Scanners-Box: 200+ Cybersecurity Tools Collection for Security

tags: [“cybersecurity”, “open-source”, “penetration-testing”, “tools”]{</* resource-info */>}

What is Scanners-Box? #

Scanners-Box is a curated collection of 200+ open-source cybersecurity tools for security professionals, penetration testers, and ethical hackers. Originally created for the Chinese security community (t00ls), it covers every aspect of cybersecurity from reconnaissance to exploitation.

GitHub: https://github.com/luckybbjason1/Scanners-Box
License: Open Source Collection
Tools Count: 200+
Categories: 15+

Tool Categories Overview #

Featured Tools Deep Dive #

1. Subdomain Enumeration #

OneForAll — The most comprehensive subdomain collection tool

• Integrates 20+ data sources
• Supports API keys for better results
• Export to various formats

amass — Go-based subdomain enumeration

• Fast and efficient
• DNS, scraping, and certificate transparency
• Graph visualization output

2. SQL Injection #

sqlmap — The king of SQL injection tools

• Automatic detection and exploitation
• Support for 6 database types
• Tamper scripts for WAF bypass

# Basic usage
sqlmap -u "http://target.com/page.php?id=1" --dbs

# Dump specific table
sqlmap -u "http://target.com/page.php?id=1" -D database -T users --dump

3. Fuzzing Frameworks #

AFL (American Fuzzy Lop) — Coverage-guided fuzzing

• Discovers vulnerabilities automatically
• Generates test cases
• Found 1000s of bugs in real software

syzkaller — Linux kernel fuzzer

• Found 3000+ Linux kernel bugs
• Used by Google, Microsoft
• Supports multiple operating systems

4. Port Scanning #

Nmap — The network scanner king

# Basic scan
nmap -sV -sC target.com

# Full port scan with scripts
nmap -p- -sV --script=vuln target.com

# Aggressive scan
nmap -A target.com

masscan — Fastest Internet port scanner

• Scan entire Internet in 6 minutes
• Compatible with Nmap
• Asynchronous transmission

5. Social Engineering Toolkit #

SET (Social-Engineer Toolkit) — Complete phishing framework

• Website cloning
• Email spear-phishing
• Credential harvesting
• Multi-attack vectors

evilginx2 — Bypass 2FA phishing framework

• Man-in-the-middle attack
• Session cookie capture
• Bypass two-factor authentication

Security Learning Resources #

For Beginners #

• sec-wiki — Security Wikipedia
• FreeBuf — Hacker and geek news
• Web Hacking 101 — Web security basics
• Kali Linux Web Pentest Cookbook

For Intermediate #

• Burpsuite实战指南 — Web penetration testing
• API-Security-Checklist — API security best practices
• Web-Security-Learning — Comprehensive web security
• 应急响应实战笔记 — Emergency response

Advanced Topics #

• Linux exploit development tutorial
• Android penetration testing
• Node.js Web security issues
• Python security series

Vulnerable Targets for Practice #

Responsible Disclosure #

⚠️ Warning: All tools listed here are for authorized security testing only. Using these tools against systems without explicit permission is illegal and unethical.

Legal Framework #

• CFAA (Computer Fraud and Abuse Act) — US
• Computer Misuse Act — UK
• Cybersecurity Law — China
• GDPR — EU data protection

Best Practices #

1. Always obtain written authorization
2. Define scope clearly
3. Respect business hours
4. Report findings promptly
5. Destroy data after testing

Tool Selection Guide #

Web Application Testing #

Reconnaissance: amass, subfinder, theHarvester
Scanning: Nmap, masscan, whatweb
Vulnerability: sqlmap, XSS scanners, dirsearch
Exploitation: Burp Suite, custom scripts
Reporting: Dradis, Faraday

Network Penetration Testing #

Discovery: Nmap, masscan, nbtscan
Enumeration: enum4linux, snmp-check
Vulnerability: OpenVAS, Nessus
Exploitation: Metasploit, Cobalt Strike
Post-exploitation: PowerShell Empire, Mimikatz

Red Team Operations #

Initial Access: SET, gophish, evilginx2
Persistence: Custom implants, scheduled tasks
Privilege Escalation: PowerUp, BeRoot
Lateral Movement: Pass-the-hash, Kerberoasting
Exfiltration: DNS tunneling, HTTPS C2

Related Articles #

• Agent Reach: AI Agent Internet Access — AI-powered security automation
• Free Claude Code: Open Source AI Coding — Secure coding practices

Disclaimer: This article is for educational purposes only. All tools should be used responsibly and only on systems you own or have explicit permission to test. The author and dibi8.com are not responsible for any misuse of the information provided.

Recommended Tools #

For developers building or deploying open-source AI tools, we recommend:

• DigitalOcean — $200 free credit for new users, 14+ global regions, one-click GPU/CPU droplets ideal for AI workloads.
• HTStack — Hong Kong VPS, same IDC that hosts dibi8.com. Self-host security scanners on dedicated VPS for low-latency Asia coverage and no shared-tenant noise.

Affiliate link — supports dibi8.com at no cost to you.

References & Sources #

• sqlmap
• Nmap
• masscan
• amass
• OneForAll
• AFL (American Fuzzy Lop)
• honggfuzz
• syzkaller
• SET (Social-Engineer Toolkit)
• gophish
• evilginx2
• RouterSploit
• theHarvester
• vulhub
• upload-labs
• DVWA
• WebGoat
• aircrack-ng
• fern-wifi-cracker
• subfinder
• API-Security-Checklist