#1C2 frameworks, redirectors, listeners, and command infrastructure tools.
Kitploit recommended
flangvik/azurec2relayAzure Function that validates and relays Cobalt Strike beacon traffic using malleable C2 profiles, redirecting invalid requests to a decoy site and…
aahmad097/badoutlookProof-of-concept C# tool that reads Outlook emails via COM interface, extracts base64-encoded shellcode from trigger subject lines, and executes…
byt3bl33d3r/pymalleablec2Python interpreter for Cobalt Strike Malleable C2 Profiles. Allows you to parse, build and modify them programmatically.
thatstraw/pwnlnxMulti-threaded Python reverse shell with payload generation, session management, keylogging, screensharing, and persistence for authorized…
flangvik/cobaltbusCobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus
crossc2/crossc2kitCrossC2 developed based on the Cobalt Strike framework can be used for other cross-platform system control. CrossC2Kit provides some interfaces for…
kleiton0x00/xsscopeXSScope is one of the most powerful and advanced GUI Framework for Modern Browser exploitation via XSS.
joelgmsec/psasyncshellAsynchronous TCP reverse shell in pure PowerShell that bypasses firewalls via non-blocking I/O, with command history, file upload/download, and…
verizon/redshellAn interactive command prompt for red teaming and pentesting. Automatically pushes commands through SOCKS4/5 proxies via proxychains. Optional Cobalt…
navikt/cpltSandbox for AI coding agents. Runs Copilot CLI, Claude Code, OpenCode, Gemini CLI, Antigravity, Pi, goose or a plain shell inside a kernel-level…
ariary/fileless-xecStealth dropper executing remote binaries without dropping them on disk .(HTTP3 support, ICMP support, invisible tracks, cross-platform,...)
igh0st/gh0st3.6_srcRemote Access Trojan (RAT) source code for learning C2 communication, payload delivery, and post-exploitation techniques in Windows environments.
sliverarmory/sliver-guiCross-platform Electron GUI for the Sliver C2 framework, providing session and beacon dashboards, payload generation, listeners, loot, and cloud…
petitoto/chromium-exploit-devToolkit to weaponize Chromium vulnerabilities into reliable, cross-platform, full-chain exploits
codesiddhant/jasmin-ransomwareJasmin Ransomware is an advanced red team tool (WannaCry Clone) used for simulating real ransomware attacks. Jasmin helps security researchers to…
dagowda/notrdpHavoc C2 plugin that creates a hidden Windows desktop, streams it to a browser viewer, and injects mouse/keyboard input for covert remote control.
frenchcisco/ratelRAT-el is an open source penetration test tool that allows you to take control of a windows machine. It works on the client-server model, the server…
enelg52/kittystagerKittyStager is a simple stage 0 C2. It is made of a web server to host the shellcode and an implant, called kitten. The purpose of this project is to…
