Pentest Tools

This page contain list of tools used for Pentest

Certification and Training

Website	Description
CompTIA	CompTIA PenTest+ is for cybersecurity professionals tasked with penetration testing and vulnerability management.
TCM Security Academy	TCM Security is a cybersecurity company that provides services for penetration testing, security training, and compliance services.
TryHackMe	Learn by following structured paths and reinforce your skills in a real-world environment by completing guided, objective-based tasks and challenges.
Hack The Box	Platform to test and advance your skills in penetration testing and cybersecurity.
PentesterLab	Hands-on training for web application security.
Offensive Security	Certifications, training, and labs, including the popular OSCP certification.
eLearnSecurity	Certifications and training in penetration testing and other areas of cybersecurity.

Frameworks and Platforms

Website	Description
Kali Linux	The most advanced penetration testing distribution.
BlackArch	An Arch Linux-based distribution for penetration testers and security researchers.
Parrot Security OS	Security GNU/Linux distribution designed for pen testing, forensic analysis, reverse engineering, and software development.
Slingshot	Designed to be stable, reliable, and lean. Includes many standard pen testing tools, as well as the PenTesters Framework (PTF).
ArchStrike	Arch Linux repository for security professionals and researchers.

Initial LookUp

Website	Description
ViewDNS	DNS Lookup (A, NS, MX, TXT, CNAME, etc.), reverse IP lookup, IP geolocation check, traceroute, ping IP or website, check if site is down, and Whois Lookup.
Shodan	Search engine for the Internet of Everything.
Have I Been Pwned?	Check if your email or phone is in a data breach.
SpiderFoot	Automate OSINT.
Netlas	Discover, research, and monitor any assets available online.
Maltego	Interactive data mining tool that renders directed graphs for link analysis.

Network Scanning

Website	Description
NMAP	Network scanning and vulnerability detection tool.
Masscan	Mass IP port scanner, similar to Nmap.
MetaSploit	Penetration testing software.
Burp Suite	Web vulnerability scanner and testing tool.
Nessus	Vulnerability scanner.
OpenVAS	Open-source vulnerability scanner.
Hydra	Password cracking tool.
Wireshark	Network protocol analyzer.
John the Ripper	Password cracker.
Intruder.io	Vulnerability scanner.
Recon-ng	Full-featured Web Reconnaissance framework written in Python.

Web Application Testing Tools

Website	Description
Powershell Empire	Post-exploitation framework.
Covenant	.NET command and control framework.
C2 Framework Matrix	Command and control framework comparison.
Mythic	C2 framework for red teams.
Nishang	Offensive PowerShell for red teaming.
Apfell	C2 framework for macOS.
Poseidon	C2 framework for macOS.
NoPowerShell	PowerShell without powershell.exe.
Netcat	Networking utility for reading from and writing to network connections.
PowerShdll	Run PowerShell without powershell.exe.
PowerLessShell	Run PowerShell scripts without powershell.exe.
Nikto	Web server scanner.

Collaboration and Reporting

Website	Description
Dradis	Collaboration and reporting tool for security assessments.

Proxy Tools

Website	Description
ProxyChains	Redirects TCP connections through proxy servers.

Debugging and Analysis

Website	Description
GDB (GNU Debugger)	Debugging tool for Linux executables.
OllyDbg	Binary code analysis tool.

Fuzzing and Exploitation Frameworks

Website	Description
Peach	Fuzzing framework.
Pacu	AWS exploitation framework.

Infrastructure and Data Discovery

Website	Description
CloudBrute	Tool for finding a company's infrastructure, files, and data.

Web Application Testing

Website	Description
Dirbuster	Directory and file brute-forcer.
w3af	Web application attack and audit framework.
Patator	Multi-purpose brute-forcer.
OWASP ZAP	Web application security scanner.

Network Analysis and Manipulation

Website	Description
tcpdump	Packet analyzer.
Aircrack-ng	WiFi network security assessment tool.
Gattacker	BLE Man-in-the-Middle tool.
Hping3	Packet generator and analyzer.
Scapy	Packet manipulation tool.

Wireless Security Tools

Website	Description
Wifite2	Wireless auditing tool.
Airodump-ng	802.11 frame capture tool.
Wifite	Wireless auditing tool.
Reaver	WPA attack tool.
Kismet	Wireless network detector, sniffer, and IDS.

Credential Extraction and Exploitation

Website	Description
Mimikatz	Credential extraction tool.
CrackMapExec	Post-exploitation tool.
Responder	LLMNR, NBT-NS, and MDNS poisoner.

Exploitation and Vulnerability Databases

Website	Description
ExploitDB	Exploit database.
SearchSploit	Local search tool for Exploit DB.

Steganography and Audio Analysis

Website	Description
Snow	CLI steganography tool.
Sonic Visualizer	Audio analysis tool.

Mobile Security Assessment

Website	Description
Drozer	Android security assessment framework.
Frida	Dynamic instrumentation toolkit.
MobSF	Mobile security framework for static and dynamic analysis.
Objection	Runtime mobile exploration tool.
iOS Secure App Development (ISAD)	Mobile security testing methodology.

Android Development and Analysis

Website	Description
Android SDK	Development kit for Android.
ApkX tool	APK decompiler.
apktool	Android application reverse engineering tool.
Androguard	Reverse engineering, malware, and goodware analysis of Android applications.
dex2jar	Tool to work with Android .dex and Java .class files.

Miscellaneous Tools

Website	Description
CeWL	Custom word list generator.
truffleHog	Searches git repositories for secrets.
Medusa	Parallel brute-forcer for network logins.
packETH	Packet crafting tool.
EAPHammer	WPA2-Enterprise attack tool.
Impacket Tools	Collection of Python classes for working with network protocols.
mitm6	IPv6 DNS hijacking tool.
SSLStrip	SSL/TLS stripping attack tool.
SQLmap	Automated SQL injection tool.
Cydia Substrate	Framework for modifying iOS apps.
iGoat	OWASP project for iOS mobile app security.
Needle	Modular framework for iOS security assessments.
cURL	Data transfer tool supporting various protocols.