Tools

joelgmsec/invoke-stealth

Simple & Powerful PowerShell Script Obfuscator

tokyoneon/credphish

PowerShell script that invokes legitimate credential prompts and exfiltrates captured passwords over DNS using CredentialPicker and Resolve-DnsName.

thewover/dinvoke

Dynamically invoke arbitrary unmanaged code from managed code without PInvoke.

ivan-sincek/invoker

Penetration testing utility and antivirus assessment tool.

checkymander/sharp-smbexec

C# implementation of SMBExec for remote command execution on Windows targets using NTLM password hashes, enabling lateral movement and pass-the-hash…

enkomio/brokenflow

A simple PoC to invoke an encrypted shellcode by using an hidden call

peewpw/invoke-psimage

Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute

jakehildreth/locksmith

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

kudaes/dinvoke_rs

Dynamically invoke arbitrary unmanaged code

n00py/outpacket

This cheatsheet maps common impacket workflows to their modern alternatives

wietze/invoke-argfuscator

Invoke-ArgFuscator is an open-source, cross-platform PowerShell module that helps generate obfuscated command-lines for common system-native…

joelgmsec/invoke-dnsteal

DNS data exfiltrator that sends payloads over UDP/TCP with configurable query size, random delay, and random domains to evade detection during red…

joelgmsec/invoke-transfer

PowerShell tool for transferring files in restricted environments (Citrix, RDP, VNC, Guacamole) via clipboard, Base64 chunks, keystrokes, or OCR…

0sm0s1z/invoke-selfsignedwebrequest

This repo exists as a quick and dirty arsenal of methods and scripts to subvert .NET SSL/TLS certificate validation in PowerShell and press on with…

0xqn/clsidfinder

PowerShell enumeration script for discovering service-backed COM objects via CLSID/AppID correlation and activation testing.

danielbohannon/invoke-cradlecrafter

PowerShell Remote Download Cradle Generator & Obfuscator

b5null/invoke-badsuccessor.ps1

PowerShell Script to automatically abuse the BadSuccessor vulnerability (CVE-2025-53779)

t3bik/cve-2026-75898

Proof-of-concept for CVE-2026-75898, an SSRF in RAGFlow's Invoke component. Demonstrates the vulnerability with unmodified source, includes E2E…