项目说明
Awesome-Red-Team-Operation
PenTest and Red Teams Tools by Joas and S3cur3Th1sSh1t
Powershell Scripts
AMSI Bypass
Payload Hosting
Network Share Scanner
Reverse Shellz
Backdoor Finder
Pi
Persistence on Windows
Framework Discovery
- Wordpress, Joomla, Drupal ScannerFramework Scanner / Exploitation
- wordpress - lotus domino - Drupal - Typo3 - JoomlaFile / Directory / Parameter discovery
- Mining parameters from dark corners of Web Archives - 💗 - Directory lookup from Ja files - Admin Panel FinderRest API Audit
- RESTler is the first stateful REST API fuzzing tool for automatically testing cloud services through their REST APIs and finding security and reliability bugs in these services.Windows Pri Escalation / Audit
- Pri Escalation Enumeration Script for Windows - powerfull Pri Escalation Check Script with nice output - UAC - UAC - find dlls for preloading attack - dll hijack scanner - admin to systemLinkedIn
Windows Pri Abuse (Pri Escalation)
- Abuse Windows Pri - load malicious dlls from system32 - Exploit potatoes with automation - from Service Account to System - Another Windows Local Pri Escalation from Service Account to System - Abusing Impersonation Pri on Windows 10 and Server 2019 - itm4ns Printspoofer in C# - Recover the default pri set of a LOCAL/NETWORK SERVICE accountExfiltration
- Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into memory. - remote lazagne - Browser Creds gathering - hack-browser-data is an open-source tool that could help you decrypt data[passwords|bookmarks|cookies|history] from the browser. - ClipHistory feature get the last 25 copy paste actions - dump lsass using direct system calls and API unhooking - Create a minidump of the LSASS process from memory - using Dumpert - Evade WinDefender ATP credential-theft - remote procdump.exe, copy dump file to local system and pypykatz for analysis/extraction - extract live rdp logins - Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute. - .NET 4.0 CLR Project to retrie data, such as cookies, history and sa. - This project reuses open handles to lsass to parse or minidump lsass - ThunderFox for Firefox Credentials, SitkyNotesExtract for "Notes as passwords" - Command line tool to extract/decrypt the password that was stored in the LSA by SysInternals AutoLogon - .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py - C# tool to discover low hanging fruits like SessionGopher - DPAPI Creds via C#LSASS Dump Without Mimikatz - C# porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commandsCredential har Linux Specific - SSH Credential loot - SSH / Sudo / SU Credential loot - Tool to extract Kerberos tickets from Linux kernel keys.Data Exfiltration - DNS/ICMP/Wifi Exfiltration - Wifi Exfiltration - Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP - Easy files and payloads delivery over DNSStaging
Rapid Attack Infrastructure (RAI) Red Team Infrastructure... Quick... Fast... Simplified One of the most tedious phases of a Red Team Operation is usually the infrastructure setup. This usually entails a teamserver or controller, domains, redirectors, and a Phishing server. Red Baron is a set of modules and custom/third-party pro for Terraform which tries to automate creating resilient, disposable, secure and agile infrastructure for Red Teams. E generate unicode e for IDN Homograph Attack and detect them. Domain Hunter checks expired domains, bluecoat categorization, and Archive.org history to determine good candidates for phishing and C2 domain names. PowerDNS is a simple proof of concept to demonstrate the execution of PowerShell script using DNS only. Chameleon a tool for e Proxy categorisation. CatMyFish Search for categorized domain that can be used during red teaming engagement. Perfect to setup whitelisted domain for your Cobalt Strike beacon C&C. Malleable C2 is a domain specific language to redefine indicators in Beacon's communication. Malleable-C2-Randomizer This script randomizes Cobalt Strike Malleable C2 profiles through the use of a metalanguage, hopefully reducing the chances of flagging signature-based detection controls. FindFrontableDomains search for potential frontable domains. Postfix-Ser Setting up a phishing server is a very long and tedious process. It can take hours to setup, and can be compromised in minutes. DomainFrontingLists a list of Domain Frontable Domains by CDN. Apache2-Mod-Rewrite-Setup Quickly Implement Mod-Rewrite in your infastructure. mod_rewrite rule to evade sandboxes. external_c2 framework a python framework for usage with Cobalt Strike's External C2. Malleable-C2-Profiles A collection of profiles used in different projects using Cobalt Strike ExternalC2 a library for integrating communication channels with the Cobalt Strike External C2 server. cs2modrewrite a tools for convert Cobalt Strike profiles to modrewrite scripts. e2modrewrite a tools for convert Empire profiles to Apache modrewrite scripts. redi automated script for setting up CobaltStrike redirectors (nginx reverse proxy, letsencrypt). cat-sites Library of sites for categorization. ycsm is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2). Domain Fronting Google App Engine. DomainFrontDisco and results for finding domain frontable CloudFront domains. Automated Empire Infrastructure Serving Random Payloads with NGINX. meek is a blocking-resistant pluggable transport for Tor. It encodes a data stream as a sequence of HTTPS requests and responses. CobaltStrike-ToolKit Some useful scripts for CobaltStrike. mkhtaccess_red Auto-generate an HTaccess for payload delivery -- automatically pulls ips/nets/etc from known sandbox companies/sources that have been seen before, and redirects them to a benign payload. RedFile a flask wsgi application that ser with intelligence, good for serving conditional RedTeam payloads. keyser serve HTTP and DNS keys for proper payload protection. DoHC2 allows the ExternalC2 library from Ryan Hanson () to be le for command and control (C2) via DNS o (DoH). This is built for the popular Ad Simulation and Red Team Operations Software Cobalt Strike (). HTran is a connection bouncer, a kind of proxy server. A “listener” program is hacked stealthily onto an unsuspecting host anywhere on the Internet. Buffer O and Exploit De
MindMaps by Joas
Lateral Mo
POST Exploitation
Phishing Tools Wrapper for tools
Acti Audit and exploit tools
Web Scanner / Burp Plugins
- all in one scanner - XSS discovery - Burpsuite Extension to bypass 403 restricted directoryWeb Exploitation Tools
- lfi - xxe - shellz - ssti - xpath injection - File Uploads - deserialization - IIS Short Filename Vuln. exploitation - Deserialize Ja - Deserialize .NET Exploitation - Exploit .git Folder Existence - SSRF Tutorials - PHP Unserialize Payload generator - Malicious Office XXE payload generator - Angularjs Csti Scanner - Deserialize .NET - Deserialize .NET Linux Pri Escalation / Audit
- powerfull Pri Escalation Check Script with nice output - lookup installed software - find suid bins and look them up under gtfobins / exploitable or not - Offline GTFOBins - sudo misconfiguration exploitation - easily manipulate the tty and create fake binaries - not really privesc but helpfullCommand and Control
Cobalt Strike is software for Ad Simulations and Red Team Operations. Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent. Metasploit Framework is a computer security project that provides information about security and aids in penetration testing and IDS signature de. SILENTTRINITY A post-exploitation agent powered by Python, IronPython, C#/.NET. Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python. Koadic or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. PoshC2 is a proxy aware C2 framework written completely in PowerShell to aid penetration testers with red teaming, post-exploitation and lateral mo. Gcat a stealthy Python based backdoor that uses Gmail as a command and control server. TrevorC2 is a legitimate website (browsable) that tunnels client/ser for covert command execution. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang. Quasar is a fast and light-weight remote administration tool coded in C#. Pro high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you. Co is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborati and control platform for red teamers. FactionC2 is a C2 framework which use websockets based API that allows for interacting with agents and transports. DNScat2 is a tool is designed to create an encrypted command-and-control (C&C) channel over the DNS protocol. Sliver is a general purpose cross-platform implant framework that supports C2 o, HTTP(S), and DNS. E An evil RAT (Remote Administration Tool) for macOS / OS X. EggShell is a post exploitation sur tool written in Python. It gives you a command line session with extra functionality between you and a target machine. Ad Emulation
MITRE CALDERA - An automated ad emulation system that performs post-compromise ad behavior within Windows Enterprise networks. APTSimulator - A Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised. Atomic Red Team - Small and highly portable detection tests mapped to the Mitre ATT&CK Framework. Network Flight Simulator - flightsim is a lightweight utility used to generate malicious network traffic and help security teams to e security controls and network . Metta - A security preparedness tool to do ad simulation. Red Team Automation (RTA) - RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. Repositores
Malware Analysis and Reverse Engineering
项目信息
开发语言：未知
Star 数：1725
技术要点
该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕红蓝攻防相关项目展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。