/toolset

Toolset Overview

OSINT & Recon

i2 Analyst's Notebook

  • Paid

S3 Buckets: https://github.com/mxm0z/awesome-sec-s3

Opsec http://grugq.github.io/

Satellites and GeoSpatial OSINT

https://shadowbreakintl.com/ - $15 for any square kilo of satellite imagery (task for images they dont have)

https://soar.earth/ - merges drone shots with satellites

https://liveuamap.com/ - provides real-time incident aggregation data from around the world

Internal Pentesting

https://info.varonis.com/hubfs/docs/whitepapers/en/ebook_pen_testing_031317.pdf?submissionGuid=af8d5b95-8b40-4f86-baa0-944bf9cf4900

https://www.trustwave.com/Resources/SpiderLabs-Blog/Top-Five-Ways-SpiderLabs-Got-Domain-Admin-on-Your-Internal-Network/

Mobile Testing

Scanning & Reporting

Mobile Security Framework

  • Android (Dynamic/Static) & iOS (Static) Analysis with vulnerability reports.
  • Lacks on the iOS side - doesn't show exact locations of reported issues.
  • Tool-author udemy course HERE

Bluemix

  • 10 free scans with vulnerability report.
  • App-specific mobile testing documentation HERE

idbtool

  • Open source

Codified Security

  • Fricken awesome tool - however, expensive. Better use corperate $ for it.
  • Note, false positives have been reported

ostorlab

  • Not yet tried

Reverse Engineering & Analysis