#3RAT analysis, detection signatures, behavioral analysis, and research frameworks.
Kitploit recommended
b23r0/heroinnA cross platform C2/post-exploitation framework.
grisuno/lazyownRed team framework and multi-operator C2 platform with AI agents, malleable implants, rootkits, phishing engine, and 741 CLI commands covering the…
bishopfox/sliverAdversary Emulation Framework
jpillora/chiselFast TCP/UDP tunnel over HTTP with SSH encryption, supporting reverse port forwarding, SOCKS5 proxy, and client authentication for secure network…
bc-security/empireEmpire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
rapid7/metasploit-payloadsUnified repository for different Metasploit Framework payloads
deadexpl0it/cve-2026-78006-pocPOC for CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
rapid7/metasploit-frameworkOpen-source exploitation framework with modular payload, encoder, and auxiliary system for penetration testing, vulnerability validation, and…
mythicagents/xenonA Mythic agent for Windows written in C
its-a-feature/mythicA collaborative, multi-platform, red teaming framework
user696/mrrat:mouse: This is a cross-platform Python 2.x Remote Access Trojan (RAT)
x3r0day/fud-c2-frameworkA fileless reverse shell and C2 framework leveraging direct syscalls, proxy tunneling, and ChaCha20 encryption for AV evasion.
g13net/lockjawModular Windows C2 framework with a Rust teamserver, Zig implant, indirect syscalls, AMSI bypass, reflective/PoolParty injection, in-memory BOF…
machine1337/telegramratCross Platform Telegram based RAT that communicates via telegram to evade network restrictions
jm33-m0/emp3r0rSelf‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents.
fortra/impacketPython library for low-level network protocol manipulation, featuring SMB, MSRPC, Kerberos, and WMI implementations with tools for authentication…
tomiwa-ot/mouktharAndroid remote administration tool
voidsecsoftwares/voidsyscallCross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
