MEGA PACK BOOKS / SHELLS (Free and Pay)

PHP deobfuscators

Online

* FOPO PHP Deobfuscator [ver. 0.1](

[To see links please register here]

) | [ver. 0.2](

[To see links please register here]

)
* [Sucuri's PHP decoder](

[To see links please register here]

)
* [Toolki's PHP decoder](

[To see links please register here]

)
* [unPHP](

[To see links please register here]

)
Offline
* [PHP Converter](

[To see links please register here]

)
* [PHP Script Decoder](

[To see links please register here]

)
*Note*: check out KahuSecurity's site [directly](

[To see links please register here]

) for latest versions of these tools.

PHP beautifiers
* [Dan's PHP beautify](

[To see links please register here]

)
* [PHP beautifier](

[To see links please register here]

)
* [PHP formatter](

[To see links please register here]

)

PHP testers
* [PHP Editor](

[To see links please register here]

)online
* [PHPFiddle](

[To see links please register here]

)online
* [PHP Sandbox](

[To see links please register here]

)online
* [PHP Tester](

[To see links please register here]

)online
* [EasyPHP](

[To see links please register here]

)offline
* [XAMPP](

[To see links please register here]

)offline

Online Resources

Penetration Testing Resources

* [Metasploit Unleashed](

[To see links please register here]

) - Free Offensive Security Metasploit course
* [PTES](

[To see links please register here]

) - Penetration Testing Execution Standard
* [OWASP](

[To see links please register here]

) - Open Web Application Security Project
* [PENTEST-WIKI](

[To see links please register here]

) - A free online security knowledge library for pentesters / researchers.
Exploit development

* [Shellcode Tutorial](

[To see links please register here]

) - Tutorial on how to write shellcode
* [Shellcode Examples](

[To see links please register here]

) - Shellcodes database
* [Exploit Writing Tutorials](

[To see links please register here]

) - Tutorials on how to develop exploits
* [shellsploit](

[To see links please register here]

) - New Generation Exploit Development Kit
* [Voltron](

[To see links please register here]

) - A hacky debugger UI for hackers

Social Engineering Resources

* [Social Engineering Framework](

[To see links please register here]

) - An information resource for social engineers

Lock Picking Resources

* [Schuyler Towne channel](

[To see links please register here]

) - Lockpicking videos and security talks
* [/r/lockpicking](

[To see links please register here]

) - Resources for learning lockpicking, equipment recommendations.

Tools

Basic Penetration Testing Tools

* [Metasploit Framework](

[To see links please register here]

) - World's most used penetration testing software
* [Burp Suite](

[To see links please register here]

) - An integrated platform for performing security testing of web applications
* [ExploitPack](

[To see links please register here]

) - Graphical tool for penetration testing with a bunch of exploits
* [BeeF](

[To see links please register here]

) - The Browser Exploitation Framework Project
* [faraday](

[To see links please register here]

) - Collaborative Penetration Test and Vulnerability Management Platform
* [evilgrade](

[To see links please register here]

) - The update explotation framework
* [commix](

[To see links please register here]

) - Automated All-in-One OS Command Injection and Exploitation Tool
* [routersploit](

[To see links please register here]

) - Automated penetration testing software for router
* [redsnarf] (

[To see links please register here]

) - Post-exploitation tool for grabbing credentials

Docker for Penetration Testing

* `docker pull kalilinux/kali-linux-docker` [official Kali Linux](

[To see links please register here]

)
* `docker pull owasp/zap2docker-stable` - [official OWASP ZAP](

[To see links please register here]

)
* `docker pull wpscanteam/wpscan` - [official WPScan](

[To see links please register here]

)
* `docker pull pandrew/metasploit` - [docker-metasploit](

[To see links please register here]

)
* `docker pull citizenstig/dvwa` - [Damn Vulnerable Web Application (DVWA)](

[To see links please register here]

)
* `docker pull wpscanteam/vulnerablewordpress` - [Vulnerable WordPress Installation](

[To see links please register here]

)
* `docker pull hmlio/vaas-cve-2014-6271` - [Vulnerability as a service: Shellshock](

[To see links please register here]

)
* `docker pull hmlio/vaas-cve-2014-0160` - [Vulnerability as a service: Heartbleed](

[To see links please register here]

)
* `docker pull opendns/security-ninjas` - [Security Ninjas](

[To see links please register here]

)
* `docker pull diogomonica/docker-bench-security` - [Docker Bench for Security](

[To see links please register here]

)
* `docker pull ismisepaul/securityshepherd` - [OWASP Security Shepherd](

[To see links please register here]

)
* `docker pull danmx/docker-owasp-webgoat` - [OWASP WebGoat Project docker image](

[To see links please register here]

)
* `docker pull citizenstig/nowasp` - [OWASP Mutillidae II Web Pen-Test Practice Application](

[To see links please register here]

)

Vulnerability Scanners

* [Nexpose](

[To see links please register here]

) - Vulnerability Management & Risk Management Software
* [Nessus](

[To see links please register here]

) - Vulnerability, configuration, and compliance assessment
* [Nikto](

[To see links please register here]

) - Web application vulnerability scanner
* [OpenVAS](

[To see links please register here]

) - Open Source vulnerability scanner and manager
* [OWASP Zed Attack Proxy](

[To see links please register here]

) - Penetration testing tool for web applications
* [Secapps](

[To see links please register here]

) - Integrated web application security testing environment
* [w3af](

[To see links please register here]

) - Web application attack and audit framework
* [Wapiti](

[To see links please register here]

) - Web application vulnerability scanner
* [WebReaver](

[To see links please register here]

) - Web application vulnerability scanner for Mac OS X
* [DVCS Ripper](

[To see links please register here]

) - Rip web accessible (distributed) version control systems: SVN/GIT/HG/BZR
* [arachni](

[To see links please register here]

) - Web Application Security Scanner Framework

Network Tools

* [nmap](

[To see links please register here]

) - Free Security Scanner For Network Exploration & Security Audits
* [pig](

[To see links please register here]

) - A Linux packet crafting tool
* [tcpdump/libpcap](

[To see links please register here]

) - A common packet analyzer that runs under the command line
* [Wireshark](

[To see links please register here]

) - A network protocol analyzer for Unix and Windows
* [Network Tools](

[To see links please register here]

) - Different network tools: ping, lookup, whois, etc
* [netsniff-ng](

[To see links please register here]

) - A Swiss army knife for for network sniffing
* [Intercepter-NG](

[To see links please register here]

) - a multifunctional network toolkit
* [SPARTA](

[To see links please register here]

) - Network Infrastructure Penetration Testing Tool
* [dnschef](

[To see links please register here]

) - A highly configurable DNS proxy for pentesters
* [DNSDumpster](

[To see links please register here]

) - Online DNS recon and search service
* [dnsenum](

[To see links please register here]

) - Perl script that enumerates DNS information from a domain, attempts zone transfers, performs a brute force dictionary style attack, and then performs reverse look-ups on the results
* [dnsmap](

[To see links please register here]

) - Passive DNS network mapper
* [dnsrecon](

[To see links please register here]

) - DNS Enumeration Script
* [dnstracer](

[To see links please register here]

) - Determines where a given DNS server gets its information from, and follows the chain of DNS servers
* [passivedns-client](

[To see links please register here]

) - Provides a library and a query tool for querying several passive DNS providers
* [passivedns](

[To see links please register here]

) - A network sniffer that logs all DNS server replies for use in a passive DNS setup
* [Mass Scan](

[To see links please register here]

) - TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
* [Zarp](

[To see links please register here]

) - Zarp is a network attack tool centered around the exploitation of local networks
* [mitmproxy](

[To see links please register here]

) - An interactive SSL-capable intercepting HTTP proxy for penetration testers and software developers
* [mallory](

[To see links please register here]

) - HTTP/HTTPS proxy over SSH
* [Netzob](

[To see links please register here]

) - Reverse engineering, traffic generation and fuzzing of communication protocols
* [DET](

[To see links please register here]

) - DET is a proof of concept to perform Data Exfiltration using either single or multiple channel(s) at the same time
* [pwnat](

[To see links please register here]

) - punches holes in firewalls and NATs
* [dsniff](

[To see links please register here]

) - a collection of tools for network auditing and pentesting
* [tgcd](

[To see links please register here]

) - a simple Unix network utility to extend the accessibility of TCP/IP based network services beyond firewalls
* [smbmap](

[To see links please register here]

) - a handy SMB enumeration tool
* [scapy](

[To see links please register here]

) - a python-based interactive packet manipulation program & library
* [Dshell](

[To see links please register here]

) - Network forensic analysis framework
* [Debookee (MAC OS X)](

[To see links please register here]

) - Intercept traffic from any device on your network
* [Dripcap](

[To see links please register here]

) - Caffeinated packet analyzer

Wireless Network Tools

* [Aircrack-ng](

[To see links please register here]

) - a set of tools for auditing wireless network
* [Kismet](

[To see links please register here]

) - Wireless network detector, sniffer, and IDS
* [Reaver](

[To see links please register here]

) - Brute force attack against Wifi Protected Setup
* [Wifite](

[To see links please register here]

) - Automated wireless attack tool
* [wifiphisher](

[To see links please register here]

) - Automated phishing attacks against Wi-Fi networks

SSL Analysis Tools

* [SSLyze](

[To see links please register here]

) - SSL configuration scanner
* [sslstrip](

[To see links please register here]

) - a demonstration of the HTTPS stripping attacks
* [sslstrip2](

[To see links please register here]

) - SSLStrip version to defeat HSTS
* [tls_prober](

[To see links please register here]

) - fingerprint a server's SSL/TLS implementation

Web exploitation

* [WPScan](

[To see links please register here]

) - Black box WordPress vulnerability scanner
* [SQLmap](

[To see links please register here]

) - Automatic SQL injection and database takeover tool
* [weevely3](

[To see links please register here]

) - Weaponized web shell
* [Wappalyzer](

[To see links please register here]

) - Wappalyzer uncovers the technologies used on websites
* [cms-explorer](

[To see links please register here]

) - CMS Explorer is designed to reveal the the specific modules, plugins, components and themes that various CMS driven web sites are running.
* [joomscan](

[To see links please register here]

) - Joomla CMS scanner
* [WhatWeb](

[To see links please register here]

) - Website Fingerprinter
* [BlindElephant](

[To see links please register here]

) - Web Application Fingerprinter
* [fimap](

[To see links please register here]

) - Find, prepare, audit, exploit and even google automatically for LFI/RFI bugs
* [Kadabr](

[To see links please register here]

) - Automatic LFI exploiter and scanner
* [Kadimus](

[To see links please register here]

) - LFI scan and exploit tool
* [liffy](

[To see links please register here]

) - LFI exploitation tool

Hex Editors

* [HexEdit.js](

[To see links please register here]

) - Browser-based hex editing
* [Hexinator](

[To see links please register here]

) (commercial) - World's finest Hex Edito

Crackers
* [John the Ripper](

[To see links please register here]

) - Fast password cracker
* [Online MD5 cracker](

[To see links please register here]

) - Online MD5 hash Cracker
* [Hashcat](

[To see links please register here]

) - The more fast hash cracker
Social Engineering Tools

* [SET](

[To see links please register here]

) - The Social-Engineer Toolkit from TrustedSec

OSInt Tools

* [Maltego](

[To see links please register here]

) - Proprietary software for open source intelligence and forensics, from Paterva.
* [theHarvester](

[To see links please register here]

) - E-mail, subdomain and people names harvester
* [creepy](

[To see links please register here]

) - A geolocation OSINT tool
* [metagoofil](

[To see links please register here]

) - Metadata harvester
* [Google Hacking Database](

[To see links please register here]

) - a database of Google dorks; can be used for recon
* [Censys](

[To see links please register here]

) - Collects data on hosts and websites through daily ZMap and ZGrab scans
* [Shodan](

[To see links please register here]

) - Shodan is the world's first search engine for Internet-connected devices
* [recon-ng](

[To see links please register here]

) - A full-featured Web Reconnaissance framework written in Python
* [github-dorks](

[To see links please register here]

) - CLI tool to scan github repos/organizations for potential sensitive information leak
* [vcsmap](

[To see links please register here]

) - A plugin-based tool to scan public version control systems for sensitive information

Anonymity Tools

* [Tor](

[To see links please register here]

) - The free software for enabling onion routing online anonymity
* [I2P](

[To see links please register here]

) - The Invisible Internet Project
* [Nipe](

[To see links please register here]

) - Script to redirect all traffic from the machine to the Tor network.

Reverse Engineering Tools

* [IDA Pro](

[To see links please register here]

) - A Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger
* [IDA Free](

[To see links please register here]

) - The freeware version of IDA v5.0
* [WDK/WinDbg](

[To see links please register here]

) - Windows Driver Kit and WinDbg
* [OllyDbg](

[To see links please register here]

) - An x86 debugger that emphasizes binary code analysis
* [Radare2](

[To see links please register here]

) - Opensource, crossplatform reverse engineering framework
* [x64_dbg](

[To see links please register here]

) - An open-source x64/x32 debugger for windows
* [Immunity Debugger](

[To see links please register here]

) - A powerful new way to write exploits and analyze malware
* [Evan's Debugger](

[To see links please register here]

) - OllyDbg-like debugger for Linux
* [Medusa disassembler](

[To see links please register here]

) - An open source interactive disassembler
* [plasma](

[To see links please register here]

) - Interactive disassembler for x86/ARM/MIPS. Generates indented pseudo-code with colored syntax code
* [peda](

[To see links please register here]

) - Python Exploit Development Assistance for GDB

CTF Tools

* [Pwntools](

[To see links please register here]

) - CTF framework for use in CTFs

Books
Penetration Testing Books

* [The Art of Exploitation by Jon Erickson, 2008](

[To see links please register here]

)
* [Metasploit: The Penetration Tester's Guide by David Kennedy et al., 2011](

[To see links please register here]

)
* [Penetration Testing: A Hands-On Introduction to Hacking by Georgia Weidman, 2014](

[To see links please register here]

)
* [Rtfm: Red Team Field Manual by Ben Clark, 2014](

[To see links please register here]

)
* [The Hacker Playbook by Peter Kim, 2014](

[To see links please register here]

)
* [The Basics of Hacking and Penetration Testing by Patrick Engebretson, 2013](

[To see links please register here]

)
* [Professional Penetration Testing by Thomas Wilhelm, 2013](

[To see links please register here]

)
* [Advanced Penetration Testing for Highly-Secured Environments by Lee Allen, 2012](

[To see links please register here]

)
* [Violent Python by TJ O'Connor, 2012](

[To see links please register here]

)
* [Fuzzing: Brute Force Vulnerability Discovery by Michael Sutton et al., 2007](

[To see links please register here]

)
* [Black Hat Python: Python Programming for Hackers and Pentesters by Justin Seitz, 2014](

[To see links please register here]

)
* [Penetration Testing: Procedures & Methodologies by EC-Council, 2010](

[To see links please register here]

)
* [Unauthorised Access: Physical Penetration Testing For IT Security Teams by Wil Allsopp, 2010](

[To see links please register here]

)
* [Advanced Persistent Threat Hacking: The Art and Science of Hacking Any Organization by Tyler Wrightson, 2014](

[To see links please register here]

)
* [Bug Hunter's Diary by Tobias Klein, 2011](

[To see links please register here]

)

Hackers Handbook Series

* [The Database Hacker's Handbook, David Litchfield et al., 2005](

[To see links please register here]

)
* [The Shellcoders Handbook by Chris Anley et al., 2007](

[To see links please register here]

)
* [The Mac Hacker's Handbook by Charlie Miller & Dino Dai Zovi, 2009](

[To see links please register here]

)
* [The Web Application Hackers Handbook by D. Stuttard, M. Pinto, 2011](

[To see links please register here]

)
* [iOS Hackers Handbook by Charlie Miller et al., 2012](

[To see links please register here]

)
* [Android Hackers Handbook by Joshua J. Drake et al., 2014](

[To see links please register here]

)
* [The Browser Hackers Handbook by Wade Alcorn et al., 2014](

[To see links please register here]

)
* [The Mobile Application Hackers Handbook by Dominic Chell et al., 2015](

[To see links please register here]

)
* [Car Hacker's Handbook by Craig Smith, 2016](

[To see links please register here]

)

Network Analysis Books

* [Nmap Network Scanning by Gordon Fyodor Lyon, 2009](

[To see links please register here]

)
* [Praical Packet Analysis by Chris Sanders, 2011](

[To see links please register here]

)
* [Wireshark Network Analysis by by Laura Chappell & Gerald Combs, 2012](

[To see links please register here]

)
* [Network Forensics: Tracking Hackers through Cyberspace by Sherri Davidoff & Jonathan Ham, 2012](

[To see links please register here]

)

Reverse Engineering Books

* [Reverse Engineering for Beginners by Dennis Yurichev](

[To see links please register here]

)
* [Hacking the Xbox by Andrew Huang, 2003](

[To see links please register here]

)
* [The IDA Pro Book by Chris Eagle, 2011](

[To see links please register here]

)
* [Practical Reverse Engineering by Bruce Dang et al., 2014](

[To see links please register here]

)
* [Gray Hat Hacking The Ethical Hacker's Handbook by Daniel Regalado et al., 2015](

[To see links please register here]

)

Malware Analysis Books

* [Practical Malware Analysis by Michael Sikorski & Andrew Honig, 2012](

[To see links please register here]

)
* [The Art of Memory Forensics by Michael Hale Ligh et al., 2014](

[To see links please register here]

)
* [Malware Analyst's Cookbook and DVD by Michael Hale Ligh et al., 2010](

[To see links please register here]

)

Social Engineering Books

* [The Art of Deception by Kevin D. Mitnick & William L. Simon, 2002](

[To see links please register here]

)
* [The Art of Intrusion by Kevin D. Mitnick & William L. Simon, 2005](

[To see links please register here]

)
* [Ghost in the Wires by Kevin D. Mitnick & William L. Simon, 2011](

[To see links please register here]

)
* [No Tech Hacking by Johnny Long & Jack Wiles, 2008](

[To see links please register here]

)
* [Social Engineering: The Art of Human Hacking by Christopher Hadnagy, 2010](

[To see links please register here]

)
* [Unmasking the Social Engineer: The Human Element of Security by Christopher Hadnagy, 2014](

[To see links please register here]

)
* [Social Engineering in IT Security: Tools, Tactics, and Techniques by Sharon Conheady, 2014](

[To see links please register here]

)

Lock Picking Books

* [Practical Lock Picking by Deviant Ollam, 2012](

[To see links please register here]

)
* [Keys to the Kingdom by Deviant Ollam, 2012](

[To see links please register here]

)
* [CIA Lock Picking Field Operative Training Manual](

[To see links please register here]

)
* [Lock Picking: Detail Overkill by Solomon](

[To see links please register here]

)
* [Eddie the Wire books](

[To see links please register here]

)

Vulnerability Databases

* [NVD](

[To see links please register here]

) - US National Vulnerability Database
* [CERT](

[To see links please register here]

) - US Computer Emergency Readiness Team
* [OSVDB](

[To see links please register here]

) - Open Sourced Vulnerability Database
* [Bugtraq](

[To see links please register here]

) - Symantec SecurityFocus
* [Exploit-DB](

[To see links please register here]

) - Offensive Security Exploit Database
* [Fulldisclosure](

[To see links please register here]

) - Full Disclosure Mailing List
* [MS Bulletin](

[To see links please register here]

) - Microsoft Security Bulletin
* [MS Advisory](

[To see links please register here]

) - Microsoft Security Advisories
* [Inj3ct0r](

[To see links please register here]

) - Inj3ct0r Exploit Database
* [Packet Storm](

[To see links please register here]

) - Packet Storm Global Security Resource
* [SecuriTeam](

[To see links please register here]

) - Securiteam Vulnerability Information
* [CXSecurity](

[To see links please register here]

) - CSSecurity Bugtraq List
* [Vulnerability Laboratory](

[To see links please register here]

) - Vulnerability Research Laboratory
* [ZDI](

[To see links please register here]

) - Zero Day Initiative

Security Courses

* [Offensive Security Training](

[To see links please register here]

) - Training from BackTrack/Kali developers
* [SANS Security Training](

[To see links please register here]

) - Computer Security Training & Certification
* [Open Security Training](

[To see links please register here]

) - Training material for computer security classes
* [CTF Field Guide](

[To see links please register here]

) - everything you need to win your next CTF competition

Information Security Conferences

* [DEF CON](

[To see links please register here]

) - An annual hacker convention in Las Vegas
* [Black Hat](

[To see links please register here]

) - An annual security conference in Las Vegas
* [BSides](

[To see links please register here]

) - A framework for organising and holding security conferences
* [CCC](

[To see links please register here]

) - An annual meeting of the international hacker scene in Germany
* [DerbyCon](

[To see links please register here]

) - An annual hacker conference based in Louisville
* [PhreakNIC](

[To see links please register here]

) - A technology conference held annually in middle Tennessee
* [ShmooCon](

[To see links please register here]

) - An annual US east coast hacker convention
* [CarolinaCon](

[To see links please register here]

) - An infosec conference, held annually in North Carolina
* [SumerCon](

[To see links please register here]

) - One of the oldest hacker conventions, held during Summer
* [Hack.lu](

[To see links please register here]

) - An annual conference held in Luxembourg
* [HITB](

[To see links please register here]

) - Deep-knowledge security conference held in Malaysia and The Netherlands
* [Troopers](

[To see links please register here]

) - Annual international IT Security event with workshops held in Heidelberg, Germany
* [Hack3rCon](

[To see links please register here]

) - An annual US hacker conference
* [ThotCon](

[To see links please register here]

) - An annual US hacker conference held in Chicago
* [LayerOne](

[To see links please register here]

) - An annual US security conference held every spring in Los Angeles
* [DeepSec](

[To see links please register here]

) - Security Conference in Vienna, Austria
* [SkyDogCon](

[To see links please register here]

) - A technology conference in Nashville
* [SECUINSIDE](

[To see links please register here]

) - Security Conference in [Seoul](

[To see links please register here]

)
* [DefCamp](

[To see links please register here]

) - Largest Security Conference in Eastern Europe, held anually in Bucharest, Romania
* [AppSecUSA](

[To see links please register here]

) - An annual conference organised by OWASP
* [BruCON](

[To see links please register here]

) - An annual security conference in Belgium
* [Infosecurity Europe](

[To see links please register here]

) - Europe's number one information security event, held in London, UK
* [Nullcon](

[To see links please register here]

) - An annual conference in Delhi and Goa, India
* [RSA Conference USA](

[To see links please register here]

) - An annual security conference in San Francisco, California, USA
* [Swiss Cyber Storm](

[To see links please register here]

) - An annual security conference in Lucerne, Switzerland
* [Virus Bulletin Conference](

[To see links please register here]

) - An annual conference going to be held in Denver, USA for 2016
* [Ekoparty](

[To see links please register here]

) - Largest Security Conference in Latin America, held annually in Buenos Aires, Argentina
* [44Con](

[To see links please register here]

) - Annual Security Conference held in London
* [BalCCon](

[To see links please register here]

) - Balkan Computer Congress, annualy held in Novi Sad, Serbia
* [FSec](

[To see links please register here]

) - FSec - Croatian Information Security Gathering in Varaždin, Croatia

Information Security Magazines

* [2600: The Hacker Quarterly](

[To see links please register here]

) - An American publication about technology and computer "underground"
* [Phrack Magazine](

[To see links please register here]

) - By far the longest running hacker zine

Awesome Lists

* [Kali Linux Tools](

[To see links please register here]

) - List of tools present in Kali Linux
* [SecTools](

[To see links please register here]

) - Top 125 Network Security Tools
* [C/C++ Programming](

[To see links please register here]

) - One of the main language for open source security tools
* [.NET Programming](

[To see links please register here]

) - A software framework for Microsoft Windows platform development
* [Shell Scripting](

[To see links please register here]

) - Command-line frameworks, toolkits, guides and gizmos
* [Ruby rogramming by @dreikanter](

[To see links please register here]

) - The de-facto language for writing exploits
* [Ruby Programming by @

[To see links please register here]

](

[To see links please register here]

) - The de-facto language for writing exploits
* [Ruby Programming by @Sdogruyol](

[To see links please register here]

) - The de-facto language for writing exploits
* [JavaScript Programming](

[To see links please register here]

) - In-browser development and scripting
* [Node.js Programming by @sindresorhus](

[To see links please register here]

) - JavaScript in command-line
* [Node.js Programming by @vndmtrx](

[To see links please register here]

) - JavaScript in command-line
* [Python tools for penetration testers](

[To see links please register here]

) - Lots of pentesting tools are written in Python
* [Python Programming by @svaksha](

[To see links please register here]

) - General Python programming
* [Python Programming by @

[To see links please register here]

](

[To see links please register here]

) - General Python programming
* [Android Security](

[To see links please register here]

) - A collection of android security related resources
* [Awesome Awesomness](

[To see links please register here]

) - The List of the Lists
* [AppSec](

[To see links please register here]

) - Resources for learning about application security
* [CTFs](

[To see links please register here]

) - Capture The Flag frameworks, libraries, etc
* [Hacking](

[To see links please register here]

) - Tutorials, tools, and resources
* [Honeypots](

[To see links please register here]

) - Honeypots, tools, components, and more
* [Infosec](

[To see links please register here]

) - Information security resources for pentesting, forensics, and more
* [Malware Analysis](

[To see links please register here]

) - Tools and resources for analysts
* [PCAP Tools](

[To see links please register here]

) - Tools for processing network traffic
* [Security](

[To see links please register here]

) - Software, libraries, documents, and other resources
* [Awesome List](

[To see links please register here]

) - A curated list of awesome lists
* [SecLists](

[To see links please register here]

) - Collection of multiple types of lists used during security assessments
* [Security Talks](

[To see links please register here]

) - A curated list of security conferences

OSX security related tools

1. [OSX collector](

[To see links please register here]

) - for forensic analysis
2. [MIDAS](

[To see links please register here]

) - Mac Intrusion Detection Analysis System
3. [OSX auditor](

[To see links please register here]

) - for forensic analysis
4. [Santa](

[To see links please register here]

) - binary whitelisting/blacklisting system
5. [Masochist](

[To see links please register here]

) - framework for creating XNU based rootkits
6. [Class-dump](

[To see links please register here]

) - command-line utility to dump Objective-C runtime information
7. [Mach inject](

[To see links please register here]

) - Inter process code injection for Mac OS X
8. [Task vaccine](

[To see links please register here]

) - similar to mach inject
8. [Hopper](

[To see links please register here]

) - Hopper disassembler (not free)
9. [Mach-O diff](

[To see links please register here]

) - mach-o diffing tool
10. [Mac4n6](

[To see links please register here]

) - A collection of OS X and iOS forensic artifacts
11. [XGuardian scanner](

[To see links please register here]

) - Security Scanner for OSX
12. [Crashwalk](

[To see links please register here]

)
13. [PassiveFuzzFrameworks](

[To see links please register here]

)
ONLINE ANALYZERS

1. [AndroTotal](

[To see links please register here]

)
* [Dexter](

[To see links please register here]

)
* [Tracedroid](

[To see links please register here]

)
* [Visual Threat](

[To see links please register here]

)
* [Mobile Malware Sandbox](

[To see links please register here]

)
* [MobiSec Eacus](

[To see links please register here]

)
* [IBM Security AppScan Mobile Analyzer](

[To see links please register here]

) - not free
* [NVISO ApkScan](

[To see links please register here]

)
* [AVC UnDroid](

[To see links please register here]

)
* [Fireeye](

[To see links please register here]

max 60MB 15/day
* [habo](

[To see links please register here]

) 10/day
* [Virustotal](

[To see links please register here]

128MB
* [Fraunhofer App-ray](

[To see links please register here]

) - not free
* [AppCritique](

[To see links please register here]

) - Upload your Android APKs and receive comprehensive free security assessments.
* ~~[CopperDroid](

[To see links please register here]

* ~~[SandDroid](

[To see links please register here]

* ~~[Stowaway](

[To see links please register here]

* ~~[Anubis](

[To see links please register here]

* ~~[Mobile app insight](

[To see links please register here]

* ~~[Mobile-Sandbox](

[To see links please register here]

* ~~[Ijiami](

[To see links please register here]

* ~~[Comdroid](

[To see links please register here]

* ~~[Android Sandbox](

[To see links please register here]

* ~~[Foresafe](

[To see links please register here]

STATIC ANALYSIS TOOLS

1. [Androwarn](

[To see links please register here]

) - detect and warn the user about potential malicious behaviours developped by an Android application.
* [ApkAnalyser](

[To see links please register here]

)
* [APKInspector](

[To see links please register here]

)
* [Droid Intent Data Flow Analysis for Information Leakage](

[To see links please register here]

)
* [DroidLegacy](

[To see links please register here]

)
* [Several tools from PSU](

[To see links please register here]

)
* [Smali CFG generator](

[To see links please register here]

)
* [FlowDroid](

[To see links please register here]

)
* [Android Decompiler](

[To see links please register here]

) – not free
* [PSCout](

[To see links please register here]

) - A tool that extracts the permission specification from the Android OS source code using static analysis
* [Amandroid](

[To see links please register here]

)
* [SmaliSCA](

[To see links please register here]

) - Smali Static Code Analysis
* [CFGScanDroid](

[To see links please register here]

) - Scans and compares CFG against CFG of malicious applications
* [Madrolyzer](

[To see links please register here]

) - extracts actionable data like C&C, phone number etc.
* [SPARTA](

[To see links please register here]

) - verifies (proves) that an app satisfies an information-flow security policy; built on the [Checker Framework](

[To see links please register here]

)
* [ConDroid](

[To see links please register here]

) - Performs a combination of symoblic + concrete execution of the app


APP VULNERABILITY SCANNERS

1. [QARK](

[To see links please register here]

) - QARK by LinkedIn is for app developers to scan app for security issues
2. [AndroBugs](

[To see links please register here]

)
3. [Nogotofail](

[To see links please register here]

)


DYNAMIC ANALYSIS TOOLS

1. [Android DBI frameowork](

[To see links please register here]

)
2. [Androl4b](

[To see links please register here]

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis
* [Adroid Malware Analysis Toolkit](

[To see links please register here]

) - (linux distro) Earlier it use to be an [online analyzer](

[To see links please register here]

)
* [Mobile-Security-Framework MobSF](

[To see links please register here]

) - Mobile Security Framework is an intelligent, all-in-one open source mobile application (Android/iOS) automated pen-testing framework capable of performing static, dynamic analysis and web API testing.
* [AppUse](

[To see links please register here]

) – custom build for pentesting
* [Cobradroid](

[To see links please register here]

) – custom image for malware analysis
* [ViaLab Community Edition](

[To see links please register here]

)
* [Droidbox](

[To see links please register here]

)
* [Mercury](

[To see links please register here]

)
* [Drozer](

[To see links please register here]

)
* [Xposed](

[To see links please register here]

) - equivalent of doing Stub based code injection but without any modifications to the binary
* [Android Hooker](

[To see links please register here]

) - Dynamic Java code instrumentation (requires the Substrate Framework)
* [ProbeDroid](

[To see links please register here]

) - Dynamic Java code instrumentation
* [Android Tamer](

[To see links please register here]

) - Virtual / Live Platform for Android Security Professionals
* [DECAF](

[To see links please register here]

) - Dynamic Executable Code Analysis Framework based on QEMU (DroidScope is now an extension to DECAF)
* [CuckooDroid](

[To see links please register here]

) - Android extension for Cuckoo sandbox
* [Mem](

[To see links please register here]

) - Memory analysis of Android (root required)
* [Crowdroid]( ) – unable to find the actual tool
* [AuditdAndroid](

[To see links please register here]

) – android port of auditd, not under active development anymore
* [Android Security Evaluation Framework](

[To see links please register here]

) - not under active development anymore
* [Android Reverse Engineering](

[To see links please register here]

) – ARE (android reverse engineering) not under active development anymore
* [Aurasium](

[To see links please register here]

) – Practical security policy enforcement for Android apps via bytecode rewriting and in-place reference monitor.
* [Android Linux Kernel modules](

[To see links please register here]

)
* [Appie](

[To see links please register here]

) - Appie is a software package that has been pre-configured to function as an Android Pentesting Environment.It is completely portable and can be carried on USB stick or smartphone.This is a one stop answer for all the tools needed in Android Application Security Assessment and an awesome alternative to existing virtual machines.
* [StaDynA](

[To see links please register here]

) - a system supporting security app analysis in the presence of dynamic code update features (dynamic class loading and reflection). This tool combines static and dynamic analysis of Android applications in order to reveal the hidden/updated behavior and extend static analysis results with this information.
* [DroidAnalytics](

[To see links please register here]

) - incomplete
* [Vezir Project](

[To see links please register here]

) - Virtual Machine for Mobile Application Pentesting and Mobile Malware Analysis
* [MARA](

[To see links please register here]

) - Mobile Application Reverse engineering and Analysis Framework
* [NowSecure Lab Automated](

[To see links please register here]

) - Enterprise tool for mobile app security testing both Android and iOS mobile apps. Lab Automated features dynamic and static analysis on real devices in the cloud to return results in minutes.
* ~~[Taintdroid](

[To see links please register here]

- requires AOSP compilation

REVERSE ENGINEERING

1. [Smali/Baksmali](

[To see links please register here]

) – apk decompilation
* [emacs syntax coloring for smali files](

[To see links please register here]

)
* [vim syntax coloring for smali files](

[To see links please register here]

)
* [AndBug](

[To see links please register here]

)
* [Androguard](

[To see links please register here]

) – powerful, integrates well with other tools
* [Apktool](

[To see links please register here]

) – really useful for compilation/decompilation (uses smali)
* [Android Framework for Exploitation](

[To see links please register here]

)
* [Bypass signature and permission checks for IPCs](

[To see links please register here]

)
* [Android OpenDebug](

[To see links please register here]

) – make any application on device debuggable (using cydia substrate).
* [Dare](

[To see links please register here]

) – .dex to .class converter
* [Dex2Jar](

[To see links please register here]

) - dex to jar converter
* [Enjarify](

[To see links please register here]

) - dex to jar converter from Google
* [Dedexer](

[To see links please register here]

)
* [Fino](

[To see links please register here]

)
* [Frida](

[To see links please register here]

) - inject javascript to explore applications and a [GUI tool](

[To see links please register here]

) for it
* [Indroid](

[To see links please register here]

) – thread injection kit
* [IntentSniffer](

[To see links please register here]

)
* [Introspy](

[To see links please register here]

)
* [Jad](

[To see links please register here]

) - Java decompiler
* [JD-GUI](

[To see links please register here]

) - Java decompiler
* [CFR](

[To see links please register here]

) - Java decompiler
* [Krakatau](

[To see links please register here]

) - Java decompiler
* [Procyon](

[To see links please register here]

) - Java decompiler
* [FernFlower](

[To see links please register here]

) - Java decompiler
* [Redexer](

[To see links please register here]

) – apk manipulation
* [Smali viewer](

[To see links please register here]

)
* ~~[ZjDroid](

[To see links please register here]

,

[To see links please register here]

* [Simplify Android deobfuscator](

[To see links please register here]

)
* [Bytecode viewer](

[To see links please register here]

)
* [Radare2](

[To see links please register here]

)

FUZZ TESTING

1. [IntentFuzzer](

[To see links please register here]

)
* [Radamsa Fuzzer](

[To see links please register here]

)
* [Honggfuzz](

[To see links please register here]

)
* [An Android port of the melkor ELF fuzzer](

[To see links please register here]

)
* [Media Fuzzing Framework for Android](

[To see links please register here]

)
* [AndroFuzz](

[To see links please register here]

)
APP REPACKAGING DETECTORS

1. [FSquaDRA](

[To see links please register here]

) - a tool for detection of repackaged Android applications based on app resources hash comparison.

READING MATERIAL

1. [Android Security (and Not) Internals](

[To see links please register here]

)
* [Android security related presentations](

[To see links please register here]

)
* [A good collection of static analysis papers](

[To see links please register here]

)

MISC TOOLS

1. [smalihook](

[To see links please register here]

)
* [APK-Downloader](

[To see links please register here]

)
* [AXMLPrinter2](

[To see links please register here]

) - to convert binary XML files to human-readable XML files
* [adb autocomplete](

[To see links please register here]

)
* [Dalvik opcodes](

[To see links please register here]

)
* [Opcodes table for quick reference]( )
* [ExploitMe Android Labs](

[To see links please register here]

) - for practice
* [GoatDroid](

[To see links please register here]

) - for practice
* [mitmproxy](

[To see links please register here]

)
* [dockerfile/androguard](

[To see links please register here]

)
* [Android Vulnerability Test Suite](

[To see links please register here]

) - android-vts scans a device for set of vulnerabilities

TUTORIALS

1. [Android Reverse Engineering 101 by Daniele Altomare](

[To see links please register here]

)

PHP SHELLS:

[To see links please register here]

Wow, this is an awesome thread! I try out pentesting once and a while so this should help me a bunch. I'm sure it took you a while to write all of this. Thanks for sharing all of these resources.

Can I say wow here? There is a lot of good resources on this thread.

amazing thread, thanks you

OMG bro very nice post thanks for sharing!!!!!!