Network-Filesystem-Forensics

Network and Filesystem Forensics Reports on post-exploitation on honeypot exploiting vulnerable wu-ftpd CVE-2001-0550...

PoshC2

PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement. PoshC2 is primarily written in Python3 and follows a modular format to enable users to add their own modules and tools, allowing an extendible and flexible C2 framework...

DanderSpritz_lab

DanderSpritz Lab Purpose The goal of DanderSpritz lab is to allow researchers and defenders to quickly stand up a fully functional version of DanderSpritz - The Equation Group's Post exploitation tool-set and a Windows Server 2008 Domain and client as targets. The Windows target have some reverse...

PowerUpSQL

PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also...

merlin

Merlin Merlin is a cross-platform post-exploitation Command & Control server and agent written in Go. Highlighted features: merlin-cli command line interface over gRPC to connect to the Merlin Server facilitating multi-user support Supported Agent C2 Protocols: http/1.1 clear-text, http/1.1 over...

AlanFramework

Alan Framework Alan Framework is a post-exploitation framework useful during red-team activities. If you find my tool useful, please consider tosponsor me. ⚠⚠⚠ Disclaimer ⚠⚠⚠ The creation of this kind of software has always caused controversies. If you're wondering why I decided to create this...

FFM

Freedom Fighting Mode FFM FFM is a hacking harness that you can use during the post-exploitation phase of a red-teaming engagement. The idea of the tool was derived from a 2007 conference from @thegrugq. It was presented at SSTIC 2018 video and the accompanying slide deck is available at this url...

EvilOSX

EvilOSX A pure python, post-exploitation, remote administration tool RAT for macOS / OS X. Features Emulate a simple terminal instance. Sockets are encrypted with CSR via OpenSSL. No dependencies pure python. Persistence. Auto installer, simply run EvilOSX on the target and the rest is handled...

Pyramid

Pyramid What is it Pyramid is composed of: 1. a Python HTTP/S server that can deliver encrypted files chacha, xor 2. Python modules that can load in-memory dependencies of offensive tooling such as Bloodhound-py, secretsdump, LaZagne, Pythonnet, DonPAPI, pythonmemorymodule, paramiko, pproxy. 3...

swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

PeekABoo

PeekABoo PeekABoo tool can be used during internal penetration testing when a user needs to enable Remote Desktop on the targeted machine. It uses PowerShell remoting to perform this task. The tool only works if WinRM is enabled. Since Windows Server 2012 WinRM is enabled by default on all Window...

pwncat

pwncat pwncat is a post-exploitation platform for Linux targets. It started out as a wrapper around basic bind and reverse shells and has grown from there. It streamlines common red team operations while staging code from your attacker machine, not the target. pwncat used to only support Linux, b...

khaos-c2

KHAØS C2 KHAØS is a modern post-exploitation C2 framework with 5 covert channels and full evasion built in, created by @28Zaaky. See the documentation for full instructions. Why KHAØS Most open-source C2s have one thing in common: they're already in every EDR vendor's database. KHAØS was built wi...

Credential-Hunting

CredsHunter credshunter is a read-only credential finder for authorized post-exploitation. It walks a host once and surfaces the secrets you can actually reuse — passwords, keys, hashes, and credential files — while staying quiet on the cloud / SaaS tokens that only add noise. Two siblings, one...

conquest

Conquest is a feature-rich, extensible and malleable command & control/post-exploitation framework developed for penetration testing and adversary simulation. Conquest's team server, operator client and agent have all been developed using the Nim programming language and are designed with...

Forensia

Forensia Anti Forensics Tool For Red Teamers, Used For Erasing Some Footprints In The Post Exploitation Phase. Reduces Payload Burnout And Increases Detection Countdown. Can Be Used To Test The capabilities of Your Incident Response / Forensics Teams. Capabilities Unloading Sysmon Driver. Gutmann...

kubesploit

Kubesploit Kubesploit is a cross-platform post-exploitation HTTP/2 Command & Control server and agent dedicated for containerized environments written in Golang and built on top of Merlin project by Russel Van Tuyl @Ne0nd0g. Our Motivation While researching Docker and Kubernetes, we noticed that...

emp3r0r

emp3r0r A self-healing, memory-only C2 for Linux and Windows — agents that survive broken links, never touch disk, and script their way through the Win32 API. What is emp3r0r? emp3r0r is a post-exploitation framework and C2 built for Linux and Windows environments where stealth and resilience...

Amnesiac

Amnesiac Amnesiac is a post-exploitation framework designed to assist with lateral movement within active directory environments. Amnesiac is being developed to bridge a gap on Windows OS, where post-exploitation frameworks are not readily available unless explicitly installed. In fact, it is...

SQLRecon

SQLRecon SQLRecon is a Microsoft SQL Server toolkit that is designed for offensive reconnaissance and post-exploitation. For detailed information on how to use each technique, refer to the wiki. You can download a copy of SQLRecon from the releases page. Alternatively, feel free to compile the...