找到
18
篇与
黑客工具
相关的结果
-
白帽黑客工具箱：routersploit 篇 推荐一个实用的开源工具——routersploit。项目由threat9开发维护，GitHub上获得了 13240 个Star。简单来说，它是一款嵌入式设备的利用框架，对于站长和开发者来说是个不错的工具。 工具功能介绍 Community Join community on Embedded Exploitation Discord. Description The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices.asciicast图片It consists of various modules that aid penetration testing operations:* exploits - modules that take advantage of identified vulnerabilities creds - modules designed to test credentials against network services scanners - modules that check if a target is vulnerable to any exploit payloads - modules that are responsible for generating payloads for various architectures and injection points generic - modules that perform generic attacks Installation Requirements Required: requests paramiko pysnmp pycryptoOptional: bluepy - Bluetooth low energy Installation on Kali Linux apt-get install python3-pip git clone https://www.github.com/threat9/routersploit cd routersploit python3 -m pip install -r requirements.txt python3 rsf.py Bluetooth Low Energy support: apt-get install libglib2.0-dev python3 -m pip install bluepy python3 rsf.py Installation on Ubuntu 20.04 sudo apt-get install git python3-pip git clone https://github.com/threat9/routersploit cd routersploit python3 -m pip install -r requirements.txt python3 rsf.py Bluetooth Low Energy support: sudo apt-get install libglib2.0-dev python3 -m pip install bluepy python3 rsf.py Installation on Ubuntu 18.04 & 17.10 sudo add-apt-repository universe sudo apt-get install git python3-pip git clone https://www.github.com/threat9/routersploit cd routersploit python3 -m pip install setuptools python3 -m pip install -r requirements.txt python3 rsf.py Bluetooth Low Energy support: apt-get install libglib2.0-dev python3 -m pip install bluepy python3 rsf.py Installation on OSX git clone https://www.github.com/threat9/routersploit cd routersploit sudo python3 -m pip install -r requirements.txt python3 rsf.py Running on Docker git clone https://www.github.com/threat9/routersploit cd routersploit docker compose up --build -d docker attach routersploit To run again without rebuild docker start routersploit docker attach routersploit Update Update RouterSploit Framework often. The project is under heavy development and new modules are shipped almost every day. cd routersploit git pull Build your own To our surprise, people started to fork routersploit not because they were interested in the security of embedded devices but simply because they want to leverage our interactive shell logic and build their tools using similar concept. All these years they must have said: "There must be a better way!" and they were completely right, the better way is called Riposte.Riposte allows you to easily wrap your application inside a tailored interactive shell. Common chores regarding building REPLs was factored out and being taken care of so you can focus on specific domain logic of your application. License The RouterSploit Framework is under a BSD license. Please see LICENSE for more details. Acknowledgments riposte {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/threat9/routersploit ⭐ Star数：13240 💻 开发语言：Python 📝 项目描述：嵌入式设备的利用框架 {/card-default} 总的来说，routersploit是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
fscan 绿色软件分享 推荐一个实用的开源工具——fscan。项目由shadow1ng开发维护，GitHub上获得了 14514 个Star。简单来说，它是一款一款内网综合扫描工具方便一键自动化、全方位漏扫扫描。（内网综合扫描工具，实现一键自动化、全方位漏洞扫描），对于站长和开发者来说是个不错的工具。 工具功能介绍 English内网综合扫描工具，一键自动化漏扫。版本: 2.2.1 功能特性 扫描能力 主机发现 - ICMP/Ping存活探测，支持大网段B/C段存活统计 端口扫描 - TCP全连接扫描，内置133个常用端口，支持端口组(web/db/service/all) 服务识别 - 智能协议识别，支持20+种服务指纹匹配 Web探测 - 网站标题、CMS指纹、Web中间件、WAF/CDN识别(40+指纹) 爆破能力 弱密码爆破 - 28种服务爆破(SSH/RDP/SMB/FTP/MySQL/MSSQL/Oracle/Redis等) Hash碰撞 - 支持NTLM Hash认证(SMB/WMI) SSH密钥登录 - 支持私钥认证方式 智能字典 - 内置100+常见弱密码，支持{user}变量替换 漏洞检测 高危漏洞 - MS17-010(永恒之蓝)、SMBGhost(CVE-2020-0796) 未授权访问 - Redis/MongoDB/Memcached/Elasticsearch等未授权检测 POC扫描 - 集成Web漏洞POC，支持Xray POC格式 DNSLog - 支持DNSLog外带检测 漏洞利用 Redis利用 - 写公钥、写计划任务、写WebShell、主从复制RCE MS17-010利用 - ShellCode注入，支持添加用户、执行命令 SSH命令执行 - 认证成功后自动执行命令 本地模块 信息收集 - 系统信息、环境变量、域控信息、网卡配置 凭据获取 - 内存转储(MiniDump)、键盘记录、注册表导出 权限维持 - Systemd服务、Windows服务、计划任务、启动项、LD_PRELOAD 反弹Shell - 正向Shell、反向Shell、SOCKS5代理服务 杀软检测 - 识别目标主机安装的安全软件 痕迹清理 - 日志清理工具 输入输出 目标输入 - IP/CIDR/域名/URL，支持文件批量导入 排除规则 - 支持排除特定主机、端口 输出格式 - TXT/JSON/CSV多格式输出 静默模式 - 无Banner、无进度条、无颜色输出 网络控制 代理支持 - HTTP/SOCKS5代理，支持指定网卡 发包控制 - 速率限制、最大发包数量控制 超时控制 - 端口超时、Web超时、全局超时独立配置 并发控制 - 端口扫描线程、服务扫描线程独立配置 扩展功能 SDK嵌入 - pkg/fscan提供Go SDK，可嵌入Agent或安全平台，支持任务控制(Pause/Resume)、实时进度回调、TaskID追溯 Web管理界面 - 可视化扫描任务管理(条件编译 -tags web) Lab靶场环境 - 内置Docker靶场用于测试学习 插件化架构 - 服务插件/Web插件/本地插件分离，易于扩展 多语言支持 - 中英文界面切换(-lang zh/en) 性能统计 - JSON格式性能报告(-perf) v2.1.0 更新日志> 本次更新包含 262个提交，涵盖30项新功能、120项修复、54项重构、14项性能优化、20项测试增强。 架构重构 全局变量消除 - 迁移至Config/State对象，提升并发安全和可测试性 SMB插件融合 - 整合smb/smb2/smbghost/smbinfo为统一插件，新增smb_protocol.go 服务探测重构 - 实现Nmap风格fallback机制，优化端口指纹识别策略 输出系统重构 - TXT实时刷盘+双写机制，解决结果丢失和乱序问题 i18n框架升级 - 迁移至go-i18n，完整覆盖core/plugins/webscan模块 HostInfo重构 - Ports字段从string改为int，类型安全 函数复杂度优化 - clusterpoc(125→30)、EnhancedPortScan(111→20) 代码审计 - 修复P0-P2级别问题，清理deadcode 日志系统优化 - LogDebug调用清理(71→18)，精简启动日志输出 性能优化 正则预编译 - 全局正则表达式预编译，避免重复编译开销 内存优化 - map[string]bool改为map[string]struct{}节省内存 并发指纹匹配 - 多协程并行匹配，提升识别速度 连接复用 - SOCKS5全局拨号器复用，避免重复握手 滑动窗口调度 - 自适应线程池+流式迭代器，优化端口扫描 CEL缓存优化 - POC扫描CEL环境缓存，减少重复初始化 包级变量提取 - proxyFailurePatterns/resourceExhaustedPatterns/sslSecondProbes等 预分配容量 - 简化转换链、单次字符串替换 并发安全优化 - 优化锁粒度和内存分配 新功能 Web管理界面 - 可视化扫描任务管理，响应式布局和进度显示 多格式POC适配 - 支持xray和afrog格式POC 智能扫描模式 - 布隆过滤器去重+代理优化 增强指纹库 - 集成FingerprintHub(3139条指纹) Favicon指纹识别 - 支持mmh3和MD5双格式hash匹配 通用版本提取器 - 自动提取服务版本信息 指纹优先级排序 - 智能排序匹配结果 智能协议检测 - 自动识别HTTP/HTTPS协议类型 网卡指定功能 - 支持VPN场景(-iface参数) 排除主机文件 - 支持从文件读取排除主机(-ehf参数) ICMP令牌桶限速 - 防止高速扫描导致路由器崩溃 端口扫描重试 - 失败自动重扫机制 RDP真实认证 - 集成grdp库实现系统指纹识别 SMB/FTP文件列表 - 匿名访问时自动列出文件 302跳转双重识别 - 同时识别原始响应和跳转后响应指纹 TXT输出URL汇总 - 末尾添加Web服务URL列表便于批量测试 nmap核心集成 - 三大改进：探测策略/匹配引擎/版本解析 插件选择性编译 - Build Tags系统，支持服务/本地/Web插件独立编译 默认端口扩展 - 从62个扩展到133个常用端口 全端口扫描支持 - 扩大端口范围限制 HTTP重定向控制 - 可配置的重定向次数限制 性能分析支持 - 添加pprof性能分析和benchmark测试 TCP包统计 - 服务插件支持TCP包发送统计 fscan-lab靶场 - 内网渗透训练平台，覆盖全部漏洞场景（未完成） Redis利用增强 - 移植完整Redis利用功能(写公钥/计划任务/WebShell/主从RCE) rsync插件重构 - 使用go-rsync库重构认证逻辑 Bug修复（120项，列出关键修复） RDP空指针panic - 修复证书解析导致的崩溃(#551) 批量扫描漏报 - 修复大规模扫描遗漏问题(#304) JSON输出格式 - 修复输出格式错误(#446) Redis弱密码检测 - 修复检测遗漏问题(#447) 结果实时保存 - 修复扫描结果未及时保存(#469) Nmap解析溢出 - 修复八进制转义解析bug(#478) 指纹识别竞态 - 修复webtitle/webpoc竞态问题(#474) MySQL连接验证 - 改用information_schema库验证 代理端口误判 - 修复代理模式下端口状态判断错误 Context超时 - 修复22处插件超时未响应问题 ICMP竞态条件 - 修复并发扫描竞争问题 IPv6地址格式 - 修复4处地址格式化问题 POC高并发卡死 - 修复Context未传播问题 Ctrl+C结果丢失 - 添加信号处理确保结果写入 SOCKS5全回显 - 添加代理连接验证 服务探测泄漏 - 修复连接未正确关闭问题 webtitle响应丢弃 - 修复部分响应数据被丢弃导致识别失败 TXT漏洞信息缺失 - 修复输出遗漏漏洞详情 JSON指纹缺失 - 统一SERVICE结果Target格式 扫描耗时显示 - 修复完成耗时显示为0的问题 虚假漏洞记录 - 重构TXT输出系统消除误报 Redis跨平台路径 - 修复利用功能的路径和超时问题 Windows编译警告 - 修复fscan-lite平台兼容性 Go 1.20兼容 - 降级依赖保持兼容性 测试增强（20项） 单元测试 - 核心模块覆盖率74-100% 并发安全测试 - State对象、指纹匹配引擎专项测试 集成测试 - Web扫描/端口扫描/服务探测/SSH认证/ICMP探测 CLI参数测试 - 命令行参数解析验证 性能基准测试 - AdaptivePool、服务探测策略benchmark ResultBuffer测试 - 去重和完整度评分验证 工程化改进 CI流程优化 - golangci-lint v2升级，简化构建步骤 Issue自动化 - GitHub Issue模板优化，Project自动化工作流 Lint全量修复 - revive/errcheck/shadow/staticcheck/gosimple全部通过 README重写 - 中英文文档全面更新 代码格式统一 - gofmt/goimports规范化 快速开始 bash # 扫描C段 ./fscan -h 192.168.1.1/24 # 指定端口 ./fscan -h 192.168.1.1 -p 22,80,443,3389 # 仅存活探测 ./fscan -h 192.168.1.1/24 -ao # 禁用爆破 ./fscan -h 192.168.1.1/24 -nobr # Web扫描 ./fscan -u http://192.168.1.1 # 本地插件 ./fscan -local systeminfo # Hash碰撞 ./fscan -h 192.168.1.1 -m smb2 -user admin -hash xxxxx # Redis写公钥 ./fscan -h 192.168.1.1 -m redis -rf id_rsa.pub 编译 bash # 标准编译 go build -ldflags="-s -w" -trimpath -o fscan . # 带Web管理界面 go build -tags web -ldflags="-s -w" -trimpath -o fscan-web . 安装 bash # Arch Linux yay -S fscan-git 运行截图fscan.exe -h 192.168.x.x 图片fscan.exe -h 192.168.x.x -rf id_rsa.pub (Redis写公钥) 图片fscan.exe -h 192.168.x.x -m ssh -user root -pwd password 图片fscan.exe -h 192.168.x.x -m ssh -user root -pwda pass1 pass2 pass3 (追加多个密码)fscan.exe -h 192.168.x.x -p80 -proxy http://127.0.0.1:8080 图片fscan.exe -h 192.168.x.x -socks5 socks5://user:pass@127.0.0.1:1080 (SOCKS5认证代理)fscan.exe -h 192.168.x.x -p 139 -m netbios 图片fscan.exe -h 192.0.0.0/8 -m icmp img.png图片2.0-1图片2.0-2图片 路线图 更新计划 更新周期 - 每月一次版本发布 前两周 - 新功能开发与特性更新 后两周 - Bug修复与代码整合 欢迎PR - 期待您的贡献！ SDK & Agent 集成 扩展SDK能力，完善端侧Agent嵌入支持 断点续扫、带宽级限速、内存水位控制 更多Agent场景的集成示例 插件生态 持续扩展服务插件覆盖范围 为每个服务插件开发更多漏洞检测和利用能力 保持插件API向后兼容，确保旧版本POC持续可用 Fscan-lite C语言重写的轻量版本 更小的体积，更少的依赖 支持更多嵌入式/受限环境 目录: fscan-lite Fscan-lab 内网渗透测试靶场环境 覆盖所有fscan支持的漏洞场景 开发测试与功能验证平台 新手学习与技能练习环境 目录: fscan-lab 免责声明本工具仅面向合法授权的企业安全建设行为。使用前请确保已获得授权，符合当地法律法规，不对非授权目标扫描。作者不承担任何非法使用产生的后果。 404StarLink图片fscan 是 404Team 星链计划2.0 成员项目。 Star趋势 捐赠请作者喝饮料 参考- https://github.com/Adminisme/ServerScan https://github.com/netxfly/x-crack https://github.com/hack2fun/Gscan https://github.com/k8gege/LadonGo https://github.com/jjf012/gopoc https://github.com/chainreactors/gogo https://github.com/0x727/FingerprintHub https://github.com/killmonday/fscanx {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/shadow1ng/fscan ⭐ Star数：14514 💻 开发语言：Go 📝 项目描述：一款内网综合扫描工具方便一键自动化、全方位漏扫扫描。（内网综合扫描工具，实现一键自动化、全方位漏洞扫描） {/card-default} 总的来说，fscan是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
白帽黑客工具箱：xmrig 篇 推荐一个实用的开源工具——xmrig。项目由xmrig开发维护，GitHub上获得了 10114 个Star。简单来说，它是一款RandomX、KawPow、CryptoNight和GhostRider统一CPU/GPU矿机和RandomX基准测试，对于站长和开发者来说是个不错的工具。 工具功能介绍 XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and GhostRider unified CPU/GPU miner and RandomX benchmark. Official binaries are available for Windows, Linux, macOS and FreeBSD. Mining backends CPU (x86/x64/ARMv7/ARMv8/RISC-V) OpenCL for AMD GPUs. CUDA for NVIDIA GPUs via external CUDA plugin. Download Binary releases Build from source Usage The preferred way to configure the miner is the JSON config file as it is more flexible and human friendly. The command line interface does not cover all features, such as mining profiles for different algorithms. Important options can be changed during runtime without miner restart by editing the config file or executing API calls.* Wizard helps you create initial configuration for the miner. Workers helps manage your miners via HTTP API. Donations Default donation 1% (1 minute in 100 minutes) can be increased via option donate-level or disabled in source code. XMR: 48edfHu7V9Z84YzzMa6fUueoELZ9ZRXq9VetWzYGzKt52XU5xvqgzYnDK9URnRoJMk1j8nLwEVsaSWJ4fhdUyZijBGUicoD Developers xmrig sech1 Contacts support@xmrig.com reddit twitter {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/xmrig/xmrig ⭐ Star数：10114 💻 开发语言：C 📝 项目描述：RandomX、KawPow、CryptoNight和GhostRider统一CPU/GPU矿机和RandomX基准测试 {/card-default} 总的来说，xmrig是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
vuls - 提升工作效率的好帮手 推荐一个实用的开源工具——vuls。项目由future-architect开发维护，GitHub上获得了 12253 个Star。简单来说，它是一款适用于Linux、FreeBSD、Container、WordPress、编程语言库、网络设备的无代理漏洞扫描程序，对于站长和开发者来说是个不错的工具。 工具功能介绍 Vuls-logo图片Vulnerability scanner for Linux/FreeBSD, agent-less, written in Go. Twitter: @vuls_enVuls-Abstract图片Vulsrepo图片Vuls-slack图片---- Abstract For a system administrator, having to perform security vulnerability analysis and software update on a daily basis can be a burden. To avoid downtime in a production environment, it is common for a system administrator to choose not to use the automatic update option provided by the package manager and to perform update manually. This leads to the following problems.- The system administrator will have to constantly watch out for any new vulnerabilities in NVD (National Vulnerability Database) or similar databases. It might be impossible for the system administrator to monitor all the software if there are a large number of software packages installed in the server. It is expensive to perform analysis to determine the servers affected by new vulnerabilities. The possibility of overlooking a server or two during analysis is there.Vuls is a tool created to solve the problems listed above. It has the following characteristics.- Informs users of the vulnerabilities that are related to the system. Informs users of the servers that are affected. Vulnerability detection is done automatically to prevent any oversight. A report is generated on a regular basis using CRON or other methods. to manage vulnerability.Vuls-Motivation图片---- Main Features Scan for any vulnerabilities in Linux/FreeBSD/Windows/macOSSupports major Linux/FreeBSD/Windows/macOS- Alpine, Amazon Linux, CentOS, AlmaLinux, Rocky Linux, Debian, Oracle Linux, Raspbian, RHEL, openSUSE, openSUSE Leap, SUSE Enterprise Linux, Fedora, and Ubuntu FreeBSD Windows macOS Cloud, on-premise, Running Docker Container High-quality scan- Vulnerability Database NVD JVN(Japanese)- OVAL Red Hat Debian Ubuntu SUSE Oracle Linux- Security Advisory Alpine-secdb Red Hat Security Advisories Debian Security Bug Tracker Ubuntu CVE Tracker Microsoft CVRF- Commands(yum, zypper, pkg-audit) RHSA / ALAS / ELSA / FreeBSD-SA Changelog- PoC, Exploit Exploit Database Metasploit-Framework modules qazbnm456/awesome-cve-poc nomi-sec/PoC-in-GitHub gmatuz/inthewilddb projectdiscovery/nuclei-templates- CERT US-CERT JPCERT- KEV CISA(Cybersecurity & Infrastructure Security Agency): Known Exploited Vulnerabilities Catalog VulnCheck: VulnCheck KEV- Cyber Threat Intelligence(MITRE ATT&CK and CAPEC) mitre/cti- Libraries aquasecurity/vuln-list- WordPress wpscan Scan modeFast Scan- Scan without root privilege, no dependencies Almost no load on the scan target server Offline mode scan with no internet access. (CentOS, Alma Linux, Rocky Linux, Debian, Oracle Linux, Red Hat, Fedora, and Ubuntu)Fast Root Scan- Scan with root privilege Almost no load on the scan target server Detect processes affected by update using yum-ps (Amazon Linux, CentOS, Alma Linux, Rocky Linux, Oracle Linux, Fedora, and RedHat) Detect processes which updated before but not restarting yet using checkrestart of debian-goodies (Debian and Ubuntu) Offline mode scan with no internet access. (CentOS, Alma Linux, Rocky Linux, Debian, Oracle Linux, Red Hat, Fedora, and Ubuntu) Remote, Local scan mode, Server modeRemote scan mode- User is required to only set up one machine that is connected to other target servers via SSHLocal scan mode- If you don't want the central Vuls server to connect to each server by SSH, you can use Vuls in the Local Scan mode.Server mode- First, start Vuls in server mode and listen as an HTTP server. Next, issue a command on the scan target server to collect software information. Then send the result to Vuls Server via HTTP. You receive the scan results as JSON format. No SSH needed, No Scanner needed. Only issuing Linux commands directory on the scan target server. Dynamic Analysis- It is possible to acquire the state of the server by connecting via SSH and executing the command. Vuls warns when the scan target server was updated the kernel etc. but not restarting it. Scan vulnerabilities of non-OS-packages- Libraries of programming language Self-compiled software Network DevicesVuls has some options to detect the vulnerabilities- Lockfile based Scan GitHub Integration Common Platform Enumeration (CPE) based Scan OWASP Dependency Check Integration Scan WordPress core, themes, plugins- Scan WordPress MISC- Nondestructive testing Pre-authorization is NOT necessary before scanning on AWS Vuls works well with Continuous Integration since tests can be run every day. This allows you to find vulnerabilities very quickly. Auto-generation of configuration file template Auto-detection of servers set using CIDR, generate configuration file template Email and Slack notification is possible (supports Japanese language) Scan result is viewable on accessory software, TUI Viewer in a terminal or Web UI (VulsRepo).---- What Vuls Doesn't Do- Vuls doesn't update the vulnerable packages.---- Document For more information such as Installation, Tutorial, Usage, visit vuls.io 日本語翻訳ドキュメント---- Authorskotakanbe (@kotakanbe) created vuls and these fine people have contributed. Contributesee vulsdoc---- Sponsors| | | Tines is no-code automation for security teams. Build powerful, reliable workflows without a development team. SAKURA internet Inc. is an Internet company founded in 1996. We provide cloud computing services such as "Sakura's Shared Server", "Sakura's VPS", and "Sakura's Cloud" to meet the needs of a wide range of customers, from individuals and corporations to the education and public sectors, using its own data centers in Japan. Based on the philosophy of "changing what you want to do into what you can do," we offer DX solutions for all fields.----License Please see LICENSE. {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/future-architect/vuls ⭐ Star数：12253 💻 开发语言：Go 📝 项目描述：适用于Linux、FreeBSD、Container、WordPress、编程语言库、网络设备的无代理漏洞扫描程序 {/card-default} 总的来说，vuls是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
站长必备！hackingtool 效率神器分享 推荐一个实用的开源工具——hackingtool。项目由Z4nzu开发维护，GitHub上获得了 79344 个Star。简单来说，它是一款面向黑客的一体化黑客工具，对于站长和开发者来说是个不错的工具。 工具功能介绍 215 curated tools across 21 categories — recon, OSINT, web, wireless, phishing, forensics, post-exploitation and more — with an **AI layer that turns plain English into the right tool and the exact command.Built for** penetration testers · red teamers · blue-team/SOC and DFIR analysts · OSINT researchers · bug-bounty hunters · CTF players · security researchers and students — all working legally, on systems they own or are authorised to test. 图片 图片 图片 图片 图片 --- Contents- Why hackingtool Tool Categories Installation From source with pipx (recommended) For development Docker Optional runtimes Quick Commands Command reference Features 🔎 /find — a tool for a need you don't have yet 🎯 /goal — plan an objective, run it one step at a time 🧠 Recommendations — say what you want in plain English 🏷 Tags and search ▶ Background panes (tmux) ⚙ Settings and the AI layer 📋 Headless engagements Documentation Contributing Support & Sponsor Social--- Why hackingtool- 🧠 AI-guided workflow — describe what you want ("find subdomains of example.com") and it maps your intent to the right tools, hands you the exact documented command, plans an objective step by step, then summarizes findings and drafts an engagement report. Bring your own key or run a local model — nothing auto-executes and nothing is fabricated. 🗂 215 curated tools, one console — install and run across 21 categories without hunting down Git repos; a fixed tag taxonomy (63 tags in use) makes every tool discoverable. 🔎 It knows what it doesn't have — /find searches your catalog first, then the GitHub API, and shows real maintained projects with the reason each was ranked. 🛡 Safe by default — standard installs, no curl | bash, downloads pinned + SHA-256 verified, list-form subprocess, no forced sudo, and signed releases with an SBOM. 🎯 For the whole spectrum — red team, blue team, OSINT, bug bounty, CTF/THM, forensics/IR — all on authorized targets only. The console on launch — live system readout, and / opens the command palette. Tool Categories215 tools across 21 categories — the full list, with links and tags, is in docs/TOOLS.md.| | Category | Tools | | | Category | Tools | 1🛡 Anonymously Hiding Tools5 12🔁 Reverse engineering tools102🔍 Information gathering tools26 13⚡ DDOS Attack Tools73📚 Wordlist Generator8 14🖥 Remote Administrator Tools (RAT)44📡 Wireless attack tools17 15🧪 XSS Attack Tools65💉 SQL Injection Tools7 16🖼 Steganography Tools106🎣 Phishing attack tools13 17🏢 Active Directory Tools107🌐 Web Attack tools23 18☁ Cloud Security Tools78🔧 Post exploitation tools15 19📱 Mobile Security Tools69🕵 Forensic tools12 20✨ Other tools1010📦 Payload creation tools6 21🔑 Password / Hash Cracking711🧰 Exploit framework6 59 further entries are archived (unmaintained or dead upstream) and hidden unlessyou set show_archived true via /config. The in-app header counts 22 categories / 217 tools because it also counts the built-in Update / Uninstall menu.--- Installation Requires Python 3.10+ on Linux or macOS (Kali, Parrot, Debian/Ubuntu, Arch, …). Windows is not supported — the app tells you so and exits. No curl | bash: every path below is a standard, verifiable install. From source with pipx (recommended)pipx installs hackingtool into its own isolated environment and puts the hackingtool command on your PATH, so you can launch it from any directory. bash # 1 — get the code git clone https://github.com/Z4nzu/hackingtool.git cd hackingtool # 2 — install it onto your PATH (isolated venv, no system Python touched) pipx install . # 3 — run it from anywhere hackingtool No pipx yet? bash # macOS brew install pipx && pipx ensurepath # Debian / Ubuntu / Kali sudo apt install pipx && pipx ensurepath Open a new shell after pipx ensurepath so the PATH change takes effect. To update later: git pull && pipx install . --force. To remove it: pipx uninstall hackingtool. Alternative: uv tool install . (same result, uses uv instead of pipx) bash git clone https://github.com/Z4nzu/hackingtool.git cd hackingtool uv tool install . # installs the `hackingtool` executable on your PATH hackingtool Alternative: plain venv + pip (no PATH changes) bash git clone https://github.com/Z4nzu/hackingtool.git cd hackingtool python3 -m venv .venv && . .venv/bin/activate pip install . # or: pip install -e . for an editable dev install hackingtool The command is only on your PATH while that venv is activated. For developmentuv creates the virtualenv and installs everything from pyproject.toml / uv.lock in one step: bash git clone https://github.com/Z4nzu/hackingtool.git cd hackingtool uv sync uv run hackingtool No uv yet? pipx install uv (or see the uv install docs).Contributing? make setup wires the pre-push hook and make check runs the full gate (lint + tests + catalog validation). See CONTRIBUTING.md. Docker Pull and run the published image: bash docker run -it --rm hardikzinzu/hackingtool:latest Or build it locally from a checkout: bash git clone https://github.com/Z4nzu/hackingtool.git && cd hackingtool docker build -t hackingtool . docker run -it --rm hackingtool Optional runtimesSome individual tools need a language runtime to install/run; the core app doesn't.| Dependency | Version | Needed for | Go1.21+nuclei, ffuf, amass, httpx, katana, dalfox, gobuster, subfinderRubyanyhaiti, evil-winrmtmuxanybackground panes (/run … &, /panes, /attach)DockeranyMythic, MobSF (optional)---Quick CommandsLaunch hackingtool and type. There are only three kinds of input:| You type | It means | Example | /…a command you run/search subdomain@…a thing you name@nmap, @tag:osintanything elseplain English "what I want to do"crack a wifi handshake@ completes tool names — @tag: completes tags, / completes commands. Command reference| Command | Aliases | What it does | /run [args] [&]/openopen a tool's menu; with a trailing & it runs in a background tmux pane instead (that's where args are used)/search search tools by name, description or tag/tags list every tag with its tool count/ai /recommend, /rrecommend tools for a goal/goal AI-plan an objective and run it step by step, with per-step confirmation/find /discoverfind tools for a need — your catalog first, then GitHub (suggest-only)/panes/jobslist background panes/attach attach to the background session (Ctrl-b d to return)/kill kill one background pane, or all of them/config [key value] view/change settings; /config test checks the AI connection, /config github checks the GitHub token/skill show the operator playbook/update · /uninstall/removeupdate system packages or hackingtool · remove hackingtool and its tools/clear/clsclear the screen/back/bleave the current tool and go back/help/?, /hquick reference card/quit/q, /exitexit (also q, Ctrl-C, Ctrl-D)@ open a tool (case-insensitive, fuzzy fallback)@tag: list and pick from the tools carrying that tagInside a category: 1–N pick a tool · 97 install everything not yet installed ·98 archived tools · 99 back. Inside a tool: 1 install · 2 run · c ask for the exact command for your goal · 98 project page · 99 back. /help — the same card, in the app. On a non-interactive terminal (or without prompt_toolkit) hackingtool falls back to the classic numbered menu, where / or s searches, t filters by tag, r or a recommends, ? helps and q quits. Force it with hackingtool --classic.> New here? docs/HOW-TO-USE.md walks through each of these start to finish with numbered steps.---Features 🔎 /find — a tool for a need you don't have yetSearches the 215 curated tools first, then the GitHub search API, and ranks the results explainably. Suggest-only — it never clones, installs or runs anything — and it makes zero model calls. /find crack a wpa handshakeIn your toolbox (vetted) • aircrack-ng (WiFi security suite) • Kismet (wireless detector / WIDS) • Reaver (WPS PIN attack) • WiGLE (wardriving map & API) • hashcat example hashes (WPA mode 22000)Found on GitHub — NOT vetted by uswifiphisher/wifiphisher 14713★ GPL-3.0 The Rogue Access Point Framework 14713★ · trusted author (ships in our catalog) · active · matches: security, wifi git clone https://github.com/wifiphisher/wifiphisher … Press a to keep a result: it is saved to ~/.hackingtool/found.yaml as a "Discovered tools" entry — title, tags, description, link, and **no install or run command**, so a discovered entry can never execute anything. It shows up in your menu and in /search next launch.Out-of-scope asks (jamming, DoS, mass-targeting, malware) are refused **before any network call**, with an authorized alternative where one exists. Defensive/DFIR phrasing is never refused.Works anonymously at 10 GitHub searches/minute; a no-scope, no-permission token raises that to 30 — see /config github. 🎯 /goal — plan an objective, run it one step at a time /goal find live subdomains of example.com hackingtool drafts a short plan of real commands (with the reason for each step and an install hint for tools you don't have), asks you to confirm you are authorized to test the target, then walks the steps: [y] run · [s] skip · [e] edit · [q] abort. Every step runs list-form — never through a shell — and each goal gets a timestamped workspace under ~/.hackingtool/goals/ holding plan.json, a UTC-stamped run.log, and the raw output of each step.The model is called once, for planning; tool output is never fed back to it. With no model configured, /goal degrades to tool recommendations for the same objective. 🧠 Recommendations — say what you want in plain EnglishBare text (or /ai) maps intent to tools. The model may only return tags from the fixed taxonomy, and the catalog resolves tags → tools, so a tool can never be invented; with no model reachable a stdlib keyword matcher answers instead. /ai — pick one of the common tasks, or type the job in your own words. 🏷 Tags and search/tags prints every tag in use with its live tool count; @tag: opens the tools carrying it; /search matches names, descriptions and tags. /tags — 63 tags in use, with the number of tools behind each. ▶ Background panes (tmux)Long scans shouldn't block your console. With tmux installed, /run … & opens a labeled window in one detached hackingtool session: /run nmap -sV -oA scan 10.0.0.5 & ▶ started 'nmap' in background — /attach to view ` /panes lists them, /attach watches one (Ctrl-b d to come back), /kill ` or /kill all stops them, and the status line under the prompt shows ▶ N running. No tmux? It says so and opens the tool inline instead; disable it entirely with /config background_runner off. ⚙ Settings and the AI layer/config opens a full-screen settings editor (↑↓ move, ←→ change, Enter edit, t test the connection, Esc close); /config sets one key from the prompt. Settings live in ~/.hackingtool/config.json.The AI layer is opt-in and bring-your-own-key: an OpenAI-compatible endpoint when ai_base_url + an API key are set, else a local Ollama, else nothing — every feature degrades to a deterministic offline behaviour instead of guessing. Your API key is written only to ~/.hackingtool/.env (mode 600), never to config.json, and never printed back. /config test reports the real failure if a probe fails. 📋 Headless engagementsThe same catalog drives a non-interactive orchestrator that normalizes tool output into one findings.json: bash hackingtool --engagement acme --targets example.com --pipeline recon hackingtool --engagement acme --report # deterministic Markdown report hackingtool --engagement acme --ai-summary # opt-in triage of the REAL findings hackingtool --engagement acme --ai-report # opt-in narrative draft (report.draft.md) Out-of-scope targets are flagged and logged before anything runs, and the AI passes only ever summarize findings that exist.--- Documentation... {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/Z4nzu/hackingtool ⭐ Star数：79344 💻 开发语言：Python 📝 项目描述：面向黑客的一体化黑客工具 {/card-default} 总的来说，hackingtool是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
Osintgram 使用教程与功能详解 推荐一个实用的开源工具——Osintgram。项目由Datalux开发维护，GitHub上获得了 14305 个Star。简单来说，它是一款Osintgram是Instagram上的OSINT工具。它提供了一个交互式外壳，可以通过其昵称对任何用户的Instagram帐户进行分析，对于站长和开发者来说是个不错的工具。 工具功能介绍 Osintgram is an OSINT tool on Instagram to collect, analyze, and run reconnaissance. Disclaimer: FOR EDUCATIONAL PURPOSE ONLY! The contributors do not assume any responsibility for the use of this tool.$${\color{red}Warning:}$$ It is advisable to not use your own/primary account when using this tool.$${\color{red}Warning:}$$ If you fork the project and add your instagram credentials to you home repository do not upload them to github. You can disable uploading a certain file by adding it to ignore list. Tools and Commands 🧰Osintgram offers an interactive shell to perform analysis on Instagram account of any users by its nickname. You can get: text - addrs Get all registered addressed by target photos - captions Get user's photos captions - comments Get total comments of target's posts - followers Get target followers - followings Get users followed by target - fwersemail Get email of target followers - fwingsemail Get email of users followed by target - fwersnumber Get phone number of target followers - fwingsnumber Get phone number of users followed by target - hashtags Get hashtags used by target - info Get target info - likes Get total likes of target's posts - mediatype Get user's posts type (photo or video) - photodes Get description of target's photos - photos Download user's photos in output folder - propic Download user's profile picture - stories Download user's stories - tagged Get list of users tagged by target - wcommented Get a list of user who commented target's photos - wtagged Get a list of user who tagged target You can find detailed commands usage here.Latest version | Commands | CHANGELOG FAQ Can I access the contents of a private profile? No, you cannot get information on private profiles. You can only get information from a public profile or a profile you follow. The tools that claim to be successful are scams! What is and how I can bypass the challenge_required error? The challenge_required error means that Instagram notice a suspicious behavior on your profile, so needs to check if you are a real person or a bot. To avoid this you should follow the suggested link and complete the required operation (insert a code, confirm email, etc) Installation ⚙️1. Fork/Clone/Download this repogit clone https://github.com/Datalux/Osintgram.git2. Navigate to the directorycd Osintgram3. Create a virtual environment for this projectpython3 -m venv venv4. Load the virtual environment On Windows Powershell: .\venv\Scripts\activate.ps1 On Linux and Git Bash: source venv/bin/activate Run pip install -r requirements.txt6. Open the credentials.ini file in the config folder and write your Instagram account username and password in the corresponding fields. Or use hikerapi_token from https://hikerapi.com/tokens (first 100 requests are free after registration and confirmation of your tg)Alternatively, you can run the make setup command to populate this file for you.7. Run the main.py script in one of three ways* As an interactive prompt python3 main.py Or execute your command straight away python3 main.py --command Or execute using HikerAPI token via env HIKERAPI_TOKEN= python3 main.py -c Use Osintgram v2 (beta) You can use Osintgram2 beta just switching to v2 branch. The v2 has some improvements and is faster with a new command execution interface. Try it just running git checkout v2. Docker Quick Start 🐳This section will explain how you can quickly use this image with Docker or Docker-compose. Prerequisites Before you can use either Docker or Docker-compose, please ensure you do have the following prerequisites met.1. Docker installed - link Docker-composed installed (if using Docker-compose) - link Credentials configured - This can be done manually or by running the make setup command from the root of this repoImportant: Your container will fail if you do not do step #3 and configure your credentials Docker If docker is installed you can build an image and run this as a container.Build: bash docker build -t osintgram . Run: bash docker run --rm -it -v "$PWD/output:/home/osintgram/output" osintgram The `` is the Instagram account you wish to use as your target for recon. The required -i flag enables an interactive terminal to use commands within the container. docs The required -v flag mounts a volume between your local filesystem and the container to save to the ./output/ folder. docs The optional --rm flag removes the container filesystem on completion to prevent cruft build-up. docs The optional -t flag allocates a pseudo-TTY which allows colored output. docs Using docker-composeYou can use the docker-compose.yml file this single command: bash docker-compose run osintgram Where target is the Instagram target for recon.Alternatively, you may run docker-compose with the Makefile:make run - Builds and Runs with compose. Prompts for a target before running. Makefile (easy mode)For ease of use with Docker-compose, a Makefile has been provided.Here is a sample work flow to spin up a container and run osintgram with just two commands!1. make setup - Sets up your Instagram credentials make run - Builds and Runs a osintgram container and prompts for a targetSample workflow for development:1. make setup - Sets up your Instagram credentials make build-run-testing - Builds an Runs a container without invoking the main.py script. Useful for an it Docker session for development make cleanup-testing - Cleans up the testing container created from build-run-testing Development version 💻To use the development version with the latest feature and fixes just switch to development branch using Git:git checkout developmentand update to last version using:git pull origin development Updating ⬇️To update Osintgram with the stable release just pull the latest commit using Git.1. Make sure you are in the master branch running: git checkout master Download the latest version: git pull origin master Contributing 💡You can propose a feature request opening an issue or a pull request.Here is a list of Osintgram's contributors: External library 🔗Instagram API {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/Datalux/Osintgram ⭐ Star数：14305 💻 开发语言：Python 📝 项目描述：Osintgram是Instagram上的OSINT工具。它提供了一个交互式外壳，可以通过其昵称对任何用户的Instagram帐户进行分析 {/card-default} 总的来说，Osintgram是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
深度评测：web-check 这款工具到底怎么样 推荐一个实用的开源工具——web-check。项目由lissy93开发维护，GitHub上获得了 34690 个Star。简单来说，它是一款用于分析任何网站的一🕵️♂️体化OSINT工具，对于站长和开发者来说是个不错的工具。 工具功能介绍 Web-Check Comprehensive, on-demand open source intelligence for any website 🌐 web-check.xyz---Kindly supported by: NinjaPear API to get a full B2B profiles from any URL Terminal Trove The $HOME of all things in the terminal Warp Built for coding with multiple AI agents About Screenshot Live Demo Mirror Features Usage Deployment Option#1: Netlify Option#2: Vercel Option#3: Docker Option#4: Render Option#5: Source Configuration Options Developer Setup Community Contributing Bugs Support License--- About Get an insight into the inner-workings of a given website: uncover potential attack vectors, analyse server architecture, view security configurations, and learn what technologies a site is using.Currently the dashboard will show: IP info, SSL chain, DNS records, cookies, headers, domain info, search crawl rules, page map, server location, redirect ledger, open ports, traceroute, DNS security extensions, site performance, trackers, associated hostnames, carbon footprint. Stay tuned, as I'll add more soon!The aim is to help you easily understand, optimize and secure your website. Screenshot Expand ScreenshotScreenshot图片Screenshot图片 Live DemoA hosted version can be accessed at: web-check.as93.net Mirror The source for this repo is mirrored to CodeBerg, available at: codeberg.org/alicia/web-check Status Build & Deploys: Repo Management & Miscellaneous: Features Click to expand / collapse sectionNote _this list needs updating, many more jobs have been added since..._The following section outlines the core features, and briefly explains why this data might be useful for you to know, as well as linking to further resources for learning more. IP Info Description An IP address (Internet Protocol address) is a numerical label assigned to each device connected to a network / the internet. The IP associated with a given domain can be found by querying the Domain Name System (DNS) for the domain's A (address) record. Use CasesFinding the IP of a given server is the first step to conducting further investigations, as it allows us to probe the server for additional info. Including creating a detailed map of a target's network infrastructure, pinpointing the physical location of a server, identifying the hosting service, and even discovering other domains that are hosted on the same IP address. Useful Links- Understanding IP Addresses IP Addresses - Wiki RFC-791 Internet Protocol whatismyipaddress.com SSL Chain DescriptionSSL certificates are digital certificates that authenticate the identity of a website or server, enable secure encrypted communication (HTTPS), and establish trust between clients and servers. A valid SSL certificate is required for a website to be able to use the HTTPS protocol, and encrypt user + site data in transit. SSL certificates are issued by Certificate Authorities (CAs), which are trusted third parties that verify the identity and legitimacy of the certificate holder. Use CasesSSL certificates not only provide the assurance that data transmission to and from the website is secure, but they also provide valuable OSINT data. Information from an SSL certificate can include the issuing authority, the domain name, its validity period, and sometimes even organization details. This can be useful for verifying the authenticity of a website, understanding its security setup, or even for discovering associated subdomains or other services. Useful Links- TLS - Wiki What is SSL (via Cloudflare learning) RFC-8446 - TLS SSL Checker DNS Records Description This task involves looking up the DNS records associated with a specific domain. DNS is a system that translates human-readable domain names into IP addresses that computers use to communicate. Various types of DNS records exist, including A (address), MX (mail exchange), NS (name server), CNAME (canonical name), and TXT (text), among others. Use CasesExtracting DNS records can provide a wealth of information in an OSINT investigation. For example, A and AAAA records can disclose IP addresses associated with a domain, potentially revealing the location of servers. MX records can give clues about a domain's email provider. TXT records are often used for various administrative purposes and can sometimes inadvertently leak internal information. Understanding a domain's DNS setup can also be useful in understanding how its online infrastructure is built and managed. Useful Links- What are DNS records? (via Cloudflare learning) DNS Record Types RFC-1035 - DNS DNS Lookup (via MxToolbox) Cookies Description The Cookies task involves examining the HTTP cookies set by the target website. Cookies are small pieces of data stored on the user's computer by the web browser while browsing a website. They hold a modest amount of data specific to a particular client and website, such as site preferences, the state of the user's session, or tracking information. Use CasesCookies can disclose information about how the website tracks and interacts with its users. For instance, session cookies can reveal how user sessions are managed, and tracking cookies can hint at what kind of tracking or analytics frameworks are being used. Additionally, examining cookie policies and practices can offer insights into the site's security settings and compliance with privacy regulations. Useful Links- HTTP Cookie Docs (Mozilla) What are Cookies (via Cloudflare Learning) Testing for Cookie Attributes (OWASP) RFC-6265 - Cookies Crawl Rules Description Robots.txt is a file found (usually) at the root of a domain, and is used to implement the Robots Exclusion Protocol (REP) to indicate which pages should be ignored by which crawlers and bots. It's good practice to avoid search engine crawlers from over-loading your site, but should not be used to keep pages out of search results (use the noindex meta tag or header instead). Use CasesIt's often useful to check the robots.txt file during an investigation, as it can sometimes disclose the directories and pages that the site owner doesn't want to be indexed, potentially because they contain sensitive information, or reveal the existence of otherwise hidden or unlinked directories. Additionally, understanding crawl rules may offer insights into a website's SEO strategies. Useful Links- Google Search Docs - Robots.txt Learn about robots.txt (via Moz.com) RFC-9309 - Robots Exclusion Protocol Robots.txt - wiki Headers Description The Headers task involves extracting and interpreting the HTTP headers sent by the target website during the request-response cycle. HTTP headers are key-value pairs sent at the start of an HTTP response, or before the actual data. Headers contain important directives for how to handle the data being transferred, including cache policies, content types, encoding, server information, security policies, and more. Use CasesAnalyzing HTTP headers can provide significant insights in an OSINT investigation. Headers can reveal specific server configurations, chosen technologies, caching directives, and various security settings. This information can help to determine a website's underlying technology stack, server-side security measures, potential vulnerabilities, and general operational practices. Useful Links- HTTP Headers - Docs RFC-7231 Section 7 - Headers List of header response fields OWASP Secure Headers Project Quality Metrics Description Using Lighthouse, the Quality Metrics task measures the performance, accessibility, best practices, and SEO of the target website. This returns a simple checklist of 100 core metrics, along with a score for each category, to gauge the overall quality of a given site. Use CasesUseful for assessing a site's technical health, SEO issues, identify vulnerabilities, and ensure compliance with standards. Useful Links- Lighthouse Docs Google Page Speed Tools W3 Accessibility Tools Google Search Console SEO Checker PWA Builder Server Location Description The Server Location task determines the physical location of the server hosting a given website based on its IP address. This is done by looking up the IP in a location database, which maps the IP to a lat + long of known data centers and ISPs. From the latitude and longitude, it's then possible to show additional contextual info, like a pin on the map, along with address, flag, time zone, currency, etc. Use CasesKnowing the server location is a good first step in better understanding a website. For site owners this aids in optimizing content delivery, ensuring compliance with data residency requirements, and identifying potential latency issues that may impact user experience in specific geographical regions. And for security researchers, it helps assess the risk posed by specific regions or jurisdictions regarding cyber threats and regulations. Useful Links- IP Locator Internet Geolocation - Wiki Associated Hosts Description This task involves identifying and listing all domains and subdomains (hostnames) that are associated with the website's primary domain. This process often involves DNS enumeration to discover any linked domains and hostnames, as well as looking at known DNS records. Use CasesDuring an investigation, understanding the full scope of a target's web presence is critical. Associated domains could lead to uncovering related projects, backup sites, development/test sites, or services linked to the main site. These can sometimes provide additional information or potential security vulnerabilities. A comprehensive list of associated domains and hostnames can also give an overview of the organization's structure and online footprint. Useful Links- DNS Enumeration - Wiki OWASP - Enumerate Applications on Webserver DNS Enumeration - DNS Dumpster Subdomain Finder Redirect Chain Description This task traces the sequence of HTTP redirects that occur from the original URL to the final destination URL. An HTTP redirect is a response with a status code that advises the client to go to another URL. Redirects can occur for several reasons, such as URL normalization (directing to the www version of the site), enforcing HTTPS, URL shorteners, or forwarding users to a new site location. Use CasesUnderstanding the redirect chain can be useful for several reasons. From a security perspective, long or complicated redirect chains can be a sign of potential security risks, such as unencrypted redirects in the chain. Additionally, redirects can impact website performance and SEO, as each redirect introduces additional round-trip-time (RTT). For OSINT, understanding the redirect chain can help identify relationships between different domains or reveal the use of certain technologies or hosting providers. Useful Links- HTTP Redirects - MDN URL Redirection - Wiki 301 Redirects explained TXT Records DescriptionTXT records are a type of DNS record that provides text information to sources outside your domain. They can be used for a variety of purposes, such as verifying domain ownership, ensuring email security, and even preventing unauthorized changes to your website. Use CasesThe TXT records often reveal which external services and technologies are being used with a given domain. They may reveal details about the domain's email configuration, the use of specific services like Google Workspace or Microsoft 365, or security measures in place such as SPF and DKIM. Understanding these details can give an insight into the technologies used by the organization, their email security practices, and potential vulnerabilities. Useful Links- TXT Records (via Cloudflare Learning) TXT Records - Wiki RFC-1464 - TXT Records TXT Record Lookup (via MxToolbox) Server Status Description Checks if a server is online and responding to requests... {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/lissy93/web-check ⭐ Star数：34690 💻 开发语言：TypeScript 📝 项目描述：用于分析任何网站的一🕵️♂️体化OSINT工具 {/card-default} 总的来说，web-check是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
安全圈热门工具 sqlmap 体验分享 推荐一个实用的开源工具——sqlmap。项目由sqlmapproject开发维护，GitHub上获得了 38375 个Star。简单来说，它是一款自动SQL注入和数据库接管工具，对于站长和开发者来说是个不错的工具。 工具功能介绍 sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switches including database fingerprinting, over data fetching from the database, accessing the underlying file system, and executing commands on the operating system via out-of-band connections.Screenshots ----Screenshot图片You can visit the collection of screenshots demonstrating some of the features on the wiki.Installation ----You can download the latest tarball by clicking here or latest zipball by clicking here.Preferably, you can download sqlmap by cloning the Git repository:git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-devsqlmap works out of the box with Python version 2.7 and 3.x on any platform.Usage ----To get a list of basic options and switches use:python sqlmap.py -hTo get a list of all options and switches use:python sqlmap.py -hhYou can find a sample run here. To get an overview of sqlmap capabilities, a list of supported features, and a description of all options and switches, along with examples, you are advised to consult the user's manual.Links ----* Homepage: https://sqlmap.org Download: .tar.gz or .zip Commits RSS feed: https://github.com/sqlmapproject/sqlmap/commits/master.atom Issue tracker: https://github.com/sqlmapproject/sqlmap/issues User's manual: https://github.com/sqlmapproject/sqlmap/wiki Frequently Asked Questions (FAQ): https://github.com/sqlmapproject/sqlmap/wiki/FAQ X: @sqlmap Demos: https://www.youtube.com/user/inquisb/videos Playground: https://sekumart.sekuripy.hr Research: https://www.sekuripy.hr/labs/sqlmap/#research Screenshots: https://github.com/sqlmapproject/sqlmap/wiki/ScreenshotsTranslations ----* Arabic Bengali Bulgarian Chinese Croatian Dutch French Georgian German Greek Hindi Indonesian Italian Japanese Korean Kurdish (Central) Persian Polish Portuguese Russian Serbian Slovak Spanish Turkish Ukrainian Vietnamese {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/sqlmapproject/sqlmap ⭐ Star数：38375 💻 开发语言：Python 📝 项目描述：自动SQL注入和数据库接管工具 {/card-default} 总的来说，sqlmap是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
精选开源工具：thc-hydra 推荐 推荐一个实用的开源工具——thc-hydra。项目由vanhauser-thc开发维护，GitHub上获得了 12244 个Star。简单来说，它是一款九头蛇，对于站长和开发者来说是个不错的工具。 工具功能介绍 H Y D R A(c) 2001-2023 by van Hauser / THC https://github.com/vanhauser-thc/thc-hydra Many modules were written by David (dot) Maciejak @ gmail (dot) com BFG code by Jan Dlabal Licensed under AGPLv3 (see LICENSE file)Please do not use in military or secret service organizations, or for illegal purposes. (This is the wish of the author and non-binding. Many people working in these organizations do not care for laws and ethics anyway. You are not one of the "good" ones if you ignore this.)NOTE: No, this is not meant to be a markdown doc! old school!Hydra in the most current GitHub state can be directly downloaded via Docker: docker pull vanhauser/hydra INTRODUCTION Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof-of-concept code to give researchers and security consultants the possibility of showing how easy it would be to gain unauthorized access from a remote to a system.THIS TOOL IS FOR LEGAL PURPOSES ONLY!There are already several login hacker tools available; however, none of them support more than one protocol to attack or support parallelized connects.It was tested to compile cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10), and MacOS.Currently, this tool supports the following protocols: Asterisk, AFP, Cisco AAA, Cisco auth, Cisco enable, CVS, Firebird, FTP, HTTP-FORM-GET, HTTP-FORM-POST, HTTP-GET, HTTP-HEAD, HTTP-POST, HTTP-PROXY, HTTPS-FORM-GET, HTTPS-FORM-POST, HTTPS-GET, HTTPS-HEAD, HTTPS-POST, HTTP-Proxy, ICQ, IMAP, IRC, LDAP, MEMCACHED, MONGODB, MS-SQL, MYSQL, NCP, NNTP, Oracle Listener, Oracle SID, Oracle, PC-Anywhere, PCNFS, POP3, POSTGRES, Radmin, RDP, Rexec, Rlogin, Rsh, RTSP, SAP/R3, SIP, SMB, SMTP, SMTP Enum, SNMP v1+v2+v3, SOCKS5, SSH (v1 and v2), SSHKEY, Subversion, Teamspeak (TS2), Telnet, VMware-Auth, VNC and XMPP.However, the module engine for new services is very easy, so it won't take a long time until even more services are supported. Your help in writing, enhancing, or fixing modules is highly appreciated!! :-)WHERE TO GET You can always find the newest release/production version of Hydra at its project page at https://github.com/vanhauser-thc/thc-hydra/releases If you are interested in the current development state, the public development repository is on GitHub: svn co https://github.com/vanhauser-thc/thc-hydra or git clone https://github.com/vanhauser-thc/thc-hydra Use the development version at your own risk. It contains new features and new bugs. Things might not work!Alternatively (and easier), you can pull it as a Docker container: docker pull vanhauser/hydra HOW TO COMPILE To configure, compile, and install Hydra, just type: ./configure make make install If you want the SSH module, you have to set up libssh (not libssh2!) on your system, get it from https://www.libssh.org, for ssh v1 support you also need to add the "-DWITH_SSH1=On" option in the cmake command line. IMPORTANT: If you compile on macOS, you must do this - do not install libssh via Homebrew.If you use Ubuntu/Debian, this will install the supplementary libraries needed for a few optional modules (note that some might not be available on your distribution): apt-get install libssl-dev libssh-dev libidn11-dev libpcre3-dev \ libgtk-3-dev libmysqlclient-dev libpq-dev libsvn-dev \ firebird-dev libmemcached-dev libgpg-error-dev \ libgcrypt11-dev libgcrypt20-dev freetds-dev This enables all optional modules and features except for Oracle, SAP R/3, NCP, and the Apple filing protocol - which you will need to download and install from the vendor's websites.For all other Linux derivatives and BSD-based systems, use the system software installer and look for similarly named libraries, like in the command above. In all other cases, you have to download all source libraries and compile them manually.SUPPORTED PLATFORMS All UNIX platforms (Linux, *BSD, Solaris, etc.) MacOS (basically a BSD clone) Windows with Cygwin (both IPv4 and IPv6) Mobile systems based on Linux, MacOS, or QNX (e.g. Android, iPhone, Blackberry 10, Zaurus, iPaq)HOW TO USE If you just enter hydra, you will see a short summary of the important options available. Type ./hydra -h to see all available command line options.Note that NO login/password file is included. Generate them yourself. A default password list is, however, present; use "dpl4hydra.sh" to generate a list.For Linux users, a GTK GUI is available; try ./xhydraFor the command line usage, the syntax is as follows: For attacking one target or a network, you can use the new "://" style: hydra [some command line options] PROTOCOL://TARGET:PORT/MODULE-OPTIONS The old mode can be used for these, too, and additionally, if you want to specify your targets from a text file; you must use this one: hydra [some command line options] [-s PORT] TARGET PROTOCOL [MODULE-OPTIONS] Via the command line options, you specify which logins to try, which passwords, if SSL should be used, how many parallel tasks should be used for attacking, etc.PROTOCOL is the protocol you want to use for attacking, e.g., ftp, SMTP, http-get or many others are available TARGET is the target you want to attack MODULE-OPTIONS are optional values that are special per PROTOCOL moduleFIRST - select your target You have three options on how to specify the target you want to attack: A single target on the command line: just put the IP or DNS address in A network range on the command line: CIDR specification like "192.168.0.0/24" A list of hosts in a text file: one line per entry (see below)SECOND - select your protocol Try to avoid telnet, as it is unreliable for detecting a correct or false login attempt. Use a port scanner to see which protocols are enabled on the target.THIRD - check if the module has optional parameters hydra -U PROTOCOL e.g. hydra -U smtpFOURTH - the destination port This is optional; if no port is supplied, the default common port for the PROTOCOL is used. If you specify SSL to use ("-S" option), the SSL common port is used by default.If you use "://" notation, you must use "[" "]" brackets if you want to supply IPv6 addresses or CIDR ("192.168.0.0/24") notations to attack: hydra [some command line options] ftp://[192.168.0.0/24]/ hydra [some command line options] -6 smtps://[2001:db8::1]/NTLMNote that everything Hydra does is IPv4 only! If you want to attack IPv6 addresses, you must add the "-6" command line option. All attacks are then IPv6 only!If you want to supply your targets via a text file, you can not use the :// notation, but use the old style and just supply the protocol (and module options): hydra [some command line options] -M targets.txt ftp You can also supply the port for each target entry by adding ":" after a target entry in the file, e.g.: foo.bar.com target.com:21 unusual.port.com:2121 default.used.here.com 127.0.0.1 127.0.0.1:2121 Note that if you want to attach IPv6 targets, you must supply the -6 option and must put IPv6 addresses in brackets in the file(!) like this: foo.bar.com target.com:21 [fe80::1%eth0] [2001::1] [2002::2]:8080 [2a01:24a:133:0:00:123:ff:1a] LOGINS AND PASSWORDS You have many options on how to attack with logins and passwords With -l for login and -p for password, you tell Hydra that this is the only login and/or password to try. With -L for logins and -P for passwords, you supply text files with entries. e.g.: hydra -l admin -p password ftp://localhost/ hydra -L default_logins.txt -p test ftp://localhost/ hydra -l admin -P common_passwords.txt ftp://localhost/ hydra -L logins.txt -P passwords.txt ftp://localhost/ Additionally, you can try passwords based on the login via the "-e" option. The "-e" option has three parameters: s - try the login as password n - try an empty password r - reverse the login and try it as a password If you want to, e.g., try "try login as password and "empty password", you specify "-e sn" on the command line.But there are two more modes for trying passwords than -p/-P: You can use a text file where a login and password pair is separated by a colon, e.g.: admin:password test:test foo:bar This is a common default account style listing that is also generated by the dpl4hydra.sh default account file generator supplied with Hydra. You use such a text file with the -C option - note that in this mode you can not use -l/-L/-p/-P options (-e nsr however you can). Example: hydra -C default_accounts.txt ftp://localhost/ And finally, there is a brute-force mode with the -x option (which you can not use with -p/-P/-C): -x minimum_length:maximum_length:charset The charset definition is a for lowercase letters, A for uppercase letters, 1 for numbers and for anything else, what you supply is their real representation. Examples: -x 1:3:a generate passwords from length 1 to 3 with all lowercase letters -x 2:5:/ generate passwords from length 2 to 5 containing only slashes -x 5:8:A1 generate passwords from length 5 to 8 with uppercase and numbers -x '3:3:aA1&~#\\ "\'$%*?./§,;:!`' -v generates length 3 passwords with all 95 characters, and verbose. Example: hydra -l ftp -x 3:3:a ftp://localhost/ SPECIAL OPTIONS FOR MODULES Via the third command line parameter (TARGET SERVICE OPTIONAL) or the -m command line option, you can pass one option to a module. Many modules use this; a few require it!To see the special option of a module, type:hydra -U e.g../hydra -U http-post-formThe special options can be passed via the -m parameter, as 3rd command line option or in the service://target/option format.Examples (they are all equal): ./hydra -l test -p test -m PLAIN 127.0.0.1 imap ./hydra -l test -p test 127.0.0.1 imap PLAIN ./hydra -l test -p test imap://127.0.0.1/PLAIN RESTORING AN ABORTED/CRASHED SESSION When Hydra is aborted with Control-C, killed, or crashes, it leaves a "hydra.restore" file behind, which contains all necessary information to restore the session. This session file is written every 5 minutes. NOTE: the hydra.restore file can NOT be copied to a different platform (e.g. from little endian to big endian, or from Solaris to AIX)HOW TO SCAN/CRACK OVER A PROXY The environment variable HYDRA_PROXY_HTTP defines the web proxy (this works just for the HTTP services!). The following syntax is valid: HYDRA_PROXY_HTTP="http://123.45.67.89:8080/" HYDRA_PROXY_HTTP="http://login:password@123.45.67.89:8080/" HYDRA_PROXY_HTTP="proxylist.txt" The last example is a text file containing up to 64 proxies (in the same format definition as the other examples).For all other services, use the HYDRA_PROXY variable to scan/crack. It uses the same syntax. eg: HYDRA_PROXY=[connect|socks4|socks5]://[login:password@]proxy_addr:proxy_port for example: HYDRA_PROXY=connect://proxy.anonymizer.com:8000 HYDRA_PROXY=socks4://auth:pw@127.0.0.1:1080 HYDRA_PROXY=socksproxylist.txt ADDITIONAL HINTS Sort your password files by likelihood and use the -u option to find passwords much faster! uniq your dictionary files! This can save you a lot of time :-) cat words.txt | sort | uniq > dictionary.txt If you know that the target is using a password policy (allowing users only to choose a password with a minimum length of 6, containing at least one letter and one number, etc. use the tool pw-inspector, which comes along with the hydra package, to reduce the password list: cat dictionary.txt | pw-inspector -m 6 -c 2 -n > passlist.txtRESULTS OUTPUT --------------The results are output to stdio along with the other information. Via the -o command line option, the results can also be written to a file. Using -b, the format of the output can be specified. Currently, these are supported:* text - plain text format jsonv1 - JSON data using version 1.x of the schema (defined below). json - JSON data using the latest version of the schema; currently, there is only version 1.If using JSON output, the results file may not be valid JSON if there are serious errors in booting Hydra.JSON Schema Here is an example of the JSON output. Notes on some of the fields:* errormessages - an array of zero or more strings that are normally printed to stderr at the end of Hydra's run. The text is very free-form. success - indication if Hydra ran correctly without error (NOT if passwords were detected). This parameter is either the JSON value true or false depending on completion. quantityfound - How many username+password combinations were discovered. jsonoutputversion - Version of the schema, 1.00, 1.01, 1.11, 2.00, 2.03, etc. Hydra will make the second tuple of the version to always be two digits to make it easier for downstream processors (as opposed to v1.1 vs v1.10). The minor-level versions are additive, so 1.02 will contain more fields than version 1.00 and will be backward compatible. Version 2.x will break something from the version 1.x output.Version 1.00 example: { "errormessages": [ "[ERROR] Error Message of Something", "[ERROR] Another Message", "These are very free form" ], "generator": { "built": "2021-03-01 14:44:22", "commandline": "hydra -b jsonv1 -o results.json ... ...", "jsonoutputversion": "1.00", "server": "127.0.0.1", "service": "http-post-form", "software": "Hydra", "version": "v8.5" }, "quantityfound": 2, "results": [ { "host": "127.0.0.1", "login": "bill@example.com", "password": "bill", "port": 9999, "service": "http-post-form" }, { "host": "127.0.0.1", "login": "joe@example.com", "password": "joe", "port": 9999, "service": "http-post-form" } ], "success": false } SPEED Through the parallelizing feature, this password cracker tool can be very fast; however, it depends on the protocol. The fastest are generally POP3 and FTP. Experiment with the task option (-t) to speed things up! The higher - the faster ;-) (but too high - and it disables the service)STATISTICS Run against a SuSE Linux 7.2 on localhost with a "-C FILE" containing 295 entries (294 tries invalid logins, 1 valid). Every test was run three times (only for "1 task" just once), and the average was noted down. P A R A L L E L T A S K S SERVICE 1 4 8 16 32 50 64 100 128 ------- -------------------------------------------------------------------- telnet 23:20 5:58 2:58 1:34 1:05 0:33 0:45* 0:25* 0:55* ftp 45:54 11:51 5:54 3:06 1:25 0:58 0:46 0:29 0:32 pop3 92:10 27:16 13:56 6:42 2:55 1:57 1:24 1:14 0:50 imap 31:05 7:41 3:51 1:58 1:01 0:39 0:32 0:25 0:21 (*) Note: telnet timings can be VERY different for 64 to 128 tasks! e.g. with 128 tasks, running four times, resulted in timings between 28 and 97 seconds! The reason for this is unknown...guesses per task (rounded up):295 74 38 19 10 6 5 3 3guesses possible per connect ... {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/vanhauser-thc/thc-hydra ⭐ Star数：12244 💻 开发语言：C 📝 项目描述：九头蛇 {/card-default} 总的来说，thc-hydra是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
网络安全工具 dirsearch 实战分享 推荐一个实用的开源工具——dirsearch。项目由maurosoria开发维护，GitHub上获得了 14697 个Star。简单来说，它是一款Web路径扫描仪，对于站长和开发者来说是个不错的工具。 工具功能介绍 Build图片 License图片 Stars图片> An advanced web path brute-forcerdirsearch is being actively developed by @maurosoria and @shelld3v.Join the Discord server to communicate with the team. Quick Startdirsearch requires Python 3.11 or higher. sh git clone https://github.com/maurosoria/dirsearch.git --depth 1 cd dirsearch python3 dirsearch.py -u https://example.com -e php,html,js You can also install the latest Python stack directly from GitHub with pip: sh pip3 install git+https://github.com/maurosoria/dirsearch.git dirsearch -u https://example.com -e php,html,js The Rust native backend is opt-in for source installs; see Installation for the native build steps.Pre-built PyInstaller binaries and portable folder archives are available on the Releases page. Documentation The full documentation now lives in docs/:- Installation: supported platforms, Python install, release artifacts, and Docker. Usage Guide: common scans, recursion, filters, proxies, raw requests, reports, and tips. Wordlists: %EXT%, categories, templates, prefixes, suffixes, and transformations. CLI Options: complete command-line reference. Configuration: config.ini reference. Sessions: save, list, and resume scan sessions. Python API: importable API examples. Building: PyInstaller, portable builds, Docker images, and GitHub Actions. References: external tutorials and articles. Minimal Examples sh python3 dirsearch.py -u https://target python3 dirsearch.py -u https://target -e php,html,js python3 dirsearch.py -u https://target -e php,html,js -w /path/to/wordlist python3 dirsearch.py -u https://target -r --max-recursion-depth 3 Use python3 dirsearch.py -h for common options or python3 dirsearch.py -hh for the complete CLI help. Python APIdirsearch can also be used from Python code for local automation, MCP servers, REST wrappers, and agent-controlled scans. The importable API keeps its configuration in FuzzerConfig, so callers do not need to parse CLI flags or mutate CLI globals.See Python API for examples covering templates, custom wordlists, callbacks, authenticated sessions, and agent-oriented scan recipes. Contributing Pull requests and feature requests are welcome. See CONTRIBUTORS.md for the people who have helped improve dirsearch. License Copyright (C) Mauro Soria (maurosoria@gmail.com)License: GNU General Public License, version 2. {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/maurosoria/dirsearch ⭐ Star数：14697 💻 开发语言：Python 📝 项目描述：Web路径扫描仪 {/card-default} 总的来说，dirsearch是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
运维安全必备：subfinder 工具解析 推荐一个实用的开源工具——subfinder。项目由projectdiscovery开发维护，GitHub上获得了 14394 个Star。简单来说，它是一款快速被动子域枚举工具。，对于站长和开发者来说是个不错的工具。 工具功能介绍 Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord ---subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.We have made it to comply with all the used passive source licenses and usage restrictions. The passive model guarantees speed and stealthiness that can be leveraged by both penetration testers and bug bounty hunters alike. Fast and powerful resolution and wildcard elimination modules Curated passive sources to maximize results Multiple output formats supported (JSON, file, stdout) Optimized for speed and lightweight on resources STDIN/OUT support enables easy integration into workflows Usage sh subfinder -h This will display help for the tool. Here are all the switches it supports. yaml Usage: ./subfinder [flags]Flags: INPUT: -d, -domain string[] domains to find subdomains for -dL, -list string file containing list of domains for subdomain discoverySOURCE: -s, -sources string[] specific sources to use for discovery (-s crtsh,github). Use -ls to display all available sources. -recursive use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld) -all use all sources for enumeration (slow) -es, -exclude-sources string[] sources to exclude from enumeration (-es alienvault,zoomeyeapi)FILTER: -m, -match string[] subdomain or list of subdomain to match (file or comma separated) -f, -filter string[] subdomain or list of subdomain to filter (file or comma separated)RATE-LIMIT: -rl, -rate-limit int maximum number of http requests to send per second -rls value maximum number of http requests to send per second for providers in key=value format (-rls "hackertarget=10/s,shodan=15/s") -t int number of concurrent goroutines for resolving (-active only) (default 10)UPDATE: -up, -update update subfinder to latest version -duc, -disable-update-check disable automatic subfinder update checkOUTPUT: -o, -output string file to write output to -oJ, -json write output in JSONL(ines) format -oD, -output-dir string directory to write output (-dL only) -cs, -collect-sources include all sources in the output (-json only) -oI, -ip include host IP in output (-active only)CONFIGURATION: -config string flag config file (default "$CONFIG/subfinder/config.yaml") -pc, -provider-config string provider config file (default "$CONFIG/subfinder/provider-config.yaml") -r string[] comma separated list of resolvers to use -rL, -rlist string file containing list of resolvers to use -nW, -active display active subdomains only -proxy string http proxy to use with subfinder -ei, -exclude-ip exclude IPs from the list of domains -mr, -max-results int limit the number of results per source (0 = unlimited; honored by paginating sources)DEBUG: -silent show only subdomains in output -version show version of subfinder -v show verbose output -nc, -no-color disable color in output -ls, -list-sources list all available sources (-oJ for JSON)OPTIMIZATION: -timeout int seconds to wait before timing out (default 30) -max-time int minutes to wait for enumeration results (default 10) -rsr, -response-size-read int max response body size to read in bytes from passive sources (0 = unlimited) Environment VariablesSubfinder supports environment variables to specify custom paths for configuration files:- SUBFINDER_CONFIG - Path to config.yaml file (overrides default $CONFIG/subfinder/config.yaml) SUBFINDER_PROVIDER_CONFIG - Path to provider-config.yaml file (overrides default $CONFIG/subfinder/provider-config.yaml) Installationsubfinder requires go1.24 to install successfully. Run the following command to install the latest version: sh go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest Learn about more ways to install subfinder here: https://docs.projectdiscovery.io/tools/subfinder/install. Post Installation Instructionssubfinder can be used right after the installation, however many sources required API keys to work. Learn more here: https://docs.projectdiscovery.io/tools/subfinder/install#post-install-configuration. Running SubfinderLearn about how to run Subfinder here: https://docs.projectdiscovery.io/tools/subfinder/running. Subfinder Go librarySubfinder can also be used as library and a minimal examples of using subfinder SDK is available here Resources- Recon with Me !!! Licensesubfinder is made with 🖤 by the projectdiscovery team. Community contributions have made the project what it is. See the THANKS.md file for more details.Read the usage disclaimer at DISCLAIMER.md and contact us for any API removal. {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/projectdiscovery/subfinder ⭐ Star数：14394 💻 开发语言：Go 📝 项目描述：快速被动子域枚举工具。 {/card-default} 总的来说，subfinder是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
hashcat - 渗透测试人员必备工具 推荐一个实用的开源工具——hashcat。项目由hashcat开发维护，GitHub上获得了 26717 个Star。简单来说，它是一款全球最快、最先进的密码恢复实用程序，对于站长和开发者来说是个不错的工具。 工具功能介绍 hashcat is a highly optimized password recovery platform for GPUs, CPUs, and large distributed systems. Features ###* World's fastest password cracker World's first and only in-kernel rule engine Free and open source, under the MIT license Multi-OS: Linux, Windows and macOS Multi-backend: CUDA, HIP, Metal and OpenCL Multi-device: several devices, and mixed device types, in one system Multi-hash: cracks large numbers of hashes at once Over 590 hash modes, each written with performance in mind 5 attack modes: wordlist, brute-force, PCFG, hybrid and association Assimilation bridge: add a hash mode in C, Python or Rust, without writing a kernel Brain: skips candidates an earlier session already tried Distributed cracking networks, using an overlay Reads candidates from a wordlist, from stdin, or from another program Markov chain keyspace ordering, so the likely candidates come first Automatic performance tuning per device Interactive pause and resume Named sessions, and restore after an interruption Built-in benchmark Integrated thermal watchdog Hex salt and hex charset, for hashes and character sets that are not text Encrypted plains: crack a hash for someone else without being able to read the password Keyboard layout mapping, for full disk encryption passwords typed on a non-US keyboard License ###hashcat is licensed under the MIT license. See docs/license.txt. Installation ###Download the latest release and unpack it where you want it. Use 7z x when unpacking from the command line, so the full file paths stay intact.Your platform may also provide packages. Building ###Building from source is optional. The release package is the same program, and a binary you build yourself will not crack any faster. Build it if you want a change of your own, a fix that is in master but not yet released, or a platform we do not ship a binary for.See BUILD.md for how.Tests:Build | BSD | Rust Usage and help ###Start with --help, also kept in the tree as docs/hashcat-help.md. One example hash per mode is in docs/hashcat-example-hashes.md.The wiki and the FAQ go further. The forum holds years of answered questions. If you still need help from a real human, come to Discord. Documentation ###The docs directory covers each feature. The ones people ask about most:* Plugin development guide, for adding a hash mode Assimilation bridge, and its Python and Rust quickstarts Generic attack mode and PCFG Brain, slow candidates, encrypted plains Keyboard layout mapping Compression libraries, for reading gzip, xz and zstd files Release notes for v7.1.0, and the full changelog Contributing ###Contributions are welcome. CONTRIBUTING.md has the code style, what a pull request needs, and how to test a change before you send it. Security ###SECURITY.md has how to report a vulnerability, and what counts as one. Happy Cracking! {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/hashcat/hashcat ⭐ Star数：26717 💻 开发语言：C 📝 项目描述：全球最快、最先进的密码恢复实用程序 {/card-default} 总的来说，hashcat是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
nmap 功能特性与应用场景 推荐一个实用的开源工具——nmap。项目由nmap开发维护，GitHub上获得了 13532 个Star。简单来说，它是一款Nmap -网络映射器。官方SVN存储库的Github镜像。，对于站长和开发者来说是个不错的工具。 工具功能介绍 Nmap ====Nmap is released under a custom license, which is based on (but not compatible with) GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for full details.The latest version of this software as well as binary installers for Windows, macOS, and Linux (RPM) are available from Nmap.orgFull documentation is also available on the Nmap.org website.Questions and suggestions may be sent to the Nmap-dev mailing list.Installing Ideally, you should be able to just type:./configure make make installFor far more in-depth compilation, installation, and removal notes, read the Nmap Install Guide on Nmap.org.Using Nmap Nmap has a lot of features, but getting started is as easy as running `nmap scanme.nmap.org. Running nmap` without any parameters will give a helpful list of the most common options, which are discussed in depth in [the man page](https://nmap.org/book/man.html). Users who prefer a graphical interface can use the included Zenmap front-end.Contributing Information about filing bug reports and contributing to the Nmap project can be found in the HACKING and CONTRIBUTING.md files. {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/nmap/nmap ⭐ Star数：13532 💻 开发语言：C 📝 项目描述：Nmap -网络映射器。官方SVN存储库的Github镜像。 {/card-default} 总的来说，nmap是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
beef 安装配置与使用指南 推荐一个实用的开源工具——beef。项目由beefproject开发维护，GitHub上获得了 11003 个Star。简单来说，它是一款Browser Exploitation Framework项目，对于站长和开发者来说是个不错的工具。 工具功能介绍 ===============================================================================Copyright (c) 2006-2026 Wade Alcorn - wade@bindshell.net Browser Exploitation Framework (BeEF) - https://beefproject.com See the file 'doc/COPYING' for copying permission===============================================================================What is BeEF? -------------__BeEF__ is short for __The Browser Exploitation Framework__. It is a penetration testing tool that focuses on the web browser.Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.Get Involved ------------You can get in touch with the BeEF team. Just check out the following:__Please, send us pull requests!____Web:__ https://beefproject.com/__Bugs:__ https://github.com/beefproject/beef/issues__Security Bugs:__ security@beefproject.com__Twitter:__ @beefprojectDiscord: https://discord.gg/25wT2P8pwxRequirements ------------* Operating System: Mac OSX 10.5.0 or higher / modern Linux. Note: Windows is not supported. Ruby: 3.0 or newer SQLite: 3.x Node.js: 10 or newer The gems listed in the Gemfile: https://github.com/beefproject/beef/blob/master/Gemfile Selenium is required on OSX: brew install selenium-server-standalone (See https://github.com/shvets/selenium)Quick Start -----------__The following is for the impatient.__The install script installs the required operating system packages and all the prerequisite Ruby gems: $ ./install For full installation details, please refer to INSTALL.txt or the Installation page on the wiki.Upon successful installation, be sure to read the Configuration page on the wiki for important details on configuring and securing BeEF.Documentation ---* User Guide Frequently Asked Questions JSdocsUsage -----To get started, simply execute beef and follow the instructions: $ ./beef {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/beefproject/beef ⭐ Star数：11003 💻 开发语言：JavaScript 📝 项目描述：Browser Exploitation Framework项目 {/card-default} 总的来说，beef是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
wpscan - 安全从业者的得力助手 推荐一个实用的开源工具——wpscan。项目由wpscanteam开发维护，GitHub上获得了 9759 个Star。简单来说，它是一款WPScan WordPress安全扫描仪。专为安全专业人员和博客维护人员编写，以测试其WordPress网站的安全性。通过，对于站长和开发者来说是个不错的工具。 工具功能介绍 WPScan WordPress Security Scanner WPScan WordPress Vulnerability Database - WordPress Security Plugin Prerequisites- (Optional but highly recommended: rbenv) Ruby >= 3.3 - Recommended: latest stable Curl >= 7.72 - Recommended: latest stable The 7.29 has a segfault The {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/wpscanteam/wpscan ⭐ Star数：9759 💻 开发语言：Ruby 📝 项目描述：WPScan WordPress安全扫描仪。专为安全专业人员和博客维护人员编写，以测试其WordPress网站的安全性。通过 {/card-default} 总的来说，wpscan是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
黑客必备工具：pwntools 详细介绍 推荐一个实用的开源工具——pwntools。项目由Gallopsled开发维护，GitHub上获得了 13676 个Star。简单来说，它是一款CTF框架和漏洞利用开发库，对于站长和开发者来说是个不错的工具。 工具功能介绍 pwntools logo图片Pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible. python from pwn import * context(arch = 'i386', os = 'linux')r = remote('exploitme.example.com', 31337) # EXPLOIT CODE GOES HERE r.send(asm(shellcraft.sh())) r.interactive() Documentation Our documentation is available at docs.pwntools.comA series of tutorials is also available onlineTo get you started, we've provided some example solutions for past CTF challenges in our write-ups repository. Installation Pwntools is best supported on 64-bit Ubuntu LTS releases (22.04 and 24.04). Most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).Pwntools supports Python 3.10+ since version 5.0.0. Use Pwntools 4.x for older versions as well as Python 2.7. Most of the functionality of pwntools is self-contained and Python-only. You should be able to get running quickly with sh sudo apt-get update sudo apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential python3 -m pip install --upgrade pip python3 -m pip install --upgrade pwntools However, some of the features (assembling/disassembling foreign architectures) require non-Python dependencies. For more information, see the complete installation instructions here. Contribution See CONTRIBUTING.md Contact and Community If you have any questions not worthy of a bug report, join the Discord server at https://discord.gg/96VA2zvjCB {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/Gallopsled/pwntools ⭐ Star数：13676 💻 开发语言：Python 📝 项目描述：CTF框架和漏洞利用开发库 {/card-default} 总的来说，pwntools是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
分享一个不错的开源工具：osv-scanner 推荐一个实用的开源工具——osv-scanner。项目由google开发维护，GitHub上获得了 10990 个Star。简单来说，它是一款用Go编写的漏洞扫描程序，使用https://osv.dev提供的数据，对于站长和开发者来说是个不错的工具。 工具功能介绍 ---Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies. OSV-Scanner provides an officially supported frontend to the OSV database and CLI interface to OSV-Scalibr that connects a project’s list of dependencies with the vulnerabilities that affect them.OSV-Scanner supports a wide range of project types, package managers and features, including but not limited to:- Languages: C/C++, Dart, Elixir, Go, Java, Javascript, PHP, Python, R, Ruby, Rust. Package Managers: npm, pip, yarn, maven, go modules, cargo, gem, composer, nuget and others. Operating Systems: Detects vulnerabilities in OS packages on Linux systems. Containers: Scans container images for vulnerabilities in their base images and included packages. Guided Remediation: Provides recommendations for package version upgrades based on criteria such as dependency depth, minimum severity, fix strategy, and return on investment.OSV-Scanner uses the extensible OSV-Scalibr library under the hood to provide this functionality. If a language or package manager is not supported currently, please file a feature request.The underlying database, OSV.dev has several benefits in comparison with closed source advisory databases and scanners:- Covering most open source language and OS ecosystems (including Git), it’s comprehensive. Each advisory comes from an open and authoritative source (e.g. GitHub Security Advisories, RustSec Advisory Database, Ubuntu security notices) Anyone can suggest improvements to advisories, resulting in a very high quality database. The OSV format unambiguously stores information about affected versions in a machine-readable format that precisely maps onto a developer’s list of packagesThe above all results in accurate and actionable vulnerability notifications, which reduces the time needed to resolve them. Check out OSV.dev for more details! Basic installationTo install OSV-Scanner, please refer to the installation section of our documentation. OSV-Scanner releases can be found on the releases page of the GitHub repository. The recommended method is to download a prebuilt binary for your platform. Alternatively, you can use go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest to build it from source. Key FeaturesFor more information, please read our detailed documentation to learn how to use OSV-Scanner. For detailed information about each feature, click their titles in this README.Please note: These are the instructions for the latest OSV-Scanner V2 beta. If you are using V1, checkout the V1 README and documentation instead. Scanning a source directory bash $ osv-scanner scan source -r /path/to/your/dir This command will recursively scan the specified directory for any supported package files, such as package.json, go.mod, pom.xml, etc. and output any discovered vulnerabilities.OSV-Scanner has the option of using call analysis to determine if a vulnerable function is actually being used in the project, resulting in fewer false positives, and actionable alerts.OSV-Scanner can also detect vendored C/C++ code for vulnerability scanning. See here for details. Supported LockfilesOSV-Scanner supports 11+ language ecosystems and 19+ lockfile types. To check if your ecosystem is covered, please check out our detailed documentation. Container ScanningOSV-Scanner also supports comprehensive, layer-aware scanning for container images to detect vulnerabilities in the following operating system packages and language-specific dependencies.| Distro Support | Language Artifacts Support | Alpine OSGoDebianJavaUbuntuNode PythonSee the full documentation for details on support.Usage: bash $ osv-scanner scan image my-image-name:tag screencast of html output of container scanning图片 License ScanningCheck your dependencies' licenses using deps.dev data. For a summary: bash osv-scanner --licenses path/to/repository To check against an allowed license list (SPDX format): bash osv-scanner --licenses="MIT,Apache-2.0" path/to/directory Offline ScanningScan your project against a local OSV database. No network connection is required after the initial database download. The database can also be manually downloaded. bash osv-scanner --offline --download-offline-databases ./path/to/your/dir Guided Remediation (Experimental)> [!WARNING] Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.OSV-Scanner provides guided remediation, a feature that suggests package version upgrades based on criteria such as dependency depth, minimum severity, fix strategy, and return on investment. We currently support remediating vulnerabilities in the following files:| Ecosystem | File Format (Type) | Supported Remediation Strategies |npmpackage-lock.json (lockfile)in-placenpmpackage.json (manifest)relockMavenpom.xml (manifest)overrideThis is available as a headless CLI command, as well as an interactive mode.Example (for npm) bash $ osv-scanner fix \ --max-depth=3 \ --min-severity=5 \ --ignore-dev \ --strategy=in-place \ -L path/to/package-lock.json Interactive mode (for npm) bash $ osv-scanner fix \ -M path/to/package.json \ -L path/to/package-lock.json Data Sources and PrivacyOSV-Scanner communicates with the following external services during operation: OSV.dev APIThe primary data source for vulnerability information. OSV-Scanner queries this API to check packages for known vulnerabilities and to identify vendored C/C++ dependencies. Data sent includes package names, versions, ecosystems, and file hashes. Use --offline mode to disable network requests and scan against a local database instead. deps.dev APIUsed for supplementary package information:- Dependency resolution: Resolves dependency graphs for vulnerability scanning and remediation Container image scanning: Queries container image metadata for vulnerability detection License scanning (--licenses flag): Retrieves license information for packages Package deprecation: Checks if packages are deprecatedData sent includes package names, versions, and ecosystems. No source code is transmitted. Package RegistriesWhen using native registry for dependency resolution (instead of deps.dev), OSV-Scanner may query:| Registry | URL | Used For | Maven Centralrepo.maven.apache.org/maven2Maven package metadata and POM filesnpm Registryregistry.npmjs.orgnpm package metadataPyPIpypi.orgPython package metadataContribute Report ProblemsIf you have what looks like a bug, please use the GitHub issue tracking system. Before you file an issue, please search existing issues to see if your issue is already covered. Contributing code to osv-scannerSee CONTRIBUTING.md for documentation on how to contribute code. Star History {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/google/osv-scanner ⭐ Star数：10990 💻 开发语言：Go 📝 项目描述：用Go编写的漏洞扫描程序，使用https://osv.dev提供的数据 {/card-default} 总的来说，osv-scanner是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
-
GhostTrack - 一款值得收藏的神器 推荐一个实用的开源工具——GhostTrack。项目由HunxByts开发维护，GitHub上获得了 15019 个Star。简单来说，它是一款跟踪位置或，对于站长和开发者来说是个不错的工具。 工具功能介绍 Useful tool to track location or mobile number, so this tool can be called osint or also information gatheringNew update : Version 2.2 Instalation on Linux (deb) sudo apt-get install git sudo apt-get install python3 Instalation on Termux pkg install git pkg install python3 Usage Tool git clone https://github.com/HunxByts/GhostTrack.git cd GhostTrack pip3 install -r requirements.txt python3 GhostTR.py Display on the menu IP Tracker on the IP Track menu, you can combo with the seeker tool to get the target IP :zap: Install Seeker : Get Seeker Display on the menu Phone Tracker on this menu you can search for information from the target phone numberDisplay on the menu Username Tracker on this menu you can search for information from the target username on social media :zap: Author : HunxByts {card-default label="📦 工具信息"} 🔗 项目地址：https://github.com/HunxByts/GhostTrack ⭐ Star数：15019 💻 开发语言：Python 📝 项目描述：跟踪位置或 {/card-default} 总的来说，GhostTrack是一个功能比较实用的开源工具，适合日常工作和学习使用。如果你正在寻找一款相关工具，不妨下载试试。使用前建议仔细阅读项目文档。 本文介绍的工具来源于GitHub开源社区，仅供学习交流使用，请遵守原项目开源协议。
