编码/加密
CyberChef:编解码及加密,可本地部署 https://github.com/gchq/CyberChef
OK Tools在线工具:https://github.com/wangyiwy/oktools
CTF在线工具:http://www.hiencode.com/
Unicode字符表:https://www.52unicode.com/enclosed-alphanumerics-zifu
在线MD5 Hash破解:https://www.somd5.com/
实用工具
Explain Shell:Shell命令解析 https://explainshell.com/
在线正则表达式:https://c.runoob.com/front-end/854/
Ceye DNS:DNS oob平台 http://ceye.io/
DNS log:DNS oob平台 http://dnslog.cn/
Webshell Chop:https://webshellchop.chaitin.cn/demo/
XSS Chop:https://xsschop.chaitin.cn/demo/
WebShell查杀:https://n.shellpub.com/
Google Hacking Database:https://www.exploit-db.com/google-hacking-database
Wayback Machine:网页缓存查询 https://archive.org/web
在线代码格式标准化:http://web.chacuo.net/formatsh
IP/域名收集
确认真实IP地址
IP精准定位:https://www.ipuu.net/#/home
IP 138:https://site.ip138.com/
Security Trails:https://securitytrails.com/
多个地点Ping服务器
Chinaz:https://ping.chinaz.com/
Host Tracker:https://www.host-tracker.com/
Webpage Test:https://www.webpagetest.org/
DNS Check:https://dnscheck.pingdom.com/
Whois注册信息反查
站长之家 Whois:https://whois.chinaz.com/
中国万网 Whois:https://whois.aliyun.com/
国际 Whois:https://who.is/
DNS数据聚合查询
Hacker Target:https://hackertarget.com/find-dns-host-records
DNS Dumpster:https://dnsdumpster.com
DNS DB:https://dnsdb.io/zh-cn
TLS证书信息查询
Censys:
https:
//censys.io
Certificate Search:https://crt.sh
证书透明度监控:https://developers.facebook.com/tools/ct"
IP地址段收集
CNNIC中国互联网信息中心:http://ipwhois.cnnic.net.cn
网络空间搜索
Fofa:https://fofa.info/
Shodan:https://www.shodan.io/
ZoomEye:https://www.zoomeye.org/
谛听:https://www.ditecting.com/
360网络空间测绘:https://quake.360.cn/quake/#/index
威胁情报平台
Virustotal:https://www.virustotal.com/gui/home/upload
腾讯哈勃分析系统:https://habo.qq.com/tool/index
微步在线威胁情报:https://x.threatbook.cn/
奇安信威胁情报:https://ti.qianxin.com/
360威胁情报:https://ti.360.net/#/homepage
安恒威胁情报:https://ti.dbappsecurity.com.cn/
火线安全平台:https://www.huoxian.cn
Hacking8安全信息流:https://i.hacking8.com/
CTF平台
CTF Wiki:https://ctf-wiki.org/
CTF Time:https://ctftime.org/
CTF Tools:https://github.com/zardus/ctf-tools
攻防世界:https://adworld.xctf.org.cn/
Hacker 101:https://www.hacker101.com/
漏洞平台
Exploit Database:https://www.exploit-db.com/
HackerOne:https://www.hackerone.com/
Vulhub:https://vulhub.org/
乌云镜像:http://wy.zone.ci/
知道创宇漏洞平台:https://www.seebug.org/
靶机平台
封神台:https://hack.zkaq.cn/index
HackTheBox:https://www.hackthebox.com/
OWASP Top10:https://owasp.org/www-project-juice-shop/
WebGoat:https://github.com/WebGoat/WebGoat
公开知识库
狼组公开知识库:https://wiki.wgpsec.org/
404星链计划:知道创宇 404 实验室 https://github.com/knownsec/404StarLink
信息收集
指纹识别
Wapplyzer:Chrome插件 跨平台网站分析工具 https://github.com/AliasIO/Wappalyzer
TideFinger:提取了多个开源指纹识别工具的规则库并进行了规则重组 https://github.com/TideSec/TideFinger
御剑web指纹识别程序:https://www.webshell.cc/4697.html
云悉指纹识别:http://www.yunsee.cn/
扫描/爆破
dirsearch:目录扫描/爆破 https://github.com/maurosoria/dirsearch
dirmap:目录扫描/爆破 https://github.com/H4ckForJob/dirmap
Arjun:HTTP参数扫描器 https://github.com/s0md3v/Arjun
ksubdomain:子域名爆破 https://github.com/knownsec/ksubdomain
Gobuster:URI/DNS/WEB爆破 https://github.com/OJ/gobuster
爆破字典
Dictionary-Of-Pentesting:渗透测试、SRC漏洞挖掘、爆破、Fuzzing等常用字典 https://github.com/insightglacier/Dictionary-Of-Pentesting
fuzzDicts:Web渗透Fuzz字典 https://github.com/TheKingOfDuck/fuzzDicts
PentesterSpecialDict:渗透测试工程师精简化字典 https://github.com/ppbibo/PentesterSpecialDict
综合信息收集
AlliN:https://github.com/P1-Team/AlliN
Kunyu:https://github.com/knownsec/Kunyu
OneForAll:https://github.com/shmilylty/OneForAll
ShuiZe:https://github.com/0x727/ShuiZe_0x727
Fofa Viewer:https://github.com/wgpsec/fofa_viewer
内网信息收集
fscan:内网综合扫描工具 https://github.com/shadow1ng/fscan
EHole:红队重点攻击系统指纹探测工具 https://github.com/EdgeSecurityTeam/EHole
Ladon:用于大型网络渗透的多线程插件化综合扫描工具 https://github.com/k8gege/Ladon
漏洞研究
漏洞综述
漏洞挖掘
Windows-Exploit-Suggester:https:
Linux_Exploit_Suggester:https:
开源漏洞库
Vulhub:https:
PeiQi文库:http:
PoCBox:https:
Vulnerability:https:
POChouse:https:
POC/EXP
ysoserial:Java反序列化 https:
Vulmap:漏洞扫描和验证工具 https:
Some-PoC-oR-ExP:各种漏洞PoC、ExP的收集或编写 https:
CMS
-Hunter:
CMS
漏洞测试用例集合 https:
Penetration_Testing_POC:https:
内网渗透
Bypass
PHPFuck:https:
JSFuck:http:
Payloads
PayloadsAllTheThings:https:
java.lang.Runtime.exec() Payload:java Payload在线生成 https:
PHP Generic Gadget Chains:PHP反序列化Payload https:
WebShell
Webshell收集项目:https:
反弹shell命令速查:https:
Behinder 冰蝎:https:
Behinder3:kali + java
11.0
.14
或 windows10 + java
1.8
.0
_91,
注意,该环境下Behinder2无法正常运行
Behinder2:windows10 + java
1.8
.0
_91
Godzilla 哥斯拉:https:
内网穿透
NPS:通过web端管理,无需配置文件 https:
FRP:
55
k star项目 https:
Neo-reGeorg:tunnel快速部署 https:
Proxifier:windows代理工具 https:
Proxychains:kali代理工具 https:
容器逃逸
The art
of
command line:快速掌握命令行 https:
Responder:实现获取NTLM Hash等功能 https:
Impacket:其中的psexec.py通过用户名和密码远程连接到目标服务器 https:
PsTools:PsExec.exe功能同Impacket中的psexec.py https:
移动端安全
CrackMinApp:反编译微信小程序 https:
AppInfoScanner:移动端信息收集 https:
安全厂商
Metasploit
Cobaltstrike
Awesome CobaltStrike:CobaltStrike知识库 https:
Erebus:后渗透测试插件 https:
LSTAR:综合后渗透插件 https:
ElevateKit:提权插件 https:
Burpsuite
HaE:高亮标记与信息提取辅助型插件 https:
Log4j2Scan:Log4j主动扫描 https:
Chrome crx
Proxy
SwitchyOmega:快速切换代理 https:
Xray
作者: Threekiii
来源:https://github.com/Threekiii/Awesome-Redteam
关注公众号后台回复数字 1126 获取 应急响应实战笔记,1127 - ctf工具集合,1230 - 内网工具,3924 - 弱口令爆破工具。
评论