BeEF alternatives

Looking for a better tool, or simply want to learn about alternatives? There is typically more than one option.

Alternatives (by tag)

78

Alternative: Metasploit Framework

Metasploit is a framework that consists of tools to perform security assignments. It focuses on the offensive side of security and leverages exploit modules.

Project details

Metasploit Framework is written in Ruby.

Strengths

  • + More than 400 contributors
  • + More than 9000 stars
  • + Many maintainers
  • + The source code of this software is available
  • + Supported by a large company
  • + Well-known tool

Typical usage

  • penetration test
  • security assessment
  • vulnerability scanning

Metasploit Framework project page

64

Alternative: Pupy

Pupy is an open source remote administration and post-exploitation tool. It is mainly written in Python and works Androi, Linux, macOS, and Windows.

Project details

Pupy is written in Python.

Strengths

  • + The source code of this software is available

Typical usage

  • penetration test
  • security assessment

Pupy project page

64

Alternative: RouterSploit

RouterSploit is a framework to test exploitation of embedded devices. It can be used as part of penetrating testing assignments or security assessments.

Project details

RouterSploit is written in Python.

Strengths

  • + More than 25 contributors
  • + More than 4000 GitHub stars
  • + The source code of this software is available

Typical usage

  • penetration test
  • self-assessment
  • software testing
  • vulnerability scanning

RouterSploit project page

85

Alternative: Ruler

Ruler is a security tool that interacts with Exchange servers remotely. It uses either the MAPI/HTTP or RPC/HTTP protocol, with the goal to gain a remote shell.

Project details

Ruler is written in Golang.

Strengths

  • + The source code of this software is available

Typical usage

  • penetration test
  • security assessment

Ruler project page

96

Alternative: sqlmap

The sqlmap performs automatic SQL injection and can take over a database. It is a valued tool for pentesters and those who want to test their web applications.

85

Alternative: APT2 (apt2)

APT2 is a tool written by Adam Compton and Austin Lane to help pentesters automate mundane scanning tasks. It leverages scan results from Nexpose, Nessus, or Nm

APT2 stands for Automated Penetration Testing Toolkit.

APT2 performs a scan with Nmap or can import the results of a scan from Nexpose or Nessus. The processed results will be used in the second phase. This phase launches exploit and enumeration modules. It helps pentesters to automate assessments and tasks.

Suggested components to have installed: convert, dirb, hydra, java, john, ldapsearch, msfconsole, nmap, nmblookup, phantomjs, responder, rpcclient, secretsdump.py, smbclient, snmpwalk, sslscan, xwd

Project details

APT2 is written in Python.

Strengths

  • + The source code of this software is available

Typical usage

  • penetration test
  • security assessment

APT2 project page

60

Alternative: InstaRecon

InstaRecon is a security tool that can help with the reconnaissance phase of a penetration test. It can collect a number of data points with limited input.

Project details

InstaRecon is written in Python.

Strengths

  • + The source code of this software is available

Typical usage

  • penetration test
  • reconnaissance

InstaRecon project page

88

Alternative: OWTF (Offensive Web Testing Framework)

The OWTF project (Offensive Web Testing Framework) unites tools for penetrating testing. Most parts are written in Python.

OWTF is short for Offensive Web Testing Framework and it is one of the many OWASP projects to improve security.

Project details

OWTF is written in Python.

Strengths

  • + More than 25 contributors
  • + More than 500 GitHub stars
  • + The source code of this software is available

Typical usage

  • penetration test
  • security assessment

OWTF project page

56

Alternative: p0f

P0f is a security tool that utilizes passive traffic fingerprinting mechanisms to identify the systems behind any incidental TCP/IP communications.

This tool is a great addition to nmap, especially if that reveals not reliable data or none at all. Due to the passive way of working, it won't be detected nor influences any connection.

- Version 3 of p0f is a full rewrite
- The idea for p0f dates back to June 10, 2000
- Tool can run in foreground or as a daemon process

Common uses for p0f include reconnaissance during penetration tests; routine network monitoring; detection of unauthorized network interconnects in corporate environments; providing signals for abuse-prevention tools; and miscellaneous forensics.

Project details

Strengths

  • + Project is mature (10+ years)
  • + The source code of this software is available
  • + Well-known tool

p0f project page

78

Alternative: SearchSploit

Exploit-DB's CLI search tool to find any exploits from the database. The tool is written in shell script and maintained by Offensive Security.

This little utility can search for exploits and related data in the Exploit-DB.

Project details

SearchSploit is written in shell script.

Strengths

  • + Used language is shell script

Weaknesses

  • - Full name of author is unknown
  • - Unknown project license

Typical usage

  • information gathering

SearchSploit project page

78

Alternative: Sn1per

Sn1per is security scanner that can be used during a penetration test to enumerate and scan for vulnerabilities.

Project details

Sn1per is written in Python, shell script.

Strengths

  • + More than 10 contributors
  • + More than 1000 GitHub stars
  • + The source code of this software is available

Weaknesses

  • - Unknown project license

Typical usage

  • penetration test
  • reconnaissance

Sn1per project page