Green-Wolf

PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

XSStrike

Most advanced XSS scanner.

evilginx2

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication

subfinder

Fast passive subdomain enumeration tool.

RsaCtfTool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

Modlishka

Modlishka. Reverse Proxy.

security_monkey

Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.

Covenant

Covenant is a collaborative .NET C2 framework for red teamers.

massdns

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

awesome-burp-extensions

A curated list of amazingly awesome Burp Extensions

SILENTTRINITY

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

malice

VirusTotal Wanna Be - Now with 100% more Hipster

Winpayloads

Undetectable Windows Payload Generation

domainhunter

Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names

CredSniper

CredSniper is a phishing framework written with the Python micro-framework Flask and Jinja2 templating which supports capturing 2FA tokens.

CheatSheets

Cheat sheets for various projects.

PrivExchange

Exchange your privileges for Domain Admin privs by abusing Exchange

InveighZero

.NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

dirty_sock

Linux privilege escalation exploit via snapd (CVE-2019-7304)

ODIN

Automated network asset, email, and social media profile discovery and cataloguing.

CredKing

Password spraying using AWS Lambda for IP rotation

OffensiveDLR

Toolbox containing research notes & PoC code for weaponizing .NET's DLR

DoHC2

DoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH).

scavenger

scavenger : is a multi-threaded post-exploitation scanning tool for scavenging systems, finding most frequently used files and folders as well as "interesting" files containing sensitive information.

dockselpy

Dockerized Selenium and Python with support for Chrome, Firefox and PhantomJS

ikeforce

PowerPriv

A Powershell implementation of PrivExchange designed to run under the current user's context

domainGain-dep

Helps with finding and registering categorized domains

Firework

Firework is a proof of concept tool to interact with Microsoft Workplaces creating valid files required for the provisioning process.

FakeAP

Fake access point using dns spoof and ssl stripping