Ghost

Ghost Framework Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device. Installation pip3 install git+https://github.com/EntySec/Ghost...

hooky

hooky This repository is a submodule for https://github.com/markuta/CVE-2024-32002, which contains a simple hook located in y/hooks/post-checkout to open calculator on macOS systems: open -a Calculator.app More info about the vulnerability can be found here and here...

LogHound

LogHound Post-Exploitation EVTX Analyzer for BloodHound Mapping LogHound collects and parses Windows Security Event Logs .evtx to extract authentication events, session data, and logon metadata for ingestion into BloodHound and for deeper adversarial telemetry. Reasoning & Overview LogHound was...

RSPET

RSPET RSPET Reverse Shell and Post Exploitation Tool is a Python based reverse shell equipped with functionalities that assist in a post exploitation scenario. DISCLAIMER: This software is provided for educational and PenTesting purposes and as a proof of concept. The developers do not endorse,...

PickleC2

PickleC2 PickleC2 is a post-exploitation and lateral movements framework Documentation ReadTheDocs Overview PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements. PickleC2 has the ability to import your own PowerShe...

postenum

Postenum makes life easier for security professionals by automating the process of gathering critical system information after gaining a foothold. It helps quickly spot misconfigurations and privilege escalation opportunities, streamlining the path to deeper access. Built to be lightweight,...

iPwn

iPwn A Framework meant for the exploitation of iOS devices. REMEMBER: THE IPHONE YOU ARE ATTEMPTING TO GET INTO USING THIS TOOL MUST BE JAILBROKEN Status - ❌ This project is still being worked on. I'm adding more extensions and options for post-exploitation for harvesting Device information and...

Pyramid

Pyramid What is it Pyramid is composed of: 1. a Python HTTP/S server that can deliver encrypted files chacha, xor 2. Python modules that can load in-memory dependencies of offensive tooling such as Bloodhound-py, secretsdump, LaZagne, Pythonnet, DonPAPI, pythonmemorymodule, paramiko, pproxy. 3...

MultiDump

MultiDump MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xreous.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offe...

Kraken

Kraken Kraken, a modular multi-language webshell coded by @secux11. Requirements • Support • Install • Usage • Advanced Usage • Contributing • FAQ • Acknowledgments Kraken is a modular multi-language webshell focused on web post-exploitation and defense evasion. It supports three technologies PHP...

redsails

Redsails About A post-exploitation tool capable of: maintaining persistence on a compromised machine subverting many common host event logs both network and account logon generating false logs / network traffic Based on PyDivert https://github.com/ffalcinelli/pydivert, a Python binding for...

SSI-CVE-2022-21661

SSI-CVE-2022-21661 Information System's Security 2nd Assignment Study and exploit the vulnerability CVE-2022-21661 that allows SQL Injections through plugins POST requests to WordPress versions below 5.8.3. Configuring the environment To start and configure the environment, you should just run:...

SCOMDecrypt

SCOMDecrypt - SCOM Credential Decryption Tool Released as open source by NCC Group Plc - http://www.nccgroup.trust/ Developed by Richard Warren, richard dot warren at nccgroup dot trust http://www.github.com/nccgroup/SCOMDecrypt Released under AGPL, see LICENSE for more information Introduction...

react2shell

React2Shell - CVE-2025-55182 Exploit PoC A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY. ❌ DO NOT use against system...

harpyTools

Active Directory Post-Exploitation and Relay Automation Utilities This repository contains a collection of Python orchestrator scripts designed for security assessments and penetration testing within Active Directory environments. These tools are specifically engineered for post-exploitation...

Browser-C2

Browser-C2 Post Exploitation agent which uses a browser to do C2 operations...

phpsploit

Full-featured C2 framework which silently persists on webserver via polymorphic PHP oneliner codeclimate maintainability Created by nil0x42 and contributors !https://assets.kitploit.com/production/public/readmes/320/aca304368ddb35833ee8b1f57c068ae36288119...

PQC-Scanner

The PQC Network Scanner is a purpose‑built assessment tool designed to help organisations understand their cryptographic exposure as they transition toward a post‑quantum security posture. Unlike traditional TLS scanners that focus solely on certificate validity or classical cryptographic strengt...

dump

Dump This repository contains dead/unfinished projects, small scripts or stuff that doesn't deserve a repository of its own. Contents git-gat : post-exploitation script for finding private git repos Infinity dead : find phone number of any Facebook user. json2paths : converts JSON keys to paths f...

vger

V'ger V'ger is an interactive command-line application for post-exploitation of authenticated Jupyter instances with a focus on AI/ML security operations. User Stories As a Red Teamer , you've found Jupyter credentials, but don't know what you can do with them. V'ger is organized in a format that...