> For the complete documentation index, see [llms.txt](https://f1shh.gitbook.io/pentest-tips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1shh.gitbook.io/pentest-tips/readme.md).

# ABOUT

![The Physical Notebook This Is Based On](/files/KfEsVk0AmUHSkCJEsdiH)

This book as a collection of useful commands and techniques that I find useful when penetration testing. This repository is synced to my personal Penetration Testing notebook. This repository also contains several penetration testing scripts that I wrote. Those scripts will not be visible from the GitBook, but feel free to visit my GitHub if you are interested.

Please keep in mind that this single repository is posted in a few different locations. My website, Github, and Gitbook. If there are some notes that seem odd, self referential, or redundant, please keep that in mind.

* **GitBook:** <https://f1shh.gitbook.io/pentest-tips/>
* **GitHub:** <https://github.com/F1shh-sec/Pentest-Scripts/>
* **Check out my website:** <https://f1shh.dev/>

![TryHackMe](https://tryhackme-badges.s3.amazonaws.com/f1shh.png)

## Penetration Testing Scripts

### Web Bruteforcer

[Download Here](https://raw.githubusercontent.com/F1shh-sec/Pentest-Scripts/main/scripts/WebBruteforce.go)

Script to brute force web credentials. Can take in cookie and header parameters. Can also be easily configured to make either a post or get request. Implements concurrency, so you may get rate limited when using this tool. You may want to go with a more robust tool such as [Hydra](https://f1shh.gitbook.io/pentest-tips/web/web) or [Burpsuite](https://f1shh.gitbook.io/pentest-tips/web/burp) for more advanced brute-forcing. A guide to use those tools is conveniently included in this repository.

### install.sh

[Download Here](https://raw.githubusercontent.com/F1shh-sec/Pentest-Scripts/main/scripts/install.sh)

Install.sh is a script that I use to bootstrap the [TryHackMe](https://tryhackme.com/) AttackBox. It installs common scripts and programs that are *not installed by default.* The TryHackMe AttackBox already comes with a ton of useful tools, so this is by no means a comprehensive pen-testing tool bootstrap script.

### linkScrape.py

[Download Here](https://github.com/F1shh-sec/Pentest-Scripts/blob/main/scripts/LinkScrape.py)

Script to grab all links on a webpage using python requests and BeautifulSoup.