> For the complete documentation index, see [llms.txt](https://interlink.gitbook.io/process/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://interlink.gitbook.io/process/qa-1/qa/security-testing/penetration-testing/tools.md).

# Tools

**Penetration Testing Distributions**

* [Kali](https://www.kali.org/) - A Linux distribution designed for digital forensics and penetration testing
* [ArchStrike](https://archstrike.org/) - An Arch Linux repository for security professionals and enthusiasts
* [BlackArch](https://www.blackarch.org/) - Arch Linux-based distribution for penetration testers and security researchers
* [NST](http://networksecuritytoolkit.org/) - Network Security Toolkit distribution
* [Pentoo](http://www.pentoo.ch/) - Security-focused livecd based on Gentoo
* [BackBox](https://backbox.org/) - Ubuntu-based distribution for penetration tests and security assessments
* [Parrot](https://www.parrotsec.org/) - A distribution similar to Kali, with multiple architecture
* [Fedora Security Lab](https://labs.fedoraproject.org/en/security/) - Provides a safe test environment to work on security auditing, forensics, system rescue and teaching security testing methodologies.<br>

**Docker for Penetration Testing**

* `docker pull kalilinux/kali-linux-docker` [official Kali Linux](https://hub.docker.com/r/kalilinux/kali-linux-docker/)
* `docker pull owasp/zap2docker-stable` - [official OWASP ZAP](https://github.com/zaproxy/zaproxy)
* `docker pull wpscanteam/wpscan` - [official WPScan](https://hub.docker.com/r/wpscanteam/wpscan/)
* `docker pull pandrew/metasploit` - [docker-metasploit](https://hub.docker.com/r/pandrew/metasploit/)
* `docker pull citizenstig/dvwa` - [Damn Vulnerable Web Application (DVWA)](https://hub.docker.com/r/citizenstig/dvwa/)
* `docker pull wpscanteam/vulnerablewordpress` - [Vulnerable WordPress Installation](https://hub.docker.com/r/wpscanteam/vulnerablewordpress/)
* `docker pull hmlio/vaas-cve-2014-6271` - [Vulnerability as a service: Shellshock](https://hub.docker.com/r/hmlio/vaas-cve-2014-6271/)
* `docker pull hmlio/vaas-cve-2014-0160` - [Vulnerability as a service: Heartbleed](https://hub.docker.com/r/hmlio/vaas-cve-2014-0160/)
* `docker pull opendns/security-ninjas` - [Security Ninjas](https://hub.docker.com/r/opendns/security-ninjas/)
* `docker pull diogomonica/docker-bench-security` - [Docker Bench for Security](https://hub.docker.com/r/diogomonica/docker-bench-security/)
* `docker pull ismisepaul/securityshepherd` - [OWASP Security Shepherd](https://hub.docker.com/r/ismisepaul/securityshepherd/)
* `docker pull danmx/docker-owasp-webgoat` - [OWASP WebGoat Project docker image](https://hub.docker.com/r/danmx/docker-owasp-webgoat/)
* `docker-compose build && docker-compose up` - [OWASP NodeGoat](https://github.com/owasp/nodegoat#option-3---run-nodegoat-on-docker)
* `docker pull citizenstig/nowasp` - [OWASP Mutillidae II Web Pen-Test Practice Application](https://hub.docker.com/r/citizenstig/nowasp/)
* `docker pull bkimminich/juice-shop` - [OWASP Juice Shop](https://github.com/bkimminich/juice-shop#docker-container--)<br>

**Vulnerability Scanners**

* [Nexpose](https://www.rapid7.com/products/nexpose/) - Vulnerability Management & Risk Management Software
* [Nessus](http://www.tenable.com/products/nessus-vulnerability-scanner) - Vulnerability, configuration, and compliance assessment
* [Nikto](https://cirt.net/nikto2) - Web application vulnerability scanner
* [OpenVAS](http://www.openvas.org/) - Open Source vulnerability scanner and manager
* [OWASP Zed Attack Proxy](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project) - Penetration testing tool for web applications
* [Secapps](https://secapps.com/) - Integrated web application security testing environment
* [w3af](https://github.com/andresriancho/w3af) - Web application attack and audit framework
* [Wapiti](http://wapiti.sourceforge.net/) - Web application vulnerability scanner
* [WebReaver](http://www.webreaver.com/) - Web application vulnerability scanner for Mac OS X
* [DVCS Ripper](https://github.com/kost/dvcs-ripper) - Rip web accessible (distributed) version control systems: SVN/GIT/HG/BZR
* [arachni](https://github.com/Arachni/arachni) - Web Application Security Scanner Framework<br>

**Network Tools**

* [nmap](https://nmap.org/) - Free Security Scanner For Network Exploration & Security Audits
* [pig](https://github.com/rafael-santiago/pig) - A Linux packet crafting tool
* [tcpdump/libpcap](http://www.tcpdump.org/) - A common packet analyzer that runs under the command line
* [Wireshark](https://www.wireshark.org/) - A network protocol analyzer for Unix and Windows
* [Network Tools](http://network-tools.com/) - Different network tools: ping, lookup, whois, etc
* [netsniff-ng](https://github.com/netsniff-ng/netsniff-ng) - A Swiss army knife for for network sniffing
* [Intercepter-NG](http://sniff.su/) - a multifunctional network toolkit
* [SPARTA](http://sparta.secforce.com/) - Network Infrastructure Penetration Testing Tool
* [dnschef](http://thesprawl.org/projects/dnschef/) - A highly configurable DNS proxy for pentesters
* [DNSDumpster](https://dnsdumpster.com/) - Online DNS recon and search service
* [dnsenum](https://github.com/fwaeytens/dnsenum/) - Perl script that enumerates DNS information from a domain, attempts zone transfers, performs a brute force dictionary style attack, and then performs reverse look-ups on the results
* [dnsmap](https://github.com/makefu/dnsmap/) - Passive DNS network mapper
* [dnsrecon](https://github.com/darkoperator/dnsrecon/) - DNS Enumeration Script
* [dnstracer](http://www.mavetju.org/unix/dnstracer.php) - Determines where a given DNS server gets its information from, and follows the chain of DNS servers
* [passivedns-client](https://github.com/chrislee35/passivedns-client) - Provides a library and a query tool for querying several passive DNS providers
* [passivedns](https://github.com/gamelinux/passivedns) - A network sniffer that logs all DNS server replies for use in a passive DNS setup
* [Mass Scan](https://github.com/robertdavidgraham/masscan) - TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
* [Zarp](https://github.com/hatRiot/zarp) - Zarp is a network attack tool centered around the exploitation of local networks
* [mitmproxy](https://github.com/mitmproxy/mitmproxy) - An interactive SSL-capable intercepting HTTP proxy for penetration testers and software developers
* [mallory](https://github.com/justmao945/mallory) - HTTP/HTTPS proxy over SSH
* [Netzob](https://github.com/netzob/netzob) - Reverse engineering, traffic generation and fuzzing of communication protocols
* [DET](https://github.com/sensepost/DET) - DET is a proof of concept to perform Data Exfiltration using either single or multiple channel(s) at the same time
* [pwnat](https://github.com/samyk/pwnat) - punches holes in firewalls and NATs
* [dsniff](https://www.monkey.org/~dugsong/dsniff/) - a collection of tools for network auditing and pentesting
* [tgcd](http://tgcd.sourceforge.net/) - a simple Unix network utility to extend the accessibility of TCP/IP based network services beyond firewalls
* [smbmap](https://github.com/ShawnDEvans/smbmap) - a handy SMB enumeration tool
* [scapy](https://github.com/secdev/scapy) - a python-based interactive packet manipulation program & library
* [Dshell](https://github.com/USArmyResearchLab/Dshell) - Network forensic analysis framework
* [Debookee (MAC OS X)](http://www.iwaxx.com/debookee/) - Intercept traffic from any device on your network
* [Dripcap](https://github.com/dripcap/dripcap) - Caffeinated packet analyzer

\
**SSL Analysis Tools**

* [SSLyze](https://github.com/nabla-c0d3/sslyze) - SSL configuration scanner
* [sslstrip](https://www.thoughtcrime.org/software/sslstrip/) - a demonstration of the HTTPS stripping attacks
* [sslstrip2](https://github.com/LeonardoNve/sslstrip2) - SSLStrip version to defeat HSTS
* [tls\_prober](https://github.com/WestpointLtd/tls_prober) - fingerprint a server's SSL/TLS implementation

\
**Web exploitation**

* [WPScan](https://wpscan.org/) - Black box WordPress vulnerability scanner
* [SQLmap](http://sqlmap.org/) - Automatic SQL injection and database takeover tool
* [weevely3](https://github.com/epinna/weevely3) - Weaponized web shell
* [Wappalyzer](https://wappalyzer.com/) - Wappalyzer uncovers the technologies used on websites
* [cms-explorer](https://code.google.com/archive/p/cms-explorer/) - CMS Explorer is designed to reveal the the specific modules, plugins, components and themes that various CMS driven web sites are running.
* [joomscan](https://www.owasp.org/index.php/Category:OWASP_Joomla_Vulnerability_Scanner_Project) - Joomla CMS scanner
* [WhatWeb](https://github.com/urbanadventurer/WhatWeb) - Website Fingerprinter
* [BlindElephant](http://blindelephant.sourceforge.net/) - Web Application Fingerprinter
* [fimap](https://github.com/kurobeats/fimap) - Find, prepare, audit, exploit and even google automatically for LFI/RFI bugs
* [Kadabra](https://github.com/D35m0nd142/Kadabra) - Automatic LFI exploiter and scanner
* [Kadimus](https://github.com/P0cL4bs/Kadimus) - LFI scan and exploit tool
* [liffy](https://github.com/hvqzao/liffy) - LFI exploitation tool

####

#### Vulnerability Databases

* [NVD](https://nvd.nist.gov/) - US National Vulnerability Database
* [CERT](https://www.us-cert.gov/) - US Computer Emergency Readiness Team
* [OSVDB](https://blog.osvdb.org/) - Open Sourced Vulnerability Database
* [Bugtraq](http://www.securityfocus.com/) - Symantec SecurityFocus
* [Exploit-DB](https://www.exploit-db.com/) - Offensive Security Exploit Database
* [Fulldisclosure](http://seclists.org/fulldisclosure/) - Full Disclosure Mailing List
* [MS Bulletin](https://technet.microsoft.com/en-us/security/bulletins) - Microsoft Security Bulletin
* [MS Advisory](https://technet.microsoft.com/en-us/security/advisories) - Microsoft Security Advisories
* [Inj3ct0r](http://www.1337day.com/) - Inj3ct0r Exploit Database
* [Packet Storm](https://packetstormsecurity.com/) - Packet Storm Global Security Resource
* [SecuriTeam](http://www.securiteam.com/) - Securiteam Vulnerability Information
* [CXSecurity](http://cxsecurity.com/) - CSSecurity Bugtraq List
* [Vulnerability Laboratory](http://www.vulnerability-lab.com/) - Vulnerability Research Laboratory
* [ZDI](http://www.zerodayinitiative.com/) - Zero Day Initiative
* [Vulners](https://vulners.com) - Security database of software vulnerabilities

\
**Hex Editors**

* [HexEdit.js](https://hexed.it) - Browser-based hex editing
* [Hexinator](https://hexinator.com/) (commercial) - World's finest Hex Editor
* [HxD - Freeware Hex Editor and Disk Editor](https://mh-nexus.de/en/hxd/)

\
**Crackers**

* [John the Ripper](http://www.openwall.com/john/) - Fast password cracker
* [Online MD5 cracker](http://www.md5crack.com/) - Online MD5 hash Cracker
* [Hashcat](http://hashcat.net/hashcat/) - The more fast hash cracker
* [THC Hydra](http://sectools.org/tool/hydra/) - Another Great Password Cracker

\
**Windows Utils**

* [Sysinternals Suite](https://technet.microsoft.com/en-us/sysinternals/bb842062) - The Sysinternals Troubleshooting Utilities
* [Windows Credentials Editor](http://www.ampliasecurity.com/research/windows-credentials-editor/) - security tool to list logon sessions and add, change, list and delete associated credentials
* [mimikatz](http://blog.gentilkiwi.com/mimikatz) - Credentials extraction tool for Windows OS
* [PowerSploit](https://github.com/PowerShellMafia/PowerSploit) - A PowerShell Post-Exploitation Framework
* [Windows Exploit Suggester](https://github.com/GDSSecurity/Windows-Exploit-Suggester) - Detects potential missing patches on the target
* [Responder](https://github.com/SpiderLabs/Responder) - A LLMNR, NBT-NS and MDNS poisoner
* [Bloodhound](https://github.com/adaptivethreat/Bloodhound/wiki) - A graphical Active Directory trust relationship explorer
* [Empire](https://github.com/PowerShellEmpire/Empire) - Empire is a pure PowerShell post-exploitation agent
* [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration and tracing of the Windows kernel

\
**Reverse Engineering Tools**

* [IDA Pro](https://www.hex-rays.com/products/ida/) - A Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger
* [IDA Free](https://www.hex-rays.com/products/ida/support/download_freeware.shtml) - The freeware version of IDA v5.0
* [WDK/WinDbg](https://msdn.microsoft.com/en-us/windows/hardware/hh852365.aspx) - Windows Driver Kit and WinDbg
* [OllyDbg](http://www.ollydbg.de/) - An x86 debugger that emphasizes binary code analysis
* [Radare2](http://rada.re/r/index.html) - Opensource, crossplatform reverse engineering framework
* [x64\_dbg](http://x64dbg.com/) - An open-source x64/x32 debugger for windows
* [Immunity Debugger](http://debugger.immunityinc.com/) - A powerful new way to write exploits and analyze malware
* [Evan's Debugger](http://www.codef00.com/projects#debugger) - OllyDbg-like debugger for Linux
* [Medusa disassembler](https://github.com/wisk/medusa) - An open source interactive disassembler
* [plasma](https://github.com/joelpx/plasma) - Interactive disassembler for x86/ARM/MIPS. Generates indented pseudo-code with colored syntax code
* [peda](https://github.com/longld/peda) - Python Exploit Development Assistance for GDB
* [dnSpy](https://github.com/0xd4d/dnSpy) - dnSpy is a tool to reverse engineer .NET assemblies

<br>