Posts Tagged ‘penetration testing’

Penetration Testing Tools

Sunday, January 13th, 2008


  • Nemesis:
    a command line packet shaper
  • Packit:
    The Packet Toolkit – A network packet shaper.
  • Hping
    by Antirez: a command line TCP/IP packet shaper
  • Sing:
    stands for ‘Send ICMP Nasty Garbage’; sends fully customizeable ICMP
  • Scapy:
    a new python-based packet generator

Cracker/Login Hacker:

  • John
    the Ripper
    : a well-known
    password cracker for Windows and *nix Systems
  • Djohn:
    a distributed password cracker based on "John
    the Ripper
  • Cain
    & Abel
    : an advanced
    password recovery tool for windows systems. It sniffs the network
    packets an cracks authentication brute-force or with dictionary
  • Project
    : Advanced instant
    NT password cracker
  • Rainbowtables: The
    shmoo group provides pre-generated rainbow tables for bittorrent
    download. The tables are generated with RainbowCrack (see above).
  • Windows
    password recovery tool
    by Peter
  • THC-Dialup
    Login Hacker
    by THC. It tries to
    guess username and password against the modem carrier. As far as I know
    the only available dialup password guesser for *NIX.
  • Hydra
    by THC: a multi-protocol login hacker. Hydra is also integrated with Nessus.
  • Medusa: parallel network login auditor
  • THC
    imap bruter
    : a very fast imap
    password brute forcer
  • x25bru:
    a login/password bruteforcer for x25 pad
  • Crowbar: a generic web brute force tool (Windows only; requires .NET Framework)
  • MDCrack-NG: a very fast MD4/MD5/NTLMv1 hash cracker; works optionally with precomputed hash tables


  • Wireshark (formerly known as Ethereal): an open source network protocol analyzer
  • Dsniff
    by Dug Song: a combination of very useful sniffer and man-in-the-middle
    attack tools
  • Ettercap:
    a multipurpose sniffer/interceptor/logger for switched LAN environments
  • aimsniffer:
    monitors AOL instant messager communication on the network
  • 4G8:
    a tool ,similar to ettercap, to capture network traffic in switched
  • cdpsniffer:
    Cisco discovery protocol (CDP) decoding sniffer

Scanner / Information Gathering:

  • nmap:
    the currently most well-known port scanner. Since version 3.45 it
    supports version
    . Have a look at PBNJ for diffing different nmap scans.
    released their nmap wrapper NWRAP,
    which shows all known protocols for the discovered ports form the Open
    Protocol Resource Database
  • Nmap::Scanner:
    Perl output parser for nmap
  • Amap
    by THC: An advanced portscanner which determines the application behind
    a network port by its application handshake. Thus it detects well-known
    applications on non-standard ports or unknown applications on
    well-known ports.
  • vmap
    by THC: version mapper to determine the version (sic!) of scanned daemons
  • Unicornscan:
    a information gathering and correlation engine
  • DMitry (Deepmagic Information Gathering Tool): a host information gathering tool for *nix systems
  • Athena:
    a search engine query tool for passive information gathering


  • Nessus
    – In version 2 an OpenSource network scanner. Version 3 is only available in binary form and under a proprietary license.
  • OpenVAS: a fork of Nessus 2.2.5 (formerly known as GNessUs)

  • Nessj: a java based nessus (and compatibles) client (formerly known as Reason)
  • Paul
    Clip from @stake released AUSTIN,
    a security scanner for Palm OS 3.5+.


  • Nikto:
    a web server scanner with anti IDS features. Based on Rain Forest
    Puppies libwhisker
  • Wikto: a webserver assessment tool (Windows only; requires .NET framework)
  • WSDigger:
    a black box web pen testing tool from Foundstone (Windows based)
  • Metis:
    a java based information gathering tool for web sites


  • SinFP: a fingerprinting tool which requires only an open tcp port and sends maximum 3 packets
  • Winfingerprint:
    much more than a simple fingerprinting tool.It scans for Windows
    shares, enumerates usernames, groups, sids and much more.
  • p0f
    : Michal Zalewski announced his
    new release of p0f 2, a passive OS fingerprinting tool. p0f 2 is a
    completely rewrite of the old p0f code.
  • xprobe2:
    a remote active operating system fingerprinting tool from Ofir Arkin
    and the xprobe2 team
  • Cron-OS:
    an active OS fingerprinting tool based on TCP timeout behavior. This
    project was formerly known as "RING" and is now published as a nmap


  • Burp
    : an interactive HTTP/S
    proxy server for attacking and debugging web-enabled applications
  • Screen-scraper:
    a http/https-proxy server with a scripting engine for data manipulation
    and searching
  • Paros:
    a man-in-the-middle proxy and application vulnerability scanner
  • WebScarab: a framework for analyzing web applications. One of it’s basic functionality is the usage as intercepting proxy.

War Dialers:

  • IWar: a classic war dialer. One of a few wardialers for *nix operation systems, and the only with VOIP functionality (to my knowledge)
  • THC-Scan: a war dialer for DOS, Windows and DOS emulators

Malware / Exploit Collections:

    Huge collections of tools and exploits
  • ElseNot Project: The project tries to publish an exploit for each MS Security Bulltin. A script kiddie dream come true.
  • Offensive Computing: Another malware collection site
  • Securityforest: try the ExploitTree to get a collection of exploit code; have a look at the ToolTree for a huge list of pentest stuff

Databases / SQL:

  • sqlninja: a tool to exploit sql injection vulnerabilities in web applications with MS SQL Servers (alpha stage)
  • CIS
    Oracle Database Scoring Tool
    scans Oracle 8i for compliance with the CIS Oracle Database
  • SQLRecon:
    an active and passive scanner for MSSQL server. Works on Windows 2000,
    XP and 2003.
  • absinthe: a
    gui-based tool that automates the process of downloading the schema
    & contents of a database that is vulnerable to Blind SQL Injection
    (see here
    and here).
  • SQL Power Injector: a GUI based SQL injector for web pages (Windows, .Net Framework 1.1 required, Internet Explorer 5.0+ required)

Voice over IP (VOIP):

  • vomit (voice over misconfigured internet telephones): converts Cisco IP phone conversations into wave files
  • SiVuS: a VOIP vulnerability scanner – SIP protocol (beta, Windows only)
  • Cain & Abel: mostly a password cracker, can also record VOIP conversations (Windows only)
  • sipsak (SIP swis army knife): a SIP packet generator
  • SIPp: a SIP test tool and packet generator
  • Nastysip: a SIP bogus message generator
  • voipong: dumps G711 encoded VOIP communications to wave files. Supports: SIP, H323, Cisco Skinny Client Protocol, RTP and RTCP
  • Perl based tools by Thomas Skora: sip-scan, sip-kill, sip-redirectrtp, rtpproxy and ipq_rules
  • rtptools: a toolset for rtp recording and playing

Networkbased Tools:

  • yersinia: a network tool
    designed to take advantage of some weakeness in different network
    protocols (STP, CDP, DTP, DHCP, HSRP, 802.1q, VTP)
  • Netsed:
    alters content of network packets while
    forwarding the packets

  • ip6sic:
    a IPv6 stack integrity tester


  • ike-scan:
    an IPSec enumeration and fingerprinting tool
  • ikeprobe:
    ike scanning tool
  • ipsectrace:
    a tool for profiling ipsec traffic in a dump file. Initial alpha release
  • VPNMonitor:
    a Java application to observer network traffic. It graphically
    represents network connections and highlights all VPN connections. Nice
    for demonstrations, if somewhat of limited use in a real pen test.
  • IKECrack:an IKE/IPSec cracker for pre-shared keys (in aggressive mode authentication [RFC2409])

DNS Auditing tool by Pierre Betouin

a session hijacking tool with curses GUI

a Windows MAC Address Modifying Utility. Supports Windows 2000 and XP.

WebGoat Project
: a web
application written in Java with intentional vulnerabilities. Supports
an interactive learning environment with individual lessons.

a Windows Terminal Server brute forcer

Whitehouse from @stake released some new cellular phone based
pentesting tools for scanning
All tools
require a Sony Ericsson P800 mobile phone. Unfortunately, @stake seems
no longer to support much of their free
security tools. So, use instead the alternativ download links above.

generates fuzzy fingerprints that look almost nearly equal to a given
fingerprint/hash-sum. Very useful for MITM attacks.

a password finder for LM/NTLM hashes. Currently, there is no support
for NTLM2 hashes. In order to get the hashes from network traffic, try ScoopLM.

: a linux kernel based

Metasploit Framework
: an
"advanced open-source platform for developing, testing, and using
exploit code".

ATK (Attack Tool Kit): a comination of security scanner and exploit framework (Windows only)

Pirana: an exploitation framework to test the security of email content filters. See also the whitepaper

a tool which provides the means to locate keys within a buffer. Based
on the article "Playing
hide and seek with stored keys
by Adi Shamir.

identifies an executables dynamic link library (DLL) files

a security tool for testing dhcp security

a perl
script for enumeration against ldap servers.

Checkpwd: a dictionary based password checker for oracle databases

NirCmd from NirSoft: a windows command line tool to manipulate the registry, initiate a dialup connection and much more

Windows Permission Identifier: a tools for auditing user permissions on a windows system

MSNPawn: a toolset for footprinting, profiling and assesment via the MSN Search. Windows-only, .NET required

snmpcheck:a tool to gather information via snmp. Works on Linux, *BSD and Windows systems.

pwdump6: extract NTLM and LanMan hashes from Windows targets