first on Penetration Testing Tools.
LayeredSyscall Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR hooks in Windows. The general idea is to generate a legitimate call stack before...
The post LayeredSyscall – Abusing Vectored Exception Handling to Bypass EDRs appeared first on Penetration Testing Tools.
Remote Method Guesser Remote Method Guesser (rmg) is a command-line utility written in Java and can be used to identify security vulnerabilities on Java RMI endpoints. Currently, the following operations are supported: List available bound names and their...
The post Remote Method Guesser: Java RMI enumeration and bruteforce of remote methods appeared first on Penetration Testing Tools.
