Pentest+

Classless Inter-Domain Routing (CIDR) Ranges:

Identify internal network ranges that are critical for business operations.

OWASP Mobile Application Security Verification Standard (MASVS)

Framework of comprehensive security requirements for mobile applications

Purdue Model

Framework in ICS and OT environments to segment networks and enhance security

Level 0: Physical process (Purdue)

Sensors, actuators, and other physical devices directly involved in the industrial process.

Level 1: Local control (Purdue)

Devices and systems that interact directly with level 0 devices.

Level 2: Supervisory control (Purdue)

Supervisory systems that manage and monitor level 1 controllers.

Level 3: Operations management (Purdue)

Systems that manage production workflows and operations.

Level 4: Enterprise/Business Planning and Logistics (Purdue)

Corporate IT systems including ERP (enterprise resource planning) systems that handle business-related data and operations.

Level 5: Enterprise network (Purdue)

Higher-level business functions and network connections, including external communications.

DREAD

Damage potential, Reproducibility, Exploitability, Affected users, Discoverability

STRIDE

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

OCTAVE

Operationally Critical Threat Asset and Vulnerability Evaluation

Maltego

After the user inputs a target (this can be a domain, company, person, etc.), it searches the Internet for all related information on the target including social media links, IP addresses, DNS servers, and much more.

Recon-ng

This Linux-based tool contains modules that can be used for information gathering on targets such as web applications, IoT devices, and domains.

SpiderFoot

This tool automates the process of gathering intelligence about a given target, which may be an IP address, domain name, hostname, network subnet, ASN, email address, or person's name.

Censys.io

This web-based platform can be used to scan for Internet-connected devices and systems for security analysis.

Hunter.io

This web-based tool, also known as Email Hunter, allows a user to find email addresses associated with a specific domain or individual.

Amass

This Linux-based tool performs network mapping and information gathering on a targeted network or domain. It can perform network mapping of attack surfaces and perform external asset discovery using open-source information gathering and active reconnaissance techniques.

theHarvester

This tool gathers open-source intelligence on a target from a wide range of public resources to discover names, emails, IPs, subdomains, and URLs.

WiGLE.net

This web-based tool, also known as Wireless Geographic Logging Engine, allows users to submit information about wireless hotspots from across the world.

InSSIDer

This tool analyzes the configuration of a wireless network including channel settings, security, signal strength, and the impact of neighboring wireless networks.

Aircrack-ng

This tool contains a suite of software that can be used to assess the security of a wireless network.

SAST Static application security testing

Examine the code for security vulnerabilities. Examines the source code itself without running it to identify any potential security vulnerabilities, so early lifecycle.

Dynamic application security testing DAST

Done after the code is placed into production.

Interactive Application Security Testing (IAST)

combines aspects of both SAST and DAST to provide a more comprehensive and accurate assessment of an application's security.

Software Composition Analysis (SCA)

Identifies the open-source and third-party libraries and components, along with their versions and licensing information, used in an application.

Nikto

Open-source web server scanner. Server versions, files, programs that can be exploited. Large footprint, not stealthy

Greenbone/Open Vulnerability Assessment Scanner (OpenVAS)

Vulnerability scanner that boasts more than 50,000 vulnerability tests with daily updates. It is capable of various high-level and low-level Internet and industrial protocols, as well as unauthenticated and authenticated testing.

TruffleHog

Open-source tool that scans code repositories and other developer tools for secrets, passwords, and sensitive keys.

Tenable Nessus

Vulnerability scans on a variety of systems; it scans for known vulnerabilities, malware, and misconfigurations. Also provides reporting and remediation, as well as ongoing monitoring.

PowerSploit

Multiple PowerShell scripts that can be used for a variety of tasks including enumeration, collecting credentials, running malicious code, and much more. postexploitation tool

Grype

Open-source vulnerability scanner for containers and file systems. Find vulnerabilities in a wide variety of major operating system and programming language containers.

Trivy

Open-source vulnerability scanner for containers, file systems, and Git repositories. Also assists in identifying misconfigurations and vulnerabilities to artifacts.

Kube-hunter

Open-source vulnerability scanner for Kubernetes clusters. Able to probe a domain or address range for Kubernetes clusters and verify any found configuration issues.

Exploit Prediction Scoring System (EPSS)

Estimates the likelihood that a vulnerability will be exploited in the next 30 days.

Common Weakness Enumeration (CWE)

Community-developed list of software and hardware weaknesses maintained by the MITRE Corporation.

CrackMapExec (CME)

A post-exploitation tool used to identify vulnerabilities in active directory environments.

Responder

An on-path type tool that can be used to exploit name resolution on a Windows network

OpenID Connect (OIDC) attacks

Exploiting Federation

mask attack

Password cracking technique that is similar to a brute-force attack, but is more systematic and typically quicker. The password cracker can try specific combinations of characters and password lengths.

Rubeus

A command-line tool that is used to exploit Kerberos authentication in a Windows Domain environment.

Certify

A C# tool that is used to exploit weaknesses in Active Directory Certificate Services.

Seatbelt

A C# tool that can be used to scan a Windows machine for potential misconfigurations. Note that this tool must be compiled first.

Zed Attack Proxy (ZAP)

An open-source web application security scanner developed by OWASP.

Postman

A tool designed to aid in the development and testing of web application APIs. It can be used by the pentester to test for common web application vulnerabilities.

Pacu

Designed as an exploitation framework to assess the security configuration of an AWS account.

Docker Bench

A script that scans Docker containers for dozens of common security best-practices.

Prowler

An audit tool for use with Amazon Web Services only. It can be used to evaluate cloud infrastructure against the Center for Internet Security (CIS) benchmarks for AWS, plus additional GDPR and HIPAA compliance checks.

ScoutSuite

An open-source tool written in Python that can be used to audit instances and policies created on multicloud platforms, such as AWS, Microsoft Azure, and Google Cloud.

Web Proxy Auto-Discovery (WPAD)

A protocol and technology used in networks to automatically determine the proxy settings that clients should use.

WiFi-Pumpkin

Designed to carry out wireless on-path attacks.

Kismet

Wireless network detector, packet sniffer, and intrusion detection system. It is designed for monitoring and analyzing wireless network traffic in real-time.

Evilginx

On-path attack framework used for phishing login credentials along with session cookies to bypass MFA.

Browser Exploitation Framework (BeEF)

It can be used to carry out phishing attacks by creating fake websites and performing credential harvesting.

Mobile Security Framework (MobSF)

Can provide an automated evaluation of code and malware analysis using both static and dynamic analysis. The framework conducts a thorough assessment to determine parameters such as OS reputation, whether it has been rooted or jail broken, and app security.

Frida

An open-source tool that can work with a wide range of operating systems. It includes custom developer tools that help the pentester during application pentesting, as it can examine the plaintext data that is being passed.

Drozer

Open-source software used for testing for vulnerabilities on Android devices. An attack framework that helps find security flaws in apps and devices.

Android Debug Bridge (ADB)

A command-line tool that allows a user to communicate with an Android device to access certain features and debug the device.

Bluestrike

Bluetooth pentesting tool that targets the frequency hopping mechanism of Bluetooth and can disrupt the communication channel of targeted Bluetooth devices.

PowerView

Uses multiple PowerShell scripts to enumerate a Windows domain environment. This tool can be used to gather information such as network shares, users, groups, and group policies. It can even help with lateral movement and privilege escalation

Empire

Popular framework designed to aid in the post-exploitation phase which involves maintaining access to compromised systems, gathering information, and executing further attacks. One of the strengths is the extensive use of PowerShell modules which allows it to leverage built-in Windows functions and bypass some security mechanisms.

ADSearch

Uses the LDAP protocol to enumerate the Windows domain environment so it is not as easily detectable. (Another Active Directory reconnaissance tool)

Atomic Red Team

Open-source project that provides a library of simple, prescriptive, and flexible tests. Each "atomic test" is designed to be as simple as possible, allowing users to understand and execute them with minimal setup and are mapped to the MITRE ATT&CK framework.

Infection Monkey

Open-sourced BAS tool that mimics the behavior of a human attacker. It is designed to be both comprehensive and easy to use by automatically simulating a variety of attack techniques, including exploitation of vulnerabilities, lateral movement, and data exfiltration.

Caldera

Open-sourced tool developed by the MITRE corporation. It is designed to simulate sophisticated cyber attacks against enterprise networks by emulating the behaviors and techniques of real-world threat actors.

sshuttle

A tool that allows users to create a VPN-like tunnel over SSH.

Proxychains

A tool that allows traffic to be routed through a series of proxy servers.

PsExec

A lightweight telnet-replacement tool that allows administrators to execute processes on remote systems without having to install a client.

Printers Services that can be exploited

JetDirect, Line Printer Daemon (LPD), Line Printer Terminal (LPT)

Distributed Component Object Model (DCOM)

Enables communication between software components over a network.