Red-Teaming-Toolkit - This repository contains cutting-edge open-source

项目说明

Red Teaming Toolkit

This repository contains cutting-edge open-源码 security tools (OST) that will help you during ad simulation and as information intended for threat hunter can make detection and pre control easier. The list of tools below that could be potentially misused by threat actors such as APT and Human-Operated Ransomware (HumOR). If you want to contribute to this list send me a pull request.

---

Table of Contents

- Reconnaissance
- Initial Access
- Delivery
- Situational Awareness
- Credential Dumping
- Pri Escalation
- Defense E
- Persistence
- Lateral Mo
- Exfiltration
- Miscellaneous

---

Reconnaissance

|Name|Description|URL|
|-----|-----------|----|
|RustScan|The Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting 引擎 (Python, Lua, Shell supported).|
|Amass|In-depth Attack Surface Mapping and Asset Discovery|
|gitleaks|Gitleaks is a SAST 工具 for detecting hardcoded secrets like passwords, api keys, and tokens in git repos.|
|S3Scanner|Scan for open S3 buckets and dump the contents|
|cloud_enum|Multi-cloud OSINT 工具. Enumerate public resources in AWS, Azure, and Google Cloud.|
|Recon-ng|Open 源码 Intelligence gathering 工具 aimed at reducing the time spent har information from open sources.|
|buster|An ad tool for email reconnaissance|
|linkedin2username|OSINT 工具: Generate username lists for companies on LinkedIn|
|WitnessMe|Web In 工具, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.|
|pagodo|pagodo (Passi Dork) - Automate Google Hacking 数据库 scraping and searching|
|AttackSurfaceMapper|AttackSurfaceMapper is a 工具 that aims to automate the reconnaissance process.|
|SpiderFoot|SpiderFoot is an open 源码 intelligence (OSINT) automation 工具. It integrates with just about every data 源码 a and utilises a range of methods for data analysis, making that data easy to na.|
|dnscan|dnscan is a python wordlist-based DNS subdomain scanner.|
|spoofcheck|A program that checks if a domain can be spoofed from. The program checks SPF and DMARC records for weak configurations that allow spoofing.|
|LinkedInt|LinkedIn Recon Tool|
|BBOT|Recursi scanner inspired by Spiderfoot, but designed to be faster, more reliable, and friendlier to pentesters, bug bounty hunters, and de.|
|Gato (Github Attack TOolkit)|Gato, or GitHub Attack Toolkit, is an enumeration and attack 工具 that allows both blue teamers and offensi practitioners to identify and exploit pipeline within a GitHub organization's public and private repositories.|

Initial Access

Brute Force

|Name|Description|URL|
|-----|-----------|----|
|SprayingToolkit|Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient|
|o365recon|Retrie via O365 with a valid cred|
|CredMaster|Refactored & impro password spraying 工具, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling|

Payload De

|Name|Description|URL|
|-----|-----------|----|
|Ivy|Ivy is a payload creation 框架 for the execution of arbitrary VBA (macro) 源码 代码 directly in memory.|
|PEzor|Open-Source PE Packer|
|GadgetToJScript|A 工具 for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/.|
|ScareCrow|Payload creation 框架 designed around EDR bypass.|
|Donut|Donut is a position-independent 代码 that enables in-memory execution of , JScript, EXE, DLL files and dotNET assemblies. |
|Mystikal|macOS Initial Access Payload Generator|
|charlotte|c++ fully undetected shellcode launcher ;)|
|In|Proof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# studio project.|
|Dendrobate|Dendrobate is a 框架 that facilitates the de of payloads that hook unmanaged 代码 through managed .NET 代码.|
|Offensive VBA and XLS Entanglement|This repo provides examples of how VBA can be used for offensi beyond a simple dropper or shell injector. As we develop more use cases, the repo will be updated.|
|xlsGen|Tiny Excel BIFF8 Generator, to Embedded 4.0 Macros in *.xls|
|darkarmour|Windows A|
|InlineWhispers|工具 for working with Direct System Calls in Cobalt Strike's Beacon Object Files (BOF)|
|E|A cross-platform assistant for creating malicious MS Office documents. Can hide , stomp VBA 代码 () and confuse macro analysis tools. Runs on Linux, OSX and Windows.|
|OfficePurge| your Office documents with OfficePurge. remo from module streams within Office documents.|
|ThreatCheck|Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.|
|CrossC2|Generate CobaltStrike's cross-platform payload|
|Ruler|Ruler is a 工具 that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP 协议.|
|DueDLLigence|Shellcode runner 框架 for application whitelisting bypasses and DLL side-loading. The shellcode included in this project spawns calc.exe.|
|RuralBishop|RuralBishop is practically a carbon copy of UrbanBishop by b33f, but all P/Invoke calls have been replaced with D/Invoke.|
|TikiTorch|TikiTorch was named in homage to CACTUSTORCH by Yiu. The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, then uses CreateRemoteThread to run the desired shellcode within that target process. Both the process and shellcode are specified by the user.|
|SharpShooter|SharpShooter is a payload creation 框架 for the retrieval and execution of arbitrary CSharp 源码 代码. SharpShooter is capable of creating payloads in a of formats, including HTA, JS, VBS and WSF.|
|SharpSploit|SharpSploit is a .NET post-exploitation library written in C#|
|MSBuildAPICaller|MSBuild Without MSBuild.exe|
|macro_pack|macro_pack is a 工具 by used to automatize obfuscation and generation of MS Office documents, , and other formats for pentest, demo, and social engineering assessments.|
|inceptor|Template-Driven AV/EDR E Framework|
|mortar|e technique to defeat and divert detection and pre of security products (AV/EDR/XDR)|
|ProtectMyTooling|Multi-Packer wrapper letting us daisy-chain packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.|
|Freeze|Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternati methods|
|Shhhloader|Shhhloader is a work in progress shellcode loader. It takes raw shellcode as input and compiles a C++ stub that does a bunch of different things to try and bypass AV/EDR|
|DllShimmer|Weaponize DLL hijacking easily. Backdoor any function in any DLL.|

Delivery

Phishing

|Name|Description|URL|
|-----|-----------|----|
|o365-attack-toolkit|A toolkit to attack Office365|
|E|E is a man-in-the-middle attack 框架 used for phishing credentials and session cookies of any web service.|
|Gophish|Gophish is an open-源码 phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.|
|PwnAuth|PwnAuth a web application 框架 for launching and managing OAuth abuse campaigns.|
|Modlishka|Modlishka is a flexible and powerful reverse proxy, that will take your ethical phishing campaigns to the next level.|

Watering Hole Attack

|Name|Description|URL|
|-----|-----------|----|
|BeEF|BeEF is short for The Browser Exploitation 框架. It is a penetration testing 工具 that focuses on the web browser|

Command and Control

Remote Access Tools (RAT)

|Name|Description|URL|
|-----|-----------|----|
|Cobalt Strike|Cobalt Strike is software for Ad Simulations and Red Team Operations.|
|SpecterInsight|SpecterInsight is a cross-platform, post-exploitation command and control 框架 based on .NET for red team engagements, threat emulation, and training. It provides a of obfuscated payloads out-of-the-box and makes a detection a core feature. Command outout is returned in JSON format and exported to ELK for analysis of operations with pre-built dashboards.|
|Brute Ratel C4|Brute Ratel is the most ad Red Team & Ad Simulation Software in the current C2 Market.|
|Empire|Empire 5 is a post-exploitation 框架 that includes a pure-PowerShell Windows agent, and compatibility with Python 3.x Linux/OS X agents.|
|PoshC2|PoshC2 is a proxy aware C2 框架 used to aid penetration testers with red teaming, post-exploitation and lateral mo.|
|Koadic|Koadic C3 COM Command & Control - JScript RAT|
|merlin|Merlin is a cross-platform post-exploitation Command & Control 服务端 and agent written in Go.|
|Mythic|A cross-platform, post-exploit, red teaming 框架 built with python3, docker, docker-compose, and a web browser UI.|
|Co|Co is a .NET command and control 框架 that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborati and control platform for red teamers.|
|shad0w|A post exploitation 框架 designed to operate co on heavily monitored en|
|Sli is a general purpose cross-platform implant 框架 that supports C2 o, HTTP(S), and DNS.|
|SILENTTRINITY|An asynchronous, collaborati agent powered by Python and .NET's DLR|
|Pupy|Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation 工具 mainly written in python|
|Ha is a modern and malleable post-exploitation command and control 框架, created by .|
|NimPlant|A light first-stage C2 implant written in Nim and Python|
|SharpC2|SharpC2 is a Command & Control (C2) 框架 written in C#. It consists of an ASP.NET Core Team 服务端, a .NET 框架 implant, and a .NET MAUI 客户端.|
|Loki|Node.js Command & Control for Script-Jacking Electron Applications|
|AdaptixC2|Adaptix is an extensible post-exploitation and ad emulation 框架 made for penetration testers. The Adaptix 服务端 is written in Golang and to allow operator flexibility.|
|Nimhawk|A powerful, modular, lightweight and efficient command & control 框架 written in Nim.|

Staging

|Name|Description|URL|
|-----|-----------|----|
|pwndrop|Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDA://github.com/kgretzky/pwndrop|
|C2concealer|A command line 工具 that generates randomized C2 malleable profiles for use in Cobalt Strike.|
|FindFrontableDomains|Search for potential frontable domains|
|Domain Hunter|Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names|
|RedWarden|Flexible CobaltStrike Malleable Redirector|
|AzureC2Relay|AzureC2Relay is an Azure Function that and relays Cobalt Strike beacon traffic by the incoming requests based on a Cobalt Strike Malleable C2 profile.|
|C3|C3 (Custom Command and Control) is a 工具 that allows Red Teams to rapidly develop and utilise esoteric command and control channels (C2).|
|Chameleon|A tool for e Proxy categorisation|
|Cobalt Strike Malleable C2 Design and Reference Guide|Cobalt Strike Malleable C2 Design and Reference Guide|
|redirect.rules|Quick and dirty dynamic redirect.rules generator|
|CobaltBus|Cobalt Strike External C2 Integration With Azure Ser, C2 traffic Ser|
|SourcePoint|SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure e.|
|RedGuard|RedGuard is a C2 front flow control 工具,Can avoid Blue Teams,AVs,EDRs check.|
|skyhook|A round-trip obfuscated HTTP file transfer setup built to bypass IDS detections.|
|GraphStrike|Cobalt Strike HTTPS beaconing o Graph API|

Log Aggregation

|Name|Description|URL|
|-----|-----------|----|
|RedELK|Red Team's SIEM - 工具 for Red Teams used for tracking and alarming about Blue Team acti as well as better usability in long term operations.|
|Elastic for Red Teaming|Repository of resources for configuring a Red Team SIEM using Elastic.|
|RedEye|RedEye is a analytic 工具 supporting Red & Blue Team operations|

Situational Awareness

Host Situational Awareness

|Name|Description|URL|
|-----|-----------|----|
|Aggressi|Aggressi is a combination of a .NET 3.5 binary (LetMeOutSharp) and a Cobalt Strike aggressor script (Aggressi.cna). Once LetMeOutSharp is executed on a workstation, it will try to enumerate all a proxy configurations and try to communicate with the Cobalt Strike 服务端 over HTTP(s) using the identified proxy configurations.|
|Gopher|C# tool to discover low hanging fruits|
|SharpEDRChecker|Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensi such as AV's, EDR's and logging tools.|
|Situational Awareness BOF|This Repo intends to serve two purposes. First it provides a nice set of basic situational awareness commands implemented in BOF.|
|Seatbelt|Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensi perspectives.|
|SauronEye|SauronEye is a search 工具 built to aid red teams in finding files containing specific keywords.|
|SharpShares|Multithreaded C# .NET Assembly to enumerate accessible 网络 shares in a domain|
|SharpAppLocker|C# port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions.|
|SharpPrinter|Printer is a modified and console of ListNetworks|

Domain Situational Awareness

|Name|Description|URL|
|-----|-----------|----|
|StandIn|StandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET nati to perform resource based constrained delegation.|
|Recon-AD|An AD recon 工具 based on ADSI and reflective DLL’s|
|BloodHound|Six Degrees of Domain Admin|
|PSPKIAudit|PowerShell toolkit for auditing Acti Certificate Services (AD CS).|
|SharpView|C# implementation of harmj0y's PowerView|
|Rubeus|Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy's Kekeo project (CC BY-NC-SA 4.0 license) and LE TOUX's MakeMeEnterpriseAdmin project (GPL v3.0 license). |
|nanorobeus|A minimalistic 工具 for managing Kerberos tickets. Supports redteam frameworks|
|Grouper|A PowerShell script for helping to find settings in AD Group Policy. (deprecated, use Grouper2 instead!)|
|ImproHound|Identify the attack paths in BloodHound breaking your AD tiering|
|ADRecon|ADRecon is a 工具 which gathers information about the Acti and generates a report which can provide a holistic picture of the current state of the target AD en.|
|ADCSPwn|A 工具 to escalate pri in an acti 网络 by coercing authenticate from machine accounts (Petitpotam) and relaying to the certificate service.|

Credential Dumping

|Name|Description|URL|
|-----|-----------|----|
|Mimikatz|Mimikatz is an open-源码 application that allows users to view and sa credentials like Kerberos tickets.|
|Dumpert|LSASS memory dumper using direct system calls and API unhooking.|
|CredBandit| CredBandit is a proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel.|
|CloneVault|CloneVault allows a red team operator to export and import entries including attributes from Windows Credential Manager. |
|SharpLAPS|Retrieve LAPS password from LDAP|
|SharpDPAPI|SharpDPAPI is a C# port of some DPAPI functionality from 's Mimikatz project.|
|KeeThief|Allows for the extraction of KeePass 2.X key material from memory, as well as the backdooring and enumeration of the KeePass trigger system.|
|SafetyKatz|SafetyKatz is a combination of slightly modified of 's Mimikatz project and 's .NET PE Loader.|
|forkatz|credential dump using forshaw technique using SeTrustedCredmanAccessPri|
|PPLKiller|工具 to bypass LSA Protection (aka Protected Process Light)|
|LaZagne|The LaZagne project is an open 源码 application used to retrieve lots of passwords stored on a local computer.|
|AndrewSpecial|AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.|
|Net-GPPPassword|.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.|
|SharpChromium|.NET 4.0 CLR Project to retrie data, such as cookies, history and sa.|
|Chlonium|Chlonium is an application designed for cloning Chromium Cookies.|
|SharpCloud|SharpCloud is a simple C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.|
|pypykatz|Mimikatz implementation in pure Python. At least a part of it :)|
|nanodump|A Beacon Object File that creates a minidump of the LSASS process.|
|Koh|Koh is a C# and Beacon Object File (BOF) toolset that allows for the capture of user credential material token/logon session leakage.|
|PPLBlade|Protected Process Dumper 工具 that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk.|
|TrickDump|Dump lsass using only NTAPIS running 3 programs to create 3 JSON and 1 ZIP file... and generate the Minidump later!|
|RemoteMonologue|RemoteMonologue is a Windows credential har technique that enables remote user compromise by le the Interactive User RunAs key and coercing NTLM authentications via DCOM.|

Pri Escalation

|Name|Description|URL|
|-----|-----------|----|
|Ele|The Elevate Kit demonstrates how to use third-party pri escalation attacks with Cobalt Strike's Beacon payload.|
|Watson|Watson is a .NET 工具 designed to enumerate missing KBs and suggest exploits for Pri Escalation .|
|SharpUp|SharpUp is a C# port of PowerUp functionality. Currently, only the most common checks have been ported; no weaponization functions have yet been implemented.|
|dazzleUP|A 工具 that detects the pri escalation caused by misconfigurations and missing updates in the Windows operating systems. dazzleUP detects the following .|
|PEASS|Pri Escalation Awesome Scripts SUITE (with colors)|
|SweetPotato|A collection of nati pri escalation techniques from service accounts to SYSTEM|
|MultiPotato| Another Potato to get SYSTEM pri |
|KrbRelayUp|a uni no-fix local pri escalation in windows domain en where LDAP signing is not enforced (the default settings).|
|GodPotato|As Long as You Have the ImpersonatePri Permission, Then You are the SYSTEM!|
|PrivKit|PrivKit is a simple beacon object file that detects pri escalation caused by misconfigurations on Windows OS.|

Defense E

|Name|Description|URL|
|-----|-----------|----|
|RefleXXion|RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc.|
|EDRSandBlast|EDRSandBlast is a 工具 written in C that weaponize a signed driver to bypass EDR detections (Kernel callbacks and ETW TI provider) and LSASS protections.|
|unDefender|Killing your preferred antimalware by abusing nati links and NT paths.|
|Backstab|A 工具 to kill antimalware protected processes|
|SPAWN - Cobalt Strike BOF|Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary 代码 Guard (ACG), BlockDll, and PPID spoofing.|
|BOF.NET - A .NET Runtime for Cobalt Strike's Beacon Object Files|BOF.NET is a small native BOF object combined with the BOF.NET managed runtime that enables the de of Cobalt Strike BOFs directly in .NET. BOF.NET removes the complexity of nati along with the headaches of manually importing native API.|
|NetLoader|Loads any C# binary from filepath or url, patching AMSI and bypassing Windows Defender on runtime|
|FindObjects-BOF|A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.|
|SharpUnhooker|C# Based Uni API Unhooker - Automatically Unhook API Hives (ntdll.dll,kernel32.dll,user32.dll,ad.dll,and kernelbase.dll).|
|E|Apply a filter to the events being reported by windows event logging|
|InlineExecute-Assembly|InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module|
|Phant0m | Windows Event Log Killer|
|SharpBlock|A method of bypassing EDR's acti DLL's by pre entry point execution.|
|NtdllUnpatcher|Example 代码 for EDR bypassing, please use this for testing blue team detection capabilities against this type of malware that will bypass EDR's userland hooks.|
|DarkLoadLibrary|LoadLibrary for offensi.|
|BlockETW|.Net 3.5 / 4.5 Assembly to block ETW telemetry in a process|
|firewalker|This repo contains a simple library which can be used to add FireWalker hook bypass capabilities to existing 代码|
|KillDefenderBOF|Beacon Object File PoC implementation of KillDefender|
|Mangle|Mangle is a 工具 that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs|
|AceLdr|Cobalt Strike UDRL for memory scanner e.|
|AtomLdr|CA DLL loader with ad e features|
|Inline-Execute-PE|Execute unmanaged Windows executables in CobaltStrike Beacons|
|SigFlip|SigFlip is a 工具 for patching authenticode signed PE files (exe, dll, sys ..etc) without in or breaking the existing signature.|
|Blackout|kill anti-malware protected processes (BYO://github.com/ZeroMemoryEx/Blackout|
|ShellGhost|A memory-based e technique which makes shellcode in from process start to end.|
|PoolPartyBof|A beacon object file implementation of PoolParty Process Injection Technique by and @0xDeku, that abuses Windows Thread Pools.|
|EDRSilencer|A 工具 uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the ser://github.com/netero1010/EDRSilencer|
|EDR-Freeze|EDR-Freeze is a 工具 that puts a process of EDR, AntiMalware into a coma state.|

Persistence

|Name|Description|URL|
|-----|-----------|----|
|SharpStay|.NET project for installing Persistence|
|SharPersist|Windows persistence toolkit written in C#.|
|SharpHide|Tool to create hidden registry keys.|
|DoUCMe|This le the NetUserAdd Win32 API to create a new computer account. This is done by setting the usri1_priv of the USER_INFO_1 type to 0x1000.|
|A Black Path Toward The Sun|(TCP tunneling over HTTP for web application servers)|
|pi|A 工具 to make socks connections through HTTP agents|
|reGeorg|The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.|
|DAMP|The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification.|
|IIS-Raid|A nati module for Microsoft IIS (Internet Information Services)|
|SharPyShell|tiny and obfuscated ASP.NET webshell for C# web applications|
|ScheduleRunner|A C# 工具 with more flexibility to customize scheduled task for both persistence and lateral mo in red team operation|
|SharpE|Persistence by writing/reading shellcode from Event Log|
|Kraken|Kraken, a modular multi-language webshell coded by .|
|HiddenDesktop|HVNC for Cobalt Strike|

Lateral Mo

|Name|Description|URL|
|-----|-----------|----|
|Liquid Snake|LiquidSnake is a 工具 that allows operators to perform fileless lateral mo using WMI Event Subscriptions and GadgetToJScript|
|PowerUpSQL|A PowerShell Toolkit for Attacking SQL Ser://github.com/NetSPI/PowerUpSQL|
|SQLRecon|A C# MS SQL toolkit designed for offensi and post-exploitation.|
|SCShell|Fileless lateral mo 工具 that relies on ChangeSer to run command|
|SharpRDP|Remote Desktop 协议 Console Application for Authenticated Command Execution|
|MoveKit|Movekit is an extension of built in Cobalt Strike lateral mo by le the execute_assembly function with the SharpMove and SharpRDP .NET assemblies.|
|SharpNoPSExec|File less command execution for lateral mo.|
|Responder/MultiRelay|LLMNR/NBT-NS/mDNS Poisoner and NTLMv1/2 Relay.|
|impacket|Impacket is a collection of Python classes for working with 网络 protocols. Impacket is focused on pro low-le access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the 协议 implementation itself.|
|Farmer|Farmer is a project for collecting NetNTLM hashes in a Windows domain. |
|CIMplant|C# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session.|
|PowerLessShell|PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. You can also execute raw shellcode using the same approach.|
|SharpGPOAbuse|SharpGPOAbuse is a .NET application written in C# that can be used to take ad of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.|
|kerbrute|A 工具 to quickly bruteforce and enumerate valid Acti accounts through Kerberos Pre-Authentication|
|mssqlproxy|mssqlproxy is a toolkit aimed to perform lateral mo in restricted en through a compromised Microsoft SQL 服务端 reuse|
|In|PowerShell Pass The Hash Utils|
|In|.NET IPv4/IPv6 machine-in-the-middle 工具 for penetration testers|
|SharpSpray|SharpSpray a simple 代码 set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike.|
|CrackMapExec|A swiss army knife for pentesting networks|
|SharpAllowedToAct|A C# implementation of a computer object takeo Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity) based on the research by .|
|SharpRDPHijack|Sharp RDP Hijack is a proof-of-concept .NET/C# Remote Desktop 协议 (RDP) session hijack utility for disconnected sessions|
|CheeseTools|This repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right moti to work on them.|
|LatLoader|PoC module to demonstrate automated lateral mo with the Havoc C2 框架.|
|SharpSpray|SharpSpray is a Windows domain password spraying 工具 written in .NET C#.|
|MalSCCM|This 工具 allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage.|
|Coercer|A python script to automatically coerce a Windows 服务端 to authenticate on an arbitrary machine through 9 methods.|
|SharpSploit|SharpSploit is a .NET post-exploitation library written in C# that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers.|
|orpheus|Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types|
|goexec|GoExec is a new take on some of the methods used to gain remote execution on Windows devices. GoExec implements a number of largely unrealized execution methods and provides significant OPSEC impro o.|
|BitlockMo Mo DCOM interfaces & COM Hijacking|

Tunneling

|Name|Description|URL|
|-----|-----------|----|
|Chisel|Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both 客户端 and 服务端.|
|frp|frp is a fast reverse proxy that allows you to expose a local ser behind a NAT or firewall to the Internet.|
|ligolo-ng|An ad, yet simple, tunneling 工具 that uses a TUN interface.|
|SockTail|SockTail is a small binary that joins a device to a Tailscale 网络 and exposes a local SOCKS5 proxy on port 1080. It's meant for red team operations where you need 网络 access into a target system without setting up wonky port forwards, persistent daemons, or noisy tunnels.|

Exfiltration

|Name|Description|URL|
|-----|-----------|----|
|SharpExfiltrate|Modular C# 框架 to exfiltrate loot o and trusted channels.|
|DNSExfiltrator|Data exfiltration over DNS request covert channel|
|Egress-Assess|Egress-Assess is a 工具 used to test egress data detection capabilities.|
|| is a data exfiltration utility designed to test and enhance the detection capabilities. This 工具 simulates real-world data exfiltration techniques used by ad threat actors, allowing organizations to e and impro security posture.|

Miscellaneous

Threat-informed Defense

|Name|Description|URL|
|-----|-----------|----|
|Tidal Cyber|Tidal Cyber helps enterprise organizations to define, measure, and impro defenses to address the ad behaviors that are most important to them.|
|Control Compass|Threat modeling aide & purple team content repository, pointing security & intelligence teams to 10,000+ publicly-accessible technical and policy controls and 2,100+ offensi tests, aligned with nearly 600 common attacker techniques|

Cloud

#### Amazon Web Services (AWS)
|Name|Description|URL|
|-----|-----------|----|
|pacu|The AWS exploitation 框架, designed for testing the security of Amazon Web Services en.|
|CloudMapper|CloudMapper helps you analyze your Amazon Web Services (AWS) en.|
|Enumerate IAM permissions|Enumerate the permissions associated with AWS credential set|

#### Azure
|Name|Description|URL|
|-----|-----------|----|
|Azure AD Connect password extraction|This toolkit offers several ways to extract and decrypt stored Azure AD and Acti credentials from Azure AD Connect servers.|
|Storm Spotter|Azure Red Team 工具 for graphing Azure and Azure Acti objects|
|ROADtools|The Azure AD exploration framework.|
|MicroBurst: A PowerShell Toolkit for Attacking Azure|A collection of scripts for assessing Microsoft Azure security|
|AADInternals|AADInternals PowerShell module for administering Azure AD and Office 365|
|TeamFiltration|TeamFiltration is a cross-platform 框架 for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.|
|MAAD Attack Framework|An attack 工具 for simple, fast & effecti testing of M365 & Azure AD.|
|GraphRunner|A Post-exploitation Toolset for Interacting with the Microsoft Graph API|
|ADOKit|ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking ad of the a REST API|
|TokenTactics|Azure JWT Token Manipulation Toolset|
|Maestro|Maestro is a post-exploitation 工具 designed to interact with Intune/EntraID from a C2 agent on a user’s workstation without requiring knowledge of the user’s password or Azure authentication flows, token manipulation, and web-based administration console.|

Ad Emulation

|Name|Description|URL|
|-----|-----------|----|
|Stratus Red Team|Stratus Red Team is "Atomic Red Team™" for the cloud, allowing to emulate offensi techniques in a granular and self-contained manner.|
|Prelude Operator|A Platform for De ad security· Defend your organization by mimicking real ad attacks.|
|Prelude Build|An open 源码 IDE for authoring, testing, and production-ready security tests..|
|Caldera|An automated ad emulation system that performs post-compromise ad behavior within Windows Enterprise networks.|
|APTSimulator|A Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.|
|Atomic Red Team|Small and highly portable detection tests mapped to the Mitre ATT&CK 框架.|
|Network Flight Simulator|flightsim is a lightweight utility used to generate malicious 网络 traffic and help security teams to e security controls and 网络 .|
|Metta|A security preparedness 工具 to do ad simulation.|
|Red Team Automation (RTA)| RTA provides a 框架 of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.|
|TTPForge|The TTPForge is a 框架 created to facilitate the de, automation, and execution of Tactics, Techniques, and Procedures (TTPs).|

AI Red Teaming

|Name|Description|URL|
|-----|-----------|----|
|promptfoo|CLI and 框架 for e, testing, and red-teaming LLM applications and prompts.|
|Garak|LLM scanner designed to probe for weaknesses, jailbreaks, and unsafe behaviors in language models.|
|deepe is a simple-to-use, open-源码 LLM e 框架, for e large-language model systems.|
|PyRIT|The Python Risk Identification 工具 for generative AI (PyRIT) is an open 源码 框架 built to empower security professionals and engineers to proactively identify risks in generative AI systems.|
|FuzzyAI|The FuzzyAI Fuzzer is a powerful 工具 for automated LLM fuzzing. It is designed to help de and security researchers identify jailbreaks and mitigate potential security in their LLM APIs.|

Offensive AI Agent

|Name|Description|URL|
|-----|-----------|----|
| PentAGI| Fully autonomous AI Agents system capable of performing complex penetration testing tasks.|
| HexStrike AI| An ad MCP 服务端 that lets AI agents autonomously run 150+ cybersecurity tools for automated pentesting, discovery, bug bounty automation, and security research.|
| CAI| A lightweight, open-源码 框架 that empowers security professionals to build and deploy AI-powered offensive and defensi.|
|RedAmon|An AI-powered agentic red team 框架 that automates offensi operations, from reconnaissance to exploitation to post-exploitation, with zero human inter.|
|raptor|Raptor turns Claude 代码 into a general-purpose AI offensi security agent.|

Living Off the Living Off the Land

|Name|Description|URL|
|-----|-----------|----|
|Living Off The Land Drivers|Living Off The Land Drivers is a curated list of Windows drivers used by ad to bypass security controls and carry out attacks|
|GTFOBins|GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems|
|LOLBAS|The goal of the LOLBAS project is to document every binary, script, and library that can be used for Living Off The Land techniques|
|Living Off Trusted Sites (LOTS) Project|Attackers are using popular legitimate domains when conducting phishing, C&C, exfiltration and downloading tools to evade detection. The list of websites below allow attackers to use their domain or subdomain|
|Filesec|Stay up-to-date with the latest file extensions being used by attackers.|
|LOOBins|Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on built-in macOS binaries and how they can be used by threat actors for malicious purposes.|
|WTFBins|WTFBin(n): a binary that beha like malware, except, somehow, it's not? This project aims to catalogue benign applications that exhibit suspicious behavior. These binaries can emit noise and false positives in threat hunting and automated detections.|
|Hijack Libs|This project provides an curated list of DLL Hijacking candidates|

Red Team Scripts

|Name|Description|URL|
|-----|-----------|----|
|RedTeamCCode|Red Team C code repo|
|EDRs|This repo contains information about EDRs that can be useful during red team exercise.|
|Cobalt Strike Community Kit|Community Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike.|

Red Team Infrastructure

|Name|Description|URL|
|-----|-----------|----|
|Red Team Infrastructure Wiki|Wiki to collect Red Team infrastructure hardening resources|

DevOps

|Name|Description|URL|
|-----|-----------|----|
|Nemesis|Nemesis is an offensive data enrichment pipeline and operator support system.|

Reporting & Tracking

|Name|Description|URL|
|-----|-----------|----|
|Ghostwriter|Ghostwriter is a Django-based web application designed to be used by an indi or a team of red team operators.|
|VECTR|VECTR is a 工具 that facilitates tracking of your red and blue team testing acti to measure detection and pre capabilities across different attack scenarios|
|PurpleOps|An open-源码 self-hosted purple team management web application.|

Threat Intelligence

|Name|Description|URL|
|-----|-----------|----|
|APT REPORT|Interesting APT Report Collection And Some Special IOC|
|Awesome Threat Intelligence|A curated list of Awesome Threat Intelligence resources|
|deepdarkCTI|Collection of Cyber Threat Intelligence sources from the deep and dark web|
|CTI Dashboard|Stay informed about cybersecurity threats in real time! Access a of threat intelligence reports and useful resources all in one place.|
|Hudson Rock|Free cybercrime intelligence toolset to check if an email address or domain was compromised in Infostealer malware attack|

License

![CC0]()

To the extent possible under law, Rahmat Nurfauzi "" has waived all copyright and related or neighboring rights to this work.

项目信息

开发语言：未知

Star 数：10761

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This repository contains cutting-edge open-源码 security tools (OST) for a red teamer and threat hunter.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。