Tools

lukechilds/reverse-shell

On-demand reverse shell service that auto-detects target environment and executes appropriate payload for remote access during penetration tests.

threatexpress/domainhunter

Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names

0x00-0x00/shellpop

Pop shells like a master.

mttaggart/offensivenotion

Notion as a platform for offensive operations

praetorian-inc/pentestly

Python and Powershell internal penetration testing framework

b23r0/heroinn

A cross platform C2/post-exploitation framework.

qsecure-labs/overlord

Python-based CLI for automated red team infrastructure deployment on AWS and Digital Ocean, with modular support for C2, email servers, HTTP…

trustedsec/tap

The TrustedSec Attack Platform is a reliable method for droppers on an infrastructure in order to ensure established connections to an organization.

empireproject/empire-gui

Empire client application

jymcheong/autottp

Automated Tactics Techniques & Procedures

mythicagents/nimplant

A cross-platform implant written in Nim

incursi0n/bluesam

A Cobalt Strike Beacon Object File that exploits the BlueHammer vulnerability that to obtain a copy of the SAM database.

nccgroup/gitpwnd

GitPwnd is a network penetration tool that lets you use a git repo for command and control of compromised machines

cobalt-strike/beacon_health_check

This aggressor script uses a beacon's note field to indicate the health status of a beacon.

nccgroup/async-pico-hub

Async PICO Hub is a work-in-progress framework to extend Cobalt Strike with custom event monitoring and in-process Asynchronous BOFs

jonstratton/selenium-node-takeover-kit

A collection of selenium tests that might aid it takeover of a selenium node

gmh5225/cve-2025-24893-rce-poc

This is a small script for the rce vulnerability for CVE-2025-24893. It supports basic input/output