Cody Thomas

Mythic. A collaborative, multi-platform, red teaming framework

offensive_macos. Tracking of offensive macOS tooling, blogs, and related helpful information

bifrost. Objective-C library and console to interact with Heimdal APIs for macOS Kerberos

Orchard. JavaScript for Automation (JXA) tool to do Active Directory enumeration.

LockSmith. ObjectiveC CLI tool for interacting with macOS Keychain

HealthInspector. JXA situational awareness helper by simply reading specific files on a filesystem

macos_execute_from_memory. PoC of macho loading from memory

dylibHijackScanner. Objective C dylibHijackScanner and analysis tool

KeytabParser. Python script to parse Keytab files for macOS or *nix (typically /etc/krb5.keytab)

awesome-osx-command-line. Use your OS X terminal shell to do awesome things.

macos-popups. Catalog Red Team techniques that cause popups in various macOS versions

loginItemManipulator. Objective-C

macOSCameraCapture. Simple CLI utility to save off an image from every webcam hooked into a mac

Red-Teaming-Toolkit. A collection of open source and commercial tools that aid in red team operations.

CursedChrome. Chrome-extension implant that turns victim Chrome browsers into fully-functional HTTP proxies, allowing you to browse sites as your victims.

smbdoor. Windows kernel backdoor via registering a malicious SMB handler

ReflectiveLoader. A Reflective Loader for macOS

build-your-own-x. 🤓 Build your own (insert technology here)

p0wnedShell. PowerShell Runspace Post Exploitation Toolkit

website. Personal blog on security

Tokenvator. A tool to elevate privilege with Windows Tokens

ClickOnceGenerator. Quick Malicious ClickOnceGenerator for Red Team

Bella. A pure python, post-exploitation, data mining tool and remote administration tool for macOS.

Empire. Empire is a PowerShell and Python post-exploitation agent.

CodeExecutionOnWindows. A list of ways to execute code on Windows using legitimate Windows tools

WheresMyImplant. C#

Misc-Powershell-Scripts. Random Tools

atomic-red-team. Small and highly portable detection tests.

ProcessHider. Post-exploitation tool for hiding processes from monitoring applications

overview. Overview stats for its-a-feature repositories

DNSExfiltrator. Data exfiltration over DNS request covert channel

koadic. Koadic C3 COM Command & Control - JScript RAT

PSAttack. A portable console aimed at making pentesting with PowerShell a little easier.

PoshC2. A proxy aware C2 framework used to aid red teamers with post-exploitation and lateral movement.

EvilOSX. A pure python, post-exploitation, RAT (Remote Administration Tool) for macOS / OSX.

LOLBAS. Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

nextnet. nextnet is a pivot point discovery tool written in Go.

Invoke-PSImage. Embeds a PowerShell script in the pixels of a PNG file and generates a oneliner to execute

DAMP. The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification

MailSniper. MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an administrator to search the mailboxes of every user in a domain.

gcat. A PoC backdoor that uses Gmail as a C&C server

mayhem. Runtime Process Manipulation

Red-Baron. Automate creating resilient, disposable, secure and agile infrastructure for Red Teams.

TCC-ClickJacking. A proof of concept for a clickjacking attack on macOS.

Infosec_Reference. An Information Security Reference That Doesn't Suck

Internal-Monologue. Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

RottenPotatoNG. New version of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools.

DotNetToJScript. A tool to create a JScript file which loads a .NET v2 assembly from memory.

gscript. Scriptable dynamic runtime execution of malware

monkey. Infection Monkey - An automated pentest tool

PrintTCCdb. JXA script for Mythic that prints the TCC.db

aquatone. A Tool for Domain Flyovers

rev-proxy-grapher. Reverse proxy grapher

Grouper. A PowerShell script for helping to find vulnerable settings in AD Group Policy.

sRDI. Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

electroniz3r. Take over macOS Electron apps' TCC permissions