Pentest-Tools - 黑客技术相关项目

项目说明

Pentest-Tools

* General usefull Powershell Scripts
* AMSI Bypass restriction Bypass
* Payload Hosting
* Network Share Scanner
* Lateral Mo
* Reverse Shellz
* POST Exploitation
* Pivot
* Backdoor finder
* Persistence on windows
* Web Application Pentest
* Framework Discovery
* Framework Scanner / Exploitation
* Web Scanner / Burp Plugins
* Network- / Ser Scanner
* Crawler
* Web Exploitation Tools
* Windows Pri Escalation / Audit
* T3 Enumeration
* Linux Pri Escalation / Audit
* Credential har Windows Specific
* Credential har Linux Specific
* Data Exfiltration - DNS/ICMP/Wifi Exfiltration
* Git Specific
* Reverse Engineering / decompiler
* Forensics
* Network Attacks
* Specific MITM service Exploitation
* Sniffing / E / Filtering
* Scanner / Exploitation-Frameworks / Automation
* Default Credential Scanner
* Payload Generation / A / Malware Creation
* Domain Finding / Subdomain Enumeration
* Scanner network level
* Email Gathering
* Domain Auth + Exploitation
* 网络 service - Login Brute Force + Wordlist attacks
* Command & Control Frameworks
* Wifi Tools
* Raspberri PI Exploitation
* Social Engeneering
* Wordlists / Wordlist generators
* Obfuscation
* Source Code Analysis
* No category yet
* Industrial Control Systems
* NAC bypass
* JMX Exploitation

And many more. I created this repo to have an o over my starred repos. I was not able to filter in categories before. Feel free to use it for yourself. I do not list Kali default tools as well as several testing tools which are state of the art. STRG+F searches are helpful here.

Windows Acti Pentest

General usefull Powershell Scripts

- :sunglasses:

- same but kerberos auth for more stealth and lockout-sleep

- domainpasswordspray executable with lockout-sleep

- supported - really nice Excel-Sheet for an AD-O

- Powersploit Tasks in C#

- Adidns Attacks

AMSI Bypass restriction Bypass

- modified PowerLessShell

C# Powershell

- Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP and A, AMSI patched

- Constrained language mode bypass

- Applocker Bypass

- This 工具 enables the compilation of a C# program that will execute arbitrary PowerShell 代码, without launching PowerShell processes through the use of runspace.

- The Hunt for Malicious Strings

- Bypass AMSI and Defender using Ordinal in VBS

- OpSec-safe Powershell runspace from within C# (aka SharpPick) with AMSI, CLM and Script Block Logging disabled at startup

- Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft .Load().

- MSBuild without MSbuild.exe

- MSBuildShell, a Powershell Host running within MSBuild.exe

- Executes Blended Managed/Unmanged Exports

- A 工具 to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies / Applocker Bypass Scan

- AmsiHook is a project I created to figure out a bypass to AMSI hooking.

- Load .net assemblies from memory while having them appear to be loaded from an on-disk location.

- Bypass LSA Protection - Dump the memory of a PPL with a userland exploit

Payload Hosting

- Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.

- Updog is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S, can set ad hoc SSL certificates and use http basic auth.

Network Share Scanner

Find Juicy Stuff

- a 工具 for pentesters to help find delicious candy, by and

- Enumerate all 网络 shares in the current domain. Also, can resol to IP addresses.

- Search 工具 to find specific files containing specific words, i.e. files containing passwords..

- .NET 4.0 Console App to browse VMDK / and extract files

- Multithreaded C# .NET Assembly to enumerate accessible 网络 shares in a domain

Reverse Shellz

- A small reverse shell for Linux & Windows

- netcat on steroids with Firewall, IDS/IPS e, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

- C# reverse shell using Background Intelligent Transfer Service (BITS) as communication 协议 and direct syscalls for EDR user-mode hooking e.

Backdoor finder

Lateral Mo

- WMI,SMB,RDP,SCM,DCOM Lateral Mo techniques

- WMI, SCM, DCOM, Task Scheduler and more

- C# Port of In

- An implementation of PSExec in C#

- CsExec, CsPosh (Remote Powershell Runspace), CsWMI,CsDCOM

- Automate Getting Dom-Adm

- automated lateral mo

- backdoor / rootkit

- automation for mitm attacks + vulns

- automated penetration toolkit

- Netbios 网络 interface Enumeration (discovery of dual homed hosts)

- Find dual homed hosts over DCOM

- A collection of proof-of-concept 源码 代码 and scripts for executing remote commands o using the WSMan.Automation COM object

- unconstrained delegation, printer bug (MS-RPRN) exploitation, Remote ADIDNS attacks

- Fileless lateral mo 工具 that relies on ChangeSer to run command

- AD Bloodhound 3.0 Path

- A Bypass Anti-virus Software Lateral Mo Command Execution 工具

- PoC 工具 to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface.

- Collection of remote authentication triggers in C#

- Implementation of SpoolSample without rDLL

- PoC 工具 to coerce Windows hosts to authenticate to other machines EfsRpcOpenFileRaw or other functions.

- Post-exploit 工具 that enables a SOCKS tunnel via a Windows host using an extensible custom RPC proto over SMB through a named pipe.

- C# application that allows you to quick run SSH commands against a host or list of hosts

- A lightweight 工具 to quickly extract information from the Acti en for both attacking and defending.

- .NET 4.0 Scheduled Job Lateral Mo

- Remotely enables Restricted Admin Mode

- LiquidSnake is a 工具 that allows operators to perform fileless lateral mo using WMI Event Subscriptions and GadgetToJScript

- Python 工具 to Check running WebClient services on multiple targets based on -

- Tools for Kerberos PKINIT and relaying to AD CS

- Get file less command execution for lateral mo.

POST Exploitation

- Automatically scan any windows or tabs for login forms and then record what gets posted. A notification will appear when some ha.

- McAfee Epo or Solarwinds post exploitation

- A POC Remote Desktop (RDP) session hijack utility for disconnected sessions

- RunasCs - Csharp and open of windows builtin runas.exe

- Powershell

- Chrome-extension implant that turns Chrome browsers into fully-functional HTTP proxies, allowing you to browse sites as your .

- .NET 4.0 Project to interact with video, audio and keyboard hardware.

- Lockless allows for the copying of locked files.

- C# Clipboard Monitor

- SharpDoor is alternati written in C# to allowed multiple RDP (Remote Desktop) sessions by patching termsrv.dll file.

- MultiRDP is a C# consosle application to make multiple RDP (Remote Desktop) sessions possible by patching termsrv.dll correctly.

- Using outlook COM objects to create con phishing emails without the user noticing. This project is meant for internal phishing.

- A little tool to play with Outlook

- 工具 for interacting with outlook interop during red team engagements

- 2 ways of Password Filter DLL to record the plaintext password

- A .NET 工具 for exporting and importing certificates without touching disk.

- Retrieve LAPS password from LDAP

- remote LAPS dumping from linux

Post Exploitation - Phish Credentials

- Windows active user credential phishing 工具

- Creates a login prompt to gather username and password of the current user. This project allows red team to phish username and password of the current user without touching lsass and having adminitrator credentials on the system.

- Phish Smartcard PIN

- PyHook is an offensive API hooking 工具 written in python designed to catch credentials within the API call.

- SharpHook is an offensive API hooking 工具 designed to catch credentials within the API call.

Wrapper for tools

- .NET Tools wrapped in Powershell

- GhostBuild is a collection of simple MSBuild launchers for GhostPack/.NET projects

- rundll32 Wrapper for Rubeus

- execute Python in C#

Pivot

- Webshell tunnel o proxy - pentesters dream

- reGeorg customized for weblogic

TCP tunneling over HTTP/HTTPS for web application servers like reGeorg

- check for internet access over open ports / egress filtering

- C# Wrapper around Chisel from

- A fast TCP tunnel over HTTP

- ping tunnel is a 工具 that ad tcp/udp/socks5 traffic as icmp traffic for forwarding.

- Reverse Tunneling made easy for pentesters, by pentesters

- An ad, yet simple, tunneling/pi 工具 that uses a TUN interface.

- Socks5/4/4a Proxy support for Remote Desktop 协议 / Terminal Services / Citrix / XenApp / XenDesktop

- mssqlproxy is a toolkit aimed to perform lateral mo in restricted en through a compromised Microsoft SQL 服务端 reuse

- Amplify 网络 from multiple POV of other hosts

- A 工具 to make socks connections through HTTP agents

- TCP Port Redirection Utility

- socks4 reverse proxy for penetration testing

Acti Audit and exploit tools

- C# Data Collector for the BloodHound Project, 3

- Maximizing BloodHound. Max is a good boy.

- same as in but in python

- Acti information dumper via LDAP

- Kerberos Resource-Based Constrained Delegation Attack from Outside using Impacket

- SpoolSample -> Responder w/NetNTLM Downgrade -> NetNTLMv1 -> NTLM -> Kerberos Sil

- 工具 to disco Constrained Delegation attack paths in Acti en

- Add SD for controlled computer object to a target object for RBCD using LDAP

- Acti certificate abuse.

- Python implementation for Acti certificate abuse

- ADCS abuser

- PowerShell toolkit for AD CS auditing based on the PSPKI toolkit.

- A proof of concept on attack against Acti by abusing Acti Certificate Services (ADCS)

- C# of Powermad

Persistence on windows

- The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification

- Python of the C# 工具 for "Shadow Credentials" attacks

- pyForgeCert is a Python equi of the ForgeCert.

- Whisker is a C# 工具 for taking o Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.

- "Golden" certificates

- Hijack Printconfig.dll to execute shellcode

Web Application Pentest

Framework Discovery

- Wordpress, Joomla, Drupal Scanner

Framework Scanner / Exploitation

- wordpress

- lotus domino

- Drupal

- Typo3

- Joomla

Web Scanner / Burp Plugins

- all in one scanner

- XSS discovery

- Burpsuite Extension to bypass 403 restricted directory

- Probe endpoints consuming Ja objects to identify classes, libraries, and library on remote Ja.

Network- / Ser Scanner

File / Directory / Parameter discovery

- Mining parameters from dark corners of Web Archives

- :heartpulse:

- Directory lookup from Ja files

- Automation for ja recon in bug bounty.

- Admin Panel Finder

Crawler

- Headless web crawler for bugbounty and penetration-testing/redteaming

- :heartpulse:

- Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

Web Exploitation Tools

- lfi

- xxe

- shellz

- ssti

- xpath injection

- File Uploads

- deserialization

- IIS Short Filename Vuln. exploitation

- Deserialize Ja

- Deserialize .NET Exploitation

- Exploit .git Folder Existence

- Leak git repositories from misconfigured websites

- SSRF Tutorials

- PHP Unserialize Payload generator

- Malicious Office XXE payload generator

- Angularjs Csti Scanner

- Deserialize .NET

- Deserialize .NET

REST API Audit

- RESTler is the first stateful REST API fuzzing 工具 for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.

SAML Login

- Python Script for SAML2 Authentication Passwordspray

Swagger File API Attack

Windows Pri Escalation / Audit

- Pri Escalation Enumeration Script for Windows

- powerfull Pri Escalation Check Script with nice output

- UAC

- C# tool for UAC bypasses

- Bypass UAC at any level by abusing the Program Compatibility Assistant with RPC, WDI, and more Windows components

- UAC

- find dlls for preloading attack

- dll hijack scanner

- admin to system

- Exploit for the RpcEptMapper registry key permissions (Windows 7 / 2088R2 / 8 / 2012)

Windows Pri Abuse (Pri Escalation)

- Abuse Windows Pri

- load malicious dlls from system32

- Exploit potatoes with automation

- from Service Account to System

- Another Windows Local Pri Escalation from Service Account to System

- Abusing Impersonation Pri on Windows 10 and 服务端 2019

- itm4ns Printspoofer in C#

- Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePri local pri escalation ).

- Just another "Won't Fix" Windows Pri Escalation from User to Domain Admin.

- Recover the default pri set of a LOCAL/网络 SERVICE account

T3 Enumeration

Linux Pri Escalation / Audit

- powerfull Pri Escalation Check Script with nice output

- lookup installed software

- find suid bins and look them up under gtfobins / exploitable or not

- Offline GTFOBins

- sudo misconfiguration exploitation

- easily manipulate the tty and create fake binaries

- not really privesc but helpfull

- Automatic Linux privesc of low-hanging fruit e.g. gtfobins, polkit, docker socket

Exfiltration

Credential har Windows Specific

- Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory.

- Kerberoast with ACL abuse capabilities

- remote lazagne

- Browser Creds gathering

- hack-browser-data is an open-源码 工具 that could help you decrypt data[passwords|bookmarks|cookies|history] from the browser.

- ClipHistory feature get the last 25 copy paste actions

- extract live rdp logins

- Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute.

- .NET 4.0 CLR Project to retrie data, such as cookies, history and sa.

- Chromium Cookie import / export tool

- ThunderFox for Firefox Credentials, SitkyNotesExtract for "Notes as passwords"

- Command line 工具 to extract/decrypt the password that was stored in the LSA by SysInternals AutoLogon

- .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py

- C# 工具 to discover low hanging fruits like SessionGopher

- DPAPI Creds via C#

- C# porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands

- Dumping DPAPI credz remotely

- credential dump using foreshaw technique using SeTrustedCredmanAccessPri

- Mimikatz implementation in pure Python

LSASS dumper / process dumper

- PIC lsass dumper using cloned handles

- Dump stuff without touching disk

- Another LSASS dumping 工具 that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory

- Command line interface to dump LSASS memory to disk

- dump lsass using direct system calls and API unhooking

- C# Lsass parser

- Create a minidump of the LSASS process from memory - using Dumpert

- Evade WinDefender ATP credential-theft

- remote procdump.exe, copy dump file to local system and pypykatz for analysis/extraction

- This project reuses open handles to lsass to parse or minidump lsass

Credential har Linux Specific

- SSH Credential loot

- SSH / Sudo / SU Credential loot

- 工具 to extract Kerberos tickets from Linux kernel keys.

Data Exfiltration - DNS/ICMP/Wifi Exfiltration

- Wifi Exfiltration

- Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP

- Easy files and payloads delivery over DNS

- Hide your payload in DNS

- Modular C# 框架 to exfiltrate loot o and trusted channels.

Git Specific

Windows / Linux

Reverse Engineering / decompiler

- .NET Disassembler

Forensics

Network Attacks

- :heartpulse:

- more up to date

- Deprecated but still good

- mitm6 in C# + Inveigh default features

- Farmer is a project for collecting NetNTLM hashes in a Windows domain. Farmer achieves this by creating a local WebDA that causes the WebDAV Mini Redirector to authenticate from any connecting clients.

- leaking net-ntlm with webdav

- Red Team oriented C# Simple HTTP & WebDA with Net-NTLM hashes capture functionality

Specific MITM service Exploitation

- SSH

- WSUS

- WSuspicious - A 工具 to abuse insecure WSUS connections for pri escalations

- WSUS mitm - Standalone implementation of a part of the WSUS spec. Built for offensi purposes.

- RDP

- RDP man-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

- Fake Updates for Software

- web application li, keystroke logger

- User Enumeration with SMB Relay Attacks

Sniffing / E / Filtering

-

Red-Team SIEM

- Red Team's SIEM - 工具 for Red Teams used for tracking and alarming about Blue Team acti as well as better usability in long term operations.

Scanner / Exploitation-Frameworks / Automation

- automate nmap with scripting capabilities

- Spray a hash via smb to check for local administrator access

Default Credential Scanner

- Login hunter of default credentials for administrative web interfaces le NNdefaccts dataset.

- screenshot for webservers

- One place for all the default credentials to assist the Blue/Red teamers acti on finding devices with default password

Default Credential Lookup

Payload Generation / A / Malware Creation

- Office RCE POC

- Bring your own print dri escalation 工具

- reverse shell generator

- Sandbox E techniques

- SandBox E in C#

- Encrypted HTA Generation

- Optimized GadgetToJScript

- Shikata ga nai (仕方がない) encoder ported into go with several impro

- Spotter is a 工具 to wrap payloads in en, AES256-encrypted launchers.

- Malleable payload generation framework.

- Build Powershell Script from .NET Executable

- Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.

- A 工具 for generating multiple types of NTLMv2 hash theft files by Jacob Wilkin (Greenwolf)

- AES Encrypt payloads

- Embed and hide any file in an HTML file

- AES Encrypt C/C++ Compiled binaries and decrypt at runtime

- PoC of a spawning a process with a spoofed parent and command line.

- Generates Malicious Macro and Execute Powershell or Shellcode Application Whitelisting Bypass.

- A cross-platform assistant for creating malicious MS Office documents. Can hide , stomp VBA 代码 () and confuse macro analysis tools. Runs on Linux, OSX and Windows.

- Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.

- BoobSnail allows generating Excel 4.0 XLM macro. Its purpose is to support the RedTeam and BlueTeam in XLM macro generation.

- Excel Macro Document Reader/Writer for Red Teamers & Analysts

- Out-of-the-Box 工具 to Obfuscate Excel XLS. Include Obfuscation & Hide for Cell Labels & BoundSheets

- PwnyForm will take an MSI installer as input and generate an MSI transform (mst) that can be used to inject arbitrary command execution by adding a custom action that will execute during the UI or Install sequence of an MSI file.

- your Office documents with OfficePurge. remo from module streams within Office documents. Documents that only contain 源码 代码 and no compiled 代码 are more likely to evade A and YARA rules.

- A Control Panel Applet dropper project. It has a high success rate on engagements since nobody cares about .CPL files and you can just double click them.

- Macro-Enabled Excel File Generator (.xlsm) using the EPPlus Library.

- C# based 工具 which automates the process of disco and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during Red Team Operations to evade EDR's.

- Retrie functions from a legitimate DLL and generates a proxy DLL 源码 代码/template for DLL proxy loading or sideloading

- Koppeling x Metatwin x LazySign

- Sign an executable for A

- A 工具 for generating fake 代码 signing certificates or signing real ones

- RCE 0-day for GhostScript 9.50 - Payload generator - ImageMagick

- Just a PoC to turn xlsx (regular Excel files) into xlsm (Excel file with macro) and slipping inside a macro (.bin)

- SigFlip is a 工具 for patching authenticode signed PE files (exe, dll, sys ..etc) without in or breaking the existing signature.

- Template-Driven AV/EDR E Framework

- BadAssMacros - C# based automated Malicous Macro Generator.

- LittleCorporal: A C# Automated Maldoc Generator

- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

- ScareCrow - Payload creation 框架 designed around EDR bypass.

- Undetectable & Xor encrypting with custom KEY (FUD Metasploit Rat) bypass Top Antivirus like BitDefender,Malwarebytes,Avast,ESET-NOD32,AVG,... & Automatically Add ICON and MANIFEST to excitable

Shellcode Injection

- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

- D/Invoke port of UrbanBishop

- A port of FuzzySecurity's UrbanBishop project for inline shellcode execution

- Donut for Shellcode Injection

- Mapping injection is a process injection technique that avoids the usage of common monitored syscall , WriteProcessMemory and CreateRemoteThread.

- Shellcode injection POC using syscalls.

- Shellcode wrapper with encryption for multiple target languages

- A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using API calls or techniques.

- C# Shellcode Runner to execute shellcode and SetThreadContext to evade Get-InjectedThread

- A set of scripts that demonstrate how to perform memory injection in C#

- SysWhispers helps with e by generating header/ASM files implants can use to make direct system calls.

- X86 of syswhispers2 / x86 direct system call

- CreateThreadpoolWait, Fiber Load, NtTestAlert Load, SEH Except Load, TLS CallBack Load, Dynamic Load, Dynamic Load plus, Syscall Load, APC-Inject Load, Early Brid APC-Inject Load, NtCreateSection-Inject Load, OEP Hiijack-Inject Load, Thread Hiijack-Inject Load

- Suite of Shellcode Running Utilities

- Shellcode runner in GO that incorporates shellcode encryption, remote process injection, block dlls, and spoofed parent process

- Yet another shellcode runner consists of different techniques for e detection capabilities of endpoint security solutions

- It's a go of Hells gate! (directly calling windows kernel functions, but from Go!)

- This program is designed to demonstrate process injection techniques

- A collection of C# shellcode injection techniques. All techniques use an AES encrypted meterpreter payload. I will be building this project up as I learn, discover or develop more techniques. Some techniques are better than others at bypassing AV.

- Collection of shellcode injection techniques packed in a D/Invoke weaponized DLL

- Another meterpreter injection technique using C# that attempts to bypass Defender

- Module Stomping, No New Thread, HellsGate syscaller, UUID Dropper for x64 Windows 10!

- Upsilon execute shellcode with syscalls - no API like NtProtect is used

- Complete Arsenal of Memory injection and other techniques for red-teaming in Windows

- Injects shellcode into remote processes using direct syscalls

- A collection of weird ways to execute unmanaged 代码 in .NET

- E shellcode loader for bypassing e injection detection (PoC)

- A protective and Low Le Loader that defeats modern EDR systems.

- C++ Injection techniques

-

- POCs for Shellcode Injection

- PoC for UUID shellcode execution using DInvoke

- Alternati Execution

- Natiques C# Codes (代码 Execution Functions Technique, without CreateThread Native API)

- CallBack-Techniques for Shellcode execution ported to Nim

Loader / Packer / Injectors

- Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, a EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs (hash)

- Reflective PE packer.

- Suite of Shellcode Running Utilities

- Open-Source PE Packer

- This project describes a technique how a NATI link library (DLL) can be loaded from memory (In C#) without storing it on the hard-disk first.

- C# Reflecti for unmanaged binaries.

EDR E - Logging E

- A method of bypassing EDR's acti DLL's by pre entry point execution

- Evade sysmon and windows event logging

- C# Implementation of the Hell's Gate

- Original C Implementation of the Hell's Gate

- C++ of In

- C# of In

- .Net Assembly to block ETW telemetry in current process

- A Bind Shell Using the Fax Service and a DLL Hijack

- Protected Process (Light) Dump: Uses Zemana AntiMalware 引擎 To Open a Pri Handle to a PP/PPL Process And Inject MiniDumpWriteDump() Shellcode

- This is a 工具 that allows you to offensively use YARA to apply a filter to the events being reported by windows event logging.

- Extracting Syscall Stub, Modernized

- Hiding your process in ProcessHacker,Task Manager,etc by patching NtQuerySystemInformation

- LoadLibrary for offensi

- Same but with LL

- An implementation of a Windows loader that can load dynamic-linked libraries (DLLs) directly from memory

- A 工具 to kill antimalware protected processes

- 工具 to bypass LSA Protection (aka Protected Process Light)

- get NTDLL copy from suspended process

- A way to delete a locked file, or current running executable, on disk.

- C# implementation of the research by and the drafted PoC from

- Process Herpaderping proof of concept, 工具, and technical deep di Herpaderping bypasses security products by obscuring the intentions of a process.

- A centralized resource for pre documented WDAC bypass techniques

- An ad in-memory e technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

- Thread Stack Spoofing - PoC for an ad In-Memory e technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

- A shellcode function to encrypt a running process image when sleeping.

- some gadgets about windows process and ready to use :)

- A memory scanning e technique

- Some 源码 代码 to demonstrate a certain direct syscall detections by locating and JMPing to a legitimate syscall instruction within NTDLL.

- A more stealthy of "DLL hollowing"

- Phantom DLL hollowing PoC

- Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

- C# Based Uni API Unhooker

- UnhookMe is an uni Windows API resolver & unhooker addressing problem of in unmonitored system calls from within of your Red Teams malware

- PoC: Exploit 32-bit Thread Snapshot of WOW64 to Take Over $RIP & Inject & Bypass Antivirus HIPS (HITB 2021)

- OffensivePH - use old Process Hacker driver to bypass several user-mode access controls

- A 框架 for creating COM-based bypasses utilizing in Microsoft's WDAPT sensors.

- A manual system call library that supports functions from both ntdll.dll and win32u.dll

- Resol numbers at runtime for all Windows .

- Enumerating and removing kernel callbacks using signed drivers

- Enumerate and disable common sources of telemetry used by AV/EDR.

- Dynamically invoke arbitrary unmanaged 代码 from managed 代码 without PInvoke.

- I used this to see if an EDR is running in Safe Mode

- DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userland Hooking.

Useful Binary Modification tools

Android

External Penetration Testing

Domain Finding / Subdomain Enumeration

+ Scanner

- more like an audit

- :heartpulse:

File Search / Metadata extraction

Scanner

- The Swiss Army knife for automated Web Application Testing

Email Gathering

- Find Emails of Github Users

- super fast emails /bing linkedin dorks

- A simple email generator that uses dorks on Bing to generate emails from LinkedIn Profiles.

Check Email Accounts

- allows you to check if the mail is used on different sites like twitter, instagram and will retrie on sites with the forgotten password function.

Domain Auth + Exploitation

- Enumerate valid usernames from Office 365 using Acti, Autodiscover v1, or office.com login page.

- A password spraying 工具 for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.

- 工具 to enumerate information from NTLM authentication enabled web endpoints

- rotate IP Adresses over AWS - Combine with MSOLSpray

- office 365 recon

- lockout Time integrated

- Lync Credential Finder

- Scripts to make password spraying attacks against Lync/S4B & OWA a lot quicker, less painful and more efficient

- Lync Credential Finder

- Use to browse the share file by eas(Exchange Ser)

- PEAS is a Python 2 library and command line application for running commands on an Acti 服务端 e.g. Microsoft Exchange.

- Modified of PEAS 客户端 for offensi -

- A C# 工具 to send emails through Outlook from the command line or in memory

- 工具 for assessing on-premises Microsoft servers authentication such as ADFS, Skype, Exchange, and RDWeb

- A script to test credentials against Acti Federation Services (ADFS), allowing password spraying or bruteforce attacks.

- onedrive user enumeration - pentest 工具 to enumerate valid onedri

- Brute force attack 工具 for Azure AD Autologon/Seamless SSO - 源码:

- POC of SecureWorks' recent Azure Acti password brute-forcing vuln

- Password attacks and MFA against endpoints in Azure and Office 365

- User enumeration with Microsoft Teams API

- Refactored & impro password spraying 工具, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling

Exchange RCE-exploits

- Exchange2010 authorized RCE

- OWA Deserialisation RCE

MobileIron RCE

Specific Service Scanning / Exploitation

Login Brute Force + Wordlist attacks

- Brute force non hydra compliant services - RDP, VNC, OpenVPN

- Brute Force services

- :sunglasses:

- Crack any Microsoft Windows users password without any pri (Guest account included)

- RDP Password Spray - No Event Logs

- Python3 工具 to perform password spraying using RDP

SNMP

Open X11

Printers

- Automation for PRET

MSSQL

Oracle

IKE

SMB Null Session Exploitation

iLO Exploitation

Exploits

- Exploit for C in 6.7

Intel AMT Exploitation

SAP Exploitation

FPM port

Found Port 9001 open? Try that:

- bash poc scripts to exploit open fpm ports

Weblogic Exploitation

- scan/test for nearly all weblogic vulns

- WEblogic Ser

- c

Sharepoint exploitation

- Sharepoint Fingerprint + Exploitation

JIRA

- One stop place for exploiting Jira instances in your proximity

Sonicwall VPN

- .NET Project for Attacking

Dameware

Confluence Exploit

- Confluence Ser OGNL injection

Telerik UI for ASP.NET AJAX Exploit

General Recon

Solarwinds

- SolarWinds Orion Account Audit / Password Dumping Utility

Command & Control Frameworks

- Command and Control 框架 written in C#.

- Empire with embedded AMSI-Bypass

- C2Bridges allow de to create new custom communication protocols and quickly utilize them within Co.

- Source for tasks I have used with Co

- Implant framework

- A post exploitation 框架 designed to operate co on heavily monitored en

- Custom Command and Control (C3). A 框架 for rapid prototyping of custom C2 channels, while still pro integration with existing offensi.

- Open-源码 Remote Administration 工具 For Windows C# (RAT)

- Small and con C2 工具 for Windows targets

- Kubesploit is a cross-platform post-exploitation HTTP/2 Command & Control 服务端 and agent written in Golang, focused on containerized en.

Mythic Agents

VBA

- This repository is a collection of my malicious .

- Trigen is a Python script which uses different combinations of Win32 function calls in generated VBA to execute shellcode.

- AMSI Bypass Via the Heap

- This repo covers some 代码 execution and A methods for Macros in Office documents

Rust

- Dynamically invoke arbitrary unmanaged 代码.

- Rust Weaponization for Red Team Engagements.

Go

- Golang PE injection on windows

Cobalt Strike Stuff

- My collection of battle-tested Aggressor Scripts for Cobalt Strike 4.0+

- Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel

- Dumping SAM / SECURITY / SYSTEM registry hives with a Beacon Object File

- A Cobalt Strike Aggressor script to generate GadgetToJScript payloads

- Cobalt Strike BOFs

- A BOF port of the research of and

- Situational Awareness commands implemented using Beacon Object Files

- InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

- BOF implementation of the research by and the drafted PoC from

- A faithful transposition of the key features/functionality of 's PPLDump project as a BOF.

- Cobalt Strike User-Defined Reflecti written in Assembly & C for ad e capabilities.

- Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon

- SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure e.

- Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary 代码 Guard (ACG), BlockDll, and PPID spoofing.

- Read Excel Spreadsheets (XLS/XLSX) using Cobalt Strike's Execute-Assembly

- Read the contents of DOCX files using Cobalt Strike's Execute-Assembly

- Project to enumerate proxy configurations and generate shellcode from CobaltStrike

- Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation

- Remove API hooks from a Beacon process.

- Collection of Beacon Object Files

- 工具 for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)

Android

Linux MacOSX Specific

Wifi Tools

- Powerful 框架 for rogue access point attack.

Android / Nethunter

NAT Slipstreaming

- NAT Slipstreaming allows an attacker to remotely access any TCP/UDP services bound to a machine, bypassing the ’s NAT/firewall, just by the a website

Raspberri PI Exploitation

Physical Security / HID/ETH Emulator

- PCI-based DMA

- PCI based DMA

- Teensy Payloads

Social Engeneering

- lookup valid phishing-Domains

- lookup valid phishing-Domains

- Change SMB Files on the fly

- Comprehensive Web Based Phishing Suite of Tools for Rapid Deployment and Real-Time Alerting!

Defender Guides / Tools / Incident Response / Blue Team

- Hunts out CobaltStrike beacons and logs operator command output

- Detect and respond to Cobalt Strike beacons using ETW.

- Detect AMSI.dll in memory patch

- Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 en.

- Credential and Red Teaming Defense for Windows En

- powershell obfuscation detection

- Lists of .NET Deobfuscator and Unpacker (Open 源码)

- python exe decompile

- .NET Re

- ids

- In malicious Windows logon by and analyzing Windows event log

- AD Passwort Blacklisting

- Powershell DE-Obfuscation

- A 工具 for de-obfuscating PowerShell scripts

- Identifies the bytes that Microsoft Defender flags on.

- Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.

- 工具 written in python3 to determine where the A is located in a binary/payload

- An Acti and EDR software to empower Blue Teams

- Scans all running processes. Recognizes and dumps a of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

- Scans a gi. Recognizes and dumps a of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

- AD Security Intrusion Detection System

- Small and highly portable detection tests based on MITRE's ATT&CK.

- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detection by Events (in-memory) etc.

- Monitor creation, deletion and changes to LDAP objects li your pentest or system administration!

- PSGumshoe is a Windows PowerShell module for the collection of OS and domain artifacts for the purposes of performing li, hunt, and forensics.

- FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening (real-time). Since FalconEye runs in kernel mode, it provides a stronger and reliable defense against process injection techniques that try to evade user-mode hooks.

Wordlists / Wordlist generators

- A collection of all the data i could extract from 1 billion leaked credentials from internet.

AD Lab En

- Create a acti that's allowing you to test most of the acti attacks in a local lab

- Automate the creation of a lab en complete with security tooling and logging best practices

Obfuscation

- GO Obfuscator

- Lists of .NET Obfuscator (Free, Trial, Paid and Open 源码 )

- Ja Obfuscator

- Powershell Obfuscator

- .NET IL Obfuscator

- C/C++ 源码 obfuscator for antivirus bypass

- GIMPLE obfuscator for C, C++, Go, ... all supported GCC targets and front-ends that use GIMPLE.

-

- Shellcode Obfuscator

- Shellcode Encoder

- Obfuscate Go builds

- heavily c++17 compile time string encryption.

- A more ad free and open .NET obfuscator using dnlib.

- PowerShell Script Obfuscator

- Proof-of-concept obfuscation toolkit for C# post-exploitation tools

- YouTube/Li project for obfuscating C# 源码 代码 using Roslyn

- Simple & Powerful PowerShell Script Obfuscator

- A better of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs.

- C obfuscator

- NIM ll

Hash Crack / Decryption

- Ciphey is an automated decryption 工具. Input encrypted text, get the decrypted text back.

- A mostly-ser distributed hash cracking platform

- Cracking hashes in the Cloud (for free!)

- CrackQ: A Python Hashcat cracking queue system

Source Code / Binary Analysis

Binary Analysis

Source Code Analysis

- Ja

- Ja

- PHP

- Audit 工具 to find common in PHP 源码 代码

Nim

- Nim implementation of Process Hollowing using syscalls (PoC)

- Malicious PDF Generator

- A tiny library to automatically encrypt string literals in Nim 代码

- RDI implementation in Nim

- A collection of offensive Nim example 代码

- SMBExec implementation in Nim - SMBv2 using NTLM Authentication with Pass-The-Hash technique

- Nim Socks5 library

MISC

- Azure JWT Token Manipulation Toolset

- A little 工具 to convert ccache tickets into kirbi (KRB-CRED) and vice versa based on impacket.

- Drupal Exploit

- SAMBA Exploit

- Reverse Shell Oneliner / Payload Generation

- Reverse/Bind Shell Generator

- check if a user is valid in a domain

- Living of the Land Binaries

- Windows Denial of Service Exploit

- Windows Denial of Service Exploit

PDF Steal NTLMv2 Hash Exploit - C

- :boom: :fire: :boom:

- LibSSH Authentication Bypass vuln.

- windows Privesc Exploit

- OSINT

- Deserialisation Exploits

- S3 bucket tester

- Zone transfer like for internal assessment

- Get-ShellContent.ps1 get the typed content for all open shells

- windows CTF Exploitation

- Apache Pri Escalation

- Windows Ele(持续更新)

- Execute python from powershell

- Recovers passwords from pixelized screenshots

- This is a 工具 suite consisting of miscellaneous offensi aimed at red teamers/penetration testers to primarily aid in Defense E TA0005

- Utility to find AES keys in running processes

- Nightly builds of common C# offensi, fresh from their respecti branches built and released in a CDI fashion using Azure DevOps release pipelines.

- A C# port of the MinHook API hooking library

- This repo contains information about EDRs that can be useful during red team exercise.

Big-IP Exploitation

Azure Cloud Tools

- The Azure AD exploration framework.

- Find exposed data in Azure with this public blob scanner

Anonymous / Tor Projects

Exploit Search

Industrial Control Systems

-

Network access control bypass

Jenkins

JMX Exploitation

- JMX enumeration and attacking tool.

- Mogwai Ja Extensions (JMX) Exploitation Toolkit

Citrix Netscaler Pwn

mikrotik pwn

- Fast exploitation 工具 for Mikrotik RouterOS up to 6.38.4

Red Team infrastructure setup

- terraform cloud c2 redirector setup

- Red Teaming Infrastructure Automation based on Red-Baron

- This application assists in managing attack infrastructure for penetration testers by pro an interface to rapidly deploy, manage, and take down cloud services. These include VMs, domain fronting, Cobalt Strike servers, API gateways, and firewalls.

- Domain Borrowing is a new method to hide C2 traffic using CDN. It was first presented at Blackhat Asia 2021 by Junyu Zhou and Tianze Ding.

- Domain Borrowing PoC

Bypass SPF/DKIM/DMARC

Redis Exploitation

MSF:

* scanner/redis/file_upload

* exploit/linux/redis/redis_replication_cmd_exec

Windows Targets - Webshell upload

Apache Tomcat Exploitation

- Apache Tomcat auto WAR deployment & pwning penetration testing 工具.

- AJP Exploit C

SSRF Exploitation

LFI exploitation

MondoDB Redis Couchdb Exploitation

- NoSql Injection CLI 工具, for finding websites using MongoDB.

XXE

Elasticsearch / Kibana Exploitation

RMI attacks

- RMIScout uses wordlist and bruteforce strategies to enumerate Java RMI functions and exploit RMI parameter unmarshalling

JSON Web Token Analysis / Exploitation

Docker Exploitation

- automation of Docker TCP socket abuse

- Docker API exposed RCE

PHP exploits

- nginx + php misconfiguration

Cloud attack tools

Bluetooth / low energy

Wireless / Radio Exploitation

APT / Malware Emulation / Defense Check

Hash Crack / Lookup

OSCP Lists / tools / help

ASPX Webshells

PHP Webshells

- Full-featured C2 框架 which silently persists on webserver via evil PHP oneliner

- A PHP backdoor management and generation 工具/C2 featuring end to end encrypted payload streaming designed to bypass WAF, IDS, SIEM systems.

JSP WebShells

Other Tool-Lists / Cheat Sheets

- List of Hooking DLLs for different A

- Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensi such as AV's, EDR's and logging tools.

项目信息

开发语言：未知

Star 数：2410

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕黑客技术相关项目展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。