Frameworks Shell Social Engineering Tools Vulnerability scanner

Penetration Testing Tools Repo

  • Penetration Testing Tools Repo

    The purpose of this project is to make a single repository for all the commonly used penetration testing tools repo, typically tools that don’t exist within Kali or other penetration testing repo in  distros. In some cases, it makes sense to have the latest version of a tool separate to your distro installed stable binaries or scripts. Installing from GitHub allows you to grab the latest tools specific to your style of pen testing, tools that could be too niche to ever make it into your favorite security distro. Additionally, a seperate self-contained tool set within your home directory or /opt also allows for easy transportation from one (identical) machine to another.

    Installation Instructions

    1. Fork repo (allows you to make changes to your tools and or push to this repo)
    2. Git clone repo:
    git clone --recursive

    For some tools further installation will be required, e.g. building binaries / installing configuring tools to suit your requirements, below are links to each distro managers page with installation instructions for each.

    Update Instructions

    Update a single tool

    The following example uses nmap:

    cd penetration-testing-tools/infra/nmap/
    git pull

    Update penetration testing tools repo

    cd penetration-testing-tools/
    git submodule foreach git pull

    Contributing to the repo

    To contribute, send a pull request.

    Included Penetration Testing Tools repo

    SSL Testing Tools

    Location: /ssl-testing-tools

    Infrastructure of penetration testing tools repo

    Location: /infra

    Intrastructure pen testing tools:

    • Metasploit Framework – metasploit framework
    • Responder – LLMNR and NBT-NS Poisoning – capture passwords from typo’d smb \server-addresses on the network
    • proxychains-ng – pivoting
    • Net-creds – Sniffs sensitive data from interface or pcap
    • smbexec – A rapid psexec style attack with samba tools
    • dnsftp – Use only DNS queries to download a file, and then execute it
    • reGeorg – pivoting via socks proxies
    • sonar.js – A framework for identifying and launching exploits against internal network hosts
    • sonar.js – A framework for identifying and launching exploits against internal network hosts.
    • The Backdoor Factory – Patch PE, ELF, Mach-O binaries with shellcode – backdoor binaries so they continue to work normally
    • NMAP – NMAP the network mapper
    • Port Scan Automation – Automate NMAP scans and custom Nessus polices.


    Location: /redteam

    • Veil Framework – a red team toolkit focused on evading detection (AV evasion & target delivery)
    • Phising Frenzy – Ruby on Rails Phishing Framework


    Location: /recon

    • EyeWitness – Take screenshots of websites, provide some server header info, and identify default credentials if possible
    • Gitrob – Helps security professionals find sensitive information lingering in publicly available files on GitHub
    • recon-ng – Recon-ng is a full-featured Web Reconnaissance framework written in Python.
    • SpiderFoot – open source footprinting and intelligence-gathering tool.
    • SimplyEmail – Email recon made fast and easy


    Location: /shells


    Location: /wordlists

    Web App Penetration testing Tools repo

    Location: /web-app

    • SQLMap – sql injection automation
    • WafW00f – identify and fingerprint Web Application Firewall (WAF)
    • ICMP Reverse Shell – Simple reverse ICMP shell
    • WeBaCoo – Web Backdoor Cookie Script-Kit
    • Commix – Commix, automated injection based web vulnerability scanner
    • WIG – WebApp Information Gatherer
    • CMSmap – CMS vulnerability scanner
    • Droop Scan – A CMS vulnerability scanner for Drupal, WordPress, SilverStripe
    • WPScan – WPScan is a black box WordPress vulnerability scanner
    • NoSQLMap – Automated Mongo database and NoSQL web application exploitation tool
    • HTTPScreenShot – HTTPScreenshot is a tool for grabbing screenshots and HTML of large numbers of websites

    Source Code Audit

    SAST – SCR – Static Analysis

    Location: /source-code-audit

    • grAudit – simple script and signature sets that allows you to find potential security flaws in source code using grep
    • Brakeman – A static analysis security vulnerability scanner for Ruby on Rails applications

    Bruteforce Tools

    Location: /bruteforce

    • Pator – Patator is a multi-purpose brute-forcer
    • Crowbar – Bruteforcer – supports protocols not supported by THC-Hydra

    Windows Tools

    Location: /windows

    • Mimikatz – Extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets.
    • UAC Script – UAC Bypass Vulnerability in Windows Script Host

    Linux Scripts

    Location: linux


    Location: /powershell

    • Badadook – Connection-less Powershell Persistent and Resilient Backdoor
    • PowerShellEmpire – Empire is a pure PowerShell post-exploitation agent
    • PowerSploit – PowerSploit – A PowerShell Post-Exploitation Framework
    • Nishang – PowerShell for penetration testing and offensive security
    • BloodHound – BloodHound uses graph theory to reveal the hidden and often unintended relationships within an Active Directory environment


    Location: /rootkits

    • Azael – Azazel is a userland rootkit based off of the original LD_PRELOAD technique from Jynx rootkit

    Scripting Tools

    Location: /scripting

    • Babel SF – Babel Scripting Framework – a collection of custom scripts to facilitate useful pentest related functions via scripting languages

    Exploit Development

    Location: /exploit-dev

    • PEDA – PEDA – Python Exploit Development Assistance for GDB
    • ROPEME – ROPEME – ROP Exploit Made Easy
    • Ropper – ROP tool
    • Shellconv – Small tool for disassembling shellcode (using objdump)
    • PWNTools – CTF framework and exploit development library


    Location: /misc

    • Gnmap-Parser – Gnmap-Parser takes multiple Nmap scans exported in greppable (.gnmap) format and parses them into various types of plain-text files for easy analysis.
    • NullSecurity Tools – pen testing and security tools, exploits, proof of concepts, shellcodes, scripts

About the author

Mubassir patel

Mubassir is a founder and developer of this site. He is a computer science engineer. He has a very deep interest in ethical hacking, penetration testing, website development and including all technology topic.

Leave a Comment