ADLab

AD Penetration Testing Lab Author: @browninfosecguy Version: 1.0 Usage: This Script can be used to configure both Domain Controller and Workstation. OPTIONS APPLICABLE TO SERVER: Option 1: Configure machine name and static IP address for the Domain Controller. Option 2: Install the "Active...

Kestrel

Kestrel BloodHound shows you the path. Kestrel shows you what's already inside. Everyone maps the same thing: the attack path - who can reach Domain Admin. It's the right question, and the tools that answer it are excellent. But a graph of "who can reach whom" is blind to an entire class of...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

CVE-2025-54918-POC

CVE-2025-54918 – Proof of Concept PoC ⚠️ Important Notice IMPORTANT: To test CVE-2025-54918 , you must create a DNS record in the target Active Directory environment. Always consult with the client and obtain explicit authorization before testing, as this can impact DNS and authentication behavior...

WEBFANG

WEBFANG v2.0 Disclaimer: Webfang is a CLI developed and engineered as a Reconnaissance toolkit for ethical hackers, blue teamers, and red teamers. It performs passive and active reconnaissance using spidering, Subdomain Scanning, WHOIS, DNS, Shodan, and header fingerprinting. WEBFANG is intended...

Masky

Masky Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability...

adnullenum

adnullenum A single-pass Active Directory enumerator for an anonymous null session, using the \samr and \lsarpc named pipes. No credentials required. It doesn't do anything the classic tools can't. What it does is gather it all in one run and lay the results out cleanly. On an engagement you land...

Detailed-Analysis-and-Mitigation-Strategies-for-CVE-2024-38124-and-CVE-2024-43468

Detailed-Analysis-and-Mitigation-Strategies-for-CVE-2024-38124-and-CVE-2024-43468 Detailed Analysis and script Mitigation Strategies for CVE-2024-38124 and CVE-2024-43468 CVE-2024-38124: Windows Netlogon Technical Exploitation Context: In a real-world scenario, an attacker with access to the...

C2-Tool-Collection

Outflank - C2 Tool Collection This repository contains a collection of tools which integrate with Cobalt Strike and possibly other C2 frameworks through BOF and reflective DLL loading techniques. These tools are not part of our commercial OST product and are written with the goal of contributing ...

mimicry

Mimicry Mimicry Mimicry is a security tool developed by Chaitin Technology for active deception in exploitation and post-exploitation. Active deception can live migrate the attacker to the honeypot without awareness. We can achieve a higher security level at a lower cost with Active deception...

ADLab

ADLab PowerShell Module Introduction The purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing. Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. Instructions...

CVE-2024-49019-rayng

Exploiting CVE-2024-49019: Certificate Authority Privilege Escalation Overview CVE-2024-49019 is a vulnerability in Active Directory Certificate Services AD CS that allows an attacker to escalate privileges by misusing certificate-based authentication. This guide demonstrates how to exploit this...

Symfony-CVE-Scanner-PoC-

Symfony Vulnerability Scanner Automated scanning tool to detect multiple known vulnerabilities CVE in Symfony applications exposed to the Internet. Developed by m10sec. Features 🔍 Detection of multiple vulnerabilities in Symfony : Validation of Symfony vulnerabilities ✅ Real exploitation validati...

raven

Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Structure Offline - Demo Firefox, Chrome or Safari Live - Regression 500 attacks at onc...

CVE-2026-23550

CVE-2026-23550 Modular DS header'User-Agent'; $userAgentMatches = $userAgent && Str::is'ModularConnector/ Linux', $userAgent; $originQuery = $request-has'origin' && $request-get'origin' === 'mo'; $isFromQuery = $originQuery || $userAgentMatches && $request-has'type'; // When is wp-load.php reques...

CVE-2025-4322-Exploit

CVE-2025-4322 - Unverified Password Change CWE-620 Exploit: Download here Details CVE ID : CVE-2025-4322 Published : 05/20/2025 Impact : Critical CVSS : 9.8 Patch Available: No official patch yet Impact Critical severity vulnerability that enables attackers to potentially: - Escape the browser's...

cve-2020-1472_Tool-collection

Introduction article https://www.yuque.com/shamo-vs4ia/vul/ktduf8 Environmental preparation pip3 install -r requirements.txt Vulnerability detection python3 zerologontester.py ad adip Exploit python CVE-2020-1472.py AD AD$ adip secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0...

Spray

Spray A Password Spraying tool for Active Directory Credentials by Jacob WilkinGreenwolf Getting Started These instructions will show you the requirements for and how to use Spray. Prerequisites All requirements come preinstalled on Kali Linux, to run on other flavors or Mac just make sure curlow...

GPOCrack

GPOCRACK.py Active Directory Group Policy Preferences cpassword cracker/decrypter. How to use python2 gpocrack.py cGc4817iMQclr1Ssixv35UpaH/FXy+1s5FnM2RqD4BI...

KerberosRun

KerberosRun KerberosRun is a little tool I use to study AD security together with my ADCollector. KerberosRun uses the Kerberos.NET library built by Steve Syfuhs. Some code were taken and adapted from Harmj0y's Rubeus project. dev2null is the primary author of this project. My colleague Constanti...