This is a curated list of tools for this category.
- 403Bypasser - Automates The Techniques Used To Circumvent Access Control Restrictions On Target Pages
- ACT Platform - Open Platform For Collection And Exchange Of Threat Intelligence Information
- ADAPT - Tool That Performs Automated Penetration Testing For WebApps
- APTRS - Automated Penetration Testing Reporting System
- ARTIF - An Advanced Real Time Threat Intelligence Framework To Identify Threats And Malicious Web Traffic On The Basis Of IP Reputation And Historical Data.
- ATTACKdatamap - A Datasource Assessment On An Event Level To Show Potential Coverage Or The MITRE ATT&CK Framework
- AbsoluteZero - Python APT Backdoor
- AgentSmith-HIDS - Open Source Host-based Intrusion Detection System (HIDS)
- Behave - A Monitoring Browser Extension For Pages Acting As Bad Boys
- Bheem - Simple Collection Of Small Bash-Scripts Which Runs Iteratively To Carry Out Various Tools And Recon Process
- CRLFsuite - Fast CRLF Injection Scanning Tool
- CTFTOOL - Interactive CTF Exploration Tool
- Constellation - A Graph-Focused Data Visualisation And Interactive Analysis Application
- Cynet Free IR Tool Offering Empowers Responders to Know and Act Against Active Attacks
- DNS-Shell - An Interactive Shell Over DNS Channel
- DNSMonster - Passive DNS Capture/Monitoring Framework
- DNSObserver - A Handy DNS Service Written In Go To Aid In The Detection Of Several Types Of Blind Vulnerabilities
- Dent - A Framework For Creating COM-based Bypasses Utilizing Vulnerabilities In Microsoft's WDAPT Sensors
- DetectionLab - Vagrant And Packer Scripts To Build A Lab Environment Complete With Security Tooling And Logging Best Practices
- DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk
- Ditto - A Tool For IDN Homograph Attacks And Detection
- DongTai - An Interactive Application Security testing(IAST) Product That Supports The Detection Of OWASP WEB TOP 10 Vulnerabilities, Multi-Request Related Vulnerabilities (Including Logic Vulnerabilities, Unauthorized Access Vulnerabilities, Etc.), Third-Party Component Vulnerabilities, Etc.
- Dorothy - Tool To Test Security Monitoring And Detection For Okta Environments
- DrSemu - Malware Detection And Classification Tool Based On Dynamic Behavior
- Egress-Assess - Tool Used To Test Egress Data Detection Capabilities
- Exfilkit - Data Exfiltration Utility For Testing Detection Capabilities
- Factual-Rules-Generator - An Open Source Project Which Aims To Generate YARA Rules About Installed Software From A Machine
- Fenrir - Simple Bash IOC Scanner
- Flerken - Obfuscated Command Detection Tool
- Freddy - Automatically Identify Deserialisation Issues In Java And .NET Applications By Using Active And Passive Scans
- GIVINGSTORM - Infection Vector That Bypasses AV, IDS, And IPS
- Gatekeeper - First Open-Source DDoS Protection System
- Girsh - Automatically Spawn A Reverse Shell Fully Interactive
- Goop - Google Search Scraper (Bypass CAPTCHA)
- Grapl - Graph Platform For Detection And Response
- Halogen - Automatically Create YARA Rules From Malicious Documents
- Haptyc - Test Generation Framework
- Heap_Detective - The Simple Way To Detect Heap Memory Pitfalls In C++ And C
- Heaptrace - Helps Visualize Heap Operations For Pwn And Debugging
- HiddenWall - Linux Kernel Module Generator For Custom Rules With Netfilter (Block Ports, Hidden Mode, Rootkit Functions, Etc)
- HoneyPy - A Low To Medium Interaction Honeypot
- HookDump - Security Product Hook Detection
- IRFuzz - Simple Scanner with Yara Rule
- Icebox - Virtual Machine Introspection, Tracing & Debugging
- In0ri - Defacement Detection With Deep Learning
- Indicator-Intelligence - Finds Related Domains And IPv4 Addresses To Do Threat Intelligence After Indicator-Intelligence Collects Static Files
- Indicator-Intelligence - Finds Related Domains And IPv4 Addresses To Do Threat Intelligence After Indicator-Intelligence Collects Static Files
- Interactsh - An OOB Interaction Gathering Server And Client Library
- Ioccheck - A Tool For Simplifying The Process Of Researching IOCs
- Js-X-Ray - JavaScript And Node.js Open-Source SAST Scanner (A Static Analysis Of Detecting Most Common Malicious Patterns)
- KaliIntelligenceSuite - Shall Aid In The Fast, Autonomous, Central, And Comprehensive Collection Of Intelligence By Executing Standard Penetration Testing Tools
- Koppeling - Adaptive DLL Hijacking / Dynamic Export Forwarding
- Kraken - Cross-platform Yara Scanner Written In Go
- Kunyu - More Efficient Corporate Asset Collection
- Lollipopz - Data Exfiltration Utility For Testing Detection Capabilities
- MSI Dump - A Tool That Analyzes Malicious MSI Installation Packages, Extracts Files, Streams, Binary Data And Incorporates YARA Scanner
- MacOSThreatTrack - Bash Tool Used For Proactive Detection Of Malicious Activity On macOS Systems
- Malicious-Pdf - Generate A Bunch Of Malicious Pdf Files With Phone-Home Functionality
- MalwareSourceCode - Collection Of Malware Source Code For A Variety Of Platforms In An Array Of Different Programming Languages
- Melody - A Transparent Internet Sensor Built For Threat Intelligence
- Memhunter - Live Hunting Of Code Injection Techniques
- Misp-Dashboard - A Dashboard For A Real-Time Overview Of Threat Intelligence From MISP Instances
- Msticpy - Microsoft Threat Intelligence Security Tools
- Multi-Juicer - Run Capture The Flags And Security Trainings With OWASP Juice Shop
- Narthex - Modular Personalized Dictionary Generator
- Neurax - A Framework For Constructing Self-Spreading Binaries
- Nim-RunPE - A Nim Implementation Of Reflective PE-Loading From Memory
- Nivistealer - Steal Victim Images Exact Location Device Info And Much More
- NtHiM - Super Fast Sub-domain Takeover Detection
- Odin - Central IoC Scanner Based On Loki
- Offering Users More For Their Activity - Similar Items Upon Checkout
- Ohmybackup - Scan Victim Backup Directories & Backup Files
- OpenCTI - Open Cyber Threat Intelligence Platform
- Oralyzer - Open Redirection Analyzer
- Oralyzer - Tool To Identify Open Redirection
- Orbit v2.0 - Blockchain Transactions Investigation Tool
- PXEThief - Set Of Tooling That Can Extract Passwords From The Operating System Deployment Functionality In Microsoft Endpoint Configuration Manager
- PasteHunter - Scanning Pastebin With Yara Rules
- Phantun - Transforms UDP Stream Into (Fake) TCP Streams That Can Go Through Layer 3 &Amp; Layer 4 (NAPT) firewalls/NATs
- Pict - Post-Infection Collection Toolkit
- Pidrila - Python Interactive Deepweb-oriented Rapid Intelligent Link Analyzer
- Polypyus - Learns To Locate Functions In Raw Binaries By Extracting Known Functions From Similar Binaries
- PortBender - TCP Port Redirection Utility
- Pown-Duct - Essential Tool For Finding Blind Injection Attacks
- Procrustes - A Bash Script That Automates The Exfiltration Of Data Over Dns In Case We Have A Blind Command Execution On A Server Where All Outbound Connections Except DNS Are Blocked
- PyBeacon - A Collection Of Scripts For Dealing With Cobalt Strike Beacons In Python
- PyRDP - RDP Monster-In-The-Middle (Mitm) And Library For Python With The Ability To Watch Connections Live Or After The Fact
- Pyattck - A Python Module To Interact With The Mitre ATT&CK Framework
- Pyrdp - RDP Man-In-The-Middle And Library For Python3 With The Ability To Watch Connections Live Or After The Fact
- Python-Iocextract - Advanced Indicator Of Compromise (IOC) Extractor
- Rconn - Rconn Is A Multiplatform Program For Creating Generic Reverse Connections
- RdpThief - Extracting Clear Text Passwords From Mstsc.Exe Using API Hooking
- RecoverPy - Interactively Find And Recover Deleted Or Overwritten Files From Your Terminal
- RedShell - An interactive command prompt that executes commands through proxychains and automatically logs them on a Cobalt Strike team server
- RedTeam-Physical-Tools - Red Team Toolkit - A Curated List Of Tools That Are Commonly Used In The Field For Physical Security, Red Teaming, And Tactical Covert Entry
- RedTeam-Physical-Tools - Red Team Toolkit - A Curated List Of Tools That Are Commonly Used In The Field For Physical Security, Red Teaming, And Tactical Covert Entry
- Reverse-Shell-Generator - Hosted Reverse Shell Generator With A Ton Of Functionality
- ReverseSSH - Statically-linked Ssh Server With Reverse Shell Functionality For CTFs And Such
- SAyHello - Capturing Audio (.Wav) From Target Using A Link
- SCREEN_KILLER - Tool To Track Progress For Reporting (Capture Screenshot, Commands And Outputs) During Pentest Engagement And OSCP
- SGXRay - Automating Vulnerability Detection for SGX Apps
- SQLancer - Detecting Logic Bugs In DBMS
- SSTImap - Automatic SSTI Detection Tool With Interactive Interface
- Screenspy - Capture user screenshots using shortcut file (Bypass SmartScreen/Defender)
- Scriptkiddi3 - Streamline Your Recon And Vulnerability Detection Process With SCRIPTKIDDI3, A Recon And Initial Vulnerability Detection Tool Built Using Shell Script And Open Source Tools
- Seatbelt - A C# Project That Performs A Number Of Security Oriented Host-Survey "Safety Checks" Relevant From Both Offensive And Defensive Security Perspectives
- SecureTea Project - The Purpose Of This Application Is To Warn The User (Via Various Communication Mechanisms) Whenever Their Laptop Accessed
- Seth - Perform A MitM Attack And Extract Clear Text Credentials From RDP Connections
- SharpSCCM - A C# Utility For Interacting With SCCM
- Simple-Live-Data-Collection - Simple Live Data Collection Tool
- Slipstream - NAT Slipstreaming Allows An Attacker To Remotely Access Any TCP/UDP Services Bound To A Victim Machine, Bypassing The Victim's NAT/firewall, Just By The Victim Visiting A Website
- Snare - Super Next Generation Advanced Reactive honEypot
- Spyre - Simple YARA-based IOC Scanner
- Strafer - A Tool To Detect Potential Infections In Elasticsearch Instances
- StreamDivert - Redirecting (Specific) TCP, UDP And ICMP Traffic To Another Destination
- ThreatHunting - A Splunk App Mapped To MITRE ATT&CK To Guide Your Threat Hunts
- ThreatIngestor - Extract And Aggregate Threat Intelligence
- Threatest - Threatest Is A Go Framework For End-To-End Testing Threat Detection Rules
- TwiTi - Tool for extracting IOCs from tweet
- Typodetect - Detect The Active Mutations Of Domains
- Upload_Bypass_Carnage - File Upload Restrictions Bypass, By Using Different Bug Bounty Techniques!
- Velociraptor - Endpoint Visibility and Collection Tool
- WSMan-WinRM - A Collection Of Proof-Of-Concept Source Code And Scripts For Executing Remote Commands Over WinRM Using The WSMan.Automation COM Object
- Web Hacker's Weapons - A Collection Of Cool Tools Used By Web Hackers
- WhatTheHack - A Collection Of Challenge Based Hack-A-Thons Including Student Guide, Proctor Guide, Lecture Presentations, Sample/Instructional Code And Templates
- Winevt_Logs_Analysis - Searching .Evtx Logs For Remote Connections
- X-force - IBM Security Utilitary Library In Python. Search And Query All Sources: Threat_Activities And Groups, Malware_Analysis, Industries
- YARASAFE - Automatic Binary Function Similarity Checks with Yara
- Yaralyzer - Visually Inspect And Force Decode YARA And Regex Matches Found In Both Binary And Text Data, With Colors
- Yeti - Your Everyday Threat Intelligence
- Zircolite - A Standalone SIGMA-based Detection Tool For EVTX, Auditd And Sysmon For Linux Logs
- cThreadHijack - Beacon Object File (BOF) For Remote Process Injection Via Thread Hijacking
- laravelN00b - Automated Scan .env Files And Checking Debug Mode In Victim Host
- magicRecon - A Powerful Shell Script To Maximize The Recon And Data Collection Process Of An Objective And Finding Common Vulnerabilities
- modDetective - Tool That Chronologizes Files Based On Modification Time In Order To Investigate Recent System Activity
- Vortex - Threat intelligence fusion platform aggregating 50+ feeds with ML-powered correlation, predictive scoring, IOC extraction, and MITRE ATT&CK/STIX/TAXII integration. Written in Julia.