Cloud Firewall Rule Analyzer
AWS Security Groups, Azure NSGs, GCP Firewall Rules Detects all-traffic-open, admin/DB ports public, wide ranges Severity classification (CRITICAL/HIGH/MEDIUM/L
Arsenal
Professional offensive security tools & exploit frameworks
98
Tools
12
Categories
Phishing Email Template Pack
25/25 phishing email templates (credential, shipping, invoice, OTP, internal IT, HR and more), each with subject/body placeholders, sender guidance and detectio
Evilginx2 Phishlet Collection
Evilginx2 phishlet collection with 13 valid YAML phishlets: AWS, GitHub, LinkedIn, Twitter/X, Dropbox, Adobe, Netflix, PayPal, Instagram, Reddit and more.
Pretexting Scenario Builder
IT Support, HR Benefits, Vendor Invoice, CEO Fraud, Package Delivery Phase-by-phase scripts with objection handling OSINT checklist per scenario
Voice Phishing (Vishing) Toolkit
3 scenarios: Password Reset, MFA Fatigue, Wire Transfer Voice modulation profiles per persona Asterisk/SIP caller ID spoof configs
USB Drop Attack Payloads
5 Rubber Ducky scripts (reverse shell, cred harvest, persistence, exfil, Linux) Malicious LNK generator (PowerShell) Autorun.inf templates
LinkedIn OSINT & Spear Phishing Module
Google dork generation for LinkedIn profiles Name-to-username pattern generation (10 patterns) Email address candidate generation Org chart reconstruction from
QR Code Phishing Generator
WiFi auto-connect QR (evil twin integration) URL redirect with tracking vCard injection for contact phishing Crypto payment redirect Campaign builder with manif
Browser-in-the-Browser (BitB) Attack Kit
5 templates: Google, Microsoft, Apple, Facebook, GitHub HTML standalone + JavaScript embed injection Built-in credential capture server with JSON logging Auto-r
Physical Penetration Testing Checklist
5 phases: Recon, Social Engineering, Access Control, Data Collection, Documentation 40+ tasks with risk levels and required tools Tool recommendation list with
SQLi to RCE Escalation Script
Multi-DB SQLi detection (MySQL, MSSQL, PostgreSQL, Oracle, SQLite) Error-based and time-based detection MySQL RCE: INTO OUTFILE webshell, UDF exploitation MSSQL
XSS to Account Takeover Toolkit
6 cookie stealer variants (script, img, svg, fetch, xhr, event) Keylogger injection Full session hijack (cookies + localStorage + CSRF tokens) Phishing overlay