A list of useful payloads and bypass for Web Application Security and Pentest/CTF

The Big List of Naughty Strings is a list of strings which have a high probability of causing issues when used as user-input data.

An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers.

Awesome list of open-source startup alternatives to well-known SaaS products 🚀

DALL·E Mini - Generate images from a text prompt

A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.

Credentials recovery project

The recursive internet scanner for hackers. 🧡

A swiss army knife for pentesting networks

An advanced memory forensics framework

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

curl-impersonate: A special build of curl that can impersonate Chrome & Firefox

The FLARE team's open-source tool to identify capabilities in executable files.

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

The Deepfake Offensive Toolkit

A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

This program show you IMSI numbers of cellphones around you.

💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

Mimikatz implementation in pure Python

UAC bypass, Elevate, Persistence methods

Privilege Escalation Project - Windows / Linux / Mac

Public domain cross platform lock free thread caching 16-byte aligned memory allocator implemented in C

Stealing Signatures and Making One Invalid Signature at a Time

Tools & Interesting Things for RedTeam Ops

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through 12 methods.

This project aims to compare and evaluate the telemetry of various EDR products.

pwning IPv4 via IPv6

An email spoofing testing tool that aims to bypass SPF/DKIM/DMARC and forge DKIM signatures.🍻

SysWhispers on Steroids - AV/EDR evasion via direct system calls.