BFScan – Tool for initial processing of APK / XAPK / DEX / JAR / WAR applications. Search for strings in source code and resources that look like URIs, paths, or secrets Generate raw...
The post BFScan: Uncover Hidden URLs, Paths, & Secrets in JAR/WAR/APK Files appeared first on Penetration Testing Tools.
VAmPI The Vulnerable API (Based on OpenAPI 3) VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a...
The post VAmPI: Vulnerable REST API with OWASP top 10 vulnerabilities appeared first on Penetration Testing Tools.
Beacon Object File (BOF) support has been at the cornerstone of capability for any modern C2 platform since its inception by Cobalt Strike 4.1 back in 2020. It was a major step forward towards...
The post BOF-PE: New PE Concept Revolutionizes C2 Capabilities with Full C++ Support appeared first on Penetration Testing Tools.
What is sandfly-entropyscan? sandfly-entropyscan is a utility to quickly scan files or running processes and report on their entropy (a measure of randomness) and if they are a Linux/Unix ELF type executable. Some malware for...
The post sandfly-entropyscan: detect packed or encrypted binaries related to malware appeared first on Penetration Testing Tools.
This repository contains a suite of Burp Suite extensions developed in Jython, designed to enhance the capabilities of penetration testers and security researchers when interacting with AI applications and performing prompt-based security testing. The...
The post Verizon Burp Extensions: Powering AI Security Testing with Jython Tools appeared first on Penetration Testing Tools.
Admin Panel Finder A Burp Suite extension that enumerates infrastructure and application Admin Interfaces. OWASP References: Classification: Web Application Security Testing > 02-Configuration and Deployment Management Testing OTG v4: OWASP OTG-CONFIG-005 WSTG: WSTG-CONF-05 Why should...
The post Admin Panel Finder: enumerates infrastructure and application Admin Interfaces appeared first on Penetration Testing Tools.
Welcome to the RedInfraCraft (V2) Tool – your gateway to automating the deployment of robust red team infrastructures! RedInfraCraft is your trusted companion in effortlessly setting up and managing red team infrastructures, streamlining the process so...
The post RedInfraCraft V2: Automate Your Red Team Infrastructure with Ease appeared first on Penetration Testing Tools.
WordPress webshell plugin for RCE A webshell plugin and interactive shell for pentesting a WordPress website. Features Webshell plugin for WordPress. Execute system commands via an API with ?action=exec. Download files from the remote system...
The post WordPress webshell plugin for RCE: webshell plugin and interactive shell for pentesting a WordPress website appeared first on Penetration Testing Tools.
Plaguards is a cutting-edge security tool built to streamline and automate the deobfuscation of obfuscated PowerShell scripts, empowering security teams to rapidly identify Indicators of Compromise (IOCs) and determine whether they represent valid threats...
The post Plaguards: Open Source PowerShell Deobfuscation and IOC Detection Engine for Blue Teams appeared first on Penetration Testing Tools.
goreplay GoReplay is an open-source network monitoring tool which can record your live traffic and use it for shadowing, load testing, monitoring, and detailed analysis. As your application grows, the effort required to test...
The post goreplay: open-source network monitoring tool appeared first on Penetration Testing Tools.
BOAZ (Bypass, Obfuscate, Adapt, Zero-trace) evasion was inspired by the concept of multi-layered approach which is the evasive version of defence-in-depth first mentioned in “One packer to rule them all” at BH USA14 (Swinnen...
The post BOAZ Evasion and Antivirus Testing Tool: Multilayered AV/EDR Evasion Framework appeared first on Penetration Testing Tools.
SilentMoonwalk SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from the control flow....
The post SilentMoonwalk: PoC Implementation of a fully dynamic call stack spoofer appeared first on Penetration Testing Tools.
Firebase, a versatile platform by Google, powers countless web and mobile applications with its extensive suite of services including real-time databases, authentication, cloud storage, and hosting. Its ubiquity and ease of use make it...
The post agneyastra: Firebase Misconfiguration Detection Toolkit appeared first on Penetration Testing Tools.
Quiet Riot An enumeration tool for scalable, unauthenticated validation of AWS principals; including AWS Account IDs, root e-mail addresses, users, and roles. Featureploitation Limits Throttling After performing extensive analysis of scaling methods using the...
The post Quiet Riot: enumeration tool for scalable, unauthenticated validation of AWS principals appeared first on Penetration Testing Tools.
A tool specifically designed for Kubernetes environments aims to efficiently and automatically discover hidden vulnerable APIs within clusters. It reveals and demonstrates a common error through a workshop format, which could lead to API...
The post KubeAPI-Inspector: Discover the secrets hidden in apis appeared first on Penetration Testing Tools.
BlackStone Project BlackStone project or “BlackStone Project” is a tool created in order to automate the work of drafting and submitting a report on audits of ethical hacking or pentesting. In this tool we...
The post BlackStone: Pentesting Reporting Tool appeared first on Penetration Testing Tools.
DetentionDodger is a tool designed to find users whose credentials have been leaked/compromised and the impact they have on the target. Install Local Installation To install, the only thing needed, is to install the...
The post DetentionDodger: Unmasking Leaked Credentials & Their Organizational Impact appeared first on Penetration Testing Tools.
WindowSpy WindowSpy is a Cobalt Strike Beacon Object File meant for targeted user surveillance. The goal of this project was to trigger surveillance capabilities only on certain targets, e.g. browser login pages, confidential documents,...
The post WindowSpy: Cobalt Strike Beacon Object File meant for targeted user surveillance appeared first on Penetration Testing Tools.
In recent years, attacks targeting the Web Application Platform have been increasing rapidly. sisakulint is a static and fast SAST for GitHub Actions. This great tool can automatically validate yaml files according to the guidelines...
The post Boost Your GitHub Actions Security with sisakulint: Fast SAST for YAML appeared first on Penetration Testing Tools.
KubeStalk KubeStalk is a tool to discover Kubernetes and related infrastructure-based attack surfaces from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around...
The post kubestalk: discovers Kubernetes and related infrastructure based attack surface appeared first on Penetration Testing Tools.
