DEV Community: Abhinav Singwal

Mastering Hydra: 20 Essential Commands for Password Auditing

Abhinav Singwal — Fri, 16 Oct 2026 00:36:00 +0000

Mastering Hydra: 20 Essential Commands for Password Auditing

Hydra is a fast, parallelized login cracker that supports numerous protocols including SSH, FTP, HTTP, SMB, MySQL, and more. It is one of the most widely used tools for credential auditing and password strength testing during authorized penetration tests. This guide walks through twenty practical Hydra commands, explaining what each does and when to reach for it during a security assessment.

1. Basic SSH Brute Force

hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1

The -l flag specifies a single username, while -P points to a password wordlist. This command attempts to authenticate to SSH using the username "admin" against every password in the rockyou list. It is the most fundamental Hydra invocation for testing SSH credential strength.

2. Brute Force with Username List

hydra -L users.txt -P passwords.txt ssh://192.168.1.1

The uppercase -L flag supplies a file containing multiple usernames. Hydra will attempt every combination of username and password. This is useful when you have enumerated valid usernames but do not know their passwords.

3. FTP Authentication Testing

hydra -l ftpuser -P passwords.txt ftp://192.168.1.1

Hydra supports FTP natively. This command tests a single FTP username against a password list. FTP remains common on internal networks and often uses weak or default credentials.

4. HTTP POST Form Attack

hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login.php:user=^USER^&pass=^PASS^:Invalid credentials"

The http-post-form module targets web login forms. The format is path:parameters:failure_string. Hydra replaces ^USER^ and ^PASS^ with credentials and detects failure by the string "Invalid credentials" appearing in the response.

5. HTTP GET Form Attack

hydra -l admin -P passwords.txt 192.168.1.1 http-get-form "/login.php:user=^USER^&pass=^PASS^:F=Login failed"

The http-get-form module works similarly but sends credentials via URL parameters. The F= prefix explicitly marks the failure condition string. Use this when the application authenticates through GET requests.

6. Basic HTTP Authentication

hydra -l admin -P passwords.txt 192.168.1.1 http-get /

This tests HTTP Basic authentication prompts. When a server returns a 401 status and prompts for credentials, this command cycles through the password list attempting to gain access.

7. SMB Authentication Testing

hydra -l administrator -P passwords.txt smb://192.168.1.1

The SMB module tests Windows file sharing credentials. This is valuable during internal assessments where SMB is often exposed and weak local administrator passwords can lead to lateral movement.

8. MySQL Database Attack

hydra -l root -P passwords.txt mysql://192.168.1.1

This targets MySQL database authentication. Databases are frequently misconfigured with weak root passwords or exposed to internal networks without proper access controls.

9. RDP Authentication Testing

hydra -l administrator -P passwords.txt rdp://192.168.1.1

The RDP module tests Remote Desktop Protocol credentials. RDP exposure is a common finding in internal networks and a frequent entry point for ransomware operators.

10. Specify a Non-Default Port

hydra -l admin -P passwords.txt -s 2222 ssh://192.168.1.1

The -s flag specifies a custom port. Services frequently run on non-standard ports to avoid automated scanning. Always verify the actual port before assuming defaults.

11. Limit Parallel Tasks

hydra -l admin -P passwords.txt -t 4 ssh://192.168.1.1

The -t flag controls the number of parallel connections per target. The default is 16, which can overwhelm fragile services or trigger account lockouts. Reducing to 4 or fewer is safer for production systems.

12. Add a Delay Between Attempts

hydra -l admin -P passwords.txt -t 2 -W 3 ssh://192.168.1.1

The -W flag sets the wait time in seconds between connection attempts. Combined with reduced task count, this helps avoid detection by rate-limiting systems and account lockout policies.

13. Continue After Finding Credentials

hydra -l admin -P passwords.txt -f ssh://192.168.1.1

The -f flag stops the attack as soon as a valid password is found. Without it, Hydra continues testing the remaining passwords even after success. Always use -f unless you specifically need to discover all valid credentials.

14. Verbose Output

hydra -l admin -P passwords.txt -V ssh://192.168.1.1

The -V flag displays every username and password combination being attempted. This is useful for debugging failed attacks, confirming that Hydra is reaching the service, and understanding timing behavior.

15. Save Output to a File

hydra -l admin -P passwords.txt -o results.txt ssh://192.168.1.1

The -o flag writes successful credentials to a file. Always save results during assessments to maintain an audit trail and avoid repeating work.

16. Resume an Interrupted Attack

hydra -l admin -P passwords.txt -R ssh://192.168.1.1

The -R flag restores a previously interrupted session. Hydra saves progress to a restore file automatically. This is essential for long-running attacks that may be interrupted by network issues.

17. Attack Multiple Targets

hydra -l admin -P passwords.txt -M targets.txt ssh

The -M flag reads a list of targets from a file. The protocol is specified separately at the end. This scales the attack across an entire subnet or inventory of hosts.

18. Combine Username and Password Lists with Colon

hydra -C credentials.txt ssh://192.168.1.1

The -C flag uses a colon-separated file where each line contains username:password. This tests specific credential pairs rather than generating the full Cartesian product, which is faster when you have known combinations to verify.

19. Test Empty Passwords

hydra -l admin -p "" ssh://192.168.1.1

The lowercase -p flag specifies a single password. Using an empty string tests whether accounts permit blank passwords. This is a quick check that occasionally yields surprising results on misconfigured systems.

20. Generate a Report in JSON Format

hydra -l admin -P passwords.txt -o results.json -b json ssh://192.168.1.1

The -b flag sets the output format for the results file. JSON output integrates cleanly with reporting tools, dashboards, and automated pipelines. This is preferred when Hydra results feed into a larger assessment workflow.

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top 20 sqlmap Commands Every Security Professional Should Know

Abhinav Singwal — Thu, 15 Oct 2026 00:36:00 +0000

Top 20 sqlmap Commands Every Security Professional Should Know

sqlmap is the industry-standard open-source tool for automating the detection and exploitation of SQL injection flaws . It supports a wide range of database backends including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, SQLite, and many more . Beyond simple detection, sqlmap can fingerprint the database, enumerate users and databases, extract data, access the underlying file system, and execute operating system commands via out-of-band connections . This fourth entry in our series covers the twenty most practical sqlmap commands, complete with explanations of when and why to use each one.

1. Basic SQL Injection Test

sqlmap -u "http://example.com/page.php?id=1"

The -u flag specifies the target URL with parameters. This is the simplest invocation and tests the given URL for SQL injection vulnerabilities automatically. sqlmap will first test if the parameter is dynamic, then attempt various injection techniques .

2. Test POST Parameters

sqlmap -u "http://example.com/login" --data="user=admin&pass=test"

The --data flag sends parameters via POST body instead of the URL query string. This is essential for testing login forms, API endpoints, and any application that accepts user input through POST requests .

3. Mark Specific Injection Point

sqlmap -u "http://example.com/page?id=1*" -p id

The asterisk (*) marks exactly where sqlmap should inject. This is useful when a URL contains multiple parameters and you want to target a specific one. The -p flag can also specify which parameter to test .

4. Use a Saved Request File

sqlmap -r request.txt

The -r flag loads an HTTP request from a file, typically exported from Burp Suite or OWASP ZAP. This is the preferred method for authenticated scans, complex requests with multipart bodies, or when you need to capture exact headers, cookies, and whitespace .

5. Enumerate All Databases

sqlmap -u "http://example.com/page?id=1" --dbs

The --dbs flag lists all databases available on the backend DBMS. This is typically the first enumeration step after confirming an injection, revealing the database names that attackers will target for sensitive data .

6. List Tables in a Database

sqlmap -u "http://example.com/page?id=1" -D database_name --tables

The -D flag specifies the database, and --tables lists its tables. This reveals the schema structure and helps identify tables containing user credentials, financial data, or other sensitive information .

7. List Columns in a Table

sqlmap -u "http://example.com/page?id=1" -D database_name -T users --columns

The -T flag specifies the table, and --columns lists its columns. This reveals the exact structure of a target table before dumping data, allowing you to extract only what matters .

8. Dump Table Data

sqlmap -u "http://example.com/page?id=1" -D database_name -T users --dump

The --dump flag extracts all data from the specified table. This is the final step in SQL injection exploitation, retrieving the actual information that attackers seek such as usernames, password hashes, and personal data .

9. Dump Specific Columns

sqlmap -u "http://example.com/page?id=1" -D database_name -T users -C username,password --dump

The -C flag limits extraction to specific columns. This is more efficient than dumping entire tables and reduces noise when you know exactly which fields contain sensitive data .

10. Get Current Database and User

sqlmap -u "http://example.com/page?id=1" --current-db --current-user

These flags retrieve the active database name and the database user account sqlmap is operating as. This information helps assess the privilege level of the compromised session .

11. Check for DBA Privileges

sqlmap -u "http://example.com/page?id=1" --is-dba

The --is-dba flag checks if the current database user has administrative privileges. DBA access opens additional exploitation avenues such as file system access and OS command execution .

12. Extract Password Hashes

sqlmap -u "http://example.com/page?id=1" --passwords

The --passwords flag dumps database user password hashes. sqlmap can also attempt to crack these hashes using dictionary attacks, potentially yielding plaintext credentials for lateral movement .

13. Non-Interactive Mode

sqlmap -u "http://example.com/page?id=1" --batch

The --batch flag runs sqlmap in non-interactive mode, accepting default answers for all prompts. This is essential for automation, CI/CD pipelines, and any scenario where manual input is not possible .

14. Adjust Detection Level

sqlmap -u "http://example.com/page?id=1" --level=3

The --level flag controls test depth from 1 to 5. Higher levels test more parameters, use more payloads, and increase the likelihood of detection but also improve coverage. Level 3 is a common starting point for thorough assessments .

15. Adjust Risk Level

sqlmap -u "http://example.com/page?id=1" --risk=2

The --risk flag controls payload risk from 1 to 3. Risk level 2 adds time-based and heavier payloads. Risk level 3 includes destructive UPDATE-based tests that can modify data. Use higher risk levels only when authorized and when data integrity is not a concern .

16. Specify Injection Technique

sqlmap -u "http://example.com/page?id=1" --technique=U

The --technique flag selects specific SQL injection methods. Letters map to techniques: B (Boolean), E (Error), U (Union), S (Stacked), T (Time-based), Q (Inline). Restricting techniques can speed up scans when the backend DBMS behavior is predictable .

17. WAF Bypass with Tamper Scripts

sqlmap -u "http://example.com/page?id=1" --tamper=space2comment

The --tamper flag applies scripts that modify payloads to evade web application firewalls. Common scripts include space2comment (replaces spaces with comments), randomcase (randomizes keyword casing), and charencode (URL-encodes characters) .

18. Route Through a Proxy

sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"

The --proxy flag routes all sqlmap traffic through a proxy such as Burp Suite or OWASP ZAP. This allows real-time inspection and modification of the payloads sqlmap sends, which is invaluable for understanding why certain injections succeed or fail .

19. Read a File from the Server

sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"

The --file-read flag reads files from the underlying file system when database privileges permit. This can expose configuration files, credentials, or source code that reveals additional attack surface .

20. Obtain an OS Shell

sqlmap -u "http://example.com/page?id=1" --os-shell

The --os-shell flag attempts to spawn an interactive operating system shell through the SQL injection. This represents full compromise and is typically used as a stepping stone for deeper network penetration. Use only with explicit authorization .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

OWASP Amass: 20 Commands for Attack Surface Mapping and Subdomain Enumeration

Abhinav Singwal — Wed, 14 Oct 2026 10:56:39 +0000

OWASP Amass is the most comprehensive tool for attack surface mapping and asset discovery. It goes beyond simple subdomain enumeration by mapping relationships between domains, IP addresses, netblocks, and autonomous systems. Amass integrates with over 50 passive data sources and supports active reconnaissance techniques including DNS brute forcing, zone transfer attempts, and certificate grabbing. This guide covers twenty practical Amass commands, explaining what each does and when to use it during a security assessment.

1. Passive Subdomain Enumeration

amass enum -passive -d example.com

The -passive flag restricts Amass to querying its numerous data sources without sending any DNS queries to the target. This is the safest starting point for reconnaissance, gathering subdomains from certificate transparency logs, search engines, and public DNS datasets while leaving no trace on the target's infrastructure .

2. Basic Domain Enumeration

amass enum -d example.com

Running enum without the -passive flag performs standard enumeration, which may include some active DNS resolution to validate discovered names. This balances coverage with reasonable speed, making it a common default for initial reconnaissance .

3. Active Enumeration with DNS Queries

amass enum -active -d example.com

The -active flag enables active recon methods including direct DNS queries, zone transfer attempts, and certificate grabbing. This reaches beyond passive feeds to discover subdomains that public sources have not indexed, at the cost of generating traffic to the target .

4. Brute Force Subdomain Discovery

amass enum -brute -d example.com

The -brute flag performs DNS brute forcing using Amass's built-in wordlist. This systematically tests candidate subdomain names by querying DNS. Combined with active enumeration, brute forcing often reveals internal naming conventions and development environments not present in public sources .

5. Brute Force with Custom Wordlist

amass enum -brute -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -d example.com

The -w flag specifies a custom wordlist for brute forcing. Security-focused wordlists like those from SecLists contain common subdomain prefixes tailored to different industries and naming patterns, significantly improving discovery rates over generic lists .

6. Save Results to Text File

amass enum -d example.com -o subdomains.txt

The -o flag writes output to a plain text file. Always save enumeration results during assessments to maintain an audit trail and to feed subsequent tools without repeating queries .

7. Save Results in All Formats

amass enum -d example.com -oA results/amass

The -oA flag writes results in all available formats including JSON, plain text, and graph database entries. This is useful when different downstream tools need different output formats, eliminating the need for multiple runs .

8. Show IP Addresses for Discovered Names

amass enum -d example.com -ip

The -ip flag includes resolved IP addresses alongside each discovered subdomain. This immediately identifies which subdomains are active and reveals shared hosting, cloud provider IP ranges, and potential infrastructure relationships .

9. Show Data Sources for Each Result

amass enum -d example.com -src

The -src flag annotates each discovered subdomain with the data source that reported it. A subdomain found by multiple independent sources is more likely to be genuine and active. This helps assess reliability when triaging large result sets .

10. Enumerate Multiple Domains from File

amass enum -df domains.txt -o all_subdomains.txt

The -df flag reads a list of root domains from a file, one per line. This scales enumeration across large scopes such as bug bounty programs with dozens of in-scope domains or organizations with multiple primary domains .

11. Set Enumeration Timeout

amass enum -d example.com -timeout 30

The -timeout flag specifies the maximum number of minutes to run the enumeration. The default is 30 minutes. For large scopes or thorough scans, increasing this allows more sources to complete. For quick checks, reducing it keeps runs short .

12. Control DNS Query Rate

amass enum -d example.com -dns-qps 100

The -dns-qps flag limits the maximum number of DNS queries per second across all resolvers. This prevents overwhelming target DNS servers and avoids triggering rate limiting or detection systems during active enumeration .

13. Use Custom DNS Resolvers

amass enum -d example.com -r 8.8.8.8,1.1.1.1

The -r flag specifies untrusted DNS resolvers to use for enumeration queries. Using public resolvers like Google (8.8.8.8) or Cloudflare (1.1.1.1) can improve resolution speed and reliability, especially when local resolvers are slow or filtered .

14. Blacklist Specific Subdomains

amass enum -d example.com -bl admin.example.com -bl staging.example.com

The -bl flag excludes specific subdomains from investigation. This is useful when certain subdomains are out of scope, known to cause issues, or belong to third parties that should not be scanned .

15. Exclude Data Sources

amass enum -d example.com -exclude crtsh

The -exclude flag prevents Amass from querying specific data sources. This is useful when a source is rate-limited, unreliable, or when you want to avoid a particular provider for operational or policy reasons .

16. Organization Intelligence Gathering

amass intel -org "Target Corporation"

The intel subcommand gathers intelligence about an organization rather than a specific domain. This discovers ASNs and CIDR ranges associated with the organization, expanding the attack surface beyond known domains to IP space the organization owns .

17. Reverse WHOIS Lookup

amass intel -whois -d example.com

The -whois flag with the intel subcommand performs reverse WHOIS lookups to find other domains registered by the same organization. This reveals additional root domains that may not be obvious from the primary domain alone .

18. Enumerate from ASN

amass intel -asn 12345 -ip

The -asn flag enumerates root domains and IP addresses belonging to a specific Autonomous System Number. Combined with -ip, this maps all IP ranges and associated domains for that ASN, providing a complete picture of the organization's infrastructure .

19. View Enumeration History

amass db -list

The db subcommand interacts with Amass's local graph database. The -list flag shows all previous enumerations stored in the database. This allows you to review past scans without re-running them and to identify which enumeration to visualize or track .

20. Track Changes Over Time

amass track -d example.com -history

The track subcommand compares enumerations that included the same target, showing what has changed between scans. The -history flag displays differences across all enumeration pairs. This is essential for continuous monitoring of an organization's attack surface and identifying newly exposed assets .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top 20 Wapiti Commands Every Security Professional Should Know

Abhinav Singwal — Wed, 14 Oct 2026 06:51:00 +0000

Wapiti is a powerful open-source web application vulnerability scanner written in Python. Unlike many commercial alternatives, Wapiti performs black-box scanning, meaning it analyzes the deployed web application without access to source code. It detects vulnerabilities such as SQL injection, cross-site scripting, file inclusion, command execution, and more. This second entry in our series covers the twenty most practical Wapiti commands, complete with explanations of when and why to use each one.

1. Basic Scan Against a URL

wapiti -u https://example.com/

The -u flag specifies the target URL. This is the simplest invocation and performs a full scan using all default modules against the specified target. Wapiti will crawl the site and test for a broad range of vulnerabilities automatically.

2. Scan with Specific Modules

wapiti -u https://example.com/ -m sql,xss

The -m flag lets you select specific attack modules to run. In this example, only SQL injection and cross-site scripting tests are performed. This is useful when you want to focus on particular vulnerability classes or reduce scan time.

3. List Available Modules

wapiti -u https://example.com/ --list-modules

Before running a targeted scan, list all available modules to understand what Wapiti can test for. Modules include sql, xss, file, ssrf, xxe, crlf, exec, and several others. Knowing the module names helps you construct precise scan commands.

4. Scan with Authentication

wapiti -u https://example.com/ --auth-user admin --auth-password secret

Many web applications require authentication before exposing vulnerable functionality. The --auth-user and --auth-password flags supply credentials for HTTP basic authentication or form-based login depending on the configuration.

5. Use a Cookie for Session-Based Scanning

wapiti -u https://example.com/ -c "PHPSESSID=abc123; security=low"

The -c flag passes a cookie header with every request. This is essential for scanning authenticated areas of an application when you already have a valid session token. It is commonly used in lab environments like DVWA.

6. Set a Custom User-Agent

wapiti -u https://example.com/ -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

The -A flag sets a custom User-Agent string. Some applications serve different content or block requests from default scanner User-Agents. Spoofing a browser string can help bypass basic filtering.

7. Limit Scan Scope with Exclude URLs

wapiti -u https://example.com/ --exclude https://example.com/logout

The --exclude flag prevents Wapiti from scanning specific URLs. This is critical when certain endpoints perform destructive actions such as account deletion or data modification. Always exclude logout and administrative action URLs.

8. Scan Multiple URLs from a File

wapiti -u https://example.com/ -f urls.txt

The -f flag supplies a file containing a list of URLs to scan. This is useful when you have a predefined set of endpoints rather than letting Wapiti crawl the entire site. Combined with scope restrictions, it keeps scans focused.

9. Control Crawl Depth

wapiti -u https://example.com/ -d 3

The -d flag sets the maximum crawling depth. A depth of 1 limits the scan to the starting page and its direct links. A depth of 5 or higher explores deeper into the application but takes significantly longer.

10. Set Maximum Number of URLs

wapiti -u https://example.com/ -m 200

The -m flag here limits the maximum number of URLs to scan (note: this differs from the module selection flag in some versions; check your Wapiti version documentation). This prevents runaway scans on large applications.

11. Adjust Number of Concurrent Tasks

wapiti -u https://example.com/ -t 10

The -t flag sets the number of concurrent tasks. Higher values speed up scanning but increase load on the target. Lower values are gentler and less likely to trigger rate limiting or WAF blocks.

12. Set Request Timeout

wapiti -u https://example.com/ --timeout 15

The --timeout flag defines the maximum number of seconds to wait for a response. Increasing the timeout helps with slow applications. Decreasing it speeds up scans against responsive targets.

13. Add Custom HTTP Headers

wapiti -u https://example.com/ -H "X-Forwarded-For: 127.0.0.1"

The -H flag adds custom headers to every request. This is useful for testing header-based access controls, bypassing IP restrictions, or simulating requests from a reverse proxy.

14. Use a Proxy for Interception

wapiti -u https://example.com/ --proxy http://127.0.0.1:8080

The --proxy flag routes all Wapiti traffic through a proxy such as Burp Suite or OWASP ZAP. This lets you inspect, modify, and log every request the scanner makes in real time.

15. Scan Behind a Proxy with Authentication

wapiti -u https://example.com/ --proxy http://127.0.0.1:8080 --proxy-user user --proxy-password pass

When your interception proxy requires authentication, use the --proxy-user and --proxy-password flags. This is common in corporate environments where proxies enforce access control.

16. Save Scan Report in HTML Format

wapiti -u https://example.com/ -f html -o /path/to/report

The -f flag specifies the report format, and -o sets the output directory. HTML reports are ideal for sharing findings with stakeholders who need a readable summary with severity ratings and remediation advice.

17. Save Scan Report in JSON Format

wapiti -u https://example.com/ -f json -o /path/to/report

JSON output is machine-readable and integrates well with CI/CD pipelines, custom dashboards, and vulnerability management platforms. Use this format when you need to parse results programmatically.

18. Save Scan Report in Multiple Formats

wapiti -u https://example.com/ -f html -f json -f txt -o /path/to/report

Wapiti supports generating multiple report formats in a single run. This is efficient when different teams need different formats. The HTML report serves humans while the JSON feeds automation.

19. Resume an Interrupted Scan

wapiti -u https://example.com/ --resume /path/to/report

The --resume flag restarts a scan from where it left off using a previously saved report directory. This is invaluable for long scans that were interrupted by network issues or system reboots.

20. Verbose Output for Debugging

wapiti -u https://example.com/ -v 2

The -v flag controls verbosity. Level 1 shows basic progress, level 2 adds detailed request and response information. Use higher verbosity when troubleshooting why certain endpoints are not being scanned or when verifying payload delivery.

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top 20 Nikto Commands Every Security Professional Should Know

Abhinav Singwal — Tue, 13 Oct 2026 22:03:00 +0000

Top 20 Nikto Commands Every Security Professional Should Know

Nikto is an open-source web server scanner that performs comprehensive tests against web servers for dangerous files, outdated software, misconfigurations, and other security issues . Written in Perl and built on LibWhisker2, Nikto supports SSL, proxies, host authentication, and attack encoding . Unlike application scanners such as Wapiti, Nikto focuses specifically on server-level reconnaissance and known dangerous paths rather than crawling application logic . This third entry in our series covers the twenty most practical Nikto commands, complete with explanations of when and why to use each one.

1. Basic Scan Against a Target

nikto -h http://example.com

The -h flag specifies the target host or URL. This is the simplest invocation and performs a full scan using all default plugins against the specified target. Nikto will probe for dangerous files, CGI scripts, outdated server versions, and common misconfigurations automatically .

2. Scan a Specific Port

nikto -h 192.168.1.1 -p 8080

The -p flag lets you target non-standard ports where web servers commonly listen. Default is port 80, but many production applications run on 8080, 8443, or custom ports. You can specify multiple ports separated by commas .

3. Scan HTTPS Targets

nikto -h https://example.com -ssl

The -ssl flag forces Nikto to use SSL/TLS when connecting. This is required for HTTPS targets, especially those using self-signed certificates that would otherwise cause connection failures. The flag tells Nikto to ignore certificate errors and proceed with the scan .

4. Save Output to HTML Report

nikto -h http://example.com -o scan.html -Format html

The -o flag specifies the output file, and -Format controls the report format. HTML reports are ideal for sharing findings with stakeholders who need a readable summary with severity ratings and descriptions .

5. Save Output in JSON Format

nikto -h http://example.com -o scan.json -Format json

JSON output is machine-readable and integrates well with CI/CD pipelines, custom dashboards, and vulnerability management platforms. Use this format when you need to parse results programmatically or feed them into other tools .

6. Scan Multiple Ports on One Host

nikto -h 192.168.0.1 -p 80,443,8080

Nikto accepts a comma-separated list of ports. This is efficient when you need to check several common web ports on a single target without running separate scans .

7. Scan Multiple Hosts from a File

nikto -h targets.txt

The -h flag accepts a file containing a list of hosts when the argument is not a URL or IP address. This is essential for large-scale assessments where you need to scan dozens or hundreds of targets in a single run .

8. Use Authentication Credentials

nikto -h http://example.com -id admin:password

The -id flag supplies HTTP Basic authentication credentials in the format username:password. Many web applications require authentication before exposing administrative interfaces or sensitive content .

9. Route Traffic Through a Proxy

nikto -h http://example.com -useproxy http://127.0.0.1:8080

The -useproxy flag routes all Nikto traffic through an HTTP proxy such as Burp Suite or OWASP ZAP. This lets you inspect, modify, and log every request in real time, which is invaluable for understanding exactly what Nikto is testing .

10. Set a Custom User-Agent

nikto -h http://example.com -useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

The -useragent flag sets a custom User-Agent string. Some applications serve different content or block requests from default scanner User-Agents. Spoofing a browser string can help bypass basic filtering .

11. Use Tuning to Select Test Categories

nikto -h http://example.com -Tuning 1234

The -Tuning flag filters which categories of tests Nikto runs. The characters map to test types: 1 (Interesting File), 2 (Misconfiguration), 3 (Information Disclosure), 4 (Injection), 5 (Remote File Retrieval), 6 (DoS), 7 (Server-wide File Retrieval), 8 (Command Execution), 9 (SQL Injection), 0 (File Upload), a (Authentication Bypass), b (Software Identification) .

12. Scan Only Specific Categories

nikto -h http://example.com -Tuning 34

This example runs only Information Disclosure (3) and Injection (4) tests. Tuning is useful when you want to focus on particular vulnerability classes or reduce scan time on large targets .

13. Use Reverse Tuning (Exclude Categories)

nikto -h http://example.com -Tuning x6

The x character reverses the tuning logic, running all tests except those specified. In this example, all tests run except Denial of Service (6). This is useful when you want comprehensive coverage but need to exclude potentially disruptive tests .

14. Scan with IDS Evasion Techniques

nikto -h http://example.com -evasion 1

The -evasion flag applies LibWhisker IDS evasion techniques. Options include: 1 (Random URI encoding), 2 (Directory self-reference), 3 (Premature URL ending), 4 (Prepend long random string), 5 (Fake parameter), 6 (TAB as request spacer), 7 (Change case of URL), 8 (Windows directory separator) .

15. Combine Multiple Evasion Techniques

nikto -h http://example.com -evasion 123

Multiple evasion techniques can be combined by listing their reference numbers consecutively. This layers multiple obfuscation methods, making detection by IDS/IPS more difficult .

16. List Available Plugins

nikto -list-plugins

The -list-plugins flag lists all plugins that Nikto can run and then exits without performing a scan. This helps you understand the full scope of available tests and construct precise plugin selections for targeted scans .

17. Run Specific Plugins Only

nikto -h http://example.com -Plugins "apacheusers"

The -Plugins flag selects which plugins to run. A comma-separated list specifies the plugin names. Special entries include ALL (run all plugins, the default) and NONE (run no plugins). This is useful for focused testing on specific server components .

18. Scan with All CGI Directories

nikto -h http://example.com -Cgidirs all

The -Cgidirs flag controls which CGI directories are tested. Special values include "none" (skip CGI testing) and "all" (test all known CGI directories). Specific directories can also be provided, such as "/cgi/ /cgi-a/" .

19. Limit Maximum Testing Time

nikto -h http://example.com -maxtime 1h

The -maxtime flag sets a maximum duration for testing each host. Durations can be specified in hours, minutes, or seconds (e.g., 1h, 60m, 3600s). This prevents scans from stalling indefinitely on slow or unresponsive targets .

20. Update Nikto's Database

nikto -update

The -update flag updates Nikto's plugins and databases directly from cirt.net. Running this before critical scans ensures you have the latest checks for newly discovered dangerous files and server vulnerabilities .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Fuzzing Smarter: 20 ffuf Commands for Web Content Discovery

Abhinav Singwal — Tue, 13 Oct 2026 12:15:29 +0000

ffuf (Fuzz Faster U Fool) is a high-speed web fuzzer written in Go. It has become the tool of choice for directory discovery, parameter fuzzing, virtual host enumeration, and virtually any task that involves injecting a payload into an HTTP request and analyzing the response. Its speed, flexibility, and powerful filtering system make it indispensable during the reconnaissance phase of web application assessments.

This guide covers twenty practical ffuf commands, explaining what each does and when to reach for it during a security assessment.

1. Basic Directory Discovery

ffuf -u https://example.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt

The -u flag sets the target URL with the FUZZ keyword marking the injection point. The -w flag points to the wordlist. This is the foundational ffuf command, replacing each FUZZ occurrence with entries from the wordlist to discover hidden directories and files.

2. File Extension Fuzzing

ffuf -u https://example.com/FUZZ -w wordlist.txt -e .php,.bak,.old,.txt,.zip

The -e flag appends extensions to every wordlist entry. Directories reveal structure; files reveal data. Backup files, old configuration files, and source code archives are frequently exposed with predictable naming patterns.

3. Match Specific Status Codes

ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,301,302,403

The -mc flag defines which HTTP status codes count as valid findings. By default ffuf matches 200, 204, 301, 302, 307, 401, and 403. Customizing this helps focus on specific response types.

4. Filter Out Status Codes

ffuf -u https://example.com/FUZZ -w wordlist.txt -fc 404,403

The -fc flag excludes specified status codes. When a server returns 403 for everything, filtering that code removes noise and surfaces genuine findings.

5. Filter by Response Size

ffuf -u https://example.com/FUZZ -w wordlist.txt -fs 1234

The -fs flag filters responses by content length. When a server returns the same generic page for all invalid paths, filtering its size eliminates false positives. This is one of the most effective filtering techniques.

6. Auto-Calibration

ffuf -u https://example.com/FUZZ -w wordlist.txt -ac

The -ac flag automatically calibrates filtering options by sending random requests and learning what a "not found" response looks like. This is considered non-negotiable by experienced testers because it dramatically reduces false positives on unpredictable applications.

7. Fuzz Host Header for Virtual Hosts

ffuf -u https://example.com -H "Host: FUZZ.example.com" -w subdomains.txt -mc 200

The -H flag adds a custom header. Virtual host discovery finds applications served on the same IP but under different hostnames. This reveals development, staging, and administrative interfaces that are not publicly linked.

8. Fuzz GET Parameters

ffuf -u "https://example.com/api?FUZZ=test" -w params.txt

Place FUZZ in the parameter name position to discover hidden parameters that the application accepts but does not document. This is a common finding in modern web applications where legacy parameters remain active.

9. Fuzz POST Data

ffuf -u https://example.com/login -X POST -d "user=admin&pass=FUZZ" -w passwords.txt

The -X flag sets the HTTP method and -d provides POST body data. This is used for parameter fuzzing in forms, APIs, and authentication endpoints.

10. Fuzz JSON POST Data

ffuf -u https://example.com/api -X POST -H "Content-Type: application/json" -d '{"name": "FUZZ", "key": "value"}' -w wordlist.txt

Fuzzing JSON APIs requires setting the correct Content-Type header and embedding FUZZ within the JSON body. Modern APIs are JSON-first, making this essential for API security testing.

11. Use Raw HTTP Requests

ffuf --request req.txt -w wordlist.txt -ac

The --request flag loads a complete HTTP request from a file. This is the most powerful feature for authenticated testing. Capture a request from Burp Suite, replace the target value with FUZZ, and ffuf replays the entire request including cookies, authentication headers, and CSRF tokens.

12. Multi-Position Fuzzing

ffuf -u https://FUZZ.example.com/FUZZ2 -w subdomains.txt:FUZZ -w paths.txt:FUZZ2 -mode pitchfork

The -w flag supports custom keywords using the wordlist:KEYWORD syntax. The -mode flag controls how multiple wordlists combine: pitchfork iterates them in parallel, clusterbomb tests every combination. This enables complex testing scenarios like fuzzing both subdomain and path simultaneously.

13. Recursive Scanning

ffuf -u https://example.com/FUZZ -w wordlist.txt -recursion -recursion-depth 2

The -recursion flag automatically queues discovered directories for further fuzzing. The -recursion-depth cap prevents runaway scans. When /admin/ is found, recursion explores its contents automatically.

14. Rate Limiting

ffuf -u https://example.com/FUZZ -w wordlist.txt -rate 50 -t 10

The -rate flag limits requests per second and -t controls concurrent threads. Default thread count is 40. Lowering both values reduces load on fragile targets and helps evade rate-limiting systems and WAF detection.

15. Add Delays Between Requests

ffuf -u https://example.com/FUZZ -w wordlist.txt -p 0.5

The -p flag sets a delay in seconds between requests. Accepts a single value or a range like 0.1-2.0 for random delays. This is essential for stealthy scanning against monitored targets.

16. Route Through a Proxy

ffuf -u https://example.com/FUZZ -w wordlist.txt -x http://127.0.0.1:8080

The -x flag routes all traffic through an HTTP or SOCKS5 proxy. Use Burp Suite or OWASP ZAP to inspect, modify, and replay requests in real time. The -replay-proxy flag sends only matched requests to the proxy for focused analysis.

17. Add Cookies for Authenticated Fuzzing

ffuf -u https://example.com/FUZZ -w wordlist.txt -b "sessionid=abc123; token=xyz789"

The -b flag supplies cookie data with every request. Combined with -ac, this enables authenticated content discovery without constructing raw request files.

18. Match Responses by Regex

ffuf -u https://example.com/search?q=FUZZ -w payloads.txt -mr "error|warning|stack trace"

The -mr flag matches responses containing a specific regular expression. Filter by -fr to exclude regex matches. This is useful for vulnerability detection, finding error messages that reveal injection points or information disclosure.

19. Output Results to JSON

ffuf -u https://example.com/FUZZ -w wordlist.txt -o results.json -of json

The -o flag writes output to a file and -of sets the format. Supported formats include JSON, HTML, Markdown, CSV, and eJSON. Structured output integrates with reporting tools and automation pipelines.

20. Silent Mode for Scripting

ffuf -u https://example.com/FUZZ -w wordlist.txt -s | tee results.txt

The -s flag suppresses the banner and progress indicators, showing only results. Piping through tee saves output while displaying it. This pattern is ideal for embedding ffuf in shell scripts and recon pipelines.

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Gobuster in Practice: 20 Commands for Directory and DNS Enumeration

Abhinav Singwal — Tue, 13 Oct 2026 12:09:56 +0000

Gobuster is a fast, lightweight enumeration tool written in Go. It is designed to brute-force hidden directories, files, DNS subdomains, virtual hosts, and cloud storage buckets. Its speed comes from concurrent threading, and its simplicity makes it a go-to utility during the reconnaissance phase of web application assessments. This guide covers twenty practical Gobuster commands, explaining what each does and when to apply it.

1. Basic Directory Brute Force

gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt

The dir mode enumerates directories and files on a web server. The -u flag sets the target URL, and -w points to the wordlist. This is the foundational Gobuster command and the starting point for most web content discovery.

2. Include File Extensions

gobuster dir -u http://example.com -w common.txt -x php,html,txt,bak

The -x flag appends specific file extensions to each wordlist entry. This reveals backup files, configuration files, and script files that would otherwise be missed by directory-only enumeration.

3. Specify HTTP Status Codes to Show

gobuster dir -u http://example.com -w common.txt -s 200,204,301,302,307,401,403

The -s flag defines which status codes count as valid findings. By default Gobuster shows 200, 204, 301, 302, 307, 401, and 403. Customizing this list helps filter noise on applications with unusual response patterns.

4. Exclude Specific Status Codes

gobuster dir -u http://example.com -w common.txt -b 404,403

The -b flag excludes specified status codes from results. This is useful when a server returns 403 for everything, which would otherwise flood the output with false positives.

5. Set Custom User-Agent

gobuster dir -u http://example.com -w common.txt -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

The -a flag sets a custom User-Agent string. Some applications serve different content or block requests from default tool User-Agents. Spoofing a browser string can help bypass basic filtering.

6. Add Cookies for Authenticated Scanning

gobuster dir -u http://example.com -w common.txt -c "PHPSESSID=abc123; security=low"

The -c flag passes a cookie header with every request. This is essential for enumerating content behind authentication when you already have a valid session token.

7. Add Custom HTTP Headers

gobuster dir -u http://example.com -w common.txt -H "X-Forwarded-For: 127.0.0.1"

The -H flag adds custom headers. This is useful for testing header-based access controls, bypassing IP restrictions, or simulating requests from a reverse proxy.

8. Follow Redirects

gobuster dir -u http://example.com -w common.txt -r

The -r flag follows HTTP redirects. When a server returns a 301 or 302 to a valid location, following the redirect confirms whether the resource actually exists or leads to a dead end.

9. Control Thread Count

gobuster dir -u http://example.com -w common.txt -t 50

The -t flag sets the number of concurrent threads. The default is 10. Higher values speed up enumeration but increase load on the target and the risk of triggering rate limiting or WAF blocks.

10. Set Request Timeout

gobuster dir -u http://example.com -w common.txt --timeout 20s

The --timeout flag defines the maximum time to wait for a response. Increasing the timeout helps with slow applications. Decreasing it speeds up scans against responsive targets.

11. Expand Results with Verbose Mode

gobuster dir -u http://example.com -w common.txt -v

The -v flag enables verbose output, showing additional details such as response lengths and redirect targets. This helps distinguish genuine findings from soft 404 pages that return 200 status codes.

12. Quiet Mode for Clean Output

gobuster dir -u http://example.com -w common.txt -q

The -q flag suppresses the banner and progress indicators, showing only results. This is ideal for scripting and when piping output into other tools.

13. Save Results to a File

gobuster dir -u http://example.com -w common.txt -o results.txt

The -o flag writes output to a file. Always save enumeration results during assessments to maintain an audit trail and avoid repeating work.

14. DNS Subdomain Enumeration

gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt

The dns mode enumerates subdomains by querying DNS resolvers. The -d flag sets the target domain. This reveals additional attack surface such as development, staging, and administrative subdomains.

15. Show DNS CNAME Records

gobuster dns -d example.com -w subdomains.txt -c

The -c flag displays CNAME records alongside A records. CNAMEs can reveal cloud services, CDNs, and third-party integrations that expand the attack surface.

16. Use a Custom DNS Resolver

gobuster dns -d example.com -w subdomains.txt -r 8.8.8.8

The -r flag specifies a custom DNS resolver. Using a public resolver or a target-specific internal resolver can improve accuracy and speed when the default system resolver is unreliable.

17. Virtual Host Enumeration

gobuster vhost -u http://example.com -w vhosts.txt

The vhost mode enumerates virtual hosts on a web server. This reveals applications hosted on the same IP address but served under different hostnames, which are often overlooked during assessments.

18. Append Domain to Vhost Entries

gobuster vhost -u http://example.com -w vhosts.txt --append-domain

The --append-domain flag automatically appends the base domain to each wordlist entry. This saves preparation time when the wordlist contains only subdomain prefixes.

19. Exclude Response Length to Filter False Positives

gobuster dir -u http://example.com -w common.txt --exclude-length 1234

The --exclude-length flag filters out responses with a specific content length. When a server returns the same generic page for all invalid paths, excluding its length removes the noise and surfaces genuine findings.

20. Scan Google Cloud Storage Buckets

gobuster bucket -w buckets.txt gcs

The bucket mode enumerates cloud storage buckets. The final argument specifies the provider, such as gcs for Google Cloud Storage or s3 for Amazon S3. Publicly readable buckets frequently expose sensitive data and are a common finding in cloud assessments.

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top 20 Nmap Commands Every Security Professional Should Know

Abhinav Singwal — Tue, 13 Oct 2026 09:33:06 +0000

Nmap (Network Mapper) remains the industry standard for network discovery and security auditing. Whether you are performing a penetration test, mapping your attack surface, or troubleshooting network issues, Nmap provides the foundational reconnaissance data that drives every subsequent phase of a security assessment. This first entry in our series covers the twenty most practical Nmap commands, complete with explanations of when and why to use each one.

1. Basic Host Discovery (Ping Sweep)

nmap -sn 192.168.1.0/24

The -sn flag performs a ping scan without port scanning, identifying live hosts on a network. This is your first step when mapping an unknown network segment. It tells you which IP addresses are active without generating the noise of a full port scan .

2. TCP SYN Scan (Stealth Scan)

nmap -sS 192.168.1.1

The SYN scan is Nmap's default and most popular technique. It sends a SYN packet, receives a SYN-ACK response, then immediately sends an RST to tear down the connection. This is faster and less likely to be logged by application-layer systems than a full connection .

3. TCP Connect Scan

nmap -sT 192.168.1.1

When you lack raw socket privileges (not running as root) or need maximum reliability, the connect scan completes the full TCP three-way handshake. It is more likely to be detected and logged by the target, but works universally .

4. UDP Scan

nmap -sU --top-ports 20 192.168.1.1

UDP services are often overlooked but frequently vulnerable. This scan checks the most common UDP ports (DNS, SNMP, DHCP, TFTP). UDP scanning is inherently slower and less reliable than TCP because UDP is connectionless .

5. Scan Specific Ports

nmap -p 22,80,443,8080 192.168.1.1

Target specific ports when you know exactly what services you are looking for. This dramatically reduces scan time and network noise compared to scanning all 65,535 ports .

6. Scan All Ports

nmap -p- 192.168.1.1

The -p- flag scans all 65,535 ports. Critical services are often hidden on non-standard ports (8081, 31337, 4443). Never assume that a service only runs on its default port .

7. Service Version Detection

nmap -sV 192.168.1.1

Version detection probes open ports to determine the application name and version. This is essential for vulnerability identification. Knowing that port 22 runs OpenSSH 7.4 versus OpenSSH 9.0 changes your entire assessment strategy .

8. Aggressive Scan

nmap -A 192.168.1.1

The -A flag enables OS detection, version detection, script scanning, and traceroute in a single command. It provides a comprehensive picture of the target but generates significant traffic. Use it when you need maximum information in one pass .

9. Operating System Detection

nmap -O 192.168.1.1

OS fingerprinting analyzes TCP/IP stack behavior to identify the target's operating system. This helps you narrow down potential exploits and understand the target environment .

10. Default Scripts

nmap -sC -sV 192.168.1.1

The -sC flag runs Nmap's default script set, which includes safe discovery scripts for service enumeration, SSL certificate details, and common misconfigurations. Combined with version detection, this is the standard "thorough but safe" scan .

11. Vulnerability Scripts

nmap --script vuln 192.168.1.1

The vuln script category checks for known vulnerabilities including MS17-010 (EternalBlue), SSL Heartbleed, and various injection flaws. These scripts are non-intrusive but can identify critical exposures .

12. HTTP Enumeration

nmap -p 80,443 --script http-enum 192.168.1.1

This script enumerates common web directories, applications, and files. It can reveal admin panels, backup files, and other web content that should not be publicly accessible .

13. SMB Vulnerability Check

nmap -p 445 --script smb-vuln-ms17-010 192.168.1.1

Given the prevalence of SMB-based attacks, this specific script checks for the EternalBlue vulnerability. It is one of the most commonly used NSE scripts in internal network assessments .

14. Timing Templates

nmap -T4 192.168.1.1

Timing templates control scan speed. T0 (Paranoid) and T1 (Sneaky) are for IDS evasion. T4 (Aggressive) is the standard for lab and internal environments. T5 (Insane) maximizes speed at the cost of accuracy .

15. Minimum Rate Scanning

nmap --min-rate 5000 -p- 192.168.1.1

The --min-rate option tells Nmap to send at least the specified number of packets per second. This is the fastest way to complete a full port scan without relying solely on timing templates .

16. Scan from Target List

nmap -iL targets.txt

When you have a file containing multiple IP addresses or hostnames, the -iL option reads targets from that file. This is essential for large-scale assessments .

17. No DNS Resolution

nmap -n 192.168.1.1

Skipping reverse DNS lookups speeds up scans significantly, especially when scanning large ranges. It also prevents your scan from generating DNS queries that might be logged .

18. Output to All Formats

nmap -oA scan_results 192.168.1.1

The -oA flag saves results in three formats: normal (human-readable), XML, and grepable. The XML output can be imported into Metasploit, Dradis, and other frameworks. Always save your scan data .

19. Decoy Scan

nmap -D RND:10 192.168.1.1

Decoy scanning sends packets from spoofed source addresses alongside your real address, making it appear that multiple hosts are scanning the target. This complicates IDS attribution, though modern systems can sometimes detect decoy patterns .

20. Firewall Mapping with ACK Scan

nmap -sA 192.168.1.1

The ACK scan does not determine open versus closed ports. Instead, it maps firewall rules by identifying which ports are filtered versus unfiltered. This is valuable reconnaissance before choosing an evasion strategy .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Hacking-Tools

Abhinav Singwal — Mon, 12 Oct 2026 04:02:43 +0000

Abhinav Singwal

Oct 12

Hacking Tools: A Complete List of Penetration Testing and Ethical Hacking Tools

#cybersecurity #opensource #github #webtesting

16 min read

Hacking Tools: A Complete List of Penetration Testing and Ethical Hacking Tools

Abhinav Singwal — Mon, 12 Oct 2026 04:02:23 +0000

Introduction

If you work in cybersecurity, you know how hard it is to find the right tools. They are spread across different websites, forums, and repositories. You waste time searching instead of testing.

I built a GitHub repository called Hacking-Tools to solve this problem. It is a curated list of penetration testing and ethical hacking tools, organized by category. It includes tools from Kali Linux and other notable sources.

This repository is free, open source, and licensed under MIT. It has 2.1k stars, 331 forks, and 18 watchers. Four contributors have helped build it.

In this blog post, I will walk you through every category and every tool in the repository. Whether you are a beginner or a professional pentester, this list will help you find what you need.

Repository link: https://github.com/yogsec/Hacking-Tools

Top 10 Tools of 2026

Before we go into categories, here are the top 10 tools featured in the repository for 2026.

Burp Suite – Web application and API security testing platform.
Nmap – Network scanning, discovery, and security auditing tool.
VCCGenerator – Developer-focused toolkit for generating and validating test card data and checking card number formats.
IP-Lookup.org – IP lookup tool for finding geolocation, ISP, ASN, hostname, and other IP details.
Quttera Website Security API – API for malware detection, reputation checks, and website security analysis.
Wireshark – Network protocol analyzer for capturing and analyzing traffic.
OWASP ZAP – Web application security scanner and penetration testing proxy.
Nessus – Vulnerability assessment and security scanning platform.
Impreza Host – Privacy-focused hosting provider offering anonymous VPS and dedicated servers.
BloodHound – Active Directory attack path and privilege relationship analysis tool.
Ghidra – Reverse engineering and binary analysis framework.

Information Gathering

Information gathering is the first step in any penetration test. These tools help you collect data about your target.

IP-Lookup.org – IP lookup and intelligence tool for checking IP geolocation, ISP, organization, ASN, hostname, IP reputation, VPN/proxy detection, Whois information, and network details.
Osintly – All-in-one OSINT platform combining hundreds of search modules, investigation tools, public data sources, intelligence APIs, and collaborative workspaces.
OnionLand Search – Deep-web search engine that indexes Tor onion services.
OSINT Search – Live OSINT search engine to find matching profiles, former usernames, and traces of deleted accounts.
IPLocation.net – IP geolocation lookup service for finding location, ISP, and other details.
WhiteIntel – Dark web monitoring service that helps organizations monitor exposed data and credentials.
ViewDNS.info – Comprehensive suite of domain and IP intelligence tools.
IP2Location.io – IP geolocation and IP intelligence API.
Nmap – Network scanning and mapping tool.
OSINTNova – Finds public information linked to usernames, emails, and phone numbers.
Check-Host – Network monitoring and diagnostic tool for checking host availability, ping, HTTP, TCP, and DNS.
Dato Capital – Business intelligence platform providing company information and corporate data.
Kismet – Wireless network detector, sniffer, and intrusion detection.
urlcap – HTTP capture and analysis API for inspecting requests and responses.
Maltego – OSINT and data mining tool for information analysis.
theHarvester – Tool to gather emails, subdomains, hosts, and more.
Recon-ng – Full-featured web reconnaissance framework.
SpiderFoot – Automate OSINT collection from multiple sources.
Amass – Network mapping and external asset discovery tool.
Sublist3r – Subdomain enumeration using search engines.
Assetfinder – Subdomain discovery using various sources.
crt.sh – SSL certificate transparency log search engine.
Dnsrecon – Perform DNS enumeration and zone transfers.
Fierce – DNS reconnaissance and attack tool.
WHOIS – Domain registration and ownership lookup.
CC.LA – Free WHOIS/RDAP lookup, DNS records, name server history, IP WHOIS, SSL certificate search, and network diagnostics.
EmailHarvester – Email enumeration and gathering.
Shodan – Search engine for internet-connected devices.
Netlas – Internet intelligence platform for discovering internet-connected assets.
Censys – Search engine for hosts and networks on the internet.
OSINT Framework – Collection of OSINT tools and resources.
FOCA – Metadata extraction and document analysis.
Netcraft – Website profiling and phishing detection.
BuiltWith – Website technology lookup and analysis.
StackScan – Website technology lookup and asset footprint search.

Vulnerability Analysis

These tools help you find weaknesses in systems, networks, and applications.

SmartScanner – AI-driven web vulnerability assessment tool.
OpenVAS – Open-source vulnerability scanner.
Nessus – Commercial vulnerability assessment tool.
Nikto – Web server scanner for detecting vulnerabilities.
Wapiti – Web application security scanner.
Vega – GUI-based web vulnerability scanner.
Arachni – Feature-rich web application security scanner.
SQLmap – Automated SQL injection detection and exploitation tool.
OWASP ZAP – Open-source web application security scanner.
Nmap Vulners – Nmap NSE script for CVE detection.
Retire.js – JavaScript library vulnerability scanner.
BugBoard – Bug hunter dashboard for vulnerability scanning and bug bounty workflows.
Dependency-Check – Vulnerability analysis for project dependencies.
Bandit – Security linter for Python code.
Vuls – Agentless vulnerability scanner for Linux and FreeBSD servers.
Trivy – Vulnerability scanner for containers and dependencies.
Grype – Vulnerability scanner for container images and filesystems.
Safety – Python dependency security scanner.
Lychee – Broken link checker with vulnerability detection potential.
GitLeaks – Detect hardcoded secrets and sensitive data.
ScoutSuite – Multi-cloud security auditing tool.
CloudSploit – AWS security auditing tool.

Exploitation Tools

These tools are used to exploit vulnerabilities once they are found.

Metasploit Framework – Powerful exploit development and penetration testing framework.
Armitage – GUI front-end for Metasploit to visualize attacks.
BeEF – Browser Exploitation Framework for client-side attacks.
ExploitDB – Archive of public exploits and proof-of-concept code.
SearchSploit – Offline version of ExploitDB for quick exploit searching.
sqlmap – Automated SQL injection exploitation tool.
Commix – Automated command injection vulnerability scanner.
RouterSploit – Exploits vulnerabilities in routers, IoT, and embedded devices.
SET (Social Engineering Toolkit) – Human hacking via phishing and payloads.
Empire – Post-exploitation framework for PowerShell agents.
Pupy – Cross-platform post-exploitation remote access tool.
Sliver – C2 framework for adversary simulation and red teaming.
Shellter – Dynamic shellcode injector for Windows executables.
Merlin – Post-exploitation command and control server using HTTP/2.
Covenant – C#-based post-exploitation platform.
PowerSploit – PowerShell scripts for post-exploitation.
Windows Exploit Suggester – Suggests exploits based on Windows OS versions.
PayloadsAllTheThings – Collection of payloads for exploits, fuzzing, and pentesting.
Fuzzbunch – NSA exploit framework from the Shadow Brokers leak.
CrackMapExec – Swiss army knife for post-exploitation in Windows environments.

Wireless Attacks

These tools target Wi-Fi networks and wireless protocols.

Aircrack-ng – WiFi cracking suite.
Reaver – WPS attack tool.
Fern WiFi Cracker – Wireless network auditing tool.
Wifite – Automated wireless attack tool.
Kismet – Wireless network detector and sniffer.
MDK3 – Wireless network attack tool.
PixieWPS – WPS offline attack tool.
WPA2 Wordlist Generator – Generate custom WPA2 wordlists.
Bully – WPS attack tool for brute-forcing.
Evil Twin – Create fake AP for capturing handshakes.
WiFi-Pumpkin – Man-in-the-middle framework for Wi-Fi networks.
Airgeddon – Multi-use bash script for wireless auditing.
Ghost Phisher – Wireless network attack tool for phishing.
NoCatSplash – Captive portal for Wi-Fi networks.
Wifiphisher – Phishing tool for Wi-Fi networks.
WLANPi – Wireless attack platform for pen-testers.
Cowpatty – Tool for offline WPA2 cracking.
Scapy – Python tool for packet manipulation and analysis.
NetStumbler – Wi-Fi scanner for Windows.
Wi-Fi Pineapple – Wireless attack platform by Hak5.

Forensics Tools

These tools help you investigate security incidents and analyze digital evidence.

Autopsy – Digital forensics platform for analyzing hard drives and smartphones.
Volatility – Memory forensics framework for analyzing RAM dumps.
Binwalk – Firmware analysis tool for extracting embedded files.
Sleuth Kit (TSK) – Command-line tools for disk image investigation.
ExifTool – Metadata extractor for images, videos, and documents.
TestDisk – Disk recovery tool to restore lost partitions.
PhotoRec – File recovery software for deleted files.
Foremost – File carving tool for data recovery.
Hashdeep – File hashing tool with recursive hashing and audit mode.
Bulk Extractor – Extracts email, URLs, and other artifacts from raw data.
Digital Forensics Framework (DFF) – Open-source platform for digital forensics.
Xplico – Network forensics tool to reconstruct network sessions.
NetworkMiner – Passive network packet analyzer for network forensics.
Pdf-parser – Analyze and extract content from PDF files.
RegRipper – Windows registry analysis tool.
PEView – Portable executable file viewer for malware analysis.
YARA – Malware pattern-matching tool.
HxD – Hex editor for raw disk editing and analysis.
FTK Imager – Disk imaging and evidence preview tool.
Capstone – Disassembly framework for binary analysis.

Stress Testing

These tools test how much load a system can handle.

Slowloris – HTTP DoS tool for keeping many connections open.
LOIC – Low Orbit Ion Cannon for stress testing.
HULK – HTTP flood tool that uses varied requests.
GoldenEye – Python-based HTTP denial-of-service tool.
Tsunami – Network stress testing and security evaluation.
R-U-Dead-Yet – Simple DoS testing tool.
DDoS-Sim – DDoS simulation tool.
Xerxes – Powerful DDoS attack tool for testing purposes.
Web-Hulk – Web server stress testing tool.
Synful – SYN flood tool for stress testing.
LOIC-PowerShell – PowerShell-based LOIC for DDoS testing.
T50 – Powerful stress testing tool that simulates multiple attack vectors.
RIP-Lite – Lightweight stress testing tool for HTTP and SOCKS.
Stress-ng – Tool that can stress test CPU, RAM, I/O, and more.
XDT – DDoS testing tool with multi-protocol support.
Botnet – DDoS botnet attack simulation tool.
DDOS-Exploit – Exploit kit for DDoS stress testing.
Fudp – Multi-threaded UDP flooder for stress testing.
BlackHAT – Stress testing framework for web applications.

Sniffing and Spoofing

These tools capture and manipulate network traffic.

Wireshark – Network protocol analyzer.
Ettercap – Man-in-the-middle attack tool.
BetterCAP – Flexible network attack and monitoring tool.
Tcpdump – Command-line packet analyzer.
Nessus – Vulnerability scanner with sniffing capabilities.
Scapy – Python-based interactive packet manipulation program.
MITMf – Man-in-the-middle framework for network attacks.
Fakenet-NG – Fake network traffic generation tool.
Dsniff – Collection of network monitoring tools for penetration testers.
Responder – LLMNR, NBT-NS, and MDNS poisoner for internal network attacks.
Ettercap-NG – Enhanced version of Ettercap.
Arp-Spoof – Tool to intercept network traffic by sending ARP packets.
WiFi-Pumpkin – WiFi spoofing tool.
Aircrack-ng – Suite for wireless network auditing and cracking WEP/WPA keys.
Xplico – Network forensics tool that extracts application data from pcap files.
Pry-Fi – Tool to find and exploit vulnerabilities in wireless networks.
Kismet – Wireless network detector, sniffer, and intrusion detection system.
Burp Suite – Web vulnerability scanner and network attack tool with interception features.
Snoopy – Sniffing and spoofing tool focused on DNS and HTTP traffic.
Snort – Open-source network intrusion detection and prevention system.

Password Attacks

These tools crack or recover passwords.

John the Ripper – Password cracking tool for various password hashes.
Hydra – Brute-force tool that supports a wide range of protocols.
Hashcat – Advanced password recovery using GPUs.
Medusa – Speedy, parallelized login brute-forcer.
Aircrack-ng – WiFi password cracking suite.
Wifite – Wireless network attack tool focused on WPA/WPA2.
THC-Hydra – Very fast network login cracker.
Hash-Toolkit – Tool for password hash cracking.
Brutus – Old but reliable password cracker for HTTP, FTP, and more.
Burp Suite – Popular web vulnerability scanner with password attack features.
Ophcrack – Windows password cracker using rainbow tables.
Cain and Abel – Versatile tool for cracking password hashes and sniffing networks.
L0phtCrack – Windows password auditing and recovery tool.
CrackStation – Free online service for cracking password hashes using dictionary attacks.
RainbowCrack – Tool that uses rainbow tables to crack passwords.
Patator – Multi-purpose brute-forcing tool that supports numerous protocols.
RSMangler – Hash bruteforce tool for creating password dictionaries.
CrackMapExec – Post-exploitation tool for automating credential validation.
SudoKiller – Tool for privilege escalation and password cracking in Unix-based systems.

Web Application Analysis

These tools find vulnerabilities in web applications.

Burp Suite – Web security testing toolkit.
OWASP ZAP – Open-source web application scanner.
SQLmap – Automated SQL injection tool.
Quttera Website Security API – REST API for website malware detection, blacklist and reputation checks, SSL and port analysis, and security assessment.
Wappalyzer – Identify technologies on websites.
Dirb – Web content scanner.
Gobuster – Directory and DNS brute-forcing.
Nikto – Web server vulnerability scanner.
Sublist3r – Subdomain enumeration.
Amass – Network mapping and subdomain enumeration.
Httpx – Fast HTTP probing.
FFUF – Fast web fuzzer.
WhatWeb – Identify web technologies.
Nuclei – Vulnerability scanning and templating.
XSStrike – XSS detection and exploitation.
Commix – Automated command injection.
WPScan – WordPress security scanner.
Cmsmap – CMS detection and exploitation.
Arachni – Advanced web vulnerability scanner.
Waybackurls – Fetch URLs from Wayback Machine.
Unfurl – Extract URLs and data from URLs.
Dirsearch – Fast scanner that uses brute-force to find hidden directories and files on web servers.

Reverse Engineering

These tools help you analyze binaries and understand how software works.

Ghidra – Open-source software reverse engineering framework.
Radare2 – Command-line reverse engineering toolkit.
OllyDbg – 32-bit assembler-level debugger for Windows.
IDA Pro – Industry-standard interactive disassembler.
Binary Ninja – Interactive binary analysis platform.
x64dbg – Open-source Windows debugger for x64 and x86.
Cutter – GUI for Radare2 with advanced analysis features.
Hopper – Mac and Linux disassembler with powerful analysis.
dnSpy – .NET debugger and assembly editor.
RetDec – Open-source decompiler for machine code.
angr – Python framework for binary analysis.
Frida – Dynamic instrumentation toolkit.
Binary Analysis Toolkit (BAT) – Malware analysis and binary inspection.
Rizin – Fork of Radare2 with a focus on usability.
PEiD – Detect packers, cryptors, and compilers.
DiE (Detect It Easy) – Portable executable identifier.
LIEF – Library for parsing and modifying executables.
Snowman – Native code to C++ decompiler.
APKTool – Decompile and rebuild Android APKs.
JEB Decompiler – Commercial decompiler for Android and other platforms.

Reporting Tools

These tools help you document and report your findings.

Dradis – Collaboration and reporting platform for pentesters.
Faraday – Multi-user penetration testing IDE.
MagicTree – Pentesting productivity tool for data aggregation and reporting.
Serpico – Simplifying pentest reporting using templates.
LaTeX – High-quality typesetting system often used for security reports.
reNgine – Automated reconnaissance framework with reporting.
ReconNote – Web-based notes manager for recon and reporting.
Pentracker – Pentest reporting and management tool.
Markdown – Lightweight markup language for clean report writing.
Ghostwriter – Reporting and engagement management platform.
VulnReport – Automated vulnerability reporting platform.
Katana Framework – Post-exploitation and reporting utility.
Pentest-Report-Template – Professional pentest report LaTeX template.
ProofSuite – Automated proof of concept and reporting tool.
VulnWhisperer – Vulnerability management reporting with Nessus, Qualys, and OpenVAS.
RiskSense – Risk-based vulnerability management and reporting.
Pentestly – PowerShell-based post-exploitation and reporting.
SecReport – Report generation tool for pentesters.
PwnDoc – Pentest reporting tool with customizable templates.
PenTest-Wiki – Knowledge base for pentesting and reporting references.

Social Engineering Tools

These tools test human behavior and awareness.

SET (Social-Engineer Toolkit) – Advanced framework for social engineering attacks.
King Phisher – Phishing campaign toolkit for testing and training.
Phishing Frenzy – Phishing campaign automation platform.
Gophish – Open-source phishing toolkit for awareness and testing.
Evilginx2 – Phishing toolkit using reverse proxy for capturing credentials and tokens.
HiddenEye – Modern phishing tool with advanced social engineering features.
BlackEye – Phishing tool with site cloning capabilities.
Zphisher – Advanced phishing tool with tunneling support.
SocialFish – Social engineering phishing framework.
HiddenEye Reborn – Improved version of HiddenEye for phishing and spoofing.
EvilPhish – Social engineering tool for phishing websites.
ShellPhish – Automated phishing tool supporting multiple templates.
CamPhish – Webcam phishing attack tool.
Weeman – HTTP server-based phishing framework.
QRGen – QR code phishing generator.
PyPhisher – Python-based phishing toolkit with multiple site templates.
AdvPhishing – Advanced phishing tool with login page cloning.
SocialBox – Brute-force social media hacking toolkit.
XPhisher – Advanced phishing tool with inbuilt tunneling.
CredSniper – Phishing framework with two-factor authentication bypass support.

Miscellaneous Tools

These tools do not fit into a single category but are useful for security work.

HostMeNow – Anonymous offshore hosting with cPanel, VPS, dedicated servers, and LTE proxies. Pay with 100+ cryptocurrencies. Use code SAFE for one month of free cPanel hosting.
Geonix – IPv4/IPv6/ISP and Mobile LTE proxies for security testing. Use promo code HTGR1 at checkout.
PROXY-SOLUTIONS.net – Proxy server provider with IP addresses in over 200 locations. Promo code for a 5% discount: Y1xpdOA8Xr.
OnionLand Hosting – Cryptocurrency-available Tor hidden-service hosting provider.
Impreza Host – Privacy-focused hosting provider offering anonymous VPS and dedicated servers.
Kali Linux – Advanced penetration testing and security auditing OS.
Parrot Security OS – Security-focused OS for pentesting and privacy.
BackBox – Ubuntu-based Linux distro for penetration testing.
BlackArch Linux – Arch-based OS with 2800+ hacking tools.
Pentoo – Security-focused Gentoo-based Linux.
Tails – Privacy and anonymity-focused live OS.
CAINE – Digital forensics live Linux distro.
Bugtraq – Linux distro for pentesting and malware analysis.
Whonix – Anonymous OS based on Tor.
DEFT Linux – Digital evidence and forensics toolkit.
Subgraph OS – Secure Linux distro with hardened kernel.
ArchStrike – Arch Linux repository for security tools.
Fedora Security Lab – Fedora spin for security auditing.
SamuraiWTF – Web application penetration testing environment.
Cyborg Hawk – Security distro for penetration testing.
Matriux Krypton – Debian-based security distribution.
NodeZero – Ubuntu-based penetration testing OS.
GnackTrack – Linux live distribution for penetration testing.
SELKS – Suricata-based IDS/IPS platform.
PentestBox – Penetration testing toolkit for Windows.

Conclusion

The Hacking-Tools repository is a one-stop resource for penetration testing and ethical hacking tools. It covers everything from information gathering to reporting. Whether you are just starting in cybersecurity or you are a seasoned professional, this list will save you time and help you find the right tool for the job.

The repository is free, open source, and licensed under MIT. It has 2.1k stars and 331 forks. If you find it useful, please star it on GitHub. That helps more people discover it.

Repository link: https://github.com/yogsec/Hacking-Tools

Follow me on LinkTree: https://linktr.ee/abhinavsingwal

IP Lookup Tool: Check IP Address, Geolocation, ISP and Network Information

Abhinav Singwal — Wed, 23 Sep 2026 13:11:13 +0000

An IP address can reveal useful information about a network, server, or internet connection. During cybersecurity research, OSINT, penetration testing, and network troubleshooting, an IP lookup tool can help you quickly understand an IP address.

IP-Lookup.org is an online IP address lookup tool that provides useful information associated with an IP address.

What Is an IP Lookup?

An IP lookup is the process of checking publicly available information associated with an IP address.

Depending on the IP address, this information can include:

IP geolocation
ISP information
Organization
ASN
Hostname
Network information
Whois details
Other IP intelligence

This can be useful when investigating an unfamiliar IP address found during security testing or network analysis.

IP Lookup for Cybersecurity

IP address information can be useful during different security research activities.

1. Reconnaissance

During web reconnaissance, security researchers may discover IP addresses belonging to servers, hosting providers, or other infrastructure.

An IP lookup can provide additional context about the discovered address.

2. OSINT Research

IP intelligence can be combined with other publicly available information to understand internet-facing infrastructure and network ownership.

3. Bug Bounty and Penetration Testing

Security researchers can use IP lookup during reconnaissance to investigate IP addresses discovered through DNS records, subdomains, server headers, or other sources.

4. Network Analysis

ISP, ASN, hostname, and geolocation information can help when investigating network connections or unfamiliar traffic.

How to Look Up an IP Address

Using an IP lookup tool is straightforward:

Find the IP address you want to investigate.
Open IP-Lookup.org.
Enter the IP address.
Review the available IP and network information.

Why Use an IP Lookup Tool?

Manually collecting information about an IP address can take time. An online IP lookup tool provides a quick way to gather commonly useful information in one place.

For security researchers, this can make the initial reconnaissance and investigation process faster.

Try IP-Lookup.org

If you are looking for an IP lookup tool, IP address lookup, or IP geolocation tool for cybersecurity research, OSINT, reconnaissance, or network analysis, you can check out:

IP-Lookup.org

CORS Misconfiguration Scanner: A Powerful Tool for Web Security Testing

Abhinav Singwal — Sat, 05 Sep 2026 12:41:53 +0000

Cross-Origin Resource Sharing (CORS) is a critical security mechanism that allows web applications to request resources from different domains. However, misconfigured CORS policies can expose your application to serious security vulnerabilities. Today, I'm excited to share a powerful tool called cors - a dedicated CORS misconfiguration scanner that helps security professionals and developers identify and fix these vulnerabilities.

What is CORS Misconfiguration Scanner?

GitHub: https://github.com/yogsec/cors

The cors tool is a fast, efficient command-line utility designed to detect CORS misconfigurations in web applications. Created by yogsec, this open-source tool helps you identify potential security loopholes before attackers can exploit them.

Key Features

Single URL Scanning: Test individual endpoints quickly
Bulk URL Scanning: Process multiple URLs from a wordlist
Multi-threaded Support: Configure concurrent threads for faster scanning
Custom Output: Save results to a file for later analysis
User-Friendly Interface: Clear output with vulnerability indicators

Understanding CORS Vulnerabilities

The tool checks for common CORS misconfigurations including:

Wildcard (*) in ACAO: Server accepts requests from any origin
Origin Reflection: Server echoes back the Origin header
Unsafe HTTP Methods: Allow dangerous methods like PUT/DELETE
Wildcard in ACAH: All headers are permitted
Credentials Enabled: Server allows sending credentials with requests

Installation Guide

Automatic Installation (Recommended)

git clone https://github.com/yogsec/cors
cd cors
sudo chmod +x install.sh
sudo ./install.sh

Manual Installation

git clone https://github.com/yogsec/cors
cd cors
chmod +x cors
sudo cp cors /usr/local/bin/

Verify Installation

cors -v

Expected output: cors version: 1.0

How to Use

Basic Syntax

cors [OPTIONS]

Usage Examples

1. Scan a Single URL

cors -u https://example.com

Output example:

[*] Checking: https://example.com
[!] https://example.com - Reflects origin in ACAO
[!] https://example.com - Credentials enabled

2. Scan Multiple URLs

Create a file urls.txt:

https://example.com
https://test.com/api
https://target.com

Run the scan:

cors -w urls.txt

3. Save Results to a File

cors -w urls.txt -o results.txt

4. Increase Scanning Speed

cors -w urls.txt -c 20

5. Combine Multiple Options

cors -w urls.txt -o vulnerable.txt -c 30

Get Involved

GitHub Repository: https://github.com/yogsec/cors
Report Issues: GitHub Issues
Contribute: Fork the repository and submit pull requests

Why This Tool Matters

In today's web application landscape, CORS misconfigurations are among the most common and dangerous security vulnerabilities. This tool provides:

Quick Identification: Rapidly detect potential CORS issues
Automated Testing: Streamline your security testing process
Comprehensive Coverage: Test multiple URLs and configurations
Developer-Friendly: Easy to use with clear output