HostHunter

HostHunter v2.0 A tool to efficiently discover and extract hostnames providing a large set of target IPv4 or IPv6 addresses. HostHunter utilises simple OSINT and active reconaissance techniques to map IP targets with virtual hostnames. This is especially useful for discovering the true attack...

SilentHound

SilentHound Quietly enumerate an Active Directory Domain via LDAP parsing users, admins, groups, etc. Created by Nick Swink from Layer 8 Security. Installation Using pipenv recommended method python3 -m pip install --user pipenv git clone https://github.com/layer8secure/SilentHound.git cd...

adidnsdump

Active Directory Integrated DNS dump tool By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks. For mo...

smbAutoRelay

DISCLAIMER : I AM NOT RESPONSIBLE OF THE MISUSE OF THIS TOOL. YOU RUN IT AT YOUR OWN RISK. Before running it, make sure you are in a controlled environment, and where you are allowed to perform this kind of exercise. PLEASE BE KIND : SMB AutoRelay SMB AutoRelay provides the automation of SMB/NTLM...

KerberosRun

KerberosRun KerberosRun is a little tool I use to study AD security together with my ADCollector. KerberosRun uses the Kerberos.NET library built by Steve Syfuhs. Some code were taken and adapted from Harmj0y's Rubeus project. dev2null is the primary author of this project. My colleague Constanti...

Find-AdminAccess

FindAdminAccess A C utility that enumerates domain computers and tests administrative access to them, including connectivity checks, admin privileges verification, and C$ share writability testing. Features Enumerate all computers in an Active Directory domain Test network connectivity Verify...

Auto_EAP

AutoEAP Introduction Published Sepetember 15, 2016 AutoEAP.py is a script designed to perform automated brute-force authentication attacks against various types of EAP networks. These types of wireless networks provide an interface to facilitate password guessing of domain credentials as radius...

fakelogonscreen

FakeLogonScreen FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password. The password entered is validated against the Active Directory or local machine to make sure it is correct and is then displayed to the console or saved to disk. It can either be...

ACLight

ACLight A tool for advanced discovery of Privileged Accounts - including Shadow Admins. ACLight2 is the improved version of the tool. Shadow Admins Research The tool version 1 was published as part of the "Shadow Admins" research - more details on "Shadow Admins" are in the blog post:...

WiFi-Pineapple-MK7_REST-Client

WIFI PINEAPPLE MARK VII - REST CLIENT The leading rogue access point and WiFi pentest toolkit for close access operations. Passive and active attacks analyze vulnerable and misconfigured devices. https://hak5.org/collections/sale/products/wifi-pineapple Author :: TW-D Version :: 1.3.7 Copyright :...

PowEnum

PowEnum Penetration testers commonly enumerate AD data – providing domain situational awareness and helping to identify soft targets. PowEnum helps automate the cartological view of your target domain. PowEnum executes common PowerSploit Powerview functions and combines the output into a...

Get-RBCD-Threaded

Get-RBCD-Threaded Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments Based almost entirely on wonderful blog posts "Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory" by Elad Shamir and "A Case Study in...

ADLab

AD Penetration Testing Lab Author: @browninfosecguy Version: 1.0 Usage: This Script can be used to configure both Domain Controller and Workstation. OPTIONS APPLICABLE TO SERVER: Option 1: Configure machine name and static IP address for the Domain Controller. Option 2: Install the "Active...

Pentest-Cheat-Sheet

Pentest Cheat Sheet There are many cheat sheets out there, but this is mine. It's a work in progress right now, and lives as a rought draft that's updated a lot , at times. I started this while I was studying for my OSCP, but it's now evolving to include more practical things that I need as a red...

lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

Awesome-RedTeam-Cheatsheet

Red Team Techniques Initial Access Techniques soon Code Execution Techniques soon Lateral Mouvement Techniques soon Evasion Techniques soon Persistence Techniques soon Privilege Escalation Techniques soon Credential Dumping Techniques soon Pivoting Techniques soon Windows Protocols and...

spraykatz

Spraykatz Spray love around the world Index Title| Description ---|--- About| Brief Description about the tool Installation| Installation and Requirements Usage| How to use Spraykatz Changelog| Spraykatz changelog Acknowlegments| Acknowlegments About Spraykatz is a tool without any pretention abl...

PSPKIAudit

PSPKIAudit PowerShell toolkit for auditing Active Directory Certificate Services AD CS. It is built on top of PKISolution's PSPKI toolkit Microsoft Public License. This repo contains a newer version of PSPKI than what's available in the PSGallery see the PSPKI directory. Vadims Podans the creator...

ResetNightmare

ResetNightmare Proof-of-concept POC tool for ResetNightmare CVE-2026-27912. ResetNightmare is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched...

Active-Directory-Exploitation-Cheat-Sheet

Active Directory Cheat Sheet This repository contains a general methodology in the Active Directory environment. It is offered with a selection of quick commands from the most efficient tools based on Powershell, C, .Net 3.5 and .Net 4.5. General Process: Recon Domain Enum Local Privilege...