DropboxC2C

DropboxC2C DropboxC2C is a post-exploitation agent which uses Dropbox Infrastructure for command and control operations. DO NOT USE THIS FOR MALICIOUS PURPOSES. THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OF THIS PROGRAM. Dropbox-C2C is an old project of mine to use a thirdparty for command and...

RTI-Toolkit

RTI-Toolkit Remote Template Injection Toolkit Description RTI-Toolkit is an open-source PowerShell toolkit for Remote Template Injection attack. This toolkit includes a PowerShell script named PS-Templator.ps1 which can be used from both an attacking and defensive perspective. The following table...

LDAPFragger

LDAPFragger LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes. For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes Dependencies a...

apfell-chrome-extension-c2server

apfell-chrome-extension-c2server Apfell C2 Server for the Google Chrome Extension Payload Find the latest version of the chrome extension C2 server in the Apfell framework here: https://github.com/its-a-feature/Apfell...

flask_heroku_redirector

Flask Heroku C2 Sample A simple Python Flask example application that's ready to run on Heroku. Development Setup virtualenv venv source venv/bin/activate pip install -r requirements.txt python app.py Deploy heroku create git push heroku master Setup set port to forward on Defaults to 80: heroku...

brawl-public-game-001

BRAWL One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities. The cheapest method is to test capabilities on a small lab network. But this environment is...

airstrike

AirStrike Stage0 This project is a Stage0 C2 that is highly customizable and can be used to create a template for your own C2 or to use it as a base for your own C2 agents. Currently there are 4 different parts to this project 1. agent is a folder which has two different agents, one is written in...

spamscanner

A spam filter for Node.js, the command line and mail servers. It catches spam, phishing, scams and malware in any language, explains every decision, and can ask a language model about close calls. spamscanner.net · Getting started · Documentation Features A classifier that reads every language...

GC2-sheet

GC2 GC2 Google Command and Control is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or Microsoft SharePoint Document. Why This project has been developed t...

link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction link provides MacOS, Linux and Windows implants which may lack the necessary evasive tradecraft provided by other more matur...

scripts-and-tools

Scripts and Tools 30backups.sh -- Creates and keeps the latest 30 web and SQL backups adig.sh -- DNS, reverse, and name server lookups, as well as any redirect blocklist-submission-forms.html -- Blocklist and abuse submission forms character-classes.txt -- Character classes useful for web malware...

Reverse_DNS_Shell

DNShell v1.7 Description: A Python Reverse Shell that uses DNS as the C2 channel. Requires: dnslib dnspython pycrypto Gotchyas: don't forget to change your HOST don't forget to change your SECRET key run server first Moar Info: http://lockboxx.blogspot.com/2015/01/python-reverse-dns-shell.html...

p0tools

Project Zero Docs and Tools This project contains various documents published by Google Project Zero and small tools that don't need a separate GitHub project. For individual topics, see subdirectories. Disclaimer This is not an official Google product...

CVE-2026-106076

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account...

DeimosC2

DeimosC2 Deimos is in: DEPRECATED DeimosC2 is no longer maintained and has a known XSS vulnerability CVE-2025-26244. Thanks to JaRm222 for identifying the vuln and notifying us. His writeup of the vuln can be foundhere. DeimosC2 is a post-exploitation Command & Control C2 tool that leverages...

GenAI-LLM-Top10

OWASP Top 10 for Large Language Model Applications !IMPORTANT Current release: 2026 — published August 4, 2026. Get the 2026 publication · Read the canonical source · Report a correction This is the official source repository for the OWASP Top 10 for Large Language Model Applications , maintained...

C3

C3 Build C3 MSVC/badge.svg?branch=master Build C3 Clang/badge.svg?branch=master C3 Custom Command and Control is a tool that allows Red Teams to rapidly develop and utilise esoteric command and control channels C2. It's a framework that extends other red team tooling, such as the commercial Cobal...

khaos-c2

KHAØS C2 KHAØS is a modern post-exploitation C2 framework with 5 covert channels and full evasion built in, created by @28Zaaky. See the documentation for full instructions. Why KHAØS Most open-source C2s have one thing in common: they're already in every EDR vendor's database. KHAØS was built wi...

CVE-2026-106076

An SQL injection vulnerability exists in the Veeam Backup for Microsoft 365 server. An authenticated organization-transfer peer can inject SQL commands into the configuration database of the source server. This flaw allows for cross-tenant read and write of configuration data and potentially enab...

EUVD-2026-111123

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account...