Penetration Testing Tools - Metepreter.org

The Scattered Spider group has intensified its assaults on corporate IT environments, concentrating its efforts on VMware ESXi hypervisors within U.S. companies across the retail, transportation, and insurance sectors. Rather than exploiting conventional software...

The post Scattered Spider Unleashes VMware ESXi Ransomware on US Retail, Transport & Insurance via Social Engineering appeared first on Penetration Testing Tools.

Rekono combines other hacking tools and its results to execute complete pentesting processes against a target in an automated way. The findings obtained during the executions will be sent to the user via email...

The post rekono: Execute complete pentesting processes appeared first on Penetration Testing Tools.

Microsoft has acknowledged that its July security updates failed to fully address vulnerabilities in on-premises versions of SharePoint, leaving systems susceptible to remote code execution. As a result, targeted attacks have continued, with experts...

The post Microsoft: SharePoint Zero-Day Exploit Leaked, Bypassed Patch, and Actively Attacked By China-Linked APTs appeared first on Penetration Testing Tools.

Researchers have uncovered two parallel malicious campaigns targeting vulnerable and misconfigured components of cloud infrastructure. Both operations involve the deployment of cryptominers and are attributed to groups designated as Soco404 and Koske—whose activities have...

The post Cloud Cryptominers Evolve: Koske & Soco404 Use Stealthy Tactics, AI-Generated Malware & Image Payloads appeared first on Penetration Testing Tools.

The FortiGuard Labs team has published an in-depth analysis of a heavily obfuscated web shell that was used in an attack targeting critical infrastructure in the Middle East. The research focuses on a script...

The post FortiGuard Labs Uncovers Highly Obfuscated Web Shell “UpdateChecker.aspx” Targeting Middle East Critical Infrastructure appeared first on Penetration Testing Tools.

At the inaugural DistrictCon Junkyard competition, analysts from Trail of Bits vividly demonstrated the grave risks posed by outdated networking devices left without updates. During the event, they remotely compromised two discontinued products—the Netgear...

The post Outdated Netgear Router & Bitdefender Box V1 Exploited for Full Remote Control appeared first on Penetration Testing Tools.

Veteran Linux kernel developer Sasha Levin, currently at NVIDIA and formerly with Google and Microsoft, has proposed the formal inclusion of guidelines for the use of AI assistants in kernel development within the official...

The post NVIDIA Dev Proposes Formal AI Guidelines for Linux Kernel Contributions: “Co-Developed-By” Tag & Configs for Claude, Copilot & More appeared first on Penetration Testing Tools.

Packj flags malicious/risky open-source packages Packj (pronounced package) is a command-line (CLI) tool to vet open-source software packages for “risky” attributes that make them vulnerable to supply chain attacks. This is the tool behind...

The post packj: detect malicious/risky open-source software packages appeared first on Penetration Testing Tools.

The threat group known as Patchwork—also operating under aliases such as APT-C-09, APT-Q-36, Chinastrats, Dropping Elephant, Operation Hangover, Quilted Tiger, and Zinc Emerson—has launched a new targeted phishing campaign aimed at Turkey’s defense sector....

The post Patchwork APT Targets Turkey’s Defense Sector: Indian Cyber-Espionage Group Seeks Hypersonic & UAV Secrets appeared first on Penetration Testing Tools.

The Tails project has released a new version of its security- and privacy-focused operating system. Update 6.18 introduces a significant enhancement that enables users to circumvent internet censorship—even in the most heavily monitored regions....

The post Tails 6.18 Unveiled: New WebTunnel Bridges Bypass Internet Censorship appeared first on Penetration Testing Tools.

RESTler What is RESTler? RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services. For a given cloud service...

The post restler-fuzzer: first stateful REST API fuzzing tool appeared first on Penetration Testing Tools.

Amid the looming end of support for Windows 10 in October 2025 and the stringent hardware requirements imposed by Windows 11, many users find themselves in search of viable alternatives. One of the most...

The post Operese: New Rust Tool Simplifies Windows 10 to Linux Migration Before EOL Hits appeared first on Penetration Testing Tools.

An unusual attack targeting Linux servers has unveiled a new echelon of malware obfuscation—and possibly, its artificial origin. Researchers at AquaSec have documented a threat dubbed Koske, which hides within seemingly innocuous images of...

The post Koske Malware: AI-Generated Cryptojacker Hides in Panda Images, Targets Linux Servers with Rootkit Stealth appeared first on Penetration Testing Tools.

Law enforcement agencies have conducted a sweeping international operation to dismantle the digital infrastructure of one of the most prolific ransomware enterprises of the past decade—BlackSuit. This cybercriminal syndicate was responsible for hundreds of...

The post Operation Checkmate: BlackSuit Ransomware Sites Seized, But Is “Chaos” Their Next Rebrand? appeared first on Penetration Testing Tools.

The wave of attacks targeting vulnerabilities in Microsoft SharePoint continues to escalate, reaching levels of sophistication and scale not witnessed since the mass infections orchestrated by LockBit. According to Microsoft, the breaches are attributed...

The post SharePoint Under Siege: China-Linked Storm-2603 Unleashes Warlock Ransomware After Zero-Day Exploitation appeared first on Penetration Testing Tools.

Researchers at CYFIRMA have issued a warning about a new wave of cyberattacks leveraging malicious Android applications disguised as legitimate banking clients. These apps are designed to steal user credentials, intercept messages, and execute...

The post New Android Banking Malware Targets Indian Banks: Steals Credentials, Intercepts OTPs via Fake Apps appeared first on Penetration Testing Tools.

ropr ropr is a blazing fast multithreaded ROP Gadget finder What is an ROP Gadget? ROP (Return Oriented Programming) Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which...

The post ropr: blazing fast multithreaded ROP Gadget finder appeared first on Penetration Testing Tools.

In the first half of 2025, researchers observed the active exploitation of a new malware loader known as CastleLoader. Since its emergence, this tool has become a central element in the distribution infrastructure for...

The post CastleLoader Unleashed: New Stealthy Malware Loader Leverages ClickFix & Fake GitHub for Widespread Infections appeared first on Penetration Testing Tools.

TerraformGoat TerraformGoat is HuoCorp research lab’s “Vulnerable by Design” multi-cloud deployment tool. Currently, supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, and Microsoft Azure. Scenarios ID...

The post TerraformGoat: “Vulnerable by Design” multi cloud deployment tool appeared first on Penetration Testing Tools.

The Leak Zone forum — widely known as a hub for publishing and distributing hacked databases, stolen credentials, and pirated software — has ironically become the source of a major data breach. According to...

The post Leak Zone Forum’s Own Elasticsearch Database Exposed, Revealing 22M+ User Records appeared first on Penetration Testing Tools.