Pentest Mapper Pentest Mapper is a Burp Suite extension that integrates the Burp Suite request logging with a custom application testing checklist. The extension provides a straightforward flow for application penetration testing. The extension...
The post Pentest Mapper: Burp Suite Extension for Application Penetration Testing appeared first on Penetration Testing Tools.
nysm: A stealth post-exploitation container With the rise in popularity of offensive tools based on eBPF, going from credential stealers to rootkits hiding their own PID, a question came to our mind: Would it...
The post nysm: A stealth post-exploitation container appeared first on Penetration Testing Tools.
EDRSandblast-GodFault Integrates GodFault into EDR Sandblast, achieving the same result without the use of any vulnerable drivers. EDRSandBlast is a tool written in C that weaponizes a vulnerable signed driver to bypass EDR detections (Notify Routine callbacks, Object...
The post EDRSandblast-GodFault: weaponize a vulnerable signed driver to bypass EDR detections appeared first on Penetration Testing Tools.
Flutter Spy Flutter Spy is a Bash-based command-line tool designed to provide insightful code analysis and data extraction capabilities from built Flutter apps with reverse engineering. It empowers developers, bug hunters, and security enthusiasts...
The post flutter-spy: Explore, analyze, and gain valuable data & insights from reverse engineered Flutter apps appeared first on Penetration Testing Tools.
HTMLSmuggler HTMLSmuggler – JS payload generator for IDS bypass and payload delivery via HTML smuggling. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion detection systems,...
The post HTMLSmuggler: JS payload generator for IDS bypass and payload delivery via HTML smuggling appeared first on Penetration Testing Tools.
OSINT Toolkit OSINT Toolkit is a full-stack web application designed to assist security analysts in their work. It combines various functions and services into a single tool, making it easier for analysts to identify...
The post OSINT Toolkit: full stack web application built for security analysts appeared first on Penetration Testing Tools.
PySQLRecon PySQLRecon is a Python port of the awesome SQLRecon project by @sanjivkawa. See the commands section for a list of capabilities. Commands All of the main modules from SQLRecon have equivalent commands. Commands noted with [PRIV] require elevated...
The post PySQLRecon: Offensive MSSQL toolkit written in Python appeared first on Penetration Testing Tools.
Introducing the ROP ROCKET This new, advanced ROP framework made its debut at DEF CON 31 with some unprecedented capabilities. ROCKET generates several types of chains, and it provides new patterns or techniques. Please...
The post ROP ROCKET: an advanced code-reuse attack framework appeared first on Penetration Testing Tools.
go-secdump Package go-secdump is a tool built to remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without...
The post go-secdump: remotely dump secrets from the Windows registry appeared first on Penetration Testing Tools.
iMonitor iMonitor (Endpoint Behavior Analysis System – Then Open Source Procmon) is an endpoint behavior monitoring and analysis software based on iMonitorSDK. Provides monitoring of system behaviors such as processes, files, registry, and networks. Support...
The post iMonitor: Endpoint Behavior Analysis System appeared first on Penetration Testing Tools.
Krueger Krueger is a Proof of Concept (PoC) .NET post-exploitation tool for remotely killing Endpoint Detection and Response (EDR) as apart of lateral movement procedures. Krueger accomplishes this task by utilizing Windows Defender Application...
The post Krueger: Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC appeared first on Penetration Testing Tools.
ShellSweep “ShellSweep” is a PowerShell/Python/Lua tool designed to detect potential webshell files in a specified directory. ShellSheep and its suite of tools calculate the entropy of file contents to estimate the likelihood of a...
The post ShellSweep: detect potential webshell files in a specified directory appeared first on Penetration Testing Tools.
What is PurpleLab? This solution will allow you to easily deploy an entire lab to create/test your detection rules, simulate logs, play tests, download and run malware and mitre attack techniques, restore the sandbox,...
The post PurpleLab: Revolutionizing Cybersecurity Testing with Speed and Simplicity appeared first on Penetration Testing Tools.
ShodanX ShodanX ⚡ is a versatile information gathering tool that harnesses the power of Shodan’s extensive database. it offers multiple modes and flexible queries to extract valuable insights for security assessments, reconnaissance, and threat...
The post ShodanX: A tool to gather information of targets using shodan dorks appeared first on Penetration Testing Tools.
AuthLogParser AuthLogParser is a powerful Digital Forensics and Incident Response tool designed specifically for analyzing Linux authentication logs, commonly known as auth.log. This tool serves as an invaluable asset for Incident Responders, streamlining the...
The post AuthLogParser: analyzing Linux authentication logs appeared first on Penetration Testing Tools.
SecuSphere Welcome to SecuSphere, your one-stop solution for all DevSecOps needs. Our centralized platform is expertly designed to manage and optimize your vulnerability management, CI/CD pipeline integration, security assessments, and DevSecOps practices. SecuSphere is...
The post SecuSphere: comprehensive DevSecOps platform appeared first on Penetration Testing Tools.
VolWeb VolWeb is a digital forensic memory analysis platform that leverages the power of the Volatility 3 framework. It is dedicated to aiding in investigations and incident responses. Objective The goal of VolWeb...
The post VolWeb: A digital forensic memory analysis platform appeared first on Penetration Testing Tools.
NufSed C2 A next-generation, Python-based Command & Control (C2) framework equipped with chaos-key encryption, dynamic port assignment, and cross-platform payload generation. NufSed C2 is designed to simplify red team operations while increasing stealth and flexibility across...
The post NufSed C2: A next-generation, Python-based Command & Control (C2) framework appeared first on Penetration Testing Tools.
CureIAM Clean up of over permissioned IAM accounts on GCP infra in an automated way CureIAM is an easy-to-use, reliable, and performant engine for Least Privilege Principle Enforcement on GCP cloud infra. It enables...
The post CureIAM: Clean accounts over permissions in GCP infra at scale appeared first on Penetration Testing Tools.
Java Archive Implant Toolkit Inject malicious payloads into JAR files. Configuration JarPlant supports injection of custom values with the implants. A set of common configuration properties are defined with the template and built-in implants....
The post JarPlant: Java archive implant toolkit appeared first on Penetration Testing Tools.
