adidnsdump

Active Directory Integrated DNS dump tool By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks. For mo...

Powermad

PowerShell MachineAccountQuota and DNS exploit tools Wiki https://github.com/Kevin-Robertson/Powermad/wiki Blog Post Beyond LLMNR/NBNS Spoofing - Exploiting Active Directory-Integrated DNS Functions MachineAccountQuota Functions DNS Functions Dynamic Updates Functions ADIDNS Functions Miscellaneo...

RSC_Detector

RSC Fingerprint Detector A Chrome extension for detecting React Server Components RSC and Next.js App Router fingerprints on web pages. ⚠️ Important Notice This extension is designed for educational and security research purposes only. It includes functionality that could be used to test for...

adwsdomaindump

ADWSDomainDump Active Directory information dumper via ADWS Active Directory Web Services. Install Recommended install: pipx install git+https://github.com/mverschu/adwsdomaindump or pipx install . Usage adwsdomaindump -u 'corp.local\jsmith' -p 'password' -n 10.0.0.1 dc01.corp.local Connecting to...

bloodyAD

⚠️ autobloody has been moved to its own repo bloodyAD bloodyAD is an Active Directory privilege escalation swiss army knife Description This tool can perform specific LDAP calls to a domain controller in order to perform AD privesc. bloodyAD supports authentication using cleartext passwords,...

CVE-2026-54121

👻 CVE-2026-54121 — CertiGhost Active Directory Certificate Services AD CS Privilege Escalation 👋 Overview CVE-2026-54121 "Certighost" is a high-severity privilege escalation vulnerability affecting Microsoft Active Directory Certificate Services AD CS. The vulnerability allows an authenticated...

jenkins_scan

jenkinsscan Find Jenkins environment and check for CVE-2024-23897 How it works Jenkins Detection Tests the paths: /, /login, /oops, /api/json, /cli, /jenkins/, /jenkins/api/json Identifies via: 1. Header X-Jenkins — most reliable, also returns the version 2. Header X-Hudson — older instances 3...

Vanquish

Vanquish – Get to Shell Vanquish is a Kali Linux based Enumeration Orchestrator built in Python. Vanquish leverages the opensource enumeration tools on Kali to perform multiple active information gathering phases. The results of each phase are fed into the next phase to identify vulnerabilities...

CVE-2023-38831-Exploit

CVE-2023-38831 WinRAR Exploit Generator Created by: technicalcorp This project contains a Python script that exploits CVE-2023-38831 , a vulnerability in WinRAR versions prior to 6.23. The exploit generates a malicious RAR archive that triggers the execution of arbitrary code when the victim open...

aced

Aced Aced is a tool to parse and resolve a single targeted Active Directory principal's DACL. Aced will identify interesting inbound access allowed privileges against the targeted account, resolve the SIDS of the inbound permissions, and present that data to the operator. Additionally, the loggin...

aad-sso-enum-brute-spray

aad-sso-enum-brute-spray POC of SecureWorks' recent Azure Active Directory password brute-forcing vuln Description This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks here is the Ars Technica article that...

cypherhound

CypherHound A Python3 terminal application that contains Neo4j cyphers for BloodHound data sets with a script to automate importing them into BloodHound CE. Output Samples Terminal HTML Report HTML Report continued Why? BloodHound is a staple tool for every penetration tester. However, there are...

name_reverser

== Welcome to Rails Rails is a web-application framework that includes everything needed to create database-backed web applications according to the Model-View-Control pattern. This pattern splits the view also called the presentation into "dumb" templates that are primarily responsible for...

Active-Directory-Exploitation-Cheat-Sheet

Active Directory Exploitation Cheat Sheet This cheat sheet contains common enumeration and attack methods for Windows Active Directory. ℹ️ This repository was created by Nikos Katsiopis and Nikos Vourdas. This cheat sheet is inspired by the PayloadAllTheThings repo. Summary Active Directory...

CVE-2024-2242

CVE-2024-2242 Contact Form 7 history.pushState'', '', '/'; document.forms0.submit;...

CVE-2025-33073

Obscura$ DNS Relay Injector + NTLM Coercion Tool A stealthy proof-of-concept that chains DNS injection, NTLM relay, and RPC-based coercion to test authentication relay paths in Windows Active Directory environments. ⚠️ DISCLAIMER: For authorized security testing and educational use only. ❌...

project-memoria-detector

project-memoria-detector The project-memoria-detector tool aims to determine whether a target network device runs a specific embedded TCP/IP stack. Currently, the tool supports fingerprints for 16 embedded TCP/IP stacks and their variations: uIP, Contiki or Contiki-NG picoTCP or picoTCP-NG Nut/Ne...

GPOddity

GPOddity The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying and more. For more details regarding the attack and a demonstration on how to use the tool, see the associated article available at:...

gpoParser

gpoParser gpoParser is a tool designed to extract and analyze configurations applied through Group Policy Objects GPOs in an Active Directory environment. Since enumerating these settings can be tedious and time-consuming, this tool provides a clearer understanding of applied policies and helps...

CVE-2024-11318

CVE-2024-11318 IDOR - AbsysNet 2.3.1 User Hijacking DISCLAIMER This tool is designed to help identify and exploit whether an application is vulnerable to this specific CVE-2024-11318. It is intended for use by cybersecurity professionals, researchers, and penetration testers to assess security in...