Home

Awesome

Red Teaming Toolkit

This repository contains cutting-edge open-source security tools (OST) that will help you during adversary simulation and as information intended for threat hunter can make detection and prevention control easier. The list of tools below that could be potentially misused by threat actors such as APT and Human-Operated Ransomware (HumOR). If you want to contribute to this list send me a pull request.


Table of Contents


Reconnaissance

NameDescriptionURL
RustScanThe Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting engine (Python, Lua, Shell supported).https://github.com/RustScan/RustScan
AmassIn-depth Attack Surface Mapping and Asset Discoveryhttps://github.com/OWASP/Amass
gitleaksGitleaks is a SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repos.https://github.com/zricethezav/gitleaks
S3ScannerScan for open S3 buckets and dump the contentshttps://github.com/sa7mon/S3Scanner
cloud_enumMulti-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.https://github.com/initstring/cloud_enum
Recon-ngOpen Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.https://github.com/lanmaster53/recon-ng
busterAn advanced tool for email reconnaissancehttps://github.com/sham00n/buster
linkedin2usernameOSINT Tool: Generate username lists for companies on LinkedInhttps://github.com/initstring/linkedin2username
WitnessMeWeb Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.https://github.com/byt3bl33d3r/WitnessMe
pagodopagodo (Passive Google Dork) - Automate Google Hacking Database scraping and searchinghttps://github.com/opsdisk/pagodo
AttackSurfaceMapperAttackSurfaceMapper is a tool that aims to automate the reconnaissance process.https://github.com/superhedgy/AttackSurfaceMapper
SpiderFootSpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.https://github.com/smicallef/spiderfoot
dnscandnscan is a python wordlist-based DNS subdomain scanner.https://github.com/rbsec/dnscan
spoofcheckA program that checks if a domain can be spoofed from. The program checks SPF and DMARC records for weak configurations that allow spoofing.https://github.com/BishopFox/spoofcheck
LinkedIntLinkedIn Recon Toolhttps://github.com/vysecurity/LinkedInt
BBOTRecursive internet scanner inspired by Spiderfoot, but designed to be faster, more reliable, and friendlier to pentesters, bug bounty hunters, and developers.https://github.com/blacklanternsecurity/bbot
Gato (Github Attack TOolkit)Gato, or GitHub Attack Toolkit, is an enumeration and attack tool that allows both blue teamers and offensive security practitioners to identify and exploit pipeline vulnerabilities within a GitHub organization's public and private repositories.https://github.com/praetorian-inc/gato

Initial Access

Brute Force

NameDescriptionURL
SprayingToolkitScripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficienthttps://github.com/byt3bl33d3r/SprayingToolkit
o365reconRetrieve information via O365 with a valid credhttps://github.com/nyxgeek/o365recon
CredMasterRefactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttlinghttps://github.com/knavesec/CredMaster

Payload Development

NameDescriptionURL
IvyIvy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory.https://github.com/optiv/Ivy
PEzorOpen-Source PE Packerhttps://github.com/phra/PEzor
GadgetToJScriptA tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA scripts.https://github.com/med0x2e/GadgetToJScript
ScareCrowPayload creation framework designed around EDR bypass.https://github.com/optiv/ScareCrow
DonutDonut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.https://github.com/TheWover/donut
MystikalmacOS Initial Access Payload Generatorhttps://github.com/D00MFist/Mystikal
charlottec++ fully undetected shellcode launcher ;)https://github.com/9emin1/charlotte
InvisibilityCloakProof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project.https://github.com/xforcered/InvisibilityCloak
DendrobateDendrobate is a framework that facilitates the development of payloads that hook unmanaged code through managed .NET code.https://github.com/FuzzySecurity/Dendrobate
Offensive VBA and XLS EntanglementThis repo provides examples of how VBA can be used for offensive purposes beyond a simple dropper or shell injector. As we develop more use cases, the repo will be updated.https://github.com/BC-SECURITY/Offensive-VBA-and-XLS-Entanglement
xlsGenTiny Excel BIFF8 Generator, to Embedded 4.0 Macros in *.xlshttps://github.com/aaaddress1/xlsGen
darkarmourWindows AV Evasionhttps://github.com/bats3c/darkarmour
InlineWhispersTool for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)https://github.com/outflanknl/InlineWhispers
EvilClippyA cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.https://github.com/outflanknl/EvilClippy
OfficePurgeVBA purge your Office documents with OfficePurge. VBA purging removes P-code from module streams within Office documents.https://github.com/fireeye/OfficePurge
ThreatCheckIdentifies the bytes that Microsoft Defender / AMSI Consumer flags on.https://github.com/rasta-mouse/ThreatCheck
CrossC2Generate CobaltStrike's cross-platform payloadhttps://github.com/gloxec/CrossC2
RulerRuler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol.https://github.com/sensepost/ruler
DueDLLigenceShellcode runner framework for application whitelisting bypasses and DLL side-loading. The shellcode included in this project spawns calc.exe.https://github.com/fireeye/DueDLLigence
RuralBishopRuralBishop is practically a carbon copy of UrbanBishop by b33f, but all P/Invoke calls have been replaced with D/Invoke.https://github.com/rasta-mouse/RuralBishop
TikiTorchTikiTorch was named in homage to CACTUSTORCH by Vincent Yiu. The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, then uses CreateRemoteThread to run the desired shellcode within that target process. Both the process and shellcode are specified by the user.https://github.com/rasta-mouse/TikiTorch
SharpShooterSharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. SharpShooter is capable of creating payloads in a variety of formats, including HTA, JS, VBS and WSF.https://github.com/mdsecactivebreach/SharpShooter
SharpSploitSharpSploit is a .NET post-exploitation library written in C#https://github.com/cobbr/SharpSploit
MSBuildAPICallerMSBuild Without MSBuild.exehttps://github.com/rvrsh3ll/MSBuildAPICaller
macro_packmacro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of MS Office documents, VB scripts, and other formats for pentest, demo, and social engineering assessments.https://github.com/sevagas/macro_pack
inceptorTemplate-Driven AV/EDR Evasion Frameworkhttps://github.com/klezVirus/inceptor
mortarevasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)https://github.com/0xsp-SRD/mortar
ProtectMyToolingMulti-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.https://github.com/mgeeky/ProtectMyTooling
FreezeFreeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methodshttps://github.com/optiv/Freeze
ShhhloaderShhhloader is a work in progress shellcode loader. It takes raw shellcode as input and compiles a C++ stub that does a bunch of different things to try and bypass AV/EDRhttps://github.com/icyguider/Shhhloader

Delivery

Phishing

NameDescriptionURL
o365-attack-toolkitA toolkit to attack Office365https://github.com/mdsecactivebreach/o365-attack-toolkit
Evilginx2Evilginx2 is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service.https://github.com/kgretzky/evilginx2
GophishGophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.https://github.com/gophish/gophish
PwnAuthPwnAuth a web application framework for launching and managing OAuth abuse campaigns.https://github.com/fireeye/PwnAuth
ModlishkaModlishka is a flexible and powerful reverse proxy, that will take your ethical phishing campaigns to the next level.https://github.com/drk1wi/Modlishka

Watering Hole Attack

NameDescriptionURL
BeEFBeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browserhttps://github.com/beefproject/beef

Command and Control

Remote Access Tools (RAT)

NameDescriptionURL
Cobalt StrikeCobalt Strike is software for Adversary Simulations and Red Team Operations.https://cobaltstrike.com/
SpecterInsightSpecterInsight is a cross-platform, post-exploitation command and control framework based on .NET for red team engagements, threat emulation, and training. It provides a variety of obfuscated payloads out-of-the-box and makes avoiding detection a core feature. Command outout is returned in JSON format and exported to ELK for analysis of operations with pre-built dashboards.https://practicalsecurityanalytics.com/specterinsight/
Brute Ratel C4Brute Ratel is the most advanced Red Team & Adversary Simulation Software in the current C2 Market.https://bruteratel.com/
EmpireEmpire 5 is a post-exploitation framework that includes a pure-PowerShell Windows agent, and compatibility with Python 3.x Linux/OS X agents.https://github.com/BC-SECURITY/Empire
PoshC2PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.https://github.com/nettitude/PoshC2
KoadicKoadic C3 COM Command & Control - JScript RAThttps://github.com/zerosum0x0/koadic
merlinMerlin is a cross-platform post-exploitation Command & Control server and agent written in Go.https://github.com/Ne0nd0g/merlin
MythicA cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI.https://github.com/its-a-feature/Mythic
CovenantCovenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.https://github.com/cobbr/Covenant
shad0wA post exploitation framework designed to operate covertly on heavily monitored environmentshttps://github.com/bats3c/shad0w
SliverSliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS.https://github.com/BishopFox/sliver
SILENTTRINITYAn asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLRhttps://github.com/byt3bl33d3r/SILENTTRINITY
PupyPupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in pythonhttps://github.com/n1nj4sec/pupy
HavocHavoc is a modern and malleable post-exploitation command and control framework, created by @C5pider.https://github.com/HavocFramework/Havoc
NimPlantA light first-stage C2 implant written in Nim and Pythonhttps://github.com/chvancooten/NimPlant
SharpC2SharpC2 is a Command & Control (C2) framework written in C#. It consists of an ASP.NET Core Team Server, a .NET Framework implant, and a .NET MAUI client.https://github.com/rasta-mouse/SharpC2

Staging

NameDescriptionURL
pwndropSelf-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.https://github.com/kgretzky/pwndrop
C2concealerA command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.https://github.com/FortyNorthSecurity/C2concealer
FindFrontableDomainsSearch for potential frontable domainshttps://github.com/rvrsh3ll/FindFrontableDomains
Domain HunterChecks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain nameshttps://github.com/threatexpress/domainhunter
RedWardenFlexible CobaltStrike Malleable Redirectorhttps://github.com/mgeeky/RedWarden
AzureC2RelayAzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile.https://github.com/Flangvik/AzureC2Relay
C3C3 (Custom Command and Control) is a tool that allows Red Teams to rapidly develop and utilise esoteric command and control channels (C2).https://github.com/FSecureLABS/C3
ChameleonA tool for evading Proxy categorisationhttps://github.com/mdsecactivebreach/Chameleon
Cobalt Strike Malleable C2 Design and Reference GuideCobalt Strike Malleable C2 Design and Reference Guidehttps://github.com/threatexpress/malleable-c2/
redirect.rulesQuick and dirty dynamic redirect.rules generatorhttps://github.com/0xZDH/redirect.rules
CobaltBusCobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebushttps://github.com/Flangvik/CobaltBus
SourcePointSourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.https://github.com/Tylous/SourcePoint
RedGuardRedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.https://github.com/wikiZ/RedGuard
skyhookA round-trip obfuscated HTTP file transfer setup built to bypass IDS detections.https://github.com/blackhillsinfosec/skyhook
GraphStrikeCobalt Strike HTTPS beaconing over Microsoft Graph APIhttps://github.com/RedSiege/GraphStrike

Log Aggregation

NameDescriptionURL
RedELKRed Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.https://github.com/outflanknl/RedELK
Elastic for Red TeamingRepository of resources for configuring a Red Team SIEM using Elastic.https://github.com/SecurityRiskAdvisors/RedTeamSIEM
RedEyeRedEye is a visual analytic tool supporting Red & Blue Team operationshttps://github.com/cisagov/RedEye

Situational Awareness

Host Situational Awareness

NameDescriptionURL
AggressiveProxyAggressiveProxy is a combination of a .NET 3.5 binary (LetMeOutSharp) and a Cobalt Strike aggressor script (AggressiveProxy.cna). Once LetMeOutSharp is executed on a workstation, it will try to enumerate all available proxy configurations and try to communicate with the Cobalt Strike server over HTTP(s) using the identified proxy configurations.https://github.com/EncodeGroup/AggressiveProxy
GopherC# tool to discover low hanging fruitshttps://github.com/EncodeGroup/Gopher
SharpEDRCheckerChecks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensive products such as AV's, EDR's and logging tools.https://github.com/PwnDexter/SharpEDRChecker
Situational Awareness BOFThis Repo intends to serve two purposes. First it provides a nice set of basic situational awareness commands implemented in BOF.https://github.com/trustedsec/CS-Situational-Awareness-BOF
SeatbeltSeatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.https://github.com/GhostPack/Seatbelt
SauronEyeSauronEye is a search tool built to aid red teams in finding files containing specific keywords.https://github.com/vivami/SauronEye
SharpSharesMultithreaded C# .NET Assembly to enumerate accessible network shares in a domainhttps://github.com/mitchmoser/SharpShares
SharpAppLockerC# port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions.https://github.com/Flangvik/SharpAppLocker/
SharpPrinterPrinter is a modified and console version of ListNetworkshttps://github.com/rvrsh3ll/SharpPrinter

Domain Situational Awareness

NameDescriptionURL
StandInStandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET native solution to perform resource based constrained delegation.https://github.com/FuzzySecurity/StandIn
Recon-ADAn AD recon tool based on ADSI and reflective DLL’shttps://github.com/outflanknl/Recon-AD
BloodHoundSix Degrees of Domain Adminhttps://github.com/BloodHoundAD/BloodHound
PSPKIAuditPowerShell toolkit for auditing Active Directory Certificate Services (AD CS).https://github.com/GhostPack/PSPKIAudit
SharpViewC# implementation of harmj0y's PowerViewhttps://github.com/tevora-threat/SharpView
RubeusRubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 4.0 license) and Vincent LE TOUX's MakeMeEnterpriseAdmin project (GPL v3.0 license).https://github.com/GhostPack/Rubeus
nanorobeusA minimalistic tool for managing Kerberos tickets. Supports redteam frameworkshttps://github.com/wavvs/nanorobeus
GrouperA PowerShell script for helping to find vulnerable settings in AD Group Policy. (deprecated, use Grouper2 instead!)https://github.com/l0ss/Grouper
ImproHoundIdentify the attack paths in BloodHound breaking your AD tieringhttps://github.com/improsec/ImproHound
ADReconADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.https://github.com/adrecon/ADRecon
ADCSPwnA tool to escalate privileges in an active directory network by coercing authenticate from machine accounts (Petitpotam) and relaying to the certificate service.https://github.com/bats3c/ADCSPwn

Credential Dumping

NameDescriptionURL
MimikatzMimikatz is an open-source application that allows users to view and save authentication credentials like Kerberos tickets.https://github.com/gentilkiwi/mimikatz
DumpertLSASS memory dumper using direct system calls and API unhooking.https://github.com/outflanknl/Dumpert
CredBanditCredBandit is a proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel.https://github.com/xforcered/CredBandit
CloneVaultCloneVault allows a red team operator to export and import entries including attributes from Windows Credential Manager.https://github.com/mdsecactivebreach/CloneVault
SharpLAPSRetrieve LAPS password from LDAPhttps://github.com/swisskyrepo/SharpLAPS
SharpDPAPISharpDPAPI is a C# port of some DPAPI functionality from @gentilkiwi's Mimikatz project.https://github.com/GhostPack/SharpDPAPI
KeeThiefAllows for the extraction of KeePass 2.X key material from memory, as well as the backdooring and enumeration of the KeePass trigger system.https://github.com/GhostPack/KeeThief
SafetyKatzSafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader.https://github.com/GhostPack/SafetyKatz
forkatzcredential dump using forshaw technique using SeTrustedCredmanAccessPrivilegehttps://github.com/Barbarisch/forkatz
PPLKillerTool to bypass LSA Protection (aka Protected Process Light)https://github.com/RedCursorSecurityConsulting/PPLKiller
LaZagneThe LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer.https://github.com/AlessandroZ/LaZagne
AndrewSpecialAndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.https://github.com/hoangprod/AndrewSpecial
Net-GPPPassword.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.https://github.com/outflanknl/Net-GPPPassword
SharpChromium.NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.https://github.com/djhohnstein/SharpChromium
ChloniumChlonium is an application designed for cloning Chromium Cookies.https://github.com/rxwx/chlonium
SharpCloudSharpCloud is a simple C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.https://github.com/chrismaddalena/SharpCloud
pypykatzMimikatz implementation in pure Python. At least a part of it :)https://github.com/skelsec/pypykatz
nanodumpA Beacon Object File that creates a minidump of the LSASS process.https://github.com/helpsystems/nanodump
KohKoh is a C# and Beacon Object File (BOF) toolset that allows for the capture of user credential material via purposeful token/logon session leakage.https://github.com/GhostPack/Koh
PPLBladeProtected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk.https://github.com/tastypepperoni/PPLBlade
TrickDumpDump lsass using only NTAPIS running 3 programs to create 3 JSON and 1 ZIP file... and generate the Minidump later!https://github.com/ricardojoserf/TrickDump

Privilege Escalation

NameDescriptionURL
ElevateKitThe Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike's Beacon payload.https://github.com/rsmudge/ElevateKit
WatsonWatson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.https://github.com/rasta-mouse/Watson
SharpUpSharpUp is a C# port of various PowerUp functionality. Currently, only the most common checks have been ported; no weaponization functions have yet been implemented.https://github.com/GhostPack/SharpUp
dazzleUPA tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems. dazzleUP detects the following vulnerabilities.https://github.com/hlldz/dazzleUP
PEASSPrivilege Escalation Awesome Scripts SUITE (with colors)https://github.com/carlospolop/PEASS-ng
SweetPotatoA collection of various native Windows privilege escalation techniques from service accounts to SYSTEMhttps://github.com/CCob/SweetPotato
MultiPotatoAnother Potato to get SYSTEM via SeImpersonate privilegeshttps://github.com/S3cur3Th1sSh1t/MultiPotato
KrbRelayUpa universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).https://github.com/Dec0ne/KrbRelayUp
GodPotatoAs Long as You Have the ImpersonatePrivilege Permission, Then You are the SYSTEM!https://github.com/BeichenDream/GodPotato
PrivKitPrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.https://github.com/mertdas/PrivKit

Defense Evasion

NameDescriptionURL
RefleXXionRefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc.https://github.com/hlldz/RefleXXion
EDRSandBlastEDRSandBlast is a tool written in C that weaponize a vulnerable signed driver to bypass EDR detections (Kernel callbacks and ETW TI provider) and LSASS protections.https://github.com/wavestone-cdt/EDRSandblast
unDefenderKilling your preferred antimalware by abusing native symbolic links and NT paths.https://github.com/APTortellini/unDefender
BackstabA tool to kill antimalware protected processeshttps://github.com/Yaxser/Backstab
SPAWN - Cobalt Strike BOFCobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.https://github.com/boku7/spawn
BOF.NET - A .NET Runtime for Cobalt Strike's Beacon Object FilesBOF.NET is a small native BOF object combined with the BOF.NET managed runtime that enables the development of Cobalt Strike BOFs directly in .NET. BOF.NET removes the complexity of native compilation along with the headaches of manually importing native API.https://github.com/CCob/BOF.NET
NetLoaderLoads any C# binary from filepath or url, patching AMSI and bypassing Windows Defender on runtimehttps://github.com/Flangvik/NetLoader
FindObjects-BOFA Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.https://github.com/outflanknl/FindObjects-BOF
SharpUnhookerC# Based Universal API Unhooker - Automatically Unhook API Hives (ntdll.dll,kernel32.dll,user32.dll,advapi32.dll,and kernelbase.dll).https://github.com/GetRektBoy724/SharpUnhooker
EvtMuteApply a filter to the events being reported by windows event logginghttps://github.com/bats3c/EvtMute
InlineExecute-AssemblyInlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly modulehttps://github.com/xforcered/InlineExecute-Assembly
Phant0mWindows Event Log Killerhttps://github.com/hlldz/Phant0m
SharpBlockA method of bypassing EDR's active projection DLL's by preventing entry point execution.https://github.com/CCob/SharpBlock
NtdllUnpatcherExample code for EDR bypassing, please use this for testing blue team detection capabilities against this type of malware that will bypass EDR's userland hooks.https://github.com/Kharos102/NtdllUnpatcher
DarkLoadLibraryLoadLibrary for offensive operations.https://github.com/bats3c/DarkLoadLibrary
BlockETW.Net 3.5 / 4.5 Assembly to block ETW telemetry in a processhttps://github.com/Soledge/BlockEtw
firewalkerThis repo contains a simple library which can be used to add FireWalker hook bypass capabilities to existing codehttps://github.com/mdsecactivebreach/firewalker
KillDefenderBOFBeacon Object File PoC implementation of KillDefenderhttps://github.com/Cerbersec/KillDefenderBOF
MangleMangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRshttps://github.com/optiv/Mangle
AceLdrCobalt Strike UDRL for memory scanner evasion.https://github.com/kyleavery/AceLdr
AtomLdrCA DLL loader with advanced evasive featureshttps://github.com/NUL0x4C/AtomLdr
Inline-Execute-PEExecute unmanaged Windows executables in CobaltStrike Beaconshttps://github.com/Octoberfest7/Inline-Execute-PE
SigFlipSigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.https://github.com/med0x2e/SigFlip
Blackoutkill anti-malware protected processes (BYOVD)https://github.com/ZeroMemoryEx/Blackout
ShellGhostA memory-based evasion technique which makes shellcode invisible from process start to end.https://github.com/lem0nSec/ShellGhost
PoolPartyBofA beacon object file implementation of PoolParty Process Injection Technique by @SafeBreach and @0xDeku, that abuses Windows Thread Pools.https://github.com/0xEr3bus/PoolPartyBof
EDRSilencerA tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the serverhttps://github.com/netero1010/EDRSilencer

Persistence

NameDescriptionURL
SharpStay.NET project for installing Persistencehttps://github.com/0xthirteen/SharpStay
SharPersistWindows persistence toolkit written in C#.https://github.com/fireeye/SharPersist
SharpHideTool to create hidden registry keys.https://github.com/outflanknl/SharpHide
DoUCMeThis leverages the NetUserAdd Win32 API to create a new computer account. This is done by setting the usri1_priv of the USER_INFO_1 type to 0x1000.https://github.com/Ben0xA/DoUCMe
A Black Path Toward The Sun(TCP tunneling over HTTP for web application servers)https://github.com/nccgroup/ABPTTS
pivotnacciA tool to make socks connections through HTTP agentshttps://github.com/blackarrowsec/pivotnacci
reGeorgThe successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.https://github.com/sensepost/reGeorg
DAMPThe Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification.https://github.com/HarmJ0y/DAMP
IIS-RaidA native backdoor module for Microsoft IIS (Internet Information Services)https://github.com/0x09AL/IIS-Raid
SharPyShelltiny and obfuscated ASP.NET webshell for C# web applicationshttps://github.com/antonioCoco/SharPyShell
ScheduleRunnerA C# tool with more flexibility to customize scheduled task for both persistence and lateral movement in red team operationhttps://github.com/netero1010/ScheduleRunner
SharpEventPersistPersistence by writing/reading shellcode from Event Loghttps://github.com/improsec/SharpEventPersist
KrakenKraken, a modular multi-language webshell coded by @secu_x11.https://github.com/kraken-ng/Kraken
HiddenDesktopHVNC for Cobalt Strikehttps://github.com/WKL-Sec/HiddenDesktop

Lateral Movement

NameDescriptionURL
Liquid SnakeLiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScripthttps://github.com/RiccardoAncarani/LiquidSnake
PowerUpSQLA PowerShell Toolkit for Attacking SQL Serverhttps://github.com/NetSPI/PowerUpSQL
SQLReconA C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.https://github.com/skahwah/SQLRecon
SCShellFileless lateral movement tool that relies on ChangeServiceConfigA to run commandhttps://github.com/Mr-Un1k0d3r/SCShell
SharpRDPRemote Desktop Protocol Console Application for Authenticated Command Executionhttps://github.com/0xthirteen/SharpRDP
MoveKitMovekit is an extension of built in Cobalt Strike lateral movement by leveraging the execute_assembly function with the SharpMove and SharpRDP .NET assemblies.https://github.com/0xthirteen/MoveKit
SharpNoPSExecFile less command execution for lateral movement.https://github.com/juliourena/SharpNoPSExec
Responder/MultiRelayLLMNR/NBT-NS/mDNS Poisoner and NTLMv1/2 Relay.https://github.com/lgandx/Responder
impacketImpacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.https://github.com/SecureAuthCorp/impacket
FarmerFarmer is a project for collecting NetNTLM hashes in a Windows domain.https://github.com/mdsecactivebreach/Farmer
CIMplantC# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session.https://github.com/FortyNorthSecurity/CIMplant
PowerLessShellPowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. You can also execute raw shellcode using the same approach.https://github.com/Mr-Un1k0d3r/PowerLessShell
SharpGPOAbuseSharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.https://github.com/FSecureLABS/SharpGPOAbuse
kerbruteA tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authenticationhttps://github.com/ropnop/kerbrute
mssqlproxymssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reusehttps://github.com/blackarrowsec/mssqlproxy
Invoke-TheHashPowerShell Pass The Hash Utilshttps://github.com/Kevin-Robertson/Invoke-TheHash
InveighZero.NET IPv4/IPv6 machine-in-the-middle tool for penetration testershttps://github.com/Kevin-Robertson/InveighZero
SharpSpraySharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike.https://github.com/jnqpblc/SharpSpray
CrackMapExecA swiss army knife for pentesting networkshttps://github.com/byt3bl33d3r/CrackMapExec
SharpAllowedToActA C# implementation of a computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity) based on the research by @elad_shamir.https://github.com/pkb1s/SharpAllowedToAct
SharpRDPHijackSharp RDP Hijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessionshttps://github.com/bohops/SharpRDPHijack
CheeseToolsThis repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them.https://github.com/klezVirus/CheeseTools
LatLoaderPoC module to demonstrate automated lateral movement with the Havoc C2 framework.https://github.com/icyguider/LatLoader
SharpSpraySharpSpray is a Windows domain password spraying tool written in .NET C#.https://github.com/iomoath/SharpSpray
MalSCCMThis tool allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage.https://github.com/nettitude/MalSCCM
CoercerA python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 9 methods.https://github.com/p0dalirius/Coercer
SharpSploitSharpSploit is a .NET post-exploitation library written in C# that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers.https://github.com/cobbr/SharpSploit
orpheusBypassing Kerberoast Detections with Modified KDC Options and Encryption Typeshttps://github.com/trustedsec/orpheus

Tunneling

NameDescriptionURL
ChiselChisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server.https://github.com/jpillora/chisel
frpfrp is a fast reverse proxy that allows you to expose a local server located behind a NAT or firewall to the Internet.https://github.com/fatedier/frp
ligolo-ngAn advanced, yet simple, tunneling tool that uses a TUN interface.https://github.com/nicocha30/ligolo-ng

Exfiltration

NameDescriptionURL
SharpExfiltrateModular C# framework to exfiltrate loot over secure and trusted channels.https://github.com/Flangvik/SharpExfiltrate
DNSExfiltratorData exfiltration over DNS request covert channelhttps://github.com/Arno0x/DNSExfiltrator
Egress-AssessEgress-Assess is a tool used to test egress data detection capabilities.https://github.com/FortyNorthSecurity/Egress-Assess
VeilTransferVeilTransfer is a data exfiltration utility designed to test and enhance the detection capabilities. This tool simulates real-world data exfiltration techniques used by advanced threat actors, allowing organizations to evaluate and improve their security posture.https://github.com/infosecn1nja/VeilTransfer

Miscellaneous

Threat-informed Defense

NameDescriptionURL
Tidal CyberTidal Cyber helps enterprise organizations to define, measure, and improve their defenses to address the adversary behaviors that are most important to them.https://app.tidalcyber.com
Control Validation CompassThreat modeling aide & purple team content repository, pointing security & intelligence teams to 10,000+ publicly-accessible technical and policy controls and 2,100+ offensive security tests, aligned with nearly 600 common attacker techniqueshttps://controlcompass.github.io

Cloud

Amazon Web Services (AWS)

NameDescriptionURL
pacuThe AWS exploitation framework, designed for testing the security of Amazon Web Services environments.https://github.com/RhinoSecurityLabs/pacu
CloudMapperCloudMapper helps you analyze your Amazon Web Services (AWS) environments.https://github.com/duo-labs/cloudmapper
Enumerate IAM permissionsEnumerate the permissions associated with AWS credential sethttps://github.com/andresriancho/enumerate-iam

Azure

NameDescriptionURL
Azure AD Connect password extractionThis toolkit offers several ways to extract and decrypt stored Azure AD and Active Directory credentials from Azure AD Connect servers.https://github.com/fox-it/adconnectdump
Storm SpotterAzure Red Team tool for graphing Azure and Azure Active Directory objectshttps://github.com/Azure/Stormspotter
ROADtoolsThe Azure AD exploration framework.https://github.com/dirkjanm/ROADtools
MicroBurst: A PowerShell Toolkit for Attacking AzureA collection of scripts for assessing Microsoft Azure securityhttps://github.com/NetSPI/MicroBurst
AADInternalsAADInternals PowerShell module for administering Azure AD and Office 365https://github.com/Gerenios/AADInternals
TeamFiltrationTeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.https://github.com/Flangvik/TeamFiltration
MAAD Attack FrameworkAn attack tool for simple, fast & effective security testing of M365 & Azure AD.https://github.com/vectra-ai-research/MAAD-AF
GraphRunnerA Post-exploitation Toolset for Interacting with the Microsoft Graph APIhttps://github.com/dafthack/GraphRunner/
ADOKitADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST APIhttps://github.com/xforcered/ADOKit
TokenTacticsAzure JWT Token Manipulation Toolsethttps://github.com/rvrsh3ll/TokenTactics
MaestroMaestro is a post-exploitation tool designed to interact with Intune/EntraID from a C2 agent on a user’s workstation without requiring knowledge of the user’s password or Azure authentication flows, token manipulation, and web-based administration console.https://github.com/Mayyhem/Maestro

Adversary Emulation

NameDescriptionURL
Stratus Red TeamStratus Red Team is "Atomic Red Team™" for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained manner.https://github.com/DataDog/stratus-red-team
Prelude OperatorA Platform for Developer-first advanced security· Defend your organization by mimicking real adversarial attacks.https://www.preludesecurity.com/products/operator
Prelude BuildAn open source IDE for authoring, testing, and verifying production-ready security tests..https://www.preludesecurity.com/products/build
CalderaAn automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks.https://github.com/mitre/caldera
APTSimulatorA Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.https://github.com/NextronSystems/APTSimulator
Atomic Red TeamSmall and highly portable detection tests mapped to the Mitre ATT&CK Framework.https://github.com/redcanaryco/atomic-red-team
Network Flight Simulatorflightsim is a lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.https://github.com/alphasoc/flightsim
MettaA security preparedness tool to do adversarial simulation.https://github.com/uber-common/metta
Red Team Automation (RTA)RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.https://github.com/endgameinc/RTA
TTPForgeThe TTPForge is a Framework created to facilitate the development, automation, and execution of Tactics, Techniques, and Procedures (TTPs).https://github.com/facebookincubator/TTPForge

Living Off the Living Off the Land

NameDescriptionURL
Living Off The Land DriversLiving Off The Land Drivers is a curated list of Windows drivers used by adversaries to bypass security controls and carry out attackshttps://www.loldrivers.io/
GTFOBinsGTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systemshttps://gtfobins.github.io
LOLBASThe goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniqueshttps://lolbas-project.github.io/
Living Off Trusted Sites (LOTS) ProjectAttackers are using popular legitimate domains when conducting phishing, C&C, exfiltration and downloading tools to evade detection. The list of websites below allow attackers to use their domain or subdomainhttps://lots-project.com
FilesecStay up-to-date with the latest file extensions being used by attackers.https://filesec.io/
LOOBinsLiving Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in macOS binaries and how they can be used by threat actors for malicious purposes.https://www.loobins.io/
WTFBinsWTFBin(n): a binary that behaves exactly like malware, except, somehow, it's not? This project aims to catalogue benign applications that exhibit suspicious behavior. These binaries can emit noise and false positives in threat hunting and automated detections.https://wtfbins.wtf/
Hijack LibsThis project provides an curated list of DLL Hijacking candidateshttps://hijacklibs.net

Red Team Scripts

NameDescriptionURL
RedTeamCCodeRed Team C code repohttps://github.com/Mr-Un1k0d3r/RedTeamCCode
EDRsThis repo contains information about EDRs that can be useful during red team exercise.https://github.com/Mr-Un1k0d3r/EDRs
Cobalt Strike Community KitCommunity Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike.https://cobalt-strike.github.io/community_kit/

Red Team Infrastructure

NameDescriptionURL
Red Team Infrastructure WikiWiki to collect Red Team infrastructure hardening resourceshttps://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki

DevOps

NameDescriptionURL
NemesisNemesis is an offensive data enrichment pipeline and operator support system.https://github.com/SpecterOps/Nemesis

Reporting & Tracking

NameDescriptionURL
GhostwriterGhostwriter is a Django-based web application designed to be used by an individual or a team of red team operators.https://github.com/GhostManager/Ghostwriter
VECTRVECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarioshttps://github.com/SecurityRiskAdvisors/VECTR
PurpleOpsAn open-source self-hosted purple team management web application.https://github.com/CyberCX-STA/PurpleOps

Threat Intelligence

NameDescriptionURL
APT REPORTInteresting APT Report Collection And Some Special IOChttps://github.com/blackorbird/APT_REPORT
Awesome Threat IntelligenceA curated list of Awesome Threat Intelligence resourceshttps://github.com/hslatman/awesome-threat-intelligence
deepdarkCTICollection of Cyber Threat Intelligence sources from the deep and dark webhttps://github.com/fastfire/deepdarkCTI
CTI DashboardStay informed about cybersecurity threats in real time! Access a variety of threat intelligence vendor reports and useful resources all in one place.https://start.me/p/wMrA5z/cyber-threat-intelligence

License

CC0

To the extent possible under law, Rahmat Nurfauzi "@infosecn1nja" has waived all copyright and related or neighboring rights to this work.