The Red Teaming Arsenal: Best Tools for Offensive Security & Ethical Hacking
Share

๐ The Red Teaming Arsenal: Best Tools for Offensive Security & Ethical Hacking
Red teaming is all about simulating real-world attacksโbypassing defenses, escalating privileges, and maintaining persistence.
If you're a penetration tester, ethical hacker, or security researcher, you need the right tools for stealth, privilege escalation, network pivoting, and post-exploitation.
This definitive Red Teaming toolkit covers the best tools for AMSI bypass, C2 frameworks, exploitation, persistence, and more!
๐ ๏ธ PowerShell Scripts for Red Teaming
PowerShell remains one of the most powerful tools for offensive security. These scripts help in gathering credentials, executing payloads, and maintaining access.
๐น Best PowerShell Hacking Tools:
โ
PowerSploit โ Post-exploitation framework
โ
Inveigh โ Network spoofing & credential dumping
โ
Empire โ Post-exploitation framework
โ
SessionGopher โ Session token gathering
โ
Nishang โ PowerShell scripts for penetration testing
๐น Bonus: Use these tools with C2 frameworks like Cobalt Strike, Metasploit, and Covenant for full offensive automation.
๐ฉธ AMSI Bypass & Evasion Techniques
The Windows Antimalware Scan Interface (AMSI) detects and blocks PowerShell payloads. These tools help in bypassing AMSI and executing malicious scripts undetected.
๐น Best AMSI Bypass Tools:
โ
AMSI.fail โ Universal AMSI bypass
โ
PowerShdll โ Load PowerShell in-memory without detection
โ
NoAmci โ Disables AMSI via patching
โ
PSAttack โ Offensive PowerShell framework
๐ Pro Tip: Combine AMSI bypass with obfuscation techniques for better stealth.
๐ก Payload Hosting & C2 Frameworks
For successful remote access & exploitation, Red Teamers need a reliable way to deliver payloads. These tools allow for hosting and executing payloads remotely.
๐น Best Tools for Payload Hosting & C2:
โ
PwnDrop โ Self-hosted file hosting & payload delivery
โ
Updog โ Python-based file hosting tool
โ
Merlin โ HTTP/2 C2 framework
โ
Cobalt Strike โ The ultimate Red Teaming C2
๐ Pro Tip: Use domain fronting & encrypted comms to evade network detection.
๐ Lateral Movement & Network Pivoting
Once inside a network, moving laterally & escalating access is key. These tools help in bypassing firewalls, tunneling traffic, and pivoting into internal systems.
๐น Top Pivoting & Lateral Movement Tools:
โ
SocksOverRDP โ SOCKS proxy over RDP
โ
Ligolo โ Reverse shell & pivoting tool
โ
Invoke-SocksProxy โ Dynamic port forwarding
โ
SSHuttle โ VPN-like tunneling over SSH
๐ Use these tools to move stealthily across networks while evading detection.
๐ Windows Privilege Escalation Techniques
Once inside a system, privilege escalation is critical to gaining full control. These tools automate privilege escalation discovery and exploitation.
๐น Top Windows Privilege Escalation Tools:
โ
PrivescCheck โ Windows privilege escalation enumeration
โ
WinPEAS โ Automated privilege escalation checks
โ
Sherlock โ Detect vulnerable privilege escalation exploits
โ
RoguePotato โ Exploit Windows token privileges
๐ Pro Tip: Use token manipulation & DLL hijacking for stealthier escalation.
๐ง Linux Privilege Escalation & Enumeration
Linux systems are often overlooked in Red Teaming engagements. These tools help in enumerating & exploiting Linux privilege escalation paths.
๐น Top Linux Privilege Escalation Tools:
โ
LinPEAS โ Automated privilege escalation scanner
โ
Linux Smart Enumeration โ Linux system enumeration
โ
GTFOBins โ Find binaries with privilege escalation potential
โ
sudo_killer โ Find sudo misconfigurations
๐ Build Your Ultimate Red Teaming Arsenal Today!
๐น Want to take your hacking skills to the next level?
๐น Need the best Red Teaming tools in one place?
๐น Looking for real-world exploitation techniques?
๐ Explore The Best Red Teaming Tools Now!
๐ Check out our recommended offensive security tools & gear:
๐ Red Team Essentials
Let's go RED!! The Blood Sucking Team. Hey! RED TEAMERS.
ย
Powershell Scripts
- https://github.com/S3cur3Th1sSh1t/WinPwn
- https://github.com/dafthack/MailSniper
- https://github.com/putterpanda/mimikittenz
- https://github.com/dafthack/DomainPasswordSpray
- https://github.com/mdavis332/DomainPasswordSpray
- https://github.com/jnqpblc/SharpSpray
- https://github.com/Arvanaghi/SessionGopher
- https://github.com/samratashok/nishang
- https://github.com/PowerShellMafia/PowerSploit
- https://github.com/fdiskyou/PowerOPS
- https://github.com/giMini/PowerMemory
- https://github.com/Kevin-Robertson/Inveigh
- https://github.com/MichaelGrafnetter/DSInternals
- https://github.com/PowerShellEmpire/PowerTools
- https://github.com/FuzzySecurity/PowerShell-Suite
- https://github.com/hlldz/Invoke-Phant0m
- https://github.com/leoloobeek/LAPSToolkit
- https://github.com/n00py/LAPSDumper
- https://github.com/sense-of-security/ADRecon
- https://github.com/adrecon/ADRecon
- https://github.com/S3cur3Th1sSh1t/Grouper
- https://github.com/l0ss/Grouper2
- https://github.com/NetSPI/PowerShell
- https://github.com/NetSPI/PowerUpSQLย SQL Injection
- https://github.com/GhostPack
- https://github.com/Kevin-Robertson/Powermad
AMSI Bypass
- https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
- https://github.com/Flangvik/AMSI.fail
- https://github.com/p3nt4/PowerShdll
- https://github.com/jaredhaight/PSAttack
- https://github.com/Cn33liz/p0wnedShell
- https://github.com/cobbr/InsecurePowerShell
- https://github.com/bitsadmin/nopowershell
- https://github.com/Mr-Un1k0d3r/PowerLessShell
- https://github.com/OmerYa/Invisi-Shell
- https://github.com/Hackplayers/Salsa-tools
- https://github.com/padovah4ck/PSByPassCLM
- https://github.com/rasta-mouse/AmsiScanBufferBypass
- https://github.com/itm4n/VBA-RunPE
- https://github.com/cfalta/PowerShellArmoury
- https://github.com/Mr-B0b/SpaceRunner
- https://github.com/RythmStick/AMSITrigger
- https://github.com/rmdavy/AMSI_Ordinal_Bypass
- https://github.com/mgeeky/Stracciatella
- https://github.com/med0x2e/NoAmci
- https://github.com/rvrsh3ll/NoMSBuild
- https://github.com/bohops/UltimateWDACBypassList
- https://github.com/jxy-s/herpaderping
- https://github.com/Cn33liz/MSBuildShell
Payload Hosting
Network Share Scanner
Reverse Shellz
Backdoor Finder
Pivoting
- https://github.com/0x36/VPNPivot
- https://github.com/securesocketfunneling/ssf
- https://github.com/p3nt4/Invoke-SocksProxy
- https://github.com/sensepost/reGeorg
- https://github.com/hayasec/reGeorg-Weblogic
- https://github.com/nccgroup/ABPTTS
- https://github.com/RedTeamOperations/PivotSuite
- https://github.com/trustedsec/egressbuster
- https://github.com/vincentcox/bypass-firewalls-by-DNS-history
- https://github.com/shantanu561993/SharpChisel
- https://github.com/jpillora/chisel
- https://github.com/esrrhs/pingtunnel
- https://github.com/sysdream/ligolo
- https://github.com/nccgroup/SocksOverRDP
- https://github.com/blackarrowsec/mssqlproxy
Persistence on Windows
Framework Discovery
Framework Scanner / Exploitation
- https://github.com/wpscanteam/wpscanย - wordpress
- https://github.com/n00py/WPForce
- https://github.com/m4ll0k/WPSekuย https://github.com/swisskyrepo/Wordpresscan
- https://github.com/rastating/wordpress-exploit-framework
- https://github.com/coldfusion39/domi-ownedย - lotus domino
- https://github.com/droope/droopescanย - Drupal
- https://github.com/whoot/Typo-Enumeratorย - Typo3
- https://github.com/rezasp/joomscanย - Joomla
File / Directory / Parameter discovery
- https://github.com/OJ/gobuster
- https://github.com/nccgroup/dirble
- https://github.com/maK-/parameth
- https://github.com/devanshbatham/ParamSpiderย - Mining parameters from dark corners of Web Archives
- https://github.com/s0md3v/Arjunย - ๐
- https://github.com/Cillian-Collins/dirscraperย - Directory lookup from Javascript files
- https://github.com/hannob/snallygaster
- https://github.com/maurosoria/dirsearch
- https://github.com/s0md3v/Breacherย - Admin Panel Finder
- https://github.com/mazen160/server-status_PWN
- https://github.com/helviojunior/turbosearch
Rest API Audit
- https://github.com/microsoft/restler-fuzzerย - RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.
- https://github.com/flipkart-incubator/Astra
Windows Privilege Escalation / Audit
- https://github.com/itm4n/PrivescCheckย - Privilege Escalation Enumeration Script for Windows
- https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEASย - powerfull Privilege Escalation Check Script with nice output
- https://github.com/AlessandroZ/BeRoot
- https://github.com/rasta-mouse/Sherlock
- https://github.com/hfiref0x/UACMEย - UAC
- https://github.com/rootm0s/WinPwnageย - UAC
- https://github.com/abatchy17/WindowsExploits
- https://github.com/dafthack/HostRecon
- https://github.com/sensepost/rattlerย - find vulnerable dlls for preloading attack
- https://github.com/WindowsExploits/Exploits
- https://github.com/Cybereason/siofraย - dll hijack scanner
- https://github.com/0xbadjuju/Tokenvatorย - admin to system
- https://github.com/MojtabaTajik/Robber
- https://github.com/411Hall/JAWS
- https://github.com/GhostPack/SharpUp
- https://github.com/GhostPack/Seatbelt
- https://github.com/A-mIn3/WINspect
- https://github.com/hausec/ADAPE-Script
- https://github.com/SecWiki/windows-kernel-exploits
- https://github.com/bitsadmin/wesng
- https://github.com/rasta-mouse/Watson
Windows Privilege Abuse (Privilege Escalation)
- https://github.com/gtworek/Priv2Adminย - Abuse Windows Privileges
- https://github.com/itm4n/UsoDllLoaderย - load malicious dlls from system32
- https://github.com/TsukiCTF/Lovely-Potatoย - Exploit potatoes with automation
- https://github.com/antonioCoco/RogueWinRMย - from Service Account to System
- https://github.com/antonioCoco/RoguePotatoย - Another Windows Local Privilege Escalation from Service Account to System
- https://github.com/itm4n/PrintSpooferย - Abusing Impersonation Privileges on Windows 10 and Server 2019
- https://github.com/BeichenDream/BadPotatoย - itm4ns Printspoofer in C#
- https://github.com/itm4n/FullPowersย - Recover the default privilege set of a LOCAL/NETWORK SERVICE account
Exfiltration
- https://github.com/gentilkiwi/mimikatz
- https://github.com/GhostPack/SafetyKatz
- https://github.com/Flangvik/BetterSafetyKatzย - Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.
- https://github.com/GhostPack/Rubeus
- https://github.com/Arvanaghi/SessionGopher
- https://github.com/peewpw/Invoke-WCMDump
- https://github.com/tiagorlampert/sAINT
- https://github.com/AlessandroZ/LaZagneForensicย - remote lazagne
- https://github.com/eladshamir/Internal-Monologue
- https://github.com/djhohnstein/SharpWebย - Browser Creds gathering
- https://github.com/moonD4rk/HackBrowserDataย - hack-browser-data is an open-source tool that could help you decrypt data[passwords|bookmarks|cookies|history] from the browser.
- https://github.com/mwrlabs/SharpClipHistoryย - ClipHistory feature get the last 25 copy paste actions
- https://github.com/outflanknl/Dumpertย - dump lsass using direct system calls and API unhooking
- https://github.com/b4rtik/SharpMiniDumpย - Create a minidump of the LSASS process from memory - using Dumpert
- https://github.com/b4rtik/ATPMiniDumpย - Evade WinDefender ATP credential-theft
- https://github.com/aas-n/spraykatzย - remote procdump.exe, copy dump file to local system and pypykatz for analysis/extraction
- https://github.com/0x09AL/RdpThiefย - extract live rdp logins
- https://github.com/chrismaddalena/SharpCloudย - Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute.
- https://github.com/djhohnstein/SharpChromiumย - .NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.
- https://github.com/jfmaes/SharpHandlerย - This project reuses open handles to lsass to parse or minidump lsass
- https://github.com/V1V1/SharpScribblesย - ThunderFox for Firefox Credentials, SitkyNotesExtract for "Notes as passwords"
- https://github.com/securesean/DecryptAutoLogonย - Command line tool to extract/decrypt the password that was stored in the LSA by SysInternals AutoLogon
- https://github.com/G0ldenGunSec/SharpSecDumpย - .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py
- https://github.com/EncodeGroup/Gopherย - C# tool to discover low hanging fruits like SessionGopher
- https://github.com/GhostPack/SharpDPAPIย - DPAPI Creds via C#
- LSASS Dump Without Mimikatz
- https://github.com/Hackndo/lsassy
- https://github.com/aas-n/spraykatz
- https://github.com/b4rtik/SharpKatzย - C# porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands
- Credential harvesting Linux Specific
- https://github.com/huntergregal/mimipenguin
- https://github.com/n1nj4sec/mimipy
- https://github.com/dirtycow/dirtycow.github.io
- https://github.com/mthbernardes/sshLooterCย - SSH Credential loot
- https://github.com/blendin/3snakeย - SSH / Sudo / SU Credential loot
- https://github.com/0xmitsurugi/gimmecredz
- https://github.com/TarlogicSecurity/tickeyย - Tool to extract Kerberos tickets from Linux kernel keys.
- Data Exfiltration - DNS/ICMP/Wifi Exfiltration
- https://github.com/FortyNorthSecurity/Egress-Assess
- https://github.com/p3nt4/Invoke-TmpDavFS
- https://github.com/DhavalKapil/icmptunnel
- https://github.com/iagox86/dnscat2
- https://github.com/Arno0x/DNSExfiltrator
- https://github.com/spieglt/FlyingCarpetย - Wifi Exfiltration
- https://github.com/SECFORCE/Tunnaย - Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP
- https://github.com/sysdream/chashell
- https://github.com/no0be/DNSliveryย - Easy files and payloads delivery over DNS
Staging
- Rapid Attack Infrastructure (RAI) Red Team Infrastructure... Quick... Fast... Simplified One of the most tedious phases of a Red Team Operation is usually the infrastructure setup. This usually entails a teamserver or controller, domains, redirectors, and a Phishing server.ย https://github.com/obscuritylabs/RAI
- Red Baron is a set of modules and custom/third-party providers for Terraform which tries to automate creating resilient, disposable, secure and agile infrastructure for Red Teams.ย https://github.com/byt3bl33d3r/Red-Baron
- EvilURL generate unicode evil domains for IDN Homograph Attack and detect them.ย https://github.com/UndeadSec/EvilURL
- Domain Hunter checks expired domains, bluecoat categorization, and Archive.org history to determine good candidates for phishing and C2 domain names.ย https://github.com/threatexpress/domainhunter
- PowerDNS is a simple proof of concept to demonstrate the execution of PowerShell script using DNS only.ย https://github.com/mdsecactivebreach/PowerDNS
- Chameleon a tool for evading Proxy categorisation.ย https://github.com/mdsecactivebreach/Chameleon
- CatMyFish Search for categorized domain that can be used during red teaming engagement. Perfect to setup whitelisted domain for your Cobalt Strike beacon C&C.ย https://github.com/Mr-Un1k0d3r/CatMyFish
- Malleable C2 is a domain specific language to redefine indicators in Beacon's communication.ย https://github.com/rsmudge/Malleable-C2-Profiles
- Malleable-C2-Randomizer This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage, hopefully reducing the chances of flagging signature-based detection controls.ย https://github.com/bluscreenofjeff/Malleable-C2-Randomizer
- FindFrontableDomains search for potential frontable domains.ย https://github.com/rvrsh3ll/FindFrontableDomains
- Postfix-Server-Setup Setting up a phishing server is a very long and tedious process. It can take hours to setup, and can be compromised in minutes.ย https://github.com/n0pe-sled/Postfix-Server-Setup
- DomainFrontingLists a list of Domain Frontable Domains by CDN.ย https://github.com/vysec/DomainFrontingLists
- Apache2-Mod-Rewrite-Setup Quickly Implement Mod-Rewrite in your infastructure.ย https://github.com/n0pe-sled/Apache2-Mod-Rewrite-Setup
- mod_rewrite rule to evade vendor sandboxes.ย https://gist.github.com/curi0usJack/971385e8334e189d93a6cb4671238b10
- external_c2 framework a python framework for usage with Cobalt Strike's External C2.ย https://github.com/Und3rf10w/external_c2_framework
- Malleable-C2-Profiles A collection of profiles used in different projects using Cobalt Strikeย https://www.cobaltstrike.com/.ย https://github.com/xx0hcd/Malleable-C2-Profiles
- ExternalC2 a library for integrating communication channels with the Cobalt Strike External C2 server.ย https://github.com/ryhanson/ExternalC2
- cs2modrewrite a tools for convert Cobalt Strike profiles to modrewrite scripts.ย https://github.com/threatexpress/cs2modrewrite
- e2modrewrite a tools for convert Empire profiles to Apache modrewrite scripts.ย https://github.com/infosecn1nja/e2modrewrite
- redi automated script for setting up CobaltStrike redirectors (nginx reverse proxy, letsencrypt).ย https://github.com/taherio/redi
- cat-sites Library of sites for categorization.ย https://github.com/audrummer15/cat-sites
- ycsm is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2).ย https://github.com/infosecn1nja/ycsm
- Domain Fronting Google App Engine.ย https://github.com/redteam-cyberark/Google-Domain-fronting
- DomainFrontDiscover Scripts and results for finding domain frontable CloudFront domains.ย https://github.com/peewpw/DomainFrontDiscover
- Automated Empire Infrastructureย https://github.com/bneg/RedTeam-Automation
- Serving Random Payloads with NGINX.ย https://gist.github.com/jivoi/a33ace2e25515a31aa2ffbae246d98c9
- meek is a blocking-resistant pluggable transport for Tor. It encodes a data stream as a sequence of HTTPS requests and responses.ย https://github.com/arlolra/meek
- CobaltStrike-ToolKit Some useful scripts for CobaltStrike.ย https://github.com/killswitch-GUI/CobaltStrike-ToolKit
- mkhtaccess_red Auto-generate an HTaccess for payload delivery -- automatically pulls ips/nets/etc from known sandbox companies/sources that have been seen before, and redirects them to a benign payload.ย https://github.com/violentlydave/mkhtaccess_red
- RedFile a flask wsgi application that serves files with intelligence, good for serving conditional RedTeam payloads.ย https://github.com/outflanknl/RedFile
- keyserver Easily serve HTTP and DNS keys for proper payload protection.ย https://github.com/leoloobeek/keyserver
- DoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH). This is built for the popular Adversary Simulation and Red Team Operations Software Cobalt Strike (https://www.cobaltstrike.com).ย https://github.com/SpiderLabs/DoHC2
- HTran is a connection bouncer, a kind of proxy server. A โlistenerโ program is hacked stealthily onto an unsuspecting host anywhere on the Internet.ย https://github.com/HiwinCN/HTran
Buffer Overflow and Exploit Development
- https://github.com/CyberSecurityUP/Buffer-Overflow-Labs
- https://github.com/gh0x0st/Buffer_Overflow
- https://github.com/freddiebarrsmith/Buffer-Overflow-Exploit-Development-Practice
- https://github.com/21y4d/Windows_BufferOverflowx32
- https://github.com/johnjhacking/Buffer-Overflow-Guide
- https://github.com/npapernot/buffer-overflow-attack
- https://github.com/V1n1v131r4/OSCP-Buffer-Overflow
- https://github.com/KINGSABRI/BufferOverflow-Kit
- https://github.com/FabioBaroni/awesome-exploit-development
- https://github.com/Gallopsled/pwntools
- https://github.com/hardenedlinux/linux-exploit-development-tutorial
- https://github.com/Billy-Ellis/Exploit-Challenges
- https://github.com/wtsxDev/Exploit-Development
MindMaps by Joas
- https://www.mindmeister.com/pt/1746180947/web-attacks-bug-bounty-and-appsec-by-joas-antonio
- https://www.mindmeister.com/pt/1760781948/information-security-certifications-by-joas-antonio
- https://www.mindmeister.com/pt/1781013629/the-best-labs-and-ctf-red-team-and-pentest
- https://www.mindmeister.com/pt/1760781948/information-security-certifications-by-joas-antonio
- https://www.mindmeister.com/pt/1746187693/cyber-security-career-knowledge-by-joas-antonio
Lateral Movement
- https://github.com/0xthirteen/SharpRDP
- https://github.com/0xthirteen/MoveKit
- https://github.com/0xthirteen/SharpMove
- https://github.com/rvrsh3ll/SharpCOM
- https://github.com/malcomvetter/CSExec
- https://github.com/byt3bl33d3r/CrackMapExec
- https://github.com/cube0x0/SharpMapExec
- https://github.com/nccgroup/WMIcmd
- https://github.com/rasta-mouse/MiscTools
- https://github.com/byt3bl33d3r/DeathStar
- https://github.com/SpiderLabs/portia
- https://github.com/Screetsec/Vegile
- https://github.com/DanMcInerney/icebreaker
- https://github.com/MooseDojo/apt2
- https://github.com/hdm/nextnet
- https://github.com/mubix/IOXIDResolver
- https://github.com/Hackplayers/evil-winrm
- https://github.com/bohops/WSMan-WinRM
- https://github.com/dirkjanm/krbrelayx
- https://github.com/Mr-Un1k0d3r/SCShell
- https://github.com/rvazarkar/GMSAPasswordReader
- https://github.com/fdiskyou/hunter
- https://github.com/360-Linton-Lab/WMIHACKER
- https://github.com/leechristensen/SpoolSample
- https://github.com/leftp/SpoolSamplerNET
- https://github.com/lexfo/rpc2socks
- https://github.com/checkymander/sshiva
- https://github.com/dev-2null/ADCollector
POST Exploitation
- https://github.com/mubix/post-exploitation
- https://github.com/emilyanncr/Windows-Post-Exploitation
- https://github.com/nettitude/Invoke-PowerThIEf
- https://github.com/ThunderGunExpress/BADministration
- https://github.com/bohops/SharpRDPHijack
- https://github.com/antonioCoco/RunasCs
- https://github.com/klsecservices/Invoke-Vnc
- https://github.com/mandatoryprogrammer/CursedChrome
- https://github.com/djhohnstein/WireTap
- https://github.com/GhostPack/Lockless
- https://github.com/infosecn1nja/SharpDoor
- Phishing Tools
- https://github.com/hlldz/pickl3
- https://github.com/shantanu561993/SharpLoginPrompt
- https://github.com/Dviros/CredsLeaker
- https://github.com/bitsadmin/fakelogonscreen
- https://github.com/CCob/PinSwipe
Wrapper for various tools
Active Directory Audit and exploit tools
- https://github.com/mwrlabs/SharpGPOAbuse
- https://github.com/BloodHoundAD/BloodHound
- https://github.com/BloodHoundAD/SharpHound3
- https://github.com/chryzsh/awesome-bloodhound
- https://github.com/hausec/Bloodhound-Custom-Queries
- https://github.com/CompassSecurity/BloodHoundQueries
- https://github.com/vletoux/pingcastle
- https://github.com/cyberark/ACLight
- https://github.com/canix1/ADACLScanner
- https://github.com/fox-it/Invoke-ACLPwn
- https://github.com/NinjaStyle82/rbcd_permissions
- https://github.com/NotMedic/NetNTLMtoSilverTicket
- https://github.com/dirkjanm/ldapdomaindump
Web Vulnerability Scanner / Burp Plugins
- https://github.com/m4ll0k/WAScanย - all in one scanner
- https://github.com/s0md3v/XSStrikeย - XSS discovery
- https://github.com/federicodotta/Java-Deserialization-Scanner
- https://github.com/d3vilbug/HackBar
- https://github.com/gyoisamurai/GyoiThon
- https://github.com/snoopysecurity/awesome-burp-extensions
- https://github.com/sting8k/BurpSuite_403Bypasserย - Burpsuite Extension to bypass 403 restricted directory
- https://github.com/BishopFox/GadgetProbe
Web Exploitation Tools
- https://github.com/OsandaMalith/LFiFreakย - lfi
- https://github.com/enjoiz/XXEinjectorย - xxeย #XXE
- https://github.com/tennc/webshellย - shellz
- https://github.com/flozz/p0wny-shell
- https://github.com/epinna/tplmapย - ssti
- https://github.com/orf/xcatย - xpath injection
- https://github.com/almandin/fuxploiderย - File Uploads
- https://github.com/nccgroup/freddyย - deserialization
- https://github.com/irsdl/IIS-ShortName-Scannerย - IIS Short Filename Vuln. exploitation
- https://github.com/frohoff/ysoserialย - Deserialize Java Exploitation
- https://github.com/pwntester/ysoserial.netย - Deserialize .NET Exploitation
- https://github.com/internetwache/GitToolsย - Exploit .git Folder Existence
- https://github.com/cujanovic/SSRF-Testingย - SSRF Tutorialsย #SSRF
- https://github.com/ambionics/phpggcย - PHP Unserialize Payload generator
- https://github.com/BuffaloWill/oxml_xxeย - Malicious Office XXE payload generator
- https://github.com/tijme/angularjs-csti-scannerย - Angularjs Csti Scanner
- https://github.com/0xacb/viewgenย - Deserialize .NET Viewstates
- https://github.com/Illuminopi/RCEvil.NETย - Deserialize .NET Viewstates
Linux Privilege Escalation / Audit
- https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEASย - powerfull Privilege Escalation Check Script with nice output
- https://github.com/mzet-/linux-exploit-suggester
- https://github.com/rebootuser/LinEnum
- https://github.com/diego-treitos/linux-smart-enumeration
- https://github.com/CISOfy/lynis
- https://github.com/AlessandroZ/BeRoot
- https://github.com/future-architect/vuls
- https://github.com/ngalongc/AutoLocalPrivilegeEscalation
- https://github.com/b3rito/yodo
- https://github.com/belane/linux-soft-exploit-suggesterย - lookup vulnerable installed software
- https://github.com/sevagas/swap_digger
- https://github.com/NullArray/RootHelper
- https://github.com/NullArray/MIDA-Multitool
- https://github.com/initstring/dirty_sock
- https://github.com/jondonas/linux-exploit-suggester-2
- https://github.com/sosdave/KeyTabExtract
- https://github.com/DominicBreuker/pspy
- https://github.com/itsKindred/modDetective
- https://github.com/nongiach/sudo_inject
- https://github.com/Anon-Exploiter/SUID3NUMย - find suid bins and look them up under gtfobins / exploitable or not
- https://github.com/nccgroup/GTFOBLookupย - Offline GTFOBins
- https://github.com/TH3xACE/SUDO_KILLERย - sudo misconfiguration exploitation
- https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
- https://github.com/inquisb/unix-privesc-check
- https://github.com/hc0d3r/tasย - easily manipulate the tty and create fake binaries
- https://github.com/SecWiki/linux-kernel-exploits
- https://github.com/initstring/uptux
- https://github.com/andrew-d/static-binariesย - not really privesc but helpfull
Command and Control
- Cobalt Strike is software for Adversary Simulations and Red Team Operations.ย https://cobaltstrike.com/
- Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent.ย https://github.com/EmpireProject/Empire
- Metasploit Framework is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development.ย https://github.com/rapid7/metasploit-framework
- SILENTTRINITY A post-exploitation agent powered by Python, IronPython, C#/.NET.ย https://github.com/byt3bl33d3r/SILENTTRINITY
- Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python.ย https://github.com/n1nj4sec/pupy
- Koadic or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire.ย https://github.com/zerosum0x0/koadic
- PoshC2 is a proxy aware C2 framework written completely in PowerShell to aid penetration testers with red teaming, post-exploitation and lateral movement.ย https://github.com/nettitude/PoshC2_Python
- Gcat a stealthy Python based backdoor that uses Gmail as a command and control server.ย https://github.com/byt3bl33d3r/gcat
- TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution.ย https://github.com/trustedsec/trevorc2
- Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.ย https://github.com/Ne0nd0g/merlin
- Quasar is a fast and light-weight remote administration tool coded in C#. Providing high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you.ย https://github.com/quasar/QuasarRAT
- Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.ย https://github.com/cobbr/Covenant
- FactionC2 is a C2 framework which use websockets based API that allows for interacting with agents and transports.ย https://github.com/FactionC2/
- DNScat2 is a tool is designed to create an encrypted command-and-control (C&C) channel over the DNS protocol.ย https://github.com/iagox86/dnscat2
- Sliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS.ย https://github.com/BishopFox/sliver
- EvilOSX An evil RAT (Remote Administration Tool) for macOS / OS X.ย https://github.com/Marten4n6/EvilOSX
- EggShell is a post exploitation surveillance tool written in Python. It gives you a command line session with extra functionality between you and a target machine.ย https://github.com/neoneggplant/EggShell
Adversary Emulation
- MITRE CALDERA - An automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks.ย https://github.com/mitre/caldera
- APTSimulator - A Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.ย https://github.com/NextronSystems/APTSimulator
- Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework.ย https://github.com/redcanaryco/atomic-red-team
- Network Flight Simulator - flightsim is a lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.ย https://github.com/alphasoc/flightsim
- Metta - A security preparedness tool to do adversarial simulation.ย https://github.com/uber-common/metta
- Red Team Automation (RTA) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.ย https://github.com/endgameinc/RTA
Repositores
- https://github.com/infosecn1nja/Red-Teaming-Toolkit
- https://github.com/S3cur3Th1sSh1t/Pentest-Tools
- https://github.com/yeyintminthuhtut/Awesome-Red-Teaming
- https://github.com/enaqx/awesome-pentest
- https://github.com/Muhammd/Awesome-Pentest
- https://github.com/CyberSecurityUP/Awesome-PenTest-Practice
- https://drive.google.com/drive/u/0/folders/12Mvq6kE2HJDwN2CZhEGWizyWt87YunkU
- https://github.com/0x4D31/awesome-oscp
- https://github.com/six2dez/OSCP-Human-Guide
- https://github.com/RustyShackleford221/OSCP-Prep
- https://github.com/wwong99/pentest-notes/blob/master/oscp_resources/OSCP-Survival-Guide.md
Malware Analysis and Reverse Engineering
- https://github.com/rshipp/awesome-malware-analysis
- https://github.com/topics/malware-analysis
- https://github.com/Apress/malware-analysis-detection-engineering
- https://github.com/SpiderLabs/malware-analysis
- https://github.com/ytisf/theZoo
- https://github.com/arxlan786/Malware-Analysis
- https://github.com/nheijmans/malzoo
- https://github.com/mikesiko/PracticalMalwareAnalysis-Labs
- https://github.com/secrary/SSMA
- https://github.com/merces/aleph
- https://github.com/mentebinaria/retoolkit
- https://github.com/mytechnotalent/Reverse-Engineering
- https://github.com/wtsxDev/reverse-engineering
- https://github.com/mentebinaria/retoolkit
- https://github.com/topics/reverse-engineering
- https://github.com/0xZ0F/Z0FCourse_ReverseEngineering
- https://github.com/NationalSecurityAgency/ghidra
- https://github.com/hax0rtahm1d/Reverse-Engineering
-
https://github.com/tylerha97/awesome-reversing
- Red Teaming tools, penetration testing, privilege escalation, ethical hacking, AMSI bypass, payload hosting, lateral movement
Show us some love if you liked the content by clicking the =>ย โค๏ธ