qwertty

ArachneC2. Decentralized C2 framework built on libp2p

AetherTune. A terminal-based internet radio player with real-time audio visualization, built in Rust.

BestEdrOfTheMarket. EDR Lab for Experimentation Purposes

SigmaPotato. SeImpersonate privilege escalation tool for Windows 8 - 11 and Windows Server 2012 - 2022 with extensive PowerShell and .NET reflection support.

BusyBOF. Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments (Docker containers, Kubernetes pods, minimal VMs) where no binaries exist beyond the agent / implant.

perfect-loader. Load a dynamic library from memory by modifying the native Windows loader

lsa-whisperer. Tools for interacting with authentication packages using their individual message protocols

InfraGuard. InfraGuard is a Command & Control Redirection Proxy and Manager which protects your Red Team Infrastructure against threat attribution

PolyEngine. PolyEngine is an evasive PE packer designed for CTF challenges and low-level Windows security education. It focuses on bypassing EDR and AV heuristics through a layered stack of in-memory execution and obfuscation techniques.

AtomicTestHarnesses. Public Repo for Atomic Test Harness

invoke-atomicredteam. Invoke-AtomicRedTeam is a PowerShell module to execute tests as defined in the [atomics folder](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics) of Red Canary's Atomic Red Team project.

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

LibGate. A Crystal Palace shared library to resolve & perform syscalls

pwnlift. Easy peasy file uploads

theHandler-BOF. Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.

Cobalt-Strike-CheatSheet. Some notes and examples for cobalt strike's functionality

AdaptixC2-Template-Generators. AdaptixC2 Templates

EVENmonitor. Monitor the Windows Event Log with grep-like features or filtering for specific Event IDs

Maverick. Adaptix C2 agent using Crystal Palace PIC linker and PICO module system

crystal-palace-vsc. Language extension for Crystal Palace Specification files

PICO-Implant. PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible to build a multi-stage and modular C2 implant made of PICOs.

Crystal-Loaders. A small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike

ReflectiveDLLInjection. Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

LitterBox. A self-hosted sandbox for red teams to test payloads against modern detection before deployment. MCP integration lets an LLM agent drive analysis end to end.

DescribeNTSecurityDescriptor. A cross-platform tool to parse and describe the contents of a raw ntSecurityDescriptor structure

FindGPPPasswords. A cross-platform tool to find and decrypt Group Policy Preferences passwords from the SYSVOL share using low-privileged domain accounts

GoPurple. Yet another shellcode runner consists of different techniques for evaluating detection capabilities of endpoint security solutions

D-Pwn. D/Invoke standalone shellcode runners

ADPulse. Active Directory Vulnerability Scanner

GadgetHunter. Find jmp gadgets for call stack spoofing.

lsawhisper-bof. A Beacon Object File (BOF) that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory.

EDRs. C

Dll-Shellcode-Loader. Dll Shellcode Loader POC

BloodBash. A Bloodhound alternative. BloodBash will ingest the same files bloodhound does but no server is required to use this tool. It's great for quick AD enumeration.

Adaptix-StealthPalace. Crystal Palace RDLL loader for Adaptix C2 with Ekko sleep obfuscation, IAT hooking via PICO, and per-section permission restoration

CobaltStrike-Linux-Beacon. Proof of Concept (PoC) implant for creating custom Cobalt Strike Beacons

Simple-Crystal-Palace-RDLL-template-for-Adaptix. C

CallStackSpoofer. C

windows-syscalls. Windows System Call Tables (NT/2000/XP/2003/Vista/7/8/10/11)

CS-EDR-Enumeration. Cobalt Strike Aggressor Script for identifying security products on Windows hosts — six enumeration methods rated by noise level, from silent in-process BOF to full PowerShell/WMI.

aliasr. Aliasr is a modern, feature-rich TUI launcher for pentest commands.

the-one-wsl-bof. One WSL BOF to rule them all

eden. A PoC UDRL for Cobalt Strike built with Crystal Palace that combines Raphael Mudge's page streaming technique with a modular call gate (Draugr)

elastic-container. Stand up a simple Elastic container with Kibana, Fleet, and the Detection Engine

Shellcode-Test-Harness. A lightweight test harness designed to speed up shellcode development by providing an execution environment with integrated crash diagnostics and debug output redirection.

Ankou. A flexible, AI powered C2 framework built with operators in mind

VX-API. Collection of various malicious functionality to aid in malware development

Clockworkpi-uConsole. 10 things to do after you get your ClockworkPi uConsole

awesome-tuis. List of projects that provide terminal user interfaces

dumpguard_bof. Beacon Object File (BOF) port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems.

DumpGuard. Proof-of-Concept tool for extracting credential material from protected sessions on modern Windows systems.

EDR-GhostLocker. AppLocker-Based EDR Neutralization

silph. Stealthy In-Memory Local Password Harvester (SILPH) tool: dump LSA, SAM and DCC2 with indirect syscall

Checklists. Red Teaming & Pentesting checklists for various engagements

RedTeam-PenTest-Cheatsheet-Checklist. Red Teaming and Penetration Testing Checklist, Cheatsheet, Clickscript

sswws. Super Simple Windows Web Server

thc-tips-tricks-hacks-cheat-sheet. Various tips & tricks

mlwr_blogs. collection of blogs about malware development and analysis

Ghostwriter. The SpecterOps project management and reporting engine

evil-go. A fork of the Go language with some tweaks

Adrenaline. C2-agnostic BOF collection, categorized by attack chain phase. Designed to be small and modular, allowing for quick execution and automation.

Kharon. Agent for AdaptixC2 with focus in evasion, capability and malleable.

pybof. Python module for running BOFs

Flipper-Zero-BadUSB. Repository for my flipper zero badUSB payloads. Now almost entirely plug and play.

inlineExecute. Cobalt Strike BOF

1.6-C2. Using the Counter Strike 1.6 RCON protocol as a C2 Channel.

RedTeamGrimoire. 🔥📜 Forbidden collection of Red Team sorcery 📜🔥

csbot. Golang Automation Framework for Cobalt Strike using the Rest API

ShareHound. A python tool to map the access rights of network shares into a BloodHound OpenGraphs easily

librepods. AirPods liberated from Apple's ecosystem.

Invoke-PowerChrome. Decrypt Chromium based browser passwords with PowerShell.

conquest. Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim.

DonPwner. Advanced Domain Controller attack and credential analysis tool leveraging DonPAPI database

InlineExecuteEx. A BOF that's a BOF Loader and more

toolong. A terminal application to view, tail, merge, and search log files (plus JSONL).

Group3r. Find vulnerabilities in AD Group Policy, but do it better than Grouper2 did.

Invoke-TheHash. PowerShell Pass The Hash Utils

shortwave. Find and listen to internet radio stations

maldev. ⚠️ Malware Development training ⚠️

cs2br-bof. Run Cobalt Strike BOFs in Brute Ratel C4!

metasploitable3. Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.

metasploit-framework. Metasploit Framework

SharpGPOAbuse. SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

adidnsdump. Active Directory Integrated DNS dumping by any authenticated user

windows-kernel-exploits. windows-kernel-exploits Windows平台提权漏洞集合

NetNTLMtoSilverTicket. SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Silver Ticket

msmailprobe. Office 365 and Exchange Enumeration

Exchange-AD-Privesc. Exchange privilege escalations to Active Directory

noPac. Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

flipper-zero-tonies. Python

pth-toolkit. Modified version of the passing-the-hash tool collection made to work straight out of the box

NetExec-Lab. Lab used for workshop and CTF

COFFLoader. C

CS-Remote-OPs-BOF. Remote operations commands implemented using Beacon Object Files

Snaffler. a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )

Active-Directory-Exploitation-Cheat-Sheet. A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

token-priv. Token Privilege Research

TokenPlayer. Manipulating and Abusing Windows Access Tokens.

C3. Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

kerbrute. A tool to perform Kerberos pre-auth bruteforcing

Inveigh. .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

Crystal-Kit. Evasion kit for Cobalt Strike

linkedin2username. OSINT Tool: Generate username lists for companies on LinkedIn

bettercap. The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

templates-extender. Templates for developing your own listeners and agents for AdaptixC2.

PyHmmm. Simple PoC Python agent to showcase Havoc C2's custom agent interface. Not operationally safe or stable. Released with accompanying blog post as a tutorial sample

workshop_firmware_reverse_engineering. Workshop on firmware reverse engineering

NetworkHound. Advanced Active Directory network topology analyzer with SMB validation, multiple authentication methods (password/NTLM/Kerberos), and comprehensive network discovery. Export results as BloodHound‑compatible OpenGraph JSON.

phishlets. Phishlets for Evilginx2 (MITM proxy Framework)

allsafe-android. Intentionally vulnerable Android application.

MaldevAcademyLdr.2. RunPE implementation with multiple evasive techniques (2)

powercat. netshell features all in version 2 powershell

FullPowers. Recover the default privilege set of a LOCAL/NETWORK SERVICE account

Volumiser. C#

evilginx2. Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

ligolo-ng. An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

obex. Obex – Blocking unwanted DLLs in user mode

GitSync. Mobile Git client for syncing a repository between remote and a local directory

TaskHound. Tool to enumerate privileged Scheduled Tasks on Remote Systems

ROADtools. A collection of Azure AD/Entra tools for offensive and defensive security purposes

bulletty. bulletty is a pretty feed reader for the terminal that stores the articles as Markdown

psudohash. Generates millions of keyword-based password mutations in seconds.

PIC-Library. A collection of position independent coding resources

wtfis. Passive hostname, domain and IP lookup tool for non-robots

dittobytes. Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.

Memory-Mirage-Anti-Debugging-. Use of in-memory string scans to outsmart reverse engineers

Shadow-Rebirth. Shadow Rebirth - An Aggressive Outbreak Anti-Debugging Technique

Detoured-DLL-Injection. DLL injection with Microsoft detours

FrostLock-Injection. FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a target process, inject shellcode, and then seamlessly resume (thaw) it.

COMouflage. COM-based DLL Surrogate Injection

Extension-Kit. AdaptixFramework Extension Kit

Amsi-Bypass-Powershell. This repo contains some Amsi Bypass methods i found on different Blog Posts.

monsoon. Fast HTTP enumerator

avred. Analyse your malware to surgically obfuscate it

cinelog. Comprehensive logging of all terminal input and output for each session based on Asciinema and wild zsh + Python scripting.

UserAgent-Switcher. A User-Agent spoofer browser extension that is highly configurable

MalDev-Analyzer-MCP. Built for red teamers, by red teamers - an MCP tool for malware development, OPSEC testing, and supporting custom loader design during red team engagements.

RedTeam-Tools. Tools and Techniques for Red Team / Penetration Testing

cyberpunk. Cyberpunk stuff

MSSQLHound. Go (formerly PowerShell) collector for adding MSSQL attack paths to BloodHound with OpenGraph

sysreptor. A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.

CVE-2025-53770-Exploit. SharePoint WebPart Injection Exploit Tool

SCShell. Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

CamXploit. Security reconnaissance and assessment tool for identifying potentially exposed IP cameras by analyzing open ports, service configurations, and common misconfigurations.

boflink. Linker for Beacon Object Files

Malleable-CS-Profiles. A list of python tools to help create an OPSEC-safe Cobalt Strike profile.

Malleable-C2-Profiles. Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike https://www.cobaltstrike.com/.

Invoke-Obfuscation. PowerShell Obfuscator

Cobalt-Strike. Various resources to enhance Cobalt Strike's functionality and its ability to evade antivirus/EDR detection

APKDeepLens. Android security insights in full spectrum.

Arjun. HTTP parameter discovery suite.

stormy. minimal neofetch-style weather cli

NTHW. Not The Hidden Wiki - The largest repository of links related to cybersecurity

btop. A monitor of resources

AdaptixC2. AdaptixC2 is a highly modular advanced redteam toolkit

bofhound. Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel

ADSearch. A tool to help query AD via the LDAP protocol

malleable-c2. Cobalt Strike Malleable C2 Design and Reference Guide

Malleable-C2-Profiles. Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.

sddm. QML based X11 and Wayland display manager

SharpDPAPI. SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

AMSITrigger. The Hunt for Malicious Strings

Awesome-Hacking. A collection of various awesome lists for hackers, pentesters and security researchers

BitlockMove. Lateral Movement via Bitlocker DCOM interfaces & COM Hijacking

CTFPacker. Shellcode packer for CTFs and pentest / red team exams aiming for AV evasion!

wayBackLister. A New Approach to Directory Bruteforce with WaybackLister v1.0

CRTO-Notes. Certified Red Team Operator (CRTO) Cheatsheet and Checklist

ruler. A tool to abuse Exchange services

ngrok-docs. ngrok's official documentation

seeker. Accurately Locate Smartphones using Social Engineering

BofAllTheThings. Creating a repository with all public Beacon Object Files (BoFs)

OperatorsKit. Collection of Beacon Object Files (BOF) for Cobalt Strike

C2-Tool-Collection. A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.

bof_template. A Beacon Object File (BOF) is a compiled C program, written to a convention that allows it to execute within a Beacon process and use internal Beacon APIs. BOFs are a way to rapidly extend the Beacon agent with new post-exploitation features.

CS-Situational-Awareness-BOF. Situational Awareness commands implemented using Beacon Object Files

Argus. The Ultimate Information Gathering Toolkit

cobra. A Commander for modern Go CLI interactions

httpx. httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

RedTeaming_CheatSheet. Pentesting cheatsheet with all the commands I learned during my learning journey. Will try to to keep it up-to-date.

ProtectMyTooling. Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.

badusb. Flipper Zero badusb payload library

wendigo. Flipper Zero application for WiFi and Bluetooth scanning with a native interface. Collects all available information about detected devices. Wendigo is a creature from North American mythology that stalks and overpowers its victims.

FlipperZero-MetroCard-Security. A scientific research paper analyzing the security vulnerabilities in metro card systems and the role of Flipper Zero in testing these weaknesses. The study explores RFID cloning, NFC relay attacks, cryptographic vulnerabilities in transit cards, and potential countermeasures to enhance security.

PsMapExec. Dominate Active Directory with PowerShell.

FlipperZero-Subghz-DB. A collection of Flipper Zero sub files

EvilPortalGenerator. An easy script/app to create Evil Portals quickly to be used on the Flipper Zero.

FlipperZeroEuropeanPortals. A repository of portals I made for the Evil Portal app on the Flipper Zero. Most portals are for European brands/companies but valid for other regions too.

flipper-zero-evil-portal. Evil portal app for the flipper zero + WiFi dev board

flipperzero-wifi-marauder. Flipper Zero WiFi Marauder companion app

flipperzero-esp-flasher. Flipper Zero app to flash ESP chips from the device (no computer connection needed!)

garble. Obfuscate Go builds

EvilWorker. A new AiTM attack framework — based on leveraging service workers — designed to conduct credential phishing campaigns. Thanks to its minimalist, robust, and highly adaptable architecture, this solution can be easily deployed on PaaS.

Flipper-IRDB. A collective of different IRs for the Flipper

flipper-zero_authenticator. Software-based TOTP/HOTP authenticator for Flipper Zero device.

flipper-paranoia. C

flipper-Bleash. C

BOF_Collection. Various Cobalt Strike BOFs

Invisi-Shell. Hide your Powershell script in plain sight. Bypass all Powershell security features

flipper-application-catalog. Flipper Application Catalog

Flipper-iOS-App. iOS Mobile App to rule all Flipper's family