一个脚本小子的渗透工具包

建议新建一个干净的虚拟机来做一个专门渗透测试的系统，配置好环境最好打个快照。

下面是我常用的一些工具，排名不分先后都是非常好用的工具。当然我自己收集的不全面，如果有好的建议请留言。

环境配置

• jdk 1.8：
  • 官方：https://www.oracle.com/kr/java/technologies/javase/javase8-archive-downloads.html
  • https://repo.huaweicloud.com/java/jdk/8u202-b08/
• python3：https://python.org/
• python2：https://python.org/
• git：https://git-scm.com/

渗透工具

Buprusite

• https://portswigger.net/burp
• 插件：
  • https://github.com/Mr-xn/BurpSuite-collections
  • https://github.com/TheKingOfDuck/burpFakeIP
  • https://github.com/gh0stkey/HaE
  • https://github.com/zilong3033/fastjsonScan
  • https://github.com/c0ny1/sqlmap4burp-plus-plus
  • https://github.com/bit4woo/u2c
  • https://github.com/whwlsfb/Log4j2Scan

信息收集

• 子域名
  • Oneforall：https://github.com/shmilylty/OneForAll
  • subfinder：https://github.com/projectdiscovery/subfinder
  • amass：https://github.com/OWASP/Amass
• 目录扫描
  • ffuf：https://github.com/ffuf/ffuf
  • dirsearch：https://github.com/maurosoria/dirsearch
• 端口扫描
  • nmap：https://nmap.org/
• 存活探测：
  • httpx：https://github.com/projectdiscovery/httpx
  • fscan：https://github.com/shadow1ng/fscan
  • bscan：https://github.com/broken5/bscan
• JS
  • https://github.com/Threezh1/JSFinder
  • https://github.com/p1g3/JSINFO-SCAN
  • https://github.com/GerbenJavado/LinkFinder
• 指纹识别：
  • ObserverWard：https://github.com/0x727/ObserverWard
  • Ehole：https://github.com/EdgeSecurityTeam/EHole
• APP
  • ApkAnalyser：https://github.com/TheKingOfDuck/ApkAnalyser
  • AppInfoScanner：https://github.com/kelvinBen/AppInfoScanner
  • jadx：https://github.com/skylot/jadx
• 杂项
  • 水泽：https://github.com/0x727/ShuiZe_0x727
  • 灯塔：https://github.com/TophantTechnology/ARL
  • fofa_viewer：https://github.com/wgpsec/fofa_viewer
  • fofax：https://github.com/xiecat/fofax
  • HostCollision（host头碰撞）：https://github.com/pmiaowu/HostCollision
  • IIS-ShortName-Scanner（IIS短文件名）：https://github.com/irsdl/IIS-ShortName-Scanner
  • gowitness（网站截图）：https://github.com/sensepost/gowitness
  • EmailAll：https://github.com/Taonn/EmailAll

信息收集(需要 Key )的工具最好放在服务器上运行

漏洞利用

• sqlmap：https://github.com/sqlmapproject/sqlmap
• nuclei：https://github.com/projectdiscovery/nuclei
• Shiro
  • https://github.com/SummerSec/ShiroAttack2
  • https://github.com/j1anFen/shiro_attack
  • https://github.com/feihong-cs/ShiroExploit-Deprecated
  • https://github.com/dr0op/shiro-550-with-NoCC
  • https://github.com/wyzxxz/shiro_rce_tool
• 致远OA：
  • https://github.com/God-Ok/SeeyonExploit-GUI
  • https://github.com/Summer177/seeyon_exp
• 通达OA：
  • https://github.com/xinyu2428/TDOA_RCE
• 蓝凌OA：
  • https://github.com/haibara3839/LandrayExploit
• 泛微OA：
  • https://github.com/z1un/weaver_exp
• Weblogic：
  • https://github.com/awsassets/weblogic_exploit
  • https://github.com/8ypass/weblogicExploit
  • https://github.com/0xn0ne/weblogicScanner
• Jboss：
  • https://github.com/GGyao/jbossScan
  • https://github.com/Xyntax/JBoss-exp
• Tomcat：
  • https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi
  • https://github.com/00theway/Ghostcat-CNVD-2020-10487
• Thinkphp:
  • https://github.com/Lotus6/ThinkphpGUI
  • https://github.com/bewhale/thinkphp_gui_tools 可惜项目已经关闭
  • https://github.com/safe6Sec/ThinkPHPLogScan
• Struts2
  • https://github.com/HatBoy/Struts2-Scan
  • https://github.com/shack2/Struts2VulsTools
  • https://github.com/xfiftyone/STS2G
• Spring Boot
  • https://github.com/LandGrey/SpringBootVulExploit
  • https://github.com/0x727/SpringBootExploit
  • https://github.com/wyzxxz/heapdump_tool
• Fastjson：
  • https://github.com/c0ny1/FastjsonExploit
• Jumpserver：
  • https://github.com/Veraxy00/Jumpserver-EXP
• 综合
  • https://github.com/chaitin/xray
  • https://cn.gobies.org/
  • https://github.com/yhy0/ExpDemo-JavaFX
  • https://github.com/zhzyker/vulmap
  • https://github.com/woodpecker-framework/woodpecker-framwork-release
  • …
• JNDI:
  • https://github.com/wyzxxz/jndi_tool
  • https://github.com/welk1n/JNDI-Injection-Exploit
  • https://github.com/su18/JNDI
  • https://github.com/HyCXSS/JNDIScan
• ysoserial
  • https://github.com/zema1/ysoserial
  • https://github.com/frohoff/ysoserial
  • https://github.com/4ra1n/Gososerial
• AK - SK 利用
  • ossbrowser：https://help.aliyun.com/document_detail/209974.htm
  • 行动管家：https://yun.cloudbility.com/login.html
  • https://github.com/NS-Sp4ce/AliyunAccessKeyTools
  • https://github.com/wyzxxz/aksk_tool
• …..

网站管理

• Godzilla(哥斯拉)：https://github.com/BeichenDream/Godzilla
• Behinder(冰蝎)：https://github.com/rebeyond/Behinder
• antSword(蚁剑)：https://github.com/AntSwordProject/antSword
• rebeyond-Mode：https://github.com/angels520/rebeyond-Mode
• skyscorpion(天蝎)：https://github.com/shack2/skyscorpion

字典文件

• https://github.com/cwkiller/Pentest_Dic
• https://github.com/TheKingOfDuck/fuzzDicts
• https://github.com/rootphantomer/Blasting_dictionary
• https://github.com/gh0stkey/Web-Fuzzing-Box
• https://github.com/danielmiessler/SecLists
• https://github.com/huyuanzhi2/password_brute_dictionary

杂项

• https://github.com/java-decompiler/jd-gui
• https://github.com/dnSpy/dnSpy

内网渗透

Cobaltstrike

• https://www.cobaltstrike.com/
• 插件
  • https://github.com/DeEpinGh0st/Erebus
  • https://github.com/lintstar/LSTAR
  • https://github.com/pandasec888/taowu-cobalt-strike

代理工具

• https://github.com/fatedier/frp
• https://github.com/ehang-io/nps
• https://github.com/EddieIvan01/iox
• https://github.com/L-codes/Neo-reGeorg
• Proxifier：https://www.proxifier.com/

提权工具

• https://github.com/SecWiki/windows-kernel-exploits
• https://github.com/SecWiki/linux-kernel-exploits
• https://github.com/zcgonvh/EfsPotato
• https://github.com/BeichenDream/BadPotato
• https://github.com/uknowsec/SweetPotato
• https://github.com/uknowsec/JuicyPotato
• https://github.com/uknowsec/getSystem
• https://github.com/ohpe/juicy-potato
• https://github.com/CCob/SweetPotato
• https://github.com/itm4n/PrintSpoofer

密码抓取

• Mimikatz：https://github.com/gentilkiwi/mimikatz/releases
• getpass：
  • https://bbs.pediy.com/thread-163383.htm
  • https://github.com/k8gege/K8tools/blob/master/GetPwd_K8.rar
  • https://github.com/k8gege/K8tools/blob/master/GetPassword_x64.rar
• pwddump：https://www.openwall.com/passwords/windows-pwdump
• LaZagne：https://github.com/AlessandroZ/LaZagne
• quarkspwdump：https://github.com/quarkslab/quarkspwdump
• 浏览器：
  • https://github.com/moonD4rk/HackBrowserData
  • https://github.com/QAX-A-Team/BrowserGhost
  • https://github.com/hayasec/360SafeBrowsergetpass
• Xshell：
  • https://github.com/JDArmy/SharpXDecrypt
  • https://github.com/dzxs/Xdecrypt
  • https://github.com/Arvanaghi/SessionGopher
• TeamViewer：https://github.com/attackercan/teamviewer-dumper
• tortoiseSVN：http://www.leapbeyond.com/ric/TSvnPD/TSvnPwd.exe
• VNC：http://www.cqure.net/tools/vncpwdump-win32-1_0_6.zip
• secureCRT：https://github.com/hustlibraco/Moye/blob/master/SecureCRTDecrypt.py
• 向日葵解密工具：https://github.com/wafinfo/Sunflower_get_Password
• RDP保存密码：https://www.nirsoft.net/utils/network_password_recovery.html
• SharpDecryptPwd：https://github.com/RowTeam/SharpDecryptPwd

  SharpDecryptPwd Navicat
  SharpDecryptPwd Xmanager
  SharpDecryptPwd TeamViewer
  SharpDecryptPwd FileZilla
  SharpDecryptPwd Foxmail
  SharpDecryptPwd TortoiseSVN
  SharpDecryptPwd WinSCP
  SharpDecryptPwd Chrome
  SharpDecryptPwd RDCMan
  SharpDecryptPwd SunLogin

数据库利用

• https://github.com/RowTeam/SharpSQLTools
• https://github.com/SafeGroceryStore/MDUT
• https://github.com/Ryze-T/Sylas
• https://github.com/jas502n/oracleShell
• https://github.com/0x727/SqlKnife_0x727
• sql tools 2.0 功能增强版
• sqltools

横向移动

• https://github.com/QAX-A-Team/sharpwmi
• https://github.com/rootclay/WMIHACKER
• https://github.com/XiaoliChan/wmiexec-RegOut
• https://github.com/ropnop/impacket_static_binaries/
• https://github.com/maaaaz/CrackMapExecWin
• https://docs.microsoft.com/zh-cn/sysinternals/downloads/psexec
• https://github.com/Twi1ight/AD-Pentest-Script
• https://github.com/gentilkiwi/kekeo

杂项

• windows多登录远程桌面：https://github.com/stascorp/rdpwrap
• 超级弱口令：https://github.com/shack2/SNETCracker

一些软件

• 快捷启动 Maya：https://github.com/25H/Maya
• SSH连接工具
  • MobaXterm：https://mobaxterm.mobatek.net/download.html
  • putty：https://www.putty.org/
• 文本文档处理
  • sublime text 4：https://www.sublimetext.com/
  • WPS：https://platform.wps.cn/
• 数据库连接工具：
  • DBeaver：https://dbeaver.io/
  • navicat：https://www.navicat.com.cn/products/
• Everything：https://www.voidtools.com/zh-cn/
• Proxifier：https://www.proxifier.com/