TornadoC2
kamalx06/tornadoc2Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, ECDSA-signed tasking, and a multi-operator team server with…
penetration-testing-frameworkspersistence-mechanismsids-ips-evasion+9
2
kamalx06/tornadoc2Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, ECDSA-signed tasking, and a multi-operator team server with…
capture0x/confirmescLinux privesc enumerator that confirms exploitability and gives you the exact root shell command - no GTFOBins searching. MCP server + AI-agent…
capture0x/adstrikeAI-powered modular Active Directory red-team framework for authorized penetration testing, AD enumeration, attack-path analysis, Kerberos/ADCS…
p3ng0s/archlivePhysical access red team live ISO built on Arch Linux
ripits-sec/couchpotatoWindows privilege escalation tool that patches ETW and AMSI and uses indirect syscalls to abuse SeImpersonatePrivilege, escalating service accounts…
bittersecurity/decepticonAutonomous LLM red team agent that plans and executes full attack chains—recon, exploitation, privilege escalation, lateral movement and C2—inside an…
sk4r4b/ntdll-reconstructionA technique that mixes NTDLL unhooking and hellsgate gate varients
itm4n/pentest-windowsCollection of Windows internals research and exploitation techniques covering privilege escalation, token abuse, and post-exploitation tricks for red…
karmanya03/overthroneAll-Rust Active Directory exploitation framework: LDAP/SMB/Kerberos enumeration, attack-graph pathfinding, Kerberoasting, NTLM relay, ticket forging,…
kypvas/ad_attack_architectureActive Directory Attack Architecture Map Comprehensive Pentest Reference — From Recon to Domain Dominance
kypvas/red-team-mapRed Team Operations Architecture Map Comprehensive Operator Reference — From Infrastructure to Impact
elnerd/get-netntlmPowershell module to get the NetNTLMv2 hash of the current user
onescripter/wmiexecExecute Windows commands remotely and capture output using only WMI and PowerShell (not remoting).
xpn/randomtsscriptsCollection of RedTeam engagement scripts including Pre2K default credential checks via TGS, LAPSv2 password decryption, and IIS App Pool credential…
linnemanlabs/glimmerAdversary emulation and C2 framework for security research
rapid7/metasploit-payloadsUnified repository for different Metasploit Framework payloads
vulncheck-oss/external-c2-experimentsGo external C2 module for go-exploit that catches reverse SSH shells, providing a server listener and payload client for integrating custom C2…
stillbigjosh/adaptix-serverless-c2Serverless C2 transport plugin for AdaptixC2 v1.2 using AWS Lambda + DynamoDB as the relay infrastructure.