#1Tools for maintaining access, exploring, and expanding control within compromised systems and networks.
Kitploit recommended
kypvas/ad_attack_architectureActive Directory Attack Architecture Map Comprehensive Pentest Reference — From Recon to Domain Dominance
kypvas/red-team-mapRed Team Operations Architecture Map Comprehensive Operator Reference — From Infrastructure to Impact
evkir/phantom-gridFree Burp Collaborator alternative- OOB interaction capture (HTTP/HTTPS/DNS) with SQLite & exfil reassembly
mrexodia/titanhideWindows kernel driver that hooks Nt* SSDT functions to hide debuggers and processes from anti-debug checks, with an x64dbg plugin for stealth…
r41n3rzuf477/pplwindowProof-of-concept PPL bypass abusing the NtUserGetWindowProcessHandle syscall to obtain a handle to protected Windows processes without admin…
r41n3rzuf477/quickassist_uac_bypassUAC bypass PoC abusing the UIAccess QuickAssist binary to load an attacker-controlled DLL via WebView2 BrowserExecutableFolder, then hijack elevated…
elnerd/get-netntlmPowershell module to get the NetNTLMv2 hash of the current user
onescripter/wmiexecExecute Windows commands remotely and capture output using only WMI and PowerShell (not remoting).
xpn/randomtsscriptsCollection of RedTeam engagement scripts including Pre2K default credential checks via TGS, LAPSv2 password decryption, and IIS App Pool credential…
p0dalirius/joomla-webshell-pluginA webshell plugin and interactive shell for pentesting a Joomla website.
bignerd95/chimay-redWorking POC of Mikrotik exploit from Vault 7 CIA Leaks
saqibnet/blackbox-pentesting-infsecosFull black-box penetration test against SecOS:1 (VulnHub) — CSRF exploitation, privilege escalation via CVE-2015-1328 (OverlayFS), post-exploitation
linnemanlabs/glimmerAdversary emulation and C2 framework for security research
darthton/hyperboneMinimalistic VT-x hypervisor for Windows x64 providing syscall, MSR, IDT, and kernel inline hooks plus EPT-based page substitution and TLB splitting.
thesecretclub/sandboxbootkitBootkit for Windows Sandbox to disable DSE/PatchGuard.
rapid7/metasploit-payloadsUnified repository for different Metasploit Framework payloads
vulncheck-oss/jupyter-notebooksExample Jupyter notebooks that query VulnCheck APIs to chart exploitation timelines, Known Exploited Vulnerabilities, and botnet data for threat…
vulncheck-oss/external-c2-experimentsGo external C2 module for go-exploit that catches reverse SSH shells, providing a server listener and payload client for integrating custom C2…
