Open Source Unix Shell Penetration Testing Tools
Sort By:
Unix Shell Penetration Testing Tools
View 124 business solutionsBrowse free open source Unix Shell Penetration Testing Tools and projects below. Use the toggles on the left to filter open source Unix Shell Penetration Testing Tools by OS, license, language, programming language, and project status.
-
Gen AI apps are built with MongoDB AtlasMongoDB Atlas is the developer-friendly database used to build, scale, and run gen AI and LLM-powered apps—without needing a separate vector database. Atlas offers built-in vector search, global availability across 115+ regions, and flexible document modeling. Start building AI apps faster, all in one place.
-
Secure remote access solution to your private network, in the cloud or on-prem.OpenVPN is here to bring simple, flexible, and cost-effective secure remote access to companies of all sizes, regardless of where their resources are located.
-
1
airgeddon
This is a multi-use bash script for Linux systems
airgeddon is an alive project growing day by day. Interface mode switcher (Monitor-Managed) keeping selection even on interface name changing. DoS over wireless networks using different methods (mdk3, mdk4, aireplay-ng). "DoS Pursuit mode" is available to avoid AP channel hopping (available also on DoS performed on Evil Twin attacks). Full support for 2.4Ghz and 5Ghz bands. Assisted WPA/WPA2 personal networks Handshake file and PMKID capturing. Cleaning and optimizing Handshake captured files. Offline password decrypting on WPA/WPA2 captured files for personal networks (Handshakes and PMKIDs) using a dictionary, brute-force, and rule-based attacks with aircrack, crunch and hashcat tools. Enterprise networks captured password decrypting based on john the ripper, crunch, asleap and hashcat tools. GPU support available for hashcat. Only Rogue/Fake AP mode to sniff using external sniffer (Hostapd + DHCP + DoS). -
2
Web Security Dojo
Virtual training environment to learn web app ethical hacking.
Web Security Dojo is a virtual machine that provides the tools, targets, and documentation to learn and practice web application security testing. A preconfigured, stand-alone training environment ideal for classroom and conferences. No Internet required to use. Ideal for those interested in getting hands-on practice for ethical hacking, penetration testing, bug bounties, and capture the flag (CTF). A single OVA file will import into VirtualBox and VMware. There is also an Ansible script for those brave souls that want transform their stock Ubuntu into a virtual dojo. Bow to your sensei! username: dojo password: dojo -
3
EMAGNET
Automated hacking tool to find leaked databases with 97.1% accuracy
Automated hacking tool that will find leaked databases with 97.1% accurate to grab mail + password. Before using Emagnet, please remember that with great power comes great responsibility. Pastebin patched the vulnerability I previously used in order to get recent uploads, so at the moment it is not possible to get recently uploaded files, you are now limited to all syntaxes exempt the default one (95% get's uploaded as 'text' and this is removed from all recent upload lists). Bruteforce support for Spotify accounts, Instagram accounts, ssh servers, Microsoft RDP clients and Gmail accounts. Emagnet is a very powerful tool for capturing email addresses and passwords from leaked databases uploaded on Pastebin. It's almost impossible to find leaked passwords after they're removed from the list on pastebin.com. Either they have been deleted by Pastebin's techs or the upload is just one in the crowd. -
4
lynis
Security auditing tool for Linux, macOS, and UNIX-based system
Lynis is a battle-tested security tool for systems running Linux, macOS, or Unix-based operating system. It performs an extensive health scan of your systems to support system hardening and compliance testing. The project is open source software with the GPL license and available since 2007. Since Lynis is flexible, it is used for several different purposes. Typical use cases for Lynis include security auditing, compliance testing (e.g. PCI, HIPAA, SOx), penetration testing, vulnerability detection, and system hardening. Test that Docker image, or improve the hardening of your deployed web application. Run daily health scans to discover new weaknesses. Show colleagues or clients what can be done to improve security. Discover security weaknesses on systems of your clients, that may eventually result in system compromise. Lynis runs on almost all UNIX-based systems and versions. -
Photo and Video Editing APIs and SDKsUnlock Picsart's full editing suite by embedding our Editor SDK directly into your platform. Offer your users the power of a full design suite without leaving your site.
-
5
What is DracOS GNU/Linux Remastered ? DracOS GNU/Linux Remastered ( https://github.com/dracos-linux ) is the Linux operating system from Indonesia , open source is built based on Debian live project under the protection of the GNU General Public License v3.0. This operating system is one variant of Linux distributions, which is used to perform security testing (penetration testing). Dracos linux in Arm by hundreds hydraulic pentest, forensics and reverse engineering. Use a GUI-based tools-tools the software using the CLI (command line interface) and GUI (graphical user interface) to perform its operations. Now Dracos currently already up to version 3.1.5 with the code name "KUNTILANAK WITH REMASTERED".
-
6
<<Hack|Track GNU/Linux
Distro Penetrasing Live System Burn to USB Flash Disk & Run.
<<Hack|Track GNU/Linux is an open source operating system developed by the HTGL Project from Indonesia which provides penetration testing. -
7
ShellTer is an iptables-based firewall. What sets it apart from the rest is that it has built-in SSH brute force protection. It is easy to configure and has an interactive CLI installer.
-
8
VPLE
Vulnerable Pentesting Lab Environment
VPLE (Linux) Vulnerable Pentesting Lab Environment VPLE is an Intentionally Vulnerable Linux Virtual Machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing Labs. In VPLE bunch of labs are Available. NOTE:- "Only run in VMWare Pls Don’t run in VirtualBox" The default login and password is administrator: password. List Of All Labs in one VM:- 1. Web-DVWA 2. Mutillidae 3. Webgoat 4. Bwapp 5. Juice-shop 6. Security-ninjas 7. WordPress We are adding more labs in few days🤗 -
9
Linset
Linset Is Not a Social Enginering Tool
Linset is a social engineering tool based on MITM to check the security (or ignorance) of the clients in our wireless network. -
No-Nonsense Code-to-Cloud Security for Devs | AikidoAikido provides a unified security platform for developers, combining 12 powerful scans like SAST, DAST, and CSPM. AI-driven AutoFix and AutoTriage streamline vulnerability management, while runtime protection blocks attacks.
-
10
cPInstall is a small bash script created at first for UnderHost customer then released to public. Its purpose is to give access to install, optimize, secure any common cPanel plugin within one click. Useful for novice and helpful for advanced users. http://underhost.com - Offshore Hosting Solutions New version coming soon!
-
11
HackShark Linux
Lightweight Linux distro for penetration testing
Based on MATE environment HackShark Linux is a lightweight distribution for penetration testing, cyber forensic investigation and vulnerability assessment purpose. -
12
Sn1per
Attack Surface Management Platform | Sn1perSecurity LLC
Sn1per Professional is an all-in-one offensive security platform that provides a comprehensive view of your internal and external attack surface and offers an asset risk scoring system to prioritize, reduce, and manage risk. With Sn1per Professional, you can discover the attack surface and continuously monitor it for changes. It integrates with the leading open source and commercial security testing tools for a unified view of your data. -
13
A shell script which determines by brute force the best compression format (bzip2, gzip, Z, zip, etc.) and which compression level to use in order to archive a file the smallest possible.
-
14
Defensive Tools For The Blind
Defensive System Administrative Tools
Defensive Tools For The Blind (DTFTB) is a collection of Windows and Linux tools that automate: post exploitation, backdoor, and rouge access discovery, for defenders. DTFTB allows a system defender to quickly and precisely locate common backdoor tendencies and system misconfigurations used by an attacker to maintain access. Additionally DTFTB provide automated access-denial tools, that prohibit the introduction of new backdoors to a system. DTFTB is primarily geared towards CTF or other competitive environments. -
15
Jack the Stripper
Perform automated MITM (Man In The Middle) attacks.
ENGLISH: Jack the Stripper uses iptables, Ettercap and SSLStrip to intercept data between two connected targets (IP addresses). The victims's ARP tables must be poisoned by Ettercap, that means Jack the Stripper works only on local networks. PORTUGUÊS: Jack The Stripper utiliza iptables, Ettercap e SSLStrip para interceptar dados entre dois alvos (endereços IP) interconectados. As tabelas ARP das vítimas devem ser envenenadas pelo Ettercap, isso significa que Jack The Stripper funciona apenas em redes locais. -
16
LabMACOSX: Is a laboratory of applications written in Applescript language. Brutosx is brutus.pl remote login and password bruteforce cracker inserted inside the application Brutosx (need only of Net::Telnet Perl module are required get them at CPAN, while the list of users and passwords, and the service is inserted inside the application). SSHOSX is ssh application client to establish an ssh connection from client to server, Nmaposx is nmap port scanner invoked from the application Nmaposx (Syntax of nmap is inside the application). Packetstorm is all packet storm exploits database all inserted inside in the application Packetstorm, Shoppingosx an example of https connection. The application Ob open four browsers, Tesseract applications container, TAL, Chatosx, AndroMac, AndroEmu, MySMS, Shutdown, Updater, Search for, MyMaps, SOA, BLI, Xcoder, BasicProg, BasicProg2, VM, D,M&Z Suite Basic and D,M&Z Suite Advanced (POSIX based).
-
17
Penbang
Penetration Testing Collection for crunchbang[Openbox(Debian)]
Version 0.5 is available. How to update: http://penbang.sysbase.org/install_tools/0.5/Readme.txt Penbang has been tested on crunchbang Penbang is a collection of tools aimed at the openbox environment. It includes Network Exploits, Vulnerability Assessment/Exploits, Network Analysis, Social Engineering tools, I.G.C, dsniff suite, and irpas. As well as a simple way of launching them. *machinebacon of LinuxBBQ has made a fine distribution out of penbang. http://linuxbbq.org/bbs/viewtopic.php?f=3&t=331 -
18
Penetration-Testing-Toolkit v1.0
A web interface for various penetration testing tools
Penetration-Testing-Toolkit is a web based project to automate Scanning a network,Exploring CMS, Generating Undectable metasploit payload, DNS-Queries, IP related informations, Information Gathering, Domain related info etc -
19
RWSecure parses the /var/log/secure (or specified secure log) file for Invalid usernames or Failed password. If more than x invalid or failed attempts by one IP(i.e. brute force), it will add that IP to your /etc/hosts.deny file by default (also configur
-
20
Sudomy
Sudomy is a subdomain enumeration tool to collect subdomains
Sudomy is a subdomain enumeration tool to collect subdomains and analyze domains performing advanced automated reconnaissance (framework). This tool can also be used for OSINT (Open-source intelligence) activities. Easy, light, fast and powerful. Bash script (controller) is available by default in almost all Linux distributions. By using bash script multiprocessing feature, all processors will be utilized optimally. Subdomain enumeration process can be achieved by using active method or passive method. Sudomy utilize Gobuster tools because of its highspeed performance in carrying out DNS Subdomain Bruteforce attack (wildcard support). The wordlist that is used comes from combined SecList (Discover/DNS) lists which contains around 3 million entries. By evaluating and selecting the good third-party sites/resources, the enumeration process can be optimized. More results will be obtained with less time required. -
21
TeamSploit
Pen Testing With Friends
TeamSploit makes group-based penetration testing fun and easy, providing real-time collaboration and automation. TeamSploit is a suite of tools for the Metasploit Framework. TeamSploit should work with any MSF product (including, OpenSource, Express, or Pro). Features Include: - Exploitation Automation - Automated Post-Exploitation - Information and Data Gathering - Session Sharing - Trojans and Trollware TeamSploit's primary goal is to automate common penetration testing tasks, and provide access and information to fellow team members. -
22
The_Deck_Linux
Portable Penetration Testing Operating System
It is an Portable Penetration Testing Operating System designed for Beagle Bone AI. It is an debian based operating system fully packed with all latest Hacking Tools. The Root file system used in this Deck Linux is Ubuntu 20.04 LTS. It can be installed in Beagle Board AI and can use as a replacement for Laptop, Desktop. It can be placed on a drone too. It has a pre-installed MeshDeck (written by Philip Polstra) so it can be runned in a ZigBee network. We can attacks from up to a mile away using multiple devices connected via 802.15.4 networking (MeshDeck). -
23
Unsploitable
Automatically Patch Metasploitable Vulnerabilities
Unsploitable is an emergency patcher, providing critical security patches and updates for commonly exploited vulnerabilities in common operating systems, services, and applications. Unsploitable specifically targets exploits provided by penetration testing frameworks such as Metasploit. Unsploitable is tool for the Metasploit Framework. Unsploitable should work with any MSF product (including: OpenSource, Express, or Pro). -
24
VENOM C2 shellcode
C2 shellcode generator/compiler/handler
The script will use msfvenom (metasploit) to generate shellcode in different formats ( C# | python | ruby | dll | msi | hta-psh | doc | apk | macho | elf | deb | mp4 | etc ) injects the shellcode generated into one template (example: python) "the python function will execute the shellcode into ram" and uses compilers like gcc (gnu cross compiler) or mingw32 or pyinstaller to build the executable file. It also starts a handler to receive the remote connection (shell or meterpreter) venom 1.0.11 (malicious_server) was build to take advantage of apache2 webserver to deliver payloads (LAN) using a fake webpage writen in html to be hable to trigger payload downloads, the user just needs to send the link provided to target host. -
25
Cheescloth is a security script that is used to monitor and block email being brute force sent to your mail server by zombie machines in control by spammers and hackers. It also will catch and block hackers trying to hack your server via SSH connection
