RedTeam-Tools

This github repository contains a collection of 150+ tools and resources that can be useful for red teaming activities.

Some of the tools may be specifically designed for red teaming, while others are more general-purpose and can be adapted for use in a red teaming context.

🔗 If you are a Blue Teamer, check out BlueTeam-Tools

Warning

The materials in this repository are for informational and educational purposes only. They are not intended for use in any illegal activities.

Note

Hide Tool List headings with the arrow.

Click 🔙 to get back to the list.

Tool List

Red Team Tips 19 tips

• Improved HTML smuggling with mouse move eventlistener @pr0xylife
• Google translate for phishing @malmoeb
• Hiding the local admin account @Alh4zr3d
• Cripple windows defender by deleting signatures @Alh4zr3d
• Enable multiple RDP sessions per user @Alh4zr3d
• Sysinternals PsExec.exe local alternative @GuhnooPlusLinux
• Live off the land port scanner @Alh4zr3d
• Proxy aware PowerShell DownloadString @Alh4zr3d
• Looking for internal endpoints in browser bookmarks @Alh4zr3d
• Query DNS records for enumeration @Alh4zr3d
• Unquoted service paths without PowerUp @Alh4zr3d
• Bypass a disabled command prompt with /k Martin Sohn Christensen
• Stop windows defender deleting mimikatz.exe @GuhnooPlusLinux
• Check if you are in a virtual machine @dmcxblue
• Enumerate AppLocker rules @Alh4zr3d
• CMD shortcut with 6 pixels via mspaint PenTestPartners
• Link spoofing with PreventDefault JavaScript method
• Check SMB firewall rules with Responder @malmoeb
• Disable AV with SysInternals PsSuspend @0gtweet

Reconnaissance 24 tools

• spiderfoot Automated OSINT and attack surface mapping
• reconftw Automated subdomain and vulnerability recon tool
• subzy Subdomain takeover vulnerability checker
• smtp-user-enum SMTP user enumeration
• crt.sh -> httprobe -> EyeWitness Automated domain screenshotting
• jsendpoints Extract page DOM links
• nuclei Vulnerability scanner
• certSniff Certificate transparency log keyword sniffer
• gobuster Website path brute force
• feroxbuster Fast content discovery tool written in Rust
• CloudBrute Cloud infrastructure brute force
• dnsrecon Enumerate DNS records
• Shodan.io Public facing system knowledge base
• AORT (All in One Recon Tool) Subdomain enumeration
• spoofcheck SPF/DMARC record checker
• AWSBucketDump S3 bucket enumeration
• GitHarvester GitHub credential searcher
• truffleHog GitHub credential scanner
• Dismap Asset discovery/identification
• enum4linux Windows/samba enumeration
• skanuvaty Dangerously fast dns/network/port scanner
• Metabigor OSINT tool without API
• Gitrob GitHub sensitive information scanner
• gowitness Web screenshot utility using Chrome Headless

Resource Development 12 tools

• remoteinjector Inject remote template link into word document
• Chimera PowerShell obfuscation
• msfvenom Payload creation
• Shellter Dynamic shellcode injection tool
• Freeze Payload creation (circumventing EDR)
• WordSteal Steal NTML hashes with Microsoft Word
• NTAPI Undocumented Functions Windows NT Kernel, Native API and drivers
• Kernel Callback Functions Undocumented Windows APIs
• OffensiveVBA Office macro code execution and evasion techniques
• WSH Wsh payload
• HTA Hta payload
• VBA Vba payload