Tools

hackplayers/evil-winrm

The ultimate WinRM shell for hacking/pentesting

61106960/adpeas

Powershell tool to automate Active Directory enumeration.

lithnet/ad-password-protection

Active Directory password filter featuring breached password checking and custom complexity rules

f-bader/tokentacticsv2

A fork of the great TokenTactics with support for CAE and token endpoint v2

blue0x1/nimrm

Native Nim WinRM shell with NTLM, Kerberos, file transfer, in-memory helpers, and AD/OPSEC reporting

b5null/invoke-badsuccessor.ps1

PowerShell Script to automatically abuse the BadSuccessor vulnerability (CVE-2025-53779)

akefallonitis/larac2shell

Cross-platform interactive shell for Microsoft Defender for Endpoint Live Response

dafthack/mfasweep

A tool for checking if MFA is enabled on multiple Microsoft Services

mzhmo/powershellkerberos

Some scripts to abuse kerberos using Powershell

incredibleindishell/certi-bhai

AD CS exploitation related stuff goes here

v-jfanca/cve-2026-20833-rc4-kerberos

Kerberos RC4 deprecation: detection, remediation and guidance (CVE-2026-20833)

n7on/dllspy

Discover input surfaces and security issues in compiled .NET assemblies — without running them.

logisek/huntcyberark

CyberArk Security Audit

zh54321/sharepointdumper

PowerShell SharePoint extraction + auditing tool for red/blue/purple teams. Enumerates all SharePoint sites/drives a user can access via Microsoft…

mayyhem/maestro

Abusing Azure services over C2

the-viper-one/psmapexec

Dominate Active Directory with PowerShell.

gerenios/aadinternals

PowerShell module for administering and auditing Azure AD and Office 365, enabling token manipulation, user enumeration, and security assessments of…

zenzue/cve-2025-50154

PowerShell toolkit to audit, harden, and hunt for insecure NTLM/SMB usage, addressing CVE-2025-50154 credential leak risks with event log analysis…