10.8K ·GitHub
What is this?
It is a curated list of cutting-edge open-source security tools for red teamers and threat hunters, covering the full attack lifecycle from reconnaissance to exfiltration.
It is a curated list of cutting-edge open-source security tools for red teamers and threat hunters, covering the full attack lifecycle from reconnaissance to exfiltration.Is this a single tool or an index of many tools?It is an index: a table-of-contents style markdown list linking out to dozens of separate third-party tools and frameworks, organized by attack phase.
It is an index: a table-of-contents style markdown list linking out to dozens of separate third-party tools and frameworks, organized by attack phase.How is the list organized so I can find what I need?Entries are grouped into categories that mirror the attack chain (Reconnaissance, Initial Access, Delivery, Command and Control, Credential Dumping, Privilege Escalation, Defense Evasion, Persistence, Lateral Movement, Exfiltration, Miscellaneous), each listed in a Name/Description/URL table.
Entries are grouped into categories that mirror the attack chain (Reconnaissance, Initial Access, Delivery, Command and Control, Credential Dumping, Privilege Escalation, Defense Evasion, Persistence, Lateral Movement, Exfiltration, Miscellaneous), each listed in a Name/Description/URL table.Do I need to install anything to use this list itself?No, the repository itself is just markdown; each linked tool has its own separate installation requirements (e.g. Python, Go, .NET, Docker) depending on the project.
No, the repository itself is just markdown; each linked tool has its own separate installation requirements (e.g. Python, Go, .NET, Docker) depending on the project.Are the linked tools all safe and actively maintained?Not necessarily; the README warns that many of these legitimate red-team tools can be misused by real threat actors like APT groups and ransomware operators, and individual tool status/maintenance varies.
Not necessarily; the README warns that many of these legitimate red-team tools can be misused by real threat actors like APT groups and ransomware operators, and individual tool status/maintenance varies.Who is this list for?It targets red teamers, penetration testers, and threat hunters/blue teamers who want to study or simulate adversary tradecraft.
It targets red teamers, penetration testers, and threat hunters/blue teamers who want to study or simulate adversary tradecraft.What kind of tools are in the Command and Control section?It covers red team C2 frameworks like Cobalt Strike, Sliver, Havoc, Mythic, Empire, and PoshC2, plus staging/redirector tools for hiding C2 traffic.
It covers red team C2 frameworks like Cobalt Strike, Sliver, Havoc, Mythic, Empire, and PoshC2, plus staging/redirector tools for hiding C2 traffic.Does it include tools for bypassing antivirus and EDR?Yes, the Payload Development subsection lists loaders, packers, and obfuscation frameworks (like ScareCrow, Freeze, Donut, inceptor) specifically designed for AV/EDR evasion.
Yes, the Payload Development subsection lists loaders, packers, and obfuscation frameworks (like ScareCrow, Freeze, Donut, inceptor) specifically designed for AV/EDR evasion.Is this list still updated?It appears actively maintained, including recent additions like AdaptixC2 and Nimhawk alongside long-standing entries like Cobalt Strike and Empire.
It appears actively maintained, including recent additions like AdaptixC2 and Nimhawk alongside long-standing entries like Cobalt Strike and Empire.What are similar projects?Claude-Red, hacker-roadmap, evilginx2, nishang, Awesome-Hacking-Resources, PENTESTING-BIBLE, PowerSploit, wifiphisher
Claude-Red, hacker-roadmap, evilginx2, nishang, Awesome-Hacking-Resources, PENTESTING-BIBLE, PowerSploit, wifiphisherWhich topics is it in?command-and-control, credentials, phishing, privilege-escalation, malware, infosec, osint, hacking-tool, offensive-security, red-team, pentesting, penetration-testing
command-and-control, credentials, phishing, privilege-escalation, malware, infosec, osint, hacking-tool, offensive-security, red-team, pentesting, penetration-testing