Offensive Ops
52 tools indexed
Red team and offensive operations tooling including C2 frameworks, evasion techniques, lateral movement utilities, and specialized attack tools. Built for authorized penetration testing and adversary simulation exercises.
Mythic
Collaborative, multi-platform C2 framework. Docker-based with web UI, multiple agent types, and plugin architecture.
Havoc
Modern C2 framework. Qt-based GUI, BOF support, custom agents, and a Cobalt Strike-inspired workflow.
Rubeus
C# toolset for raw Kerberos interaction and abuse. AS-REP roasting, Kerberoasting, ticket manipulation, delegation attacks.
Certipy
Active Directory Certificate Services (AD CS) abuse tool. Find and exploit certificate template misconfigurations.
Coercer
Automatically find and exploit Windows authentication coercion vulnerabilities. PetitPotam, PrinterBug, and more.
SharpHound
Official BloodHound data collector. Enumerates Active Directory objects, sessions, ACLs, and trusts for graph analysis.
BeEF
Browser Exploitation Framework. Hook browsers via XSS, then pivot into the network using browser-based attacks.
Social-Engineer Toolkit
Open-source social engineering framework. Spear-phishing, web attacks, USB/HID attacks, and credential harvesting.
Quasar RAT
Open-source remote administration tool for Windows. Full remote desktop, keylogger, file manager, and reverse proxy.
Donut
Generates position-independent shellcode from .NET assemblies, PE files, and DLLs. Load anything in memory.
ScareCrow
Payload creation framework for EDR bypass. Generates loaders using WinAPI syscalls to evade userland hooks.
SharpCollection
Nightly builds of common C# offensive tools. Pre-compiled Rubeus, Seatbelt, SharpUp, Certify, and 50+ more.
Seatbelt
C# safety checks for offensive operations. Enumerates host security config, credentials, and interesting data.
HackRF One
Open-source software-defined radio platform. Transmit and receive 1 MHz to 6 GHz. The hardware hacker's SDR.
USB Rubber Ducky Payloads
Payload repository for USB Rubber Ducky and BadUSB devices. Keystroke injection scripts for every scenario.
pwncat
Post-exploitation platform and target management. Automatic privesc, persistence, file transfer - the smart reverse shell.
Villain
Windows and Linux backdoor generator and handler. Auto-obfuscation, multi-session, and reverse shell management.
Creepy
Geolocation OSINT tool. Aggregates location data from social media, photos, and online services on a map.
pwndrop
Self-deployable file hosting for red teams. Upload payloads, host phishing files, serve implants - with HTTPS and Let's Encrypt.
Stegseek
Lightning fast steganography brute-forcer. Cracks steghide passwords at 200+ GB/s using wordlists.
Peirates
Kubernetes penetration testing tool. Exploit misconfigs, steal secrets, move laterally in K8s clusters.
Pacu
AWS exploitation framework. Enumerate, escalate, and exfiltrate across AWS services. The Metasploit of cloud.
Prowler
Cloud security assessment tool. 300+ checks for AWS, Azure, GCP, and Kubernetes against CIS benchmarks.
Starkiller
Frontend GUI for PowerShell Empire - manage listeners, agents, and modules through a modern Electron interface.
hoaxshell
Unconventional Windows reverse shell using HTTP(S) traffic - fully undetectable by Microsoft Defender.
Penelope
Advanced reverse shell handler. Auto-upgrades shells to PTY, handles multiple sessions, with built-in file transfer and logging.
PetitPotam
NTLM relay coercion tool. Forces Windows machines to authenticate via MS-EFSRPC, enabling relay attacks for domain compromise.
Whisker
Shadow Credentials attack tool. Adds rogue Key Credentials to AD objects for Kerberos authentication without knowing passwords.
CALDERA
MITRE ATT&CK-based automated adversary emulation platform for red team operations and security testing.
Pupy
Cross-platform remote administration and post-exploitation tool with in-memory execution.
Faraday
Collaborative penetration testing and vulnerability management platform.
Amber
Reflective PE packer converting native PE files to position-independent shellcode.
RedELK
Red team OPSEC monitoring and tracking using ELK stack integration.
PayloadsAllTheThings
Comprehensive reference of payloads and bypasses for web application pentesting.
PHPSploit
Stealth post-exploitation C2 framework tunneled through PHP web servers.
Ronin
Ruby toolkit for security research with built-in exploit development and recon.
Merlin
Cross-platform HTTP/2 command and control server and agent written in Go. Supports QUIC, HTTP/3, and encrypted communications.
Empire
Post-exploitation and adversary emulation framework with PowerShell, Python, and C# agents. BC-Security maintained fork.
WinPwn
Automated Windows internal penetration testing toolkit. Runs recon, privesc, credential extraction, and lateral movement in one script.
Inveigh
.NET/PowerShell LLMNR, NBNS, mDNS, DNS, and DHCPv6 spoofing tool with integrated relay attack support.
Weevely
Weaponized PHP web shell with 30+ modules for post-exploitation, pivoting, and privilege escalation through a tiny backdoor.
Commando VM
Mandiant's Windows-based penetration testing distribution. Automated installer for 140+ offensive security tools on Windows.
MailSniper
PowerShell tool for searching through Exchange and Office 365 email for sensitive data, credentials, and insider threat indicators.
DomainPasswordSpray
PowerShell tool for performing password spray attacks against Active Directory domain accounts with lockout-aware throttling.
Ruler
Tool for abusing Exchange services to gain remote code execution via Outlook mail rules, forms, and home page exploitation.
PrivescCheck
Windows privilege escalation enumeration script. Checks services, scheduled tasks, registry, credentials, and dozens of escalation vectors.
PingCastle
Active Directory security assessment tool that generates risk scores and identifies misconfigurations, trust issues, and attack paths.
SSH-Snake
Self-propagating, fileless network traversal tool that discovers and uses SSH keys to map reachable infrastructure.
emp3r0r
Self-healing mesh C2 framework with agent persistence, steganography transport, and automated post-exploitation for Linux.
HexStrike AI
MCP server giving AI agents access to 150+ cybersecurity tools for automated pentesting, vulnerability discovery, and bug bounty automation.
Decepticon
Autonomous red team agent executing full kill chains from recon through C2 with MITRE ATT&CK mapping and Neo4j knowledge graph.
RedAmon
AI-powered agentic red team framework automating recon through exploitation with LangGraph, Neo4j, and 70+ integrated tools.