Tools

lethal-forensics/macos-collector

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

byt3bl33d3r/offensivedlr

Toolbox containing research notes & PoC code for weaponizing .NET's DLR

twosevenonet/edr-redir

Redirects EDR working folders using a Bind Filter (bindflt.sys) to bypass endpoint detection, corrupt EDR services, or replace with…

duhirsch/moveedr

Permanently disable EDRs as local admin

pushpenderindia/thorse

THorse is a RAT (Remote Administrator Trojan) Generator for Windows/Linux systems written in Python 3.

lamaper/cve-2025-55182-toolbox

Automated exploitation tool for CVE-2025-55182 (React/Next.js RCE) with command execution, outbound detection, interactive reverse shell, and…

cerberusmrxi/langflow-cve-2026-33017-exploit

CVE-2026-33017 exploitation tool for Langflow <1.9.0. Features reverse shells, command execution, file operations, persistence, and automated…

captmag/maldev

Creation of multiple Malware tools consisting of evasion, enumeration and exploitation

ghostvectoracademy/dllhijackhunter

Automated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths.

jm33-m0/emp3r0r

Self‑healing Gossip Mesh C2 with Assisted Peer Discovery, Cross-Platform BOF Execution, and Scriptable Agents.

pennyw0rth/netexec

Post-exploitation framework for automated network authentication testing, credential harvesting, and lateral movement across Windows/AD environments…

j-0-t/staekka

Stækka Metasploit - Extenting Metasploit

rek7/postshell

PostShell - Post Exploitation Bind/Backconnect Shell

rek7/patchy

Automated Persistence and Lateral Movement using GCP Patch Management

jkornev/hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

d4vinci/dr0p1t-framework

A framework that create an advanced stealthy dropper that bypass most AVs and have a lot of tricks