Active-Directory-Exploitation-Cheat-Sheet
s1ckb0y1337/active-directory-exploitation-cheat-sheetA cheat sheet that contains common enumeration and attack methods for Windows Active Directory.
curated-resourceseducationexploitation+5
s1ckb0y1337/active-directory-exploitation-cheat-sheetA cheat sheet that contains common enumeration and attack methods for Windows Active Directory.
samugit83/redamonAn AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with…
integration-it/active-directory-exploitation-cheat-sheetA cheat sheet that contains common enumeration and attack methods for Windows Active Directory.
s3n4t0r-0x0/apts-adversary-simulationThis repository contains detailed adversary simulation APT campaigns targeting various critical sectors. Each simulation includes custom tools, C2…
mr-un1k0d3r/scshellFileless lateral movement tool that relies on ChangeServiceConfigA to run command
arvanaghi/sessiongopherSessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY,…
reverseclabs/sharpgpoabuseSharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order…
ad-security/ad_minerAD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security…
redsiege/wmimplantThis is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is…
screetsec/vegileThis tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimited your session in…
mvelazc0/purplesharpPurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows…
med0x2e/gadgettojscriptA tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA…
coalfire-research/slackorA Golang implant that uses Slack as a command and control server
yeeb1/socktailLightweight Go binary that joins a device to a Tailscale network and exposes a local SOCKS5 proxy for ephemeral red team access. Supports…
gellin/teamviewer_permissions_hook_v1A proof of concept injectable C++ dll, that uses naked inline hooking and direct memory modification to change your TeamViewer permissions.
28zaaky/khaos-c2KHAOS is a modern C2 framework that routes agent traffic through cloud services already trusted by enterprise networks.
netero1010/rdphijack-bofCobalt Strike Beacon Object File (BOF) that uses WinStationConnect API to perform local/remote RDP session hijacking.
beichendream/sharptokenWindows token theft and privilege escalation tool that steals leaked tokens from processes, enables SYSTEM-level access, user impersonation, and…