Toolset Overview

OSINT & Recon

i2 Analyst's Notebook

• Paid

S3 Buckets: https://github.com/mxm0z/awesome-sec-s3

Opsec http://grugq.github.io/

Satellites and GeoSpatial OSINT

https://shadowbreakintl.com/ - $15 for any square kilo of satellite imagery (task for images they dont have)

https://soar.earth/ - merges drone shots with satellites

https://liveuamap.com/ - provides real-time incident aggregation data from around the world

Internal Pentesting

https://info.varonis.com/hubfs/docs/whitepapers/en/ebook_pen_testing_031317.pdf?submissionGuid=af8d5b95-8b40-4f86-baa0-944bf9cf4900

https://www.trustwave.com/Resources/SpiderLabs-Blog/Top-Five-Ways-SpiderLabs-Got-Domain-Admin-on-Your-Internal-Network/

Mobile Testing

Scanning & Reporting

Mobile Security Framework

• Android (Dynamic/Static) & iOS (Static) Analysis with vulnerability reports.
• Lacks on the iOS side - doesn't show exact locations of reported issues.
• Tool-author udemy course HERE

Bluemix

• 10 free scans with vulnerability report.
• App-specific mobile testing documentation HERE

idbtool

• Open source

Codified Security

• Fricken awesome tool - however, expensive. Better use corperate $ for it.
• Note, false positives have been reported

ostorlab

• Not yet tried

Reverse Engineering & Analysis

• IDA Pro
• ImmunityDebugger - Dynamic
• Ollydbg - Dynamic
• Online Disassembler
• Hopper Disassembler - Static
  • Demo has time limit