CredMaster is a tool that facilitates password guessing attacks against common targets. It is designed with evasion and anti-detection capabilities and uses AWS APIs to rotate IP addresses for each guess.

GraphRunner is a collection of post-exploitation PowerShell modules for interacting with the Microsoft Graph API. It provides modules for enumeration, exfiltration, persistence, and more!

Burp Suite is an intercepting HTTP proxy that can also scan a web-based service for vulnerabilities. A tool like this is indispensable for testing web applications. Burp Suite is written in Java and comes bundled with a JVM, so it works on any operating system…

Impacket is an extremely useful tool for post exploitation. It is a collection of Python scripts that provides low-level programmatic access to the packets and for some protocols, such as DCOM, Kerberos, SMB1, and MSRPC, the protocol implementation itself.

Wireshark is an incredible tool used to read and analyze network traffic coming in and out of an endpoint. Additionally, it can load previously captured traffic to assist with troubleshooting network issues or analyze malicious traffic to help determine what…

Hashcat is a powerful tool for recovering lost passwords, and, thanks to GPU acceleration, it’s one of the fastest. It works by rapidly trying different password guesses to determine the original password from its scrambled (hashed) version.

Offensive Purpose: Efficient way to gather info about web services & their hosting infrastructure. Automates taking screenshots for quick & easy review.

Nmap is a powerful open-source tool commonly used by system/network administrators and security professionals to perform network discovery, security auditing, and basic vulnerability assessment.

🤖 AI for Cybersecurity Automation

Ethical Hackers Really Use It

Your go-to quick reference for essential commands in penetration testing, OSINT, network scanning, and more. Bookmark this for your next…

These are standard commands used for learning and lab-based pentesting. Always use them only in authorized testing environments.

In the world of bug bounty, your tools are only as good as your methodology. This cheat sheet organizes the "chaos" of a security…

One-liners are compact commands that combine multiple steps into a single execution

20+ Commands Every Cybersecurity Pro Needs

This list can be used by penetration testers when testing for SQL injection authentication bypass.A penetration tester can use it manually…

Domina Waybackurls para encontrar endpoints ocultos, parámetros sensibles y archivos JS antiguos en tus auditorías de seguridad.

This is a cheat sheet for Active Directory attack techniques used in TCM Security’s PNPT (Practical Network Penetration Tester)…