Skip to content

Latest commit

 

History

History
341 lines (315 loc) · 43 KB

README.md

File metadata and controls

341 lines (315 loc) · 43 KB
Raw

Red Teaming/Adversary Simulation Toolkit

A collection of open source and commercial tools that aid in red team operations. This repository will help you during red team engagement. If you want to contribute to this list send me a pull request.

Contents

Reconnaissance

Active Intelligence Gathering

Passive Intelligence Gathering

  • Social Mapper OSINT Social Media Mapping Tool, takes a list of names & images (or LinkedIn company name) and performs automated target searching on a huge scale across multiple social media sites. Not restricted by APIs as it instruments a browser using Selenium. Outputs reports to aid in correlating targets across sites. https:/SpiderLabs/social_mapper
  • skiptracer OSINT scraping framework, utilizes some basic python webscraping (BeautifulSoup) of PII paywall sites to compile passive information on a target on a ramen noodle budget. https:/xillwillx/skiptracer
  • ScrapedIn a tool to scrape LinkedIn without API restrictions for data reconnaissance. https:/dchrastil/ScrapedIn
  • linkScrape A LinkedIn user/company enumeration tool. https:/NickSanzotta/linkScrape
  • FOCA (Fingerprinting Organizations with Collected Archives) is a tool used mainly to find metadata and hidden information in the documents its scans. https:/ElevenPaths/FOCA
  • theHarvester is a tool for gathering subdomain names, e-mail addresses, virtual hosts, open ports/ banners, and employee names from different public sources. https:/laramies/theHarvester
  • Metagoofil is a tool for extracting metadata of public documents (pdf,doc,xls,ppt,etc) availables in the target websites. https:/laramies/metagoofil
  • SimplyEmail Email recon made fast and easy, with a framework to build on. https:/killswitch-GUI/SimplyEmail
  • truffleHog searches through git repositories for secrets, digging deep into commit history and branches. https:/dxa4481/truffleHog
  • Just-Metadata is a tool that gathers and analyzes metadata about IP addresses. It attempts to find relationships between systems within a large dataset. https:/ChrisTruncer/Just-Metadata
  • typofinder a finder of domain typos showing country of IP address. https:/nccgroup/typofinder
  • pwnedOrNot is a python script which checks if the email account has been compromised in a data breach, if the email account is compromised it proceeds to find passwords for the compromised account. https:/thewhiteh4t/pwnedOrNot
  • GitHarvester This tool is used for harvesting information from GitHub like google dork. https:/metac0rtex/GitHarvester
  • pwndb is a python command-line tool for searching leaked credentials using the Onion service with the same name. https:/davidtavarez/pwndb/

Frameworks

Weaponization

Delivery

Phishing

  • King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. https:/securestate/king-phisher
  • FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more. https:/Raikia/FiercePhish
  • ReelPhish is a Real-Time Two-Factor Phishing Tool. https:/fireeye/ReelPhish/
  • Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training. https:/gophish/gophish
  • CredSniper is a phishing framework written with the Python micro-framework Flask and Jinja2 templating which supports capturing 2FA tokens. https:/ustayready/CredSniper
  • PwnAuth a web application framework for launching and managing OAuth abuse campaigns. https:/fireeye/PwnAuth
  • Phishing Frenzy Ruby on Rails Phishing Framework. https:/pentestgeek/phishing-frenzy
  • Phishing Pretexts a library of pretexts to use on offensive phishing engagements. https:/L4bF0x/PhishingPretexts
  • *Modlishka is a flexible and powerful reverse proxy, that will take your ethical phishing campaigns to the next level. https:/drk1wi/Modlishka

Watering Hole Attack

  • BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser. https:/beefproject/beef

Command and Control

Remote Access Tools

  • Cobalt Strike is software for Adversary Simulations and Red Team Operations. https://cobaltstrike.com/
  • Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows agent, and a pure Python 2.6/2.7 Linux/OS X agent. https:/EmpireProject/Empire
  • Metasploit Framework is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. https:/rapid7/metasploit-framework
  • SILENTTRINITY A post-exploitation agent powered by Python, IronPython, C#/.NET. https:/byt3bl33d3r/SILENTTRINITY
  • Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python. https:/n1nj4sec/pupy
  • Koadic or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. https:/zerosum0x0/koadic
  • PoshC2 is a proxy aware C2 framework written completely in PowerShell to aid penetration testers with red teaming, post-exploitation and lateral movement. https:/nettitude/PoshC2
  • Gcat a stealthy Python based backdoor that uses Gmail as a command and control server. https:/byt3bl33d3r/gcat
  • TrevorC2 is a legitimate website (browsable) that tunnels client/server communications for covert command execution. https:/trustedsec/trevorc2
  • Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang. https:/Ne0nd0g/merlin
  • Quasar is a fast and light-weight remote administration tool coded in C#. Providing high stability and an easy-to-use user interface, Quasar is the perfect remote administration solution for you. https:/quasar/QuasarRAT

Staging

Lateral Movement

  • CrackMapExec is a swiss army knife for pentesting networks. https:/byt3bl33d3r/CrackMapExec
  • PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and commands without spawning powershell.exe. https:/Mr-Un1k0d3r/PowerLessShell
  • GoFetch is a tool to automatically exercise an attack plan generated by the BloodHound application. https:/GoFetchAD/GoFetch
  • ANGRYPUPPY a bloodhound attack path automation in CobaltStrike. https:/vysec/ANGRYPUPPY
  • DeathStar is a Python script that uses Empire's RESTful API to automate gaining Domain Admin rights in Active Directory environments using a variety of techinques. https:/byt3bl33d3r/DeathStar
  • SharpHound C# Rewrite of the BloodHound Ingestor. https:/BloodHoundAD/SharpHound
  • BloodHound.py is a Python based ingestor for BloodHound, based on Impacket. https:/fox-it/BloodHound.py
  • Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. https:/SpiderLabs/Responder
  • SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally. https:/fireeye/SessionGopher
  • PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. https:/PowerShellMafia/PowerSploit
  • Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. https:/samratashok/nishang
  • Inveigh is a Windows PowerShell LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool. https:/Kevin-Robertson/Inveigh
  • PowerUpSQL a PowerShell Toolkit for Attacking SQL Server. https:/NetSPI/PowerUpSQL
  • MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). https:/dafthack/MailSniper
  • WMIOps is a powershell script that uses WMI to perform a variety of actions on hosts, local or remote, within a Windows environment. It's designed primarily for use on penetration tests or red team engagements. https:/ChrisTruncer/WMIOps
  • Mimikatz is an open-source utility that enables the viewing of credential information from the Windows lsass. https:/gentilkiwi/mimikatz
  • LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. https:/AlessandroZ/LaZagne
  • mimipenguin a tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. https:/huntergregal/mimipenguin
  • PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
  • KeeThief allows for the extraction of KeePass 2.X key material from memory, as well as the backdooring and enumeration of the KeePass trigger system. https:/HarmJ0y/KeeThief
  • PSAttack combines some of the best projects in the infosec powershell community into a self contained custom PowerShell console. https:/jaredhaight/PSAttack
  • Internal Monologue Attack Retrieving NTLM Hashes without Touching LSASS. https:/eladshamir/Internal-Monologue
  • Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (for instance NMB, SMB1-3 and MS-DCERPC) the protocol implementation itself. https:/CoreSecurity/impacket
  • icebreaker gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment. https:/DanMcInerney/icebreaker
  • Living Off The Land Binaries and Scripts (and now also Libraries) The goal of these lists are to document every binary, script and library that can be used for other purposes than they are designed to. https:/api0cradle/LOLBAS
  • WSUSpendu for compromised WSUS server to extend the compromise to clients. https:/AlsidOfficial/WSUSpendu
  • Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates. https:/infobyte/evilgrade
  • NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before encryption/after decryption. https:/NytroRST/NetRipper
  • LethalHTA Lateral Movement technique using DCOM and HTA. https:/codewhitesec/LethalHTA
  • Invoke-PowerThIEf an Internet Explorer Post Exploitation library. https:/nettitude/Invoke-PowerThIEf
  • RedSnarf is a pen-testing / red-teaming tool for Windows environments. https:/nccgroup/redsnarf
  • HoneypotBuster Microsoft PowerShell module designed for red teams that can be used to find honeypots and honeytokens in the network or at the host. https:/JavelinNetworks/HoneypotBuster

Establish Foothold

  • Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled environments. https:/SECFORCE/Tunna
  • reGeorg the successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn. https:/sensepost/reGeorg
  • Blade is a webshell connection tool based on console, currently under development and aims to be a choice of replacement of Chooper. https:/wonderqs/Blade
  • TinyShell Web Shell Framework. https:/threatexpress/tinyshell
  • PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. https:/Sw4mpf0x/PowerLurk
  • DAMP The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification. https:/HarmJ0y/DAMP

Escalate Privileges

Domain Escalation

Local Escalation

Data Exfiltration

  • CloakifyFactory & the Cloakify Toolset - Data Exfiltration & Infiltration In Plain Sight; Evade DLP/MLS Devices; Social Engineering of Analysts; Defeat Data Whitelisting Controls; Evade AV Detection. https:/TryCatchHCF/Cloakify
  • DET (is provided AS IS), is a proof of concept to perform Data Exfiltration using either single or multiple channel(s) at the same time. https:/sensepost/DET
  • DNSExfiltrator allows for transfering (exfiltrate) a file over a DNS request covert channel. This is basically a data leak testing tool allowing to exfiltrate data over a covert channel. https:/Arno0x/DNSExfiltrator
  • PyExfil a Python Package for Data Exfiltration. https:/ytisf/PyExfil
  • Egress-Assess is a tool used to test egress data detection capabilities. https:/ChrisTruncer/Egress-Assess
  • Powershell RAT python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. https:/Viralmaniar/Powershell-RAT

Misc

Wireless Networks

  • Wifiphisher is a security tool that performs Wi-Fi automatic association attacks to force wireless clients to unknowingly connect to an attacker-controlled Access Point. https:/wifiphisher/wifiphisher
  • Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. https:/kgretzky/evilginx
  • mana toolkit for wifi rogue AP attacks and MitM. https:/sensepost/mana

Embedded & Peripheral Devices Hacking

  • magspoof a portable device that can spoof/emulate any magnetic stripe, credit card or hotel card "wirelessly", even on standard magstripe (non-NFC/RFID) readers. https:/samyk/magspoof
  • WarBerryPi was built to be used as a hardware implant during red teaming scenarios where we want to obtain as much information as possible in a short period of time with being as stealth as possible. https:/secgroundzero/warberry
  • P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W (required for HID backdoor). https:/mame82/P4wnP1
  • malusb HID spoofing multi-OS payload for Teensy. https:/ebursztein/malusb
  • Fenrir is a tool designed to be used "out-of-the-box" for penetration tests and offensive engagements. Its main feature and purpose is to bypass wired 802.1x protection and to give you an access to the target network. https:/Orange-Cyberdefense/fenrir-ocd
  • poisontap exploits locked/password protected computers over USB, drops persistent WebSocket-based backdoor, exposes internal router, and siphons cookies using Raspberry Pi Zero & Node.js. https:/samyk/poisontap
  • WHID WiFi HID Injector - An USB Rubberducky / BadUSB On Steroids. https:/whid-injector/WHID

Software For Team Communication

  • RocketChat is free, unlimited and open source. Replace email & Slack with the ultimate team chat software solution. https://rocket.chat
  • Etherpad is an open source, web-based collaborative real-time editor, allowing authors to simultaneously edit a text document https://etherpad.net

Log Aggregation

C# Offensive Framework

  • SharpSploit is a .NET post-exploitation library written in C# that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers. https:/cobbr/SharpSploit
  • GhostPack is (currently) a collection various C# implementations of previous PowerShell functionality, and includes six separate toolsets being released today- Seatbelt, SharpUp, SharpRoast, SharpDump, SafetyKatz, and SharpWMI. https:/GhostPack
  • SharpWeb .NET 2.0 CLR project to retrieve saved browser credentials from Google Chrome, Mozilla Firefox and Microsoft Internet Explorer/Edge. https:/djhohnstein/SharpWeb
  • reconerator C# Targeted Attack Reconnissance Tools. https:/stufus/reconerator
  • SharpView C# implementation of harmj0y's PowerView. https:/tevora-threat/SharpView
  • Watson is a (.NET 2.0 compliant) C# implementation of Sherlock. https:/rasta-mouse/Watson

Labs

  • Detection Lab This lab has been designed with defenders in mind. Its primary purpose is to allow the user to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. https:/clong/DetectionLab
  • Modern Windows Attacks and Defense Lab This is the lab configuration for the Modern Windows Attacks and Defense class that Sean Metcalf (@pyrotek3) and I teach. https:/jaredhaight/WindowsAttackAndDefenseLab
  • Invoke-UserSimulator Simulates common user behaviour on local and remote Windows hosts. https:/ubeeri/Invoke-UserSimulator
  • Invoke-ADLabDeployer Automated deployment of Windows and Active Directory test lab networks. Useful for red and blue teams. https:/outflanknl/Invoke-ADLabDeployer
  • Sheepl Creating realistic user behaviour for supporting tradecraft development within lab environments. https:/SpiderLabs/sheepl

Scripts

References

License

License: GPL v3