phantomrecon

PhantomRecon PhantomRecon is a CLI-based, modular, agent-driven red team automation tool designed to demonstrate autonomous offensive security workflows powered by AI Google's Gemini via Agent Development Kit - ADK. Quick Start CLI Run interactive console metasploit-style: root@kitploit: python -...

Stormspotter

Stormspotter creates an “attack graph” of the resources in an Azure subscription. It enables red teams and pentesters to visualize the attack surface and pivot opportunities within a tenant, and supercharges your defenders to quickly orient and prioritize incident response work. Installation With...

grove

Grove is a Software as a Service SaaS log collection framework, designed to support collection of logs from services which do not natively support log streaming. Grove enables teams to collect security related events from their vendors in a reliable and consistent way. This data may then be store...

InfraGuard

Red team infrastructure tracker and C2 redirector -- a modern alternative to RedWarden. InfraGuard sits between the internet and your C2 teamserver, validating every inbound request against your malleable C2 profile and blocking anything that doesn't conform. Scanners, bots, and blue team probes...

BTPS-SecPack

The Blue Team PowerShell Security Package Using Microsoft Teams for Alerts Instead of Email If you wish to use Microsoft Teams for sending alerts instead of using email you will want to load the microsoft-teams branch for this repository which has the Teams alert modifications. It will take me a...

CloudSec

Cloud Security Toolkit The Art of Cloud Exploitation Welcome to the Cloud Security Toolkit—a specialized resource designed for offensive security researchers, red teamers, and adversaries. This repository is dedicated to the systematic weaponization of vulnerabilities, advanced attack simulations...

agentseal

Security toolkit for AI agents. Red-team prompts, detect MCP poisoning, scan skill files, trace toxic data flows. 225+ tests across 28 agents...

purpleteam

purpleteam CLI CLI component of purpleteam - Currently in alpha Installation Simplest npm install -g purpleteam...

DLPwn

DLPwn Data Leak Prevention via Bluetooth Speaker DLPwn is a Red Team tool designed for file exfiltration to bypass security systems such as EDR Endpoint Detection and Response, XDR Extended Detection and Response, DLP Data Loss Prevention, and more broadly any air-gapped information systems. It...

smokedmeat

SmokedMeat CI/CD Red Team Framework Like Metasploit, but for CI/CD pipelines. From the makers of thepoutine Build Pipeline SAST scanner at BoostSecurity Labs. Warning: This tool is for authorized security testing only. SmokedMeat exists because CI/CD pipeline threats are deeply underestimated...

SauronEye

SauronEye SauronEye is a search tool built to aid red teams in finding files containing specific keywords. Features : Search multiple network drives Search contents of files Search contents of Microsoft Office files .doc, .docx, .xls, .xlsx Find VBA macros in old 2003 .xls and .doc files Search...

Empire

Invoke-Obfuscation v1.8 Introduction Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator. Background In the Fall of 2015 I decided to begin researching the flexibility of PowerShell's language and began cataloguing the various ways to accomplish a handful ...

cve

CVE PoC Almost every publicly available CVE PoC. Current hottest CVEs...

O365-Doppelganger

O365-Doppelganger O365-Doppelganger is NOT a replacement for hardcore phishing activities. There are several other tools which perform OAuth and OTA capture which is not the aim of O365-Doppelganger. O365-Doppelganger is a quick handy script to harvest credentials of a user during Red Teams. This...

Macrome

Macrome An Excel Macro Document Reader/Writer for Red Teamers & Analysts. Blog posts describing what this tool actually does can be found here and here. Installation / Building Clone or download this repository, the tool can then be executed using dotnet - for example: root@kitploit: dotnet run -...

M365Pwned

M365Pwned Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API. Two WinForms GUI tools for enumerating, searching, and exfiltrating data from M365 environments using application-level OAuth tokens — no user interaction required. Tool| Target| What it does ---|---|---...

ezEmu

ezEmu ezEmu enables users to test adversary behaviors via various execution techniques. Sort of like an "offensive framework for blue teamers ", ezEmu does not have any networking/C2 capabilities and rather focuses on creating local test telemetry. Windows See /Linux for ELF ezEmu is compiled as...

reternal-quickstart

RE:TERNAL Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing RE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoint...

JS-Tap

JS-Tap v3.0.4 This tool is intended to be used on systems you are authorized to attack and for legal and educational purposes. Do not use this tool for illegal purposes, or I will be very angry in your general direction. Changelogs Major changes are documented in the project Announcements:...

Preferred-Network-List-Sniffer

Preferred Network List Sniffer - PNLS Preferred Network List Sniffer PNLS is a Red Team Wi-Fi auditing tool with a simple web interface that is capable of intercepting SSIDs1 from the device's preferred network list PNL2. This is achieved by sniffing out Probe Requests in the nearby vicinity, whi...