#1Tools for creating fake identities, spoofing communications, and impersonating targets for social engineering.
Kitploit recommended
r00t-3xp10it/backdoorppttransform your payload.exe into one fake word doc (.ppt)
decoder-it/tokenstealerWindows token manipulation utility that lists, steals, and impersonates process or user tokens to execute commands as other users, leveraging…
m4rm0k/cve-2020-10135-biasCVE 2020-10135 a.k.a BIAS (Bluetooth Impersonation Attack)
sensepost/impersonateA windows token impersonation tool
syss-research/clone-certSimple shell script to "clone" X.509 certificates
initstring/evil-ssdpSpoof SSDP replies and create fake UPnP devices to phish for credentials and NetNTLM challenge/response.
s3cur3th1ssh1t/sharpimpersonationA User Impersonation tool - via Token or Shellcode injection
zadewg/riusCVE-2020-20093; 20094; 20095; 20096, 2022-28345 RTLO Injection URI Spoofing
millad7/sogo_web_mail-vulnerability-cve-2025-50340Insecure Direct Object Reference (IDOR vulnerability) in SOGo Webmail Allows a user to send emails on behalf of another user.
gar-re/cve-2022-27438Proof-of-concept exploit for CVE-2022-27438, demonstrating remote code execution via spoofed update server in Advanced Installer 19.3. Includes DNS…
lab52io/stopdefenderStop Windows Defender programmatically
secureworks/squarephishAdvanced phishing tool combining OAuth Device Code authentication flow with QR codes to harvest Microsoft authentication tokens via MFA update…
s3cur3th1ssh1t/namedpipepthPass the Hash to a named pipe for token Impersonation
rasta-mouse/spawnwithCobalt Strike BOF that spawns a process using another user's token and injects Beacon shellcode, enabling post-exploitation and lateral movement via…
alperenugurlu/nac_bypass_agentThis function combines all the above functions and takes necessary information from the user to change the IP and MAC address, start the responder…
leftp/backupcredsA C# implementation of dumping credentials from Windows Credential Manager
bishopfox/ca-cloneScripts to clone CA certificates for use in HTTPS client attacks.
