n3t1nv4d3

OSEPlayground. A collection of useful tools and scripts were developed and gathered throughout the Offensive Security's PEN-300 (OSEP) course.

RedTeam-Arsenal. Red Team Arsenal - a comprehensive collection of tools, scripts, and techniques for conducting red team operations and adversary simulations, including custom beacons, malleable C2 profiles, aggressor scripts, advanced payload generation methods, as well as other evasion tools, tailored for red team operations and security research.

CLR-Unhook. Modern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory .NET assembly loads. This tool unhooks that function.

PentestGPT. Automated Penetration Testing Agentic Framework Powered by Large Language Models

vuln-bank. A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn pentesting and secure coding practices.

DirtyLittleDotNetHooker. Find .Net Functions to use with Frida and Fermion

koneko. Robust Cobalt Strike shellcode loader with multiple advanced evasion features

ad-lab-scripts. A modular Active Directory lab builder for hands-on penetration testing and security research in isolated environments.

Damn-Vulnerable-RESTaurant-API-Game. Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers.

Clio. Logging tool intended for red team usage

DSViper. This is for Ethical Use only. The default automated binaries created are all burned. I have added the script to the repo to modify certain signatures and it will still work.

skidstorm. C

My-starred-Repositories. This is my starred repositories including the description for each tool. Makes search/filter over them easier.

CTF-toolBox. PowerShell & Python tools developed for CTFs and certification exams

Serenity. C# DInvoke Shellcode Runner

Stifle. .NET Post-Exploitation Utility for Abusing Strong Explicit Certificate Mappings in ADCS

OSCP-Resources. A comprehensive collection of resources, tools, tips, and guides for preparing and succeeding in the OSCP (Offensive Security Certified Professional) certification.

telco-f1nd3r. Python

all-the-things. Python

TermHound. Python

sitedorks. Search Google/Bing/Ecosia/DuckDuckGo/Yandex/Yahoo for a search term (dork) with a default set of websites, bug bounty programs or custom collection.

hm-surf. macOS CVE-2024-44133 evaluator of popular browsers

Active-Directory-Exploitation-Cheat-Sheet. A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

MicroBurst. A collection of scripts for assessing Microsoft Azure security

PowerUpSQL. PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server

Conferences. Conference presentation slides

spoofdpi. Simple and fast anti-censorship tool written in Go

C2_INFRA_WORKSHOP_DEFCON32_RED_TEAM_VILLAGE. C2 Infrastructure Automation

OST-C2-Spec. Open Source C&C Specification

bf-aws-permissions. Shell

BadLister. Deny list generator for password filters

Invoke-DumpMDEConfig. PowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges required )

UltraDolphin. An inaudible attack vector for voice operated LLMs, Siri, Alexa etc.

nmap-did-what. Nmap Dashboard Mini Project

Evilginx-Phishing-Infra-Setup. Evilginx Phishing Infrastructure Setup Guide - Securing Evilginx and Gophish Infrastructure, Removing IOCs, Phishing TTPs

tib3rius.github.io. HTML

UltimateWDACBypassList. A centralized resource for previously documented WDAC bypass techniques

shells. Script for generating revshells

SharpGraphView. Microsoft Graph API post-exploitation toolkit

NetWrapper. Simple netexec wraper with html repport

Sublime-Nmap-Syntax. A Sublime Text plugin that allows for Nmap syntax highlighting

D3MPSEC. "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system calls, randomized procedures, and prototype name obfuscation. Its primary purpose is to bypass both static and dynamic analysis techniques commonly employed by security measures.

LetMeowIn. A sophisticated, covert Windows-based credential dumper using C++ and MASM x64.

merlin. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

Knowledge-Management-for-Offensive-Security-Professionals. Knowledge Management for Offensive Security Professionals Official Repository

adPEAS. winPEAS, but for Active Directory

GPOddity. The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).

regexp-security-cheatsheet. PHP

http-garden. Differential testing framework for HTTP implementations

RustRedOps. Repository for advanced Red Team techniques focused on Rust

FullBypass. A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell.

pryingdeep. Prying Deep - An OSINT tool to collect intelligence on the dark web.

CyberPunkOS. CyberPunkOS is a virtual machine that incorporates several tools for Open Source Intelligence (OSINT) to dismantle Fake News

OSINTko. OSINTk.o is a customized Kali Linux-based ISO image with pre-installed packages and scripts

DInvoke. Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

aroadtools. fully async implementation of Dirkjan's ROADTools

WebclientServiceScanner. Python tool to Check running WebClient services on multiple targets based on @leechristensen

TeamsPhisher. Send phishing messages and attachments to Microsoft Teams users

PrivFu. Kernel mode WinDbg extension and PoCs for token privilege investigation.

arttoolkit.github.io. A RedTeam Toolkit

SOAPHound. SOAPHound is a custom-developed .NET data collector tool which can be used to enumerate Active Directory environments via the Active Directory Web Services (ADWS) protocol.

llm-course. Course to get into Large Language Models (LLMs) with roadmaps and Colab notebooks.

NimReflectiveLoader. NimReflectiveLoader is a Nim-based tool for in-memory DLL execution using Reflective DLL Loading.

AutomatedEmulation. An automated Adversary Emulation lab with terraform and MCP server. Build Caldera techniques and operations assisted with LLMs. Built for IaC stability, consistency, and speed.

pantagrule. large hashcat rulesets generated from real-world compromised passwords

Locksmith. A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

chromepass. Fetching passwords from the chrome browser database

FBI-tools. 🕵️ OSINT Tools for gathering information and actions forensics 🕵️

github_cves_search. Find CVEs associated to Linux and public exploits on github

webcopilot. An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

CloudIntel. This repo contains IOC, malware and malware analysis associated with Public cloud

ASM-Utils. ASM scripts useful for basic operations from the user side.

ThreadlessInject-C-Implementation. This repository implements Threadless Injection in C

Rubeus. Trying to tame the three-headed dog.

AtlasLdr. Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls

odin. odin c2

dnschef-ng. DNSChef (NG) - DNS proxy for Penetration Testers and Malware Analysts

pretender. Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing.

hackGPT. I leverage OpenAI and ChatGPT to do hackerish things

HackGPT. A powerful and customizable ChatGPT-like interface, built for developers.

CloudRecon. Go

naabu. A fast port scanner written in go with a focus on reliability and simplicity. Designed to be used in combination with other tools for attack surface discovery in bug bounties and pentests

Smap. a drop-in replacement for Nmap powered by shodan.io

check_mdi. Python script to enumerate valid Microsoft 365 domains, retrieve tenant name, and check for an MDI instance.

teams_dump. PoC for dumping and decrypting cookies in the latest version of Microsoft Teams

PatchaPalooza. A comprehensive tool that provides an insightful analysis of Microsoft's monthly security updates.

GraphRunner. A Post-exploitation Toolset for Interacting with the Microsoft Graph API

PsMapExec. Dominate Active Directory with PowerShell.

DocPlz. Documents Exfiltration project for fun and educational purposes

pyLDAPWordlistHarvester. A tool to generate a wordlist from the information present in LDAP, in order to crack passwords of domain accounts.

bindiff. Quickly find differences and similarities in disassembled code

curlshell. reverse shell using curl

Supernova. Shellcode encryptor & obfuscator tool

RandomTSScripts. Collection of random RedTeam scripts.

secretsdump.py. Enhanced version of secretsdump.py from Impacket. Adds multi-threading and accepts an input file with a list of target hosts for simultaneous secrets extraction.

dcomhijack. Lateral Movement Using DCOM and DLL Hijacking

Windows_x64_Tcp_Reverse_Shell_Shellcode. Null-free shellcode for TCP reverse shell on Windows x64

sccmhunter. SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain.

Amsi_Bypass_In_2023. Amsi Bypass payload that works on Windwos 11

WinDefenderKiller. Windows Defender Killer | Registry-Based Disablement + BYOVD Process Termination (C++)

subcrawl. SubCrawl is a modular framework for discovering open directories, identifying unique content through signatures and organizing the data with optional output modules, such as Elastic.

BypassAV. This map lists the essential techniques to bypass anti-virus and EDR

ShellGhost. A memory-based evasion technique which makes shellcode invisible from process start to end.

EICARsandboxCheck. This project contains all the EICAR files needed to test if a web application has a Virus sandboxing mechanism.

BOFMask.

RustHound. Active Directory data ingestor for BloodHound Legacy written in Rust. 🦀

PayloadsAllThePDFs. PDF Files for Pentesting

Terminator. Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

GetLAPSPassword. A LAPS dumper written using the impacket library.

Ruy-Lopez. C

ObfuscatedSharpCollection. Attempt at Obfuscated version of SharpCollection

Chimera. Automated DLL Sideloading Tool With EDR Evasion Capabilities

Custom-BloodHound-Queries.

Shell3er. PowerShell Reverse Shell

AzureAD-Attack-Defense. This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

LOOBins. Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

Direct-Syscalls-A-journey-from-high-to-low. Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

PowerShell-Obfuscation-Bible. A collection of techniques, examples and a little bit of theory for manually obfuscating PowerShell scripts to achieve AV evasion, compiled for educational purposes. The contents of this repository are the result of personal research, including reading materials online and conducting trial-and-error attempts in labs and pentests.

AutoFunkt. Python script for automating the creation of serverless cloud redirectors from Cobalt Strike malleable C2 profiles

SharpMapExec. C#

yetAnotherObfuscator. C# obfuscator that bypass windows defender

RunasCs. RunasCs - Csharp and open version of windows builtin runas.exe

wmiexec-Pro. New generation of wmiexec.py

PetitPotato. Local privilege escalation via PetitPotam (Abusing impersonate privileges).

Domain_checker. Domain_checker application is the trial/demo version for the new EASM (External Attack Surface Management) system called HydrAttack (hydrattack.com), the main idea of which is, based only on the domain name, find almost all of the subdomains and their top 100 open ports

BurpSuite-For-Pentester. This cheatsheet is built for the Bug Bounty Hunters and penetration testers in order to help them hunt the vulnerabilities from P4 to P1 solely and completely with "BurpSuite".

Windows_LPE_AFD_CVE-2023-21768. LPE exploit for CVE-2023-21768

lolbin-poc. Small PoC of using a Microsoft signed executable as a lolbin.

Amsi-Killer. Lifetime AMSI bypass

pe-bear. Portable Executable reversing tool with a friendly GUI

Pentest-Cheat-Sheets. A collection of snippets of codes and commands to make your life easier!

LAPSToolkit. Tool to audit and attack LAPS environments

BokuLoader. A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

whids. Open Source EDR for Windows

awesome-connected-things-sec. A Curated list of Security Resources for all connected things

secrets-patterns-db. Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.

OperatorsKit. Collection of Beacon Object Files (BOF) for Cobalt Strike

Invoke-Transfer. PowerShell Clipboard Data Transfer

ESXiArgs-Recover. A tool to recover from ESXiArgs ransomware

DLL-Exports-Extraction-BOF. DLL Exports Extraction BOF with optional NTFS transactions.

RedTeam-Tools. Tools and Techniques for Red Team / Penetration Testing

exploits. A handy collection of my public exploits, all in one place.

dll-hijack-by-proxying. Exploiting DLL Hijacking by DLL Proxying Super Easily

certsync. Dump NTDS with golden certificates and UnPAC the hash

SharpStartWebclient. Programmatically start WebClient from an unprivileged session to enable that juicy privesc.

PyCript. Burp Suite extension to decrypt/encrypt any encrypted traffic (AES/RSA/Encodings and more) with custom code in any language

Inline-Execute-PE. Execute unmanaged Windows executables in CobaltStrike Beacons

NetLoader. Loads any C# binary in mem, patching AMSI + ETW.

Windows-Privilege-Escalation.

vbSparkle. VBScript & VBA source-to-source deobfuscator with partial-evaluation

pentest-scripts. Miscellaneous scripts for pentesting

Alcatraz. x64 binary obfuscator

PowerSharpPack. PowerShell

Cloudmare. Cloudflare, Sucuri, Incapsula real IP tracker.

RedditC2. Abusing Reddit API to host the C2 traffic, since most of the blue-team members use Reddit, it might be a great way to make the traffic look legit.

SQLRecon. A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

maldev-links. My collection of malware dev links

SharpC2. Command and Control Framework written in C#

awesome-appsec. A curated list of resources for learning about application security

OffensiveVBA. This repo covers some code execution and AV Evasion methods for Macros in Office documents

DVHMA. Damn Vulnerable Hybrid Mobile App (DVHMA) is an hybrid mobile app (for Android) that intentionally contains vulnerabilities.

dvws-node. Damn Vulnerable Web Services is a vulnerable application with a web service and an API that can be used to learn about webservices/API related vulnerabilities.

DVWA. Damn Vulnerable Web Application (DVWA)

AzureGoat. AzureGoat : A Damn Vulnerable Azure Infrastructure

AWSGoat. AWSGoat : A Damn Vulnerable AWS Infrastructure

osep-code-dump-2022. Code dump from PEN-300/OSEP updated 2022

oswe-prep-2022. Offensive Security OSWE Prep 2022

TeamFiltration. TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts

Chisel-Strike. A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.

Awesome-RCE-techniques. Awesome list of step by step techniques to achieve Remote Code Execution on various apps!

hakrawler. Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application

A-Red-Teamer-diaries. RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.

ScheduleRunner. A C# tool with more flexibility to customize scheduled task for both persistence and lateral movement in red team operation

InvisibilityCloak. Proof-of-concept obfuscation toolkit for C# post-exploitation tools

DetectionLab. Automate the creation of a lab environment complete with security tooling and logging best practices

PowerShellArmoury. A PowerShell armoury for security guys and girls

AppLocker-Bypass. Bypassing AppLocker with C#

HTTP-Smuggling-Calculator. Perform TE.CL HTTP Request Smuggling attacks by crafting HTTP Request automatically.

AutoSmuggle. Utility to craft HTML or SVG smuggled files for Red Team engagements

Offensive_tools. Java

mortar. evasion technique to defeat and divert detection and prevention of security products (AV/EDR/XDR)

SysWhispers3. SysWhispers on Steroids - AV/EDR evasion via direct system calls.

PowerShdll. Run PowerShell with rundll32. Bypass software restrictions.

Template-CherryTree-PenTest.

KrbRelay. Framework for Kerberos relaying

KillDefender. A small POC to make defender useless by removing its token privileges and lowering the token integrity

DefenderStop. Stop Defender Service using C# via Token Impersonation

eCXD-Preparation. eLearnSecurity Certified Exploit Development

Awesome-Red-Team-Operations.

Azure-Red-Team. Azure Security Resources and Notes

dystopia-c2. Windows Remote Administration Tool that uses Discord, Telegram and GitHub as C2s

aad-sso-enum-brute-spray. POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln

UAC-bypass-using-dll-injection. A small project to bypass UAC in windows 10/8/7 using dll injection technique

OSEP-Code-Snippets. A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.

warberry. WarBerryPi - Tactical Exploitation

OSCE3-Complete-Guide. OSWE, OSEP, OSED, OSEE

ttp0_community_templates.

ImproHound. Identify the attack paths in BloodHound breaking your AD tiering

OffensivePipeline. OfensivePipeline allows you to download and build C# tools, applying certain modifications in order to improve their evasion for Red Team exercises.

ThreatCheck. Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.