GitHub RadarRed team tool

aw-junaid/Kali-Linux

A guide to using Kali Linux tools for web penetration testing, ethical hacking, forensics, and bug bounty. Covers setup, key tools, methodologies, and best practices. Optimized for security professionals. 105 stars.

105 stars17 forkspushed Jul 20, 2026MIT

Project links:Open GitHub project Back to radar

README Preview

Fetched from GitHub

Kali Linux Tools Documentation

Image: GitHub contributors Image: GitHub followers Image: YouTube Channel Subscribers Image: Discord Image: X (formerly Twitter) Follow Image: GitHub commit activity Image: Website Image: GitHub repo size

Contact With Me:

💰 You can help me by Donating

![BuyMeACoffee](https://buymeacoffee.com/awjunaid)

[!Note]

This project is intended for educational and ethical purposes only. Unauthorized use, distribution, or modification of these tools without proper consent is prohibited. By using this repository, you agree to comply with all applicable laws and ethical guidelines. The author is not responsible for any misuse or damage caused by the tools provided herein.

1. Information Gathering

This phase involves collecting as much data as possible about a target system or network.

1.1. DNS Analysis

Tools for enumerating DNS records and identifying subdomains.

**dnsenum**: A multithreaded Perl script to enumerate DNS information from a domain, discover non-contiguous IP blocks, and perform reverse lookups.
**dnsmap**: A passive DNS mapping tool that performs brute-force subdomain discovery to identify hidden or non-linked hosts.
**dnsrecon**: A versatile DNS enumeration script that checks for zone transfers, performs SRV record enumeration, and supports various discovery techniques.
**fierce**: A DNS reconnaissance tool for locating non-contiguous IP space and identifying domain names, often used as a last resort before a full port scan.
**subfinder**: A powerful subdomain discovery tool that focuses on speed and reliability, using passive online sources to enumerate valid subdomains.
**aquatone**: A tool for visual inspection of websites across many hosts, providing screenshots and HTTP response data for easy analysis.
**gobuster**: A multi-purpose tool for brute-forcing URIs (directories and files), DNS subdomains, and virtual host names.
**shuffledns**: A wrapper around massdns that enumerates subdomains using a wordlist and various resolvers.

1.2. OSINT Analysis

Open-Source Intelligence (OSINT) tools for gathering information from publicly available sources.

**maltego**: An interactive data mining tool that renders directed graphs for link analysis, allowing you to uncover relationships between people, companies, domains, and more.
**spiderfoot**: An automated OSINT tool that integrates with numerous data sources to collect intelligence on targets, including IP addresses, domains, email addresses, and names.
**recon-ng**: A full-featured Web Reconnaissance framework written in Python, providing a powerful environment for automated OSINT collection.
**theHarvester**: A tool for gathering emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines and PGP key servers.
**sherlock**: A powerful tool to hunt down usernames across hundreds of social networks, making it invaluable for social media intelligence.
**waybackurls**: Fetch URLs from the Wayback Machine for a given domain, useful for discovering hidden endpoints.
**gau**: Get All URLs - Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.
**shodan**: The official command-line interface for Shodan, allowing you to search for internet-connected devices and services.

1.3. Live Host & Route Analysis

Tools for identifying live systems on a network and analyzing network paths.

**netdiscover**: An active/passive ARP reconnaissance tool for discovering live hosts on a local network, useful for wardriving and network inventory.
**nmap**: The industry-standard network exploration and security auditing tool, used for host discovery, port scanning, version detection, and OS fingerprinting.
**masscan**: A high-performance TCP port scanner that can scan the entire internet in minutes, transmitting packets at a very high rate.
**unicornscan**: A sophisticated network reconnaissance and port scanning tool with a high degree of control over packet transmission and data collection.
**fping**: A high-performance ping tool capable of sending ICMP echo requests to multiple hosts in parallel, ideal for large-scale host discovery.
**hping3**: A command-line TCP/IP packet assembler and analyzer, often used for advanced port scanning, firewall testing, and manual path MTU discovery.
**arping**: A utility for sending ARP requests to discover and probe hosts on a local network, bypassing IP-level filters.
**thc-ipv6**: A comprehensive suite of tools for attacking the inherent protocol weaknesses of IPv6 and ICMP6, essential for modern network audits.
**netmask**: A simple but useful tool for analyzing and managing IP subnets, converting between different netmask formats.
**httprobe**: A tool to probe for working HTTP and HTTPS servers from a list of hosts.
**naabu**: A fast port scanner written in Go that focuses on accuracy and simplicity.
**httpx**: A fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

1.4. Service & Protocol Analysis

Specialized tools for enumerating and analyzing specific network services.

**nbtscan**: A scanner for NetBIOS name information, retrieving share lists, logged-in users, and MAC addresses from Windows hosts on a local network.
**smbmap**: A handy SMB enumeration tool that allows pen testers to browse, upload, download, and execute commands on SMB shares, checking for common misconfigurations.
**smtp-user-enum**: A tool for enumerating valid users on SMTP servers using techniques like VRFY, EXPN, and RCPT TO.
**swaks**: The "Swiss Army Knife" for SMTP, a featureful, flexible, and scriptable tool for testing email servers and verifying mail relays.
**onesixtyone**: A fast and simple SNMP scanner that sends multiple community strings to a range of IP addresses to identify devices with default or weak SNMP configurations.
**snmp-check**: A Perl script that enumerates information from SNMP devices, including running processes, open TCP ports, network interfaces, and installed software.
**ike-scan**: A command-line tool for discovering, fingerprinting, and testing IPsec VPN servers using IKE (Internet Key Exchange).

1.5. SSL/TLS Analysis

Tools for auditing and analyzing SSL/TLS configurations and certificates.

**sslscan**: A fast SSL/TLS scanner that tests services for supported ciphers, protocols, and some common vulnerabilities like Heartbleed.
**sslyze**: A powerful and fast SSL/TLS scanning library and tool that analyzes server configurations for weak ciphers, certificate issues, and pro