SANS Attack surfaces, tools and techniques cheat sheet | by SANS h9-cheatsheet cheatsheet Download PDF

TorBot is an open source intelligence tool developed in python. The main objective of this project is to collect open data from the deep web (aka dark web)

IoTShark aims to provide a fully automated solution for a user to monitor their IOT devices by simply running a single script. The user merely has to select

DroneSploit was created by Alexandre D’Hondt and Yannick Pasquazzo. The project is still in the development stage, as both developers are working to improve

Incident response is the organized practice of responding to cyber security events. These processes are typically organized into an incident response plan,

There are many Command and Control Frameworks for Pentesters and Red Teamers to use. Covenant is a nice .NET based C2 environment that works great on Kali

To do its magic, WAFW00F does the following:

TuxResponse is incident response script for linux systems written in bash. It can automate incident response activities on Linux systems and enable you to

Stowaway is Multi-hop proxy tool for security researchers and pentesters. Users can easily proxy their network traffic to intranet nodes (multi-layer).

Mapping injection is a process injection technique that avoids the usage of common monitored syscall VirtualAllocEx and WriteProcessMemory.

Hakrawler is a Go web crawler designed for easy, quick discovery of endpoints and assets within a web application. It can be used to discover:

Quark Engine is an open source software for automating analysis of suspicious Android application. To do so it makes use of custom Dalvik Bytecode Loader and

Pown.js is a security testing and exploitation toolkit built on top of Node.js and NPM. Unlike traditional security tools like Metasploits, Pown.js considers

Imperva customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output.

Typically, backdoor utilities such as NetCat have 2 main functions: to pipe remote input into cmd or bash and output the response. This is useful, but it is

Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system.

You are a Threat Hunter. While investigating, did you find yourself with more than 20 tabs opened in your browser, scattered .txt files with data and some