Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
awesome-hacking-lists — A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit! | Kitploit
Tools/GitHubGitHub/taielab/awesome-hacking-lists
OSINT (Open Source Intelligence)Exploit FrameworksVulnerability AnalysisReverse EngineeringWeb SecurityPenetration TestingLearning & EducationRed TeamingCurated Resources
GitHubtaielab/awesome-hacking-lists

awesome-hacking-lists

A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit!

1.4k2678 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository

Awesome Stars Awesome

A curated list of my GitHub stars! Generated by starred.

Contents

  • ASL
  • ASP.NET
  • ActionScript
  • Ada
  • Arduino
  • Assembly
  • AutoHotkey
  • AutoIt
  • Batchfile
  • BitBake
  • Blade
  • BlitzBasic
  • Boo
  • C
  • C#
  • C++
  • CMake
  • CSS
  • Classic ASP
  • Clojure
  • CodeQL
  • ColdFusion
  • Dart
  • Dockerfile
  • Emacs Lisp
  • Erlang
  • F#
  • Fluent
  • FreeMarker
  • Go
  • Groovy
  • HCL
  • HTML
  • Hack
  • Haskell
  • Inno Setup
  • Java
  • JavaScript
  • Jinja
  • Jupyter Notebook
  • KiCad Layout
  • Kotlin
  • LLVM
  • Logos
  • Lua
  • MATLAB
  • Makefile
  • Markdown
  • Mask
  • Max
  • Mustache
  • NSIS
  • Nginx
  • Nim
  • Nix
  • Nunjucks
  • OCaml
  • Objective-C
  • Objective-C++
  • Open Policy Agent
  • Others
  • PHP
  • PLpgSQL
  • Pascal
  • Perl
  • PostScript
  • PowerShell
  • Propeller Spin
  • Pug
  • Python
  • QMake
  • REXX
  • Rascal
  • Rich Text Format
  • Roff
  • Ruby
  • Rust
  • SCSS
  • Sage
  • SaltStack
  • Scala
  • Scheme
  • Shell
  • Smali
  • Smarty
  • Solidity
  • SourcePawn
  • Starlark
  • Svelte
  • Swift
  • TSQL
  • Tcl
  • TeX
  • TypeScript
  • VBA
  • VBScript
  • VCL
  • Vim Script
  • Visual Basic
  • Visual Basic .NET
  • Vue
  • XSLT
  • YAML
  • YARA
  • Zeek
  • Zig
  • nesC
  • templ

ASL

  • postgres-cn/pgdoc-cn - PostgreSQL manual Chinese translation by China PostgreSQL Users Group

ASP.NET

  • Jean-Francois-C/Webshell-Upload-and-Web-RCE-Techniques - Classic Web shell upload techniques & Web RCE techniques

ActionScript

  • appsecco/json-flash-csrf-poc - This repo contains the files required to perform a CSRF attack using Flash and HTTP 307 redirections.

Ada

  • PatrikFehrenbach/amass-tools -

Arduino

  • UnicycleDumpTruck/MissionControl - This kids' homework desk has top that flips up to reveal a space-themed control panel.
  • spacehuhn/wifi_keylogger - DIY Arduino Wi-Fi Keylogger (Proof of Concept)

Assembly

  • enkomio/AlanFramework - A C2 post-exploitation framework
  • MortenSchenk/Token-Stealing-Shellcode -
  • xenoscr/SysWhispers2 - AV/EDR evasion via direct system calls.
  • timwhitez/Doge-Direct-Syscall - Golang Direct Syscall
  • klezVirus/inceptor - Template-Driven AV/EDR Evasion Framework
  • guitmz/memrun - Small tool to run ELF binaries from memory with a given process name
  • DownWithUp/DynamicKernelShellcode - An example of how x64 kernel shellcode can dynamically find and use APIs
  • mai1zhi2/SysWhispers2_x86 - X86 version of syswhispers2 / x86 direct system call
  • jthuraisamy/SysWhispers2 - AV/EDR evasion via direct system calls.
  • Cybereason/siofra -
  • mytechnotalent/Reverse-Engineering - A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.
  • jjyr/jonesforth_riscv - Jonesforth RISC-V port.
  • vxunderground/MalwareSourceCode - Collection of malware source code for a variety of platforms in an array of different programming languages.
  • antonioCoco/Mapping-Injection - Just another Windows Process Injection
  • jthuraisamy/SysWhispers - AV/EDR evasion via direct system calls.
  • tinysec/windows-syscall-table - windows syscall table from xp ~ 10 rs4

AutoHotkey

  • xianyukang/MyKeymap - 一款基于 AutoHotkey 的键盘映射工具
  • goreliu/runz - RunZ，专业的快速启动工具
  • kookob/smpic - Windows下面的SM.MS图床上传工具

AutoIt

  • WildByDesign/ACLViewer - ACL Viewer for Windows

Batchfile

  • lxgw/LxgwWenKai - An open-source Chinese font derived from Fontworks' Klee One. 一款开源中文字体，基于 FONTWORKS 出品字体 Klee One 衍生。
  • gsuberland/lbfo_win10 - Re-enable NIC teaming (LBFO) in Windows 10 using components from Windows Server.
  • SkyBlueEternal/jdk-change - 支持windows\linux\macOS | jdk一键切换版本\一键切换jdk版本\jdk版本更换
  • 0xbinibini/emergency_response_batch - 应急响应，应急响应脚本，应急响应批处理；将Windows查看日志用户端口等命令集成在批处理脚本中。让熟练的应急人员能省去多次重复的敲击和记忆，并通过读取配置文件来调用Windows自带的命令结束进程服务等，本批处理尽量不调用任何外部的工具。任何调用的外部工具都将会存放在plugin目录下可按需使用，力图使用最原生的命令行来完成工作。
  • SoraShu/easyconn-socks5-for-HITsz - 在服务器上运行easyconnect并建立socks5代理，实现win电脑上免安装easyconnect访问校园内网。
  • r00t4dm/CVE-2020-27955 -
  • swagkarna/Defeat-Defender-V1.2.0 - Powerful batch script to dismantle complete windows defender protection and even bypass tamper protection ..Disable Windows-Defender Permanently....Hack windows. POC
  • wafinfo/cobaltstrike - cobaltstrike插件
  • chroblert/JC-jEnv - windows java environ manage
  • massgravel/Microsoft-Activation-Scripts - Open-source Windows and Office activator featuring HWID, Ohook, TSforge, KMS38, and Online KMS activation methods, along with advanced troubleshooting.
  • sagishahar/lpeworkshop - Windows / Linux Local Privilege Escalation Workshop
  • maguowei/k8s-docker-desktop-for-mac - Docker Desktop for Mac 开启并使用 Kubernetes
  • ihacku/winhardening - windows 加固脚本
  • frizb/Windows-Privilege-Escalation - Windows Privilege Escalation Techniques and Scripts
  • acgbfull/IBM_Appscan_Batch_Scan_Script - IBM AppScan批量扫描脚本

BitBake

  • xer0times/BugBounty - Bug Bounty stuffs, payloads, scripts, profiles, tips and tricks, ...

Blade

  • dbarzin/mercator - Mapping the information system / Cartographie du système d'information

BlitzBasic

  • Sy3Omda/burp-bounty - Burp Bounty profiles
  • six2dez/burp-bounty-profiles - Burp Bounty profiles compilation, feel free to contribute!
  • PortSwigger/scan-check-builder - Burp Bounty is a extension of Burp Suite that improve an active and passive scanner by yourself. This extension requires Burp Suite Pro.
  • 1N3/IntruderPayloads - A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.
  • ghsec/BBProfiles - Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that improve an active and passive scanner by yourself. This extension requires Burp Suite Pro.

Boo

  • byt3bl33d3r/SILENTTRINITY - An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

C

  • ImKKingshuk/RootShield - RootShield : The Ultimate Shield for Rooted Android Devices - Protect your rooted Android device from unauthorized file operations and process executions! 🛡️ RootShield is a powerful kernel module tha
  • google/security-research - This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
  • linktools-toolkit/linktools - 记录了在移动端漏洞分析和合规扫描过程中涉及的一些常用功能，以Python库的方式提供使用
  • varwara/CVE-2024-35250 - PoC for the Untrusted Pointer Dereference in the ks.sys driver
  • hengyoush/kyanos - Kyanos is a networking analysis tool using eBPF. It can visualize the time packets spend in the kernel, capture requests/responses, makes troubleshooting more efficient.
  • wangfly-me/LoaderFly - 助力每一位RT队员，快速生成免杀木马
  • gianlucaborello/libprocesshider - Hide a process under Linux using the ld preloader (https://sysdig.com/blog/hiding-linux-processes-for-fun-and-profit/)
  • paokuwansui/Antivirus_killer - 免杀主流防病毒软件
  • P001water/yuze - A socksv5 proxy tool Written by CLang. 一款纯C实现的轻量内网穿透工具，支持正向，反向socks5代理隧道的搭建，支持跨平台使用。
  • OracleNep/Nday-Exploit-Plan - 历史漏洞的细节以及利用方法汇总收集
  • iridium-soda/container-escape-exploits - 整理容器逃逸相关的漏洞和exploits.
  • baiyies/AutoMonitor - windows自动监控截图工具。 windows automatic screenshoter.
  • h4ckm310n/Container-Vulnerability-Exploit - 容器安全漏洞的分析与复现
  • m0nad/Diamorphine - LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

C#

  • EncodeGroup/RegSave - A .NET implementation to dump SAM / SECURITY / SYSTEM registry hives
  • lintstar/SharpHunter - Automated Hosting Information Hunting Tool - Windows 主机信息自动化狩猎工具
  • xhnbzdl/feishu-doc-export - 飞书文档导出服务
  • h0ny/MobaXtermDecryptor - A simple MobaXterm password extraction tool.
  • 1Remote/1Remote - One Remote Access Manager to Rule Them All
  • rnchg/Apt - AI Productivity Tool - Free and open source, improve user productivity, protect privacy and data security. Provide efficient and convenient AI solutions, built-in local exclusive ChatGPT, Phi, DeepSee
  • decoder-it/KrbRelay-SMBServer -
  • murat-exp/EDR-Antivirus-Bypass-to-Gain-Shell-Access - EDR & Antivirus Bypass to Gain Shell Access
  • lypd0/DeadPotato - DeadPotato is a windows privilege escalation utility from the Potato family of exploits, leveraging the SeImpersonate right to obtain SYSTEM privileges. This script has been customized from the
  • MInggongK/Penetration-mining-src - 一款集成了H3C,致远，泛微，万户，帆软，海康威视，金蝶云星空，畅捷通，Struts等多个RCE漏洞利用工具
  • INotGreen/SharpScan - 内网资产收集、探测主机存活、端口扫描、域控定位、文件搜索、各种服务爆破（SSH、SMB、MsSQL等）、Socks代理，一键自动化+无文件落地扫描
  • qwqdanchun/Pillager - Pillager是一个适用于后渗透期间的信息收集工具
  • StarfireLab/SharpWeb - 一个浏览器数据（密码|历史记录|Cookie|书签|下载记录）的导出工具，支持主流浏览器。
  • Mangofang/BypassLoad - shellcode免杀加载器，过主流杀软
  • DeEpinGh0st/WindowsBaselineAssistant - Windows安全基线核查加固助手
  • mabangde/winlogparser - windows 日志检测工具

Read more

Download Tool
  • crazywifi/RDP_SessionHijacking - Passwordless RDP Session Hijacking
  • mxk/windows-secure-group-policy - Windows 11 secure group policy for standalone devices
  • so87/CISSP-Study-Guide - study material used for the 2018 CISSP exam
  • Tai7sy/fuckcdn - CDN真实IP扫描，易语言开发
  • NextronSystems/APTSimulator - A toolset to make a system look as if it was the victim of an APT attack
  • auspbro/domain-admin-crack - 🌵 入域电脑用户本地提权
  • bartblaze/Disable-Intel-AMT - Tool to disable Intel AMT on Windows
  • NuclearPhoenixx/fake-sandbox - 👁‍🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.
  • wzulfikar/ngrok-caddy - Script to run ngrok with (optional) caddy server
  • PolarPeak/NIDS - 基于Suricata简单的网络入侵检测系统，也是我的垃圾毕业设计，目前仅仅是一个demo。
  • evilashz/PigScheduleTask - 添加计划任务方法集合
  • kernweak/minicrypt - 基于MiniFilter和Sfilter的加解密
  • esnet/iperf - iperf3: A TCP, UDP, and SCTP network bandwidth measurement tool
  • qwqdanchun/HVNC - 基于Tinynuke修复得到的HVNC
  • baidu/dperf - dperf is a 100Gbps network load tester.
  • H4K6/CVE-2023-0179-PoC - 针对（CVE-2023-0179）漏洞利用 该漏洞被分配为CVE-2023-0179，影响了从5.5到6.2-rc3的所有Linux版本，该漏洞在6.1.6上被测试。 漏洞的细节和文章可以在os-security上找到。
  • Impalabs/CVE-2023-27326 - VM Escape for Parallels Desktop <18.1.1
  • libAudioFlux/audioFlux - A library for audio and music analysis, feature extraction.
  • chompie1337/Windows_LPE_AFD_CVE-2023-21768 - LPE exploit for CVE-2023-21768
  • xforcered/Windows_LPE_AFD_CVE-2023-21768 - LPE exploit for CVE-2023-21768
  • Esonhugh/sshd_backdoor - /root/.ssh/authorized_keys evil file watchdog with ebpf tracepoint hook.
  • brosck/Pingoor - 「🚪」Linux Backdoor based on ICMP protocol
  • nelhage/reptyr - Reparent a running program to a new terminal
  • itm4n/PPLdump - Dump the memory of a PPL with a userland exploit
  • zh-explorer/dirtycow - exploit for dirtycow
  • Coldzer0/ReverseSock5Proxy - A tiny Reverse Sock5 Proxy written in C :V
  • Cerbersec/KillDefenderBOF - Beacon Object File PoC implementation of KillDefender
  • seventeenman/noELF - Linux下用于远程加载可执行文件以达到内存加载的目的
  • Kevin-sa/ebpf-supply-chain - 利用ebpf做pypi恶意包检测
  • yukar1z0e/cloudswordtsh - 多用户版linux/freebsd/openbsd/netbsd/cygwin/sunos/irix/hpux/osf的远控tiny shell
  • Octoberfest7/EventViewerUAC_BOF - Beacon Object File implementation of Event Viewer deserialization UAC bypass
  • Rvn0xsy/SchtaskCreator - 远程创建任务计划工具
  • Libraggbond/EventViewerBypassUacBof - EventViewer Bypass Uac Bof
  • randorisec/CVE-2022-34918-LPE-PoC -
  • h3xduck/TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
  • pytorch/cpuinfo - CPU INFOrmation library (x86/x86-64/ARM/ARM64, Linux/Windows/Android/macOS/iOS)
  • byt3bl33d3r/BOF-Zig - Cobalt Strike BOF with Zig!
  • crisprss/PetitPotam - 替代PrintBug用于本地提权的新方式，主要利用MS-EFSR协议中的接口函数 借鉴了Potitpotam中对于EFSR协议的利用,实现了本地提权的一系列方式 Drawing on the use of the EFSR protocol in Potitpotam, a series of local rights escalation methods have been realized
  • Cracked5pider/Ekko - Sleep Obfuscation
  • helloexp/0day - 各种CMS、各种平台、各种系统、各种软件漏洞的EXP、POC ,该项目将持续更新
  • tr3ee/CVE-2022-23222 - CVE-2022-23222: Linux Kernel eBPF Local Privilege Escalation
  • synacktiv/ica2tcp - A SOCKS proxy for Citrix.
  • thefLink/DeepSleep - A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
  • q77190858/CVE-2021-3156 - sudo提权漏洞CVE-2021-3156复现代码
  • nsacyber/Hardware-and-Firmware-Security-Guidance - Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as gene
  • nemo-wq/PrintNightmare-CVE-2021-34527 - PrintNightmare - Windows Print Spooler RCE/LPE Vulnerability (CVE-2021-34527, CVE-2021-1675) proof of concept exploits
  • LDrakura/Remote_ShellcodeLoader - 远程shellcode加载&权限维持+小功能
  • JDArmy/RPCSCAN - RPC远程主机信息匿名扫描工具
  • jituo666/AndroidEventRecorder - A recorder used for recording user actions on Android platforms.
  • liudf0716/xfrpc - The xfrpc project is a lightweight implementation of the FRP client written in C language for OpenWRT and IoT systems. It is designed to provide an efficient solution for resource-constrained devices
  • Mr-Un1k0d3r/WindowsDllsExport - A list of all the DLLs export in C:\windows\system32\
  • trustedsec/CS-Remote-OPs-BOF -
  • 3nock/OTE - OSINT Template Engine
  • DataDog/security-labs-pocs - Proof of concept code for Datadog Security Labs referenced exploits.
  • outflanknl/C2-Tool-Collection - A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
  • chicharitomu14/AndScanner - This is the project for the paper “Large-scale Security Measurements on the Android Firmware Ecosystem” in ICSE2022
  • rbsec/sslscan - sslscan tests SSL/TLS enabled services to discover supported cipher suites
  • krisnova/boopkit - Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.
  • bytedance/bhook - 🔥 ByteHook is an Android PLT hook library which supports armeabi-v7a, arm64-v8a, x86 and x86_64.
  • r0ysue/AndroidFridaBeginnersBook - 《安卓Frida逆向与抓包实战》随书附件
  • easychen/pushdeer - 开放源码的无App推送服务，iOS14+扫码即用。亦支持快应用/iOS和Mac客户端、Android客户端、自制设备
  • emptymonkey/revsh - A reverse shell with terminal support, data tunneling, and advanced pivoting capabilities.
  • Bonfee/CVE-2022-0995 - CVE-2022-0995 exploit
  • RfidResearchGroup/proxmark3 - Iceman Fork - Proxmark3
  • gojue/ecapture - Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
  • ly4k/PwnKit - Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation
  • crisprss/PrintSpoofer - PrintSpoofer的反射dll实现，结合Cobalt Strike使用
  • AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits - A collection of exploits and documentation that can be used to exploit the Linux Dirty Pipe vulnerability.
  • mponcet/subversive - x86_64 linux rootkit using debug registers
  • therealdreg/lsrootkit - Rootkit Detector for UNIX
  • Arinerron/CVE-2022-0847-DirtyPipe-Exploit - A root exploit for CVE-2022-0847 (Dirty Pipe)
  • Bonfee/CVE-2022-25636 - CVE-2022-25636
  • bopin2020/WindowsCamp - Windows Kernel Knowledge && Collect Resources on the wire && Nothing innovation by myself &&
  • Lojii/Knot - 一款iOS端基于MITM(中间人攻击技术)实现的HTTPS抓包工具，完整的App，核心代码使用SwiftNIO实现
  • r4j0x00/exploits -
  • SentryPeer/SentryPeer - Protect your SIP Servers from bad actors at https://sentrypeer.org
  • b1n4r1b01/n-days -
  • linux-lock/bpflock - bpflock - eBPF driven security for locking and auditing Linux machines
  • Rvn0xsy/CVE-2021-4034 - CVE-2021-4034 Add Root User - Pkexec Local Privilege Escalation
  • 0verSp4ce/CVE-2021-4034 - CVE-2021-4034, For Webshell Version.
  • MichaelDim02/Narthex - Modular personalized dictionary generator.
  • FlamingSpork/iptable_evil - An evil bit backdoor for iptables
  • kyleavery/inject-assembly - Inject .NET assemblies into an existing process
  • spieglt/whatfiles - Log what files are accessed by any Linux process
  • berdav/CVE-2021-4034 - CVE-2021-4034 1day
  • arthepsy/CVE-2021-4034 - PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)
  • Ayrx/CVE-2021-4034 - Exploit for CVE-2021-4034
  • xbyl1234/android_analysis - a few android analysis tools, jni trace by native hook, libc hook, write log with caller's addr in file or AndroidLog
  • aaaddress1/Skrull - Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting te
  • thefLink/Hunt-Sleeping-Beacons - Aims to identify sleeping beacons
  • Rvn0xsy/linux_dirty - 更改后的脏牛提权代码，可以往任意文件写入任意内容，去除交互过程
  • revng/pagebuster - PageBuster - dump all executable pages of packed processes.
  • screetsec/TheFatRat - Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then
  • f0rb1dd3n/Reptile - LKM Linux rootkit
  • lcatro/qemu-fuzzer - Qemu Fuzzer.针对Qemu模拟设备的模糊测试工具,主要思路是Host生成种子Data,然后传递给Guest中转程序,由中转程序访问MMIO,以达到和模拟设备的交互,不同于qtest自带的fuzzer.
  • chriskaliX/Hades - Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)
  • n0b0dyCN/redis-rogue-server - Redis(<=5.0.5) RCE
  • wavestone-cdt/EDRSandblast -
  • OALabs/BlobRunner - Quickly debug shellcode extracted during malware analysis
  • SweetIceLolly/Huorong_Vulnerabilities - Huorong Internet Security vulnerabilities 火绒安全软件漏洞
  • scareing/cmd2shellcode - cmd2shellcode
  • securifybv/Visual-Studio-BOF-template - A Visual Studio template used to create Cobalt Strike BOFs
  • HexHive/USBFuzz - A Framework for fuzzing USB Drivers by Device Emulation
  • fortra/nanodump - The swiss army knife of LSASS dumping
  • 0671/RedisModules-ExecuteCommand-for-Windows - 可在Windows下执行系统命令的Redis模块，可用于Redis主从复制攻击。
  • Lakr233/Decrypter - An easy way to decrypt UIKit app.
  • idealeer/xmap - XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning.
  • wolfpython/nids - 基于网络的入侵检测系统
  • dismantl/ImprovedReflectiveDLLInjection - An improvement of the original reflective DLL injection technique by Stephen Fewer of Harmony Security
  • aircrack-ng/mdk4 - MDK4
  • boku7/injectEtwBypass - CobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)
  • codewhitesec/HandleKatz - PIC lsass dumper using cloned handles
  • gentilkiwi/kekeo - A little toolbox to play with Microsoft Kerberos in C
  • EspressoCake/PPLDump_BOF - A faithful transposition of the key features/functionality of @itm4n's PPLDump project as a BOF.
  • microsoft/omi - Open Management Infrastructure
  • seL4/seL4 - The seL4 microkernel
  • outflanknl/PrintNightmare -
  • cube0x0/SharpSystemTriggers - Collection of remote authentication triggers in C#
  • paranoidninja/PIC-Get-Privileges - Building and Executing Position Independent Shellcode from Object Files in Memory
  • SolomonSklash/SleepyCrypt - A shellcode function to encrypt a running process image when sleeping.
  • limithit/NginxExecute - The NginxExecute module executes the shell command through GET POST and HEAD to display the result.
  • boku7/azureOutlookC2 - Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Micro
  • cyberark/rdpfuzz - Tools for fuzzing RDP
  • mprovost/NFStash - NFS client CLI toolkit
  • aaaddress1/PR0CESS - some gadgets about windows process and ready to use :)
  • superflexible/TGPuttyLib - An SFTP client shared library (dll/so/dylib) with bindings and classes for C++, Delphi and Free Pascal based on PuTTY
  • ttdennis/fpicker - fpicker is a Frida-based fuzzing suite supporting various modes (including AFL++ in-process fuzzing)
  • mgeeky/ElusiveMice - Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind
  • boku7/whereami - Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.
  • frkngksl/Huan - Encrypted PE Loader Generator
  • Yubico/yubico-c - YubiKey C low-level library (libyubikey)
  • RUB-SysSec/Nyx - USENIX 2021 - Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types
  • glmcdona/Process-Dump - Windows tool for dumping malware PE files from memory back to disk for analysis.
  • alfarom256/BOF-ForeignLsass -
  • knightswd/ProcessGhosting -
  • NoOne-hub/Beacon.dll - Beacon.dll reverse
  • boku7/BokuLoader - A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!
  • aqi00/advanceapp - 《Android App开发进阶与项目实战》随书源码
  • horsicq/PDBRipper - PDBRipper is a utility for extract an information from PDB-files.
  • Gui774ume/ebpfkit - ebpfkit is a rootkit powered by eBPF
  • jrbrtsn/ban2fail - Simple & efficient log file scanning and iptable filtering
  • cdpxe/NELphase - Network Environment Learning (NEL) Phase for Covert Channels (with a Feedback Channel)
  • ZhangZhuoSJTU/StochFuzz - Sound and Cost-effective Fuzzing of Stripped Binaries by Incremental and Stochastic Rewriting
  • connormcgarr/cThreadHijack - Beacon Object File (BOF) for remote process injection via thread hijacking
  • boku7/injectAmsiBypass - Cobalt Strike BOF - Bypass AMSI in a remote process with code injection.
  • LloydLabs/process-enumeration-stealth -
  • hasherezade/process_ghosting - Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file
  • GJDuck/e9patch - A powerful static binary rewriting tool
  • djkaty/Il2CppInspector - Powerful automated tool for reverse engineering Unity IL2CPP binaries
  • merbanan/rtl_433 - Program to decode radio transmissions from devices on the ISM bands (and other frequencies)
  • killvxk/Beacon - Lightweight, header-only C++ IPC library for Windows operating systems (Vista+) using advanced local procedure calls
  • sliverarmory/COFFLoader -
  • joshfaust/Alaris - A protective and Low Level Shellcode Loader that defeats modern EDR systems.
  • OWASP/IoTGoat - IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.
  • ndilieto/uacme - ACMEv2 client written in plain C with minimal dependencies
  • client9/libinjection - SQL / SQLI tokenizer parser analyzer
  • alipay/ios-malicious-bithunter - iOS Malicious Bit Hunter is a malicious plug-in detection engine for iOS applications. It can analyze the head of the macho file of the injected dylib dynamic library based on runtime. If you are inte
  • xuanxuan0/TiEtwAgent - PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
  • antonioCoco/RemotePotato0 - Windows Privilege Escalation from User to Domain Admin.
  • greenbone/gvmd - Greenbone Vulnerability Manager - The database backend for the Greenbone Community Edition
  • topotam/PetitPotam - PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.
  • CCob/BOF.NET - A .NET Runtime for Cobalt Strike's Beacon Object Files
  • 0xricksanchez/dlink-decrypt - D-Link firmware decryption PoC
  • boku7/spawn - Cobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG),
  • xforcered/InlineExecute-Assembly - InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional f
  • inspiringz/CVE-2021-3493 - CVE-2021-3493 Ubuntu OverlayFS Local Privesc (Interactive Bash Shell & Execute Command Entered)
  • wbenny/injdrv - proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC
  • CCob/SylantStrike - Simple EDR implementation to demonstrate bypass
  • jattach/jattach - JVM Dynamic Attach utility
  • anthemtotheego/InlineExecute-Assembly - InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional f
  • praetorian-inc/PortBender - TCP Port Redirection Utility
  • hlldz/CVE-2021-1675-LPE - Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527
  • blackorbird/PrintNightmare -
  • iqiyi/qnsm - QNSM is network security monitoring framework based on DPDK.
  • Yaxser/Backstab - A tool to kill antimalware protected processes
  • CaledoniaProject/rdpscan - RDP password verification tool - No external libraries required ;-P
  • wonderkun/go-packer - golang打包二进制进行免杀
  • cgwalters/cve-2020-14386 -
  • alipay/Owfuzz - Owfuzz: a WiFi protocol fuzzing tool
  • passthehashbrowns/hook-integrity-checks -
  • kevmitch/win_battery_log - command line battery stats for MS Windows
  • passthehashbrowns/hiding-your-syscalls - Some source code to demonstrate avoiding certain direct syscall detections by locating and JMPing to a legitimate syscall instruction within NTDLL.
  • yarrick/iodine - Official git repo for iodine dns tunnel
  • airbus-cyber/afl_ghidra_emu -
  • ApsaraDB/PolarDB-for-PostgreSQL - A cloud-native database based on PostgreSQL developed by Alibaba Cloud.
  • season-lab/fuzzolic - fuzzing + concolic = fuzzolic :)
  • djhohnstein/macos_shell_memory - Execute MachO binaries in memory using CGo
  • ASkyeye/Zipper - Zipper, a CobaltStrike file and folder compression utility.
  • pbek/loganalyzer - LogAnalyzer is a tool that helps you to analyze your log files by reducing the content with patterns you define.
  • heiher/hev-socks5-core - A simple, lightweight socks5 library (IPv4/IPv6/TCP/UDP/Client/Server)
  • orangetw/tsh - Tiny SHell is an open-source UNIX backdoor.
  • waldo-irc/CVE-2021-21551 - Exploit to SYSTEM for CVE-2021-21551
  • Iansus/SilentLsassDump - VisualStudio port of https://github.com/guervild/BOFs/tree/dev/SilentLsassDump
  • abcz316/rwProcMem33 - Linux ARM64内核硬件进程内存读写驱动、硬件断点调试驱动。硬件级读写Linux进程内存、硬件级下断点。
  • falcosecurity/pdig - ptrace-based event producer for udig
  • svengong/xcubebase_riru - 基于magisk 和riru的frida持久化方案
  • Al1ex/WindowsElevation - Windows Elevation(持续更新)
  • Al1ex/LinuxEelvation - Linux Eelvation(持续更新)
  • boazsegev/iodine - iodine - HTTP / WebSockets Server for Ruby with Pub/Sub support
  • xforcered/CredBandit - Proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel
  • dgoulet/kjackal - Linux Rootkit Scanner
  • rsmudge/ZeroLogon-BOF -
  • git-for-windows/git-sdk-64 - A Git repository mirroring the current 64-bit Git for Windows SDK
  • csandker/inMemoryShellcode - A Collection of In-Memory Shellcode Execution Techniques for Windows
  • pattern-f/TQ-pre-jailbreak - Hello from pattern-f.
  • darvincisec/AntiDebugandMemoryDump - Anti-Debug and Anti-Memory Dump for Android
  • purerosefallen/ygopro - KoishiPro
  • decoder-it/juicy_2 - juicypotato for win10 > 1803 & win server 2019
  • 9bie/exe2shellcode - Remote Download and Memory Execute for shellcode framework
  • trustedsec/COFFLoader -
  • akopytov/sysbench - Scriptable database and system performance benchmark
  • mtrojnar/osslsigncode - OpenSSL based Authenticode signing for PE/MSI/Java CAB files
  • jmk-foofus/medusa - Medusa is a speedy, parallel, and modular, login brute-forcer.
  • rewardone/OSCPRepo - A list of commands, scripts, resources, and more that I have gathered and attempted to consolidate for use as OSCP (and more) study material. Commands in 'Usefulcommands' Keepnote. Bookmarks and readi
  • aaaddress1/sakeInject - Windows PE - TLS (Thread Local Storage) Injector in C/C++
  • Rvn0xsy/CVE-2021-3156-plus - CVE-2021-3156非交互式执行命令
  • blasty/CVE-2021-3156 -
  • Mr-Un1k0d3r/RedTeamCCode - Red Team C code repo
  • lockedbyte/CVE-Exploits - PoC exploits for software vulnerabilities
  • mai1zhi2/ShellCodeFramework - 绕3环的shellcode免杀框架
  • ea/bosch_headunit_root - Documentation and code for rooting and extending a Bosch car head unit (lcn2kai)
  • LloydLabs/Windows-API-Hashing - This is a simple example and explanation of obfuscating API resolution via hashing
  • LloydLabs/delete-self-poc - A way to delete a locked file, or current running executable, on disk.
  • zznop/drow - Injects code into ELF executables post-build
  • neil-wu/CatFrida - CatFrida is a macOS tool for inspecting a running iOS app.
  • ybdt/evasion-hub - 免杀对抗
  • jsherman212/xnuspy - an iOS kernel function hooking framework for checkra1n'able devices
  • rsmudge/unhook-bof - Remove API hooks from a Beacon process.
  • dacade/tools - some tools
  • lengjibo/FourEye - AV Evasion Tool For Red Team Ops
  • AFLplusplus/AFLplusplus - The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
  • ethereal-vx/Persistence - Recreating and reviewing the Windows persistence methods
  • anantshri/Android_Security - This repository is a suplimentary material for Android Training's done by Anant Shrivastava from 2012-2017
  • gtworek/PSBits - Simple (relatively) things allowing you to dig a bit deeper than usual.
  • ajpc500/BOFs - Collection of Beacon Object Files
  • tomcarver16/BOF-DLL-Inject - Manual Map DLL injection implemented with Cobalt Strike's Beacon Object Files.
  • gnxbr/Fully-Undetectable-Techniques -
  • chroblert/JC-AntiPtrace - 安卓绕过ptrace反调试
  • NixOS/patchelf - A small utility to modify the dynamic linker and RPATH of ELF executables
  • TannerJin/AntiMSHookFunction - AntiMSHookFunction (make MSHookFunction doesn't work)
  • ntop/n2n - Peer-to-peer VPN
  • gaffe23/linux-inject - Tool for injecting a shared object into a Linux process
  • code-scan/ssh-inject-auto-find-libdl -
  • geokb/yabar - A modern and lightweight status bar for X window managers.
  • cbwang505/CVE-2019-0708-EXP-Windows - CVE-2019-0708-EXP-Windows版单文件exe版,运行后直接在当前控制台反弹System权限Shell
  • strongcourage/uafuzz - UAFuzz: Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities
  • LloydLabs/wsb-detect - wsb-detect enables you to detect if you are running in Windows Sandbox ("WSB")
  • g0dA/linuxStack - Linux技术栈
  • 0voice/algorithm-structure - 2021年最新总结 500个常用数据结构，算法，算法导论，面试常用，大厂高级工程师整理总结
  • GeoSn0w/Blizzard-Jailbreak - An Open-Source iOS 11.0 -> 11.4.1 (soon iOS 13) Jailbreak, made for teaching purposes.
  • bytecode77/r77-rootkit - Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.
  • ventoy/Ventoy - A new bootable USB solution.
  • SkewwG/domainTools - 内网域渗透小工具
  • StarCross-Tech/heap_exploit_2.31 -
  • XiphosResearch/netelf - Run executables from memory, over the network, on Windows, Linux, OpenVMS... routers... spaceships... toasters etc.
  • andreafioraldi/weizz-fuzzer -
  • hackerschoice/gsocket - Connect like there is no firewall. Securely.
  • phra/PEzor - Open-Source Shellcode & PE Packer
  • TimelifeCzy/Shell_Protect - VM一键加壳/脱壳，全压缩，反调试等
  • ish-app/ish - Linux shell for iOS
  • inspektor-gadget/inspektor-gadget - Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF
  • gloxec/CrossC2 - generate CobaltStrike's cross-platform payload
  • timwhitez/Cobalt-Strike-Aggressor-Scripts - Cobalt Strike Aggressor 插件包
  • brendan-rius/c-jwt-cracker - JWT brute force cracker written in C
  • bg6cq/whoisscanme -
  • aircrack-ng/rtl8188eus - RealTek RTL8188eus WiFi driver with monitor mode & frame injection support
  • dtcooper/fakehostname - Run a command and fake your hostname.
  • yifengyou/learn-kvm - Qemu KVM(Kernel Virtual Machine)学习笔记
  • blendin/3snake - Tool for extracting information from newly spawned processes
  • 0vercl0k/sic - Enumerate user mode shared memory mappings on Windows.
  • CylanceVulnResearch/ReflectiveDLLRefresher - Universal Unhooking
  • DoctorWkt/acwj - A Compiler Writing Journey
  • limbenjamin/LogServiceCrash - POC code to crash Windows Event Logger Service
  • nil0x42/duplicut - Remove duplicates from MASSIVE wordlist, without sorting it (for dictionary-based password cracking)
  • blunderbuss-wctf/wacker - A WPA3 dictionary cracker
  • uf0o/CVE-2020-17382 - PoC exploits for CVE-2020-17382
  • libinjection/libinjection - SQL / SQLI tokenizer parser analyzer
  • blackarrowsec/redteam-research - Collection of PoC and offensive techniques used by the BlackArrow Red Team
  • chompie1337/s8_2019_2215_poc - PoC 2019-2215 exploit for S8/S8 active with DAC + SELinux + Knox/RKP bypass
  • DerekSelander/yacd - Decrypts FairPlay applications on iOS 13.4.1 and lower, no jb required
  • jvinet/knock - A port-knocking daemon
  • ThunderGunExpress/UAC-TokenDuplication -
  • Ascotbe/Kernelhub - 🌴Linux、macOS、Windows Kernel privilege escalation vulnerability collection, with compilation environment, demo GIF map, vulnerability details, executable file (提权漏洞合集)
  • fancycode/MemoryModule - Library to load a DLL from memory.
  • reactos/reactos - A free Windows-compatible Operating System
  • MobileForensicsResearch/mem - Tool used for dumping memory from Android devices
  • ARM-software/CSAL - Coresight Access Library
  • webview/webview_csharp - C# bindings for webview/webview - Batteries included
  • gabrielrcouto/awesome-php-ffi - PHP FFI examples and use cases
  • bhassani/EternalBlueC - EternalBlue suite remade in C/C++ which includes: MS17-010 Exploit, EternalBlue vulnerability detector, DoublePulsar detector and DoublePulsar Shellcode & DLL uploader
  • mdsecactivebreach/firewalker -
  • hzqst/VmwareHardenedLoader - Vmware Hardened VM detection mitigation loader (anti anti-vm)
  • aligrudi/neatcc - A small arm/x86(-64) C compiler
  • bkerler/opencl_brute - MD5,SHA1,SHA256,SHA512,HMAC,PBKDF2,SCrypt Bruteforcing tools using OpenCL (GPU, yay!) and Python
  • marsyy/littl_tools -
  • n0b0dyCN/RedisModules-ExecuteCommand - Tools, utilities and scripts to help you write redis modules!
  • vulhub/redis-rogue-getshell - redis 4.x/5.x master/slave getshell module
  • TheWover/donut - Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
  • google/sanitizers - AddressSanitizer, ThreadSanitizer, MemorySanitizer
  • AntSwordProject/ant_php_extension - PHP 扩展, 用于 PHP-FPM、FastCGI、LD_PRELOAD等模式下突破 disabled_functions
  • m57/cobaltstrike_bofs - My CobaltStrike BOFS
  • anthemtotheego/C_Shot -
  • sailay1996/UAC_Bypass_In_The_Wild - Windows 10 UAC bypass for all executable files which are autoelevate true .
  • a0rtega/pafish - Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do
  • github/securitylab - Resources related to GitHub Security Lab
  • qq4108863/hihttps - hihttps是一款完整源码的高性能web应用防火墙，既支持传统WAF的所有功能如SQL注入、XSS、恶意漏洞扫描、密码暴力破解、CC、DDOS等ModSecurity正则规则，又支持无监督机器学习，自主对抗未知攻击。
  • rvrsh3ll/BOF_Collection - Various Cobalt Strike BOFs
  • sailay1996/RpcSsImpersonator - Privilege Escalation Via RpcSs svc
  • libyal/liblnk - Library and tools to access the Windows Shortcut File (LNK) format
  • NtRaiseHardError/NINA - NINA: No Injection, No Allocation x64 Process Injection Technique
  • DanieleDeSensi/peafowl - High performance Deep Packet Inspection (DPI) framework to identify L7 protocols and extract and process data and metadata from network traffic.
  • elfmaster/libelfmaster - Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools
  • elfmaster/ftrace - POSIX Function tracing
  • elfmaster/dsym_obfuscate - Obfuscates dynamic symbol table
  • ntop/nDPI - Open Source Deep Packet Inspection Software Toolkit
  • redplait/armpatched - clone of armadillo patched for windows
  • dalvarezperez/CreateFile_based_rootkit -
  • mhaskar/Shellcode-In-Memory-Decoder - A simple C implementation to decoded your shellcode and writes it directly to memory
  • meme/hotwax - Coverage-guided binary fuzzing powered by Frida Stalker
  • avs333/Nougat_dlfunctions -
  • hack0z/byopen - 🎉A dlopen library that bypasses mobile system limitation
  • titansec/OpenWAF - Web security protection system based on openresty
  • ionescu007/faxhell - A Bind Shell Using the Fax Service and a DLL Hijack
  • ph4ntonn/Impost3r - 👻Impost3r -- A linux password thief
  • havocykp/Gh0st - 远控源码
  • yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD - bypass disable_functions via LD_PRELOA (no need /usr/sbin/sendmail)
  • gentilkiwi/mimikatz - A little tool to play with Windows security
  • itm4n/PrintSpoofer - Abusing impersonation privileges through the "Printer Bug"
  • sandboxie/sandboxie - The Sandboxie application
  • can1357/NtLua - Lua in kernel-mode because why not.
  • 1d8/MailJack -
  • thebabush/bline - Naver LINE VoIP reversing stuff
  • kingToolbox/WindTerm - A professional cross-platform SSH/Sftp/Shell/Telnet/Tmux/Serial terminal.
  • nccgroup/nccfsas - Information released publicly by NCC Group's Full Spectrum Attack Simulation (FSAS) team.
  • a1exdandy/checkm8-a5 - checkm8 port for S5L8940X/S5L8942X/S5L8945X
  • taviso/ctftool - Interactive CTF Exploration Tool
  • YutaroHayakawa/ipftrace2 - A packet oriented Linux kernel function call tracer
  • hasherezade/hollows_hunter - Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
  • rxwx/spoolsystem - Print Spooler Named Pipe Impersonation for Cobalt Strike
  • Katrovisch/KatroLogger - KeyLogger for Linux Systems
  • bats3c/shad0w - A post exploitation framework designed to operate covertly on heavily monitored environments
  • HyperDbg/HyperDbg - State-of-the-art native debugging tools
  • AltraMayor/gatekeeper - The first open-source DDoS protection system
  • V-E-O/PoC - PoC of CVE/Exploit
  • vanhauser-thc/thc-hydra - hydra
  • luke-goddard/enumy - Linux post exploitation privilege escalation enumeration
  • oleavr/ios-inject-custom - Example showing how to use Frida for standalone injection of a custom payload
  • Echocipher/AUTO-EARN - 一个利用OneForAll进行子域收集、Shodan API端口扫描、Xray漏洞Fuzz、Server酱的自动化漏洞扫描、即时通知提醒的漏洞挖掘辅助工具
  • zhuotong/Android_InlineHook - Android内联hook框架
  • juuso/keychaindump - A proof-of-concept tool for reading OS X keychain passwords
  • prbinu/tls-scan - An Internet scale, blazing fast SSL/TLS scanner ( non-blocking, event-driven )
  • a2o/snoopy - Snoopy Command Logger is a small library that logs all program executions on your Linux/BSD system.
  • gentilkiwi/kirandomtpm - Get random bytes from the TPM (tool + BCrypt RNG provider)
  • wonderkun/CTFENV - 为应对CTF比赛而搭建的各种环境
  • antonioCoco/RoguePotato - Another Windows Local Privilege Escalation from Service Account to System
  • yusufqk/SystemToken - Steal privileged token to obtain SYSTEM shell
  • uknowsec/getSystem - webshell下提权执行命令 Reference:https://github.com/yusufqk/SystemToken
  • NLnetLabs/ldns - LDNS is a DNS library that facilitates DNS tool programming
  • noptrix/lulzbuster - A very fast and smart web directory and file enumeration tool written in C.
  • danigargu/CVE-2020-0796 - CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost
  • twelvesec/passcat - Passwords Recovery Tool
  • chroblert/domainWeakPasswdCheck - 内网安全·域账号弱口令审计
  • chroblert/AssetManage -
  • paranoidninja/Shuriken - Offensive Android Kernel on Steroids - Shuriken is an Android kernel for Oneplus 5/5T which supports multiple features for pentesting.
  • newsoft/adduser - Programmatically create an administrative user under Windows
  • david378/ssocks - build static ssocks by cmake,cross build ssocks
  • V-E-O/rdp2tcp - rdp2tcp: open tcp tunnel through remote desktop connection.
  • redcanaryco/atomic-red-team - Small and highly portable detection tests based on MITRE's ATT&CK.
  • brainsmoke/ptrace-burrito - a friendly wrapper around ptrace
  • Mr-Un1k0d3r/SCShell - Fileless lateral movement tool that relies on ChangeServiceConfigA to run command
  • RITRedteam/Headshot - NGINX module to allow for RCE through a specific header
  • Genymobile/scrcpy - Display and control your Android device
  • bootleg/ret-sync - ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.
  • pymumu/smartdns - A local DNS server to obtain the fastest website IP for the best Internet experience, support DoT, DoH, DoQ. 一个本地DNS服务器，获取最快的网站IP，获得最佳上网体验，支持DoH，DoT, DoQ。
  • outflanknl/Dumpert - LSASS memory dumper using direct system calls and API unhooking.
  • jonathanmetzman/wasm-fuzzing-demo - Demos of and walkthroughs on in-browser fuzzing using WebAssembly
  • turing-technician/FastHook - Android ART Hook
  • 0x25bit/darkRat_HVNC - DarkRats Standalone HVNC
  • SwiftLaTeX/SwiftLaTeX - SwiftLaTeX, a WYSIWYG Browser-based LaTeX Editor
  • mohuihui/antispy - AntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks.With its
  • OWASP/igoat - OWASP iGoat - A Learning Tool for iOS App Pentesting and Security by Swaroop Yermalkar
  • OWASP/iGoat-Swift - OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS
  • hmgle/graftcp - A flexible tool for redirecting a given program's TCP traffic to SOCKS5 or HTTP proxy.
  • blechschmidt/massdns - A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
  • abelcheung/rifiuti2 - Windows Recycle Bin analyser
  • vmonaco/kloak - Keystroke-level online anonymization kernel: obfuscates typing behavior at the device level.
  • robertdavidgraham/rdpscan - A quick scanner for the CVE-2019-0708 "BlueKeep" vulnerability.
  • q3k/cve-2019-5736-poc - Unweaponized Proof of Concept for CVE-2019-5736 (Docker escape)
  • gurnec/HashCheck - HashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org
  • skeeto/endlessh - SSH tarpit that slowly sends an endless banner
  • Chion82/netfilter-full-cone-nat - A kernel module to turn MASQUERADE into full cone SNAT
  • hacksysteam/HackSysExtremeVulnerableDriver - HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux
  • y11en/BlockRDPBrute - [HIPS]RDP(3389)爆破防护
  • klsfct/getshell - 各大平台提权工具
  • Halbmond/Introduction-to-Computer-Systems - Course : Introduction to Computer Systems
  • swaywm/sway - i3-compatible Wayland compositor
  • ambrop72/badvpn - NCD scripting language, tun2socks proxifier, P2P VPN
  • firebroo/UnixTools - 一些处理数据的Unix小工具，支持管道操作。
  • meyerd/n2n - A development branch of the n2n p2p vpn software
  • ValdikSS/p0f-mtu - p0f with patches to save MTU value and export it via API (for VPN detection)
  • rosehgal/BinExp - Linux Binary Exploitation
  • sfan5/fi6s - IPv6 network scanner designed to be fast
  • silight-jp/MacType-Patch - MacType Patch for DirectWrite Hook
  • andreiw/RaspberryPiPkg - DEPRECATED - DO NOT USE | Go here instead ->
  • aarond10/https_dns_proxy - A lightweight DNS-over-HTTPS proxy.
  • telekom-security/tpotce - 🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
  • lihaoyun6/axeldown-core - 基于axel-webm的优化项目. 通过webui调用axel进行下载
  • suvllian/process-inject - 在Windows环境下的进程注入方法：远程线程注入、创建进程挂起注入、反射注入、APCInject、SetWindowHookEX注入
  • sumatrapdfreader/sumatrapdf - SumatraPDF reader
  • zogvm/zogvm - zogna video manager
  • henkman/virgo - ♍💻💻💻💻 Virtual desktops for Windows
  • netdata/netdata - X-Ray Vision for your infrastructure!
  • RPISEC/MBE - Course materials for Modern Binary Exploitation by RPISEC
  • saaramar/execve_exploit - Hardcore corruption of my execve() vulnerability in WSL
  • Nat-Lab/eoip - EoIP/EoIPv6 for *nix.
  • tcp-nanqinlang/general - general mode via module loading
  • 3proxy/3proxy - 3proxy - tiny free proxy server
  • coolstar/electra - Electra iOS 11.0 - 11.1.2 jailbreak toolkit based on async_awake
  • dyne/dnscrypt-proxy - DNSCrypt-Proxy repository, frankly maintained for what it does (no new features planned)
  • agile6v/awesome-nginx - A curated list of awesome Nginx distributions, 3rd party modules, Active developers, etc. :octocat:
  • Chuyu-Team/MINT - Contains the definitions for the Windows Internal UserMode API from ntdll.dll, samlib.dll and winsta.dll.
  • guanchao/AppProtect - 整理一些app常见的加固方法，包括java层、native层和资源文件加固等
  • firmianay/CTF-All-In-One - CTF竞赛权威指南
  • Wind4/vlmcsd - KMS Emulator in C (currently runs on Linux including Android, FreeBSD, Solaris, Minix, Mac OS, iOS, Windows with or without Cygwin)
  • mpv-player/mpv - 🎥 Command line media player
  • gsliepen/tinc - a VPN daemon
  • hardenedlinux/linux-exploit-development-tutorial - a series tutorial for linux exploit development to newbie.
  • NoahhhRyan/krackattacks-test -
  • hfiref0x/UACME - Defeating Windows User Account Control
  • tinyproxy/tinyproxy - tinyproxy - a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems
  • mitchellkrogza/apache-ultimate-bad-bot-blocker - Apache Block Bad Bots, (Referer) Spam Referrer Blocker, Vulnerability Scanners, Malware, Adware, Ransomware, Malicious Sites, Wordpress Theme Detectors and Fail2Ban Jail for Repeat Offenders
  • vanhoefm/krackattacks-scripts -
  • droberson/icmp-backdoor - Backdoor that listens for specially crafted ICMP packets and spawns reverse shells.
  • giltu/KernelPCC - PCC is a new approach for TCP congestion control base on real-time performance analysis. This is a kernel implementation of it.
  • madeye/tcp_china - TCP China congestion control algorithm
  • gatieme/AderXCoding - 介绍各类语言，库，系统编程以及算法的学习
  • session-replay-tools/tcpcopy - An online request replication and TCP stream replay tool, ideal for real testing, performance testing, stability testing, stress testing, load testing, smoke testing, and more.
  • sudeshnapal12/Web-Application-Firewall - Designed and Implemented a Web Application Firewall as an Apache module that "sits" in-front of a web server. The WAF is designed to stop malicious requests from known attacks such as SQL Injection, X
  • 50m30n3/dsptunnel - IP over audio tunnel
  • Ridter/Pentest - tools
  • dosgo/ngrok-c - ngrok client for c language,Due to the use of GO ngrok language development, porting to embedded devices some inconvenience, such as openwrt, so use C language rewrite a client. Very mini, the need to
  • dlundquist/sniproxy - Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session.
  • haiwen/seafile - High performance file syncing and sharing, with also Markdown WYSIWYG editing, Wiki, file label and other knowledge management features.
  • WireGuard/wireguard-monolithic-historical - Historical monolithic WireGuard repository, split into wireguard-tools, wireguard-linux, and wireguard-linux-compat.
  • git-hulk/tcpkit - the tcpkit was designed to make network packets programable with Lua script
  • snooda/net-speeder - net-speeder 在高延迟不稳定链路上优化单线程下载速度
  • rip1s/vmware_escape - VMware Escape Exploit before VMware WorkStation 12.5.5
  • axel-download-accelerator/axel - Lightweight CLI download accelerator
  • skywind3000/kcp - ⚡ KCP - A Fast and Reliable ARQ Protocol
  • osqzss/gps-sdr-sim - Software-Defined GPS Signal Simulator
  • magkopian/keepassxc-debian - Debian source package for the KeePassXC password manager.
  • ScottyBauer/Android_Kernel_CVE_POCs - A list of my CVE's with POCs
  • axi0mX/ios-kexec-utils - boot LLB/iBoot/iBSS/iBEC image from a jailbroken iOS kernel
  • santoru/filewatcher - A simple auditing utility for macOS
  • Cn33liz/HSEVD-ArbitraryOverwrite - HackSys Extreme Vulnerable Driver - ArbitraryOverwrite Exploit
  • c0d3z3r0/sudo-CVE-2017-1000367 -
  • Chion82/kcptun-raw - Kcptun with raw socket and fake TCP headers.
  • klsecservices/Invoke-Vnc - Powershell VNC injector
  • DhavalKapil/icmptunnel - Transparently tunnel your IP traffic through ICMP echo and reply packets.
  • shudo/shujit - Java Just-in-Time Compiler for x86 processors
  • opsxcq/exploit-CVE-2017-7494 - SambaCry exploit and vulnerable container (CVE-2017-7494)
  • raminfp/linux-4.8.0-netfilter_icmp - Anatomy of a linux kernel development
  • DhavalKapil/heap-exploitation - This book on heap exploitation is a guide to understanding the internals of glibc's heap and various attacks possible on the heap structure.
  • ANSSI-FR/AD-control-paths - Active Directory Control Paths auditing and graphing tools
  • ValdikSS/GoodbyeDPI - GoodbyeDPI — Deep Packet Inspection circumvention utility (for Windows)
  • ufrisk/pcileech - Direct Memory Access (DMA) Attack Software
  • Cybellum/DoubleAgent - Zero-Day Code Injection and Persistence Technique
  • gentilkiwi/wanakiwi - Automated wanadecrypt with key recovery if lucky
  • jtesta/ssh-mitm - SSH man-in-the-middle tool
  • SecWiki/linux-kernel-exploits - linux-kernel-exploits Linux平台提权漏洞集合
  • adafruit/Adafruit-GPIO-Halt - Press-to-halt program for headless Raspberry Pi. Similar functionality to the rpi_power_switch kernel module from the fbtft project, but easier to compile (no kernel headers needed).
  • greensea/mptunnel - MPUDP Tunnel (User space MultiPath UDP)
  • Keysight/Rhme-2016 - Rhme2 challenge (2016)
  • leechristensen/UnmanagedPowerShell - Executes PowerShell from an unmanaged process
  • peperunas/injectopi - A set of tutorials about code injection for Windows.
  • hasherezade/demos - Demos of various injection techniques found in malware
  • google/honggfuzz - Security oriented software fuzzer. Supports evolutionary, feedback-driven fuzzing based on code coverage (SW and HW based)
  • mubix/post-exploitation - Post Exploitation Collection
  • hxp2k6/smart7ec-scan-console - 基于Linux c开发的插件式扫描器(Python/lua)
  • SpacehuhnTech/esp8266_deauther - Affordable WiFi hacking platform for testing and learning
  • hlldz/Phant0m - Windows Event Log Killer
  • s0lst1c3/eaphammer - Targeted evil twin attacks against WPA2-Enterprise networks. Indirect wireless pivots using hostile portal attacks.
  • LukaSikic/Unix-Privilege-Escalation-Exploits-Pack - Exploits for getting local root on Linux, BSD, AIX, HP-UX, Solaris, RHEL, SUSE etc.
  • kala13x/scap - Network Sniffer (Scan and Capture Incoming Packets)
  • nmap/ncrack - Ncrack network authentication tool
  • SecWiki/windows-kernel-exploits - windows-kernel-exploits Windows平台提权漏洞集合
  • ele7enxxh/Android-Inline-Hook - thumb16 thumb32 arm32 inlineHook in Android
  • laginimaineb/cve-2015-6639 - QSEE Privilege Escalation Exploit using PRDiag* commands (CVE-2015-6639)
  • deamwork/inetutils - the copy of https://git.savannah.gnu.org/cgit/inetutils.git/ with knali support
  • traviscross/mtr - Official repository for mtr, a network diagnostic tool
  • kmyk/libproofofwork - Simple hash-mining c library and its python binding.
  • boywhp/wifi_crack_windows - wifi crack project for windows
  • zcgonvh/NTDSDumpEx - NTDS.dit offline dumper with non-elevated
  • derrekr/android_security - Public Android Vulnerability Information (CVE PoCs etc)
  • googleprojectzero/winafl - A fork of AFL for fuzzing Windows binaries
  • F-Stack/f-stack - F-Stack is an user space network development kit with high performance based on DPDK, FreeBSD TCP/IP stack and coroutine API.
  • mrschyte/pentestkoala - Modified dropbear server which acts as a client and allows authless login
  • openwall/john - John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
  • netblue30/firejail - Linux namespaces and seccomp-bpf sandbox
  • Azard/SE315-OperatingSystem - SJTU-SE315 Operating System labs from MIT 6.828, by a SE12er.
  • gamelinux/passivedns - A network sniffer that logs all DNS server replies for use in a passive DNS setup
  • spacehuhn/wifi_ducky - Upload, save and run keystroke injection payloads with an ESP8266 + ATMEGA32U4
  • danieljiang0415/android_kernel_crash_poc -
  • robertfisk/USG - The USG is Good, not Bad
  • ossec/ossec-hids - OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.
  • iovisor/bcc - BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
  • huntergregal/mimipenguin - A tool to dump the login password from the current linux user
  • SamyPesse/How-to-Make-a-Computer-Operating-System - How to Make a Computer Operating System in C++
  • nonstriater/Learn-Algorithms - 算法学习笔记
  • wg/wrk - Modern HTTP benchmarking tool
  • Ridter/MSSQL_CLR - MSSQL CLR for pentest.
  • la00gke/DomainAuto-one - Domain penetration automation module one, domain information collection.
  • 0xb11a1/yetAnotherObfuscator - C# obfuscator that bypass windows defender
  • BeichenDream/GodPotato -
  • WesleyWong420/RedTeamOps-Havoc-101 - Materials for the workshop "Red Team Ops: Havoc 101"
  • darktohka/FlashPatch - FlashPatch! Play Adobe Flash Player games in the browser after January 12th, 2021.
  • daem0nc0re/TangledWinExec - PoCs and tools for investigation of Windows process execution techniques
  • sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY - Exploit for the CVE-2023-23397
  • Sq00ky/csharp-portscanner - simple C# portscanner - written for playing around with Metasploit's Execute-Assembly
  • zcgonvh/DCOMPotato - Some Service DCOM Object and SeImpersonatePrivilege abuse.
  • zR00t1/WannaCry - 基于C#编写的WannaCry模拟病毒，通常应用于网络安全应急演练
  • lele8/SharpUserIP - 获取服务器或域控登录日志
  • mandiant/ADFSDump -
  • rasta-mouse/SharpC2 - Command and Control Framework written in C#
  • bugch3ck/SharpEfsPotato - Local privilege escalation from SeImpersonatePrivilege using EfsRpc.
  • RikunjSindhwad/MSSQL-Attacker - MSSQL Database Attacker tool
  • F3eev/SharkExec - 内网渗透|红队工具|C#内存加载|cobaltstrike
  • BornToBeRoot/NETworkManager - A powerful tool for managing networks and troubleshoot network problems!
  • netwrix/PingCastleCloud - Audit program for AzureAD
  • BeichenDream/SharpToken - Windows Token Stealing Expert
  • casbin-net/redis-adapter - Redis adapter for Casbin.NET
  • pwn1sher/frostbyte - FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads
  • CervantesSec/cervantes - Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients
  • xpn/AppProxyC2 -
  • improsec/SharpEventPersist - Persistence by writing/reading shellcode from Event Log
  • EricZimmerman/evtx - C# based evtx parser with lots of extras
  • Ryze-T/CNVD-2022-10270-LPE - 基于向日葵RCE的本地权限提升，无需指定端口
  • Hagrid29/DuplicateDump - Dumping LSASS with a duplicated handle from custom LSA plugin
  • fox-it/LDAPFragger -
  • nettitude/SharpWSUS -
  • SpecterOps/SharpHoundCommon - Common library used by SharpHound.
  • nettitude/MalSCCM -
  • Viralmaniar/DDWPasteRecon - DDWPasteRecon tool will help you identify code leak, sensitive files, plaintext passwords, password hashes. It also allow member of SOC & Blue Team to gain situational awareness of the organisation's
  • Dec0ne/KrbRelayUp - KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).
  • whitesquirrell/C0deVari4nt - A variant analysis and visualisation tool that scans codebases for similar vulnerabilities
  • arsium/EagleMonitorRAT - Remote Access Tool Written In C#
  • onSec-fr/Http-Asynchronous-Reverse-Shell - [POC] Asynchronous reverse shell using the HTTP protocol.
  • yck1509/ConfuserEx - An open-source, free protector for .NET applications
  • daem0nc0re/AtomicSyscall - Tools and PoCs for Windows syscall investigation.
  • scotty-kdw/ARM-Analyzer - Backward Taint Analysis (GUI) on Desktop : Analyzing trace log to determine exploitability by tracking data propagation
  • RowTeam/SharpDecryptPwd - SharpDecryptPwd source, To Decrypt Navicat,Xmanager,Filezilla,Foxmail,WinSCP,etc
  • Gr1mmie/AtlasC2 - C# C2 Framework centered around Stage 1 operations
  • wwh1004/ExtremeDumper - .NET Assembly Dumper
  • netero1010/ScheduleRunner - A C# tool with more flexibility to customize scheduled task for both persistence and lateral movement in red team operation
  • Group3r/Group3r - Find vulnerabilities in AD Group Policy, but do it better than Grouper2 did.
  • JDArmy/SharpXDecrypt - Xshell全版本密码恢复工具
  • cube0x0/KrbRelay - Framework for Kerberos relaying
  • 0xthirteen/SharpStay - .NET project for installing Persistence
  • skahwah/SQLRecon - A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.
  • tothi/SharpStay - .NET project for installing Persistence
  • dqcostin/SharpGetinfo - 关于工作组和域信息收集的工具
  • Flangvik/CobaltBus - Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus
  • ly4k/SpoolFool - Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)
  • py7hagoras/GetSystem - This is a C# implementation of making a process/executable run as NT AUTHORITY/SYSTEM. This is achieved through parent ID spoofing of almost any SYSTEM process.
  • mrd0x/EvilSelenium - EvilSelenium is a tool that weaponizes Selenium to attack Chromium based browsers.
  • jfmaes/AmsiHooker - Hookers are cooler than patches.
  • VbScrub/Rubeus-GUI - GUI alternative to the Rubeus command line tool, for all your Kerberos exploit requirements
  • pengw0048/WechatExport-iOS - Save iOS WeChat history as HTML or TXT with neat layout and picture & audio support.
  • snovvcrash/MirrorDump - Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory
  • mandiant/SharPersist -
  • An0nySec/UserAdd - Bypass AV 用户添加
  • daem0nc0re/PrivFu - Kernel mode WinDbg extension and PoCs for token privilege investigation.
  • pwn1sher/WMEye - WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for lateral movement
  • bohops/RogueAssemblyHunter - Rogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
  • VollRagm/KernelBypassSharp - C# Kernel Mode Driver to read and write memory in protected processes
  • punk-security/smbeagle - SMBeagle - Fileshare auditing tool.
  • evi1ox/sharpNetstat -
  • Jumbo-WJB/SharpAllowedToAct-Modify - resource-based constrained delegation RBCD
  • Ridter/SharpAddDomainMachine - SharpAddDomainMachine
  • cube0x0/noPac - CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.
  • matterpreter/FindETWProviderImage - Quickly search for references to a GUID in DLLs, EXEs, and drivers
  • A-D-Team/SharpMemshell - Memshell
  • daem0nc0re/SharpWnfSuite - C# Utilities for Windows Notification Facility
  • FDlucifer/Proxy-Attackchain - Proxylogon & Proxyshell & Proxyoracle & Proxytoken & All exchange server history vulns summarization :)
  • hackthedev/teardrop - Open-Source Ransomware Project for learning purpose only written in C# (csharp). Dont use it for bad things.
  • Jhangju/bypass-sandbox-antivirus-detection-using-human-interaction-technique-by-cheking-mouse-movement - This project actually checks for the mouse movement if reach to 100 pixel it will start cmd and open cmd.exe and chrome.exe. Just to give idea that some sandbox does not use mouse movements.
  • DamonMohammadbagher/NativePayload_ReverseShell - This is Simple C# Source code to Bypass almost "all" AVS, (kaspersky v19, Eset v12 v13 ,Trend-Micro v16, Comodo & Windows Defender Bypassed via this method Very Simple)
  • Kara-4search/MappingInjection_CSharp - MappingInjection via csharp
  • tedyyu/ProcDumpEx - ProcDumpEx = ProcDump in batch mode
  • rasta-mouse/ExternalC2.NET - .NET implementation of Cobalt Strike's External C2 Spec
  • ldqk/Masuit.Tools - 全龄段友好的C#万能工具库，码数吐司库，包含一些常用的操作类，大都是静态类，加密解密，反射操作，权重随机筛选算法，分布式短id，表达式树，linq扩展，文件压缩，多线程下载，硬件信息，字符串扩展方法，日期时间扩展操作，中国农历，大文件拷贝，图像裁剪，验证码，断点续传，集合扩展、Excel导出等常用封装。诸多功能集一身，代码量不到2MB！
  • ryhanson/ExternalC2 - A library for integrating communication channels with the Cobalt Strike External C2 server
  • chr0n1k/AH2021Workshop - Malware development for red teaming workshop
  • CanIPhish/Phishious - An open-source Secure Email Gateway (SEG) evaluation toolkit designed for red-teamers.
  • knight0x07/ImpulsiveDLLHijack - C# based tool which automates the process of discovering and exploiting DLL Hijacks in target binaries. The Hijacked paths discovered can later be weaponized during Red Team Operations to evade EDR's.
  • iomoath/PowerShx - Run Powershell without software restrictions.
  • leechristensen/SpoolSample - PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.
  • plackyhacker/Shellcode-Injection-Techniques - A collection of C# shellcode injection techniques. All techniques use an AES encrypted meterpreter payload. I will be building this project up as I learn, discover or develop more techniques. Some tec
  • p0dalirius/LDAPmonitor - Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!
  • plackyhacker/Suspended-Thread-Injection - Another meterpreter injection technique using C# that attempts to bypass Defender
  • 0x727/SchTask_0x727 - 创建隐藏计划任务，权限维持，Bypass AV
  • 7hr0wer/ProxyValidator - 用C#开发的简单的多线程代理验证工具。
  • tevora-threat/SharpView - C# implementation of harmj0y's PowerView
  • pornin/paradox-compress - Paper and Demo Implementation of Paradoxical Compression with VDF
  • StarZHF/Foxmail-Password-Recovery -
  • zacateras/sddl-parser - Security Descriptor Definition Language (SDDL) Parser
  • pentest-tools-public/Pass-to-hash-EWS -
  • GhostPack/SharpDPAPI - SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.
  • lassehauballe/Eternalblue - Eternalblue written in CSharp. Contains version detection, vulnerability scanner and exploit of MS17-010
  • ChoiSG/SharpJfmaesWorkshop - things I learned from @jfmaes's .NET reflection workshop - thank you for the great workshop
  • RiccardoAncarani/LiquidSnake - LiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript
  • waf/CSharpRepl - A command line C# REPL with syntax highlighting – explore the language, libraries and nuget packages interactively.
  • eladshamir/Whisker - Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.
  • evilashz/SharpADUserIP - 提取DC日志，快速获取域用户对应IP地址
  • iomoath/SharpSpray - Active Directory password spraying tool. Auto fetches user list and avoids potential lockouts.
  • GhostPack/RestrictedAdmin - Remotely enables Restricted Admin Mode
  • X-C3LL/xlsxPoison - Just a PoC to turn xlsx (regular Excel files) into xlsm (Excel file with macro) and slipping inside a macro (vbaProject.bin)
  • fozavci/WeaponisingCSharp-Fundamentals - Weaponising C# - Fundamentals Training Content
  • bitsadmin/fakelogonscreen - Fake Windows logon screen to steal passwords
  • YDHCUI/csload.net - 一个cobaltstrike shellcode加载器，过国内主流杀软
  • EncodeGroup/UAC-SilentClean - New UAC bypass for Silent Cleanup for CobaltStrike
  • deadjakk/Reg1c1de - Registry permission scanner written in C# for finding potential privesc avenues within registry
  • mai1zhi2/SharpBeacon - CobaltStrike Beacon written in .Net 4 用.net重写了stager及Beacon，其中包括正常上线、文件管理、进程管理、令牌管理、结合SysCall进行注入、原生端口转发、关ETW等一系列功能
  • mobdk/Upsilon - Upsilon execute shellcode with syscalls - no API like NtProtectVirtualMemory is used
  • RedSiege/EDD - Enumerate Domain Data
  • chvancooten/OSEP-Code-Snippets - A repository with my notable code snippets for Offensive Security's PEN-300 (OSEP) course.
  • w1u0u1/smb2os - Use smb2 protocol to detect remote computer os version, support win7/server2008-win10/server2019
  • iomoath/SharpStrike - A Post exploitation tool written in C# uses either CIM or WMI to query remote systems.
  • gellin/bantam - A PHP backdoor management and generation tool/C2 featuring end to end encrypted payload streaming designed to bypass WAF, IDS, SIEM systems.
  • cube0x0/MiniDump - C# Lsass parser
  • uknowsec/SharpCryptPermute - Crypt/Decrypt Proxyshell Payload
  • PwnDexter/SharpEDRChecker - Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, install
  • nettitude/SharpSocks - Tunnellable HTTP/HTTPS socks4a proxy written in C# and deployable via PowerShell
  • med0x2e/SigFlip - SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.
  • CCob/BeaconEye - Hunts out CobaltStrike beacons and logs operator command output
  • GhostPack/ForgeCert - "Golden" certificates
  • GhostPack/Certify - Active Directory certificate abuse.
  • Flangvik/DeployPrinterNightmare - C# tool for installing a shared network printer abusing the PrinterNightmare bug to allow other network machines easy privesc!
  • GhostPack/SharpWMI - SharpWMI is a C# implementation of various WMI functionality.
  • Flangvik/ADCSPwn - A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.
  • bats3c/ADCSPwn - A tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service.
  • med0x2e/GadgetToJScript - A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.
  • zcgonvh/EfsPotato - Exploit for EfsPotato(MS-EFSR EfsRpcOpenFileRaw with SeImpersonatePrivilege local privalege escalation vulnerability).
  • tuian/subTee-gits-backups - subTee gists code backups
  • Inf0secRabbit/BadAssMacros - BadAssMacros - C# based automated Malicous Macro Generator.
  • GhostPack/Rubeus - Trying to tame the three-headed dog.
  • RedSiege/CIMplant - C# port of WMImplant which uses either CIM or WMI to query remote systems
  • aniqfakhrul/Sharperner - Simple executable generator with encrypted shellcode.
  • qwqdanchun/DcRat - A simple remote tool in C#.
  • dotnet/roslyn - The Roslyn .NET compiler provides C# and Visual Basic languages with rich code analysis APIs.
  • connormcgarr/LittleCorporal - LittleCorporal: A C# Automated Maldoc Generator
  • OG-Sadpanda/SharpSword - Read the contents of MS Word Documents using Cobalt Strike's Execute-Assembly
  • klezVirus/CheeseTools - Self-developed tools for Lateral Movement/Code Execution
  • OG-Sadpanda/SharpExcelibur - Read Excel Spreadsheets (XLS/XLSX) using Cobalt Strike's Execute-Assembly
  • AnErrupTion/LoGiC.NET - A free and open-source .NET obfuscator using dnlib.
  • Mr-Un1k0d3r/ADHuntTool - official repo for the AdHuntTool (part of the old RedTeamCSharpScripts repo)
  • MythicAgents/Apollo - A .NET Framework 4.0 Windows Agent
  • Yaxser/SharpPhish - Using outlook COM objects to create convincing phishing emails without the user noticing. This project is meant for internal phishing.
  • Kara-4search/DInvoke_shellcodeload_CSharp - ShellCodeLoader via DInvoke
  • Flangvik/SharpProxyLogon - C# POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode injection
  • dahall/Vanara - A set of .NET libraries for Windows implementing PInvoke calls to many native Windows APIs with supporting wrappers.
  • LimerBoy/FireFox-Thief - 🦊 Decrypt gecko based browsers passwords, cookies, history, bookmarks.
  • gourk/FirePwd.Net - Password reader for Mozilla Firefox and Thunderbird
  • BinaryScary/NET-Obfuscate - Obfuscate ECMA CIL (.NET IL) assemblies to evade Windows Defender AMSI
  • sourceincite/CVE-2021-24085 -
  • cube0x0/CVE-2021-1675 - C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
  • DamonMohammadbagher/FSWatch - File System Watcher via C# (Monitoring File Activity , Create/Delete/Change/Rename events + some Activity like Size/Attribute/Security Changes & LastAccess, LastWrite etc...)
  • nettitude/RunPE - C# Reflective loader for unmanaged binaries.
  • GhostPack/SharpDump - SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
  • IlanKalendarov/SharpHook - SharpHook is an offensive API hooking tool designed to catch various credentials within the API call.
  • improsec/ImproHound - Identify the attack paths in BloodHound breaking your AD tiering
  • GetRektBoy724/SharpUnhooker - C# Based Universal API Unhooker
  • rasta-mouse/AsyncSockets - Example of async client/server sockets in .NET 5
  • d3adzo/shepard - In progress persistent download/upload/execution tool using Windows BITS.
  • enkomio/ManagedInjector - A C# DLL injection library
  • lithnet/ad-password-protection - Active Directory password filter featuring breached password checking and custom complexity rules
  • dionach/NtdsAudit - An Active Directory audit utility
  • AaronRobinsonMSFT/COMInterop - Example on how to consume a COM server from a .NET client and a .NET server from a COM client. Examples are for both using the Registry and for RegFree.
  • AdamWhiteHat/Judge-Jury-and-Executable - A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power
  • S3cur3Th1sSh1t/SyscallAmsiScanBufferBypass - AmsiScanBufferBypass using D/Invoke
  • mitchmoser/SharpShares - Multithreaded C# .NET Assembly to enumerate accessible network shares in a domain
  • Dliv3/DomainBorrowing - Domain Borrowing PoC
  • Cerbersec/DomainBorrowingC2 -
  • marius-rothenbuecher/PentestBro - Experimental tool for Windows. PentestBro combines subdomain scans, whois, port scanning, banner grabbing and web enumeration into one tool. Uses subdomain list of SecLists. Uses nmap service probes f
  • jfmaes/SharpNukeEventLog - nuke that event log using some epic dinvoke fu
  • RowTeam/SharpNTLMSSPExtract - 利用 NTLMSSP 探测 Windows 信息
  • xpnas/inotify - 一个简易消息通知系统，支持企业微信、电报机器人、邮件推送、内置BARK推送、钉钉群机器人、飞书群机器人，类似Server酱，支持私有Docker部署
  • cyberark/Evasor - A tool to be used in post exploitation phase for blue and red teams to bypass APPLICATIONCONTROL policies
  • S3cur3Th1sSh1t/SharpNamedPipePTH - Pass the Hash to a named pipe for token Impersonation
  • Ben0xA/DoUCMe -
  • juliourena/SharpNoPSExec - Get file less command execution for lateral movement.
  • TheWover/CertStealer - A .NET tool for exporting and importing certificates without touching disk.
  • Hzllaga/JsLoader - js免杀shellcode，绕过杀毒添加自启
  • mgeeky/SharpWebServer - Red Team oriented C# Simple HTTP & WebDAV Server with Net-NTLM hashes capture functionality
  • uknowsec/SharpOSS - Quickly upload files to aliyun OSS by aliyun-oss-csharp-sdk
  • checkymander/Sharp-SMBExec - SMBExec C# module
  • DebugST/STPortScanner - [端口扫描器] 采用.NET开发的端口扫描器 支持端口协议探测 内置多种类型扫描器 TCP/UDP/SYN/SMB/ICMP 等 采用IOCP模型开发 性能表现不错 可视为轻量级NMAP
  • dahall/TaskScheduler - Provides a .NET wrapper for the Windows Task Scheduler. It aggregates the multiple versions, provides an editor and allows for localization.
  • FSecureLABS/SharpGPOAbuse - SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by th
  • S3cur3Th1sSh1t/Sharp-HackBrowserData - C# binary with embeded golang hack-browser-data
  • w1u0u1/exec - Use current thread token to execute command
  • Hzllaga/RDODecrypt - Remote Desktop Organizer 密码破解
  • ChoiSG/UuidShellcodeExec - PoC for UUID shellcode execution using DInvoke
  • airzero24/WMIReg - PoC to interact with local/remote registry hives through WMI
  • proxysu/ProxySU - Xray,V2ray，Trojan，NaiveProxy, Trojan-Go, ShadowsocksR(SSR),Shadowsocks-libev及相关插件,MTProto+TLS 一键安装工具，windows下用（一键科学上网）
  • WithSecureLabs/physmem2profit - Physmem2profit can be used to create a minidump of a target hosts' LSASS process by analysing physical memory remotely
  • odedshimon/BruteShark - Network Analysis Tool
  • calebstewart/bypass-clm - PowerShell Constrained Language Mode Bypass
  • hausec/MaliciousClickOnceMSBuild - Basic C# Project that will take an MSBuild payload and run it with MSBuild via ClickOnce.
  • Aetsu/OffensivePipeline - OfensivePipeline allows you to download and build C# tools, applying certain modifications in order to improve their evasion for Red Team exercises.
  • mdsecactivebreach/Farmer -
  • KINGSABRI/DotNetToJScriptMini - A simplified version of DotNetToJScript to create a JScript file which loads a .NET v2 assembly from memory.
  • Kevin-Robertson/Sharpmad - C# version of Powermad
  • swisskyrepo/SharpLAPS - Retrieve LAPS password from LDAP
  • Flangvik/AzureC2Relay - AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile.
  • FuzzySecurity/Dendrobate - Managed code hooking template.
  • soufianetahiri/HttpRquestPlayer - This small utility could help you to find authorization bugs.
  • rvrsh3ll/SharpSMBSpray - Spray a hash via smb to check for local administrator access
  • BeichenDream/WhetherMysqlSham - 检测目标Mysql数据库是不是蜜罐
  • An0nySec/ShadowUser - 影子用户 克隆
  • bats3c/EvtMute - Apply a filter to the events being reported by windows event logging
  • JoniRinta-Kahila/WPCracker - WordPress pentest tool
  • zcgonvh/CVE-2020-0688 - Exploit and detect tools for CVE-2020-0688
  • JamesCooteUK/SharpSphere - .NET Project for Attacking vCenter
  • py7hagoras/CovenantTasks - Source for tasks I have used with Covenant
  • RCStep/CSSG - Cobalt Strike Shellcode Generator
  • srini0x00/dvta - Damn Vulnerable Thick Client App developed in C# .NET
  • uknowsec/SharpSQLTools - SharpSQLTools 和@Rcoil一起写的小工具，可上传下载文件，xp_cmdshell与sp_oacreate执行命令回显和clr加载程序集执行相应操作。
  • Viralmaniar/BigBountyRecon - BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.
  • b4rtik/SharpKatz - Porting of mimikatz sekurlsa::logonpasswords, sekurlsa::ekeys and lsadump::dcsync commands
  • jnqpblc/SharpTask - SharpTask is a simple code set to interact with the Task Scheduler service api and is compatible with Cobalt Strike.
  • ReverendThing/Carnivore - Microsoft External Attack Tool
  • FatRodzianko/Get-RBCD-Threaded - Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory environments
  • FatRodzianko/SharpBypassUAC - C# tool for UAC bypasses
  • GoSecure/WSuspicious - WSuspicious - A tool to abuse insecure WSUS connections for privilege escalations
  • bitsadmin/nopowershell - PowerShell rebuilt in C# for Red Teaming purposes
  • 05sec/Asteroid - 💫 CTF AWD 实时 3D 攻击大屏
  • rasta-mouse/EWSToolkit - Abusing Exchange via EWS
  • mubix/solarflare - SolarWinds Orion Account Audit / Password Dumping Utility
  • zcgonvh/CVE-2020-17144 - weaponized tool for CVE-2020-17144
  • Airboi/CVE-2020-17144-EXP - Exchange2010 authorized RCE
  • securesean/DecryptAutoLogon - Command line tool to extract/decrypt the password that was stored in the LSA by SysInternals AutoLogon
  • cube0x0/SharpMapExec -
  • jas502n/SSCMS_Decrypt - sscms database decrypt
  • outflanknl/EvilClippy - A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
  • RcoIl/CSharp-Tools - .NET C# Tools
  • Ch1ngg/SharpGetTitle - SharpGetTitle - 基于 C# 的多线程 Web Title 扫描器
  • antonioCoco/RunasCs - RunasCs - Csharp and open version of windows builtin runas.exe
  • rocksdanister/lively - Free and open-source software that allows users to set animated desktop wallpapers and screensavers powered by WinUI 3.
  • huiyadanli/RevokeMsgPatcher - :trollface: A hex editor for WeChat/QQ/TIM - PC版微信/QQ/TIM防撤回补丁（我已经看到了，撤回也没用了）
  • cobbr/SharpSploit - SharpSploit is a .NET post-exploitation library written in C#
  • med0x2e/NoAmci - Using DInvoke to patch AMSI.dll in order to bypass AMSI detections triggered when loading .NET tradecraft via Assembly.Load().
  • NVISOsecurity/DInvisibleRegistry - DInvisibleRegistry
  • matterpreter/DefenderCheck - Identifies the bytes that Microsoft Defender flags on.
  • 3F/DllExport - .NET DllExport with .NET Core support (aka 3F/DllExport aka DllExport.bat)
  • TheWover/DInvoke - Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.
  • mandiant/OfficePurge -
  • hayasec/360SafeBrowsergetpass - 这是一个一键辅助抓取360安全浏览器密码的CobaltStrike脚本以及解密小工具，用于节省红队工作量，通过下载浏览器数据库、记录密钥来离线解密浏览器密码。
  • smartlockpicking/BLE_HackMe - Bluetooth Low Energy hardware-less HackMe
  • awaescher/Fusion - 🧰 A modern alternative to the Microsoft Assembly Binding Log Viewer (FUSLOGVW.exe)
  • rasta-mouse/ThreatCheck - Identifies the bytes that Microsoft Defender / AMSI Consumer flags on.
  • xforcered/StandIn - StandIn is a small .NET35/45 AD post-exploitation toolkit
  • EncodeGroup/AggressiveProxy - Project to enumerate proxy configurations and generate shellcode from CobaltStrike
  • xiaoxiaoleo/Scan-and-Clean-Macro-Virus - Scan and clean specific Macro Virus, #C Sharp
  • Mr-Un1k0d3r/RedTeamCSharpScripts - C# Script used for Red Team
  • TGSAN/CMWTAT_Digital_Edition - CloudMoe Windows 10/11 Activation Toolkit get digital license, the best open source Win 10/11 activator in GitHub. GitHub 上最棒的开源 Win10/Win11 数字权利（数字许可证）激活工具！
  • wesleydekraker/xamarin-security-scanner - A tool to find security vulnerabilities in Xamarin.Android apps.
  • dev-2null/KerberosRun - A little tool to play with Kerberos.
  • ustayready/SharpHose - Asynchronous Password Spraying Tool in C# for Windows Environments
  • tyranid/DotNetToJScript - A tool to create a JScript file which loads a .NET v2 assembly from memory.
  • EncodeGroup/AggressiveGadgetToJScript - A Cobalt Strike Aggressor script to generate GadgetToJScript payloads
  • EncodeGroup/Gopher - C# tool to discover low hanging fruits
  • b4rtik/SharpAdidnsdump - c# implementation of Active Directory Integrated DNS dumping (authenticated user)
  • mez-0/DecryptRDCManager - .NET 4.0 Remote Desktop Manager Password Gatherer
  • uknowsec/SharpSQLDump - 内网渗透中快速获取数据库所有库名，表名，列名。具体判断后再去翻数据，节省时间。适用于mysql，mssql。
  • Apr4h/CobaltStrikeScan - Scan files or process memory for CobaltStrike beacons and parse their configuration
  • r3nhat/SharpWifiGrabber - Sharp Wifi Password Grabber retrieves in clear-text the Wi-Fi Passwords from all WLAN Profiles saved on a workstation.
  • CCob/Rubeus - Trying to tame the three-headed dog.
  • rasta-mouse/Fork-n-Run -
  • microsoft/onefuzz - A self-hosted Fuzzing-As-A-Service platform
  • checkymander/Zolom - C# Executable with embedded Python that can be used reflectively to run python code on systems without Python installed
  • r3nhat/GRAT2 - We developed GRAT2 Command & Control (C2) project for learning purpose.
  • Kudaes/LOLBITS - ** DISCONTINUED ** C2 framework that uses Background Intelligent Transfer Service (BITS) as communication protocol and Direct Syscalls + Dinvoke for EDR user-mode hooking evasion.
  • vivami/SauronEye - Search tool to find specific files containing specific words, i.e. files containing passwords..
  • mez-0/MoveScheduler - .NET 4.0 Scheduled Job Lateral Movement
  • passthehashbrowns/SharpBuster - SharpBuster is a C# implementation of a directory brute forcing tool. It's designed to be used via Cobalt Strike's execute-assembly and similar tools, when running a similar tool over a SOCKS proxy is
  • G0ldenGunSec/SharpSecDump - .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py
  • chromelyapps/Chromely - Build Cross Platform HTML Desktop Apps on .NET using native GUI, HTML5, JavaScript, CSS, Owin, AspNetCore (MVC, RazorPages, Blazor)
  • slyd0g/LNKMod - C# project to create or modify existing LNKs
  • lontivero/Open.NAT - Lightweight and easy-to-use class library to allow port forwarding in NAT devices with UPNP and/or PMP
  • sf197/GetPwd - 用CSharp写的一款信息搜集工具，目前支持Navicat、TeamView、Xshell、SecureCRT产品的密码解密
  • BeichenDream/MysqlT - 伪造Myslq服务端,并利用Mysql逻辑漏洞来获取客户端的任意文件反击攻击者
  • rasta-mouse/MiscTools - Miscellaneous Tools
  • mez-0/CSharpWinRM - .NET 4.0 WinRM API Command Execution
  • RiccardoAncarani/DirSync-Poc - A PoC that uses the DirSync protocol to poll Active Directory for changes
  • BloodHoundAD/SharpHound3 - C# Data Collector for the BloodHound Project, Version 3
  • BloodHoundAD/SharpHound2 - The Old BloodHound C# Ingestor (Deprecated)
  • WayneJLee/CsharpAmsiBypass - C# loader for msfvenom shellcode with AMSI bypass
  • aduskin/AduSkin - A Beautiful WPF Control UI
  • TalAloni/SMBLibrary - Free, Open Source, User-Mode SMB 1.0/CIFS, SMB 2.0, SMB 2.1 and SMB 3.0 server and client library
  • rnwood/smtp4dev - smtp4dev - the fake smtp email server for development and testing
  • 3xpl01tc0d3r/ProcessInjection - This program is designed to demonstrate various process injection techniques
  • Flangvik/SharpAppLocker - C# port of the Get-AppLockerPolicy PS cmdlet
  • netwrix/pingcastle - PingCastle - Get Active Directory Security at 80% in 20% of the time
  • RythmStick/ProxyPunch - Finding SSL Blindspots for Red Teams
  • Mr-B0b/SpaceRunner - This tool enables the compilation of a C# program that will execute arbitrary PowerShell code, without launching PowerShell processes through the use of runspace.
  • jfmaes/GG-AESY - Hide cool stuff in images :)
  • MrFooL137/WebSocketRemoteControl - Remote Control With WebSocket
  • checkymander/Carbuncle - Tool for interacting with outlook interop during red team engagements
  • fullmetalcache/PowerLine -
  • djhohnstein/SharpSearch - Search files for extensions as well as text within.
  • crawl3r/FunWithAMSI - A repo to hold any bypasses I work on/study/whatever
  • Flangvik/SharpDllProxy - Retrieves exported functions from a legitimate DLL and generates a proxy DLL source code/template for DLL proxy loading or sideloading
  • jfmaes/TrustJack - Yet another PoC for https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows
  • Fody/Costura - Embed references as resources
  • EquiFox/KsDumper - Dumping processes using the power of kernel space !
  • tomcarver16/ADSearch - A tool to help query AD via the LDAP protocol
  • bohops/SharpRDPHijack - A proof-of-concept Remote Desktop (RDP) session hijack utility
  • mvelazc0/PurpleSharp - PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments
  • git-ecosystem/git-credential-manager - Secure, cross-platform Git credential storage with authentication to GitHub, Azure Repos, and other popular Git hosting services.
  • SnaffCon/Snaffler - a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )
  • 360-Linton-Lab/Telemetry - WINDOWS TELEMETRY权限维持
  • GhostPack/Seatbelt - Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.
  • mdsecactivebreach/sitrep -
  • jfmaes/Clippi-B -
  • thiagomayllart/Covenant_Alternate - Covenant is a collaborative .NET C2 framework for red teamers.
  • Hzllaga/ShellcodeLoader - 将shellcode用rsa加密并动态编译exe，自带几种反沙箱技术。
  • SpiderLabs/SharpCompile - SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime. This is a more slick approach than manually compiling an .NET assembly and loading it into
  • dotnet/ILMerge - ILMerge is a static linker for .NET Assemblies.
  • RedLectroid/SearchOutlook - A C# tool to search through a running instance of Outlook for keywords
  • Flangvik/BetterSafetyKatz - Fork of SafetyKatz that dynamically fetches the latest pre-compiled release of Mimikatz directly from gentilkiwi GitHub repo, runtime patches signatures and uses SharpSploit DInvoke to PE-Load into me
  • QAX-A-Team/sharpwmi - sharpwmi是一个基于rpc的横向移动工具，具有上传文件和执行命令功能。