#1Tools for maintaining access, exploring, and expanding control within compromised systems and networks.
Kitploit recommended
abraxas/pfsense-api-acb-userkeypfSense Plus MIM API toolkit b4acd7ca - High - Remote - IDOR - ACB userkey capability URL
abraxas/pfsense-api-acme-key-dumppfSense Plus MIM API toolkit b4acd7ca - High - Remote - Privilege leftover - GET /services/acme dumps keys
abraxas/pfsense-api-unix-sock-noauthpfSense Plus MIM API toolkit b4acd7ca - High - Local - Privilege leftover - unix sock enroll no JWT
p3ng0s/archlivePhysical access red team live ISO built on Arch Linux
gmh5225/memory-relocallocC proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…
joda32/aditActive Directory recon and read-only security audit over ADWS (net.tcp/9389), in Go
kr0no/bloodhound-shellAn interactive command-line shell for BloodHound API.
roccoammon/active-directory-health-checkPowerShell GUI tool that runs 54 best-practice health and security checks against Active Directory, flagging Kerberoasting, DCSync, delegation and…
ripits-sec/couchpotatoWindows privilege escalation tool that patches ETW and AMSI and uses indirect syscalls to abuse SeImpersonatePrivilege, escalating service accounts…
bittersecurity/decepticonAutonomous LLM red team agent that plans and executes full attack chains—recon, exploitation, privilege escalation, lateral movement and C2—inside an…
abraxas/opnsense-firmware-mirror-sedOPNsense 26.7.6 - High - Remote - Privilege leftover - custom firmware mirror sed-skips pkg fingerprints
abraxas/opnsense-uidfield-system-uid0OPNsense 26.7.6 - High - Remote - Privilege leftover - UidField uid 0
abraxas/pfsense-carp-vhidpfSense CE 2.9.0-DEVELOPMENT - High - Remote - RCE - CARP VHID leftover
abraxas/spark-proxyuser-classpathApache Spark 4.2.0 - High - Remote - Privilege leftover - proxy-user defaultExtraClassPath
abraxas/spark-python-ds-staticApache Spark 4.2.0 - High - Remote - Privilege leftover - process-global Python Data Source map
abraxas/spark-rest-auth-bypassApache Spark 4.2.0 - High - Remote - Privilege leftover - standalone REST ignores spark.authenticate
twosevenonet/injectsetconsoleProof of Concept for Process Code Injection Without Using WriteProcessMemory
sk4r4b/ntdll-reconstructionA technique that mixes NTDLL unhooking and hellsgate gate varients
