Red Teaming Toolkit

This repository contains cutting-edge open-source security tools (OST) that will help you during
adversary simulation and as information intended for threat hunter can make detection and
prevention control easier. The list of tools below that could be potentially misused by threat
actors such as APT and Human-Operated Ransomware (HumOR). If you want to contribute to
this list send me a pull request.

Table of Contents

Reconnaissance
Initial Access
Delivery
Situational Awareness
Credential Dumping
Privilege Escalation
Defense Evasion
Persistence
Lateral Movement
Exfiltration
Miscellaneous

Reconnaissance
 Name Description URL

The Modern Port

Scanner. Find ports
quickly (3 seconds at
its fastest). Run
RustScan https://github.com/RustScan/RustScan
scripts through our
scripting engine
(Python, Lua, Shell
supported).

In-depth Attack
Amass Surface Mapping and https://github.com/OWASP/Amass
Asset Discovery

Gitleaks is a SAST
tool for detecting
hardcoded secrets
gitleaks https://github.com/zricethezav/gitleaks
like passwords, api
keys, and tokens in
git repos.

Scan for open S3

S3Scanner buckets and dump https://github.com/sa7mon/S3Scanner
the contents

Multi-cloud OSINT
tool. Enumerate
cloud_enum public resources in https://github.com/initstring/cloud_enum
AWS, Azure, and
Google Cloud.

Open Source
Intelligence gathering
tool aimed at
Recon-ng reducing the time https://github.com/lanmaster53/recon-ng
spent harvesting
information from
open sources.

An advanced tool for

buster https://github.com/sham00n/buster
email reconnaissance

OSINT Tool: Generate

linkedin2username username lists for https://github.com/initstring/linkedin2username
companies on
LinkedIn

Web Inventory tool,

takes screenshots of
webpages using
Pyppeteer (headless
WitnessMe https://github.com/byt3bl33d3r/WitnessMe
Chrome/Chromium)
and provides some
extra bells & whistles
to make life easier.

pagodo (Passive
Google Dork) -
Automate Google
pagodo https://github.com/opsdisk/pagodo
Hacking Database
scraping and
searching

AttackSurfaceMapper
is a tool that aims to
AttackSurfaceMapper automate the https://github.com/superhedgy/AttackSurfaceM
reconnaissance
process.

SpiderFoot is an open
source intelligence
(OSINT) automation
tool. It integrates with
just about every data
SpiderFoot https://github.com/smicallef/spiderfoot
source available and
utilises a range of
methods for data
analysis, making that
data easy to navigate.

dnscan is a python
dnscan wordlist-based DNS https://github.com/rbsec/dnscan
subdomain scanner.

A program that
 checks if a domain
can be spoofed from.
spoofcheck The program checks https://github.com/BishopFox/spoofcheck
SPF and DMARC
records for weak
configurations that
allow spoofing.

LinkedInt LinkedIn Recon Tool https://github.com/vysecurity/LinkedInt

Initial Access

Brute Force

Name Description URL

Scripts to make
password spraying
attacks against
SprayingToolkit Lync/S4B, OWA & https://github.com/byt3bl33d3r/SprayingToolkit
O365 a lot quicker,
less painful and more
efficient

Retrieve information
o365recon via O365 with a valid https://github.com/nyxgeek/o365recon
cred

Refactored &
improved CredKing
password spraying
tool, uses FireProx
CredMaster https://github.com/knavesec/CredMaster
APIs to rotate IP
addresses, stay
anonymous, and beat
throttling

Payload Development

Name Description URL

 Ivy is a payload
creation framework
Ivy for the execution of https://github.com/optiv/Ivy
arbitrary VBA
(macro) source code
directly in memory.

Open-Source PE
PEzor https://github.com/phra/PEzor
Packer

A tool for generating

.NET serialized
gadgets that can
trigger .NET
assembly
GadgetToJScript https://github.com/med0x2e/GadgetToJScript
load/execution when
deserialized using
BinaryFormatter
from JS/VBS/VBA
scripts.

Payload creation
ScareCrow framework designed https://github.com/optiv/ScareCrow
around EDR bypass.

Donut is a position-
independent code
that enables in-
Donut memory execution of https://github.com/TheWover/donut
VBScript, JScript,
EXE, DLL files and
dotNET assemblies.

macOS Initial Access

Mystikal https://github.com/D00MFist/Mystikal
Payload Generator

c++ fully undetected

charlotte https://github.com/9emin1/charlotte
shellcode launcher ;)

Proof-of-concept
obfuscation toolkit
for C# post-
exploitation tools.
InvisibilityCloak https://github.com/xforcered/InvisibilityCloak
 This will perform the
below actions for a
C# visual studio
project.

Dendrobate is a
framework that
facilitates the
development of
Dendrobate https://github.com/FuzzySecurity/Dendrobate
payloads that hook
unmanaged code
through managed
.NET code.

This repo provides

examples of how
VBA can be used for
offensive purposes
Offensive VBA
beyond a simple https://github.com/BC-SECURITY/Offensive-VBA-
and XLS
dropper or shell and-XLS-Entanglement
Entanglement
injector. As we
develop more use
cases, the repo will
be updated.

Tiny Excel BIFF8

Generator, to
xlsGen https://github.com/aaaddress1/xlsGen
Embedded 4.0
Macros in *.xls

darkarmour Windows AV Evasion https://github.com/bats3c/darkarmour

Tool for working with

Direct System Calls
InlineWhispers in Cobalt Strike's https://github.com/outflanknl/InlineWhispers
Beacon Object Files
(BOF)

A cross-platform
assistant for creating
malicious MS Office
documents. Can
hide VBA macros,
EvilClippy stomp VBA code (via https://github.com/outflanknl/EvilClippy
P-Code) and
confuse macro
analysis tools. Runs
on Linux, OSX and
Windows.

VBA purge your

Office documents
with OfficePurge.
VBA purging
OfficePurge https://github.com/fireeye/OfficePurge
removes P-code
from module
streams within Office
documents.

Identifies the bytes

that Microsoft
ThreatCheck https://github.com/rasta-mouse/ThreatCheck
Defender / AMSI
Consumer flags on.

Generate
CrossC2 CobaltStrike's cross- https://github.com/gloxec/CrossC2
platform payload

Ruler is a tool that

allows you to interact
with Exchange
Ruler servers remotely, https://github.com/sensepost/ruler
through either the
MAPI/HTTP or
RPC/HTTP protocol.

Shellcode runner
framework for
application
whitelisting
DueDLLigence bypasses and DLL https://github.com/fireeye/DueDLLigence
side-loading. The
shellcode included in
this project spawns
calc.exe.
 RuralBishop is
practically a carbon
copy of UrbanBishop
RuralBishop by b33f, but all https://github.com/rasta-mouse/RuralBishop
P/Invoke calls have
been replaced with
D/Invoke.

TikiTorch was named

in homage to
CACTUSTORCH by
Vincent Yiu. The
basic concept of
CACTUSTORCH is
that it spawns a new
process, allocates a
region of memory,
TikiTorch https://github.com/rasta-mouse/TikiTorch
then uses
CreateRemoteThread
to run the desired
shellcode within that
target process. Both
the process and
shellcode are
specified by the
user.

SharpShooter is a
payload creation
framework for the
retrieval and
execution of
arbitrary CSharp
SharpShooter source code. https://github.com/mdsecactivebreach/SharpShoote
SharpShooter is
capable of creating
payloads in a variety
of formats, including
HTA, JS, VBS and
WSF.
SharpSploit SharpSploit is a .NET https://github.com/cobbr/SharpSploit
post-exploitation
library written in C#

MSBuild Without
MSBuildAPICaller https://github.com/rvrsh3ll/MSBuildAPICaller
MSBuild.exe

macro_pack is a tool
by @EmericNasi
used to automatize
obfuscation and
generation of MS
macro_pack Office documents, https://github.com/sevagas/macro_pack
VB scripts, and other
formats for pentest,
demo, and social
engineering
assessments.

Template-Driven
inceptor AV/EDR Evasion https://github.com/klezVirus/inceptor
Framework

evasion technique to
defeat and divert
detection and
mortar https://github.com/0xsp-SRD/mortar
prevention of
security products
(AV/EDR/XDR)

Multi-Packer
wrapper letting us
daisy-chain various
packers, obfuscators
and other Red Team
oriented weaponry.
Featured with
artifacts
ProtectMyTooling watermarking, IOCs https://github.com/mgeeky/ProtectMyTooling
collection & PE
Backdooring. You
feed it with your
implant, it does a lot
 of sneaky things and
spits out obfuscated
executable.

Freeze is a payload
toolkit for bypassing
EDRs using
suspended
Freeze https://github.com/optiv/Freeze
processes, direct
syscalls, and
alternative execution
methods

Delivery

Phishing

Name Description URL

o365-
https://github.com/mdsecactivebreach/o365-
attack- A toolkit to attack Office365
attack-toolkit
toolkit

Evilginx2 is a man-in-the-
middle attack framework
Evilginx2 used for phishing credentials https://github.com/kgretzky/evilginx2
and session cookies of any
web service.

Gophish is an open-source
phishing toolkit designed for
businesses and penetration
testers. It provides the ability
Gophish https://github.com/gophish/gophish
to quickly and easily setup
and execute phishing
engagements and security
awareness training.

PwnAuth a web application

framework for launching and
PwnAuth https://github.com/fireeye/PwnAuth
managing OAuth abuse
 campaigns.

Modlishka is a flexible and

powerful reverse proxy, that
Modlishka https://github.com/drk1wi/Modlishka
will take your ethical phishing
campaigns to the next level.

Watering Hole Attack

Name Description URL

BeEF is short for The Browser Exploitation

BeEF Framework. It is a penetration testing tool https://github.com/beefproject/beef
that focuses on the web browser

Command and Control

Remote Access Tools (RAT)

Name Description URL

Cobalt Strike is
software for
Cobalt Strike Adversary https://cobaltstrike.com/
Simulations and Red
Team Operations.

Brute Ratel is the

most advanced Red
Team & Adversary
Brute Ratel C4 https://bruteratel.com/
Simulation Software
in the current C2
Market.

Empire 5 is a post-
exploitation
framework that
includes a pure-
Empire PowerShell Windows https://github.com/BC-SECURITY/Empire
agent, and
compatibility with
 Python 3.x Linux/OS
X agents.

PoshC2 is a proxy
aware C2 framework
used to aid
PoshC2 penetration testers https://github.com/nettitude/PoshC2
with red teaming,
post-exploitation and
lateral movement.

Koadic C3 COM
Koadic Command & Control - https://github.com/zerosum0x0/koadic
JScript RAT

Merlin is a cross-
platform post-
exploitation
merlin https://github.com/Ne0nd0g/merlin
Command & Control
server and agent
written in Go.

A cross-platform,
post-exploit, red
teaming framework
Mythic built with python3, https://github.com/its-a-feature/Mythic
docker, docker-
compose, and a web
browser UI.

Covenant is a .NET
command and control
framework that aims
to highlight the attack
surface of .NET, make
the use of offensive
Covenant https://github.com/cobbr/Covenant
.NET tradecraft
easier, and serve as a
collaborative
command and control
platform for red
teamers.
 A post exploitation
framework designed
shad0w to operate covertly on https://github.com/bats3c/shad0w
heavily monitored
environments

Sliver is a general
purpose cross-
platform implant
Sliver framework that https://github.com/BishopFox/sliver
supports C2 over
Mutual-TLS,
HTTP(S), and DNS.

An asynchronous,
collaborative post-
SILENTTRINITY exploitation agent https://github.com/byt3bl33d3r/SILENTTRINITY
powered by Python
and .NET's DLR

Pupy is an
opensource, cross-
platform (Windows,
Linux, OSX, Android)
Pupy https://github.com/n1nj4sec/pupy
remote administration
and post-exploitation
tool mainly written in
python

Havoc is a modern
and malleable post-
exploitation
Havoc https://github.com/HavocFramework/Havoc
command and control
framework, created
by @C5pider.

A light first-stage C2
NimPlant implant written in Nim https://github.com/chvancooten/NimPlant
and Python

SharpC2 is a
 Command & Control
(C2) framework
written in C#. It
SharpC2 https://github.com/rasta-mouse/SharpC2
consists of an
ASP.NET Core Team
Server, a .NET
Framework implant,
and a .NET MAUI
client.

Staging

Name Description URL

Self-deployable file
hosting service for red
teamers, allowing to
pwndrop https://github.com/kgretzky/pwndrop
easily upload and share
payloads over HTTP and
WebDAV.

A command line tool that

generates randomized
C2concealer https://github.com/FortyNorthSecurity/C2c
C2 malleable profiles for
use in Cobalt Strike.

Search for potential

FindFrontableDomains https://github.com/rvrsh3ll/FindFrontableDo
frontable domains

Checks expired domains

for
categorization/reputation
Domain Hunter and Archive.org history https://github.com/threatexpress/domainhu
to determine good
candidates for phishing
and C2 domain names

Flexible CobaltStrike
RedWarden https://github.com/mgeeky/RedWarden
Malleable Redirector

AzureC2Relay is an
Azure Function that
validates and relays
 Cobalt Strike beacon
AzureC2Relay https://github.com/Flangvik/AzureC2Relay
traffic by verifying the
incoming requests based
on a Cobalt Strike
Malleable C2 profile.

C3 (Custom Command
and Control) is a tool
that allows Red Teams to
C3 rapidly develop and https://github.com/FSecureLABS/C3
utilise esoteric command
and control channels
(C2).

A tool for evading Proxy

Chameleon https://github.com/mdsecactivebreach/Cha
categorisation

Cobalt Strike Cobalt Strike Malleable

Malleable C2 Design C2 Design and https://github.com/threatexpress/malleable
and Reference Guide Reference Guide

Quick and dirty dynamic

redirect.rules https://github.com/0xZDH/redirect.rules
redirect.rules generator

Cobalt Strike External C2

Integration With Azure
CobaltBus https://github.com/Flangvik/CobaltBus
Servicebus, C2 traffic via
Azure Servicebus

SourcePoint is a C2
profile generator for
Cobalt Strike command
SourcePoint https://github.com/Tylous/SourcePoint
and control servers
designed to ensure
evasion.

RedGuard is a C2 front
flow control tool,Can
RedGuard https://github.com/wikiZ/RedGuard
avoid Blue
Teams,AVs,EDRs check.

Log Aggregation
 Name Description URL

Red Team's SIEM -

tool for Red Teams
used for tracking and
alarming about Blue
RedELK Team activities as https://github.com/outflanknl/RedELK
well as better
usability in long term
operations.

Repository of
Elastic resources for
for Red configuring a Red https://github.com/SecurityRiskAdvisors/RedTeamSIEM
Teaming Team SIEM using
Elastic.

RedEye is a visual
analytic tool
RedEye https://github.com/cisagov/RedEye
supporting Red &
Blue Team operations

Situational Awareness

Host Situational Awareness

Name Description URL

AggressiveProxy is a
combination of a .NET
3.5 binary
(LetMeOutSharp) and
a Cobalt Strike
aggressor script
(AggressiveProxy.cna).
Once LetMeOutSharp
is executed on a
AggressiveProxy workstation, it will try https://github.com/EncodeGroup/AggressiveProxy
to enumerate all
available proxy
 configurations and try
to communicate with
the Cobalt Strike
server over HTTP(s)
using the identified
proxy configurations.

C# tool to discover
Gopher https://github.com/EncodeGroup/Gopher
low hanging fruits

Checks running
processes, process
metadata, Dlls loaded
into your current
process and the each
DLLs metadata,
common install
directories, installed
services and each
SharpEDRChecker https://github.com/PwnDexter/SharpEDRChecker
service binaries
metadata, installed
drivers and each
drivers metadata, all
for the presence of
known defensive
products such as
AV's, EDR's and
logging tools.

This Repo intends to

serve two purposes.
Situational First it provides a nice https://github.com/trustedsec/CS-Situational-
Awareness BOF set of basic situational Awareness-BOF
awareness commands
implemented in BOF.

Seatbelt is a C#
project that performs
a number of security
oriented host-survey
Seatbelt "safety checks" https://github.com/GhostPack/Seatbelt
relevant from both
 offensive and
defensive security
perspectives.

SauronEye is a search
tool built to aid red
SauronEye teams in finding files https://github.com/vivami/SauronEye
containing specific
keywords.

Multithreaded C# .NET
Assembly to
SharpShares enumerate accessible https://github.com/mitchmoser/SharpShares
network shares in a
domain

C# port of the Get-

AppLockerPolicy
PowerShell cmdlet
with extended
SharpAppLocker features. Includes the https://github.com/Flangvik/SharpAppLocker/
ability to filter and
search for a specific
type of rules and
actions.

Printer is a modified
SharpPrinter and console version of https://github.com/rvrsh3ll/SharpPrinter
ListNetworks

Domain Situational Awareness

Name Description URL

StandIn is a small AD
post-compromise toolkit.
StandIn came about
because recently at
StandIn https://github.com/FuzzySecurity/StandIn
xforcered we needed a
.NET native solution to
perform resource based
constrained delegation.
 An AD recon tool based
Recon-AD on ADSI and reflective https://github.com/outflanknl/Recon-AD
DLL’s

Six Degrees of Domain

BloodHound Admin https://github.com/BloodHoundAD/BloodHound

PowerShell toolkit for

auditing Active Directory
PSPKIAudit https://github.com/GhostPack/PSPKIAudit
Certificate Services (AD
CS).

C# implementation of
SharpView https://github.com/tevora-threat/SharpView
harmj0y's PowerView

Rubeus is a C# toolset
for raw Kerberos
interaction and abuses. It
is heavily adapted from
Benjamin Delpy's Kekeo
Rubeus project (CC BY-NC-SA https://github.com/GhostPack/Rubeus
4.0 license) and Vincent
LE TOUX's
MakeMeEnterpriseAdmin
project (GPL v3.0
license).

A PowerShell script for

helping to find vulnerable
Grouper settings in AD Group https://github.com/l0ss/Grouper
Policy. (deprecated, use
Grouper2 instead!)

Identify the attack paths

ImproHound in BloodHound breaking https://github.com/improsec/ImproHound
your AD tiering

ADRecon is a tool which

gathers information
about the Active
Directory and generates
 ADRecon a report which can https://github.com/adrecon/ADRecon
provide a holistic picture
of the current state of
the target AD
environment.

A tool to escalate
privileges in an active
directory network by
ADCSPwn coercing authenticate https://github.com/bats3c/ADCSPwn
from machine accounts
(Petitpotam) and relaying
to the certificate service.

Credential Dumping

Name Description URL

Mimikatz is an open-source
application that allows users to
Mimikatz https://github.com/gentilkiwi/mimikatz
view and save authentication
credentials like Kerberos tickets.

LSASS memory dumper using

Dumpert direct system calls and API https://github.com/outflanknl/Dumpert
unhooking.

CredBandit is a proof of concept

Beacon Object File (BOF) that
uses static x64 syscalls to perform
CredBandit a complete in memory dump of a https://github.com/xforcered/CredBand
process and send that back
through your already existing
Beacon communication channel.

CloneVault allows a red team

operator to export and import
CloneVault https://github.com/mdsecactivebreach/
entries including attributes from
Windows Credential Manager.

Retrieve LAPS password from

SharpLAPS https://github.com/swisskyrepo/SharpLA
 LDAP

SharpDPAPI is a C# port of some

SharpDPAPI DPAPI functionality from https://github.com/GhostPack/SharpDP
@gentilkiwi's Mimikatz project.

Allows for the extraction of

KeePass 2.X key material from
memory, as well as the
KeeThief https://github.com/GhostPack/KeeThief
backdooring and enumeration of
the KeePass trigger system.

SafetyKatz is a combination of
slightly modified version of
SafetyKatz https://github.com/GhostPack/SafetyKa
@gentilkiwi's Mimikatz project and
@subtee's .NET PE Loader.

credential dump using forshaw

forkatz technique using https://github.com/Barbarisch/forkatz
SeTrustedCredmanAccessPrivilege

Tool to bypass LSA Protection (aka

PPLKiller https://github.com/RedCursorSecurityC
Protected Process Light)

The LaZagne project is an open

source application used to retrieve
LaZagne https://github.com/AlessandroZ/LaZagn
lots of passwords stored on a local
computer.

AndrewSpecial, dumping lsass'

AndrewSpecial memory stealthily and bypassing https://github.com/hoangprod/AndrewS
"Cilence" since 2019.

.NET implementation of Get-

GPPPassword. Retrieves the
Net-
plaintext password and other https://github.com/outflanknl/Net-GPPP
GPPPassword
information for accounts pushed
through Group Policy Preferences.

.NET 4.0 CLR Project to retrieve

SharpChromium Chromium data, such as cookies, https://github.com/djhohnstein/SharpCh
history and saved logins.

Chlonium is an application
 Chlonium designed for cloning Chromium https://github.com/rxwx/chlonium
Cookies.

SharpCloud is a simple C# utility

for checking for the existence of
SharpCloud credential files related to Amazon https://github.com/chrismaddalena/Sha
Web Services, Microsoft Azure,
and Google Compute.

Mimikatz implementation in pure

pypykatz https://github.com/skelsec/pypykatz
Python. At least a part of it :)

A Beacon Object File that creates

nanodump https://github.com/helpsystems/nanodu
a minidump of the LSASS process.

Koh is a C# and Beacon Object

File (BOF) toolset that allows for
Koh the capture of user credential https://github.com/GhostPack/Koh
material via purposeful
token/logon session leakage.

Privilege Escalation

Name Description URL

The Elevate Kit

demonstrates how to
use third-party privilege
ElevateKit https://github.com/rsmudge/ElevateKit
escalation attacks with
Cobalt Strike's Beacon
payload.

Watson is a .NET tool

designed to enumerate
Watson missing KBs and suggest https://github.com/rasta-mouse/Watson
exploits for Privilege
Escalation vulnerabilities.

SharpUp is a C# port of
various PowerUp
functionality. Currently,
only the most common
SharpUp checks have been https://github.com/GhostPack/SharpUp
 ported; no
weaponization functions
have yet been
implemented.

A tool that detects the

privilege escalation
vulnerabilities caused by
misconfigurations and
missing updates in the
dazzleUP https://github.com/hlldz/dazzleUP
Windows operating
systems. dazzleUP
detects the following
vulnerabilities.

Privilege Escalation
PEASS Awesome Scripts SUITE https://github.com/carlospolop/PEASS-ng
(with colors)

A collection of various
native Windows privilege
SweetPotato escalation techniques https://github.com/CCob/SweetPotato
from service accounts to
SYSTEM

Another Potato to get

SYSTEM via
MultiPotato https://github.com/S3cur3Th1sSh1t/MultiPotato
SeImpersonate
privileges

a universal no-fix local

privilege escalation in
windows domain
KrbRelayUp environments where https://github.com/Dec0ne/KrbRelayUp
LDAP signing is not
enforced (the default
settings).

As Long as You Have the

ImpersonatePrivilege
GodPotato https://github.com/BeichenDream/GodPotato
Permission, Then You
are the SYSTEM!
Defense Evasion

Name Description

RefleXXion is a utility designed to aid in

bypassing user-mode hooks utilised by
RefleXXion https://github.com/hlldz/Re
AV/EPP/EDR etc.

EDRSandBlast is a tool written in C that

weaponize a vulnerable signed driver to bypass
EDRSandBlast https://github.com/wavest
EDR detections (Kernel callbacks and ETW TI
provider) and LSASS protections.

Killing your preferred antimalware by abusing

unDefender https://github.com/APTorte
native symbolic links and NT paths.

Backstab A tool to kill antimalware protected processes https://github.com/Yaxser/

Cobalt Strike BOF that spawns a sacrificial

process, injects it with shellcode, and executes
SPAWN - Cobalt payload. Built to evade EDR/UserLand hooks by
https://github.com/boku7/s
Strike BOF spawning sacrificial process with Arbitrary
Code Guard (ACG), BlockDll, and PPID
spoofing.

BOF.NET is a small native BOF object combined

BOF.NET - A
with the BOF.NET managed runtime that
.NET Runtime
enables the development of Cobalt Strike BOFs
for Cobalt https://github.com/CCob/B
directly in .NET. BOF.NET removes the
Strike's Beacon
complexity of native compilation along with the
Object Files
headaches of manually importing native API.

Loads any C# binary from filepath or url,

NetLoader patching AMSI and bypassing Windows https://github.com/Flangvi
Defender on runtime

A Cobalt Strike Beacon Object File (BOF)

FindObjects- project which uses direct system calls to
https://github.com/outflan
BOF enumerate processes for specific modules or
process handles.

C# Based Universal API Unhooker -

Automatically Unhook API Hives
SharpUnhooker (ntdll.dll,kernel32.dll,user32.dll,advapi32.dll,and https://github.com/GetRek
kernelbase.dll).

Apply a filter to the events being reported by

EvtMute https://github.com/bats3c
windows event logging

InlineExecute-Assembly is a proof of concept

Beacon Object File (BOF) that allows security
InlineExecute- professionals to perform in process .NET https://github.com/xforcer
Assembly assembly execution as an alternative to Cobalt Assembly
Strikes traditional fork and run execute-
assembly module

Phant0m Windows Event Log Killer https://github.com/hlldz/Ph

A method of bypassing EDR's active projection

SharpBlock https://github.com/CCob/S
DLL's by preventing entry point execution.

Example code for EDR bypassing, please use

this for testing blue team detection capabilities
NtdllUnpatcher https://github.com/Kharos
against this type of malware that will bypass
EDR's userland hooks.

DarkLoadLibrary LoadLibrary for offensive operations. https://github.com/bats3c

.Net 3.5 / 4.5 Assembly to block ETW telemetry

BlockETW https://github.com/Soledg
in a process

This repo contains a simple library which can

firewalker be used to add FireWalker hook bypass https://github.com/mdseca
capabilities to existing code

Beacon Object File PoC implementation of

KillDefenderBOF https://github.com/Cerber
KillDefender

Mangle is a tool that manipulates aspects of

Mangle compiled executables (.exe or DLL) to avoid https://github.com/optiv/M
detection from EDRs

Cobalt Strike UDRL for memory scanner

AceLdr https://github.com/kyleave
evasion.

AtomLdr CA DLL loader with advanced evasive features https://github.com/NUL0x4

Inline-Execute- Execute unmanaged Windows executables in

https://github.com/Octobe
 PE CobaltStrike Beacons

SigFlip is a tool for patching authenticode

SigFlip signed PE files (exe, dll, sys ..etc) without https://github.com/med0x
invalidating or breaking the existing signature.

Persistence

Name Description URL

.NET project for

SharpStay installing https://github.com/0xthirteen/SharpStay
Persistence

Windows
SharPersist persistence toolkit https://github.com/fireeye/SharPersist
written in C#.

Tool to create
SharpHide hidden registry https://github.com/outflanknl/SharpHide
keys.

This leverages the

NetUserAdd Win32
API to create a new
computer account.
DoUCMe This is done by https://github.com/Ben0xA/DoUCMe
setting the
usri1_priv of the
USER_INFO_1 type
to 0x1000.

(TCP tunneling
A Black Path
over HTTP for web https://github.com/nccgroup/ABPTTS
Toward The Sun
application servers)

A tool to make
socks connections
pivotnacci https://github.com/blackarrowsec/pivotnacci
through HTTP
agents

The successor to
reDuh, pwn a
 bastion webserver
reGeorg and create SOCKS https://github.com/sensepost/reGeorg
proxies through the
DMZ. Pivot and
pwn.

The Discretionary
ACL Modification
Project:
Persistence
DAMP Through Host- https://github.com/HarmJ0y/DAMP
based Security
Descriptor
Modification.

A native backdoor
module for
Microsoft IIS
IIS-Raid https://github.com/0x09AL/IIS-Raid
(Internet
Information
Services)

tiny and
obfuscated
SharPyShell ASP.NET webshell https://github.com/antonioCoco/SharPyShell
for C# web
applications

A C# tool with
more flexibility to
customize
scheduled task for
ScheduleRunner https://github.com/netero1010/ScheduleRunner
both persistence
and lateral
movement in red
team operation

Persistence by
writing/reading
SharpEventPersist https://github.com/improsec/SharpEventPersist
shellcode from
Event Log
 Kraken, a modular
Kraken multi-language https://github.com/kraken-ng/Kraken
webshell coded by
@secu_x11.

Lateral Movement

Name Description URL

LiquidSnake is a tool that allows

operators to perform fileless lateral
Liquid Snake https://github.com/RiccardoAn
movement using WMI Event
Subscriptions and GadgetToJScript

A PowerShell Toolkit for Attacking SQL

PowerUpSQL https://github.com/NetSPI/Pow
Server

A C# MS SQL toolkit designed for

SQLRecon offensive reconnaissance and post- https://github.com/skahwah/S
exploitation.

Fileless lateral movement tool that

SCShell relies on ChangeServiceConfigA to run https://github.com/Mr-Un1k0d
command

Remote Desktop Protocol Console

SharpRDP Application for Authenticated https://github.com/0xthirteen/
Command Execution

Movekit is an extension of built in

Cobalt Strike lateral movement by
MoveKit leveraging the execute_assembly https://github.com/0xthirteen/
function with the SharpMove and
SharpRDP .NET assemblies.

File less command execution for lateral

SharpNoPSExec https://github.com/juliourena/S
movement.

LLMNR/NBT-NS/mDNS Poisoner and

Responder/MultiRelay https://github.com/lgandx/Res
NTLMv1/2 Relay.

Impacket is a collection of Python

classes for working with network
impacket protocols. Impacket is focused on https://github.com/SecureAuth
providing low-level programmatic
access to the packets and for some
protocols (e.g. SMB1-3 and MSRPC)
the protocol implementation itself.

Farmer is a project for collecting

Farmer NetNTLM hashes in a Windows https://github.com/mdsecactiv
domain.

C# port of WMImplant which uses

either CIM or WMI to query remote
CIMplant systems. It can use provided https://github.com/FortyNorth
credentials or the current user's
session.

PowerLessShell rely on MSBuild.exe to

remotely execute PowerShell scripts
and commands without spawning
PowerLessShell https://github.com/Mr-Un1k0d
powershell.exe. You can also execute
raw shellcode using the same
approach.

SharpGPOAbuse is a .NET application

written in C# that can be used to take
advantage of a user's edit rights on a
SharpGPOAbuse https://github.com/FSecureLA
Group Policy Object (GPO) in order to
compromise the objects that are
controlled by that GPO.

A tool to quickly bruteforce and

enumerate valid Active Directory
kerbrute https://github.com/ropnop/ker
accounts through Kerberos Pre-
Authentication

mssqlproxy is a toolkit aimed to

perform lateral movement in restricted
mssqlproxy https://github.com/blackarrow
environments through a compromised
Microsoft SQL Server via socket reuse

https://github.com/Kevin-Robe
Invoke-TheHash PowerShell Pass The Hash Utils
TheHash
InveighZero .NET IPv4/IPv6 machine-in-the-middle https://github.com/Kevin-Robe
tool for penetration testers

SharpSpray a simple code set to

perform a password spraying attack
SharpSpray against all users of a domain using https://github.com/jnqpblc/Sh
LDAP and is compatible with Cobalt
Strike.

A swiss army knife for pentesting

CrackMapExec https://github.com/byt3bl33d3
networks

A C# implementation of a computer
object takeover through Resource-
Based Constrained Delegation (msDS-
SharpAllowedToAct https://github.com/pkb1s/Shar
AllowedToActOnBehalfOfOtherIdentity)
based on the research by
@elad_shamir.

Sharp RDP Hijack is a proof-of-

concept .NET/C# Remote Desktop
SharpRDPHijack https://github.com/bohops/Sh
Protocol (RDP) session hijack utility for
disconnected sessions

This repository has been made basing

onto the already existing MiscTool, so
CheeseTools big shout-out to rasta-mouse for https://github.com/klezVirus/C
releasing them and for giving me the
right motivation to work on them.

SharpSpray is a Windows domain

SharpSpray password spraying tool written in .NET https://github.com/iomoath/Sh
C#.

This tool allows you to abuse local or

remote SCCM servers to deploy
MalSCCM https://github.com/nettitude/M
malicious applications to hosts they
manage.

A python script to automatically coerce

a Windows server to authenticate on
Coercer https://github.com/p0dalirius/
an arbitrary machine through 9
methods.
 SharpSploit is a .NET post-exploitation
library written in C# that aims to
SharpSploit highlight the attack surface of .NET https://github.com/cobbr/Shar
and make the use of offensive .NET
easier for red teamers.

Bypassing Kerberoast Detections with

orpheus Modified KDC Options and Encryption https://github.com/trustedsec
Types

Chisel is a fast TCP/UDP tunnel,

transported over HTTP, secured via
Chisel SSH. Single executable including both https://github.com/jpillora/chis
client and server.

frp is a fast reverse proxy that allows

frp you to expose a local server located https://github.com/fatedier/frp
behind a NAT or firewall to the Internet.

Exfiltration

Name Description URL

Modular C# framework
to exfiltrate loot over
SharpExfiltrate https://github.com/Flangvik/SharpExfiltrate
secure and trusted
channels.

Data exfiltration over

DNSExfiltrator DNS request covert https://github.com/Arno0x/DNSExfiltrator
channel

Egress-Assess is a tool
used to test egress https://github.com/FortyNorthSecurity/Egress-
Egress-Assess
data detection Assess
capabilities.

Miscellaneous

Threat-informed Defense
 Name Description URL

Tidal Cyber helps enterprise organizations

Tidal to define, measure, and improve their
https://app.tidalcyber.com
Cyber defenses to address the adversary
behaviors that are most important to them.

Threat modeling aide & purple team

content repository, pointing security &
Control intelligence teams to 10,000+ publicly-
Validation accessible technical and policy controls
https://controlcompass.github.io
Compass and 2,100+ offensive security tests,
aligned with nearly 600 common attacker
techniques

Cloud

Amazon Web Services (AWS)

Name Description URL

The AWS exploitation

framework, designed for
pacu testing the security of https://github.com/RhinoSecurityLabs/pacu
Amazon Web Services
environments.

CloudMapper helps you

analyze your Amazon
CloudMapper https://github.com/duo-labs/cloudmapper
Web Services (AWS)
environments.

Enumerate Enumerate the

https://github.com/andresriancho/enumerate-
IAM permissions associated
iam
permissions with AWS credential set

Azure

Name Description URL

This toolkit offers several

Azure AD ways to extract and
 Connect decrypt stored Azure AD
https://github.com/fox-it/adconnectdump
password and Active Directory
extraction credentials from Azure AD
Connect servers.

Azure Red Team tool for

Storm Spotter graphing Azure and Azure https://github.com/Azure/Stormspotter
Active Directory objects

The Azure AD exploration

ROADtools https://github.com/dirkjanm/ROADtools
framework.

MicroBurst: A
PowerShell A collection of scripts for
Toolkit for assessing Microsoft Azure https://github.com/NetSPI/MicroBurst
Attacking security
Azure

AADInternals PowerShell
AADInternals module for administering https://github.com/Gerenios/AADInternals
Azure AD and Office 365

TeamFiltration is a cross-
platform framework for
enumerating, spraying,
TeamFiltration https://github.com/Flangvik/TeamFiltration
exfiltrating, and
backdooring O365 AAD
accounts.

An attack tool for simple,

MAAD Attack fast & effective security https://github.com/vectra-ai-
Framework testing of M365 & Azure research/MAAD-AF
AD.

Adversary Emulation

Name Description URL

Stratus Red Team is

"Atomic Red
Team™" for the
cloud, allowing to
Stratus Red
Team emulate offensive https://github.com/DataDog/stratus-red-team
attack techniques
in a granular and
self-contained
manner.

A Platform for
Developer-first
advanced security·
Prelude Defend your
https://www.preludesecurity.com/products/operator
Operator organization by
mimicking real
adversarial attacks.

An open source IDE

for authoring,
testing, and
Prelude Build https://www.preludesecurity.com/products/build
verifying
production-ready
security tests..

An automated
adversary
emulation system
that performs post-
compromise
Caldera https://github.com/mitre/caldera
adversarial
behavior within
Windows
Enterprise
networks.

A Windows Batch
script that uses a
set of tools and
APTSimulator output files to make https://github.com/NextronSystems/APTSimulator
a system look as if
it was
compromised.

Small and highly

portable detection
 Atomic Red tests mapped to https://github.com/redcanaryco/atomic-red-team
Team the Mitre ATT&CK
Framework.

flightsim is a
lightweight utility
used to generate
Network malicious network
Flight traffic and help https://github.com/alphasoc/flightsim
Simulator security teams to
evaluate security
controls and
network visibility.

A security
preparedness tool
Metta https://github.com/uber-common/metta
to do adversarial
simulation.

RTA provides a
framework of
scripts designed to
allow blue teams to
Red Team
test their detection
Automation https://github.com/endgameinc/RTA
capabilities against
(RTA)
malicious
tradecraft, modeled
after MITRE
ATT&CK.

Living Off the Living Off the Land

Name Description URL

Living Off Living Off The Land Drivers is a curated list of

The Land Windows drivers used by adversaries to bypass https://www.loldrivers.io/
Drivers security controls and carry out attacks

GTFOBins is a curated list of Unix binaries that

GTFOBins can be used to bypass local security restrictions in https://gtfobins.github.io
misconfigured systems
 The goal of the LOLBAS project is to document
https://lolbas-
LOLBAS every binary, script, and library that can be used
project.github.io/
for Living Off The Land techniques

Living Off Attackers are using popular legitimate domains

Trusted when conducting phishing, C&C, exfiltration and
Sites downloading tools to evade detection. The list of https://lots-project.com
(LOTS) websites below allow attackers to use their
Project domain or subdomain

Stay up-to-date with the latest file extensions

Filesec https://filesec.io/
being used by attackers.

Living Off the Orchard: macOS Binaries (LOOBins)

is designed to provide detailed information on
LOOBins various built-in macOS binaries and how they can https://www.loobins.io/
be used by threat actors for malicious purposes.

WTFBin(n): a binary that behaves exactly like

malware, except, somehow, it's not? This project
aims to catalogue benign applications that exhibit
WTFBins https://wtfbins.wtf/
suspicious behavior. These binaries can emit
noise and false positives in threat hunting and
automated detections.

Hijack This project provides an curated list of DLL

https://hijacklibs.net
Libs Hijacking candidates

Red Team Scripts

Name Description URL

https://github.com/Mr-
RedTeamCCode Red Team C code repo
Un1k0d3r/RedTeamCCode

This repo contains information about

https://github.com/Mr-
EDRs EDRs that can be useful during red
Un1k0d3r/EDRs
team exercise.

Community Kit is a central repository

Cobalt Strike of extensions written by the user https://cobalt-
Community Kit community to extend the capabilities strike.github.io/community_kit/
of Cobalt Strike.
Red Team Infrastructure

Name Description URL

Red Team Wiki to collect Red Team

https://github.com/bluscreenofjeff/Red-
Infrastructure infrastructure hardening
Team-Infrastructure-Wiki
Wiki resources

License

To the extent possible under law, Rahmat Nurfauzi "@infosecn1nja" has waived all copyright and
related or neighboring rights to this work.