#1Adversary simulation, red team infrastructure, C2 frameworks, and operational security tools.
Kitploit recommended
bats3c/shad0wA post exploitation framework designed to operate covertly on heavily monitored environments
outflanknl/c2-tool-collectionA collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
login-securite/donpapiAutomated remote credential dumper for Windows environments, extracting DPAPI secrets, browser credentials, certificates, and configuration files…
fiddyschmitt/file-tunnelTunnel TCP connections through a file
ascotbe/medusa🐈Medusa是一个红队武器库平台，目前包括XSS平台、协同平台、CVE监控、免杀生成、DNSLOG、钓鱼邮件、文件获取等功能，持续开发中
dliv3/venomVenom - A Multi-hop Proxy for Penetration Testers
pikpikcu/aireconAIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual…
gianlucaborello/libprocesshiderLD_PRELOAD shared library that hides a Linux process from tools like ps and lsof by intercepting readdir and proc filesystem calls.
reverseclabs/sharpgpoabuseSharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order…
knavesec/credmasterRefactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling
arvanaghi/sessiongopherSessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY,…
cobbr/sharpsploitSharpSploit is a .NET post-exploitation library written in C#
pushsecurity/browser-identity-attacks-matrixOffensive security drives defensive security. We're sharing a collection of SaaS attack techniques to help defenders understand the threats they…
bitbrute/evillimiterTool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access
endgameinc/rtaScripted framework for simulating over 50 MITRE ATT&CK techniques to test blue team detection capabilities. Includes Python scripts and a compiled…
arthepsy/cve-2021-4034Proof-of-concept exploit for CVE-2021-4034 (PwnKit), a local privilege escalation vulnerability in polkit's pkexec, allowing unprivileged users to…
reverseclabs/c3Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive…
the-xentropy/xencryptA PowerShell script anti-virus evasion tool
