Vulnerability analysis

32 herramientas

afl++web

Coverage-guided fuzzer for binaries and libraries when you want crashes from mutated inputs in a lab harness.
bedweb

Protocol fuzzer that throws malformed data at network services you have permission to stress.
cisco-auditing-toolweb

Checks Cisco devices for default communities and known weak SNMP or telnet setups in scope.
cisco-global-exploiterweb

Runs a short list of known Cisco issues against devices you are authorized to validate.
cisco-ocsweb

Mass-scans Cisco gear for common service exposure when the engagement allows network sweeps.
cisco-torch

Fingerprints and probes Cisco services across many hosts for authorized inventory work.
copy-router-configweb

Pulls Cisco running configs over SNMP when community strings and scope allow it.
dhcpigweb

Exhausts DHCP pools with scapy to demonstrate denial-of-service on networks you own.
enumiaxweb

Enumerates Inter-Asterisk eXchange users on VoIP systems inside scope.
gvmweb

Greenbone Vulnerability Management metapackage: scanners and helpers for authorized VA work.
iaxfloodweb

Floods IAX VoIP with traffic to test how a lab PBX behaves under abuse.
invitefloodweb

Floods SIP INVITE messages over UDP to stress call setup on systems in scope.

legionweb

Semi-automated network assessment UI that wraps common scanners; verify every finding by hand.

ayuda

usage: legion.py [-h] [--mcp-server] [--headless] [--web] [--tool-audit |
                 --tool-install-plan {kali,ubuntu} |
                 --tool-install {kali,ubuntu}] [--web-port WEB_PORT]
                 [--web-bind-all] [--web-transparent-ui]
                 [--input-file INPUT_FILE] [--discovery] [--staged-scan]
                 [--output-file OUTPUT_FILE] [--run-actions]

Start Legion

options:
  -h, --help            show this help message and exit
  --mcp-server          Start MCP server for AI integration
  --headless            Run Legion in headless (CLI) mode
  --web                 Run Legion with the local Flask web interface
  --tool-audit          Print a tool availability audit and exit
  --tool-install-plan {kali,ubuntu}
                        Print the generated install script for missing tools
                        on the selected platform and exit
  --tool-install {kali,ubuntu}
                        Run the generated install plan for missing tools on
                        the selected platform and exit
  --web-port WEB_PORT   Local web interface port
  --web-bind-all        When used with --web, bind the web interface to
                        0.0.0.0 instead of 127.0.0.1
  --web-transparent-ui  When used with --web, enable transparent UI effects
  --input-file INPUT_FILE
                        Text file with targets (hostnames, subnets, IPs, etc.)
  --discovery           Enable host discovery (default: enabled)
  --staged-scan         Enable staged scan
  --output-file OUTPUT_FILE
                        Output file (.legion or .json)
  --run-actions         Run scripted actions/automated attacks after
                        scan/import

lynisweb

Host auditing script that suggests hardening improvements on systems you own.
ohrwurmweb

RTP fuzzer for finding parser bugs in VoIP media stacks you are paid to break.

peasslinpeasweb

Privilege-escalation enumeration suite packaging linpeas/winpeas style checks for Linux and Windows lab hosts.

ayuda

> peass ~ Privilege Escalation Awesome Scripts SUITE

/usr/share/peass/linpeas
├── linpeas_darwin_amd64
├── linpeas_darwin_arm64
├── linpeas_fat.sh
├── linpeas_linux_386
├── linpeas_linux_amd64
├── linpeas_linux_arm
├── linpeas_linux_arm64
├── linpeas.sh
└── linpeas_small.sh
=

protos-sipweb

Academic-style SIP test suite that throws protocol violations at a PBX under test.
rtpbreakweb

Detects and reconstructs RTP sessions from captures for call analysis.
rtpfloodweb

Floods RTP toward a device to test media-path resilience in a VoIP lab.
rtpinsertsoundweb

Inserts audio into a chosen RTP stream when demonstrating media injection risks.
rtpmixsoundweb

Mixes pre-recorded audio into a live RTP stream for the same class of demos.
sctpscanweb

Scans SCTP for discovery and basic security checks on stacks that speak that transport.
sfuzzweb

Black-box fuzzer utilities for throwing mutated inputs at network or file parsers you are testing.
siparmyknifeweb

SIP fuzzer/toolkit for throwing odd messages at softphones and proxies in scope.
sippweb

SIP traffic generator for load and scenario testing against a PBX you control.
sipsakweb

SIP Swiss-army knife for one-off OPTIONS, REGISTER, and similar probes.

sipvicioussvcrackweb

Audits SIP-based VoIP systems: enumeration, options probing, and password guessing in a lab PBX.

ayuda

Usage: svcrack -u username [options] target
examples:
svcrack -u100 -d dictionary.txt udp://10.0.0.1:5080
svcrack -u100 -r1-9999 -z4 10.0.0.1

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -p PORT, --port=PORT  Destination port of the SIP device - eg -p 5060
  -v, --verbose         Increase verbosity
  -q, --quiet           Quiet mode
  -P PORT, --localport=PORT
                        Source port for our packets
  -x IP, --externalip=IP
                        IP Address to use as the external ip. Specify this if
                        you have multiple interfaces or if you are behind NAT
  -b BINDINGIP, --bindingip=BINDINGIP
                        By default we bind to all interfaces. This option
                        overrides that and binds to the specified ip address
  -t SELECTTIME, --timeout=SELECTTIME
                        This option allows you to trottle the speed at which
                        packets are sent. Change this if you're losing
                        packets. For example try 0.5.
  -R, --reportback      Send the author an exception traceback. Currently
                        sends the command line parameters and the traceback
  -A, --autogetip       Automatically get the current IP address. This is
                        useful when you are not getting any responses back due
                        to SIPVicious not resolving your local IP.
  -s NAME, --save=NAME  save the session. Has the benefit of allowing you to
                        resume a previous scan and allows you to export scans
  --resume=NAME         resume a previous scan
  -c, --enablecompact   enable compact mode. Makes packets smaller but
                        possibly less compatible
  -u USERNAME, --username=USERNAME
                        username to try crack
  -d DICTIONARY, --dictionary=DICTIONARY
                        specify a dictionary file with passwords or - for
                        stdin
  -r RANGE, --range=RANGE
                        specify a range of numbers. example:
                        100-200,300-310,400
  -e EXTENSION, --extension=EXTENSION
                        Extension to crack. Only specify this when the
                        extension is different from the username.
  -z PADDING, --zeropadding=PADDING
… (26 more lines — see the tool's home page)

spikecitrixweb

Classic network protocol fuzzer for building scripted mutations against listeners in a lab.
ayuda
```
Usage: ./citrix target port
./citrix 192.168.1.101 1494
```
t50web

Multi-protocol packet injector for stress and odd-packet tests on lab network gear.

unix-privesc-checkweb

Enumerates common local privilege-escalation misconfigurations on Unix labs.

ayuda

unix-privesc-check v1.4 ( http://pentestmonkey.net/tools/unix-privesc-check )

Usage: unix-privesc-check { standard | detailed }

"standard" mode: Speed-optimised check of lots of security settings.

"detailed" mode: Same as standard mode, but also checks perms of open file
                 handles and called files (e.g. parsed from shell scripts,
                 linked .so files).  This mode is slow and prone to false
                 positives but might help you find more subtle flaws in 3rd
                 party programs.

This script checks file permissions and other settings that could allow
local users to escalate privileges.

Use of this script is only permitted on systems which you have been granted
legal permission to perform a security assessment of.  Apart from this
condition the GPL v2 applies.

Search the output for the word 'WARNING'.  If you don't see it then this
script didn't find any problems.

voiphopperweb

Tests VLAN hopping behaviors relevant to VoIP phone deployments on switched labs.

ayuda

VoIP Hopper Extended Usage:

Miscellaneous Options:
	-l (list available interfaces for CDP sniffing, then exit)
	Example:  voiphopper -l
	-m (Spoof the MAC Address, then exit)
	Example:  voiphopper -i eth0 -m 00:07:0E:EA:50:86
	-d (Delete the VLAN Interface, then exit)
	Example:  voiphopper -d eth0.200
	-V (Print the VoIP Hopper version, then exit)
	Example:  voiphopper -V

MAC Address Spoofing Options (used with -a, -v, or -c options):
	-m (Spoof the MAC Address of existing interface, and new Interface)
	-D -m (Spoof the MAC Address of only new Voice Interface)
	Example:  voiphopper -i eth0 -m 00:07:0E:EA:50:86
	Example:  voiphopper -i eth0 -D -m 00:07:0E:EA:50:86

CDP Sniff Mode (-c 0)
	Example:  voiphopper -i eth0 -c 0

CDP Spoof Mode (-c 1):
	-E <string> (Device ID)
	-P <string> (Port ID)
	-C <string> (Capabilities)
	-L <string> (Platform)
	-S <string> (Software)
	-U <string> (Duplex)

Example Usage for SIP Firmware Phone:
voiphopper -i eth0 -c 1 -E 'SIP00070EEA5086' -P 'Port 1' -C Host -L 'Cisco IP Phone 7940' -S 'P003-08-8-00' -U 1

Example Usage for SCCP Firmware Phone:
voiphopper -i eth0 -c 1 -E 'SEP0070EEA5086' -P 'Port 1' -C Host -L 'Cisco IP Phone 7940' -S 'P00308000700' -U 1

Example Usage for Phone with MAC Spoofing:
voiphopper -i eth0 -m 00:07:0E:EA:50:86 -c 1 -E 'SEP00070EEA5086' -P 'Port 1' -C Host -L 'Cisco IP Phone 7940' -S 'P003-08-8-00' -U 1

Avaya DHCP Option Mode (-a):
	Example:  voiphopper -i eth0 -a
	Example:  voiphopper -i eth0 -a -m 00:07:0E:EA:50:86

VLAN Hop Mode (-v VLAN ID):
	Example:  voiphopper -i eth0 -v 200
	Example:  voiphopper -i eth0 -v 200 -D -m 00:07:0E:EA:50:86
… (8 more lines — see the tool's home page)

yersiniaweb

Layer-2 protocol attack suite (STP, DHCP, and friends) for switch labs you own.

Cuando hay un propósito escrito para esta ruta, se muestra primero. Si no, ves el resumen del paquete. La ayuda se captura en vivo desde un Kali cuando está disponible.