7z
List and extract zip, 7z, rar, and other archives found on a host or in loot.
- Enumeration
- Post-exploitation
- Productivity
- LGPL
- Free
FIELD KIT
Pentesting tools directory
A curated catalog of pentesting tools. Content stays in the language you pick; nothing falls back in silence.
Amass
Attack-surface mapping and discovery of domains, ASNs, and infrastructure.
- Recon
- Network
- Web
- Apache-2.0
- Free
AntSword
Cross-platform GUI client for managing an authorized web shell left on a compromised host during post-exploitation.
- Post-exploitation
- Web
- MIT
- Free
arpspoof
Classic ARP cache poisoning tool from the dsniff suite, used to redirect traffic on a switched LAN segment for on-path testing.
- Exploitation
- Network
- BSD-style
- Free
Autorize
Free Burp extension that automates authorization testing by replaying every request with a lower-privileged session.
- Exploitation
- Web
- No license (source-available)
- Free
E-AWSAWS
Web console for manually inspecting AWS IAM, S3, EC2, and other services in scope.
- Enumeration
- Cloud
- Proprietary
- Freemium
AWS CLI
Official command-line interface for scripting and enumerating AWS resources — IAM, S3, EC2, and more.
- Enumeration
- Cloud
- Apache-2.0
- Free
az
Official command-line tool for enumerating and managing Azure resources — RBAC, storage, VMs, and more.
- Enumeration
- Cloud
- MIT
- Free
BeEF
Browser Exploitation Framework for demonstrating real-world impact once an authorized XSS finding hooks a browser.
- Exploitation
- Post-exploitation
- Web
- GPL-2.0
- Free
Behinder
Java-based GUI client for administering an authorized web shell over a dynamically encrypted, memory-capable channel.
- Post-exploitation
- Web
- No license (source-available)
- Free
BloodHound
Active Directory graphs for abuse paths and privilege relationships.
- Post-exploitation
- Enumeration
- Active Directory
- Apache-2.0
- Free
Burp Collaborator
Out-of-band interaction service built into Burp Suite Pro/Enterprise for confirming blind SSRF, XXE, and command injection.
- Enumeration
- Exploitation
- Web
- Commercial
- Paid
Burp HTTP Request Smuggler
PortSwigger's free BApp Store extension for detecting and exploiting HTTP request smuggling and desync vulnerabilities.
- Exploitation
- Web
- Apache-2.0
- Free
Burp Intruder
Burp Suite's built-in customizable attack tool for automating fuzzing, brute-force, and parameter-manipulation attacks.
- Exploitation
- Web
- Commercial
- Freemium
Burp Param Miner
PortSwigger's free BApp Store extension that discovers hidden, unlinked HTTP parameters and web cache poisoning vectors.
- Exploitation
- Web
- Apache-2.0
- Free
Burp Suite
Intercepting proxy and web lab; Community is free, Professional is paid.
- Enumeration
- Exploitation
- Web
- Commercial
- Freemium
Burp Turbo Intruder
PortSwigger's free, Python-scriptable Burp extension for high-throughput HTTP requests — built for race conditions and large-scale attacks.
- Exploitation
- Web
- AGPL-3.0
- Free
can-they.sh
Bash helper from Bishop Fox's badPods that batch-runs kubectl auth can-i to map what a pod's service account can actually do.
- Enumeration
- Cloud
- MIT
- Free
capsh
Capability shell wrapper from libcap, used to inspect and test the Linux capabilities available to a process.
- Post-exploitation
- Cloud
- BSD-3-Clause OR GPL-2.0
- Free
chisel
Fast TCP/UDP tunnel over HTTP, used to pivot traffic through a compromised host into an internal network segment.
- Post-exploitation
- Network
- MIT
- Free
Chrome DevTools
Chrome's built-in developer tools for inspecting network traffic, storage, and JavaScript execution live in the browser.
- Recon
- Enumeration
- Web
- BSD-3-Clause (Chromium)
- Free
commix
Automated command-injection detection and exploitation tool that turns a vulnerable parameter into a semi-interactive shell.
- Exploitation
- Web
- GPL-3.0
- Free
confused
Go CLI that checks a project's dependency manifest against public registries to flag packages that could be hijacked via dependency confusion.
- Recon
- Enumeration
- Web
- MIT
- Free
CORScanner
Python scanner that sends crafted Origin headers to find and confirm CORS misconfigurations at scale.
- Exploitation
- Web
- MIT
- Free
cosign
Signs and verifies container images and artifacts as part of the Sigstore supply-chain project.
- Enumeration
- Cloud
- Apache-2.0
- Free
crackmapexec
Swiss-army-knife tool for validating credentials and enumerating access across many Windows/AD hosts at once over SMB, WinRM, MSSQL, and LDAP.
- Enumeration
- Exploitation
- Active Directory
- BSD-2-Clause
- Free
Crane
CLI for pulling, pushing, and inspecting container images and manifests straight from a registry, no daemon required.
- Enumeration
- Cloud
- Apache-2.0
- Free
crictl
CLI for any CRI-compatible runtime, used to inspect and debug pods and containers at the Kubernetes node level.
- Post-exploitation
- Cloud
- Apache-2.0
- Free
crt.sh
Certificate Transparency log search engine used to enumerate subdomains from issued TLS certificates.
- Recon
- Web
- Free service
- Free
ctr
Low-level CLI for containerd, used to inspect and manage containers directly when Docker is not present.
- Post-exploitation
- Cloud
- Apache-2.0
- Free
curl
Transfer data to or from a URL — the default way to probe HTTP, APIs, and TLS by hand.
- Recon
- Enumeration
- Web
- Network
- curl License
- Free
dalfox
Fast, parameter-analysis-based XSS scanner written in Go, built for automation and pipeline use.
- Exploitation
- Web
- MIT
- Free
dig
Query DNS records directly — A, AAAA, MX, NS, TXT, and the rest — from BIND’s CLI.
- Recon
- Network
- MPL-2.0
- Free
Dive
Explores a container image layer by layer to find secrets, bloat, or misconfigurations baked into the build.
- Enumeration
- Cloud
- MIT
- Free
Docker
The standard container CLI and daemon for running, inspecting, and breaking out of containers on a compromised host.
- Post-exploitation
- Cloud
- Apache-2.0
- Free
DOM Invader
Client-side testing tool built into Burp Suite's embedded browser for finding DOM XSS and DOM clobbering.
- Enumeration
- Exploitation
- Web
- Commercial
- Freemium
DotDotPwn
Perl-based fuzzer that automates directory-traversal and file-inclusion payload testing across HTTP, FTP, TFTP, and more.
- Exploitation
- Web
- GPL-3.0
- Free
Dradis
Platform for centralizing evidence and assembling the engagement report.
- Reporting
- Web
- Network
- Active Directory
- GPL-2.0
- Freemium
eksctl
Official CLI for creating and managing Amazon EKS clusters, used to enumerate cluster and node-group configuration.
- Enumeration
- Cloud
- Apache-2.0
- Free
enum4linux-ng
Modernized rewrite of enum4linux for enumerating SMB/RPC shares, users, groups, and password policy on Windows/Samba hosts.
- Enumeration
- Network
- GPL-3.0
- Free
etcdctl
Official command-line client for etcd, the key-value store behind Kubernetes, used to enumerate and read data from an exposed or misconfigured cluster.
- Enumeration
- Post-exploitation
- Network
- Apache-2.0
- Free
etcdutl
Offline etcd maintenance utility for inspecting and restoring cluster snapshots without a running etcd server.
- Enumeration
- Post-exploitation
- Network
- Apache-2.0
- Free
evil-winrm
Ruby-based WinRM client for opening an authenticated remote PowerShell session on a Windows host.
- Post-exploitation
- Active Directory
- GPL-3.0
- Free
feroxbuster
Fast, recursive content-discovery scanner for directories and files, written in Rust.
- Recon
- Enumeration
- Web
- MIT
- Free
ffuf
Fast web fuzzer for directories, files, parameters, and virtual hosts.
- Recon
- Enumeration
- Web
- MIT
- Free
find
Walk a filesystem and match files by name, type, or permission — the usual loot search on Linux.
- Enumeration
- Post-exploitation
- Productivity
- GPL-3.0
- Free
fping
Fast parallel ICMP ping sweeper for discovering live hosts across large ranges.
- Recon
- Enumeration
- Network
- BSD-style
- Free
frida
Dynamic code instrumentation toolkit for Android, iOS, and Linux x86/ARM/MIPS.
- Exploitation
- Mobile
- Apache-2.0
- Free
GadgetProbe
Burp extension and Java library that fingerprints which classes sit on a remote Java classpath via blind deserialization, before firing a full gadget chain.
- Exploitation
- Web
- MIT
- Free
gau
Fetches known URLs for a domain from the Wayback Machine, Common Crawl, and AlienVault OTX.
- Recon
- Enumeration
- Web
- MIT
- Free
gcloud
Official command-line tool from the Google Cloud SDK for enumerating and managing GCP resources — IAM, storage, compute.
- Enumeration
- Cloud
- Proprietary
- Freemium
GitHub code search
Built-in search across public GitHub repositories, used to spot leaked secrets and exposed config.
- Recon
- Web
- Proprietary
- Free
gitleaks
Scans git repositories and commit history for hardcoded secrets and credentials.
- Recon
- Enumeration
- Web
- MIT
- Free
GNU parallel
Run the same command against a list of hosts, URLs, or files in parallel.
- Recon
- Enumeration
- Productivity
- GPL-3.0
- Free
Gobuster
Directory, DNS, and vhost brute-forcing against web targets.
- Enumeration
- Web
- Apache-2.0
- Free
GodPotato
Local privilege-escalation tool that turns SeImpersonatePrivilege into SYSTEM across most modern Windows versions.
- Post-exploitation
- Active Directory
- Apache-2.0
- Free
General-purpose search engine used for OSINT recon via advanced operators ('Google dorking').
- Recon
- Web
- Proprietary
- Free
Grype
Vulnerability scanner for container images, filesystems, and SBOMs.
- Enumeration
- Cloud
- Apache-2.0
- Free
hashcat
GPU-accelerated cracker for auditing the strength of password hashes recovered during an engagement.
- Post-exploitation
- Active Directory
- MIT
- Free
Helm
Kubernetes package manager, used in a cloud assessment to inspect chart configurations and installed releases for misconfigurations.
- Enumeration
- Cloud
- Apache-2.0
- Free
httpx
Fast HTTP probing toolkit for confirming which hosts are alive and fingerprinting them at scale.
- Recon
- Enumeration
- Web
- MIT
- Free
hydra
Parallelized network login cracker that tests credentials against dozens of protocols, from SSH and RDP to web forms.
- Exploitation
- Active Directory
- AGPL-3.0
- Free
impacket
Python library and collection of example scripts implementing Windows/AD network protocols, the base for secretsdump, psexec.py, and dozens of other tools.
- Enumeration
- Exploitation
- Post-exploitation
- Active Directory
- Impacket License (Apache-derived)
- Free
Interactsh
Open-source out-of-band interaction (OAST) tool for detecting blind vulnerabilities like SSRF, blind XXE, and blind SSTI.
- Enumeration
- Exploitation
- Web
- MIT
- Free
jq
Filter and reshape JSON from APIs, cloud CLIs, and loot files in a one-liner.
- Enumeration
- Reporting
- Productivity
- MIT
- Free
jsluice
Go library and CLI that parses JavaScript into an AST to extract URLs, endpoints, and secrets more accurately than regex-based extractors.
- Recon
- Enumeration
- Web
- MIT
- Free
jwt_tool
Python toolkit for validating, tampering with, and forging JSON Web Tokens to probe common signing and claim flaws.
- Exploitation
- Web
- MIT
- Free
katana
Fast web crawler for discovering endpoints, JavaScript files, and forms across an application.
- Recon
- Enumeration
- Web
- MIT
- Free
kerbrute
Kerberos pre-authentication tool for enumerating valid Active Directory usernames and testing passwords.
- Enumeration
- Active Directory
- MIT
- Free
kube-dnsspoof
Proof-of-concept that hijacks CoreDNS resolution from a compromised pod to demonstrate cluster-internal DNS spoofing and MITM.
- Exploitation
- Cloud
- No license (source-available)
- Free
kube-hunter
Aqua Security scanner that hunts for known Kubernetes security weaknesses from outside the cluster, from a pod, or from a node.
- Enumeration
- Cloud
- Apache-2.0
- Free
kubectl
The official Kubernetes CLI for querying, and where authorized, controlling cluster resources during an assessment.
- Enumeration
- Cloud
- Apache-2.0
- Free
kubectl-who-can
kubectl plugin that lists every user, group, or service account with RBAC permission to run a given verb on a resource.
- Enumeration
- Cloud
- Apache-2.0
- Free
kubeletctl
CLI that talks directly to a node's Kubelet API to list pods, exec into containers, and pull logs — most valuable against a kubelet left open to anonymous access.
- Enumeration
- Cloud
- Apache-2.0
- Free
ldapsearch
Standard OpenLDAP command-line client for querying and enumerating LDAP directories, including Active Directory.
- Enumeration
- Network
- OpenLDAP Public License
- Free
ligolo-ng
TUN-interface pivoting tool that turns a compromised host's reachable network into routable subnets on the attacker box.
- Post-exploitation
- Network
- GPL-3.0
- Free
LinkFinder
Python tool that extracts endpoints and URLs from JavaScript files to expand a web application's attack surface.
- Recon
- Enumeration
- Web
- MIT
- Free
linPEAS
Linux enumeration script that surfaces local privilege-escalation vectors: SUID binaries, cron jobs, credentials, and more.
- Enumeration
- Post-exploitation
- Network
- GPL-3.0
- Free
Linux Exploit Suggester
Suggests known Linux kernel and package privilege-escalation exploits based on version and patch level.
- Enumeration
- Post-exploitation
- Network
- MIT
- Free
ls
List a directory with hidden files, modes, and timestamps — first look at a foothold.
- Enumeration
- Post-exploitation
- Productivity
- GPL-3.0
- Free
masscan
Asynchronous, raw-packet port scanner built to sweep huge ranges at extremely high speed.
- Recon
- Enumeration
- Network
- AGPL-3.0
- Free
Metasploit
Open-source exploitation framework for developing and running exploits, generating payloads, and running post-exploitation modules.
- Exploitation
- Post-exploitation
- Network
- BSD-3-Clause
- Free
mimikatz
Post-exploitation tool for extracting Windows credentials, hashes, and Kerberos tickets from memory.
- Post-exploitation
- Active Directory
- CC BY 4.0
- Free
msfvenom
Standalone Metasploit payload generator for building and encoding custom payloads in various formats.
- Exploitation
- Network
- BSD-3-Clause
- Free
nc
Open a TCP or UDP connection by hand — probe a port, grab a banner, or move a file.
- Enumeration
- Post-exploitation
- Network
- ISC
- Free
Nessus
Automated vulnerability scanner with a huge, daily-updated plugin library covering CVEs, misconfigs, and compliance checks.
- Enumeration
- Network
- Commercial
- Freemium
Nmap
Network scanner for discovering hosts, ports, and services in scope.
- Recon
- Enumeration
- Network
- NPSL
- Free
npm
Inspect Node package manifests, scripts, and lockfiles without installing the app.
- Enumeration
- Web
- Productivity
- Artistic-2.0
- Free
nsenter
Part of util-linux; enters the namespaces of an existing process, the classic way to attach to or escape a container.
- Post-exploitation
- Cloud
- GPL-2.0
- Free
Nuclei
Template-based scanner for known findings across HTTP and other protocols.
- Enumeration
- Exploitation
- Web
- Network
- MIT
- Free
OAuth2 Proxy
Reverse proxy that puts OAuth/OIDC login in front of HTTP apps that have none.
- Enumeration
- Web
- Productivity
- MIT
- Free
onesixtyone
Fast SNMP scanner that brute-forces community strings across many hosts in parallel.
- Enumeration
- Network
- GPL-2.0
- Free
OpenSSL
Standard TLS/crypto toolkit CLI for inspecting certificates, testing cipher and protocol support, and manually interacting with TLS services.
- Recon
- Enumeration
- Network
- Apache-2.0
- Free
OpenVAS
Open-source vulnerability scanner from Greenbone, driven by a continuously updated feed of network vulnerability tests.
- Enumeration
- Network
- GPL-2.0
- Free
Pacu
AWS exploitation framework for post-compromise enumeration and privilege-escalation testing within an account.
- Enumeration
- Exploitation
- Post-exploitation
- Cloud
- BSD-3-Clause
- Free
phpggc
Library of pre-built PHP unserialize() gadget chains and a CLI to generate ready-to-use deserialization payloads for common frameworks and libraries.
- Exploitation
- Web
- Apache-2.0
- Free
PowerUp
PowerShell script that enumerates and abuses common Windows privilege-escalation misconfigurations.
- Post-exploitation
- Active Directory
- BSD-3-Clause
- Free
ppmap
Go scanner that detects client-side prototype pollution and turns known gadgets into a working XSS payload.
- Exploitation
- Web
- GPL-3.0
- Free
PrintSpoofer
Exploits SeImpersonatePrivilege via the Print Spooler bug to escalate a service account to SYSTEM.
- Post-exploitation
- Active Directory
- No license (source-available)
- Free
ProcDump
Signed Microsoft Sysinternals utility for capturing process memory dumps, including LSASS.
- Enumeration
- Post-exploitation
- Network
- Sysinternals Software License
- Free
Prowler
Prowler is a security tool for AWS, Azure, and GCP.
- Enumeration
- Cloud
- Apache-2.0
- Free
python
Run small scripts and stdlib helpers — JSON, HTTP, encoding — already on most hosts.
- Enumeration
- Post-exploitation
- Productivity
- PSF-2.0
- Free
rakkess
kubectl plugin that renders a full access matrix — every resource type against every verb — for the current or an impersonated identity.
- Enumeration
- Cloud
- Apache-2.0
- Free
rbac-police
Evaluates a cluster's effective RBAC permissions against a Rego policy library to flag identities with real, documented privilege-escalation paths.
- Enumeration
- Cloud
- MIT
- Free
rclone
CLI for managing and syncing files across cloud storage providers, used to enumerate and validate access to misconfigured buckets.
- Enumeration
- Post-exploitation
- Cloud
- MIT
- Free
responder
LLMNR/NBT-NS/mDNS poisoner that captures NTLM authentication attempts broadcast on a local network segment.
- Enumeration
- Exploitation
- Active Directory
- GPL-3.0
- Free
sc
Query and inspect Windows services in place — names, states, and binary paths.
- Enumeration
- Post-exploitation
- Active Directory
- Microsoft
- Free
Scapy
Python library and interactive shell for crafting, sending, and dissecting arbitrary network packets.
- Recon
- Enumeration
- Network
- GPL-2.0
- Free
schtasks
List Windows scheduled tasks, their triggers, and the commands they run.
- Enumeration
- Post-exploitation
- Active Directory
- Microsoft
- Free
searchsploit
Command-line search tool for a local mirror of Exploit-DB, matching a service or version against known public exploits.
- Enumeration
- Network
- GPL-2.0
- Free
secretsdump
Impacket script for remotely dumping SAM, LSA secrets, and NTDS.dit hashes.
- Post-exploitation
- Active Directory
- Impacket License (Apache-derived)
- Free
Sherlock
Hunts for a username across hundreds of social media and web platforms for OSINT.
- Recon
- Web
- MIT
- Free
Shodan
Search engine for internet-connected devices and services, indexed by banner and port.
- Recon
- Web
- Commercial
- Freemium
skopeo
CLI to inspect, copy, and sign container images and registries without a Docker daemon.
- Enumeration
- Cloud
- Apache-2.0
- Free
smbclient
FTP-like command-line client, bundled with Samba, for browsing and interacting with SMB/CIFS shares.
- Enumeration
- Network
- GPL-3.0
- Free
smuggler.py
Standalone Python CLI that fingerprints HTTP request smuggling and desync issues through differential server responses.
- Exploitation
- Web
- MIT
- Free
snmpwalk
Part of Net-SNMP, walks an SNMP MIB tree to enumerate device details, often via a default community string.
- Enumeration
- Network
- BSD-style
- Free
socket.dev
Scans open-source dependencies for malware, typosquatting, and other supply-chain risk.
- Recon
- Enumeration
- Web
- Commercial
- Freemium
source-map-explorer
Analyzes JavaScript source maps shipped to the client to reveal original, unminified source code and file structure.
- Recon
- Enumeration
- Web
- Apache-2.0
- Free
sqlmap
Automated SQL injection detection and exploitation, with controlled dumps.
- Exploitation
- Web
- GPL-2.0
- Free
ssh
Reach a remote shell and forward ports over an encrypted OpenSSH session.
- Enumeration
- Post-exploitation
- Network
- BSD
- Free
SSRFmap
Python tool that takes a confirmed SSRF and automates exploitation against cloud metadata, internal services, and more.
- Exploitation
- Web
- MIT
- Free
stress-ng
System stress-testing tool that loads CPU, memory, I/O, and network resources to test availability under an authorized DoS test.
- Exploitation
- Network
- GPL-2.0
- Free
strings
Pull printable text out of binaries, dumps, and firmware images.
- Enumeration
- Post-exploitation
- Productivity
- GPL-3.0
- Free
subfinder
Passive subdomain discovery tool that aggregates results from dozens of public sources.
- Recon
- Enumeration
- Web
- MIT
- Free
syft
Generates a Software Bill of Materials (SBOM) from container images and filesystems.
- Enumeration
- Cloud
- Apache-2.0
- Free
tcpdump
Command-line packet capture and analysis tool for inspecting live network traffic or saved pcap files.
- Recon
- Enumeration
- Network
- BSD-3-Clause
- Free
theHarvester
Gathers emails, subdomains, names, and IPs from public sources like search engines and PGP servers.
- Recon
- Web
- GPL-3.0
- Free
tplmap
Automates detection and exploitation of server-side template injection (SSTI).
- Exploitation
- Web
- MIT
- Free
Trivy
Trivy is a security tool for containers, Kubernetes, and more.
- Enumeration
- Cloud
- Apache-2.0
- Free
TruffleHog
Scans git history, filesystems, and cloud sources for secrets, then actively verifies them.
- Recon
- Enumeration
- Web
- AGPL-3.0
- Free
wafw00f
Identifies and fingerprints which WAF, if any, is protecting a web target.
- Recon
- Enumeration
- Web
- BSD-3-Clause
- Free
Wappalyzer
Browser extension and lookup service that fingerprints a site's CMS, frameworks, and analytics stack.
- Recon
- Web
- Commercial
- Freemium
Watson
Enumerates missing Windows patches and suggests matching known privilege-escalation exploits.
- Enumeration
- Post-exploitation
- Network
- GPL-3.0
- Free
Web Cache Vulnerability Scanner
Standalone Go CLI scanner from Hackmanit that tests for web cache poisoning and web cache deception across multiple techniques.
- Enumeration
- Exploitation
- Web
- Apache-2.0
- Free
weevely
Python tool that generates a lightweight, obfuscated PHP web shell and includes the client to manage it, in one package.
- Post-exploitation
- Web
- GPL-3.0
- Free
wevtutil
Query Windows Event Log channels for evidence without opening Event Viewer.
- Post-exploitation
- Reporting
- Active Directory
- Microsoft
- Free
WhatWeb
Web technology fingerprinting scanner that identifies CMSs, frameworks, servers, and libraries.
- Recon
- Enumeration
- Web
- GPL-2.0
- Free
whois
Look up domain and IP registration records during passive recon.
- Recon
- Network
- GPL-2.0
- Free
winPEAS
Windows enumeration script that surfaces local privilege-escalation vectors: misconfigured services, credentials, and more.
- Enumeration
- Post-exploitation
- Network
- GPL-3.0
- Free
XSStrike
Context-aware XSS detection and exploitation suite with its own fuzzing engine and payload generator.
- Exploitation
- Web
- GPL-3.0
- Free
XXEinjector
Automates exploitation of XXE injection, including blind/out-of-band data exfiltration techniques.
- Exploitation
- Web
- MIT
- Free
ysoserial
The standard proof-of-concept tool for generating Java deserialization gadget-chain payloads from libraries already on a target's classpath.
- Exploitation
- Web
- MIT
- Free
No tools match this filter.