My penetrating weapon.

Turn: http://zhuanlan.zhihu.com/evilcos/19578244. The by cosine 2013 expands and expands, thinking about where to expand.

Under Firefox

1. Firebug, debug Js,http Request response Observation, cookie,dom tree observation, etc.;
2. Greasemonkey, I changed a cookie to modify the script, other students can use this: Original cookie Injector for Greasemonkey;
3. Noscript, to do some JS blocking;
4. Autoproxy,fq necessary;

Under Chrome

1. F12 Open Developer tools, function ==firebug+ Local storage observation, etc.
2. Swichysharp,fq necessary;
3. Cookie modification script, wrote a Chrome extension (open Source: Cookie using Artifact: cookiehacker), other students can go to the Chrome extension to search for a useful;

Front-end penetration tools

1. XSS ' OR, which I developed, is commonly used for decryption and code generation, where the source is stacked: Evilcos/xssor GitHub;
2. Xssee 3.0 Beta,monyer developed, plus decryption best use artifact;
3. Online JavaScript beautifier,js beautification tool, analysis JS commonly used;
4. Front-end attack framework, recommended beef and some small partners developed the XSS Blind Play tool, I also have a paragraph, but not easily;

HTTP Proxy Tool

1. Fiddler, can, no longer look for other, wherein the watcher plug-in can play, find loopholes;
2. Burp Suite, artifact, not only HTTP proxy, but also crawler, vulnerability scanning, infiltration, blasting and other functions;

Vulnerability Scanning Tool

1. Awvs, not only easy to sweep, bring some small tools to use;
2. Python self-writing scripts/tools, the good flaw is you use Awvs wait to find? Wash and sleep;
3. Nmap, definitely not just port scanning! Hundreds of scripts;

Exploit exploits

1. Sqlmap,sql injected using the most cattle artifact, not one;
2. Metasploit, the host infiltration framework, and the web level is to know the creation of some good things in the woo (I may be bragging);
3. Some social work platforms, all good are hiding;
4. Hydra, blasting necessary;

Grab Bag Tool

1. Wireshark, grasping the bag must;
2. Tcpdump,linux the command line grab packet, the result can give Wireshark analysis;

Big Data Platform

1. Zoomeye, know that Chuang Yu open a web search engine, search components will know: Zoomeye (Zhong eye), can think of me in advertising;
2. Shodan, the foreigner open a search engine of Internet space, search the host equipment to know: Shodan–computer search engine;
3. Google,:)

See more yourself Kali Linux (old is: BackTrack).

Life Saving Recommendations: Skilled linux many command +vim.

My penetrating weapon