versionscan

versionscan Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. PLEASE NOTE: Work is still in progress to adapt the tool to linux distributions that backport security fixe...

social-engineer-toolkit

The Social-Engineer Toolkit SET The Social-Engineer Toolkit is an open-source penetration testing framework for authorized social-engineering assessments. SET provides guided attack vectors for security teams that need to test user awareness, validate controls, and run consent-based red-team...

evil-winrm

Evil-WinRM !Version-shield !Ruby2.3-shield !Gem-Version !License-shield !Docker-shield The ultimate WinRM shell for hacking/pentesting Description & Purpose This shell is the ultimate WinRM shell for hacking/pentesting. WinRM Windows Remote Management is the Microsoft implementation of...

CMSsc4n

CMSsc4n Tool to identify if a domain has got a CMS and determine his version. At the moment, CMS's supported by CMSsc4n are WordPress,Moodle,Joomla,Drupal and Prestashop. Instalation You can download the latest version of CMSsc4n by cloning the GitHub repository: git clone...

BridgeBlock

BridgeBlock BridgeBlock is a menu bar app that prevents wireless bridging attacks by detecting bridging conditions and taking action. It also has a commandline version for system administrators. Sponsors: Installing GitLab Releases Zips of the both the GUI and CLI versions are provided in the...

reko

reko - a general purpose decompiler. Reko Swedish: "decent, obliging" is a decompiler for machine code binaries. This project is freely available under the GNU General Public License. The project consists of front ends, core decompiler engine, and back ends to help it achieve its goals. A...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

droopescan

droopescan A plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume n...

nodexp

NodeXP - Detection and Exploitation Tool for Node.js Services! NodeXP is an intergrated tool, written in Python 2.7, capable of detecting possible vulnerabilities on Node.js services as well as exploiting them in an automated way, based on ServerSideJavascriptInjection attack! Getting Started -...

foolav

foolav Executable compiled with this code is useful during penetration tests where there is a need to execute some payload meterpreter maybe? while being certain that it will not be detected by antivirus software. The only requirement is to be able to upload two files: binary executable and paylo...

WhatWeb

WhatWeb - Next generation web scanner Developed by Andrew Horton urbanadventurer and Brendan Coles bcoles Latest Release: v0.6.4. April 3, 2026 License: GPLv2 This product is subject to the terms detailed in the license agreement. For more information about WhatWeb visit...

magescan

Mage Scan The idea behind this is to evaluate the quality and security of a Magento site you don't have access to. The scenario when you're interviewing a potential developer or vetting a new client and want to have an idea of what you're getting into. Installation .phar Download the magescan.pha...

dnsrecon

DNSRecon DNSRecon is a Python port of a Ruby script that I wrote to learn the language and about DNS in early 2007. This time I wanted to learn about Python and extend the functionality of the original tool and in the process re-learn how DNS works and how could it be used in the process of a...

barrido

barrido Console utility to find web application paths. Still in alpha version. Examples Multiple URLs bruteforcing: $ cat urls.txt https://target.a.com https://target.b.com https://target.c.com $ barrido urls.txt wordlists/quickhits.txt -se | tee curiouspaths.txt https://target.c.com/manager/ 401...

detux

Detux: The Multiplatform Linux Sandbox Introduction: Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. QEMU hypervisor is used to emulate Linux Debian for various CPU architectures. The following CPUs are currently supported: x86 x86-64 AR...

vulscan

vulscan - Vulnerability Scanning with Nmap Introduction Vulscan is a module which enhances nmap to a vulnerability scanner. The nmap option -sV enables version detection per service which is used to determine potential flaws according to the identified product. The data is looked up in an offline...

nccfsas

Introduction This repository holds information released publicly by NCC Group's Full Spectrum Attack Simulation FSAS team...

mtr

WHAT IS MTR? mtr combines the functionality of the 'traceroute' and 'ping' programs in a single network diagnostic tool. As mtr starts, it investigates the network connection between the host mtr runs on and a user-specified destination host. It sends probes to the destination with successively...

NcStatusCheck

NcStatusCheck Centralized monitoring for multiple Nextcloud instances NcStatusCheck is a monitoring tool that lets you track the health of multiple Nextcloud servers from a single web interface: Nextcloud and PHP versions against their security floor, branch end of life, reachability, configurati...

kalimux

ABOUT TOOL : Kalimux is a bash based script which automatically installs kali linux in termux without any issue and without root. This tool works on both rooted Android device and Non-rooted Android device. AVAILABLE ON : Termux TESTED ON : Termux REQUIREMENTS : internet 1GB storage storage 400 M...