random-dude6969/kali-linux-all-tools-tutorial

## 目录 - [这个项目是什么](#what-is-this-project) - [精选工具](#featured-tools) - [完整阶段概览](#complete-phase-overview) - [所有已记录工具](#all-documented-tools) - [学习路径](#learning-path) - [OSCP 认证指南](#oscp-certification-guide) - [CTF 比赛工具](#ctf-competition-tools) - [漏洞赏金工具包](#bug-bounty-toolkit) - [Web 应用安全](#web-application-security) - [密码破解指南](#password-cracking-guide) - [逆向工程工具](#reverse-engineering-tools) - [文档结构说明](#how-documentation-is-structured) - [适用人群](#who-uses-this) - [贡献指南](#contributing) - [许可证](#license) ## 这个项目是什么 本仓库包含了 **302 款 Kali Linux 渗透测试工具**的文档。每款工具均包含： - 针对APT、源码和 Docker 的**安装指南** - 解释每个 flag 的**命令参考** - 适用于安全审计、CTF 和漏洞赏金的**实战场景** - 供蓝队防守人员参考的**检测与防御**章节 - 供快速查阅的**备忘单** 本文档遵循 **MITRE ATT&CK 框架** —— 这与全球安全专业人士使用的框架相同。 ### 为什么这很重要 | 其他资源 | 本仓库 | |-----------------|-----------------| | 工具下载链接 | 完整的文档说明 | | 基础用法 | 高级技巧 | | 没有示例 | 实战场景 | | 没有防御信息 | 蓝队章节 | | 零散分布在各网站 | 统一整理的合集 | ## 精选工具 最受欢迎的渗透测试工具，附带完整文档的直接链接： ### 网络扫描与枚举 | 工具 | 行数 | 描述 | |------|-------|-------------| | **[Nmap](01_reconnaissance/03_network_information/nmap/nmap.md)** | 1,048 | 端口扫描、服务检测、操作系统指纹识别 | | **[Masscan](09_discovery/network_service_discovery/masscan/masscan.md)** | 340 | 最快的端口扫描器 | | **[Amass](01_reconnaissance/03_network_information/amass/amass.md)** | 2,121 | 攻击面映射 | | **[Autorecon](01_reconnaissance/03_network_information/autorecon/autorecon.md)** | 3,631 | 自动化网络侦察 | ### Web 应用测试 | 工具 | 行数 | 描述 | |------|-------|-------------| | **[Burp Suite](01_reconnaissance/07_web_vulnerability_scanning/burpsuite/burpsuite.md)** | 1,079 | Web 应用安全测试 | | **[SQLMap](03_initial_access/sqlmap/sqlmap.md)** | 891 | 自动化 SQL 注入 | | **[Gobuster](01_reconnaissance/05_web_scanning/gobuster/gobuster.md)** | 1,182 | 目录暴力破解 | | **[Nuclei](01_reconnaissance/07_web_vulnerability_scanning/nuclei/nuclei.md)** | 1,249 | 基于模板的漏洞扫描器 | | **[FFuf](01_reconnaissance/05_web_scanning/ffuf/ffuf.md)** | 1,143 | 快速 Web 模糊测试 | ### 漏洞利用框架 | 工具 | 行数 | 描述 | |------|-------|-------------| | **[Metasploit](03_initial_access/metasploit-framework/metasploit-framework.md)** | 632 | 渗透测试框架 | | **[MSFvenom](02_resource_development/shellcode_payload/msfvenom/msfvenom.md)** | 907 | payload 生成 | | **[SearchSploit](02_resource_development/exploit_resources/searchsploit/searchsploit.md)** | 442 | 漏洞利用数据库搜索 | ### 密码攻击 | 工具 | 行数 | 描述 | |------|-------|-------------| | **[Hashcat](08_credential_access/password_cracking/hashcat/hashcat.md)** | 800+ | GPU 加速哈希破解 | | **[John the Ripper](08_credential_access/password_cracking/john/john.md)** | 700+ | 多功能密码破解器 | | **[Hydra](08_credential_access/brute_force/hydra/hydra.md)** | 600+ | 在线暴力破解攻击 | | **[Responder](08_credential_access/credential_harvesting/responder/responder.md)** | 600+ | 网络凭证收集 | ### 后渗透 | 工具 | 行数 | 描述 | |------|-------|-------------| | **[Mimikatz](07_defense_evasion/pass_the_hash/mimikatz/mimikatz.md)** | 564 | Windows 凭证提取 | | **[LinPEAS](06_privilege_escalation/linpeas/linpeas.md)** | 574 | Linux 提权 | | **[BloodHound](09_discovery/active_directory/bloodhound/bloodhound.md)** | 700+ | Active Directory 攻击路径分析 | | **[Impacket](07_defense_evasion/pass_the_hash/impacket-scripts/impacket-scripts.md)** | 837 | 网络协议漏洞利用 | ### 逆向工程 | 工具 | 行数 | 描述 | |------|-------|-------------| | **[Ghidra](02_resource_development/disassemblers_debuggers/ghidra/ghidra.md)** | 675 | NSA 逆向工程套件 | | **[GDB](02_resource_development/disassemblers_debuggers/gdb/gdb.md)** | 816 | GNU 调试器 | | **[Radare2](02_resource_development/disassemblers_debuggers/radare2/radare2.md)** | 534 | 逆向工程框架 | ## 完整阶段概览 本文档遵循 MITRE ATT&CK 框架 —— 包含网络攻击的 16 个阶段： | 阶段 | 名称 | 工具数 | 状态 | 核心工具 | |-------|------|-------|--------|-----------| | 01 | [侦察](01_reconnaissance/) | 80 | 完成 | Nmap, Gobuster, Burp Suite, Nuclei | | 02 | [资源开发](02_resource_development/) | 34 | 完成 | Ghidra, MSFvenom, AFL, Radare2 | | 03 | [初始访问](03_initial_access/) | 10 | 完成 | SQLMap, Metasploit, GoPhish | | 04 | [执行](04_execution/) | 6 | 完成 | BeEF, XSSer, PowerSploit | | 05 | [持久化](05_persistence/) | 7 | 完成 | Weevely, Laudanum, PHPGGC | | 06 | [权限提升](06_privilege_escalation/) | 6 | 完成 | LinPEAS, WinPEAS, Lynis | | 07 | [防御绕过](07_defense_evasion/) | 16 | 完成 | Mimikatz, Impacket, Veil | | 08 | [凭证获取](08_credential_access/) | 52 | 完成 | Hydra, John, Hashcat, Responder | | 09 | [发现](09_discovery/) | 88 | 完成 | Wireshark, BloodHound, Ettercap | | 10 | [横向移动](10_lateral_movement/) | 3 | **已完成** | PsExec, SMBExec, RDesktop | | 11 | 收集 | 12 | 待推出 | 键盘记录器、屏幕捕获 | | 12 | 命令与控制 | 30 | 待推出 | C2 框架 | | 13 | 数据渗出 | 3 | 待推出 | 数据提取工具 | | 14 | 影响 | 10 | 待推出 | DDoS、破坏性工具 | | 15 | 取证 | 51 | 待推出 | Volatility, Autopsy | | 16 | 服务 | 15 | 待推出 | 网络服务 | ## 所有已记录工具 本仓库中的每款工具均附带直接链接。点击任意工具即可查看其完整文档。

阶段 01 — 侦察（80 款工具）

### 主机信息 | 工具 | 行数 | 链接 | |------|-------|------| | Metagoofil | 2,076 | [文档](01_reconnaissance/01_host_information/metagoofil/metagoofil.md) | | SpiderFoot | 629 | [文档](01_reconnaissance/01_host_information/spiderfoot/spiderfoot.md) | ### 身份信息 | 工具 | 行数 | 链接 | |------|-------|------| | EmailHarvester | 1,893 | [文档](01_reconnaissance/02_identity_information/emailharvester/emailharvester.md) | | Instaloader | 1,795 | [文档](01_reconnaissance/02_identity_information/instaloader/instaloader.md) | | Sherlock | 613 | [文档](01_reconnaissance/02_identity_information/sherlock/sherlock.md) | | Photon | 510 | [文档](01_reconnaissance/02_identity_information/photon/photon.md) | | Tookie-OSINT | 546 | [文档](01_reconnaissance/02_identity_information/tookie-osint/tookie-osint.md) | | LinkedIn2Username | 501 | [文档](01_reconnaissance/02_identity_information/linkedin2username/linkedin2username.md) | ### 网络信息 | 工具 | 行数 | 链接 | |------|-------|------| | Autorecon | 3,632 | [文档](01_reconnaissance/03_network_information/autorecon/autorecon.md) | | Amass | 2,121 | [文档](01_reconnaissance/03_network_information/amass/amass.md) | | Nmap | 1,048 | [文档](01_reconnaissance/03_network_information/nmap/nmap.md) | | TheHarvester | 886 | [文档](01_reconnaissance/03_network_information/theharvester/theharvester.md) | | Unicornscan | 802 | [文档](01_reconnaissance/03_network_information/unicornscan/unicornscan.md) | | Zenmap | 598 | [文档](01_reconnaissance/03_network_information/zenmap/zenmap.md) | | Dmitry | 535 | [文档](01_reconnaissance/03_network_information/dmitry/dmitry.md) | | Legion | 523 | [文档](01_reconnaissance/03_network_information/legion/legion.md) | ### DNS 侦察 | 工具 | 行数 | 链接 | |------|-------|------| | DNSRecon | 1,282 | [文档](01_reconnaissance/04_dns_reconnaissance/dnsrecon/dnsrecon.md) | | DNSEnum | 1,241 | [文档](01_reconnaissance/04_dns_reconnaissance/dnsenum/dnsenum.md) | | DNSMap | 1,059 | [文档](01_reconnaissance/04_dns_reconnaissance/dnsmap/dnsmap.md) | | MassDNS | 1,136 | [文档](01_reconnaissance/04_dns_reconnaissance/massdns/massdns.md) | | DNSWalk | 1,185 | [文档](01_reconnaissance/04_dns_reconnaissance/dnswalk/dnswalk.md) | | DNSTracer | 1,028 | [文档](01_reconnaissance/04_dns_reconnaissance/dnstracer/dnstracer.md) | ### Web 扫描 | 工具 | 行数 | 链接 | |------|-------|------| | Gobuster | 1,182 | [文档](01_reconnaissance/05_web_scanning/gobuster/gobuster.md) | | FFuf | 1,143 | [文档](01_reconnaissance/05_web_scanning/ffuf/ffuf.md) | | Feroxbuster | 1,128 | [文档](01_reconnaissance/05_web_scanning/feroxbuster/feroxbuster.md) | | Subfinder | 1,122 | [文档](01_reconnaissance/05_web_scanning/subfinder/subfinder.md) | | GoSpider | 1,065 | [文档](01_reconnaissance/05_web_scanning/gospider/gospider.md) | | FinalRecon | 1,033 | [文档](01_reconnaissance/05_web_scanning/finalrecon/finalrecon.md) | | LBD | 1,014 | [文档](01_reconnaissance/05_web_scanning/lbd/lbd.md) | | Findomain | 1,008 | [文档](01_reconnaissance/05_web_scanning/findomain/findomain.md) | | Recon-ng | 988 | [文档](01_reconnaissance/05_web_scanning/recon-ng/recon-ng.md) | | Arjun | 944 | [文档](01_reconnaissance/05_web_scanning/arjun/arjun.md) | | Wfuzz | 910 | [文档](01_reconnaissance/05_web_scanning/wfuzz/wfuzz.md) | | Sublist3r | 902 | [文档](01_reconnaissance/05_web_scanning/sublist3r/sublist3r.md) | | DirSearch | 842 | [文档](01_reconnaissance/05_web_scanning/dirsearch/dirsearch.md) | | Dirb | 783 | [文档](01_reconnaissance/05_web_scanning/dirb/dirb.md) | | Assetfinder | 758 | [文档](01_reconnaissance/05_web_scanning/assetfinder/assetfinder.md) | | WPProbe | 751 | [文档](01_reconnaissance/05_web_scanning/wpprobe/wpprobe.md) | | Parsero | 746 | [文档](01_reconnaissance/05_web_scanning/parsero/parsero.md) | | URLCrazy | 642 | [文档](01_reconnaissance/05_web_scanning/urlcrazy/urlcrazy.md) | | DirBuster | 616 | [文档](01_reconnaissance/05_web_scanning/dirbuster/dirbuster.md) | | Uro | 526 | [文档](01_reconnaissance/05_web_scanning/uro/uro.md) | ### 漏洞扫描 | 工具 | 行数 | 链接 | |------|-------|------| | Heartleech | 819 | [文档](01_reconnaissance/06_vulnerability_scanning/heartleech/heartleech.md) | GVM | 519 | [文档](01_reconnaissance/06_vulnerability_scanning/gvm/gvm.md) | ### Web 漏洞扫描 | 工具 | 行数 | 链接 | |------|-------|------| | Nuclei | 1,249 | [文档](01_reconnaissance/07_web_vulnerability_scanning/nuclei/nuclei.md) | | Nikto | 1,169 | [文档](01_reconnaissance/07_web_vulnerability_scanning/nikto/nikto.md) | | DavTest | 1,148 | [文档](01_reconnaissance/07_web_vulnerability_scanning/davtest/davtest.md) | | JoomScan | 1,114 | [文档](01_reconnaissance/07_web_vulnerability_scanning/joomscan/joomscan.md) | | Burp Suite | 1,079 | [文档](01_reconnaissance/07_web_vulnerability_scanning/burpsuite/burpsuite.md) | | Caido | 1,079 | [文档](01_reconnaissance/07_web_vulnerability_scanning/caido/caido.md) | | CRLFuzz | 1,045 | [文档](01_reconnaissance/07_web_vulnerability_scanning/crlfuzz/crlfuzz.md) | | WPScan | 1,011 | [文档](01_reconnaissance/07_web_vulnerability_scanning/wpscan/wpscan.md) | | Skipfish | 879 | [文档](01_reconnaissance/07_web_vulnerability_scanning/skipfish/skipfish.md) | | Wapiti | 840 | [文档](01_reconnaissance/07_web_vulnerability_scanning/wapiti/wapiti.md) | | SSTImap | 823 | [文档](01_reconnaissance/07_web_vulnerability_scanning/sstimap/sstimap.md) | | Tinja | 822 | [文档](01_reconnaissance/07_web_vulnerability_scanning/tinja/tinja.md) | | Subjack | 813 | [文档](01_reconnaissance/07_web_vulnerability_scanning/subjack/subjack.md) | | WhatWeb | 772 | [文档](01_reconnaissance/07_web_vulnerability_scanning/whatweb/whatweb.md) | | Paros | 706 | [文档](01_reconnaissance/07_web_vulnerability_scanning/paros/paros.md) | | WCVS | 689 | [文档](01_reconnaissance/07_web_vulnerability_scanning/wcvs/wcvs.md) | | WebScarab | 641 | [文档](01_reconnaissance/07_web_vulnerability_scanning/webscarab/webscarab.md) | | Watobo | 628 | [文档](01_reconnaissance/07_web_vulnerability_scanning/watobo/watobo.md) | | ZAProxy | 517 | [文档](01_reconnaissance/07_web_vulnerability_scanning/zaproxy/zaproxy.md) | ### 蓝牙 | 工具 | 行数 | 链接 | |------|-------|------| | Bettercap | 801 | [文档](01_reconnaissance/08_bluetooth/bettercap/bettercap.md) | | Ubertooth-Util | 847 | [文档](01_reconnaissance/08_bluetooth/ubertooth-util/ubertooth-util.md) | | Bluesnarfer | 732 | [文档](01_reconnaissance/08_bluetooth/bluesnarfer/bluesnarfer.md) | | BTScanner | 716 | [文档](01_reconnaissance/08_bluetooth/btscanner/btscanner.md) | | Spooftooph | 667 | [文档](01_reconnaissance/08_bluetooth/spooftooph/spooftooph.md) | | BlueLog | 665 | [文档](01_reconnaissance/08_bluetooth/bluelog/bluelog.md) | | RedFang | 617 | [文档](01_reconnaissance/08_bluetooth/redfang/redfang.md) | | BlueRanger | 603 | [文档](01_reconnaissance/08_bluetooth/blueranger/blueranger.md) | ### WiFi | 工具 | 行数 | 链接 | |------|-------|------| | Kismet | 999 | [文档](01_reconnaissance/09_wifi/kismet/kismet.md) | | Wash | 845 | [文档](01_reconnaissance/09_wifi/wash/wash.md) | | Sparrow-WiFi | 796 | [文档](01_reconnaissance/09_wifi/sparrow-wifi/sparrow-wifi.md) | | Asleap | 617 | [文档](01_reconnaissance/09_wifi/asleap/asleap.md) | ### 射频 | 工具 | 行数 | 链接 | |------|-------|------| | GnuRadio | 1,258 | [文档](01_reconnaissance/10_radio_frequency/gnuradio/gnuradio.md) | | RFcat | 1,019 | [文档](01_reconnaissance/10_radio_frequency/rfcat/rfcat.md) | | Chirp | 839 | [文档](01_reconnaissance/10_radio_frequency/chirp/chirp.md) | | HackRF | 716 | [文档](01_reconnaissance/10_radio_frequency/hackrf/hackrf.md) | | Gqrx | 766 | [文档](01_reconnaissance/10_radio_frequency/gqrx/gqrx.md) |

阶段 02 — 资源开发（34 款工具）

### 反汇编器与调试器 | 工具 | 行数 | 链接 | |------|-------|------| | GDB | 816 | [文档](02_resource_development/disassemblers_debuggers/gdb/gdb.md) | | Ghidra | 675 | [文档](02_resource_development/disassemblers_debuggers/ghidra/ghidra.md) | | Rizin | 589 | [文档](02_resource_development/disassemblers_debuggers/rizin/rizin.md) | | GEF | 578 | [文档](02_resource_development/disassemblers_debuggers/gef/gef.md) | | Capstone | 547 | [文档](02_resource_development/disassemblers_debuggers/capstone/capstone.md) | | Radare2 | 534 | [文档](02_resource_development/disassemblers_debuggers/radare2/radare2.md) | | Cutter | 444 | [文档](02_resource_development/disassemblers_debuggers/cutter/cutter.md) | | EDB-Debugger | 415 | [文档](02_resource_development/disassemblers_debuggers/edb-debugger/edb-debugger.md) | | RecStudio | 376 | [文档](02_resource_development/disassemblers_debuggers/recstudio/recstudio.md) | | OllyDbg | 349 | [文档](02_resource_development/disassemblers_debuggers/ollydbg/ollydbg.md) | ### 漏洞利用资源 | 工具 | 行数 | 链接 | |------|-------|------| | SearchSploit | 442 | [文档](02_resource_development/exploit_resources/searchsploit/searchsploit.md) | | ExploitDB | 413 | [文档](02_resource_development/exploit_resources/exploitdb/exploitdb.md) | | Pompem | 330 | [文档](02_resource_development/exploit_resources/pompem/pompem.md) | ### 模糊测试 | 工具 | 行数 | 链接 | |------|-------|------| | AFL | 602 | [文档](02_resource_development/fuzzing/afl-fuzz/afl-fuzz.md) | | Spike | 414 | [文档](02_resource_development/fuzzing/spike/spike.md) | | SFuzz | 373 | [文档](02_resource_development/fuzzing/sfuzz/sfuzz.md) | | BED | 351 | [文档](02_resource_development/fuzzing/bed/bed.md) | ### Java 与 Android 逆向 | 工具 | 行数 | 链接 | |------|-------|------| | JADX | 520 | [文档](02_resource_development/java_android_reversing/jadx/jadx.md) | | Apktool | 491 | [文档](02_resource_development/java_android_reversing/apktool/apktool.md) | | Bytecode Viewer | 421 | [文档](02_resource_development/java_android_reversing/bytecode-viewer/bytecode-viewer.md) | | DEX2JAR | 393 | [文档](02_resource_development/java_android_reversing/dex2jar/dex2jar.md) | | JD-GUI | 352 | [文档](02_resource_development/java_android_reversing/jd-gui/jd-gui.md) | | JavaSnoop | 301 | [文档](02_resource_development/java_android_reversing/javasnoop/javasnoop.md) | ### Shellcode 与 payload 生成 | 工具 | 行数 | 链接 | |------|-------|------| | MSFvenom | 907 | [文档](02_resource_development/shellcode_payload/msfvenom/msfvenom.md) | | Veil | 603 | [文档](02_resource_development/shellcode_payload/veil/veil.md) | | Shellter | 598 | [文档](02_resource_development/shellcode_payload/shellter/shellter.md) | | Donut | 580 | [文档](02_resource_development/shellcode_payload/donut/donut.md) | | Backdoor-Factory | 514 | [文档](02_resource_development/shellcode_payload/backdoor-factory/backdoor-factory.md) | | ShellNoob | 506 | [文档](02_resource_development/shellcode_payload/shellnoob/shellnoob.md) | | Cymothoa | 485 | [文档](02_resource_development/shellcode_payload/cymothoa/cymothoa.md) | | MSF-NASM | 436 | [文档](02_resource_development/shellcode_payload/msf-nasm_shell/msf-nasm_shell.md) | | EXE2HEX | 401 | [文档](02_resource_development/shellcode_payload/exe2hex/exe2hex.md) | | Sickle-PDK | 396 | [文档](02_resource_development/shellcode_payload/sickle-pdk/sickle-pdk.md) | | MSFPC | 389 | [文档](02_resource_development/shellcode_payload/msfpc/msfpc.md) |

阶段 03 — 初始访问（10 款工具）

| 工具 | 行数 | 链接 | |------|-------|------| | SQLSus | 1,256 | [文档](03_initial_access/sqlsus/sqlsus.md) | | GoPhish | 959 | [文档](03_initial_access/gophish/gophish.md) | | SQLNinja | 952 | [文档](03_initial_access/sqlninja/sqlninja.md) | | SQLMap | 891 | [文档](03_initial_access/sqlmap/sqlmap.md) | | Commix | 759 | [文档](03_initial_access/commix/commix.md) | | DNS-Rebind | 690 | [文档](03_initial_access/dns-rebind/dns-rebind.md) | | jSQL | 642 | [文档](03_initial_access/jsql/jsql.md) | | Metasploit | 632 | [文档](03_initial_access/metasploit-framework/metasploit-framework.md) | | JBoss-Autopwn | 612 | [文档](03_initial_access/jboss-autopwn/jboss-autopwn.md) | | SET Toolkit | 511 | [文档](03_initial_access/setoolkit/setoolkit.md) |

阶段 04 — 执行（6 款工具）

| 工具 | 行数 | 链接 | |------|-------|------| | XSSer | 828 | [文档](04_execution/xsser/xsser.md) | | Nishang | 738 | [文档](04_execution/nishang/nishang.md) | | PowerSploit | 738 | [文档](04_execution/powersploit/powersploit.md) | | BeEF | 723 | [文档](04_execution/beef-xss/beef-xss.md) | | Evilgrade | 708 | [文档](04_execution/evilgrade/evilgrade.md) | | Armitage | 611 | [文档](04_execution/armitage/armitage.md) |

阶段 05 — 持久化（7 款工具）

| 工具 | 行数 | 链接 | |------|-------|------| | Laudanum | 689 | [文档](05_persistence/laudanum/laudanum.md) | | Weevely | 630 | [文档](05_persistence/weevely/weevely.md) | | Cymothoa | 614 | [文档](05_persistence/cymothoa/cymothoa.md) | | WeBaCoo | 588 | [文档](05_persistence/webacoo/webacoo.md) | | Backdoor-Factory | 550 | [文档](05_persistence/backdoor-factory/backdoor-factory.md) | | Webshells | 517 | [文档](05_persistence/webshells/webshells.md) | | PHPGGC | 510 | [文档](05_persistence/phpggc/phpggc.md) |

阶段 06 — 权限提升（6 款工具）

| 工具 | 行数 | 链接 | |------|-------|------| | BloodyAD | 746 | [文档](06_privilege_escalation/bloodyad/bloodyad.md) | | Lynis | 644 | [文档](06_privilege_escalation/lynis/lynis.md) | | Unix-Privesc-Check | 616 | [文档](06_privilege_escalation/unix-privesc-check/unix-privesc-check.md) | | LinPEAS | 574 | [文档](06_privilege_escalation/linpeas/linpeas.md) | | PEASS | 508 | [文档](06_privilege_escalation/peass/peass.md) | | WinPEAS | 505 | [文档](06_privilege_escalation/winpeas/winpeas.md) |

阶段 07 — 防御绕过（16 款工具）

| 工具 | 行数 | 链接 | |------|-------|------| | Impacket | 837 | [文档](07_defense_evasion/pass_the_hash/impacket-scripts/impacket-scripts.md) | | Veil | 790 | [文档](07_defense_evasion/av_evasion/veil/veil.md) | | Shellter | 743 | [文档](07_defense_evasion/av_evasion/shellter/shellter.md) | | Evil-WinRM | 729 | [文档](07_defense_evasion/pass_the_hash/evil-winrm/evil-winrm.md) | | SniffJoke | 697 | [文档](07_defense_evasion/av_evasion/sniffjoke/sniffjoke.md) | | Stegsnow | 655 | [文档](07_defense_evasion/steganography/stegsnow/stegsnow.md) | | FreeRDP | 649 | [文档](07_defense_evasion/pass_the_hash/freerdp/freerdp.md) | | OutGuess | 612 | [文档](07_defense_evasion/steganography/outguess/outguess.md) | | SMBMap | 611 | [文档](07_defense_evasion/pass_the_hash/smbmap/smbmap.md) | | Stegosuite | 600 | [文档](07_defense_evasion/steganography/stegosuite/stegosuite.md) | | Rubeus | 583 | [文档](07_defense_evasion/pass_the_hash/rubeus/rubeus.md) | | Mimikatz | 564 | [文档](07_defense_evasion/pass_the_hash/mimikatz/mimikatz.md) | | Passing-the-Hash | 542 | [文档](07_defense_evasion/pass_the_hash/passing-the-hash/passing-the-hash.md) | | CrackMapExec | 536 | [文档](07_defense_evasion/pass_the_hash/crackmapexec/crackmapexec.md) | | Steghide | 536 | [文档](07_defense_evasion/steganography/steghide/steghide.md) | | NetExec | 532 | [文档](07_defense_evasion/pass_the_hash/netexec/netexec.md) |

## 学习路径 ### 初级（第 1-2 周） 从这些基础工具开始： 1. **Nmap** — 网络扫描基础 2. **Gobuster** — 目录发现 3. **SQLMap** — SQL 注入 4. **Metasploit** — 漏洞利用框架 5. **Hydra** — 暴力破解攻击 ### 中级（第 3-6 周） 在你的基础上进阶： 1. **Burp Suite** — Web 应用测试 2. **Nuclei** — 漏洞扫描 3. **Hashcat** — 密码破解 4. **BloodHound** — Active Directory 5. **Wireshark** — 网络分析 ### 高级（第 2 个月及以后） 掌握高级技术： 1. **Ghidra** — 逆向工程 2. **MSFvenom** — payload 创建 3. **Mimikatz** — 凭证提取 4. **Impacket** — 网络漏洞利用5. **自定义工具** — 构建您自己的工具 ## OSCP 认证指南 Offensive Security Certified Professional (OSCP) 考试要求掌握特定的工具。本仓库涵盖了 OSCP 大纲中的每一款工具： | 分类 | 本仓库的工具 | |----------|-------------------| | 枚举 | [Nmap](01_reconnaissance/03_network_information/nmap/nmap.md), [Gobuster](01_reconnaissance/05_web_scanning/gobuster/gobuster.md), [FFuf](01_reconnaissance/05_web_scanning/ffuf/ffuf.md) | | Web 攻击 | [SQLMap](03_initial_access/sqlmap/sqlmap.md), [Burp Suite](01_reconnaissance/07_web_vulnerability_scanning/burpsuite/burpsuite.md), [Nikto](01_reconnaissance/07_web_vulnerability_scanning/nikto/nikto.md) | | 漏洞利用 | [Metasploit](03_initial_access/metasploit-framework/metasploit-framework.md), [MSFvenom](02_resource_development/shellcode_payload/msfvenom/msfvenom.md), [SearchSploit](02_resource_development/exploit_resources/searchsploit/searchsploit.md) | | 密码攻击 | [Hydra](08_credential_access/brute_force/hydra/hydra.md), [John](08_credential_access/password_cracking/john/john.md), [Hashcat](08_credential_access/password_cracking/hashcat/hashcat.md) | | 权限提升 | [LinPEAS](06_privilege_escalation/linpeas/linpeas.md), [WinPEAS](06_privilege_escalation/winpeas/winpeas.md) | | 后渗透 | [Mimikatz](07_defense_evasion/pass_the_hash/mimikatz/mimikatz.md), [Impacket](07_defense_evasion/pass_the_hash/impacket-scripts/impacket-scripts.md) | ## CTF 比赛工具 CTF 比赛需要快速使用特定工具： | CTF 分类 | 工具 | |--------------|-------| | **Web** | [SQLMap](03_initial_access/sqlmap/sqlmap.md), [Gobuster](01_reconnaissance/05_web_scanning/gobuster/gobuster.md), [FFuf](01_reconnaissance/05_web_scanning/ffuf/ffuf.md), [Burp Suite](01_reconnaissance/07_web_vulnerability_scanning/burpsuite/burpsuite.md) | | **Crypto** | [John](08_credential_access/password_cracking/john/john.md), [Hashcat](08_credential_access/password_cracking/hashcat/hashcat.md) | | **Forensics** | [Steghide](07_defense_evasion/steganography/steghide/steghide.md), [Binwalk](15_forensics/) | | **逆向工程** | [GDB](02_resource_development/disassemblers_debuggers/gdb/gdb.md), [Ghidra](02_resource_development/disassemblers_debuggers/ghidra/ghidra.md), [Radare2](02_resource_development/disassemblers_debuggers/radare2/radare2.md) | | **Pwn** | [GDB](02_resource_development/disassemblers_debuggers/gdb/gdb.md), [MSFvenom](02_resource_development/shellcode_payload/msfvenom/msfvenom.md) | | **OSINT** | [Sherlock](01_reconnaissance/02_identity_information/sherlock/sherlock.md), [TheHarvester](01_reconnaissance/03_network_information/theharvester/theharvester.md) | ## 漏洞赏金工具包 漏洞赏金计划必备工具： | 阶段 | 工具 | |-------|-------| | 侦察 | [Amass](01_reconnaissance/03_network_information/amass/amass.md), [Subfinder](01_reconnaissance/05_web_scanning/subfinder/subfinder.md), [Assetfinder](01_reconnaissance/05_web_scanning/assetfinder/assetfinder.md) | | 扫描 | [Nuclei](01_reconnaissance/07_web_vulnerability_scanning/nuclei/nuclei.md), [Nmap](01_reconnaissance/03_network_information/nmap/nmap.md) | | Web | [Burp Suite](01_reconnaissance/07_web_vulnerability_scanning/burpsuite/burpsuite.md), [FFuf](01_reconnaissance/05_web_scanning/ffuf/ffuf.md), [Gobuster](01_reconnaissance/05_web_scanning/gobuster/gobuster.md) | ## Web 应用安全 Web 应用渗透测试的完整文档： | 工具 | 用途 | |------|---------| | [Burp Suite](01_reconnaissance/07_web_vulnerability_scanning/burpsuite/burpsuite.md) | 拦截代理、漏洞扫描 | | [SQLMap](03_initial_access/sqlmap/sqlmap.md) | SQL 注入检测与利用 | | [Nikto](01_reconnaissance/07_web_vulnerability_scanning/nikto/nikto.md) | Web 服务器漏洞扫描 | | [Gobuster](01_reconnaissance/05_web_scanning/gobuster/gobuster.md) | 目录与文件发现 | | [FFuf](01_reconnaissance/05_web_scanning/ffuf/ffuf.md) | Web 模糊测试 | | [Nuclei](01_reconnaissance/07_web_vulnerability_scanning/nuclei/nuclei.md) | 基于模板的漏洞扫描 | | [Commix](03_initial_access/commix/commix.md) | 命令注入 | | [XSSer](04_execution/xsser/xsser.md) | 跨站脚本检测 | ## 密码破解指南 离线与在线密码攻击工具： | 工具 | 类型 | 用例 | |------|------|----------| | [Hashcat](08_credential_access/password_cracking/hashcat/hashcat.md) | GPU 破解 | 利用 GPU 进行极速哈希破解 | | [John the Ripper](08_credential_access/password_cracking/john/john.md) | CPU 破解 | 多功能密码破解器 | | [Hydra](08_credential_access/brute_force/hydra/hydra.md) | 在线暴力破解 | 登录页面暴力破解 | | [Medusa](08_credential_access/brute_force/medusa/medusa.md) | 在线暴力破解 | 并行网络登录暴力破解器 | | [Responder](08_credential_access/credential_harvesting/responder/responder.md) | 网络投毒 | LLMNR/NBT-NS 凭证收集 | ## 逆向工程工具 二进制分析与逆向工程文档： | 工具 | 用途 | |------|---------| | [Ghidra](02_resource_development/disassemblers_debuggers/ghidra/ghidra.md) | 带有反编译器的 NSA 逆向工程套件 | | [GDB](02_resource_development/disassemblers_debuggers/gdb/gdb.md) | 适用于 Linux 的 GNU 调试器 | | [GEF](02_resource_development/disassemblers_debuggers/gef/gef.md) | 用于漏洞利用开发的 GDB 增强功能 | | [Radare2](02_resource_development/disassemblers_debuggers/radare2/radare2.md) | 逆向工程框架 | | [Rizin](02_resource_development/disassemblers_debuggers/rizin/rizin.md) | Radare2 的分支 | | [Capstone](02_resource_development/disassemblers_debuggers/capstone/capstone.md) | 反汇编框架 | ## 文档结构说明 每款工具均遵循 8 章模板： ``` Chapter 1: Introduction & Overview Chapter 2: Installation & Setup Chapter 3: Basic Usage (with command examples) Chapter 4: Intermediate Usage (scripting, automation) Chapter 5: Advanced Usage (evasion, custom techniques) Chapter 6: Real-World Scenarios (audit, CTF, bug bounty) Chapter 7: Detection & Defense (blue team) Chapter 8: Troubleshooting (errors, FAQ) ``` 此外还提供用于快速查阅的 **CHEATSHEET.md**。 ## 适用人群 - 记录其方法论的**渗透测试人员** - 需要快速查阅工具参考的**CTF 选手** - 希望获得全面指南的**漏洞赏金猎人** - 学习网络安全和道德黑客技术的**学生** - 准备认证考试的 **OSCP/CEH/GPEN 考生** - 了解攻击者工具以进行防御的**蓝队成员** ## 贡献指南 想要为某款工具添加文档？请参阅 [CONTRIBUTING.md](CONTRIBUTING.md)。 ## 许可证 MIT 许可证。仅供教育目的使用。 在对您不拥有的系统进行测试之前，请务必获得适当的授权。

标签：OSCP, XXE攻击, 工具文档, 插件系统, 网络安全, 防御加固, 隐私保护