trajan

Trajan: CI/CD Security Scanner Trajan scans CI/CD pipelines for security vulnerabilities that attackers use to compromise software supply chains. It supports GitHub Actions, GitLab CI, Azure DevOps, Jenkins, and JFrog. What it does Trajan parses workflow YAML files, builds dependency graphs, runs...

Covenant

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a...

git-fsmonitor

This is a documented known issue, but I found this during my research & its pretty useful for RT/PT. Summary: The FSMonitor helper is executed by git on every command like git status, git diff, etc., hence git will blindly launch whatever path we specfic there. Our IDEs runs git status...

AttackSurfaceManagement

ABOUT: Discover the attack surface and prioritize risks with our continuous Attack Surface Management ASM platform - Sn1per Professional. For more information, go to https://sn1persecurity.com. FEATURES: Attack Surface Discovery Easily discover the attack surface IPs, domain names, open ports, HT...

paragon

Deprecation Notice This project has been deprecated, please refer to our new Realm project, which builds upon many of the ideas we had when building this repo. Paragon Paragon is a Red Team engagement platform. It aims to unify offensive tools behind a simple UI, abstracting much of the backend...

cervantes

Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location. By facilitating efficient data...

dc-sonar

DC Sonar Community Repositories The project consists of repositories: dc-sonar-frontend dc-sonar-user-layer dc-sonar-workers-layer ntlm-scrutinizer Disclaimer It's only for education purposes. Avoid using it on the production Active Directory AD domain. Neither contributor incur any responsibilit...

baboossh

.. image:: https://raw.githubusercontent.com/cybiere/baboossh/master/logo.png SSH spreading made easy for red teams in a hurry. BabooSSH allows you, from a simple SSH connection to a compromised host, to quickly gather info on other SSH endpoints to pivot and compromise them. Licence +++++++...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links...

Phishious

What is Phishious? Phishious is an open-source Secure Email Gateway SEG evaluation toolkit designed for red-teamers and developed by the team at CanIPhish. Phishious provides the ability to see how various Secure Email Gateway technologies behave when presented with phishing material. 📬 Secure...

Cohab_Processes

CohabProcesses This Aggressor script is intended to help internal Red Teams identify suspicious or foreign processes "Cohabitation" running in their environments. Red Teams may assemble a list of "known" processes either independently or in collaboration with Blue force and feed it to the aggress...

awesome-edr-bypass

Awesome EDR Bypass 🛡️ Awesome EDR Bypass Resources For Ethical Hacking ⚔️ EDR bypass technology is not just for attackers. Many malware now have EDR bypass capabilities, knowledge that pentesters and incident responders should also be aware of. This repository is not intended to be used to escalate...

axiom

WARNING : Axiom Classic is now in maintenance mode. We encourage you to transition to the new Ax Framework. In the coming months, we will introduce essential quality-of-life updates to Axiom Classic before 2025. Long live Axiom! We are lucky enough to be sponsored by the awesome SecurityTrails!...

caldera

Caldera™ Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE. The framework consists of two components: 1. The core...

Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

Kittysploit-framework

KittySploit Framework The Next-Gen Exploitation Engine for Modern Red Teams Website • Wiki • Usage Guide • Marketplace Modular • Extensible • AI-Powered Why KittySploit? While traditional tools struggle with modern web architectures and automated defense, KittySploit redefines the offensive...

Forensia

Forensia Anti Forensics Tool For Red Teamers, Used For Erasing Some Footprints In The Post Exploitation Phase. Reduces Payload Burnout And Increases Detection Countdown. Can Be Used To Test The capabilities of Your Incident Response / Forensics Teams. Capabilities Unloading Sysmon Driver. Gutmann...

Phishing-Simulation

Phishing-Simulation Phishing Simulation mainly aims to increase phishing awareness by providing an intuitive tutorial and customized assessment without any actual setup - no domain, no infrastructure, no actual email address to assess people's action on any given situation and gives ability to...

NimSyscallPacker

NimSyscallPacker / Loader This tool was made public after a talk at x33fcon. It was my private main coding project from 2021 - 2024 and is now considered deprecated and is not maintained anymore. Dont expect bug fixes or feature updates here from my side. Instead, RustPack is maintained now as a...

Cybersec

Offensive CyberSec Cheat Sheet A highly dynamic, single-file HTML cheat sheet designed for Red Teamers, Pentesters, and CTF players. Tired of typing the same Reverse Shell payloads and constantly replacing your local IP and port? This tool eliminates the "Typo Fatigue" and cognitive load during...