~/hackyfeed $

Bash is a collection of Bash scripts designed primarily for use by Red Teamers to facilitate offensive security tasks and simplify common operations in a Linux environment. Key features include various exploit scripts targeting vulnerabilities such as CVE-2014-6271 (ShellShock) and CVE-2006-3392 for remote file disclosure, as well as utility scripts for obtaining system information and performing network reconnaissance. The toolset is easily installable via standard Linux practices, promoting accessibility and efficiency for cybersecurity professionals.

Zero-loader is a polymorphic x64 shellcode loader designed to evade detection by generating unique binaries with every build, thus ensuring no static signatures are shared across compilations. Its primary use case is for authorized security testing and research, featuring advanced evasion techniques such as indirect syscalls, patchless AMSI/ETW bypass, module stomping, and anti-emulation measures. By employing methods like XOR encryption and synthetic function tables, the tool maintains a low profile during execution, effectively avoiding modern detection systems.

Z-Hound is a browser-based tool designed for visualizing attack graphs from SharpHound and AzureHound data, enabling quick and portable analysis of Active Directory and Azure AD environments without requiring any server setup or installations. It supports multiple SharpHound output formats, offers an interactive graph interface with various layout options, and allows users to upload ZIP or JSON files for analysis, making it ideal for pentesters and red teamers needing fast, offline capabilities. Notable features include automatic resolution of SIDs, customizable node visualizations, and the ability to work entirely offline after initial loading.

wmiexec2 is an enhanced and obfuscated version of the original `wmiexec`, designed for red team operations by facilitating stealthy remote command execution on Windows systems. Key features include support for various shell types, automated red team modules, local and remote file transfers, and capabilities for bypassing antivirus detection. The tool also includes additional functionalities like system information gathering, active token enumeration, and VM detection, making it a comprehensive suite for Windows penetration testing and cyber operations.

ThreatSwarm is a comprehensive penetration testing tool that utilizes 27 AI agents to execute the entire kill chain—from reconnaissance to exploitation, post-exploitation, digital forensics, and reporting—streamlined into a single command interface. It enforces strict scope limitations via `scope_check.py`, ensuring compliance with authorized testing parameters, while leveraging a library of 754 MITRE-mapped skills to guide its operations. Notably, it operates as a Claude Code plugin, eliminating the need for additional infrastructure like Docker or cloud accounts, and outputs detailed vulnerability reports with CVSS scoring.

The Red Council is an automated adversarial testing platform designed for Large Language Models (LLMs), offering a comprehensive security workflow that identifies vulnerabilities, applies automated defenses, and verifies their effectiveness in real-time. Key features include a multi-agent adversarial flow, a real-time battle user interface, and the ability to integrate with various LLM APIs, supporting a versatile approach to security assessment and fortification. Additionally, it incorporates capabilities for AI Agent Security Testing based on the OWASP Agentic Top 10 framework, enhancing its utility in securing AI-driven applications.

tempor is a cloud infrastructure provisioning tool that allows users to effortlessly create ephemeral servers across multiple cloud providers using Terraform, making it ideal for penetration testers and bug hunters. Notable features include support for custom Ansible playbooks and Packer configurations, enabling tailored setups, along with robust authentication mechanisms via environment variables and API tokens.

TapDucky is an open-source tool for rooted Android devices that functions as a USB HID keystroke injector, capable of emulating keyboard, mouse, and composite HID devices. Its primary use case is in authorized testing and automation through the execution of customizable DuckyScripts, featuring a robust payload management system, execution logging, and a GitHub-backed library for seamless script integration and validation. Notable features include live payload validation, multiple scheduling options, and the ability to configure device-specific HID profiles without the need for external dongles.

Takopii is a production-grade banker malware architecture designed for Android, featuring four APK specimens that encapsulate techniques from 17 real-world malware families. Its primary use case is to facilitate the study of malware detection and defense strategies, offering Kotlin source code alongside comprehensive YARA and Sigma detection rules. Notably, all specimens demonstrate zero detection across 66 VirusTotal engines, showcasing advanced evasion capabilities within a structured kill chain framework.

SunnyDayBPF is an eBPF-based research tool designed for post-syscall user-buffer telemetry deception, investigating the integrity of data observed by user-space security agents after read-like syscalls. It alters the telemetry data before it is processed by security pipelines, allowing for a detailed examination of discrepancies between actual events and the observed telemetry. Notable features include support for multiple syscalls (e.g., read, pread64, recvfrom), a modular BPF architecture utilizing tail calls to circumvent verifier constraints, and customizable scanning rules for enhanced security analysis.

The Stardust-RS project provides a Rust template for creating position-independent shellcode (PIC) targeting both i686 and x86_64 architectures on Linux and Windows platforms. It allows for the compilation of shellcode that can be executed without specific memory locations, facilitating various exploit development scenarios. Notable features include cross-platform support, minimal payload sizes, and a customizable build environment with Docker compatibility.

Solemn is a command-line utility designed to facilitate the manual addition of drivers to the Hypervisor-Protected Code Integrity (HVCI) custom blocklist on Windows systems. Its primary use case is to enhance kernel security by allowing system administrators to block specific drivers, thereby preventing potentially malicious code from executing within the kernel. Key features include automatic creation of the registry entry for the blocklist, duplicate entry prevention, and user-friendly command-line output, all while ensuring necessary administrative privileges are checked before modifications are made.

ShareSift is a machine learning-enhanced tool designed to identify and rank files on SMB shares that are likely to contain credentials or secrets. Utilizing a two-stage classifier pipeline, it combines a LightGBM path classifier and a Qwen3 1.7B LoRA content classifier to improve recall of sensitive information significantly over its predecessor, Snaffler. Notable features include adjustable classification policies to balance false positives and recall rates, allowing users to optimize for specific operational needs.

ShadowMap is a professional IP geolocation intelligence tool designed for tracking IP addresses with multi-source accuracy and Google Maps integration. Its notable features include querying multiple APIs for enhanced accuracy, precise coordinate outputs, proxy and VPN detection, and compatibility with mobile platforms like Termux. Intended for educational and authorized testing purposes, it provides users a clean, professional interface and the ability to save detailed geolocation reports.

The Security Reference Guide is a curated repository of cyber security resources tailored for SOC analysts, pentesters, DFIR practitioners, and other security-focused roles. It organizes valuable links into categories such as offensive and defensive operations, engineering fundamentals, and training resources, providing context to help users select the appropriate tools and materials quickly. Notably, the guide emphasizes legitimacy, cautioning against the misuse of tools for unethical purposes.

RootHunter is an offensive auditing suite for Linux, designed for pentesters and administrators to detect and prioritize common privilege escalation vectors before malicious actors can exploit them. It includes a Bash script for evidence collection, a local database of binary escalation techniques, and a Python analysis tool that generates actionable insights based on the collected evidence. Key features include a structured JSON report, prioritization of attack paths, and integration with CVE databases for context-specific exploits.

Reflectra is a User-Defined Reflective Loader (UDRL) designed for Windows x64 platforms, enabling modular integration with various Command and Control (C2) frameworks. It features a customizable reflective loading pipeline, advanced evasion techniques such as syscall spoofing and ETW patching, and extensive control over execution flow and memory layout, allowing for sophisticated payload manipulation. The tool is built on the Crystal Palace architecture and focuses on seamless DLL-based payload delivery while maintaining operational stealth.

RedTeam-Agent is an AI-powered autonomous framework designed for red team security assessments, enabling automated execution of commands across multiple tools through a skill-first terminal workflow. Its notable features include support for over 15 integrated security tools, advanced output filtering, and comprehensive Active Directory attack coverage, allowing users to streamline the red teaming process without manual tool management. The framework facilitates multi-client operations and includes functionalities for reconnaissance, data collection, analysis, and lateral movement.

red-run is a security assessment toolkit designed for orchestrating and conducting comprehensive security evaluations using Claude Code and MCP servers. It guides users through essential assessment phases—recon, initial access, lateral movement, privilege escalation, and post-access—while maintaining engagement state in SQLite and allowing for semantic search and execution delegation across persistent agent teams. Notable features include multiple orchestrator variants tailored for specific use cases, real-time monitoring and interaction via tmux, and a robust skill management system that facilitates complex assessments.

ReconMind is an AI-powered bug bounty agent designed to emulate the decision-making process of a senior penetration tester, automating the entire vulnerability assessment workflow from reconnaissance through to reporting. Key features include an LLM-driven approach that intelligently selects targets and scans, filters false positives, and generates platform-ready reports for services like HackerOne and Bugcrowd. Its streamlined pipeline ensures comprehensive coverage, while being free to use, and provides flexibility with local and cloud-based LLM integrations.

RamiBot is an AI-powered security operations platform designed for both Red and Blue team engagements, integrating various pentesting tools within a structured operational pipeline. Its notable features include multi-provider LLM support, human-in-the-loop tool execution approval, evidence-locked reporting to mitigate hallucinations, and Docker integration for seamless command execution in containerized environments. Additionally, RamiBot automates setup processes and provides one-click PDF reporting for streamlined security assessments.

PWNCLOUDOS is a multi-cloud security Linux distribution designed for both offensive and defensive security operations across major cloud platforms such as AWS, Azure, and GCP. It offers a lightweight XFCE4 environment pre-loaded with a range of cloud exploitation tools, auditing frameworks, and security testing utilities, making it suitable for red, blue, and purple teams. Notable features include customizable shell environments, a variety of cloud-specific tools, and community-driven enhancements, with options for both AMD64 and ARM64 architectures.

Proteus is a Rust-based command-and-control (C2) agent designed for integration with the Mythic framework, featuring capabilities such as raw shellcode production, COFF file analysis, and robust data-section obfuscation. Its key innovations include a shuffle pipeline that randomizes function order while repairing internal references, combined with ChaCha20-based encryption for added security. This tool serves as both a payload generator and a development aid, supporting advanced persistence and clandestine operations in targeted environments.

PingRAT is a command and control (C2) tool that utilizes ICMP payloads to stealthily transmit C2 traffic through firewalls, making it largely undetectable by most antivirus and endpoint detection and response solutions. It is implemented in Go and offers features such as server-client architecture for communication, allowing for flexible network interface configuration. This tool is primarily aimed at facilitating covert operations in environments with strict traffic monitoring.

PH4NTØM ROOTKIT is a Windows usermode rootkit designed for educational research, featuring techniques for stealth, privilege escalation, and command-and-control (C2) infrastructure. Notable features include token stealing and named pipe impersonation for privilege escalation, inline hooking for process and file hiding, and a comprehensive C2 setup allowing for real-time keylogging and remote execution commands. It emphasizes defensive learning while providing extensive evasion mechanisms against analysis and detection.