Modern Penetration Testing Tools

Penetration testing tools constantly evolve as techniques change and discoveries are made. Most tools are highly community-driven, and many great researchers and developers invest their time creating incredible tools to share with the public. This leads to testers all being able to capitalize on the latest trends and ensure that they are testing using updated methods. Penetration testers need to do their best to stay up to date with any new tools to make sure that no innovations are being missed. Here is a list of some great tools that have been recently released to add to your testing toolkit:

1. NetExec – NetExec is a recent fork of the popular CrackMapExec tool, often described as the Swiss army knife for penetration testers. It builds on its predecessor’s capabilities, offering advanced functionality and active maintenance. The tool is especially adept at handling Windows protocols and validating credentials. Additionally, NetExec comes equipped with various modules that can perform exploits, carry out detailed enumerations, and retrieve sensitive data from target machines, making it a comprehensive choice for security professionals.
2. Evilginx3 – Evilginx3 is a phishing framework that takes advantage of reverse proxy techniques to significantly enhance the effectiveness of phishing campaigns. This tool allows penetration testers to create highly realistic malicious sites using custom templates, making social engineering campaigns harder to detect. Besides setting up these sites, Evilginx3 can also collect data from those who fall victim to phishing attempts, streamlining the data harvesting process.
3. PentestGPT – Among the many AI models designed to support penetration testing, PentestGPT stands out for its popularity and utility. It leverages ChatGPT to provide targeted insights and troubleshooting help to penetration testers. While it’s always important to double-check its guidance, PentestGPT is a valuable resource across various aspects of cybersecurity.
4. Stardust – Developed by the creator of the flexible Havoc C2 framework, Stardust is a robust tool for developing custom implants for use in red team operations. It’s designed to be user-friendly, allowing testers of varying experience levels to create sophisticated tools tailored to their specific needs during security engagements.
5. Graphstrike – This tool redirects traffic from Cobalt Strike to the Microsoft Graph API, enhancing stealth by making the traffic appear more legitimate. Graphstrike isn’t a standalone tool but a powerful add-on that integrates with Cobalt Strike, offering an effective way to avoid detection during cybersecurity operations.
6. Nidhogg – Nidhogg is a powerful rootkit that integrates smoothly with popular command and control systems (C2s). It offers a wide array of features for interacting with Windows internals and providing real-time input to penetration testers. Its ability to mesh with the early stages of C2 frameworks makes it particularly valuable for those involved in sophisticated red team engagements.
7. Taranis AI – Taranis AI is an artificial intelligence tool focused on reconnaissance. It leverages AI technology to condense information into valuable insight for analysts and penetration testers. Taranis does a great job at searching far and wide for information sources that may have otherwise been missed and extracting valuable information.
8. Nimplant – Another tool geared towards red team engagements, Nimplant is a very powerful and lightweight C2 implant. It is largely focused on the initial stages of enumeration post compromised, with a wide range of features to assist penetration testers. Nimplant, as the name suggests, is written largely in Nim.
9. SharpCollection – While not a tool itself, SharpCollection is a constantly updated list of some of the most popular C# tools in offensive security. It is well structured and divided to allow penetration testers and red teamers to quickly find a tool that works exactly for their specific needs.
10. IronSharpPack – IronSharpPack is a collection of tools pulled from SharpCollection wrapped into IronPython scripts. IronSharpPack has the added advantage of automatically performing some basic levels of anti-malware bypassing, meaning the odds of triggering detections go down significantly.

Penetration tools evolve rapidly, and it is vital to stay up to date with the latest changes. Novel technologies such as AI change the scope of not only what penetration testers will be attacking, but how they will be attacking. Luckily for ethical hackers, the community tends to release incredible new tools and research to the public frequently. It can be easy to fall behind, so integrating with the community and monitoring the latest developments and projects is essential to maintain your skills and stay up to date with everything that is changing.

Need a third-party penetration test? Contact us.