#1Tools for gaining higher-level permissions or unauthorized access on compromised systems.
Kitploit recommended
abraxas/vbox-ovf-href-dest-escapeVirtualBox 7.2.20 - High - Local - File write - OVF href dest escape
abraxas/vbox-ovf-nat-tftp-prefixVirtualBox 7.2.20 - High - Local - File read - OVF NAT TFTP empty prefix
mein-0/knockgigaProof-of-concept local privilege escalation exploiting Gigabyte gdrv3.sys IOCTLs to write the SYSTEM token into a user process via an unchecked…
abraxas/pfsense-acb-restore-privpfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - ACB restore
abraxas/pfsense-config-readonly-restorepfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - readonly config_install
abraxas/pfsense-ldap-name-collisionpfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - LDAP admin name
capture0x/confirmescLinux privesc enumerator that confirms exploitability and gives you the exact root shell command - no GTFOBins searching. MCP server + AI-agent…
abraxas/pfsense-uploadconfigpfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - hidden uploadconfig
abraxas/pfsense-wizard-uid0pfSense CE 2.9.0-DEVELOPMENT - High - Remote - Privilege leftover - wizard uid 0
capture0x/adstrikeAI-powered modular Active Directory red-team framework for authorized penetration testing, AD enumeration, attack-path analysis, Kerberos/ADCS…
abraxas/pfsense-api-unix-sock-noauthpfSense Plus MIM API toolkit b4acd7ca - High - Local - Privilege leftover - unix sock enroll no JWT
joda32/aditActive Directory recon and read-only security audit over ADWS (net.tcp/9389), in Go
kr0no/bloodhound-shellAn interactive command-line shell for BloodHound API.
roccoammon/active-directory-health-checkPowerShell GUI tool that runs 54 best-practice health and security checks against Active Directory, flagging Kerberoasting, DCSync, delegation and…
ripits-sec/couchpotatoWindows privilege escalation tool that patches ETW and AMSI and uses indirect syscalls to abuse SeImpersonatePrivilege, escalating service accounts…
bittersecurity/decepticonAutonomous LLM red team agent that plans and executes full attack chains—recon, exploitation, privilege escalation, lateral movement and C2—inside an…
abraxas/opnsense-firmware-mirror-sedOPNsense 26.7.6 - High - Remote - Privilege leftover - custom firmware mirror sed-skips pkg fingerprints
abraxas/opnsense-uidfield-system-uid0OPNsense 26.7.6 - High - Remote - Privilege leftover - UidField uid 0
