Custom offensive-security tooling in Python, built to automate the repetitive parts of web-application and API assessments: authentication flows, access control and account enumeration.
⚠️ Authorized use only. Use these tools only in penetration tests you are contracted to perform, in bug-bounty programs that permit it, and in CTF / lab environments. Using them against systems without explicit written authorization is illegal.
| Tool | Purpose | Highlights |
|---|---|---|
| 🗡️ Dagger | Password-reset flow auditor | token-leak detection · entropy scoring · user-enum · rate-limit test · generates crunch/ffuf/hydra recipes |
| 🆔 IDOR Tester | Access-control (IDOR/BOLA) testing | sequential/parametric ID fuzzing · response diffing · ships with a vulnerable demo API |
| 🔎 VerboseLogin_UserEnum | Valid-account discovery through login error responses | auto-baseline diffing · marker mode · multithreaded · spray-ready output |
| 📍 loc-tracker | Phishing / social-engineering awareness exercises | per-target links · IP geolocation · opt-in precise location · SQLite dashboard (consent-based by design) |
pentest-scripts/ holds smaller menu-driven recon scripts (subdomain and directory enumeration, port and ARP scan, hash cracker, SSH tester) written while learning. They are less polished than the tools above.
git clone https://github.com/sohaebgamal/pentest-tools
cd pentest-tools
pip install requests
pip install flask # only needed for the IDOR demo API
python3 dagger/dagger.py -hEvery tool lives in its own folder with a README that has the full usage and examples.
- Single-file and dependency-light: copy onto a testing box and run.
- Authorization first: banners and docs state the legal boundary;
loc-trackerdeliberately has no covert or silent location path. - Output that chains: results are formatted to feed the next tool (
ffuf,hydra, password spraying, Burp Intruder). - Evidence over noise: tools compare real responses (baselines, response diffs) rather than rely on a single error string.
Released under the MIT License. Provided for authorized security testing and education; the author is not responsible for misuse.
Maintained by Sohaib Gamal Elsayed · LinkedIn · TryHackMe