How do I install the Hacking/Penetration Testing [[TOC]](#anger-table-of-contents) skill?

Run npx skillmds@latest add tools-only/hacking-penetration-testing-and-nbsp-toc-anger-table-of in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Which AI agents work with Hacking/Penetration Testing [[TOC]](#anger-table-of-contents)?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Who published Hacking/Penetration Testing [[TOC]](#anger-table-of-contents)?

tools-only (@tools-only) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hacking/Penetration Testing  [[TOC]](#anger-table-of-contents) by tools-only

Name: Hacking/Penetration Testing [[TOC]](#anger-table-of-contents)
Author: tools-only

Hacking/Penetration Testing  [[TOC]](#anger-table-of-contents)

   Sandcat Browser - a penetration-oriented browser with plenty of advanced functionality already built in.    Metasploit - tool and framework for pentesting system, web and many more.

tools-only Updated Sep 29, 2026 7 repo stars

File contents

Hacking/Penetration Testing [TOC]

:black_small_square: Pentesters arsenal tools

:black_small_square: Pentests bookmarks collection

:black_small_square: Backdoors/exploits

:black_small_square: Wordlists and Weak passwords

:black_small_square: Bounty platforms

:black_small_square: Web Training Apps (local installation)

:black_small_square: Labs (ethical hacking platforms/trainings/CTFs)

:black_small_square: CTF platforms

:black_small_square: Other resources

Your daily knowledge and news [TOC]

---name: hacking-penetration-testing-and-nbsp-toc-anger-table-ofdescription:    Sandcat Browser - a penetration-oriented browser with plenty of advanced functionality already built in.    Metasploit - tool and framework for pentesting system, web and many more.---#### Hacking/Penetration Testing  [[TOC]](#anger-table-of-contents)##### :black_small_square: Pentesters arsenal tools   <a href="http://www.syhunt.com/sandcat/">Sandcat Browser</a> - a penetration-oriented browser with plenty of advanced functionality already built in.    <a href="https://www.metasploit.com/">Metasploit</a> - tool and framework for pentesting system, web and many more.    <a href="https://portswigger.net/burp">Burp Suite</a> - tool for testing web app security, intercepting proxy to replay, inject, scan and fuzz.    <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project">OWASP Zed Attack Proxy</a> - intercepting proxy to replay, inject, scan and fuzz HTTP requests.    <a href="http://w3af.org/">w3af</a> - is a Web Application Attack and Audit Framework.    <a href="https://mitmproxy.org/">mitmproxy</a> - an interactive TLS-capable intercepting HTTP proxy for penetration testers.    <a href="https://cirt.net/Nikto2">Nikto2</a> - web server scanner which performs comprehensive tests against web servers for multiple items.    <a href="http://sqlmap.org/">sqlmap</a> - tool that automates the process of detecting and exploiting SQL injection flaws.    <a href="https://github.com/lanmaster53/recon-ng">Recon-ng</a> - is a full-featured Web Reconnaissance framework written in Python.    <a href="https://github.com/Tib3rius/AutoRecon">AutoRecon</a> - is a network reconnaissance tool which performs automated enumeration of services.    <a href="https://www.faradaysec.com/">Faraday</a> - an Integrated Multiuser Pentest Environment.    <a href="https://github.com/s0md3v/Photon">Photon</a> - incredibly fast crawler designed for OSINT.    <a href="https://github.com/s0md3v/XSStrike">XSStrike</a> - most advanced XSS detection suite.    <a href="https://github.com/1N3/Sn1per">Sn1per</a> - automated pentest framework for offensive security experts.    <a href="https://github.com/future-architect/vuls">vuls</a> - is an agent-less vulnerability scanner for Linux, FreeBSD, and other.    <a href="https://github.com/google/tsunami-security-scanner">tsunami</a> - is a general purpose network security scanner with an extensible plugin system.    <a href="https://github.com/michenriksen/aquatone">aquatone</a> - a tool for domain flyovers.    <a href="https://github.com/GitHackTools/BillCipher">BillCipher</a> - information gathering tool for a website or IP address.    <a href="https://github.com/Ekultek/WhatWaf">WhatWaf</a> - detect and bypass web application firewalls and protection systems.    <a href="https://github.com/s0md3v/Corsy">Corsy</a> - CORS misconfiguration scanner.    <a href="https://github.com/evyatarmeged/Raccoon">Raccoon</a> - is a high performance offensive security tool for reconnaissance and vulnerability scanning.    <a href="https://github.com/Nekmo/dirhunt">dirhunt</a> - find web directories without bruteforce.    <a href="https://www.openwall.com/john/">John The Ripper</a> - is a fast password cracker, currently available for many flavors of Unix, Windows, and other.    <a href="https://hashcat.net/hashcat/">hashcat</a> - world's fastest and most advanced password recovery utility.    <a href="http://lcamtuf.coredump.cx/p0f3/">p0f</a> - is a tool to identify the players behind any incidental TCP/IP communications.    <a href="https://github.com/mozilla/ssh_scan">ssh_scan</a> - a prototype SSH configuration and policy scanner.    <a href="https://github.com/woj-ciech/LeakLooker">LeakLooker</a> - find open databases - powered by Binaryedge.io    <a href="https://github.com/offensive-security/exploitdb">exploitdb</a> - searchable archive from The Exploit Database.    <a href="https://github.com/vulnersCom/getsploit">getsploit</a> - is a command line utility for searching and downloading exploits.    <a href="https://github.com/zardus/ctf-tools">ctf-tools</a> - some setup scripts for security research tools.    <a href="https://github.com/Gallopsled/pwntools">pwntools</a> - CTF framework and exploit development library.    <a href="https://github.com/bl4de/security-tools">security-tools</a> - collection of small security tools created mostly in Python. CTFs, pentests and so on.    <a href="https://github.com/leonteale/pentestpackage">pentestpackage</a> - is a package of Pentest scripts.    <a href="https://github.com/dloss/python-pentest-tools">python-pentest-tools</a> - python tools for penetration testers.    <a href="https://github.com/fuzzdb-project/fuzzdb">fuzzdb</a> - dictionary of attack patterns and primitives for black-box application fault injection.    <a href="https://github.com/google/AFL">AFL</a> - is a free software fuzzer maintained by Google.    <a href="https://github.com/AFLplusplus/AFLplusplus">AFL++</a> - is AFL with community patches.    <a href="https://github.com/google/syzkaller">syzkaller</a> - is an unsupervised, coverage-guided kernel fuzzer.    <a href="https://github.com/pwndbg/pwndbg">pwndbg</a> - exploit development and reverse engineering with GDB made easy.    <a href="https://github.com/longld/peda">GDB PEDA</a> - Python Exploit Development Assistance for GDB.    <a href="https://www.hex-rays.com/products/ida/index.shtml">IDA</a> - multi-processor disassembler and debugger useful for reverse engineering malware.    <a href="https://github.com/radare/radare2">radare2</a> - framework for reverse-engineering and analyzing binaries.    <a href="https://github.com/threat9/routersploit">routersploit</a> - exploitation framework for embedded devices.    <a href="https://github.com/NationalSecurityAgency/ghidra">Ghidra</a> - is a software reverse engineering (SRE) framework.    <a href="https://cutter.re/">Cutter</a> - is an SRE platform integrating Ghidra's decompiler.    <a href="https://github.com/salesforce/vulnreport">Vulnreport</a> - open-source pentesting management and automation platform by Salesforce Product Security.    <a href="https://github.com/sc0tfree/mentalist">Mentalist</a> - is a graphical tool for custom wordlist generation.    <a href="https://github.com/archerysec/archerysec">archerysec</a> - vulnerability assessment and management helps to perform scans and manage vulnerabilities.    <a href="https://github.com/j3ssie/Osmedeus">Osmedeus</a> - fully automated offensive security tool for reconnaissance and vulnerability scanning.    <a href="https://github.com/beefproject/beef">beef</a> - the browser exploitation framework project.    <a href="https://github.com/NullArray/AutoSploit">AutoSploit</a> - automated mass exploiter.    <a href="https://github.com/TH3xACE/SUDO_KILLER">SUDO_KILLER</a> - is a tool to identify and exploit sudo rules' misconfigurations and vulnerabilities.    <a href="https://github.com/VirusTotal/yara">yara</a> - the pattern matching swiss knife.    <a href="https://github.com/gentilkiwi/mimikatz">mimikatz</a> - a little tool to play with Windows security.    <a href="https://github.com/sherlock-project/sherlock">sherlock</a> - hunt down social media accounts by username across social networks.    <a href="https://owasp.org/www-project-threat-dragon/">OWASP Threat Dragon</a> - is a tool used to create threat model diagrams and to record possible threats. ##### :black_small_square: Pentests bookmarks collection   <a href="http://www.pentest-standard.org/index.php/Main_Page">PTES</a> - the penetration testing execution standard.    <a href="https://www.amanhardikar.com/mindmaps/Practice.html">Pentests MindMap</a> - amazing mind map with vulnerable apps and systems.    <a href="https://www.amanhardikar.com/mindmaps/webapptest.html">WebApps Security Tests MindMap</a> - incredible mind map for WebApps security tests.    <a href="https://brutelogic.com.br/blog/">Brute XSS</a> - master the art of Cross Site Scripting.    <a href="https://portswigger.net/web-security/cross-site-scripting/cheat-sheet">XSS cheat sheet</a> - contains many vectors that can help you bypass WAFs and filters.    <a href="https://jivoi.github.io/2015/07/03/offensive-security-bookmarks/">Offensive Security Bookmarks</a> - security bookmarks collection, all things that author need to pass OSCP.    <a href="https://github.com/coreb1t/awesome-pentest-cheat-sheets">Awesome Pentest Cheat Sheets</a> - collection of the cheat sheets useful for pentesting.    <a href="https://github.com/Hack-with-Github/Awesome-Hacking">Awesome Hacking by HackWithGithub</a> - awesome lists for hackers, pentesters and security researchers.    <a href="https://github.com/carpedm20/awesome-hacking">Awesome Hacking by carpedm20</a> - a curated list of awesome hacking tutorials, tools and resources.    <a href="https://github.com/vitalysim/Awesome-Hacking-Resources">Awesome Hacking Resources</a> - collection of hacking/penetration testing resources to make you better.    <a href="https://github.com/enaqx/awesome-pentest">Awesome Pentest</a> - collection of awesome penetration testing resources, tools and other shiny things.    <a href="https://github.com/m4ll0k/Awesome-Hacking-Tools">Awesome-Hacking-Tools</a> - is a curated list of awesome Hacking Tools.    <a href="https://github.com/ksanchezcld/Hacking_Cheat_Sheet">Hacking Cheat Sheet</a> - author hacking and pentesting notes.    <a href="https://github.com/toolswatch/blackhat-arsenal-tools">blackhat-arsenal-tools</a> - official Black Hat arsenal security tools repository.    <a href="https://www.peerlyst.com/posts/the-complete-list-of-infosec-related-cheat-sheets-claus-cramon">Penetration Testing and WebApp Cheat Sheets</a> - the complete list of Infosec related cheat sheets.    <a href="https://github.com/The-Art-of-Hacking/h4cker">Cyber Security Resources</a> - includes thousands of cybersecurity-related references and resources.    <a href="https://github.com/jhaddix/pentest-bookmarks">Pentest Bookmarks</a> - there are a LOT of pentesting blogs.    <a href="https://github.com/OlivierLaflamme/Cheatsheet-God">Cheatsheet-God</a> - Penetration Testing Reference Bank - OSCP/PTP & PTX Cheatsheet.    <a href="https://github.com/Cyb3rWard0g/ThreatHunter-Playbook">ThreatHunter-Playbook</a> - to aid the development of techniques and hypothesis for hunting campaigns.    <a href="https://github.com/hmaverickadams/Beginner-Network-Pentesting">Beginner-Network-Pentesting</a> - notes for beginner network pentesting course.    <a href="https://github.com/rewardone/OSCPRepo">OSCPRepo</a> - is a list of resources that author have been gathering in preparation for the OSCP.    <a href="https://github.com/swisskyrepo/PayloadsAllTheThings">PayloadsAllTheThings</a> - a list of useful payloads and bypass for Web Application Security and Pentest/CTF.    <a href="https://github.com/foospidy/payloads">payloads</a> - git all the Payloads! A collection of web attack payloads.    <a href="https://github.com/payloadbox/command-injection-payload-list">command-injection-payload-list</a> - command injection payload list.    <a href="https://github.com/jakejarvis/awesome-shodan-queries">Awesome Shodan Search Queries</a> - great search queries to plug into Shodan.    <a href="https://github.com/s0md3v/AwesomeXSS">AwesomeXSS</a> - is a collection of Awesome XSS resources.    <a href="https://github.com/JohnTroony/php-webshells">php-webshells</a> - common php webshells.    <a href="https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/">Pentesting Tools Cheat Sheet</a> - a quick reference high level overview for typical penetration testing.    <a href="https://cheatsheetseries.owasp.org/">OWASP Cheat Sheet Series</a> - is a collection of high value information on specific application security topics.    <a href="https://jeremylong.github.io/DependencyCheck/index.html">OWASP dependency-check</a> - is an open source solution the OWASP Top 10 2013 entry.    <a href="https://www.owasp.org/index.php/OWASP_Proactive_Controls">OWASP ProActive Controls</a> - OWASP Top 10 Proactive Controls 2018.    <a href="https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE">PENTESTING-BIBLE</a> - hacking & penetration testing & red team & cyber security resources.    <a href="https://github.com/nixawk/pentest-wiki">pentest-wiki</a> - is a free online security knowledge library for pentesters/researchers.    <a href="https://media.defcon.org/">DEF CON Media Server</a> - great stuff from DEFCON.    <a href="https://github.com/rshipp/awesome-malware-analysis">Awesome Malware Analysis</a> - a curated list of awesome malware analysis tools and resources.    <a href="https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/">SQL Injection Cheat Sheet</a> - detailed technical stuff about the many different variants of the SQL Injection.    <a href="http://kb.entersoft.co.in/">Entersoft Knowledge Base</a> - great and detailed reference about vulnerabilities.    <a href="http://html5sec.org/">HTML5 Security Cheatsheet</a> - a collection of HTML5 related XSS attack vectors.    <a href="http://evuln.com/tools/xss-encoder/">XSS String Encoder</a> - for generating XSS code to check your input validation filters against XSS.    <a href="https://gtfobins.github.io/">GTFOBins</a> - list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.    <a href="https://guif.re/">Guifre Ruiz Notes</a> - collection of security, system, network and pentest cheatsheets.    <a href="http://blog.safebuff.com/2016/07/03/SSRF-Tips/index.html">SSRF Tips</a> - a collection of SSRF Tips.    <a href="http://shell-storm.org/repo/CTF/">shell-storm repo CTF</a> - great archive of CTFs.    <a href="https://github.com/bl4de/ctf">ctf</a> - CTF (Capture The Flag) writeups, code snippets, notes, scripts.    <a href="https://github.com/orangetw/My-CTF-Web-Challenges">My-CTF-Web-Challenges</a> - collection of CTF Web challenges.    <a href="https://github.com/OWASP/owasp-mstg">MSTG</a> - The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing.    <a href="https://github.com/sdcampbell/Internal-Pentest-Playbook">Internal-Pentest-Playbook</a> - notes on the most common things for an Internal Network Penetration Test.    <a href="https://github.com/streaak/keyhacks">KeyHacks</a> - shows quick ways in which API keys leaked by a bug bounty program can be checked.    <a href="https://github.com/securitum/research">securitum/research</a> - various Proof of Concepts of security research performed by Securitum.    <a href="https://github.com/juliocesarfort/public-pentesting-reports">public-pentesting-reports</a> - is a list of public pentest reports released by several consulting security groups.    <a href="https://github.com/djadmin/awesome-bug-bounty">awesome-bug-bounty</a> - is a comprehensive curated list of available Bug Bounty.    <a href="https://github.com/ngalongc/bug-bounty-reference">bug-bounty-reference</a> - is a list of bug bounty write-ups.    <a href="https://github.com/devanshbatham/Awesome-Bugbounty-Writeups">Awesome-Bugbounty-Writeups</a> - is a curated list of bugbounty writeups.    <a href="https://pentester.land/list-of-bug-bounty-writeups.html">Bug bounty writeups</a> - list of bug bounty writeups (2012-2020).    <a href="https://hackso.me/">hackso.me</a> - a great journey into security. ##### :black_small_square: Backdoors/exploits   <a href="https://github.com/bartblaze/PHP-backdoors">PHP-backdoors</a> - a collection of PHP backdoors. For educational or testing purposes only. ##### :black_small_square: Wordlists and Weak passwords   <a href="https://weakpass.com/">Weakpass</a> - for any kind of bruteforce find wordlists or unleash the power of them all at once!    <a href="https://hashes.org/">Hashes.org</a> - is a free online hash resolving service incorporating many unparalleled techniques.    <a href="https://github.com/danielmiessler/SecLists">SecLists</a> - collection of multiple types of lists used during security assessments, collected in one place.    <a href="https://github.com/berzerk0/Probable-Wordlists">Probable-Wordlists</a> - sorted by probability originally created for password generation and testing.    <a href="https://wiki.skullsecurity.org/index.php?title=Passwords">skullsecurity passwords</a> - password dictionaries and leaked passwords repository.    <a href="https://bezpieka.org/polski-slownik-premium-polish-wordlist">Polish PREMIUM Dictionary</a> - official dictionary created by the team on the forum bezpieka.org.* <a href="https://sourceforge.net/projects/kali-linux/files/Wordlist/">1    <a href="https://github.com/insidetrust/statistically-likely-usernames">statistically-likely-usernames</a> - wordlists for creating statistically likely username lists. ##### :black_small_square: Bounty platforms   <a href="https://www.yeswehack.com/">YesWeHack</a> - bug bounty platform with infosec jobs.    <a href="https://www.openbugbounty.org/">Openbugbounty</a> - allows any security researcher reporting a vulnerability on any website.    <a href="https://www.hackerone.com/">hackerone</a> - global hacker community to surface the most relevant security issues.    <a href="https://www.bugcrowd.com/">bugcrowd</a> - crowdsourced cybersecurity for the enterprise.    <a href="https://crowdshield.com/">Crowdshield</a> - crowdsourced security & bug bounty management.    <a href="https://www.synack.com/">Synack</a> - crowdsourced security & bug bounty programs, crowd security intelligence platform, and more.    <a href="https://hacktrophy.com/en/">Hacktrophy</a> - bug bounty platform. ##### :black_small_square: Web Training Apps (local installation)   <a href="https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project">OWASP-VWAD</a> - comprehensive and well maintained registry of all known vulnerable web applications.    <a href="http://www.dvwa.co.uk/">DVWA</a> - PHP/MySQL web application that is damn vulnerable.    <a href="https://metasploit.help.rapid7.com/docs/metasploitable-2">metasploitable2</a> - vulnerable web application amongst security researchers.    <a href="https://github.com/rapid7/metasploitable3">metasploitable3</a> - is a VM that is built from the ground up with a large amount of security vulnerabilities.    <a href="https://github.com/stamparm/DSVW">DSVW</a> - is a deliberately vulnerable web application written in under 100 lines of code.    <a href="https://sourceforge.net/projects/mutillidae/">OWASP Mutillidae II</a> - free, open source, deliberately vulnerable web-application.    <a href="https://www.owasp.org/index.php/OWASP_Juice_Shop_Project">OWASP Juice Shop Project</a> - the most bug-free vulnerable application in existence.    <a href="https://www.owasp.org/index.php/Projects/OWASP_Node_js_Goat_Project">OWASP Node js Goat Project</a> - OWASP Top 10 security risks apply to web apps developed using Node.js.    <a href="https://github.com/iteratec/juicy-ctf">juicy-ctf</a> - run Capture the Flags and Security Trainings with OWASP Juice Shop.    <a href="https://github.com/OWASP/SecurityShepherd">SecurityShepherd</a> - web and mobile application security training platform.    <a href="https://github.com/opendns/Security_Ninjas_AppSec_Training">Security Ninjas</a> - open source application security training program.    <a href="https://github.com/rapid7/hackazon">hackazon</a> - a modern vulnerable web app.    <a href="https://github.com/appsecco/dvna">dvna</a> - damn vulnerable NodeJS application.    <a href="https://github.com/DefectDojo/django-DefectDojo">django-DefectDojo</a> - is an open-source application vulnerability correlation and security orchestration tool.    <a href="https://google-gruyere.appspot.com/">Google Gruyere</a> - web application exploits and defenses.    <a href="https://github.com/amolnaik4/bodhi">Bodhi</a> - is a playground focused on learning the exploitation of client-side web vulnerabilities.    <a href="https://websploit.h4cker.org/">Websploit</a> - single vm lab with the purpose of combining several vulnerable appliations in one environment.    <a href="https://github.com/vulhub/vulhub">vulhub</a> - pre-built Vulnerable Environments based on docker-compose.    <a href="https://rhinosecuritylabs.com/aws/introducing-cloudgoat-2/">CloudGoat 2</a> - the new & improved "Vulnerable by Design"AWS deployment tool.    <a href="https://github.com/globocom/secDevLabs">secDevLabs</a> - is a laboratory for learning secure web development in a practical manner.    <a href="https://github.com/incredibleindishell/CORS-vulnerable-Lab">CORS-vulnerable-Lab</a> - sample vulnerable code and its exploit code.    <a href="https://github.com/moloch--/RootTheBox">RootTheBox</a> - a Game of Hackers (CTF Scoreboard & Game Manager).    <a href="https://application.security/">KONTRA</a> - application security training (OWASP Top Web & Api). ##### :black_small_square: Labs (ethical hacking platforms/trainings/CTFs)   <a href="https://www.offensive-security.com/">Offensive Security</a> - true performance-based penetration testing training for over a decade.    <a href="https://www.hackthebox.eu/">Hack The Box</a> - online platform allowing you to test your penetration testing skills.    <a href="https://www.hacking-lab.com/index.html">Hacking-Lab</a> - online ethical hacking, computer network and security challenge platform.    <a href="http://pwnable.kr/index.php">pwnable.kr</a> - non-commercial wargame site which provides various pwn challenges.    <a href="https://pwnable.tw/">Pwnable.tw</a> - is a wargame site for hackers to test and expand their binary exploiting skills.    <a href="https://picoctf.com/">picoCTF</a> - is a free computer security game targeted at middle and high school students.    <a href="https://ctflearn.com/">CTFlearn</a> - is an online platform built to help ethical hackers learn and practice their cybersecurity knowledge.    <a href="https://ctftime.org/">ctftime</a> - CTF archive and a place, where you can get some another CTF-related info.    <a href="https://silesiasecuritylab.com/">Silesia Security Lab</a> - high quality security testing services.    <a href="https://practicalpentestlabs.com/">Practical Pentest Labs</a> - pentest lab, take your Hacking skills to the next level.    <a href="https://www.root-me.org/?lang=en">Root Me</a> - the fast, easy, and affordable way to train your hacking skills.    <a href="https://rozwal.to/login">rozwal.to</a> - a great platform to train your pentesting skills.    <a href="https://tryhackme.com/">TryHackMe</a> - learning Cyber Security made easy.    <a href="https://hackxor.net/">hackxor</a> - is a realistic web application hacking game, designed to help players of all abilities develop their skills.    <a href="http://hack-yourself-first.com/">Hack Yourself First</a> - it's full of nasty app sec holes.    <a href="http://overthewire.org/wargames/">OverTheWire</a> - can help you to learn and practice security concepts in the form of fun-filled games.    <a href="https://labs.wizard-security.net/">Wizard Labs</a> - is an online Penetration Testing Lab.    <a href="https://pentesterlab.com/">PentesterLab</a> - provides vulnerable systems that can be used to test and understand vulnerabilities.    <a href="https://ringzer0ctf.com/">RingZer0</a> - tons of challenges designed to test and improve your hacking skills.    <a href="http://www.try2hack.nl/">try2hack</a> - several security-oriented challenges for your entertainment.    <a href="https://www.ubeeri.com/preconfig-labs">Ubeeri</a> - preconfigured lab environments.    <a href="https://lab.pentestit.ru/">Pentestit</a> - emulate IT infrastructures of real companies for legal pen testing and improving pentest skills.    <a href="https://microcorruption.com/login">Microcorruption</a> - reversal challenges done in the web interface.    <a href="https://crackmes.one/">Crackmes</a> - download crackmes to help improve your reverse engineering skills.    <a href="https://domgo.at/cxss/intro">DomGoat</a> - DOM XSS security learning and practicing platform.    <a href="https://chall.stypr.com">Stereotyped Challenges</a> - upgrade your web hacking techniques today!    <a href="https://www.vulnhub.com/">Vulnhub</a> - allows anyone to gain practical 'hands-on' experience in digital security.    <a href="https://w3challs.com/">W3Challs</a> - is a penetration testing training platform, which offers various computer challenges.    <a href="https://ringzer0ctf.com/challenges">RingZer0 CTF</a> - offers you tons of challenges designed to test and improve your hacking skills.    <a href="https://hack.me/">Hack.me</a> - a platform where you can build, host and share vulnerable web apps for educational purposes.    <a href="https://www.hackthis.co.uk/levels/">HackThis!</a> - discover how hacks, dumps and defacements are performed and secure your website.    <a href="https://www.enigmagroup.org/#">Enigma Group WebApp Training</a> - these challenges cover the exploits listed in the OWASP Top 10 Project.    <a href="https://challenges.re/">Reverse Engineering Challenges</a> - challenges, exercises, problems and tasks - by level, by type, and more.    <a href="https://0x00sec.org/">0x00sec</a> - the home of the Hacker - Malware, Reverse Engineering, and Computer Science.    <a href="https://www.wechall.net/challs">We Chall</a> - there are exist a lots of different challenge types.    <a href="https://www.hackergateway.com/">Hacker Gateway</a> - is the go-to place for hackers who want to test their skills.    <a href="https://www.hacker101.com/">Hacker101</a> - is a free class for web security.    <a href="https://contained.af/">contained.af</a> - a stupid game for learning about containers, capabilities, and syscalls.    <a href="http://flaws.cloud/">flAWS challenge!</a> - a series of levels you'll learn about common mistakes and gotchas when using AWS.    <a href="https://cybersecurity.wtf">CyberSec WTF</a> - provides web hacking challenges derived from bounty write-ups.    <a href="https://ctfchallenge.co.uk/login">CTF Challenge</a> - CTF Web App challenges.    <a href="https://capturetheflag.withgoogle.com">gCTF</a> - most of the challenges used in the Google CTF 2017.    <a href="https://www.hackthissite.org/pages/index/index.php">Hack This Site</a> - is a free, safe and legal training ground for hackers.    <a href="https://attackdefense.com">Attack & Defense</a> - is a browser-based cloud labs.    <a href="https://cryptohack.org/">Cryptohack</a> - a fun platform for learning modern cryptography.    <a href="https://cryptopals.com/">Cryptopals</a> - the cryptopals crypto challenges. ##### :black_small_square: CTF platforms   <a href="https://github.com/facebook/fbctf">fbctf</a> - platform to host Capture the Flag competitions.    <a href="https://github.com/google/ctfscoreboard">ctfscoreboard</a> - scoreboard for Capture The Flag competitions. ##### :black_small_square: Other resources   <a href="https://github.com/bugcrowd/bugcrowd_university">Bugcrowd University</a> - open source education content for the researcher community.    <a href="https://github.com/rewardone/OSCPRepo">OSCPRepo</a> - a list of resources and scripts that I have been gathering in preparation for the OSCP.    <a href="https://medium.com/@cxosmo/owasp-top-10-real-world-examples-part-1-a540c4ea2df5">OWASP Top 10: Real-World Examples</a> - test your web apps with real-world examples (two-part series).    <a href="http://phrack.org/index.html">phrack.org</a> - an awesome collection of articles from several respected hackers and other thinkers.    <a href="https://github.com/Gr1mmie/Practical-Ethical-Hacking-Resources">Practical-Ethical-Hacking-Resources</a> - compilation of resources from TCM's Udemy Course. #### Your daily knowledge and news  [[TOC]](#anger-table-of-contents)

Frequently asked questions

Hacking/Penetration Testing &nbsp;[[TOC]](#anger-table-of-contents)

File contents

Hacking/Penetration Testing [TOC]

:black_small_square: Pentesters arsenal tools

:black_small_square: Pentests bookmarks collection

:black_small_square: Backdoors/exploits

:black_small_square: Wordlists and Weak passwords

:black_small_square: Bounty platforms

:black_small_square: Web Training Apps (local installation)

:black_small_square: Labs (ethical hacking platforms/trainings/CTFs)

:black_small_square: CTF platforms

:black_small_square: Other resources

Your daily knowledge and news [TOC]

Related skills

Frequently asked questions

How do I install the Hacking/Penetration Testing &nbsp;[[TOC]](#anger-table-of-contents) skill?

What does the Hacking/Penetration Testing &nbsp;[[TOC]](#anger-table-of-contents) skill do?

Is Hacking/Penetration Testing &nbsp;[[TOC]](#anger-table-of-contents) safe to use?

Which AI agents work with Hacking/Penetration Testing &nbsp;[[TOC]](#anger-table-of-contents)?

Is Hacking/Penetration Testing &nbsp;[[TOC]](#anger-table-of-contents) free to use?

Who published Hacking/Penetration Testing &nbsp;[[TOC]](#anger-table-of-contents)?

Hacking/Penetration Testing [[TOC]](#anger-table-of-contents)