beligue

NotSwiftOnSecurity

Modified version of SwiftOnSecurity, in order to enable in-depth collection to aide deliberate hunting and incident response.

HELK

The Hunting ELK

sof-elk

Configuration files for the SOF-ELK VM

caldera

Automated Adversary Emulation Platform

EVTX-ATTACK-SAMPLES

Windows Events Attack Samples

AtomicRedteam

DSCompromised

ExchangeRelayX

An NTLM relay tool to the EWS endpoint for on-premise exchange servers. Provides an OWA for hackers.

Match-ADHashes

Builds a hashmap of AD NTLM hashes/usernames and iterates through a second list of hashes checking for the existence of each entry in the AD NTLM hashmap

five_oh_noes

repo for ssid/mac based police body camera scanner

CredKing

Password spraying using AWS Lambda for IP rotation

pinky

pinky - The PHP mini RAT (Remote Administration Tool)

SecLists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

statistically-likely-usernames

Wordlists for creating statistically likely username lists for use in password attacks and security testing

Inception

Provides In-memory compilation and reflective loading of C# apps for AV evasion.

LOLBAS

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

malware-ioc

Indicators of Compromises (IOC) of our various investigations

WMImplant

This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.

Mythic

A collaborative, multi-platform, red teaming framework

One-Lin3r

Gives you one-liners that aids in penetration testing operations, privilege escalation and more

metasploit-framework

Metasploit Framework

ADRecon

ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.

Responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

wifijammer

Continuously jam all wifi clients/routers

EagleEye

Stalk your Friends. Find their Instagram, FB and Twitter Profiles using Image Recognition and Reverse Image Search.

OpenPasswordFilter

An open source custom password filter DLL and userspace service to better protect / control Active Directory domain passwords.

Magic-Unicorn-Tool

GetVulnerableGPO

PowerShell script to find 'vulnerable' security-related GPOs that should be hardended

Red-Team-Infrastructure-Wiki

Wiki to collect Red Team infrastructure hardening resources

C2Kv2

Updated version of C2K