pentest-tools is a multi-language toolbox of small, focused scripts for reconnaissance, subdomain enumeration and web vulnerability checks during authorized security assessments.
| Tool | gwen001/pentest-tools — a collection of small custom security scripts for quick tasks during engagements |
| Category | offensive security utility collection (bash, Python 3, PHP >= 5.5) |
| Primary Use | Speeding up repetitive recon and validation work — DNS enumeration, host discovery, and checks for CORS, CRLF, open redirect, XSS, SSRF and HTTP request smuggling on in-scope hosts |
| Safe Use | For penetration testers and bug bounty hunters working exclusively on systems they are explicitly authorized to test, such as scoped engagements, lab environments, and sanctioned bug bounty programs |
| Telemetry Note | Most scripts generate direct, high-volume network requests (netcat, nmap, DNS queries, mass path checks) that are visible in target logs, WAF alerts, and DNS query logs — defenders should expect noisy scanning patterns from these tools |
gwen001/pentest-tools is one of those repositories that reflects how experienced operators actually work: rather than a monolithic framework, it is a loose arsenal of forty-odd small scripts, each solving one narrow problem that comes up repeatedly during reconnaissance and web testing. Written across bash, Python 3, and PHP >= 5.5, the collection sits at around 3,300 stars and is MIT licensed, which tells you it has earned real traction in the bug bounty community. The author's own framing — "a collection of custom security tools for quick needs" — is accurate: these are glue-code utilities designed to be chained together in a shell, not a product with a UI or a reporting pipeline.
What makes the repository trustworthy as a reference point is its documented hygiene. A major cleanup in November 2022 archived scripts that were broken or obsolete, and promoted the more substantial utilities into their own dedicated repositories: apk-analyzer, cloudflare-origin-ip, csp-analyzer, detectify-cves, extract-endpoints, favicon-hashtrick, google-search, graphql-introspection-analyzer, keyhacks.sh, and related-domains. That history matters operationally, because it means the current tree is curated — the scripts that remain are the ones the author still considers worth keeping, and the spun-out tools often deserve attention in their own right for deeper workflows.
Installation is deliberately minimal, which is typical of this class of toolbox. A git clone https://github.com/gwen001/pentest-tools, a cd pentest-tools, and a pip3 install -r requirements.txt covers the Python dependencies; the bash scripts lean on standard system binaries like netcat, nmap, parallel, and host, while the PHP scripts assume a working php interpreter. There is no installer, no daemon, and no configuration file — you read the source, understand what a script does, and run it against targets that are inside your authorized scope. That transparency is itself a feature: every script is short enough to audit in a single sitting.
The DNS and subdomain enumeration family is one of the strongest clusters in the collection. crtsh.php pulls subdomains for a given domain from certificate transparency data via crt.sh, while dnsenum-brute.sh and dnsenum-bruten.sh brute-force subdomains from wordlists and numeric variations respectively. dnsenum-reverse.sh and dnsenum-reverserange.sh apply reverse DNS resolution across IP ranges, with the latter reading ranges from an input file. dnsenum-zonetransfer.sh and mass_axfr.sh test for the classic misconfiguration of zone transfers being permitted, the latter doing it at scale across a list of domains. subalt.py complements all of these by generating subdomain alterations and permutations — the typo-adjacent hostnames that often expose forgotten infrastructure during sanctioned reconnaissance.
Host discovery and port awareness are covered by a parallel set of small scripts that differ mainly in their underlying primitive. ping-sweep-ping.sh, ping-sweep-nc.sh, and ping-sweep-nmap.sh all determine which IPs in a range are alive, using ping, netcat, or nmap respectively — a nice illustration of how the author offers interchangeable implementations depending on what is installed on the engagement box. portscan-nc.sh maps open ports on a single IP with netcat, and detect-vnc-rdp.sh specifically probes ports 3389 and 5900 across a range, a quick way to spot exposed RDP or VNC during scoping. resolve.py resolves a list of hosts to separate the living from the dead before you invest time in them.
The web vulnerability validation group is where the collection shows its bug bounty heritage. cors.py tests for CORS misconfigurations, crlf.py checks for CRLF injection, openredirect.py looks for open redirect flaws, and smuggler.py probes for HTTP request smuggling — all against a supplied list of hosts rather than one URL at a time, which is the unifying design pattern of the whole repo. rce.py tests for remote command execution, and xss.py (with its phantomjs-driven companion phantom-xss.js) validates reflected XSS by actually rendering pages in a headless browser. These are validation tools for hypotheses formed during recon, not automated exploitation frameworks, and they should be treated as such in an authorized workflow.
Content discovery is handled by quick-hits.php and quickhits.py, two implementations of the same idea: test a list of paths against a list of hosts and report what responds. Alongside them, filterurls.py classifies and displays URLs by vulnerability type — useful when you have already collected a large URL inventory from crawling or proxy logs and want to triage which ones look interesting for each bug class. testhttp.php does a crude but useful check of whether a given subdomain and port actually speak HTTP, and screensite.sh captures screenshots of a URL and port using xvfb, handy for rapidly eyebaling a large attack surface.
A smaller but interesting cluster deals with OSINT and third-party data sources. gdorks.php generates Google dorks for a given domain without performing the searches themselves — it produces the queries, you decide how to use them. pastebin.php and codeshare.php perform string searches on pastebin.com and codeshare.io respectively, and shodan.php wraps the Shodan API for search from the command line. For credential-oriented assessment work, mass-smtp-user-enum-bruteforce.sh and mass-smtp-user-enum-check.sh leverage smtp-user-enum to test whether SMTP user enumeration is possible across a list of IPs, and ssh-timing-b4-pass.sh attempts to guess SSH usernames via a timing side channel before authentication.
The remaining utilities are general-purpose plumbing that rounds out the toolbox. hashall.php hashes a string with roughly forty algorithms, and pass-permut.php generates word permutations with different separators and outputs their hashes — clearly aimed at offline password-audit preparation. ip-converter.php converts IP addresses between formats, referencing Nicolas Grégoire's well-known presentation on server-side browsing, and ip-listing.php expands IP ranges into explicit lists. ssrf-generate-ip.php generates random IP:port pairs inside private network ranges for SSRF testing, extract-domains.py and extract_links.php parse structured data into usable lists, arpa.sh converts reverse-DNS notation back to dotted quads, and node-uuid.js encodes and decodes UUIDs in base36.
From a defensive perspective, this collection is worth studying precisely because of its signature: nearly every script produces high-volume, patterned traffic. Mass DNS queries, wordlist brute-forcing, parallel host lookups via parallel, systematic path probing, and sweeps against well-known ports all leave clear footprints in DNS logs, WAF telemetry, and flow data. Blue teams can use the repo as a reference for what lightweight attacker tooling looks like — noise from these scripts is trivially detectable with rate-based alerting and anomaly detection when it hits infrastructure you are charged with defending.
The obvious caveat is operational discipline: because these scripts operate on lists, a careless input file can send traffic to hosts outside your intended scope. Every operator using pentest-tools in a professional context should validate target lists before any run, confirm authorization for each in-scope asset, and remember that the PHP and bash scripts have no output throttling built in. Used deliberately inside a sanctioned engagement or a lab, however, the collection is a genuinely useful set of building blocks — short, auditable, and emblematic of the Unix philosophy applied to security testing.
gwen001/pentest-tools.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.