Mercer

BusPwn. BusPwn V1.0 is a powerful Modbus hacking framework designed for testing and exploiting vulnerabilities in Modbus-based systems commonly found in Industrial Control Systems (ICS) and Operational Technology (OT).

CyberStrike. AI-powered offensive security agent with 7,300+ actionable security skills. Autonomous pentesting powered by MITRE ATT&CK (2,000+ Atomic tests), CIS Benchmarks (1,500+ controls), OWASP, NIST. Lazy-loading, zero context pollution. Your AI red team.

OSWE-Notes. My OSWE notes (mostly on exploit writing and my helper scripts)

p4wned. Perforce security research and tools - CVE-2026-6043

shinysocks. A small, ultrafast SOCKS proxy server.

llvm-obfus. out-of-tree LLVM 21+ pass plugin for policy-driven IR obfuscation.

Outpacket. This cheatsheet maps common impacket workflows to their modern alternatives

optimizerNXT. The finest Windows Optimizer CLI

KSLDBYOVDARK. Abusing Some Defects in KSLD Ark driver

DrvEye. Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods BYOVD

KsDumper-11. A revival of the classic and legendary KsDumper

Maverick. Adaptix C2 agent using Crystal Palace PIC linker and PICO module system

kvc. KVC enables unsigned driver loading via DSE bypass (g_CiOptions patch, skci.dll hijack, SeCiCallbacks redirection) and PP/PPL manipulation for LSASS memory dumping on modern Windows with HVCI/VBS.

DumpGuard. Proof-of-Concept tool for extracting credential material from protected sessions on modern Windows systems.

KvcForensic. Windows/Linux LSA credential extractor for lsass.dmp minidumps. Targets Windows 11 24H2/25H2/26H1 and Windows Server 2025. Pure Win32, no DbgHelp, no dependencies. Extracts MSV, WDigest, Kerberos, CredMan, DPAPI. AES-CFB128 and 3DES-CBC decryption via BCrypt

Interceptor. Agent-driven Chrome extension for full browser control via CLI

graphthulhu. MCP server that gives AI full access to your Logseq or Obsidian knowledge graph. 39 tools for navigation, search, analysis, writing, decisions, journals, flashcards, and whiteboards.

awesome-claude-code. A hand-picked collection of the finest of resources for the most awesome of agents, Claude Code, the undisputed champion of coding companions, from the unstoppable team at Anthropic PBC. A delectable showcase of top tier skills, ambidextrous agents, scintillating status lines, top notch developer tooling, and also we have plugins

wmiexec2. wmiexec2.0 is the same wmiexec that everyone knows and loves (debatable). This 2.0 version is obfuscated to avoid well known signatures from various AV engines. It also has a handful of additional built in modules to help automate some common tasks on Red team engagements.

KslDump. KslDump — Why bring your own knife when Defender already left one in the kitchen?

claude-bug-bounty. AI-powered bug bounty hunting from your terminal - recon, 20 vuln classes, autonomous hunting, and report generation. All inside Claude Code.

burp-ai-agent. Burp Suite extension that adds built-in MCP tooling, AI-assisted analysis, privacy controls, passive and active scanning and more

SockTail. Lightweight binary that joins a device to a Tailscale network and exposes a local SOCKS5 proxy. Designed for red team operations and ephemeral access into restricted environments using Tailscale’s embedded client (tsnet). Zero config, no daemon, no persistence - just a fast way in.

win-x86-shellcoder. A tool for developing bad character-free shellcode to bypass DEP with WriteProcessMemory (32-bit only)

ropcatalog. Finding and classifying ROP gadgets from rp++ output file with some regex and a CLI.

claude-auto-resume. A shell script utility that automatically resumes Claude CLI tasks when usage limits are lifted.

Bloodhound-CustomQueries. Custom Queries - Brought Up to BH4.1 syntax

keycred. Generate and Manage KeyCredentialLinks

BloodHoundQueries. Python

scfw. A cross-platform C++ framework for building Windows shellcode

AzureADEnumeration. Microsoft Entra ID (Azure AD) Unauthenticated Enumeration

Huginn. C++

digler. Digler is a tool for forensic disk analysis and file recovery. It's designed to help you unearth lost or deleted data from various disk images and raw devices.

BusterCall. "Bypassing" HVCI via donor PFN swaps to modify read-only code pages. Call chained kernel functions (kCET and SLAT support), and more.

Invoke-SocksProxy. Socks proxy, and reverse socks server using powershell.

RelayKing-Depth. Dominate the domain. Relay to royalty.

Invoke-TheHash. PowerShell Pass The Hash Utils

alive2. Automatic verification of LLVM optimizations

IRvana. Slaying multi-language LLVM IR with obfuscation passes to achieve JIT execution

Extension-Kit. AdaptixFramework Extension Kit

fort. Fort Firewall for Windows

omni. A modern, mostly zero-allocation C++23 library for working with low-level Windows within user-space. Iteration over loaded modules via PEB, EAT iteration, lazy imports, syscalls, and more.

BetterGetProcAddress. POC of a better implementation of GetProcAddress for ntdll using binary search

BOF_ExecuteAssembly. Beacon Object File for Cobalt Strike that executes .NET assemblies in beacon with evasion techniques.

Moonwalk--. Moonwalk++: Simple POC Combining StackMoonwalking and Memory Encryption

SessionHop. Windows Session Hijacking via COM

PrivKit. PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.

Kharon-Mtc. C2 Agent fully PIC for Mythic with advanced evasion capabilities, dotnet/powershell/shellcode/bof memory executions, lateral moviments, pivot and more.

anvill. anvill forges beautiful LLVM bitcode out of raw machine code

pliron. An Extensible Compiler IR Framework

NotDec-llvm2c. Structures LLVM IR into C/C++.

rellic. Rellic produces goto-free C output from LLVM bitcode

EntraMFACheck. Identify Azure AD resources that issue tokens without MFA enforcement using the ROPC grant flow.

WSASS. This is the tool to dump the LSASS process on modern Windows 11

ntoskrnl. The Windows Research Kernel (WRK)

basekernel. A simple OS kernel for research, teaching, and fun.

NoPrompt. Python

EntraFalcon. A lightweight PowerShell tool for assessing the security posture of Microsoft Entra ID environments. It helps identify privileged objects, risky assignments, and potential misconfigurations.

ECUtilities. Powershell and python utilties for Entra Connect

MDExclusionParser. PowerShell script to quickly scan Event Log ID 5007 and 1121 for published Windows Defender Exclusions and Attack Surface Reduction (ASR) rule configuration.

CVE-2024-6387_Check. CVE-2024-6387_Check is a lightweight, efficient tool designed to identify servers running vulnerable versions of OpenSSH

regreSSHion. CVE-2024-6387 (regreSSHion) Exploit (PoC), a vulnerability in OpenSSH's server (sshd) on glibc-based Linux systems.

debugir. DebugIR: Debugging LLVM-IR Files

mssql-spider. Automated exploitation of MSSQL servers at scale

IRvana. IRvana is a Windows-focused LLVM IR exploration project for code execution, reverse engineering, and JIT testing. It streamlines IR for C, C++, Rust, Nim 🐙

go-recon. External recon toolkit

dittobytes. Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.

MasterHide. A x64 Windows Rootkit using SSDT or Hypervisor hook

WinVisor. WinVisor - A hypervisor-based emulator for Windows x64 user-mode executables using Windows Hypervisor Platform API

awesome-flipperzero. 🐬 A collection of awesome resources for the Flipper Zero device.

Ludus-MDE-MDI-Roles. Ludus roles to deploy ASR rules and MDI auditing settings

elfspirit. ELF static analysis and injection framework that parse, manipulate, patch and camouflage ELF files.

CVE-2025-33073. PoC Exploit for the NTLM reflection SMB flaw.

ioctlance. A tool that is used to hunt vulnerabilities in x64 WDM drivers

Hells-Hollow. Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls

obfus.h. Macro-header for compile-time C obfuscation (tcc, win x86/x64)

Crystal-Loaders. A small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike

LitterBox. A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

MemLoader. Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible

Ghidra-to-LLVM. A binary-to-LLVM IR lifter that leverages Ghidra's IR and analysis

llvm-ei. extensible interpreter for LLVM dynamic analyses

LLVMDynamicTools. An LLVM interpreter that aims to compute points-to sets dynamically

llvmlite. A lightweight LLVM python binding for writing JIT compilers

llvm-ir. LLVM IR in natural Rust data structures

CVE-2025-25257. FortiWeb CVE-2025-25257 exploit

SpeechRuntimeMove. Lateral Movement as loggedon User via Speech Named Pipe COM & ISpeechNamedPipe + COM Hijacking

AssemblyHunter. Find .net assemblies locally

ROP_ROCKET. ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Syscalls attack, a novel Heaven's Gate, and "shellcodeless" ROP. The framework utilizes emulation and obfuscation to help expand the attack surface.

NauthNRPC. Enumerate Domain Users Without Authentication

LdrShuffle. Code execution/injection technique using DLL PEB module structure manipulation

DLHell. Local & remote Windows DLL Proxying

GuidedHacking-Injector. The BEST DLL Injector Library.

Dll-Shellcode-Loader. Dll Shellcode Loader POC

evilrdp. Python

DonPAPI. Dumping DPAPI credz remotely

DCOMRunAs. Lateral movement with DCOM DLL hijacking

GPOZaurr. Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.

BitlockMove. Lateral Movement via Bitlocker DCOM interfaces & COM Hijacking

SignToolGUI. This tool is a user-friendly Graphical User Interface (GUI) tool that simplifies and streamlines the process of digitally signing files using Microsoft's signtool.exe. This tool is designed to provide a straightforward interface, enabling users to apply digital signatures to software executables, drivers, DLLs, and other file types effortlessly.

Generate_Linux_Kernel_Bitcode. Go

golem. Golem automates C/C++ vulnerability discovery with SemGrep+LLVM+LLM

VMwhere. LLVM based obfuscation engine

PipeViewer. A tool that shows detailed information about named pipes in Windows

PastDSE. DSE bypass using a leaked cert and adjusting the current clock.

SignatureKid. C++

ShadowHound. PowerShell scripts for alternative SharpHound enumeration, including users, groups, computers, and certificates, using the ActiveDirectory module (ADWS) or System.DirectoryServices class (LDAP).

SOAPHound. SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.

byor. Go

GPOwned. Buggy script to play with GPOs

GPOddity. The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).

OUned. The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning

SharpSuccessor. SharpSuccessor is a .NET Proof of Concept (POC) for fully weaponizing Yuval Gordon’s (@YuG0rd) BadSuccessor attack from Akamai.

exploits. A handy collection of my public exploits, all in one place.

PowerPUG. A tiny tool built to help AD Admins tame the Protected Users group.

WSL. Windows Subsystem for Linux

EvilentCoerce. Python

binaryen. Optimizer and compiler/toolchain library for WebAssembly

defendnot. An even funnier way to disable windows defender. (through WSC api)

RandomTSScripts. Collection of random RedTeam scripts.

ForsHops. ForsHops

SoaPy. SoaPy is a Proof of Concept (PoC) tool for conducting offensive interaction with Active Directory Web Services (ADWS) from Linux hosts.

AdaptixC2. AdaptixC2 is a highly modular advanced redteam toolkit

redteam-collab. Red Team Collaboration Infrastructure

Nimhawk. A powerful, modular, lightweight and efficient command & control framework written in Nim.

eavesarp-ng. Go

RemoteMonologue. Weaponizing DCOM for NTLM Authentication Coercions

Stifle. .NET Post-Exploitation Utility for Abusing Strong Explicit Certificate Mappings in ADCS

LLVM-On-iOS. Script to build LLVM and Clang projects for use in iOS app and example iOS app using LLVM to interpret C++ programs

BloodHound-MCP. Python

Loki. 🧙‍♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications

windows. Windows inside a Docker container.

eyeballer. Convolutional neural network for analyzing pentest screenshots

mcp-job-security. LLVM Pass to save Reverse Engineers from Automation

Mergen. Deobfuscation via optimization with usage of LLVM IR and parsing assembly.

ida-pro-mcp. AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

RamiGPT. Autonomous Privilege Escalation using AI

Ultimate-RAT-Collection. For educational purposes only, exhaustive samples of 500+ classic/modern trojan builders including screenshots.

impacket. Impacket is a collection of Python classes for working with network protocols.

TGSThief. My implementation of the GIUDA project in C++

SharpSpray. 域内密码喷射工具

kernel-callback-removal. kernel callback removal (Bypassing EDR Detections)

conpass. Continuous password spraying tool

cargo-xwin. Cross compile Cargo project to Windows MSVC target with ease

openai-agents-python. A lightweight, powerful framework for multi-agent workflows

BootExecuteEDR. C

ACLViewer. ACL Viewer for Windows

emscripten. Emscripten: An LLVM-to-WebAssembly Compiler

PowerChell. A PowerShell console in C/C++ with all the security features disabled

SQLRecon. A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

WID_LoadLibrary. Reverse engineering winapi function loadlibrary.

msftrecon. Python

RagingRotator. A tool for carrying out brute force attacks against Office 365, with built in IP rotation use AWS gateways.

TargetedTimeroast. Tamper Active Directory user attributes to collect their hashes with MS-SNTP

lemon. eBPF Memory Dump Tool

Invoke-ArgFuscator. Invoke-ArgFuscator is an open-source, cross-platform PowerShell module that helps generate obfuscated command-lines for common system-native executables.

sprayhound. Password spraying tool and Bloodhound integration

LLVM-Obfuscation-Experiments. C

earlycascade-injection. early cascade injection PoC based on Outflanks blog post

SharpADWS. Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS).

GPOHunter. A security assessment tool for analyzing Active Directory Group Policy Objects (GPOs) to identify misconfigurations and vulnerabilities

trust-validator. Validates priv escalation of AD trusts

godap. A complete terminal user interface (TUI) for LDAP.

APEX. Azure Post Exploitation Framework

Spyndicapped. COM ViewLogger — new malware keylogging technique

ldapx. Flexible LDAP proxy that can be used to inspect & transform all LDAP packets generated by other tools on the fly.

EagleVM. Native code virtualizer for x64 binaries

msldap. LDAP library for auditing MS AD

flyphish. Deploy a phishing infrastructure on the fly.

PIC-Library. A collection of position independent coding resources

retdec. RetDec is a retargetable machine-code decompiler based on LLVM.

gllvm. Whole Program LLVM: wllvm ported to go

whole-program-llvm. A wrapper script to build whole-program LLVM bitcode files

mcsema. Framework for lifting x86, amd64, aarch64, sparc32, and sparc64 program binaries to LLVM bitcode

PSXecute. MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.

KrakenMask. Sleep obfuscation

TokenCert. TokenCert

KernelCallbackTable-Injection-PoC. Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijack execution flow.

Exploit-Street. Complete list of LPE exploits for Windows (starting from 2023)

Carseat. Python implementation of GhostPack's Seatbelt situational awareness tool

ollvm-rust. out-of-tree llvm obfuscation pass plugin (dynamically loadable by rustc). || rust toolchain with obfuscation llvm pass.

ADCSKiller. An ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer

UwuRatel. Pink BRC4 skin/theme.

Cable. .NET post-exploitation toolkit for Active Directory reconnaissance and exploitation

ollvm17. Obfuscation LLVM 17

osintbuddy. Node graphs, OSINT data mining, and plugins. Connect unstructured and public data for transformative insights. The rewrite can be found @ osintbuddy/osintbuddy

vac-bypass-kernel. Fully working kernel-mode VAC bypass

adconnectdump. Dump Azure AD Connect credentials for Azure AD and Active Directory

awesome-password-spraying. Everything and anything related to password spraying

Misconfiguration-Manager. Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.

selene. Kernel-mode Paravirtualization in Ring 2, LLVM based linker, and some other things!

lsassdump. lsassdump via RtlCreateProcessReflection and NanoDump

NameSpi. An OSINT employee/username enumeration tool

Invoke-SessionHunter. Retrieve and display information about active user sessions on remote computers. No admin privileges required.

scylla. scylla.sh db dumps and more

pwned. A command-line tool for querying the 'Have I been pwned?' service.

cred1py. A Python POC for CRED1 over SOCKS5

Voidmaw. A new technique that can be used to bypass memory scanners. This can be useful in hiding problematic code (such as reflective loaders implemented by C2 beacons) or other problematic executables that will be flagged by the antimalware programs(such as mimikatz).

EDRenum-BOF. Identify common EDR processes, directories, and services. Simple BOF of Invoke-EDRChecker.

TelemetrySource.

GPUSleep. Move CS beacon to GPU memory when sleeping