RED TEAM TOOLS LIST 2023

ACTIVE INTELLIGENCE GATHERING

EyeWitness is designed to take screenshots of websites, provide some server header

info, and identify default credentials if possible.
AWSBucketDump is a tool to quickly enumerate AWS S3 buckets to look for loot.
AQUATONE is a set of tools for performing reconnaissance on domain names.
spoofcheck a program that checks if a domain can be spoofed. The program checks SPF
and DMARC records for weak configurations that allow spoofing.
Nmap is used to discover hosts and services on a computer network, thus building a
“map” of the network.
dnsrecon a tool DNS Enumeration Script.
dirsearch is a simple command line tool designed to brute force directories and
files in websites.
Sn1per automated pentest recon scanner.

PASSIVE INTELLIGENCE GATHERING

Social Mapper Social Media Mapping Tool, takes a list of names & images (or
LinkedIn company name) and performs automated target searching on a huge scale
across multiple social media sites. Not restricted by APIs as it instruments a
browser using Selenium. Outputs reports to aid in correlating targets across sites.
skiptracer OSINT scraping framework, utilizes some basic python webscraping
(BeautifulSoup) of PII paywall sites to compile passive information on a target on
a ramen noodle budget.
FOCA (Fingerprinting Organizations with Collected Archives) is a tool used mainly
to find metadata and hidden information in the documents its scans.
theHarvester is a tool for gathering subdomain names, e-mail addresses, virtual
hosts, open ports/ banners, and employee names from different public sources.
Metagoofil is a tool for extracting metadata of public documents
(pdf,doc,xls,ppt,etc) availables in the target websites.
SimplyEmail Email recon made fast and easy, with a framework to build on.
truffleHog searches through git repositories for secrets, digging deep into commit
history and branches.
Just-Metadata is a tool that gathers and analyzes metadata about IP addresses. It
attempts to find relationships between systems within a large dataset.
typofinder a finder of domain typos showing country of IP address.
pwnedOrNot is a python script which checks if the email account has been
compromised in a data breach, if the email account is compromised it proceeds to
find passwords for the compromised account.
GitHarvester This tool is used for harvesting information from GitHub like google
dork.
pwndb is a python command-line tool for searching leaked credentials using the
Onion service with the same name.
LinkedInt LinkedIn Recon Tool.
CrossLinked LinkedIn enumeration tool to extract valid employee names from an
organization through search engine scraping.
findomain is a fast domain enumeration tool that uses Certificate Transparency logs
and a selection of APIs.

FRAMEWORKS
Maltego is a unique platform developed to deliver a clear threat picture to the
environment that an organization owns and operates.
SpiderFoot the open source footprinting and intelligence-gathering tool.
datasploit is an OSINT Framework to perform various recon techniques on Companies,
People, Phone Number, Bitcoin Addresses, etc., aggregate all the raw data, and give
data in multiple formats.
Recon-ng is a full-featured Web Reconnaissance framework written in Python.
WEAPONIZATION

WinRAR Remote Code Execution Proof of Concept exploit for CVE-2018-20250.

Composite Moniker Proof of Concept exploit for CVE-2017-8570.
Exploit toolkit CVE-2017-8759 is a handy python script which provides pentesters
and security researchers a quick and effective way to test Microsoft .NET Framework
RCE.
CVE-2017-11882 Exploit accepts over 17k bytes long command/code in maximum.
Adobe Flash Exploit CVE-2018-4878.
Exploit toolkit CVE-2017-0199 is a handy python script which provides pentesters
and security researchers a quick and effective way to test Microsoft Office RCE.
demiguise is a HTA encryption tool for RedTeams.
Office-DDE-Payloads collection of scripts and templates to generate Office
documents embedded with the DDE, macro-less command execution technique.
CACTUSTORCH Payload Generation for Adversary Simulations.
SharpShooter is a payload creation framework for the retrieval and execution of
arbitrary CSharp source code.
Don’t kill my cat is a tool that generates obfuscated shellcode that is stored
inside of polyglot images. The image is 100% valid and also 100% valid shellcode.
Malicious Macro Generator Utility Simple utility design to generate obfuscated
macro that also include a AV / Sandboxes escape mechanism.
SCT Obfuscator Cobalt Strike SCT payload obfuscator.
Invoke-Obfuscation PowerShell Obfuscator.
Invoke-CradleCrafter PowerShell remote download cradle generator and obfuscator.
Invoke-DOSfuscation cmd.exe Command Obfuscation Generator & Detection Test Harness.
morphHTA Morphing Cobalt Strike’s evil.HTA.
Unicorn is a simple tool for using a PowerShell downgrade attack and inject
shellcode straight into memory.
Shellter is a dynamic shellcode injection tool, and the first truly dynamic PE
infector ever created.
EmbedInHTML Embed and hide any file in an HTML file.
SigThief Stealing Signatures and Making One Invalid Signature at a Time.
Veil is a tool designed to generate metasploit payloads that bypass common anti-
virus solutions.
CheckPlease Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#,
Perl, and Rust.
Invoke-PSImage is a tool to embeded a PowerShell script in the pixels of a PNG file
and generates a oneliner to execute.
LuckyStrike a PowerShell based utility for the creation of malicious Office macro
documents. To be used for pentesting or educational purposes only.
ClickOnceGenerator Quick Malicious ClickOnceGenerator for Red Team. The default
application a simple WebBrowser widget that point to a website of your choice.
macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation
of MS Office documents, VB scripts, and other formats for pentest, demo, and social
engineering assessments.
StarFighters a JavaScript and VBScript Based Empire Launcher.
nps_payload this script will generate payloads for basic intrusion detection
avoidance. It utilizes publicly demonstrated techniques from several different
sources.
The Social-Engineer Toolkit is an open-source penetration testing framework
designed for social engineering.
Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing
credentials via Basic Authentication.
PowerShdll run PowerShell with rundll32. Bypass software restrictions.
Ultimate AppLocker ByPass List The goal of this repository is to document the most
common techniques to bypass AppLocker.
Ruler is a tool that allows you to interact with Exchange servers remotely, through
either the MAPI/HTTP or RPC/HTTP protocol.
Generate-Macro is a standalone PowerShell script that will generate a malicious
Microsoft Office document with a specified payload and persistence method.
Malicious Macro MSBuild Generator Generates Malicious Macro and Execute Powershell
or Shellcode via MSBuild Application Whitelisting Bypass.
Meta Twin is designed as a file resource cloner. Metadata, including digital
signature, is extracted from one file and injected into another.
WePWNise generates architecture-independent VBA code to be used in Office documents
or templates and automates bypassing application control and exploit mitigation
software.
DotNetToJScript a tool to create a JScript file which loads a .NET v2 assembly from
memory.
PSAmsi is a tool for auditing and defeating AMSI signatures.
Reflective DLL injection is a library injection technique in which the concept of
reflective programming is employed to perform the loading of a library from memory
into a host process.
ps1encode use to generate and encode a powershell based metasploit payloads.
Worse PDF turn a normal PDF file into malicious. Use to steal Net-NTLM Hashes from
windows machines.
SpookFlare has a different perspective to bypass security measures and it gives you
the opportunity to bypass the endpoint countermeasures at the client-side detection
and network-side detection.
GreatSCT is an open source project to generate application white list bypasses.
This tool is intended for BOTH red and blue team.
nps running powershell without PowerShell.
Meterpreter_Paranoid_Mode.sh allows users to secure their staged/stageless
connection for Meterpreter by having it check the certificate of the handler it is
connecting to.
The Backdoor Factory (BDF) is to patch executable binaries with user desired
shellcode and continue normal execution of the prepatched state.
MacroShop a collection of scripts to aid in delivering payloads via Office Macros.
UnmanagedPowerShell Executes PowerShell from an unmanaged process.
evil-ssdp Spoof SSDP replies to phish for NTLM hashes on a network. Creates a fake
UPNP device, tricking users into visiting a malicious phishing page.
Ebowla Framework for Making Environmental Keyed Payloads.
make-pdf-embedded a tool to create a PDF document with an embedded file.
avet (AntiVirusEvasionTool) is targeting windows machines with executable files
using different evasion techniques.
EvilClippy A cross-platform assistant for creating malicious MS Office documents.
Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools.
Runs on Linux, OSX and Windows.
CallObfuscator Obfuscate windows apis from static analysis tools and debuggers.
Donut is a shellcode generation tool that creates position-independant shellcode
payloads from .NET Assemblies. This shellcode may be used to inject the Assembly
into arbitrary Windows processes.

PHISHING

King Phisher is a tool for testing and promoting user awareness by simulating real-
world phishing attacks.
FiercePhish is a full-fledged phishing framework to manage all phishing
engagements. It allows you to track separate phishing campaigns, schedule sending
of emails, and much more.
ReelPhish is a Real-Time Two-Factor Phishing Tool.
Gophish is an open-source phishing toolkit designed for businesses and penetration
testers. It provides the ability to quickly and easily set up and execute phishing
engagements and security awareness training.
CredSniper is a phishing framework written with the Python micro-framework Flask
and Jinja2 templating which supports capturing 2FA tokens.
PwnAuth is a web application framework for launching and managing OAuth abuse
campaigns.
Phishing Frenzy Ruby on Rails Phishing Framework.
Phishing Pretexts are a library of pretexts to use on offensive phishing
engagements.
Modlishka is a flexible and powerful reverse proxy, that will take your ethical
phishing campaigns to the next level.
Evilginx2 is a man-in-the-middle attack framework for phishing credentials and
session cookies of any web service.

WATERING HOLE ATTACK

BeEF is short for The Browser Exploitation Framework. It is a penetration testing

tool that focuses on the web browser.

REMOTE ACCESS TOOLS

Cobalt Strike is software for Adversary Simulations and Red Team Operations.
Empire is a post-exploitation framework that includes a pure-PowerShell2.0 Windows
agent, and a pure Python 2.6/2.7 Linux/OS X agent.
Metasploit Framework is a computer security project that provides information about
security vulnerabilities and aids in penetration testing and IDS signature
development.
SILENTTRINITY A post-exploitation agent powered by Python, IronPython, C#/.NET.
Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote
administration and post-exploitation tool mainly written in python.
Koadic or COM Command & Control, is a Windows post-exploitation rootkit similar to
other penetration testing tools such as Meterpreter and Powershell Empire.
PoshC2 is a proxy aware C2 framework written completely in PowerShell to aid
penetration testers with red teaming, post-exploitation and lateral movement.
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and
agent written in golang.
Quasar is a fast and light-weight remote administration tool coded in C#. Providing
high stability and an easy-to-use user interface, Quasar is the perfect remote
administration solution for you.
Covenant is a .NET command and control framework that aims to highlight the attack
surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a
collaborative command and control platform for red teamers.
FactionC2 is a C2 framework which use websockets based API that allows for
interacting with agents and transports.
DNScat2 is a tool is designed to create an encrypted command-and-control (C&C)
channel over the DNS protocol.
Sliver is a general purpose cross-platform implant framework that supports C2 over
Mutual-TLS, HTTP(S), and DNS.
EvilOSX An evil RAT (Remote Administration Tool) for macOS / OS X.
EggShell is a post exploitation surveillance tool written in Python. It gives you a
command line session with extra functionality between you and a target machine.
Gcat a stealthy Python based backdoor that uses Gmail as a command and control
server.
TrevorC2 is a legitimate website (browsable) that tunnels client/server
communications for covert command execution.

STAGING

Rapid Attack Infrastructure (RAI) Red Team Infrastructure… Quick… Fast… Simplified
One of the most tedious phases of a Red Team Operation is usually the
infrastructure setup. This usually entails a teamserver or controller, domains,
redirectors, and a Phishing server.
Red Baron is a set of modules and custom/third-party providers for Terraform which
tries to automate creating resilient, disposable, secure and agile infrastructure
for Red Teams.
EvilURL generate unicode evil domains for IDN Homograph Attack and detect them.
Domain Hunter checks expired domains, bluecoat categorization, and Archive.org
history to determine good candidates for phishing and C2 domain names.
PowerDNS is a simple proof of concept to demonstrate the execution of PowerShell
script using DNS only.
Chameleon a tool for evading Proxy categorisation.
CatMyFish Search for categorized domain that can be used during red teaming
engagement. Perfect to setup whitelisted domain for your Cobalt Strike beacon C&C.
Malleable C2 is a domain specific language to redefine indicators in Beacon’s
communication.
Malleable-C2-Randomizer This script randomizes Cobalt Strike Malleable C2 profiles
through the use of a metalanguage, hopefully reducing the chances of flagging
signature-based detection controls.
FindFrontableDomains search for potential frontable domains.
Postfix-Server-Setup Setting up a phishing server is a very long and tedious
process. It can take hours to setup, and can be compromised in minutes.
DomainFrontingLists a list of Domain Frontable Domains by CDN.
Apache2-Mod-Rewrite-Setup Quickly Implement Mod-Rewrite in your infastructure.
mod_rewrite rule to evade vendor sandboxes.
external_c2 framework a python framework for usage with Cobalt Strike’s External
C2.
Malleable-C2-Profiles A collection of profiles used in different projects using
Cobalt Strike
ExternalC2 a library for integrating communication channels with the Cobalt Strike
External C2 server.
cs2modrewrite a tools for convert Cobalt Strike profiles to modrewrite scripts.
e2modrewrite a tools for convert Empire profiles to Apache modrewrite scripts.
redi automated script for setting up CobaltStrike redirectors (nginx reverse proxy,
letsencrypt).
cat-sites Library of sites for categorization.
ycsm is a quick script installation for resilient redirector using nginx reverse
proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike,
Empire, Metasploit, PoshC2).
Domain Fronting Google App Engine.
DomainFrontDiscover Scripts and results for finding domain frontable CloudFront
domains.
Automated Empire Infrastructure
Serving Random Payloads with NGINX.
meek is a blocking-resistant pluggable transport for Tor. It encodes a data stream
as a sequence of HTTPS requests and responses.
CobaltStrike-ToolKit Some useful scripts for CobaltStrike.
mkhtaccess_red Auto-generate an HTaccess for payload delivery — automatically pulls
ips/nets/etc from known sandbox companies/sources that have been seen before, and
redirects them to a benign payload.
RedFile a flask wsgi application that serves files with intelligence, good for
serving conditional RedTeam payloads.
keyserver Easily serve HTTP and DNS keys for proper payload protection.
DoHC2 allows the ExternalC2 library from Ryan Hanson to be leveraged for command
and control (C2) via DNS over HTTPS (DoH). This is built for the popular Adversary
Simulation and Red Team Operations Software Cobalt Strike
HTran is a connection bouncer, a kind of proxy server. A “listener” program is
hacked stealthily onto an unsuspecting host anywhere on the Internet.

LATERAL MOVEMENT
CrackMapExec is a swiss army knife for pentesting networks.
PowerLessShell rely on MSBuild.exe to remotely execute PowerShell scripts and
commands without spawning powershell.exe.
GoFetch is a tool to automatically exercise an attack plan generated by the
BloodHound application.
ANGRYPUPPY a bloodhound attack path automation in CobaltStrike.
DeathStar is a Python script that uses Empire’s RESTful API to automate gaining
Domain Admin rights in Active Directory environments using a variety of techinques.
SharpHound C# Rewrite of the BloodHound Ingestor.
BloodHound.py is a Python based ingestor for BloodHound, based on Impacket.
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in
HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2,
Extended Security NTLMSSP and Basic HTTP authentication.
SessionGopher is a PowerShell tool that uses WMI to extract saved session
information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla,
and Microsoft Remote Desktop. It can be run remotely or locally.
PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid
penetration testers during all phases of an assessment.
Nishang is a framework and collection of scripts and payloads which enables usage
of PowerShell for offensive security, penetration testing and red teaming. Nishang
is useful during all phases of penetration testing.
Inveigh is a Windows PowerShell LLMNR/mDNS/NBNS spoofer/man-in-the-middle tool.
PowerUpSQL a PowerShell Toolkit for Attacking SQL Server.
MailSniper is a penetration testing tool for searching through email in a Microsoft
Exchange environment for specific terms (passwords, insider intel, network
architecture information, etc.).
DomainPasswordSpray is a tool written in PowerShell to perform a password spray
attack against users of a domain.
WMIOps is a powershell script that uses WMI to perform a variety of actions on
hosts, local or remote, within a Windows environment. It’s designed primarily for
use on penetration tests or red team engagements.
Mimikatz is an open-source utility that enables the viewing of credential
information from the Windows lsass.
LaZagne project is an open source application used to retrieve lots of passwords
stored on a local computer.
mimipenguin a tool to dump the login password from the current linux desktop user.
Adapted from the idea behind the popular Windows tool mimikatz.
PsExec is a light-weight telnet-replacement that lets you execute processes on
other systems, complete with full interactivity for console applications, without
having to manually install client software.
KeeThief allows for the extraction of KeePass 2.X key material from memory, as well
as the backdooring and enumeration of the KeePass trigger system.
PSAttack combines some of the best projects in the infosec powershell community
into a self contained custom PowerShell console.
Internal Monologue Attack Retrieving NTLM Hashes without Touching LSASS.
Impacket is a collection of Python classes for working with network protocols.
Impacket is focused on providing low-level programmatic access to the packets and
for some protocols (for instance NMB, SMB1-3 and MS-DCERPC) the protocol
implementation itself.
icebreaker gets plaintext Active Directory credentials if you’re on the internal
network but outside the AD environment.
Living Off The Land Binaries and Scripts (and now also Libraries) The goal of these
lists are to document every binary, script and library that can be used for other
purposes than they are designed to.
WSUSpendu for compromised WSUS server to extend the compromise to clients.
Evilgrade is a modular framework that allows the user to take advantage of poor
upgrade implementations by injecting fake updates.
NetRipper is a post exploitation tool targeting Windows systems which uses API
hooking in order to intercept network traffic and encryption related functions from
a low privileged user, being able to capture both plain-text traffic and encrypted
traffic before encryption/after decryption.
LethalHTA Lateral Movement technique using DCOM and HTA.
Invoke-PowerThIEf an Internet Explorer Post Exploitation library.
RedSnarf is a pen-testing / red-teaming tool for Windows environments.
HoneypotBuster Microsoft PowerShell module designed for red teams that can be used
to find honeypots and honeytokens in the network or at the host.
PAExec lets you launch Windows programs on remote Windows computers without needing
to install software on the remote computer first.

ESTABLISH NFOOTHOLD

Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP.
It can be used to bypass network restrictions in fully firewalled environments.
reGeorg the successor to reDuh, pwn a bastion webserver and create SOCKS proxies
through the DMZ. Pivot and pwn.
Blade is a webshell connection tool based on console, currently under development
and aims to be a choice of replacement of Chooper.
TinyShell Web Shell Framework.
PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions.
DAMP The Discretionary ACL Modification Project: Persistence Through Host-based
Security Descriptor Modification.