In this section we will see the most powerful and used tools.
SSH Client Updated To Fix a Large Number of Security Vulnerabilities The free and open-source SSH client updated with the fix for a number of Security Vulnerabilities including the one in RSA key exchange and the latest version is PuTTY 0.71. PuTTY is an SSH and telnet client for the Read more…
Evil SMTP Server for pentesting SMTP clients MITMsmtp MITMsmtp is an Evil SMTP Server for pentesting SMTP clients to catch login credentials and mails sent over plain or SSL/TLS encrypted connections. The idea is to catch sensitive emails sent by clients which are not correctly verifying the SMTP servers identity Read more…
Secures secrets used by privileged users and machine identities Conjur provides secrets management and machine identity for modern infrastructure: Machine Authorization Markup Language (“MAML”), a role-based access policy language to define system components & their roles, privileges, and metadata A REST web service to: manage identity life cycles for humans and machines Read more…
Testing TLS/SSL encryption anywhere on any port testssl.sh is a free command line tool which checks a server’s service on any port for the support of TLS/SSLcyphers, protocols as well as some cryptographic flaws. Key features Clear output: you can tell easily whether anything is good or bad Ease of installation: It Read more…
AWS Security tools Bunch of scripts for AWS Pentest lambda/lambda_dumper.py – Script to Dump AWS Lambda functions lambda/lambda_backdoor.py – Backdoor AWS users iam/iam_user_enum – Bruteforce IAM usernames iam/assume_role_enum – Enumerate and Assume IAM Roles for privilege escalation eks/k8s_secrets_dumper.py – Kubernetes Secrets Dumper eks/pod_to_node_escape – Escape form k8s pod to the underlying container Read more…
mitm6 v0.2.2 releases: pwning IPv4 via IPv6 mitm6 is a pentesting tool that exploits the default configuration of Windows to take over the default DNS server. It does this by replying to DHCPv6 messages, providing victims with a link-local IPv6 address and setting the attackers host as default DNS server. As DNS Read more…
Interlace Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support. Install git clone https://github.com/codingo/Interlace.gitpython3 setup.py install Usage ARGUMENT DESCRIPTION (stdin) Pipe target lists from another application in comma-delimited format, CIDR notation, or as an individual host -t Specify a target or domain name either in Read more…
Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security’s premium reporting add-on for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage large environments and pentest scopes. For more information regarding Sn1per Read more…
hasherbasher This is a tool used to help exploit poorly designed authentication systems by locating ASCII strings that when MD5 hashed, result in raw bytes that could change SQL logic. How It Works When constructing SQL queries for authentication, if a prepared statement is not used – a user can Read more…
What is XSS Chef? XSS Chef is a small React.js application inspired by CyberChef, which provides users with a modular way to build JavaScript payloads to typically be used during penetration tests to demonstrate cross-site scripting vulnerabilities. A live copy of the application can be found here. What Can I Do with XSS Chef? Read more…