#1Tools for maintaining long-term access to compromised systems, even after reboots.
Kitploit recommended
g13net/lockjawModular Windows C2 framework with a Rust teamserver, Zig implant, indirect syscalls, AMSI bypass, reflective/PoolParty injection, in-memory BOF…
owasp/owasp-cstgVendor-neutral cloud security testing guide with structured phases for enumeration, privilege escalation, lateral movement, and post-exploitation…
nccgroup/sshessionThe SSH Multiplex Backdoor Tool
voidsecsoftwares/voidsyscallCross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
b3rt1ng/koiMulti-session reverse shell handler with PTY upgrade, post-exploitation modules, Layer 3 tunneling, payload obfuscation for EDR evasion, session…
kamalx06/tornadorevc2Modular post-exploitation framework managing reverse-shell sessions over TCP/TLS/mTLS with plugins for enumeration, in-memory execution, SOCKS5…
cys3c/evilosxA pure python, post-exploitation, remote administration tool (RAT) for macOS / OS X.
stillbigjosh/neoThe NeoC2 Framework
nccgroup/kubetcdPost-exploit a compromised etcd, gain persistence and remote shell to nodes.
d4vinci/palsy-virusPython virus that will make your pc paralyzed once it opened :D
phackt/wptsextensions.dllWptsExtensions.dll for exploiting DLL hijacking of the task scheduler.
ariary/dogwalk-rce-poc🐾Dogwalk PoC (using diagcab file to obtain RCE on windows)
mattiaalessi/phantom-keyloggerPhantom Keylogger is an advanced, stealth-enabled keystroke and visual intelligence gathering system.
rvazarkar/antipwnyA host based IDS written in C# Targetted at Metasploit
enigma0x3/powershell-c2PowerShell-based command and control framework using website-hosted payloads for persistent remote access and post-exploitation on Windows systems.
kaill-jlq/mmskillriskBenchmark and evaluation harness testing whether LLM agents resist malicious instructions hidden in multimodal skill images, with 108 cases across…
yo-yo-yo-jbo/macos_app_structureEducational deep dive into macOS app bundles, plist files, and launchd process behavior, with offensive security notes on packaging payloads as .app…
