Blogs Worth It:
What the title says. There are a LOT of pentesting blogs, these are the ones i monitor constantly and value in the actual day to day testing work.

Forums:

Created for forums that will help in both tool usage, syntax, attack techniques, and collection of scripts and tools. Needs some help. I don't really frequent too many underground forums but i actually find nice one-off scripts and info i can roll into my own code in these places. Would like to add more.

Magazines:

Video:

Methodologies:

OSINT

Presentations:

People and Organizational:

Infrastructure:

Exploits and Advisories:

Cheatsheets and Syntax:

Agile Hacking:

OS and Scripts:

Tools:

Distros:

Labs:

ISOs and VMs:

Vulnerable Software:

Test Sites:

Exploitation Intro:

If you'd like to get into exploit dev, these are really the guides and docs that will start you off in the right direction. Since Exploit dev is not my primary occupation this section could always use help.

Reverse Engineering & Malware:

Passwords and Hashes:

Wordlists:

http://contest.korelogic.com/wordlists.html

http://packetstormsecurity.org/Crackers/wordlists/

http://www.skullsecurity.org/wiki/index.php/Passwords

http://www.ericheitzman.com/passwd/passwords/

Pass the Hash:

http://www.sans.org/reading_room/whitepapers/testing/pass-the-hash-attacks-tools-mitigation_33283

http://www.sans.org/reading_room/whitepapers/testing/crack-pass-hash_33219

http://carnal0wnage.blogspot.com/2008/03/using-pash-hash-toolkit.html

MiTM:

Tools:

OSINT:

http://www.edge-security.com/theHarvester.php

http://www.mavetju.org/unix/dnstracer-man.php

http://www.paterva.com/web5/

Metadata:

http://www.sans.org/reading_room/whitepapers/privacy/document-metadata-silent-killer_32974

http://lcamtuf.coredump.cx/strikeout/

http://www.sno.phy.queensu.ca/~phil/exiftool/

http://www.edge-security.com/metagoofil.php

http://www.darkoperator.com/blog/2009/4/24/metadata-enumeration-with-foca.html

Google Hacking:

http://www.stachliu.com/index.php/resources/tools/google-hacking-diggity-project/

http://midnightresearch.com/projects/search-engine-assessment-tool/#downloads

http://sqid.rubyforge.org/#next

http://voidnetwork.org/5ynL0rd/darkc0de/python_script/dorkScan.html

Web:

http://www.bindshell.net/tools/beef

http://blindelephant.sourceforge.net/

http://xsser.sourceforge.net/

http://sourceforge.net/projects/rips-scanner/

http://www.divineinvasion.net/authforce/

http://andlabs.org/tools.html#sotf

http://www.taddong.com/docs/Browser_Exploitation_for_Fun&Profit_Taddong-RaulSiles_Nov2010_v1.1.pdf

http://carnal0wnage.blogspot.com/2007/07/using-sqid-sql-injection-digger-to-look.html

http://code.google.com/p/pinata-csrf-tool/

http://xsser.sourceforge.net/#intro

http://www.contextis.co.uk/resources/tools/clickjacking-tool/

http://packetstormsecurity.org/files/view/69896/unicode-fun.txt

http://sourceforge.net/projects/ws-attacker/files/

https://github.com/koto/squid-imposter

本文转hackfreer51CTO博客，原文链接：http://blog.51cto.com/pnig0s1992/586384 ，如需转载请自行联系原作者

pentest-bookmarks

Blogs Worth It:

Forums:

Magazines:

Video:

Methodologies:

OSINT

Presentations:

People and Organizational:

Infrastructure:

Exploits and Advisories:

Cheatsheets and Syntax:

Agile Hacking:

OS and Scripts:

Tools:

Distros:

Labs:

ISOs and VMs:

Vulnerable Software:

Test Sites:

Exploitation Intro:

Reverse Engineering & Malware:

Passwords and Hashes:

Wordlists:

Pass the Hash:

MiTM:

Tools:

OSINT:

Metadata:

Google Hacking:

Web:

热门文章

最新文章

相关电子书