Penetration Testing Tools

HTTP parameter discovery suite that finds hidden query and POST parameters on web endpoints.

Browser exploitation framework for the assessment of web client and social-engineering security controls through hooked browser sessions.

Lightweight web security auditing proxy offering HTTP traffic interception and workflow automation.

TCP and UDP tunnel over HTTP secured with SSH, shipped as a single Go executable.

WinRM shell for Linux and Windows that supports authorized remote management, file transfers, and PowerShell execution during security reviews.

Fast web fuzzer written in Go for recursive directory discovery, content enumeration, and brute force scans of HTTP request parameters at scale.

Fast Go-based directory, DNS, and virtual host brute forcer with multiple modes for web application attack surface discovery.

Python library of classes and example tools for the construction, parsing, and interaction with Windows and Active Directory network protocols.

Tunneling and pivoting tool that creates reverse TUN interfaces without SOCKS or port forwarding.

Asynchronous TCP port scanner, rated by its author at up to 10 million packets per second, for large-scale asset and network discovery in authorized environments.

Penetration testing framework used to verify vulnerabilities, manage security assessments, and generate payloads.

Interactive HTTPS proxy for intercepting, inspecting, modifying, and replaying HTTP traffic.

Network service assessment tool for automating authentication checks, credential sprays, and Active Directory evaluations.

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LinPEAS, WinPEAS, and macPEAS scripts that audit Linux, Windows, and macOS systems for privilege escalation paths and exposed credentials.

LLMNR, NBT-NS, and mDNS poisoner that captures network credentials and runs rogue authentication servers during authorized internal assessments.

Modern Rust-based port scanner that maps open ports quickly and feeds results into Nmap for detailed follow-up service enumeration.

Command-line search tool for the Exploit Database that searches a local copy of exploits, shellcodes, and papers for disclosed vulnerabilities.

The security tester's wordlist collection: usernames, passwords, fuzzing payloads, and discovery lists.

Automated penetration testing tool that detects and exploits SQL injection flaws to assess database security configurations.

Web application firewall fingerprinting tool that identifies WAF products protecting a target.