#1C2 frameworks, redirectors, listeners, and command infrastructure tools.
Kitploit recommended
nodauf/girshAutomatically spawn a reverse shell fully interactive for Linux or Windows victim
mayyhem/maestroAbusing Azure services over C2
hackerhouse-opensource/backdoorsTools for maintaining access to systems and proof-of-concept demonstrations.
devzero-security/redstackproCompose red team infrastructure and Active Directory ranges on a canvas, then compile to a complete Terraform and Ansible working directory you run…
oldkingcone/slopshellthe only php webshell you need.
arno0x/webdavc2A WebDAV PROPFIND C2 tool
h4x0r-dz/cve-2024-3400Proof-of-concept exploit for CVE-2024-3400, a Palo Alto OS command injection in GlobalProtect VPN. Demonstrates file creation and outbound command…
ustayready/python-pentestingJust a repo of random Python scripts to get pentesters started with the Python language on engagements.
malwaretech/trickbot-toolkitA collection of tools for dealing with TrickBot
arcanum-sec/wraithBrowser-hooking framework for authorized red teams and educators. Hooks browsers via XSS, provides interactive post-exploitation control, blind-XSS…
jumpseclabs/tokenflareServerless AITM Simulation Framework for Entra ID and M365
octoberfest7/dns_tunnelingDNS tunneling tool using PowerShell and Nslookup to exfiltrate data and deliver payloads via DNS TXT/MX records, bypassing Constrained Language Mode…
beichendream/cve-2022-26134-godzilla-memshellJava-based exploit for CVE-2022-26134 that injects a Godzilla webshell into Confluence servers, enabling remote code execution with password and key…
redsiege/cimplantC# port of WMImplant which uses either CIM or WMI to query remote systems
rasta-mouse/crystal-loadersA small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike
00xglitch/bellaBella is a pure python post-exploitation data mining tool & remote administration tool for macOS. 🍎💻
allevon412/teamsimplantStealthy DLL proxying implant for Microsoft Teams that injects AES-encrypted shellcode via unhooking techniques, providing persistent backdoor access…
skorpion96/unisoc-suA method for CVE-2025-31710 and to connect to cmd_skt to obtain a root shell on unisoc unpatched models
