Awesome-Red-Team-Operation

Strumenti PenTest e Red Team di Joas e S3cur3Th1sSh1t

Script di PowerShell

• https://github.com/S3cur3Th1sSh1t/WinPwn

• https://github.com/dafthack/MailSniper

• https://github.com/putterpanda/mimikittenz

• https://github.com/dafthack/DomainPasswordSpray

• https://github.com/mdavis332/DomainPasswordSpray

• https://github.com/jnqpblc/SharpSpray

• https://github.com/Arvanaghi/SessionGopher

• https://github.com/samratashok/nishang

• https://github.com/PowerShellMafia/PowerSploit

• https://github.com/fdiskyou/PowerOPS

• https://github.com/giMini/PowerMemory

• https://github.com/Kevin-Robertson/Inveigh

• https://github.com/MichaelGrafnetter/DSInternals

• https://github.com/PowerShellEmpire/PowerTools

• https://github.com/FuzzySecurity/PowerShell-Suite

• https://github.com/hlldz/Invoke-Phant0m

• https://github.com/leoloobeek/LAPSToolkit

• https://github.com/n00py/LAPSDumper

• https://github.com/sense-of-security/ADRecon

• https://github.com/adrecon/ADRecon

• https://github.com/S3cur3Th1sSh1t/Grouper

• https://github.com/l0ss/Grouper2

• https://github.com/NetSPI/PowerShell

• https://github.com/NetSPI/PowerUpSQL

• https://github.com/GhostPack

• https://github.com/Kevin-Robertson/Powermad

Bypass di AMSI

• https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell

• https://github.com/Flangvik/AMSI.fail

• https://github.com/p3nt4/PowerShdll

• https://github.com/jaredhaight/PSAttack

• https://github.com/Cn33liz/p0wnedShell

• https://github.com/cobbr/InsecurePowerShell

• https://github.com/bitsadmin/nopowershell

• https://github.com/Mr-Un1k0d3r/PowerLessShell

• https://github.com/OmerYa/Invisi-Shell

• https://github.com/Hackplayers/Salsa-tools

• https://github.com/padovah4ck/PSByPassCLM

• https://github.com/rasta-mouse/AmsiScanBufferBypass

• https://github.com/itm4n/VBA-RunPE

• https://github.com/cfalta/PowerShellArmoury

• https://github.com/Mr-B0b/SpaceRunner

• https://github.com/RythmStick/AMSITrigger

• https://github.com/rmdavy/AMSI_Ordinal_Bypass

• https://github.com/mgeeky/Stracciatella

Hosting di Payload

• https://github.com/kgretzky/pwndrop

• https://github.com/sc0tfree/updog

Scanner di Condivisioni di Rete

• https://github.com/SnaffCon/Snaffler

• https://github.com/djhohnstein/SharpShares

• https://github.com/vivami/SauronEye

• https://github.com/leftp/VmdkReader

Reverse Shell

• https://github.com/xct/xc

• https://github.com/cytopia/pwncat

• https://github.com/Kudaes/LOLBITS

Rilevatore di Backdoor

• https://github.com/linuz/Sticky-Keys-Slayer

• https://github.com/ztgrace/sticky_keys_hunter

• https://github.com/countercept/doublepulsar-detection-script

Pivoting

• https://github.com/0x36/VPNPivot

• https://github.com/securesocketfunneling/ssf

• https://github.com/p3nt4/Invoke-SocksProxy

• https://github.com/sensepost/reGeorg

• https://github.com/hayasec/reGeorg-Weblogic

• https://github.com/nccgroup/ABPTTS

• https://github.com/RedTeamOperations/PivotSuite

• https://github.com/trustedsec/egressbuster

• https://github.com/vincentcox/bypass-firewalls-by-DNS-history

• https://github.com/shantanu561993/SharpChisel

• https://github.com/jpillora/chisel

• https://github.com/esrrhs/pingtunnel

• https://github.com/sysdream/ligolo

• https://github.com/nccgroup/SocksOverRDP

• https://github.com/blackarrowsec/mssqlproxy

Persistenza su Windows

• https://github.com/fireeye/SharPersist

• https://github.com/outflanknl/SharpHide

• https://github.com/HarmJ0y/DAMP

Scoperta di Framework

• https://github.com/Tuhinshubhra/CMSeeK

• https://github.com/Dionach/CMSmap - Scanner per Wordpress, Joomla, Drupal

• https://github.com/wpscanteam/wpscan

• https://github.com/Ekultek/WhatWaf

• https://github.com/KingOfBugbounty/KingOfBugBountyTips

Scanner / Exploit di Framework

• https://github.com/wpscanteam/wpscan - wordpress

• https://github.com/n00py/WPForce

• https://github.com/m4ll0k/WPSeku https://github.com/swisskyrepo/Wordpresscan

• https://github.com/rastating/wordpress-exploit-framework

• https://github.com/coldfusion39/domi-owned - lotus domino

• https://github.com/droope/droopescan - Drupal

• https://github.com/whoot/Typo-Enumerator - Typo3

• https://github.com/rezasp/joomscan - Joomla

Scoperta di File / Directory / Parametri

• https://github.com/OJ/gobuster

• https://github.com/nccgroup/dirble

• https://github.com/maK-/parameth

• https://github.com/devanshbatham/ParamSpider - Estrazione di parametri dagli angoli oscuri degli archivi Web

• https://github.com/s0md3v/Arjun - 💗

• https://github.com/Cillian-Collins/dirscraper - Ricerca di directory da file JavaScript

• https://github.com/hannob/snallygaster

• https://github.com/maurosoria/dirsearch

• https://github.com/s0md3v/Breacher - Ricerca di pannelli di amministrazione

• https://github.com/mazen160/server-status_PWN

• https://github.com/helviojunior/turbosearch

Audit delle API REST

• https://github.com/microsoft/restler-fuzzer - RESTler è il primo strumento di fuzzing stateful per API REST che testa automaticamente i servizi cloud tramite le loro API REST e trova bug di sicurezza e affidabilità in questi servizi.

• https://github.com/flipkart-incubator/Astra

Escalation dei Privilegi su Windows / Audit

• https://github.com/itm4n/PrivescCheck - Script di enumerazione per l'escalation dei privilegi su Windows

• https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS - potente script di controllo per l'escalation dei privilegi con un ottimo output

• https://github.com/AlessandroZ/BeRoot

• https://github.com/rasta-mouse/Sherlock

• https://github.com/hfiref0x/UACME - UAC

• https://github.com/rootm0s/WinPwnage - UAC

• https://github.com/abatchy17/WindowsExploits

• https://github.com/dafthack/HostRecon

• https://github.com/sensepost/rattler - trova DLL vulnerabili per attacchi di preloading

• https://github.com/WindowsExploits/Exploits

• https://github.com/Cybereason/siofra - scanner per DLL hijacking

• https://github.com/0xbadjuju/Tokenvator - da admin a system

• https://github.com/MojtabaTajik/Robber

• https://github.com/411Hall/JAWS

• https://github.com/GhostPack/SharpUp

• https://github.com/GhostPack/Seatbelt

LinkedIn

• https://www.linkedin.com/in/joas-antonio-dos-santos

Abuso dei Privilegi di Windows (Escalation dei Privilegi)

• https://github.com/gtworek/Priv2Admin - Abusa dei privilegi di Windows

• https://github.com/itm4n/UsoDllLoader - carica DLL dannose da system32

• https://github.com/TsukiCTF/Lovely-Potato - Sfrutta i Potato con automazione

• https://github.com/antonioCoco/RogueWinRM - da account di servizio a System

• https://github.com/antonioCoco/RoguePotato - Un'altra escalation dei privilegi locale di Windows da account di servizio a System

• https://github.com/itm4n/PrintSpoofer - Abuso dei privilegi di impersonificazione su Windows 10 e Server 2019

• https://github.com/BeichenDream/BadPotato - il PrintSpoofer di itm4n in C#

• https://github.com/itm4n/FullPowers - Recupera il set di privilegi predefinito di un account LOCAL/NETWORK SERVICE

Esfiltrazione

• https://github.com/gentilkiwi/mimikatz

• https://github.com/GhostPack/SafetyKatz

• https://github.com/Flangvik/BetterSafetyKatz - Fork di SafetyKatz che recupera dinamicamente l'ultima release precompilata di Mimikatz direttamente dal repository GitHub di gentilkiwi, applica patch alle firme a runtime e usa SharpSploit DInvoke per il PE-Load in memoria.

• https://github.com/GhostPack/Rubeus

• https://github.com/Arvanaghi/SessionGopher

• https://github.com/peewpw/Invoke-WCMDump

• https://github.com/tiagorlampert/sAINT

• https://github.com/AlessandroZ/LaZagneForensic - lazagne remoto

• https://github.com/eladshamir/Internal-Monologue

• https://github.com/djhohnstein/SharpWeb - Raccolta di credenziali del browser

• https://github.com/moonD4rk/HackBrowserData - hack-browser-data è uno strumento open-source che può aiutarti a decrittare i dati [passwords|bookmarks|cookies|history] dal browser.

• https://github.com/mwrlabs/SharpClipHistory - La funzionalità ClipHistory recupera le ultime 25 azioni di copia e incolla

• https://github.com/outflanknl/Dumpert - dump di LSASS utilizzando chiamate di sistema dirette e API unhooking

• https://github.com/b4rtik/SharpMiniDump - Crea un minidump del processo LSASS dalla memoria - usando Dumpert

Staging

• Rapid Attack Infrastructure (RAI) Infrastruttura Red Team... Veloce... Rapida... Semplificata. Una delle fasi più noiose di un'operazione Red Team è di solito la configurazione dell'infrastruttura. Questo di solito comporta un teamserver o controller, domini, redirector e un server di phishing. https://github.com/obscuritylabs/RAI

• Red Baron è un insieme di moduli e provider personalizzati/di terze parti per Terraform che tenta di automatizzare la creazione di infrastrutture resilienti, usa e getta, sicure e agili per i Red Team. https://github.com/byt3bl33d3r/Red-Baron

• EvilURL genera domini dannosi unicode per l'IDN Homograph Attack e li rileva. https://github.com/UndeadSec/EvilURL

• Domain Hunter controlla i domini scaduti, la categorizzazione Bluecoat e la cronologia di Archive.org per determinare buoni candidati per nomi di dominio di phishing e C2. https://github.com/threatexpress/domainhunter

• PowerDNS è una semplice proof of concept per dimostrare l'esecuzione di script PowerShell utilizzando solo DNS. https://github.com/mdsecactivebreach/PowerDNS

• Chameleon è uno strumento per eludere la categorizzazione dei proxy. https://github.com/mdsecactivebreach/Chameleon

• CatMyFish cerca domini categorizzati che possono essere utilizzati durante un engagement di red teaming. Perfetto per configurare un dominio in whitelist per il C&C del tuo beacon Cobalt Strike. https://github.com/Mr-Un1k0d3r/CatMyFish

• Malleable C2 è un linguaggio specifico di dominio per ridefinire gli indicatori nella comunicazione di Beacon. https://github.com/rsmudge/Malleable-C2-Profiles

• Malleable-C2-Randomizer Questo script randomizza i profili Malleable C2 di Cobalt Strike tramite l'uso di un metalinguaggio, riducendo così le possibilità di attivare i controlli di rilevamento basati su firme. https://github.com/bluscreenofjeff/Malleable-C2-Randomizer

• FindFrontableDomains cerca potenziali domini frontable.

Buffer Overflow e Sviluppo di Exploit

• https://github.com/CyberSecurityUP/Buffer-Overflow-Labs

• https://github.com/gh0x0st/Buffer_Overflow

• https://github.com/freddiebarrsmith/Buffer-Overflow-Exploit-Development-Practice

• https://github.com/21y4d/Windows_BufferOverflowx32

• https://github.com/johnjhacking/Buffer-Overflow-Guide

• https://github.com/npapernot/buffer-overflow-attack

• https://github.com/V1n1v131r4/OSCP-Buffer-Overflow

• https://github.com/KINGSABRI/BufferOverflow-Kit

• https://github.com/FabioBaroni/awesome-exploit-development

• https://github.com/Gallopsled/pwntools

• https://github.com/hardenedlinux/linux-exploit-development-tutorial

• https://github.com/Billy-Ellis/Exploit-Challenges

• https://github.com/wtsxDev/Exploit-Development

MindMaps di Joas

• https://www.mindmeister.com/pt/1746180947/web-attacks-bug-bounty-and-appsec-by-joas-antonio

• https://www.mindmeister.com/pt/1760781948/information-security-certifications-by-joas-antonio

• https://www.mindmeister.com/pt/1781013629/the-best-labs-and-ctf-red-team-and-pentest

• https://www.mindmeister.com/pt/1760781948/information-security-certifications-by-joas-antonio

• https://www.mindmeister.com/pt/1746187693/cyber-security-career-knowledge-by-joas-antonio

Movimento Laterale

• https://github.com/0xthirteen/SharpRDP

• https://github.com/0xthirteen/MoveKit

• https://github.com/0xthirteen/SharpMove

• https://github.com/rvrsh3ll/SharpCOM

• https://github.com/malcomvetter/CSExec

• https://github.com/byt3bl33d3r/CrackMapExec

• https://github.com/cube0x0/SharpMapExec

• https://github.com/nccgroup/WMIcmd

• https://github.com/rasta-mouse/MiscTools

• https://github.com/byt3bl33d3r/DeathStar

• https://github.com/SpiderLabs/portia

• https://github.com/Screetsec/Vegile

• https://github.com/DanMcInerney/icebreaker

• https://github.com/MooseDojo/apt2

• https://github.com/hdm/nextnet

• https://github.com/mubix/IOXIDResolver

• https://github.com/Hackplayers/evil-winrm

• https://github.com/bohops/WSMan-WinRM

• https://github.com/dirkjanm/krbrelayx

Post-Exploitation

• https://github.com/mubix/post-exploitation

• https://github.com/emilyanncr/Windows-Post-Exploitation

• https://github.com/nettitude/Invoke-PowerThIEf

• https://github.com/ThunderGunExpress/BADministration

• https://github.com/bohops/SharpRDPHijack

• https://github.com/antonioCoco/RunasCs

• https://github.com/klsecservices/Invoke-Vnc

• https://github.com/mandatoryprogrammer/CursedChrome

• https://github.com/djhohnstein/WireTap

• https://github.com/GhostPack/Lockless

• https://github.com/infosecn1nja/SharpDoor

• Strumenti di Phishing

• https://github.com/hlldz/pickl3

• https://github.com/shantanu561993/SharpLoginPrompt

• https://github.com/Dviros/CredsLeaker

• https://github.com/bitsadmin/fakelogonscreen

• https://github.com/CCob/PinSwipe

Wrapper per vari strumenti

• https://github.com/bohops/GhostBuild

• https://github.com/S3cur3Th1sSh1t/PowerSharpPack

• https://github.com/rvrsh3ll/Rubeus-Rundll32## Strumenti di audit ed exploit di Active Directory

• https://github.com/checkymander/Zolom

• https://github.com/mwrlabs/SharpGPOAbuse

• https://github.com/BloodHoundAD/BloodHound

• https://github.com/BloodHoundAD/SharpHound3

• https://github.com/chryzsh/awesome-bloodhound

• https://github.com/hausec/Bloodhound-Custom-Queries

• https://github.com/CompassSecurity/BloodHoundQueries

• https://github.com/vletoux/pingcastle

• https://github.com/cyberark/ACLight

• https://github.com/canix1/ADACLScanner

• https://github.com/fox-it/Invoke-ACLPwn

• https://github.com/NinjaStyle82/rbcd_permissions

• https://github.com/NotMedic/NetNTLMtoSilverTicket

• https://github.com/dirkjanm/ldapdomaindump

Scanner di vulnerabilità web / Plugin Burp

• https://github.com/m4ll0k/WAScan - scanner tutto in uno

• https://github.com/s0md3v/XSStrike - rilevamento XSS

• https://github.com/federicodotta/Java-Deserialization-Scanner

• https://github.com/d3vilbug/HackBar

• https://github.com/gyoisamurai/GyoiThon

• https://github.com/snoopysecurity/awesome-burp-extensions

• https://github.com/sting8k/BurpSuite_403Bypasser - Estensione BurpSuite per bypassare le directory ristrette con errore 403

• https://github.com/BishopFox/GadgetProbe

Strumenti di sfruttamento web

• https://github.com/OsandaMalith/LFiFreak - lfi

• https://github.com/enjoiz/XXEinjector - xxe

• https://github.com/tennc/webshell - shellz

• https://github.com/flozz/p0wny-shell

• https://github.com/epinna/tplmap - ssti

• https://github.com/orf/xcat - iniezione XPath

• https://github.com/almandin/fuxploider - Caricamento di file

• https://github.com/nccgroup/freddy - deserializzazione

• https://github.com/irsdl/IIS-ShortName-Scanner - sfruttamento della vulnerabilità dei nomi brevi di IIS

• https://github.com/frohoff/ysoserial - Exploit di deserializzazione Java

• https://github.com/pwntester/ysoserial.net - Exploit di deserializzazione .NET

• https://github.com/internetwache/GitTools - Sfruttamento dell'esistenza della cartella .git

• https://github.com/cujanovic/SSRF-Testing - Tutorial su SSRF

• https://github.com/ambionics/phpggc - Generatore di payload PHP Unserialize

• https://github.com/BuffaloWill/oxml_xxe - Generatore di payload XXE per Office malevoli

• https://github.com/tijme/angularjs-csti-scanner - Scanner CSTI per AngularJS

Escalation dei privilegi Linux / Audit

• https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS - potente script di check dell'escalation dei privilegi con un bell'output

• https://github.com/mzet-/linux-exploit-suggester

• https://github.com/rebootuser/LinEnum

• https://github.com/diego-treitos/linux-smart-enumeration

• https://github.com/CISOfy/lynis

• https://github.com/AlessandroZ/BeRoot

• https://github.com/future-architect/vuls

• https://github.com/ngalongc/AutoLocalPrivilegeEscalation

• https://github.com/b3rito/yodo

• https://github.com/belane/linux-soft-exploit-suggester - ricerca di software installato vulnerabile

• https://github.com/sevagas/swap_digger

• https://github.com/NullArray/RootHelper

• https://github.com/NullArray/MIDA-Multitool

• https://github.com/initstring/dirty_sock

• https://github.com/jondonas/linux-exploit-suggester-2

• https://github.com/sosdave/KeyTabExtract

Comando e Controllo

• Cobalt Strike è un software per simulazioni di avversari (Adversary Simulation) e operazioni di Red Team. https://cobaltstrike.com/

• Empire è un framework post-exploitation che include un agente Windows in puro PowerShell 2.0 e un agente Linux/OS X in puro Python 2.6/2.7. https://github.com/EmpireProject/Empire

• Metasploit Framework è un progetto di sicurezza informatica che fornisce informazioni sulle vulnerabilità di sicurezza e aiuta nel test di penetrazione e nello sviluppo di firme IDS. https://github.com/rapid7/metasploit-framework

• SILENTTRINITY è un agente post-exploitation basato su Python, IronPython, C#/.NET. https://github.com/byt3bl33d3r/SILENTTRINITY

• Pupy è uno strumento open source, multipiattaforma (Windows, Linux, OSX, Android) di amministrazione remota e post-exploitation, scritto principalmente in Python. https://github.com/n1nj4sec/pupy

• Koadic, o COM Command & Control, è un rootkit post-exploitation per Windows simile ad altri strumenti di test di penetrazione come Meterpreter e PowerShell Empire. https://github.com/zerosum0x0/koadic

• PoshC2 è un framework C2 compatibile con i proxy, scritto interamente in PowerShell, per assistere i penetration tester in red teaming, post-exploitation e movimento laterale. https://github.com/nettitude/PoshC2_Python

• Gcat è una backdoor stealth basata su Python che utilizza Gmail come server di comando e controllo. https://github.com/byt3bl33d3r/gcat

• TrevorC2 è un sito web legittimo (navigabile) che incanala le comunicazioni client/server per l'esecuzione occulta di comandi. https://github.com/trustedsec/trevorc2

• Merlin è un server Command & Control HTTP/2 e agente post-exploitation multipiattaforma scritto in Go. https://github.com/Ne0nd0g/merlin

• Quasar è uno strumento di amministrazione remota veloce e leggero scritto in C#. Grazie all'elevata stabilità e a un'interfaccia utente facile da usare, Quasar è la soluzione perfetta di amministrazione remota per te.

Emulazione degli avversari

• MITRE CALDERA - Un sistema automatizzato di emulazione degli avversari che esegue comportamenti avversari post-compromissione all'interno di reti Windows Enterprise. https://github.com/mitre/caldera

• APTSimulator - Uno script Batch di Windows che utilizza un insieme di strumenti e file di output per far sembrare un sistema compromesso. https://github.com/NextronSystems/APTSimulator

• Atomic Red Team - Test di rilevamento piccoli e altamente portabili mappati sul framework Mitre ATT&CK. https://github.com/redcanaryco/atomic-red-team

• Network Flight Simulator - flightsim è un'utilità leggera utilizzata per generare traffico di rete malevolo e aiutare i team di sicurezza a valutare i controlli di sicurezza e la visibilità della rete. https://github.com/alphasoc/flightsim

• Metta - Uno strumento di preparazione alla sicurezza per eseguire simulazioni avversarie. https://github.com/uber-common/metta

• Red Team Automation (RTA) - RTA fornisce un framework di script progettato per consentire ai blue team di testare le proprie capacità di rilevamento contro tecniche malevole, modellato su MITRE ATT&CK. https://github.com/endgameinc/RTA

Repository

• https://github.com/infosecn1nja/Red-Teaming-Toolkit

• https://github.com/S3cur3Th1sSh1t/Pentest-Tools

• https://github.com/yeyintminthuhtut/Awesome-Red-Teaming

• https://github.com/enaqx/awesome-pentest

• https://github.com/Muhammd/Awesome-Pentest

• https://github.com/CyberSecurityUP/Awesome-PenTest-Practice

• https://drive.google.com/drive/u/0/folders/12Mvq6kE2HJDwN2CZhEGWizyWt87YunkU

• https://github.com/0x4D31/awesome-oscp

• https://github.com/six2dez/OSCP-Human-Guide

• https://github.com/RustyShackleford221/OSCP-Prep

• https://github.com/wwong99/pentest-notes/blob/master/oscp_resources/OSCP-Survival-Guide.md

Analisi di malware e reverse engineering

• https://github.com/rshipp/awesome-malware-analysis

• https://github.com/topics/malware-analysis

• https://github.com/Apress/malware-analysis-detection-engineering

• https://github.com/SpiderLabs/malware-analysis

• https://github.com/ytisf/theZoo

• https://github.com/arxlan786/Malware-Analysis

• https://github.com/nheijmans/malzoo

• https://github.com/mikesiko/PracticalMalwareAnalysis-Labs

• https://github.com/secrary/SSMA

• https://github.com/merces/aleph

• https://github.com/mentebinaria/retoolkit

• https://github.com/mytechnotalent/Reverse-Engineering

• https://github.com/wtsxDev/reverse-engineering

• https://github.com/mentebinaria/retoolkit

• https://github.com/topics/reverse-engineering

• https://github.com/0xZ0F/Z0FCourse_ReverseEngineering

• https://github.com/NationalSecurityAgency/ghidra