Red Teaming Toolkit



This repository contains cutting-edge open-source security tools (OST) that will help you during adversary simulation and as information intended for threat hunter can make detection and prevention control easier. The list of tools below that could be potentially misused by threat actors such as APT and Human-Operated Ransomware (HumOR). If you want to contribute to this list send me a pull request.


RustScanThe Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting engine (Python, Lua, Shell supported).
AmassIn-depth Attack Surface Mapping and Asset Discovery
gitleaksGitleaks is a SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repos.
S3ScannerScan for open S3 buckets and dump the contents
cloud_enumMulti-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.
Recon-ngOpen Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.
busterAn advanced tool for email reconnaissance
linkedin2usernameOSINT Tool: Generate username lists for companies on LinkedIn
WitnessMeWeb Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.
pagodopagodo (Passive Google Dork) – Automate Google Hacking Database scraping and searching
AttackSurfaceMapperAttackSurfaceMapper is a tool that aims to automate the reconnaissance process.
SpiderFootSpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.
dnscandnscan is a python wordlist-based DNS subdomain scanner.
spoofcheckA program that checks if a domain can be spoofed from. The program checks SPF and DMARC records for weak configurations that allow spoofing.
LinkedIntLinkedIn Recon Tool

Initial Access

Brute Force

SprayingToolkitScripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient
o365reconRetrieve information via O365 with a valid cred

Payload Development

PEzorOpen-Source PE Packer
GadgetToJScriptA tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA scripts.
ScareCrowPayload creation framework designed around EDR bypass.
DonutDonut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
MystikalmacOS Initial Access Payload Generator
charlottec++ fully undetected shellcode launcher 😉
InvisibilityCloakProof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project.
DendrobateDendrobate is a framework that facilitates the development of payloads that hook unmanaged code through managed .NET code.
Offensive VBA and XLS EntanglementThis repo provides examples of how VBA can be used for offensive purposes beyond a simple dropper or shell injector. As we develop more use cases, the repo will be updated.
xlsGenTiny Excel BIFF8 Generator, to Embedded 4.0 Macros in *.xls
darkarmourWindows AV Evasion
InlineWhispersTool for working with Direct System Calls in Cobalt Strike’s Beacon Object Files (BOF)
EvilClippyA cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.
OfficePurgeVBA purge your Office documents with OfficePurge. VBA purging removes P-code from module streams within Office documents.
ThreatCheckIdentifies the bytes that Microsoft Defender / AMSI Consumer flags on.
CrossC2Generate CobaltStrike’s cross-platform payload
RulerRuler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol.
DueDLLigenceShellcode runner framework for application whitelisting bypasses and DLL side-loading. The shellcode included in this project spawns calc.exe.
RuralBishopRuralBishop is practically a carbon copy of UrbanBishop by b33f, but all P/Invoke calls have been replaced with D/Invoke.
TikiTorchTikiTorch was named in homage to CACTUSTORCH by Vincent Yiu. The basic concept of CACTUSTORCH is that it spawns a new process, allocates a region of memory, then uses CreateRemoteThread to run the desired shellcode within that target process. Both the process and shellcode are specified by the user.
SharpShooterSharpShooter is a payload creation framework for the retrieval and execution of arbitrary CSharp source code. SharpShooter is capable of creating payloads in a variety of formats, including HTA, JS, VBS and WSF.
SharpSploitSharpSploit is a .NET post-exploitation library written in C#
MSBuildAPICallerMSBuild Without MSBuild.exe
macro_packmacro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of MS Office documents, VB scripts, and other formats for pentest, demo, and social engineering assessments.
inceptorTemplate-Driven AV/EDR Evasion Framework



o365-attack-toolkitA toolkit to attack Office365
Evilginx2Evilginx2 is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service.
GophishGophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.
PwnAuthPwnAuth a web application framework for launching and managing OAuth abuse campaigns.
ModlishkaModlishka is a flexible and powerful reverse proxy, that will take your ethical phishing campaigns to the next level.

Watering Hole Attack

BeEFBeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser

Command and Control

Remote Access Tools (RAT)

Cobalt StrikeCobalt Strike is software for Adversary Simulations and Red Team Operations.
EmpireEmpire 3 is a post-exploitation framework that includes a pure-PowerShell Windows agent, and compatibility with Python 3.x Linux/OS X agents.
PoshC2PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.
KoadicKoadic C3 COM Command & Control – JScript RAT
merlinMerlin is a cross-platform post-exploitation Command & Control server and agent written in Go.
MythicA cross-platform, post-exploit, red teaming framework built with python3, docker, docker-compose, and a web browser UI.
CovenantCovenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.
shad0wA post exploitation framework designed to operate covertly on heavily monitored environments
SliverSliver is a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS.
SILENTTRINITYAn asynchronous, collaborative post-exploitation agent powered by Python and .NET’s DLR
PupyPupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python


pwndropSelf-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.
C2concealerA command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.
FindFrontableDomainsSearch for potential frontable domains
Domain HunterChecks expired domains for categorization/reputation and history to determine good candidates for phishing and C2 domain names
RedWardenFlexible CobaltStrike Malleable Redirector
AzureC2RelayAzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile.
C3C3 (Custom Command and Control) is a tool that allows Red Teams to rapidly develop and utilise esoteric command and control channels (C2).
ChameleonA tool for evading Proxy categorisation
Cobalt Strike Malleable C2 Design and Reference GuideCobalt Strike Malleable C2 Design and Reference Guide
redirect.rulesQuick and dirty dynamic redirect.rules generator

Log Aggregation

RedELKRed Team’s SIEM – tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.
Elastic for Red TeamingRepository of resources for configuring a Red Team SIEM using Elastic.

Situational Awareness

Host Situational Awareness

AggressiveProxyAggressiveProxy is a combination of a .NET 3.5 binary (LetMeOutSharp) and a Cobalt Strike aggressor script (AggressiveProxy.cna). Once LetMeOutSharp is executed on a workstation, it will try to enumerate all available proxy configurations and try to communicate with the Cobalt Strike server over HTTP(s) using the identified proxy configurations.
GopherC# tool to discover low hanging fruits
SharpEDRCheckerChecks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories, installed services and each service binaries metadata, installed drivers and each drivers metadata, all for the presence of known defensive products such as AV’s, EDR’s and logging tools.
Situational Awareness BOFThis Repo intends to serve two purposes. First it provides a nice set of basic situational awareness commands implemented in BOF.
SeatbeltSeatbelt is a C# project that performs a number of security oriented host-survey “safety checks” relevant from both offensive and defensive security perspectives.
SauronEyeSauronEye is a search tool built to aid red teams in finding files containing specific keywords.
SharpSharesMultithreaded C# .NET Assembly to enumerate accessible network shares in a domain
SharpAppLockerC# port of the Get-AppLockerPolicy PowerShell cmdlet with extended features. Includes the ability to filter and search for a specific type of rules and actions.
SharpPrinterPrinter is a modified and console version of ListNetworks

Domain Situational Awareness

StandInStandIn is a small AD post-compromise toolkit. StandIn came about because recently at xforcered we needed a .NET native solution to perform resource based constrained delegation.
Recon-ADAn AD recon tool based on ADSI and reflective DLL’s
BloodHoundSix Degrees of Domain Admin
PSPKIAuditPowerShell toolkit for auditing Active Directory Certificate Services (AD CS).
SharpViewC# implementation of harmj0y’s PowerView
RubeusRubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpy’s Kekeo project (CC BY-NC-SA 4.0 license) and Vincent LE TOUX’s MakeMeEnterpriseAdmin project (GPL v3.0 license).
GrouperA PowerShell script for helping to find vulnerable settings in AD Group Policy. (deprecated, use Grouper2 instead!)
ImproHoundIdentify the attack paths in BloodHound breaking your AD tiering
ADReconADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.
ADCSPwnA tool to escalate privileges in an active directory network by coercing authenticate from machine accounts (Petitpotam) and relaying to the certificate service.

Credential Dumping

MimikatzMimikatz is an open-source application that allows users to view and save authentication credentials like Kerberos tickets.
DumpertLSASS memory dumper using direct system calls and API unhooking.
CredBanditCredBandit is a proof of concept Beacon Object File (BOF) that uses static x64 syscalls to perform a complete in memory dump of a process and send that back through your already existing Beacon communication channel.
CloneVaultCloneVault allows a red team operator to export and import entries including attributes from Windows Credential Manager.
SharpLAPSRetrieve LAPS password from LDAP
SharpDPAPISharpDPAPI is a C# port of some DPAPI functionality from @gentilkiwi’s Mimikatz project.
KeeThiefAllows for the extraction of KeePass 2.X key material from memory, as well as the backdooring and enumeration of the KeePass trigger system.
SafetyKatzSafetyKatz is a combination of slightly modified version of @gentilkiwi’s Mimikatz project and @subtee’s .NET PE Loader.
forkatzcredential dump using forshaw technique using SeTrustedCredmanAccessPrivilege
PPLKillerTool to bypass LSA Protection (aka Protected Process Light)
LaZagneThe LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer.
AndrewSpecialAndrewSpecial, dumping lsass’ memory stealthily and bypassing “Cilence” since 2019.
Net-GPPPassword.NET implementation of Get-GPPPassword. Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
SharpChromium.NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.
ChloniumChlonium is an application designed for cloning Chromium Cookies.
SharpCloudSharpCloud is a simple C# utility for checking for the existence of credential files related to Amazon Web Services, Microsoft Azure, and Google Compute.
pypykatzMimikatz implementation in pure Python. At least a part of it 🙂

Privilege Escalation

ElevateKitThe Elevate Kit demonstrates how to use third-party privilege escalation attacks with Cobalt Strike’s Beacon payload.
WatsonWatson is a .NET tool designed to enumerate missing KBs and suggest exploits for Privilege Escalation vulnerabilities.
SharpUpSharpUp is a C# port of various PowerUp functionality. Currently, only the most common checks have been ported; no weaponization functions have yet been implemented.
dazzleUPA tool that detects the privilege escalation vulnerabilities caused by misconfigurations and missing updates in the Windows operating systems. dazzleUP detects the following vulnerabilities.
PEASSPrivilege Escalation Awesome Scripts SUITE (with colors)
SweetPotatoA collection of various native Windows privilege escalation techniques from service accounts to SYSTEM

Defense Evasion

unDefenderKilling your preferred antimalware by abusing native symbolic links and NT paths.
BackstabA tool to kill antimalware protected processes
SPAWN – Cobalt Strike BOFCobalt Strike BOF that spawns a sacrificial process, injects it with shellcode, and executes payload. Built to evade EDR/UserLand hooks by spawning sacrificial process with Arbitrary Code Guard (ACG), BlockDll, and PPID spoofing.
BOF.NET – A .NET Runtime for Cobalt Strike’s Beacon Object FilesBOF.NET is a small native BOF object combined with the BOF.NET managed runtime that enables the development of Cobalt Strike BOFs directly in .NET. BOF.NET removes the complexity of native compilation along with the headaches of manually importing native API.
NetLoaderLoads any C# binary from filepath or url, patching AMSI and bypassing Windows Defender on runtime
FindObjects-BOFA Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.
SharpUnhookerC# Based Universal API Unhooker – Automatically Unhook API Hives (ntdll.dll,kernel32.dll,user32.dll,advapi32.dll,and kernelbase.dll).
EvtMuteApply a filter to the events being reported by windows event logging
InlineExecute-AssemblyInlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module
Phant0mWindows Event Log Killer
SharpBlockA method of bypassing EDR’s active projection DLL’s by preventing entry point execution.
NtdllUnpatcherExample code for EDR bypassing, please use this for testing blue team detection capabilities against this type of malware that will bypass EDR’s userland hooks.
DarkLoadLibraryLoadLibrary for offensive operations.
BlockETW.Net 3.5 / 4.5 Assembly to block ETW telemetry in a process
firewalkerThis repo contains a simple library which can be used to add FireWalker hook bypass capabilities to existing code


SharpStay.NET project for installing Persistence
SharPersistWindows persistence toolkit written in C#.
SharpHideTool to create hidden registry keys.
DoUCMeThis leverages the NetUserAdd Win32 API to create a new computer account. This is done by setting the usri1_priv of the USER_INFO_1 type to 0x1000.
A Black Path Toward The Sun(TCP tunneling over HTTP for web application servers)
pivotnacciA tool to make socks connections through HTTP agents
reGeorgThe successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.
DAMPThe Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification.
IIS-RaidA native backdoor module for Microsoft IIS (Internet Information Services)
SharPyShelltiny and obfuscated ASP.NET webshell for C# web applications

Lateral Movement

Liquid SnakeLiquidSnake is a tool that allows operators to perform fileless lateral movement using WMI Event Subscriptions and GadgetToJScript
PowerUpSQLA PowerShell Toolkit for Attacking SQL Server
SharpRDPRemote Desktop Protocol Console Application for Authenticated Command Execution
MoveKitMovekit is an extension of built in Cobalt Strike lateral movement by leveraging the execute_assembly function with the SharpMove and SharpRDP .NET assemblies.
SharpNoPSExecFile less command execution for lateral movement.
Responder/MultiRelayLLMNR/NBT-NS/mDNS Poisoner and NTLMv1/2 Relay.
impacketImpacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself.
FarmerFarmer is a project for collecting NetNTLM hashes in a Windows domain.
CIMplantC# port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user’s session.
PowerLessShellPowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. You can also execute raw shellcode using the same approach.
SharpGPOAbuseSharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user’s edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
kerbruteA tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication
mssqlproxymssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse
Invoke-TheHashPowerShell Pass The Hash Utils
InveighZero.NET IPv4/IPv6 machine-in-the-middle tool for penetration testers
SharpSpraySharpSpray a simple code set to perform a password spraying attack against all users of a domain using LDAP and is compatible with Cobalt Strike.
CrackMapExecA swiss army knife for pentesting networks
SharpAllowedToActA C# implementation of a computer object takeover through Resource-Based Constrained Delegation (msDS-AllowedToActOnBehalfOfOtherIdentity) based on the research by @elad_shamir.
SharpRDPHijackSharp RDP Hijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions
CheeseToolsThis repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them.
SharpSpraySharpSpray is a Windows domain password spraying tool written in .NET C#.


SharpExfiltrateModular C# framework to exfiltrate loot over secure and trusted channels.
DNSExfiltratorData exfiltration over DNS request covert channel
Egress-AssessEgress-Assess is a tool used to test egress data detection capabilities.



Amazon Web Services (AWS)

pacuThe AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
CloudMapperCloudMapper helps you analyze your Amazon Web Services (AWS) environments.
Enumerate IAM permissionsEnumerate the permissions associated with AWS credential set


Azure AD Connect password extractionThis toolkit offers several ways to extract and decrypt stored Azure AD and Active Directory credentials from Azure AD Connect servers.
Storm SpotterAzure Red Team tool for graphing Azure and Azure Active Directory objects
ROADtoolsThe Azure AD exploration framework.
MicroBurst: A PowerShell Toolkit for Attacking AzureA collection of scripts for assessing Microsoft Azure security
AADInternalsAADInternals PowerShell module for administering Azure AD and Office 365

Adversary Emulation

Prelude OperatorA Platform for Developer-first advanced security· Defend your organization by mimicking real adversarial attacks.
CalderaAn automated adversary emulation system that performs post-compromise adversarial behavior within Windows Enterprise networks.
APTSimulatorA Windows Batch script that uses a set of tools and output files to make a system look as if it was compromised.
Atomic Red TeamSmall and highly portable detection tests mapped to the Mitre ATT&CK Framework.
Network Flight Simulatorflightsim is a lightweight utility used to generate malicious network traffic and help security teams to evaluate security controls and network visibility.
MettaA security preparedness tool to do adversarial simulation.
Red Team Automation (RTA)RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK.

Red Team Scripts

RedTeamCCodeRed Team C code repo
EDRsThis repo contains information about EDRs that can be useful during red team exercise.
Cobalt Strike Community KitCommunity Kit is a central repository of extensions written by the user community to extend the capabilities of Cobalt Strike.

The Red Teaming Toolkit is a github repository by superzerosec