Tools: ad (133)

A python script to automatically list vulnerable Windows ACEs/ACLs.

A tool for dumping domain data via ADWS for evasion purposes.

Aliasr is a modern and feature-rich TUI launcher for penetration testing commands inspired by Arsenal but with significantly improved functionality.

A simple tool for filtering and manipulating text data / such as log files and other outputs.

Terminal session recorder

Extendable version manager with support for ruby python go etc

Make your VLAN ASREProastable.

Automatically exploit Active Directory privilege escalation paths shown by BloodHound.

BloodBash is a powerful standalone BloodHound / SharpHound + AzureHound JSON analyzer written in Python

Active Directory security tool for reconnaissance and attacking AD environments (Community Edition)

BloodHound-CE ingestor in Python.

Import data into BloodHound for analyzing active directory trust relationships

BloodHound ingestor in Python.

A tool for BloodHounding on Windows machines without .NET or Powershell installed

Bolt crawls the target website to the specified depth and stores all the HTML forms found in a database for further processing.

A Swiss Army knife for bypassing web application firewalls and filters.

CeWL alternative in Python

A Go client to communicate with Chaos dataset API from ProjectDiscovery.

cmloot.py is built to aid penetration testers to search and find sensitive files in Configuration Manager's complex file share structure.

A fast WPA/WPA2/WPA3 WiFi Handshake capture / password recovery and analysis tool

Curlie is a frontend to curl that adds the ease of use of httpie without compromising on features and performance

Automated extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets.

Exhaustive search and flexible filtering of Active Directory ACEs

DFS-R target coercion tool

Advanced subdomain scanner

Do The Right eXtraction - don't remember what set of tar flags or where to pipe the output to extract it? no worries!

Framework for building offensive security tools.

Monitor the Windows Event Log with grep-like features or filtering for specific Event IDs

Tool to connect to a remote Windows system with WinRM.

Credentials management for Exegol

A simple bash script to enumerate stale ADIDNS entries

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP) released under the Apache license.

🌸 A command-line fuzzy finder

GenUsername is a Python tool for generating a list of usernames based on a name or email address.

tool to generate wordlists of passwords containing cities at a defined distance around the client city.

glow is a tool to render Markdown inside the terminal.

A complete TUI for LDAP.

GoExec is a new take on some of the methods used to gain remote execution on Windows devices. GoExec implements a number of largely unrealized…

Copy the properties and groups of a user from neo4j (bloodhound) to create an identical golden ticket

Implements NTLMSSP network authentication protocol in Go

Aiming at automating GPO attack vectors through NTLM relaying (and more)

Tool designed to extract and analyze configurations applied through Group Policy Objects (GPOs) in an Active Directory environment.

This small tool is aimed at anonymizing hashes files for offline but online cracking like Google Collab for instance (see…

Password cracking rules for Hashcat based on statistics and industry patterns

Tool for exploiting HTTP methods (e.g. PUT / DELETE / etc.)

Userspace command line tool for configuring kernel firewall

This exploitation script is meant to be used by pentesters against active JDWP service / in order to gain Remote Code Execution.

Extract URLs / paths / secrets and other interesting data from JavaScript source code.

a command-line tool for working with JSON Web Tokens (JWTs)

Cross-platform password manager

KeePwn is a tool that extracts passwords from KeePass 1.x and 2.x databases.

KeyTabExtract is a tool to extract valuable information from keytab files.

Check Domain Controllers for LDAP server protections regarding the relay of NTLM authentication.

Search for and display entries (ldap)

LDAP search utility with AD support

C library for Microsoft compression formats.

This tool will allow you to generate LNK payloads. Upon rendering or being run they will exfiltrate data.

Windows secrets and passwords extraction tool.

MariaDB is a community-developed fork of the MySQL relational database management system. The mariadb-client package includes command-line utilities…

Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been…

Fancy cat for Markdown

A popular penetration testing framework that includes many exploits and payloads

Scan Moodle sites for information and vulnerabilities.

msprobe is a tool to identify Microsoft Windows hosts and servers that are running certain services.

Database.

hyperextensible Vim-based text editor

Converts/manipulates/extracts data from a Nmap scan output.

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user.

Password cracking rules and masks for hashcat

Find Open redirects and other vulnerabilities.

A python module to explore the object tree to extract paths to interesting objects in memory.

a powerful subdomain collection tool.

Rockyou for web fuzzing

One rule to crack all passwords. A revamped - optimised and updated version of the original OneRuleToRuleThemAll hashcat rule

large hashcat rulesets generated from real-world compromised passwords

TODO

PassTheCert is a tool to extract Active Directory user password hashes from a domain controller's local certificate store.

Windows machine account manipulation

A CLI to generate PHP filters chain / get your RCE without uploading a file if you control entirely the parameter passed to a require or an include…

API platform for testing APIs

PowerView.py is an alternative for the awesome original PowerView.ps1 script.

an mitm tool for helping with relay attacks.

A utility for quickly generating IP ranges or enumerating hosts within a specified range.

a tool to perform attacks against Microsoft Exchange server using NTLM relay techniques

Proxy chains - redirect connections through proxy servers.

A toolkit to perform pass-the-hash attacks

Maintained fork of pwncat-cs with recent fixes and enhancements.

PXEThief is a set of tooling that can extract passwords from the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager

Script that can help identify shares that are not commonly found on a Windows system.

Extremely fast and scalable Python FTP server library

Cross-platform Python implementation of the GoldenGMSA attack for exploiting Group Managed Service Accounts (gMSA) in Active Directory.

Utility for enumerating and querying LDAP servers.

a Python library for mimikatz-like functionality

Snaffler. But in python.

A (partial) Python rewriting of PowerSploit's PowerView.

PyWhisker is a Python equivalent of the original Whisker made by Elad Shamir and written in C#. This tool allows users to manipulate the…

Python implementation of a WSUS client

redis-tools is a collection of Redis client utilities including redis-cli and redis-benchmark.

Remote desktop client.

A tool to coerce NTLM authentications via DCOM

rlwrap is a small utility that wraps input and output streams of executables / making it possible to edit and re-run input history

RoastInTheMiddle is a tool to intercept and relay NTLM authentication requests.

Utility for testing whether a website's robots.txt file is correctly configured.

File synchronization tool for efficiently copying and updating data between local or remote locations

BloodHound ingestor in Rust.

SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting and initial access and lateral movement.

This code is designed for exploring SCCM in a lab.

A command line search tool for Exploit-DB

Utility for bypassing the Windows Defender antivirus by hiding a process within a legitimate process.

A fast and reliable network capture analyzer

The smart password spraying and bruteforcing tool for Active Directory Domain Services.

SMBclient is a command-line utility that allows you to access Windows shared resources

ssh-audit is a tool to test SSH server configuration for best practices.

Collection of Symfony exploits and PoCs.

Proof-of-Concept tool to dump trusted domain objects and extract trust credentials for lateral movement across domain boundaries

TeamsPhisher is a Python3 program that facilitates the delivery of phishing messages and attachments to Microsoft Teams users whose organizations…

a tool for testing SSL/TLS encryption on servers

THR (The Hacker Recipes) is aimed at providing technical guides on various hacking topics.

Tig is an ncurses-based text-mode interface for git.

Tool to generate a timing profile for a given command.

Token Exploiter is a tool designed to analyze GitHub Personal Access Tokens.

Personal knowledge management system (successor to Trilium).

Fast and lightweight - UDPX is a single-packet UDP scanner written in Go that supports the discovery of over 45 services with the ability to add…

Simple replacement for Python's SimpleHTTPServer.

Tool for quickly downloading files to a remote machine based on the target operating system

urldedupe is a c++ tool to quickly pass in a list of URLs and get back a list of deduplicated (unique) URL and query string combination.

Scans for web service endpoints

Active Directory enumeration tool.

WireGuard is an extremely simple yet fast and modern VPN that utilizes state-of-the-art cryptography

xtightvncviewer is an open source VNC client software.

Yarn is a package manager that doubles down as project manager.

A youtube-dl fork with additional features and fixes

Exploit for the Zerologon vulnerability (CVE-2020-1472).