OWASP Zed Attack Proxy (ZAP) is an easy-to-use integrated penetration testing tool for finding vulnerabilities in Web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing as well as being a useful addition to an experienced pen tester's toolbox. ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.
sqlmap is a penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a detection engine, many niche features, and a broad range of switches including database fingerprinting, data fetching from the database, and accessing the underlying file system and executing commands on the operating system via out-of-band connections.
Armitage is a graphical cyber attack management tool for Metasploit that visualizes your targets, recommends exploits, and exposes the advanced capabilities of the framework. Armitage aims to make Metasploit usable for security practitioners who understand hacking but don't use Metasploit every day. If you want to learn Metasploit and grow into the advanced features, Armitage can help you.
HackIt! is a strategic game where your goal is to control as many Web sites as you can by hacking them. It is played on an infinite map (the whole Web) where hackers struggle for the control of the Internet. The game involves scanning sites to know who they belong to, hacking your friends' favorite pages, or tracking them to kick them out of the net.
geoipgen is an IP network tool for generating geotargeted lists of IP addresses using MaxMind's GeoLite Country database. It can randomly enumerate all IP addresses or a specified number of IP addresses in a particular country or a list of countries. For example, to get all IPs for Japan in a random order, use "geoipgen jp". For a sample of 10,000 IPs from Australia and New Zealand, use "geoipgen -n 10000 au nz".
Bluepot is a Bluetooth honeypot. It is designed to accept and store any malware sent to it and to interact with common Bluetooth attacks such as “BlueBugging” and “BlueSnarfing”. Bluetooth connectivity is provided via hardware Bluetooth dongles. The system also allows monitoring of attacks via a graphical user interface that provides graphs, lists, a dashboard, and further detailed analysis from log files. The system is also highly configurable through said interface.
StopHack is a simple to use and easy to install intrusion prevention system. It is fully adaptable and easily customized to your environment. It is built on top of proven bandwidth arbitration technology so the traffic passing through it won't be slowed down. Every packet is analyzed with regular expression-based behavior anomaly detection, and hackers are blocked immediately. It prevents reflected cross-site scripting, SQL injection, directory traversal, reflected URL redirects, login brute forcing, remote shell execution, and more.
PRADS is a "Passive Real-time Asset Detection System". It passively listens to network traffic and gathers information on hosts and services it sees. This information can be used to map your network, letting you know what services and hosts are alive and used. It can also be used together with your favorite IDS/IPS setup for "event to host/service" correlation. It can help you make sure that your inventory database is up to date. PRADS commes in two versions. One written in Perl, and one written in C. Some features might only be found in one of the versions.