Like PingCastle went out for drinks with Bloodhound, and they actually decided to get some work done. 🍷

WinFlesher is an advanced attack surface security assessment framework designed to analyze, evaluate, and report on security postures, attack paths, and remediation strategies in complex environments.

Developed for security professionals and cybersecurity auditors, WinFlesher automates vulnerability discovery and critical path correlation within Active Directory and local infrastructures.

Features Overview

WinFlesher offers a modular, telemetry-based approach to risk management:

Automated Discovery: Real-time detection of host configurations, services, scheduled tasks, firewalls, and LSA configurations.
Active Directory Analysis: In-depth analysis of domains, trusts, group privileges, and users with exposed SPNs.
Attack Paths Engine: Automatic correlation between vulnerabilities and impact, identifying paths to Domain Compromise, Privilege Escalation, and Lateral Movement.
Remediation Support: Integrated practical guides and resolution scripts for each detected vulnerability.
Modern GUI: Dedicated graphical interface for rapid management and an intuitive visualization of the security score.

HTML Report

WinFlesher Dashboard

WinFlesher Findings

WinFlesher Module Details

WinForm GUI

WinFlesher Attack Paths

WinFlesher Modules

WinFlesher Remediation

Installation

WinFlesher can run on either a client or a server operating system, as long as the machine is domain-joined and has local administrator privileges to install dependencies and Active Directory modules.

The quickest way to get started is to download the entire repository as a ZIP archive and extract it locally:

Download the repository by clicking the "Download ZIP" button on the main GitHub page.
Extract the ZIP file to a secure folder (e.g., C:\Tools\WinFlesher).
Note: Ensure that PowerShell script execution is enabled on your system:
```
Set-ExecutionPolicy Bypass -Scope Process -Force
```

Required Modules

To fully leverage WinFlesher's capabilities (especially for the Active Directory and Cloud components), ensure you have the following modules installed:

Active Directory:

Install-WindowsFeature RSAT-AD-PowerShell

Microsoft Graph (for Entra ID):

Install-Module Microsoft.Graph.Applications -Scope CurrentUser

How to Run WinFlesher

To start the framework, open a PowerShell console (running as Administrator is recommended for full telemetry gathering), navigate to the root directory, and simply execute:

. .\Invoke-Winflesher.ps1

WinFlesher