“UrBackup is an easy to setup Open Source client/server backup system, that through a combination of image and file backups accomplishes both data safety and a fast restoration time.” https://www.urbackup.org
CrackStation
“CrackStation is a security awareness project started by Defuse Security. Its purpose is to raise awareness about insecure password storage in web applications, and to provide guidance to implementors of user authentication systems. By making large hash lookup tables freely available to the public, we make it easier for security researchers to demonstrate why password […]
JET
A Bat to EXE Converter https://github.com/lightning-speed/JET
Exploit-DB, VulDB, AND Vulners
Exploit-db The Exploit Database is a CVE compliant archive of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. Our aim is to serve the most comprehensive collection of exploits gathered through direct submissions, mailing lists, as well as other public sources, and present them in a freely-available and […]
Aircrack-ng
Aircrack-ng is a complete suite of tools to assess WiFi network security. It focuses on different areas of WiFi security: All tools are command line which allows for heavy scripting. A lot of GUIs have taken advantage of this feature. It works primarily on Linux but also Windows, macOS, FreeBSD, OpenBSD, NetBSD, as well as […]
Domain Info
https://observatory.mozilla.org/ https://ns.tools/ https://mxtoolbox.com/ https://dnschecker.org/ https://dnslytics.com/ https://dnsdumpster.com/ https://www.ipvoid.com/ https://osint.sh/ https://www.ipaddress.com/ https://blacklistchecker.com/ https://www.dnsblacklist.org/
Nikto
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index […]
w3af
w3af is a Web Application Attack and Audit Framework. The project’s goal is to create a framework to help you secure your web applications by finding and exploiting all web application vulnerabilities. https://w3af.org/
Wapiti
Wapiti allows you to audit the security of your websites or web applications.It performs “black-box” scans (it does not study the source code) of the web application by crawling the webpages of the deployed webapp, looking for scripts and forms where it can inject data.Once it gets the list of URLs, forms and their inputs, […]
RapidScan
It is quite a fuss for a pentester to perform binge-tool-scanning (running security scanning tools one after the other) sans automation. Unless you are a pro at automating stuff, it is a herculean task to perform binge-scan for each and every engagement. The ultimate goal of this program is to solve this problem through automation; […]
WPScan
The WPScan CLI tool is a free, for non-commercial use, black box WordPress security scanner written for security professionals and blog maintainers to test the security of their sites. The WPScan CLI tool uses our database of 38,379 WordPress vulnerabilitie https://wpscan.com/ https://wpscan.org/?s..= https://github.com/wpscanteam/wpscan https://www.kali.org/tools/wpscan/
Metasploit
The Metasploit Framework is a Ruby-based, modular penetration testing platform that enables you to write, test, and execute exploit code. The Metasploit Framework contains a suite of tools that you can use to test security vulnerabilities, enumerate networks, execute attacks, and evade detection. At its core, the Metasploit Framework is a collection of commonly used […]
Cain & Abel
Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols. https://github.com/xchwarze/Cain
Dstrike
Dstrike.com
RTL-SDR (RTL2832U Software Defined Radio)
HARDWARE: https://www.rtl-sdr.com/ https://airspy.com/ https://www.nooelec.com/ SOFTWARE: SDR++ Gqrx SDRangel SatDump sdrtrunk dump1090 OTHERS: https://awesomeopensource.com/projects/rtl-sdr
sqlmap
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the […]
Nmap
Nmap (“Network Mapper”) is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available […]
Web Application Scanner GUIs
OWASP Zed Attack Proxy (ZAP) https://www.zaproxy.org/ Vega https://subgraph.com/vega/
Remote Access
https://remmina.org/ https://rport.io/ https://mremoteng.org/ https://guacamole.apache.org/ https://www.freerdp.com/ http://xrdp.org/ https://tigervnc.org/ https://uvnc.com/ https://winscp.net https://filezilla-project.org/ https://www.chiark.greenend.org.uk/~sgtatham/putty/ http://www.9bis.net/
SSL/TLS Tests
https://observatory.mozilla.org/ https://www.ssllabs.com/ssltest/ https://www.fairssl.net/en/ssltest https://www.immuniweb.com/ssl/ https://geekflare.com/tools/tls-test
Shodan and Cenys
Shodan https://www.shodan.io/ Censys https://search.censys.io/
Practice and Testing Sites
Vulnweb OverTheWire Hack This Site HellBound Hackers VulnHub scanme.nmap.org
RockYou! wordlists
RockYou 2009 RockYou was a company that developed widgets for MySpace and implemented applications for various social networks and Facebook. Since 2014, it has engaged primarily in the purchases of rights to classic video games; it incorporates in-game ads and re-distributes the games. In December 2009, the company experienced a data breach resulting in the […]
Password Lists and Dictionaries
SecLists keyspace.md (PSKracker) Kali wordlists