Red Teaming Toolkit

This repository contains cutting-edge open-source security tools (OST) that will help you during adversary simulation and as information intended for threat hunter can make detection and prevention control easier. The list of tools below that could be potentially misused by threat actors such as APT and Human-Operated Ransomware (HumOR). If you want to contribute to this list send me a pull request.

---

Table of Contents

• Reconnaissance
• Initial Access
• Delivery
• Situational Awareness
• Credential Dumping
• Privilege Escalation
• Defense Evasion
• Persistence
• Lateral Movement
• Exfiltration
• Miscellaneous

---

Reconnaissance

Name	Description	URL
RustScan	The Modern Port Scanner. Find ports quickly (3 seconds at its fastest). Run scripts through our scripting engine (Python, Lua, Shell supported).	https://github.com/RustScan/RustScan
Amass	In-depth Attack Surface Mapping and Asset Discovery	https://github.com/OWASP/Amass
gitleaks	Gitleaks is a SAST tool for detecting hardcoded secrets like passwords, api keys, and tokens in git repos.	https://github.com/zricethezav/gitleaks
S3Scanner	Scan for open S3 buckets and dump the contents	https://github.com/sa7mon/S3Scanner
cloud_enum	Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.	https://github.com/initstring/cloud_enum
Recon-ng	Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.	https://github.com/lanmaster53/recon-ng
buster	An advanced tool for email reconnaissance	https://github.com/sham00n/buster
linkedin2username	OSINT Tool: Generate username lists for companies on LinkedIn	https://github.com/initstring/linkedin2username
WitnessMe	Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.	https://github.com/byt3bl33d3r/WitnessMe
pagodo	pagodo (Passive Google Dork) - Automate Google Hacking Database scraping and searching	https://github.com/opsdisk/pagodo

Initial Access

Brute Force

Name	Description	URL
SprayingToolkit	Scripts to make password spraying attacks against Lync/S4B, OWA & O365 a lot quicker, less painful and more efficient	https://github.com/byt3bl33d3r/SprayingToolkit
o365recon	Retrieve information via O365 with a valid cred	https://github.com/nyxgeek/o365recon
CredMaster	Refactored & improved CredKing password spraying tool, uses FireProx APIs to rotate IP addresses, stay anonymous, and beat throttling	https://github.com/knavesec/CredMaster

Payload Development

Name	Description	URL
Ivy	Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory.	https://github.com/optiv/Ivy
PEzor	Open-Source PE Packer	https://github.com/phra/PEzor
GadgetToJScript	A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA scripts.	https://github.com/med0x2e/GadgetToJScript
ScareCrow	Payload creation framework designed around EDR bypass.	https://github.com/optiv/ScareCrow
Donut	Donut is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.	https://github.com/TheWover/donut
Mystikal	macOS Initial Access Payload Generator	https://github.com/D00MFist/Mystikal
charlotte	c++ fully undetected shellcode launcher ;)	https://github.com/9emin1/charlotte
InvisibilityCloak	Proof-of-concept obfuscation toolkit for C# post-exploitation tools. This will perform the below actions for a C# visual studio project.	https://github.com/xforcered/InvisibilityCloak
Dendrobate	Dendrobate is a framework that facilitates the development of payloads that hook unmanaged code through managed .NET code.	https://github.com/FuzzySecurity/Dendrobate
Offensive VBA and XLS Entanglement	This repo provides examples of how VBA can be used for offensive purposes beyond a simple dropper or shell injector. As we develop more use cases, the repo will be updated.

Delivery

Phishing

Name	Description	URL
o365-attack-toolkit	A toolkit to attack Office365	https://github.com/mdsecactivebreach/o365-attack-toolkit
Evilginx2	Evilginx2 is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service.	https://github.com/kgretzky/evilginx2
Gophish	Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.	https://github.com/gophish/gophish
PwnAuth	PwnAuth a web application framework for launching and managing OAuth abuse campaigns.	https://github.com/fireeye/PwnAuth
Modlishka	Modlishka is a flexible and powerful reverse proxy, that will take your ethical phishing campaigns to the next level.	https://github.com/drk1wi/Modlishka

Watering Hole Attack

Name	Description	URL
BeEF	BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser	https://github.com/beefproject/beef

Command and Control

Remote Access Tools (RAT)

Name	Description	URL
Cobalt Strike	Cobalt Strike is software for Adversary Simulations and Red Team Operations.	https://cobaltstrike.com/
SpecterInsight	SpecterInsight is a cross-platform, post-exploitation command and control framework based on .NET for red team engagements, threat emulation, and training. It provides a variety of obfuscated payloads out-of-the-box and makes avoiding detection a core feature. Command outout is returned in JSON format and exported to ELK for analysis of operations with pre-built dashboards.	https://practicalsecurityanalytics.com/specterinsight/
Brute Ratel C4	Brute Ratel is the most advanced Red Team & Adversary Simulation Software in the current C2 Market.	https://bruteratel.com/
Empire	Empire 5 is a post-exploitation framework that includes a pure-PowerShell Windows agent, and compatibility with Python 3.x Linux/OS X agents.	https://github.com/BC-SECURITY/Empire
PoshC2	PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.	https://github.com/nettitude/PoshC2
Koadic	Koadic C3 COM Command & Control - JScript RAT	https://github.com/zerosum0x0/koadic
merlin	Merlin is a cross-platform post-exploitation Command & Control server and agent written in Go.	https://github.co