sliver

Sliver Sliver is an open-source, cross-platform adversary emulation and red team framework designed for organizations of all sizes to perform authorized security testing. Sliver implants support command-and-control C2 over Mutual TLS mTLS, WireGuard, HTTPS, and DNS. Implants are dynamically...

Honeypot-for-CVE-2025-59287-WSUS

wsus-decoy Defensive proof of concept decoy for CVE-2025-59287 WSUS. The decoy emulates WSUS web endpoints on ports 8530 and 8531, captures full HTTP request bodies and headers, stores evidence for forensic analysis, and includes a Windows test harness to validate endpoint, file and process...

USB Spy

USB SPY usb-spy is a USB Mass Storage traffic analyzer built around a WiFi or Ethernet-enabled microcontroller. The board exposes a disk image FAT or any filesystem as a fake USB Mass Storage device to a target system, while the actual storage data is provided by a remote server over WiFi or...

pciem

PCIem A Linux kernel framework enabling synthetic userspace PCIe device emulation. | Documentation What is PCIem? PCIem is a framework that creates virtual PCIe devices in the Linux kernel by leveraging a few novel techniques to populate synthetic cards as legitimate PCI devices to the host OS. T...

unidbg

unidbg Allows you to emulate an Android native library, and an experimental iOS emulation. This is an educational project to learn more about the ELF/MachO file format and ARM assembly. Use it at your own risk ! Features Support MCP Model Context Protocol for AI-assisted debugging with Cursor and...

Arduino-Netcat-Backdoor

Arduino - Netcat - Backdoor for Windows Name suggestions welcome. Proof Of Concept. Not intended for real life use. I can't take responsibillity for stuff other people do with this Attacks a Windows machine running Windows 7 or later, creating a persistent Backdoor. Funtionallity The Arduino-scri...

EasyTokens

EasyTokens A device-code phishing server for adversary emulation. Captures Microsoft 365 OAuth tokens via the Device Authorization Grant flow. Inspired by GraphSpy. Warning — Authorized Use Only. This tool is intended for penetration testers and red teamers operating under explicit written...

vmp-lazy-unpack

vmp-lazy-unpack An emulation-based unpacker and import resolver for Windows x64, x32 VMProtect 3.x binaries. The project started as a script used to unpack VMProtect 3 in our devirtualization pipeline. It does this without the need to attach a debugger or dump live. How The project uses Unicorn t...

offensive-security-adversary-emulation

Project 5 — Offensive Security & Adversary Emulation Part of a 5-project home-lab SOC arc: build → detect & enrich → investigate → monitor & hunt → attack & cross-check. This project adds the missing half of the picture from Projects 1–4: everything before this was blue team building detections,...

caldera

Caldera™ Caldera™ is a cyber security platform designed to easily automate adversary emulation, assist manual red-teams, and automate incident response. It is built on the MITRE ATT&CK™ framework and is an active research project at MITRE. The framework consists of two components: 1. The core...

agent-opfor

Open-source adversary emulation for AI agents, LLM apps, and MCP servers. Test your AI like a real attacker would — from your CLI, your IDE, or a browser extension that anyone on your team can use. Website · Docs · GitHub · Browser Extension · Discord OPFOR is short for Opposition Force — a...

APTs-Adversary-Simulation

APTs Adversary Simulation Comprehensive collection of simulated APT attacks based on real world TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly for educational, research, and defensive security purposes only...

Triton

Triton is a dynamic binary analysis library. It provides internal components that allow you to build your program analysis tools, automate reverse engineering, perform software verification or just emulate code. Dynamic symbolic execution Dynamic taint analysis AST representation of the x86 ,...

darling

Quick links Website • Community Discord • Bug Tracker Introduction Darling is a runtime environment that allows running macOS applications on Linux without a virtual machine. It consists of a Mach-O binary loader and a userspace kernel server darlingserver that implements macOS's Mach IPC, POSIX,...

remill

Remill Remill is a static binary translator that translates machine code instructions into LLVM bitcode. It translates AArch64 64-bit ARMv8, SPARC32 SPARCv8, SPARC64 SPARCv9, x86 and amd64 machine code including AVX and AVX512 into LLVM bitcode. AArch32 32-bit ARMv8 / ARMv7 support is underway...

DroppedConnection

DroppedConnection Emulates a Cisco ASA Anyconnect VPN service, accepting any credentials and logging them before serving VBS to the client that gets executed in the context of the user. Blog post:...

facedancer

Facedancer 3.0 This repository houses the next generation of Facedancer software. Descended from the original GoodFET-based Facedancer, this repository provides a python module that provides expanded Facedancer support -- including support for multiple boards and some pretty significant new...

qemu

=========== QEMU README QEMU is a generic and open source machine & userspace emulator and virtualizer. QEMU is capable of emulating a complete machine in software without any need for hardware virtualization support. By using dynamic translation, it achieves very good performance. QEMU can also...

atomic-red-team

Atomic Red Team Atomic Red Team™ is a library of tests mapped to the MITRE ATT&CK® framework. Security teams can use Atomic Red Team to quickly, portably, and reproducibly test their environments. Get started You can execute atomic tests directly from the command line, no installation required. S...

stratus-red-team

Stratus Red Team Stratus Red Team is "Atomic Red Team™" for the cloud, providing granular and self-contained emulation of offensive attack techniques. Announcement blog posts: https://www.datadoghq.com/blog/cyber-attack-simulation-with-stratus-red-team/...