latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

Prox-Ez

Prox-Ez: The Swiss Army Knife of HTTP auth This HTTP proxy handles all HTTP authentications on your behalf. It supports NTLM EPA channel binding and service binding, kerberos, pass-the-hash, overpass-the-hash pass-the-key and pass-the-ticket TGT and TGS. Related articles: Dissecting NTLM EPA with...

DumpGuard

DumpGuard DumpGuard es una herramienta de extracción de credenciales e investigación de protocolos para sistemas Windows modernos. Abusa del protocolo Remote Credential Guard para recuperar material de credenciales incluso cuando Credential Guard está habilitado, e incluye una ruta del paquete de...

LDAP-Password-Hunter

Cazador de Contraseñas LDAP Sucede que debido a requisitos de servicios heredados o simplemente malas prácticas de seguridad, las contraseñas son legibles globalmente en la base de datos LDAP por cualquier usuario que pueda autenticarse. Cazador de Contraseñas LDAP es una herramienta que envuelve...

PKINITtools

Herramientas PKINIT Este repositorio contiene algunas utilidades para jugar con PKINIT y certificados. Las herramientas están construidas sobre minikerberos e impacket. Artículo de blog adjunto con más contexto: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ Instalación Estas...

freeipa

FreeIPA Server FreeIPA allows Linux administrators to centrally manage identity, authentication and access control aspects of Linux and UNIX systems by providing simple to install and use command line and web based management tools. FreeIPA is built on top of well known Open Source components and...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. root@kitploit:...

mimikatz

mimikatz mimikatz es una herramienta que creé para aprender C y hacer algunos experimentos con la seguridad de Windows. Ahora es bien conocida por extraer contraseñas en texto plano, hashes, códigos PIN y tickets de Kerberos de la memoria. mimikatz también puede realizar pass-the-hash,...

lsawhisper-bof

LSA Whisperer BOF A Cobalt Strike Beacon Object File BOF port of LSA Whisperer — the tool that talks directly to Windows authentication packages through the LSA untrusted/trusted client interface, without touching LSASS process memory even when PPL and Credential Guard is enabled. Why This Exists...

CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...

tgt-monitor-bof

Monitorización y Renovación Automática de TGTs Kerberos Este repositorio contiene dos Archivos de Objetos Beacon Asíncronos BOF. El primero, tgt-monitor, monitorea el sistema en busca de eventos de inicio de sesión Kerberos y activa el agente cada vez que se captura un nuevo TGT Kerberos. Similar...

ResetNightmare

ResetNightmare Proof-of-concept POC tool for ResetNightmare CVE-2026-27912. ResetNightmare is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched...

Outpacket

📦 Outpacket Tired of impacket? This cheatsheet maps common impacket workflows to their modern alternatives Index Auth Quick Reference 1. Remote Execution WMI Exec · wmiexec.py DCOM Exec · dcomexec.py Service-Based Exec · smbexec.py · psexec.py Scheduled Task Exec · atexec.py Bulk Execution ·...

ticket_converter

This script is no longer supported Use the impacket example ticketConverter.py. ticketconverter A little tool to convert ccache tickets into kirbi KRB-CRED and vice versa based on impacket. As input you must provide a ccache or kirbi file. The script will detect the format and convert it...

WindowsProtocolTestSuites

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

nimux

Pure-Nim network enumeration and remote execution toolkit nimux - Native Operator Toolkit nimux is a native command surface for authorized security assessments. It combines network enumeration, lightweight web discovery, credential validation, Active Directory operations, Kerberos workflows, remo...

MITM6-Kerberos-CNAME-Abuse

Kerberos Authentication Relay - CNAME Abuse Technique PoC Background This tool is the proof-of-concept for Kerberos CNAME Abuse Relay technique, based on the MITM6 tool. The research uncovered a flaw in Windows Kerberos client behavior: when a DNS CNAME record is returned, the client follows the...

CVE-2020-15931

CVE-2020-15931 Netwrix Account Lockout Examiner 4.1 Domain Admin Account Credential Disclosure Vulnerability Vulnerbility Overview Netwrix Account Lockout Examiner ALE before 5.1 allows an unauthenticated, remote adversary to trigger a connection to an attacker-controlled system and capture the...

kcmdump

KCM dumper Quick script to dump the KCM database used by SSSD and recover Kerberos tickets in the CCACHE format. Initially based on SSSDKCMExtractor and KCMTicketFormatter. Description Since version 2.0.0 2018-08-13, the back end storage of the KCM responder of SSSD does not encrypt the database...