AD-description-password-finder

AD description password finder The purpose of this tool is to check if passwords are stored in clear text in the description of Active Directory accounts. The requirements are : having a copy of the ntds.dit and SYSTEM hive If you don't have python, you can use the .exe version of the scripts in...

OSCP

OSCP OSCP Study Guide Table of Contents Enumeration and Recon Web Enumeration Nikto scanning: root@kitploit: nikto -h http://10.10.10.1 Directory busting with different tools: DIRB root@kitploit: dirb http://10.10.10.1 Gobuster root@kitploit: gobuster dir -u http://10.129.155.74:3000 -w...

krackattacks-scripts

This project contains scripts to test if clients or access points APs are affected by the KRACK attack against WPA2. For details behind this attack see our website and the research paper. Remember that our scripts are not attack scripts! You will need the appropriate network credentials in order ...

TornadoRevC2

TornadoRevC2 A lightweight, modular post-exploitation framework for authorized security research, red-team operations, and penetration testing. TornadoRevC2 manages reverse shell sessions on Linux and Windows hosts through a unified operator console, extending core session handling with a...

Metasploit-Red-Pentest-Lab

Metasploit-Red-Pentest-Lab Lab exercise involving exploitation of the vsftpd 2.3.4 vulnerability CVE-2011-2523 on Metasploitable 2 and post-exploitation steps...

Heroinn

Heroinn A cross platform C2/post-exploitation framework implementation by Rust. This project is for research and study purposes only, and any illegal behavior using this project has nothing to do with this project. Features GUI Interactive PTY shell System infomations collect File manager support...

SQLRecon

SQLRecon SQLRecon is a Microsoft SQL Server toolkit that is designed for offensive reconnaissance and post-exploitation. For detailed information on how to use each technique, refer to the wiki. You can download a copy of SQLRecon from the releases page. Alternatively, feel free to compile the...

TokenMan

Access and Refresh Token Suite. Token Man is a tool for supporting post-exploitation activities using AAD access and/or refresh tokens. Table of Contents Usage Commands Fetch Search Swap FOCI Application Client ID Map AZ OAuth Usage root@kitploit: usage: tokenman.py -h fetch,search,swap,az,oauth...

Dragnmove

Dragnmove Dragnmove is a post-exploitaition tool that infects files shared between users in order to move from one system to another. Dragnmove can detect actions like dropping a file into the browser window or attaching a file to an email client. After Dragnmove detects the action, it hooks...

StopDefender

StopDefender Stop Windows Defender programmatically creating a new token using TrustedInstaller and Windefend service accounts. One button stop action, no need for supply commandline options nor pid. Usefull for integration with Post Explotation frameworks. Blogpost...

wwwolf-php-webshell

wwwolf's PHP web shell I frequently encountered issues when using other web shells: They use new PHP syntax features not compatible with the old PHP version running on some targets. They make wrong assumption on the remote URL, breaking PHP code injection or GET parameters unexpected by the serve...

NewPowerDNS

NewPowerDNS NewPowerDNS 是 @domchell 的 PowerDNS 的更新版本。新增的主要功能是支持使用 DNS A 记录传输文件。以下是所做修改的完整列表： 支持通过 DNS A 记录传输 Gzip 压缩以减小文件传输体积 支持传输所有类型的文件 新的 stager，可轻松混淆或逐行运行，以绕过 AV/EDR 的拦截 可选择打印、执行或保存传输的文件 从 python2 更新到 python3 除 python3 外，唯一的依赖项是 scapy。可通过 pip 轻松安装，如下所示： root@kitploit: python3 -m pip install...

pth-toolkit

pth-toolkit 这是对 passing-the-hash 工具集 https://code.google.com/p/passing-the-hash/ 的修改版本，旨在实现便携式运行，即使是在最“精简”的系统上也能开箱即用。 master 分支为 amd64 架构编译，最终目标是将这些工具交叉编译到所有可能的架构上。 目前该仓库提供以下修补过的工具/实用程序： winexe wmic wmis rpcclient smbclient smbget net 依赖 sh 所有工具都在仅安装了 base 软件包的 Arch Linux 精简安装上测试通过。 什么时候有用？...

metasploitable-pentest-lab

Exploitation of vulnerabilities in Metasploitable Complete cycle of a real attack on a controlled and isolated environment: lab preparation, reconnaissance with nmap, attack surface prioritization, mapping to CVE, exploitation with Metasploit, post-exploitation, credential extraction and cracking...

Pentest-Command

项目背景 在渗透测试过程中我们会使用到各类的框架，例如:MSF、CS、Empire、Impacket等，本项目的主要目的是收录在后渗透测试阶段中常用到的命令 基础知识 Windows目录介绍 a、开机启动程序目录c C:\Users\Al1ex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup root@kitploit: b、开机自启动程序该特色常被用于进行权限维持c C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup c. System...

Monitor

Project Description Used for implementing privilege persistence during the post-exploitation testing phase Project Usage Step 1 : Download the project, then compile Monitor.cpp using VS. Of course, you can also use the pre-compiled one. The Monitor.cpp code is as follows: root@kitploit: include...

ncentral-compromise-ioc-triage

N-central Compromise IoC Triage Read-only defensive hunting toolkit for post-exploitation artifacts associated with N-able N-central authentication bypass vulnerabilities CVE-2026-18556 and CVE-2026-18577. The PowerShell endpoint scanner flags indicators published by N-able and Huntress; it never...

Cable

Cable Cable is a post-exploitation tool used for reconnaissance and Discretionary Access Control List DACL focused exploitation of an Active Directory environment. This tool was primarily created to learn more about .NET offensive development in an Active Directory context, while hoping to expand...

loot-me

linux-loot Post Exploit Report Generation. Grabs files / commands and puts them in markdown ready for reporting and assists in finding sensitive information...

offensive-security-adversary-emulation

项目 5 — 进攻性安全与对手模拟 5 个项目组成的家庭实验室 SOC 系列的一部分：构建 → 检测与富化 → 调查 → 监控与狩猎 → 攻击与交叉验证。 本项目补全了项目 1–4 缺失的另一半图景：此前的内容全部属于蓝队（构建检测规则、调查事件、在网络数据中狩猎）。而本项目让我站到攻击者一侧——针对一个真实且有文档记录漏洞进行侦察、利用和后渗透——然后再回到现有 SOC，评估它究竟捕获到了什么。 概述 | ---|--- 目标| Metasploitable2（刻意存在漏洞的 Linux 虚拟机） 漏洞| vsftpd 2.3.4 后门 — CVE-2011-2523 使用工具|...