Powershell

HitmanVRFoveationFix enhances the visual experience of HITMAN World of Assassination in PC VR by replacing the game's fixed foveation renderer with dual full-resolution eye layers across the entire field of view, addressing the peripheral blurriness typical in pancake-lens headsets. Notable features include improved startup speeds for unverified game builds, reduced CPU usage while idle, and maintained safety protocols to ensure accurate gameplay integrity. The tool is compatible with Windows and SteamVR platforms, with experimental support for Linux.

WinFlesher is an advanced attack surface security assessment tool designed for security professionals and auditors to automate the discovery of vulnerabilities and evaluate security postures in Active Directory and local infrastructures. Its notable features include real-time automated discovery of configurations and services, in-depth Active Directory analysis with a focus on trust and privilege relationships, a built-in attack paths engine for identifying potential escalation routes, and integrated remediation support with practical guides. The tool also provides a modern GUI for intuitive visualization of findings and security scores, enhancing the management of risk assessments.

TCPK (Thick Client Pentest Kit) is a Windows-based security audit tool designed for comprehensive testing of thick-client applications, including MSIX, .NET, and Electron binaries. Noteworthy features include a PowerShell engine, live auditing with real-time findings, CVSS scoring, AI triage capabilities, and automated report generation in multiple formats, providing an exhaustive analysis for authorized testing environments. This tool emphasizes evidence-based findings and offers extensive checks, making it suitable for security professionals conducting in-depth application audits.

Kioskonomicon is a comprehensive workshop resource designed for exploring and exploiting security vulnerabilities in public-facing kiosks, emphasizing the path from kiosk escape to Active Directory compromise. It features a structured "choose your adventure" format, allowing users to engage in DIY attacks, hard mode challenges, or follow guided exercises, all set within a specialized Active Directory lab environment. Notable elements include detailed scenarios for various kiosk types, a range of Active Directory attack methodologies, and supplementary resources for both hacking techniques and defensive measures.

dsh-reverse-skill is a comprehensive DeepSeek Harness (dsh) plugin that encapsulates 85 skills from the upstream reverse-skill repository, providing seamless integration into the dsh environment without manual maintenance of skill lists. The tool automatically registers a complete library of skills upon startup, includes both domain and CTF-oriented skills, and offers a straightforward installation process via GitHub or configuration files. It is specifically designed for authorized reverse engineering, penetration testing, and security research.

M365 Assess is a read-only security assessment tool for Microsoft 365 tenants, designed for IT consultants and administrators to quickly analyze and report security posture. It performs 292 automated checks across 15 compliance frameworks, generating comprehensive output in the form of CSV data, a branded HTML report, and an XLSX compliance matrix. Key features include customizable assessment sections, compatibility with various compliance standards, and an interactive wizard for streamlined execution.

The Scan-broken-owner tool is a PowerShell script designed to audit Active Directory for vulnerabilities related to object ownership, specifically targeting "broken owners" which pose a security risk. Its primary use case is to help organizations identify and mitigate control-takeover vulnerabilities by ensuring that Active Directory objects are owned by appropriate, legitimate users, thereby preventing potential attacks such as Kerberos Resource-Based Constrained Delegation abuse. Notable features include the generation of a detailed HTML report, the ability to skip specific users or groups during scans, and operation without requiring administrative privileges.

PowerShell-for-Hackers is a repository that offers a collection of PowerShell functions specifically designed for the creation and execution of hacking payloads. Its primary use case is to facilitate the development of custom payloads by providing easily accessible functions, detailed descriptions, and practical examples. Notable features include a PowerShell to DuckyScript converter, comprehensive documentation, and video tutorials for each function, enhancing the learning experience for users looking to expand their cybersecurity toolkit.

The PowerShell Reverse TCP tool facilitates bidirectional communication between a client and a remote host, enabling the remote host to execute commands on the client system. Designed primarily for educational purposes, it features multiple shell implementations using Invoke-Expression and process pipes, and includes a methodology for script obfuscation to evade detection by security systems. Users can customize IP addresses and port numbers, while future updates aim to enhance shell optimization further.

Wconsole is a PowerShell-based tool designed for penetration testing on Windows systems, enabling comprehensive checks of OS versions, configurations, and security settings. It features functions for user enumeration, firewall status, process management, and various privilege escalation checks, making it a versatile hand-script for security testing. The tool can be executed locally or remotely, providing flexibility in assessment execution.

The Fuck-Windows-Security script is a malicious tool designed to disable various Windows security features through registry manipulation, effectively bypassing User Account Control (UAC) and gaining elevated privileges. It implements an anti-virtual machine feature to ensure execution on actual systems, while also providing persistence through self-replication by copying itself to the startup folder. Notably, it disables numerous critical security aspects, including Windows Defender, Firewall, and system recovery options, allowing for potential exploitation of the target environment.

CredsHunter is a read-only credential discovery tool designed for authorized post-exploitation activities, efficiently identifying and extracting reusable credentials such as passwords, keys, and hashes while filtering out irrelevant cloud tokens. It operates through a structured five-stage process, scanning various OS credential stores and confirming the presence of valuable file types, ultimately delivering findings in a tiered format that prioritizes critical information. This tool supports both Linux and Windows environments, providing versatile and targeted scanning options without altering the host system.

The repository titled "Fuck-Windows-Security" appears to be a tongue-in-cheek commentary rather than a functional cybersecurity tool. It does not provide a specific use case or notable features for any security-related applications.

Invoke-SeRestoreAbuse is a privilege escalation tool that exploits the SeRestorePrivilege via Seclogon service hijacking to execute arbitrary commands with SYSTEM privileges. It achieves this by modifying the Seclogon service's ImagePath using SeRestorePrivilege and REG_OPTION_BACKUP_RESTORE techniques. This tool is designed for authorized system penetration testing and is accompanied by usage demonstrations.

Credit-Card-Bruteforcer is a security testing tool designed to exploit vulnerabilities in credit card systems by attempting to generate valid Primary Account Numbers (PAN) using partial hashes and a set of random PINs. The tool's primary use case is to assess the strength of credit card security measures, while its intentionally incomplete functionality indicates it is intended for educational or testing purposes rather than practical exploitation.

The Cobalt Strike Aggressor Script Collection provides a set of scripts designed to enhance post-exploitation capabilities within the Cobalt Strike framework. Key features include techniques for privilege escalation, persistence, and situational awareness, along with accessible notes that facilitate streamlined operations during engagements. This tool is primarily used by security professionals for advanced exploitation and operational efficiency in red team scenarios.

NTLMX is a post-exploitation tool designed for extracting local NTLM user password hashes from the Windows registry, supporting both modern AES-128-CBC techniques introduced in Windows 10 and traditional MD5/RC4 methods for earlier versions. The tool requires SYSTEM privileges to operate and can be easily installed via PowerShell Gallery or from the GitHub repository. It has been validated on multiple Windows versions, ensuring compatibility across various PowerShell environments.

PEH (Post Exploitation Helper) is a script designed to facilitate the downloading of common post-exploitation tools onto a target machine with minimal commands. Its primary use case is to operate on machines lacking internet access, allowing users to specify tool files and network interfaces for resource acquisition. Key features include flexible file input, configurable network interface and port options, and straightforward usage through command-line commands.

PentaDrone is an asynchronous PowerShell post-exploitation agent designed for red teaming and penetration testing, utilizing the Mitre Att&ck framework for automation through an autopilot mode. It allows security researchers to simulate HTTP loader-style botnets, facilitating malware research while providing extensive configurability for command-and-control server connections and agent behavior. Notable features include various persistence methods, USB spreading options, and customizable operational parameters.

Powerexploit is a PowerShell-based exploitation framework designed to facilitate offensive post-exploitation tasks in Windows environments. It enables security professionals to automate the process of gaining and maintaining access to targets, quickly exfiltrating sensitive information, and leveraging vulnerabilities within the system. Notable features include a modular architecture for plugins, support for various attack vectors, and inherent obfuscation techniques to evade detection by security tools.

Clipboard-Hijacker is a post-exploitation payload designed for penetration testing that monitors and captures clipboard data on a target machine. It automatically sends captured clipboard contents, which may include sensitive information, to a specified web server or webhook every 10 seconds, while also optionally logging data locally. Notable features include the ability to modify clipboard contents and error handling mechanisms for reliable data transmission.

Powtel is a remote system control tool designed for Windows environments, utilizing PowerShell and Telegram as its communication interface. Its primary use case is for authorized security testing and post-exploitation activities, providing features such as task scheduling, file upload/download capabilities, and screenshot functionality. The tool emphasizes ethical usage, aiming to aid cybersecurity professionals and researchers in controlled settings.

Redpill is a post-exploitation tool designed to facilitate various tasks following initial access via reverse TCP shells, particularly for red team engagements. It comprises a collection of PowerShell scripts, with the main script, redpill.ps1, serving as a central hub to download, configure, and execute these scripts, offering functionalities similar to the meterpreter environment. Notable features include system enumeration, remote process management, web server deployment, and a keystroke logger, all intended to enhance the capabilities of shell access in compromised systems.

Sh3ller is a lightweight command-and-control (C2) framework designed for managing incoming reverse shells via PowerShell. Its primary use case is to maintain persistent access to compromised systems, allowing users to manage multiple shell sessions simultaneously with minimal dependencies. Notable features include an always-on listening mode, support for various reverse shell payloads, and intuitive session management commands.

box-ps is a PowerShell sandboxing utility designed to execute PowerShell scripts in a controlled environment, mitigating security risks associated with running untrusted code. Its primary use case includes testing and analyzing scripts while allowing specific behaviors, such as file system manipulation and process management, through a defined set of properties. Notable features include detailed behavior tracking for code execution, subprocess control, and network probing, along with comprehensive error handling to address various operational issues.

DFIRWS is a digital forensics and incident response (DFIR) tool designed to operate within a Windows Sandbox environment, facilitating streamlined setup and maintenance of necessary forensics tools. Its notable features include automated downloading and updating of DFIR tools through a PowerShell script, synchronization capabilities for offline environments, and a user-friendly configuration process for sandbox setups. This tool is particularly advantageous for cybersecurity professionals seeking to perform incident response without the complexities of managing an extensive DFIR toolkit.

The Mandiant VM-Packages repository provides PowerShell scripts that facilitate the installation and configuration of tools for binary analysis environments, specifically FLARE VM and CommandoVM. Notable features include automated package building and testing using GitHub Actions, a public MyGet package feed for easy access, and community contributions for package development and improvement. This setup enhances transparency and reduces manual maintenance for users, ensuring that tools can be effortlessly integrated into their virtual machine environments.

xeca is a tool designed for creating encrypted PowerShell payloads intended for offensive security applications. It enables users to develop position-independent shellcode from DLL files and integrates an AMSI bypass feature for enhanced stealth. Key functionalities include encryption of payloads, remote execution capabilities, and retrieval of decryption keys via a controlled web server.

The Windows-Hardening-CTF is a PowerShell script designed to enhance the security posture of Windows devices by implementing a series of hardening measures. Its primary use case is to mitigate various attack vectors by disabling unnecessary features, enforcing security logging, and applying best practices recommended by the NSA. Notable features include enabling Windows Defender protections, configuring AppLocker, and disabling legacy protocols such as SMB v1 and PowerShell v2.

Vulmap-Windows is a network vulnerability mapping tool designed for Windows environments that identifies potential security vulnerabilities across various network services. Its primary use case is to assist security professionals in assessing network risks by providing comprehensive views of exploitable vulnerabilities. Notable features include automated scanning, integration with various vulnerability databases, and customizable reporting options.

The fleet-cve-scanner is an open-source, PowerShell 7-based CVE scanner designed for managing vulnerabilities in software across RMM-managed fleets, without the need for agents or appliances. It cross-references the software inventory of managed endpoints against multiple authoritative security feeds to determine if installed software versions are vulnerable and assess their urgency. Key features include the ability to generate per-device CSV reports, a SQLite history database for change tracking, and an HTML dashboard, making vulnerability assessment and management streamlined and efficient.

The Public-Scripts repository offers a collection of PowerShell scripts designed for enhancing identity security and automating tasks within Microsoft 365 and Windows infrastructure. Notable features include scripts for Entra ID credential enumeration, Exchange app access policy audits, and OSINT tools, all aimed at streamlining enterprise management and security auditing processes. This repository consolidates tools previously available on TechNet Gallery and provides links to companion blog posts for additional context and usage guidance.

The Rubber Ducky Bad USB is a script that mimics the behavior of a Rubber Ducky device, utilizing the WshShell.SendKeys method from Windows Script Host to execute various commands for information gathering. It primarily serves as an educational tool to collect system and network information, including Wi-Fi passwords, by running a PowerShell script from a USB drive that is treated as a trusted Human Interface Device. Notable features include the automatic creation of a Data directory on the USB, comprehensive system data collection capabilities, and the ability to bypass script execution policies for enhanced control.

FlipperZero is a tool designed for executing BadUSB attacks using scripts based on the DuckyScript language on the Flipper Zero device. Its primary use case revolves around both defensive and offensive scenarios, facilitating security awareness demonstrations or performing penetration testing via various pre-defined scripts for phishing, pin brute-forcing, and credential exfiltration. Notable features include the ability to automate web actions, access sensitive information, and deploy awareness campaigns by executing scripts that interact with commonly used applications and services.

GhostPack Binaries is a repository offering precompiled binaries and scripts for various security and red team tools compatible with Windows, Linux, and macOS. Its primary use case is to facilitate authorized security testing and educational purposes, providing streamlined access to essential utilities while emphasizing the importance of ethical usage. Notable features include cross-platform support and a focus on prebuilt security tools, enabling users to conduct red teaming activities efficiently.

Herramientas y utilidades de pentesting, ethical hacking y seguridad ofensiva.

Proxy_Bypass is a post-exploitation tool designed to identify user agents capable of circumventing proxy restrictions. It offers batch processing, the ability to test various user agents against specific domains, and includes a predefined library of user agents for immediate use. Notable features include verbose output, support for custom user agents, and future enhancements such as multi-threading and additional language support.

ThreatHunting-Keywords is a repository providing a comprehensive list of keywords to facilitate threat hunting activities in cybersecurity. It serves both blue teams and red teams, offering tools and methodologies for detecting and analyzing malicious activities that may evade automated security systems. Notable features include integration with SIEM tools like Splunk and ELK, DFIR optimized hunting strategies, and support for creating detections using YARA rules and SIGMA rules.

MSSprinkler is a PowerShell-based password spraying utility designed to test Microsoft Online accounts while minimizing the risk of account lockouts. It features a low-and-slow approach, configurable attempt thresholds, and the ability to gather verbose account and tenant information without triggering MFA prompts. Notably, it logs access and refresh tokens for successful sign-ins, enhances testing efficiency by detecting non-existent or locked-out accounts, and stores results in JSON and CSV formats.

Red Team Playbooks is a comprehensive repository designed to assist cybersecurity professionals in Red Team engagements by providing a collection of open-source tools, techniques, and procedures. Its primary use case includes guiding users through various phases of penetration testing such as reconnaissance, exploitation, and post-exploitation activities. Notable features include detailed playbooks for each stage of an attack lifecycle, covering essential actions from initial access to data exfiltration and situational awareness.

PDB2JSON is an Azure Functions-based application designed for secure authentication of running memory in Windows systems through its extensive SHA256 hash database. The tool provides a JSON-based interface for remote interactions with a Code+PDB analysis server, enabling functionalities like symbol resolution and hash verification without uploading binary data. Its notable features include a just-in-time hashing methodology for integrity protection and automation support for memory dump analysis through various scripting examples.

The "Malware" repository offers a collection of malware samples and resources for cybersecurity professionals. Its primary use case is to facilitate testing and analysis of malware, including the ability to download various samples using proxy tools like proxychains. Notable features include the inclusion of the EICAR test file for antivirus testing and the ability to aggregate IP addresses from logs for streamlined malware acquisition.

HashDump-BypassEDR is a tool designed to circumvent Endpoint Detection and Response (EDR) solutions by utilizing the `reg.exe` command to export critical registry information, enabling the dumping of password hashes from Windows systems. Its notable features include the ability to operate with minimal permissions on certain Windows versions, alongside an effective method for retrieving the BootKey necessary for the process without detection by most antivirus software. The tool's practicality is underscored by its testing across various Windows environments, showcasing its robustness in real-world applications.

AES-Encoder is a PowerShell-based tool designed for crypting and obfuscating PowerShell scripts, primarily to evade modern antivirus detection. It features advanced capabilities such as variable name randomization, compression, and encryption, as well as support for recursive layering and AMSI bypassing for enhanced security. The tool is open-source, allowing users to easily modify and create their own variants for educational purposes.

🎒 An up-to-date collection of precompiled binaries and hacking scripts.

JMP-AMSI is a Proof of Concept tool designed to demonstrate the manipulation of managed code pointers in the PowerShell runtime, specifically targeting the Antimalware Scan Interface (AMSI) to bypass its scanning capabilities. Notable features include in-memory execution, native memory manipulation without using highly monitored functions, and multi-architecture support for dynamic assembly patching. The tool provides options for telemetry interruption and detailed verbose output for testing and research purposes.

MSFT-IP-Tracker is a tool designed to monitor and track Microsoft IP addresses for applications in security research, firewall configurations, routing, and troubleshooting. It collects data from a range of Autonomous System Numbers (ASNs) and publishes daily updates featuring IPv4 and IPv6 addresses in CIDR notation. Notable features include automated daily releases and a comprehensive source of Microsoft’s ASN IP ranges, providing users with up-to-date information for network decision-making.

PowerShell is a task automation and configuration management framework that enables users to script and execute administrative tasks across various operating systems, although it lacks full feature parity on non-Windows platforms. Its notable features include a robust command-line interface, scripting capabilities for system management, and a focus on script reliability and reuse. The tool is particularly useful for network troubleshooting and performance monitoring, exemplified by scripts like TimeTrack-Specific-Software-Openings.ps1, which measures application launch times.

PrecompiledBinaries is a curated repository of precompiled binaries designed for use in authorized security testing, including penetration testing, red teaming, and exploit validation. It facilitates rapid access to essential tools across various scenarios such as privilege escalation, Active Directory assessments, and tunneling, eliminating the need for time-consuming compilation from source. Notable features include an organized layout of binaries by tool and platform, covering a wide range of use cases in security assessments.

SiteSniper is an automation script designed for blackbox penetration testing, leveraging tmux for organizing and executing various penetration testing scripts across multiple phases. Its primary use case involves preparation and execution of commands for tasks such as information gathering, exploit identification, and web application analysis. Notable features include a user-friendly interface for phase selection, precompiled command execution, and a structured approach to manage multiple testing sessions efficiently.

OffsetInspect is a PowerShell toolkit designed for byte-offset inspection, source correlation, binary comparison, and defensive detection-boundary analysis. It enables analysts to identify specific content at given byte offsets and the surrounding context, while also facilitating detection workflows inspired by ThreatCheck and offering a suite of red-team analysis and triage capabilities. Notable features include efficient file handling, contextual mapping, multi-region detection, and an in-memory approach to avoid interference with endpoint protection mechanisms.

PowerLadon is a modular penetration testing tool designed for network reconnaissance, vulnerability scanning, and exploitation, offering capabilities for batch processing across various IP segments. It features extensive support for different protocols, built-in modules for high-risk vulnerabilities, password auditing, and remote command execution, while allowing users to customize and develop their own plugins. Its ease of use and compatibility with PowerShell and Cobalt Strike enhance its versatility in both internal and external network penetration tasks.

Amnesiac is a post-exploitation framework developed in PowerShell that facilitates lateral movement within Active Directory environments without the need for installation, as it operates entirely in memory. It features command execution over Named Pipes for discreet operations, a user-friendly interface, and a variety of integrated modules for tasks such as keylogging and Kerberos ticket dumping. The tool is designed for research and authorized testing, emphasizing user responsibility in compliance with legal regulations.

WiFi Password Stealer is a cybersecurity tool designed to extract WiFi credentials from target computers using keystroke injection techniques via a USB device, specifically leveraging a Raspberry Pi Pico configured as a Rubber Ducky. The tool facilitates information exfiltration through customized payloads, allowing stolen data to be sent over email or stored on a USB drive. It demonstrates advanced attack vectors, including both Rubber Ducky and Bash Bunny methods, while emphasizing the importance of physical access to the target system.

EntraFalcon is a PowerShell-based assessment tool that helps pentesters, security analysts, and system administrators evaluate the security posture of Microsoft Entra ID environments. It performs over 80 automated checks to identify weak configurations and risky assignments, such as excess permissions on privileged accounts and improper Conditional Access policies, and presents findings in interactive HTML reports for detailed analysis. The tool is easy to use across platforms, requiring no additional modules and offering built-in authentication to streamline deployment.

The "exchange-penetration-testing" tool provides a comprehensive framework for performing penetration tests on Microsoft Exchange servers. It facilitates reconnaissance, brute-force attacks, and exploitation of vulnerabilities such as ProxyLogon and ProxyShell, alongside automated enumeration of the Global Address List (GAL). Notable features include the ability to conduct password spraying and provide access to critical vulnerabilities, enabling security professionals to assess and strengthen Exchange server defenses effectively.

RTI-Toolkit is an open-source PowerShell toolkit designed for executing and defending against Remote Template Injection (RTI) attacks in Microsoft Office documents, specifically DOCX files. It features key cmdlets such as `Invoke-Template` and `Invoke-Regular`, which facilitate the implementation of malicious remote template links, while `Invoke-Identify` assists in detecting such links, positioning the toolkit as both an offensive and defensive resource in the cybersecurity landscape. Notably, the tool is referenced in the NIST National Vulnerability Database under multiple CVEs, underscoring its significance in addressing this type of vulnerability.

SnafflerParser is a parsing tool designed to process the output from Snaffler, generating user-friendly reports in various formats (TXT, CSV, HTML, JSON) for easier analysis of large datasets. Key features include interactive HTML reports with filtering, dynamic sorting, keyword highlighting, review workflows, and pagination, along with the ability to export processed results and maintain state between sessions. The tool enhances visibility and manageability of Snaffler output, making it suitable for large environment assessments.

AzureAttackKit is a comprehensive suite of tools designed for penetration testing and assessments of Azure environments from a Windows machine or Azure Cloud Shell. Its primary use case is to streamline the collection of Azure resources, enabling automated queries and security checks across multiple subscriptions using tools like PowerZure, AzureHound, and AADInternals. Notable features include the ability to quickly pull subscription data, execute targeted scripts for information gathering, and employ regular expressions for searching sensitive information within Azure resource configurations.

JAMBOREE is a portable installer that rapidly sets up a comprehensive security and administrative toolkit for Android app testing without requiring local admin rights on Windows. It provisions a functional environment including Android AVD, Magisk, Frida, Objection, and Burp Suite in seconds with no bundled binaries, all driven by an open-source PowerShell script. Key features include built-in proxy configurations, an intuitive PowerShell UI for launching tools, and an optional collection of additional utilities for advanced security assessments.

MovementHound is a PowerShell tool designed for active enumeration of lateral movement capabilities in Windows environments, focusing on the effective rights a principal possesses rather than simple group memberships. This approach allows users to identify potential access paths that may be overlooked by traditional enumeration methods, making it particularly effective in environments with modified DACLs and security descriptors. Notable features include integration with BloodHound Legacy for detailed access mapping and a comprehensive output that aids in identifying persistent footholds during security assessments.

Scoop Security is a Scoop bucket specifically designed for penetration testing and cybersecurity tools, enabling users to easily install and manage various security applications via PowerShell commands. Key features include a curated list of tools such as vulnerability scanners, webshell management clients, and advanced web scanning utilities, providing a comprehensive resource for security professionals. The setup process is streamlined through straightforward installation commands, facilitating quick access to essential cybersecurity tools.

o365recon is a PowerShell script designed for retrieving information from Office 365 and Azure AD using valid credentials. Its primary use case is to facilitate information gathering for security assessments, with a notable feature allowing optional Azure querying through a simple command-line interface. The tool requires the installation of MSOnline and AzureAD modules and includes support for multi-factor authentication.

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

The Official Bash Bunny Payload Repository

Chimera is a PowerShell obfuscation script designed to bypass AMSI and commercial antivirus solutions.

K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)

Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Microsoft Entra ID security configuration reviews.

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

OSCP Cheat Sheet

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.

A post exploitation tool based on a web application, focusing on bypassing endpoint protection and application whitelisting

This repository is a collection of powershell functions every hacker should know

Privilege Escalation Enumeration Script for Windows

Dominate Active Directory with PowerShell.

全平台 QQ 聊天数据库解密

RedSnarf is a pen-testing / red-teaming tool for Windows environments

Red Teaming Tactics and Techniques

SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.

SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS

A repository of sysmon configuration modules

Windows Local Privilege Escalation Cookbook

Automation for internal Windows Penetrationtest / AD-Security

A PowerShell script anti-virus evasion tool