PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Pen Testing Tools We’re Thankful for in 2020

bishopfox.com | blog | #open-source | #osint | #penetration-testing | #security-tools | #nuclei | #roundup
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox's favorite pen-testing tools of 2020: Nuclei for fast community-driven scanning, Spyse for security-focused OSINT, Smuggler for request smuggling, GoBuster, and other standouts.
Published
Collected

Related coverage

tool · projectdiscovery.io
Community Spotlight: Rishi (@rxerium)
“Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium) If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Center, CERT Polska, Spain’s national security agency, and many others, he’s one of the most prolific con
tool · github.com
Peach: Single-user, Local-first Personal Media Library and Management System
Offers a privacy-respecting, local-first alternative for media library indexing and playback, combining cloud-drive integration with automated scraping while keeping sensitive viewing data strictly local.
blog · bishopfox.com
Otto Support - Testing MCP Servers
Closing the otto-support series, the team uses nmap, a Nuclei template, and MCP Inspector to expose an authorization gap that lets any unprivileged user delete other users' tickets.
blog · bishopfox.com
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.
blog · bishopfox.com
Free Tools and Add-Ons to Explore for Applying DevSecOps in Your Organization
A free DevSecOps starter kit mapped to the DevOps lifecycle: OWASP ASVS/SAMM and Threat Dragon, SAST linters like SpotBugs and Bandit, OWASP ZAP, MozDef, and Prometheus.
blog · bishopfox.com
9 Red Team Tools For a Successful Red Teaming Engagement
Nine red team tools from Bishop Fox: CursedChrome for browser hijacking, Universal Loader for cross-platform in-memory loading, Overlord for infrastructure automation, and Sliver's implant framework.
Back