# More Tools

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF版本的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[NFTs收藏品](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>

<figure><img src="/files/YM7uBW8YtIhrJWT3a6lG" alt=""><figcaption></figcaption></figure>

{% embed url="<https://websec.nl/>" %}

## 蓝队

* <https://github.com/yarox24/attack_monitor>
* <https://capsule8.com/blog/dont-get-kicked-out-a-tale-of-rootkits-and-other-backdoors/>
* <https://github.com/ION28/BLUESPAWN>
* <https://github.com/PaperMtn/lil-pwny> : 检查泄露的账户
* <https://github.com/rabobank-cdc/DeTTECT>

## OSINT

* <https://github.com/3vangel1st/kamerka>
* <https://github.com/BullsEye0/google_dork_list>
* <https://github.com/highmeh/lure>
* [https://www.shodan.io/](https://www.shodan.io)
* [https://censys.io/](https://censys.io)
* <https://viz.greynoise.io/table>
* <https://www.zoomeye.org>
* <https://fofa.so>
* <https://www.onyphe.io>
* <https://app.binaryedge.io>
* <https://hunter.io>
* <https://wigle.net>
* <https://ghostproject.fr>
* [https://www.oshadan.com/](https://www.oshadan.com)
* [https://builtwith.com/](https://builtwith.com)
* [https://www.spiderfoot.net/](https://www.spiderfoot.net)
* <https://github.com/zricethezav/gitleaks>
* <https://www.nmmapper.com/sys/tools/subdomainfinder/> : 8个子域名查找工具，sublist3r、amass等

## **WEB**

* <https://github.com/AlisamTechnology/ATSCAN>
* <https://github.com/momenbasel/KeyFinder>
* <https://github.com/hahwul/XSpear>
* <https://github.com/BitTheByte/Monitorizer/>
* <https://github.com/spinkham/skipfish>
* <https://github.com/blark/aiodnsbrute> : 异步暴力破解域名
* <https://crt.sh/?q=%.yahoo.com> : 子域名暴力破解
* <https://github.com/tomnomnom/httprobe>: 检查域中的Web服务器是否可访问
* <https://github.com/aboul3la/Sublist3r> : 子域发现
* <https://github.com/gwen001/github-search/blob/master/github-subdomains.py> : GitHub中的子域发现
* <https://github.com/robertdavidgraham/masscan> : 快速端口扫描
* <https://github.com/Threezh1/JSFinder> : 从Web中的JS文件中获取子域和URL
* <https://github.com/C1h2e1/MyFuzzingDict> : Web文件字典
* <https://github.com/TypeError/Bookmarks/blob/master/README.md> : 用于避免大量重复标签的Burp扩展
* <https://github.com/hakluke/hakrawler> : 获取资产
* <https://github.com/izo30/google-dorker> : Google Dorks
* <https://github.com/sehno/Bug-bounty/blob/master/bugbounty_checklist.md> : Web BugBounty清单
* <https://github.com/Naategh/dom-red> : 检查一组域名是否存在开放重定向
* <https://github.com/prodigysml/Dr.-Watson> : Burp插件，离线分析以发现域、子域和IP
* <https://github.com/hahwul/WebHackersWeapons>: 不同工具列表
* <https://github.com/gauravnarwani97/Trishul> : 用于发现漏洞（SQLi、XSS、SSTI）的BurpSuite插件
* <https://github.com/fransr/postMessage-tracker> : 用于跟踪post-messages函数的Chrome扩展
* <https://github.com/Quitten/Autorize> : 自动身份验证测试（删除cookies并尝试发送请求）
* <https://github.com/pikpikcu/xrcross>: XRCross是一个用于测试（XSS|SSRF|CORS|SSTI|IDOR|RCE|LFI|SQLI）漏洞的重建、扫描和渗透/漏洞赏金测试工具

## Windows

* <https://github.com/Mr-Un1k0d3r/PoisonHandler> : 横向移动
* <https://freddiebarrsmith.com/trix/trix.html> : LOL bins
* <https://gist.github.com/netbiosX/ee35fcd3722e401a38136cff7b751d79> (<https://pentestlab.blog/2020/01/13/persistence-image-file-execution-options-injection/>): 持久性
* <https://github.com/odzhan/injection> : Windows进程注入技术
* <https://github.com/BankSecurity/Red_Team> : 红队脚本
* <https://github.com/l0ss/Grouper2> : 在Active Directory组策略中查找与安全相关的配置错误。
* <https://www.wietzebeukema.nl/blog/powershell-obfuscation-using-securestring> : Securestring混淆
* <https://pentestlab.blog/2020/02/24/parent-pid-spoofing/> : 父进程ID欺骗
* <https://github.com/the-xentropy/xencrypt> : 加密Powershell有效载荷
* <https://shells.systems/introducing-ninja-c2-the-c2-built-for-stealth-red-team-operations/> : 隐蔽C2
* <https://windows-internals.com/faxing-your-way-to-system/> : 有关Windows内部的一系列日志
* <https://bestestredteam.com/2018/10/02/tracking-pixel-in-microsoft-office-document/> : 跟踪谁打开了文档
* <https://github.com/Integration-IT/Active-Directory-Exploitation-Cheat-Sheet> : Active Directory备忘单

## 固件

我看到的用于分析固件的酷炫工具（自动化）：

* <https://github.com/craigz28/firmwalker>
* <https://github.com/fkie-cad/FACT_core>
* <https://gitlab.com/bytesweep/bytesweep-go>

后续：

* <https://blog.mindedsecurity.com/2018/09/pentesting-iot-devices-part-1-static.html>
* <https://blog.mindedsecurity.com/2018/10/pentesting-iot-devices-part-2-dynamic.html>

如果找不到在线固件，如何提取固件：<https://www.youtube.com/watch?v=Kxvpbu9STU4>

这里有一个带有漏洞的固件可供分析：<https://github.com/scriptingxss/IoTGoat>

以及OWASP分析固件的方法：<https://github.com/scriptingxss/owasp-fstm>

固件仿真：FIRMADYNE (<https://github.com/firmadyne/firmadyne/>) 是一个用于自动化Linux固件仿真和动态分析的平台。

## 其他

* <https://twitter.com/HackAndDo/status/1202695084543791117>
* <https://github.com/weev3/LKWA>
* <https://h0mbre.github.io/Learn-C-By-Creating-A-Rootkit/>
* <https://github.com/skelsec/jackdaw>
* <https://github.com/CoatiSoftware/Sourcetrail> : 静态代码分析
* <https://www.hackerdecabecera.com/2019/12/blectf-capture-flag-en-formato-hardware.html> : 蓝牙LE CTF
* <https://github.com/skeeto/endlessh> : 缓慢发送无尽横幅的SSH陷阱。
* AWS和云工具：<https://github.com/toniblyx/my-arsenal-of-aws-security-tools>
* IFS（星际文件系统）用于网络钓鱼：<https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/using-the-interplanetary-file-system-for-offensive-operations/>
* IP轮换服务：<https://medium.com/@lokeshdlk77/how-to-rotate-ip-address-in-brute-force-attack-e66407259212>
* Linux rootkit：<https://github.com/aesophor/satanic-rootkit>
* [https://theia-ide.org/](https://theia-ide.org) : 在线IDE
* <https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters/> : 初学者赏金猎人资源
* <https://medium.com/macoclock/jailbreak-and-stuff-kickstart-tools-and-techniques-for-ios-application-pentesting-6fa53a3987ab> : IOS渗透测试工具
* <https://github.com/random-robbie/keywords/blob/master/keywords.txt> : 关键词
* <https://github.com/ElevenPaths/HomePWN> : 黑客IoT（Wifi、BLE、SSDP、MDNS）
* <https://github.com/rackerlabs/scantron> : 自动化扫描
* <https://github.com/doyensec/awesome-electronjs-hacking> : 该列表旨在涵盖与Electron.js安全相关的主题。
* <https://github.com/serain/bbrecon> : 有关BB程序的信息

<figure><img src="/files/YM7uBW8YtIhrJWT3a6lG" alt=""><figcaption></figcaption></figure>

{% embed url="<https://websec.nl/>" %}

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

支持HackTricks的其他方式：

* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF版本的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品
* **加入** 💬 [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://hacktricks.xsx.tw/todo/more-tools.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.