Antonlovesdnb

codex-mcp-server. Codex Mcp Server

endpoint-ai-agent-abuse. EAA is a curated catalog of techniques and real-world cases involving abuse of local AI agents through their runtime, configuration, state, tools, and inherited authority.

ADACLScanner. Repo for ADACLScan.ps1 - Your number one script for ACL's in Active Directory

TraceTree. TraceTree - Runtime behavioral analysis tool that maps the process cascade of suspicious packages into a directed tree, catching supply chain attacks that install-time scanners miss.

cuddlephish. Weaponized Browser-in-the-Middle (BitM) for Penetration Testers

agent-directory. Python

Dorothy. Dorothy, the wife your AI agents needs.

remnux-mcp-server. MCP server for using the REMnux malware analysis toolkit via AI assistants

mission-control. Self-hosted control plane for AI agents: dispatch tasks, review runs, track spend, and operate OpenClaw, Claude Code, Codex, and other runtimes.

cli. Google Workspace CLI — one command-line tool for Drive, Gmail, Calendar, Sheets, Docs, Chat, Admin, and more. Dynamically built from Google Discovery Service. Includes AI agent skills.

obsidian-skills. Agent skills for Obsidian. Teach your agent to use Obsidian CLI and open formats including Markdown, Bases, JSON Canvas.

FindMeAccess. Python

vscode-dark-islands. VSCode theme based off the easemate IDE and Jetbrains islands theme

ClickOnceBlobber. Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading a C# port of ProxyBlob Agent.

yara-rule-skill. LLM Agent Skill for YARA rule authoring and review

claude-mem. Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More

MCPControl. MCP server for Windows OS automation

mcp-vnc. Remote desktop control for AI

agent-browser. Browser automation CLI for AI agents

LifeOS. ⛰️A General Hill-climbing AI harness that helps you move from Current State to Ideal State in both Life and Work.

SysmonConfigPusher2. Sysmon Config Pusher - Modernized

ConstructingDefenseLab. Ludus range for the Constructing Defense Lab

thermoptic. A next-generation HTTP stealth proxy which perfectly cloaks requests as the Chrome browser across all layers of the stack.

iii. Effortlessly compose, extend, and observe every service in real-time for the first time ever.

RunAs-Stealer. RunAs Utility Credential Stealer implementing 3 techniques : Hooking CreateProcessWithLogonW, Smart Keylogging, Remote Debugging

HF-Agents-Course-Notes. My Notes from Hugging Face AI Agents Course

massdns. A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)

PowerShell-Hunter. PowerShell tools to help defenders hunt smarter, hunt harder.

BrokenHill. A productionized greedy coordinate gradient (GCG) attack tool for large language models (LLMs)

text-extract-api. Document (PDF, Word, PPTX ...) extraction and parse API using state of the art modern OCRs + Ollama supported models. Anonymize documents. Remove PII. Convert any document or picture to structured JSON or Markdown

Chrome-App-Bound-Encryption-Decryption. Bypass Chromium's App-Bound Encryption via Direct Syscall-based Reflective Process Hollowing. Extract cookies, passwords, payment methods & tokens from Chrome, Edge, Brave & Avast - fileless, user-mode, no admin required.

offensive-azure. Collection of offensive tools targeting Microsoft Azure

GlobalUnProtect. Decrypt GlobalProtect configuration and cookie files.

osdfir-infrastructure. Helm charts for running open source digital forensic tools in Kubernetes

turbinia. Automation and Scaling of Digital Forensics Tools

hindsight. Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

impacket-shell-integration. Bash and ZSH integration for Impacket

Efflanrs. Efflanrs - GUI for Snaffler Output

block-parser. Parser for Windows PowerShell script block logs

PowerDecode. PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs code dynamic analysis, extracting malware hosting URLs and checking http response.It can also detect if the malware attempts to inject shellcode into memory.

Graphpython. Modular cross-platform Microsoft Graph API (Entra, o365, and Intune) enumeration and exploitation toolkit

mdeproxy. Microsoft Defender for Endpoint Proxy (Device Timeline, ...)

k8s-sniff-https. A simple mitmproxy blueprint to intercept HTTPS traffic from app running on Kubernetes

RemoteKrbRelay. Remote Kerberos Relay made easy! Advanced Kerberos Relay Framework

chromedb. Read Chromium data (namely, cookies and local storage) straight from disk, without spinning up the browser.

crtdumper. crtdumper is a Go application designed to interact directly with Certificate Transparency (CT) logs servers and extract domain names from certificates. Perfect for security researchers and developers interested in massively extracting domain names from CT logs.

firefox_decrypt. Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

Nebula. Nebula is a cloud C2 Framework, which at the moment offers reconnaissance, enumeration, exploitation, post exploitation on AWS, but still working to allow testing other Cloud Providers and DevOps Components.

Evilginx-Phishing-Infra-Setup. Evilginx Phishing Infrastructure Setup Guide - Securing Evilginx and Gophish Infrastructure, Removing IOCs, Phishing TTPs

NetExec. The Network Execution Tool

subcrawl. SubCrawl is a modular framework for discovering open directories, identifying unique content through signatures and organizing the data with optional output modules, such as MISP.

ChromeKatz. Dump cookies and credentials directly from Chrome/Edge process memory

VolWeb. A centralized and enhanced memory analysis platform

Aladdin. C#

rigging. Lightweight LLM Interaction Framework

ETWInspector. C#

AutoAppDomainHijack. Automated .NET AppDomain hijack payload generation

lsa-whisperer. Tools for interacting with authentication packages using their individual message protocols

NativeDump. Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)

GraphSpy. Initial Access and Post-Exploitation Tool for Entra ID and M365 with a browser-based GUI

Blauhaunt. A tool collection for filtering and visualizing logon events. Designed to help answering the "Cotton Eye Joe" question (Where did you come from where did you go) in Security Incidents and Threat Hunts

syft. CLI tool and library for generating a Software Bill of Materials from container images and filesystems

harview. A commandline tool which takes as input a .har (HTTP Archive) file and dumps a human-readable summary of it to the console

cloud-active-defense. Add a layer of active defense to your cloud applications.

EntraAuth. PowerShell

AzTokenFinder. C#

TrailDiscover. An evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real-world incidents, references and security implications

Azure-AD-Password-Checker. Azure AD Password Checker

ViperMonkey. A VBA parser and emulation engine to analyze malicious macros.

edgeshark. Discover and capture container network traffic from your comfy desktop Wireshark, using a containerized service and a Wireshark plugin.

IMDSpoof. IMDSPOOF is a cyber deception tool that spoofs the AWS IMDS service to return HoneyTokens that can be alerted on.

Notebooks. Jupyter notebook

ysoserial.net-docker. ysoserial.net docker image

365-Stealer. 365-Stealer is a phishing simualtion tool written in python3. It can be used to execute Illicit Consent Grant Attack.

IntelRAGU. Intel Retrieval Augmented Generation (RAG) Utilities

RoleCrawl. PowerShell

vger. An interactive CLI application for interacting with authenticated Jupyter instances.

bf-aws-perms-simulate. Python

kunai. Threat-hunting tool for Linux

OneClick-macOS-Simple-KVM. Tools to set up a easy, quick macOS VM in QEMU, accelerated by KVM. Works on Linux AND Windows.

kubetap. Kubectl plugin to interactively proxy Kubernetes Services with ease

gpt4all. GPT4All: Run Local LLMs on Any Device. Open-source and available for commercial use.

pwnhub. How GitHub Actions workflows can be hacked

galah. Galah: An LLM-powered web honeypot.

CloudIntel. This repo contains IOC, malware and malware analysis associated with Public cloud

EDRSilencer. A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

shutter. C++

Kape2ADX. This is a project for automating your KAPE process. Currently, this project takes KAPE .zips found in blob storage, turns the artefacts into super timelines, then uploads the .csv back to Blob. You can optionally connect blob as a data source to Azure Data Explorer to then do forensics via KQL.

PoolParty. A set of fully-undetectable process injection techniques abusing Windows Thread Pools

scrapedown. A simple worker for extracting page content for a given URL

k8scheck. Shell

cloudtrail2sightings. Convert cloudtrail data to MITRE ATT&CK Sightings

teams_dump. PoC for dumping and decrypting cookies in the latest version of Microsoft Teams

ClickOnce-AppDomain-Manager-Injection. Click Once + App Domain

m365-fatigue. Python

Cookie-and-Handle-Stealer. C or BOF file to extract WebKit master key to decrypt user cookie

arsenal. Arsenal is just a quick inventory and launcher for hacking programs

BadZure. BadZure automates the deployment of intentionally misconfigured Entra ID tenants and Azure subscriptions, populating them with diverse entities and configurable, traversable attack paths.

macos-image-templates. HCL

websec-answers. Websec interview questions by tib3rius answered

sigma. Main Sigma Rule Repository

pwngraph. A simple tool to help the service principal abuse, using Microsoft Graph API.

security_content. Splunk Security Content

cloudgrep. cloudgrep is grep for cloud storage

GCP-Pentest-Checklist.

JonMon. C++

TTPForge. The TTPForge is a Cybersecurity Framework for developing, automating, and executing attacker Tactics, Techniques, and Procedures (TTPs).

FuncoPop. Tools for attacking Azure Function Apps

TierZeroTable. Table of AD and Azure assets and whether they belong to Tier Zero

AWS-Attack-Scenarios. A collection of real-world scenarios and code samples demonstrating potential exploitation techniques in AWS services. Designed for educational purposes and security awareness.

act. Run your GitHub Actions locally 🚀

neo4cyclone. Python

llm-opstower. DevOps AI Assistant CLI. Ask questions about your AWS services, cloudwatch metrics, and billing.

sensitive_iam_actions. Crowdsourced list of sensitive IAM Actions

ADCSKiller. An ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer

llama_index. LlamaIndex is the leading document agent and OCR platform

yoink. Yoink is a quick tool for use with Obsidian that will allow you to take a markdown file and package it up into a folder that will allow you to share an entire markdown document with someone else without having to manually copy all the attachments to a folder.

ligolo-ng. An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

url_genie. Malicious URL Detection Model NN optimized by Genetic Algorithms 🧬

aftermath. Aftermath is a free macOS IR framework

Abusing_Weak_ACL_on_Certificate_Templates. Investigation about ACL abusing for Active Directory Certificate Services (AD CS)

GenAI-Security-Adventures. Jupyter Notebook

InsightEngineering. Hardcore Debugging

microsoft-info. Repository hosting a static list of Microsoft First party apps and Graph permissions that's updated daily

electroniz3r. Take over macOS Electron apps' TCC permissions

ContainYourself. A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.

power-pwn. An offensive/defense security toolset for discovery, recon and ethical assessment of AI Agents

malicious-chrome-extension-scanner. Collect chrome extensions from various devices and find out if they are malicious

kubefuzz. Generative and mutative fuzzer for Kubernetes admission controller chains by automatically parsing the cluster api specification.

ACCD. Active C&C Detector

ThreatMapper. Open Source Cloud Native Application Protection Platform (CNAPP)

BucketLoot. BucketLoot is an automated S3-compatible bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text.

OffensiveCloud. Offensive security and Penetration Testing TTP for Cloud based environment (AWS / Azure / GCP)

BlackLotus. BlackLotus UEFI Windows Bootkit

GIUDA. Ask a TGS on behalf of another user without password

Scripts. A collection of miscellaneous scripts

curlshell. reverse shell using curl

LimitsOfML4Vuln. Python

flightsim. A utility to safely generate malicious network traffic patterns and evaluate controls.

PerfExec. C#

fileless-elf-exec. Execute ELF files without dropping them on disk

detection-and-response-pipeline. ✨ A compilation of suggested tools/services for each component in a detection and response pipeline, along with real-world examples. The purpose is to create a reference hub for designing effective threat detection and response pipelines. 👷 🏗

kbom. KBOM - Kubernetes Bill of Materials

ALFA. ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework

llm-course. Course to get into Large Language Models (LLMs) with roadmaps and Colab notebooks.

proxy. Security and compliance proxy for LLM APIs

engineer-manager. A list of engineering manager resource links.

SSH-Harvester. Harvest passwords automatically from OpenSSH server

wmiexec-Pro. New generation of wmiexec.py

Awesome-CloudSec-Labs. Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

github-actions-goat. GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment

AzureAD-Attack-Defense. This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

LOOBins. Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

WebView2-Cookie-Stealer. C++

aws-customer-security-incidents. A repository of breaches of AWS customers

monkey365. Monkey365 is an open-source security assessment tool for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals identify misconfigurations, review cloud security posture, and evaluate environments against industry security best practices and compliance standards.

awesome-kubernetes-threat-detection. A curated list of resources about detecting threats and defending Kubernetes systems.

aws-incident-response. HCL

Amsi-Killer. Lifetime AMSI bypass

okta_scim_attack_tool. Go

ccat. Cloud Container Attack Tool (CCAT) is a tool for testing security of container environments.

modern-unix. A collection of modern/faster/saner alternatives to common unix commands.

Sloth. Mac app that shows all open files, directories, sockets, pipes and devices in use by all running processes. Nice GUI for lsof.

offensive-docker. Offensive Docker is an image with the more used offensive tools to create an environment easily and quickly to launch assessment to the targets.

kubernetes-goof. Kubernetes Stranger Danger

KeePwn. A python tool to automate KeePass discovery and secret extraction.

amd-ryzen-master-driver-v17-exploit. Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).

deepce. Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)

macOS-Security-Research. macOS Security Research

undetected-chromedriver. Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)

Interceptor. Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space

PfxViewer. C++

Spartacus. Spartacus DLL/COM Hijacking Toolkit

Kubernetes-security. Kubernetes pentesting, hardening and hunting tools.

Cloud-Security-Attacks. Azure and AWS Attacks

peirates. Peirates - Kubernetes Penetration Testing tool

dploot. DPAPI looting remotely and locally in Python

go-audit. go-audit is an alternative to the auditd daemon that ships with many distros

Lsass-Shtinkering. C++

GCPGoat. GCPGoat : A Damn Vulnerable GCP Infrastructure

Lnk2Vbs. A Python script that embeds Target VBS into LNK and when executed runs the VBS script from within.

WonkaVision. C#

ofelia. A docker job scheduler (aka. crontab for docker)

training-devenv-security. Hands-on Exercises for "Dangerous attack paths: Modern Development Environment Security - Devices and CI/CD pipelines"

AzureGoat. AzureGoat : A Damn Vulnerable Azure Infrastructure

wevade. C#

osquery-defense-kit. Production-ready detection & response queries for osquery

KeeFarceReborn. A standalone DLL that exports databases in cleartext once injected in the KeePass process.

serverless-prey. Serverless Functions for establishing Reverse Shells to Lambda, Azure Functions, and Google Cloud Functions

emblem. Archived: Emblem Giving is a sample application that demonstrates a serverless architecture with continuous delivery, and trouble recovery. :diamond_shape_with_a_dot_inside:

DEFCON-CICD-pipelines-workshop. HCL

DLLirant. DLLirant is a tool to automatize the DLL Hijacking researches on a specified binary.

Teamsniper. Teamsniper is a tool for fetching keywords in a Microsoft Teams such as (passwords, emails, database, etc.).

jsoncrack.com. ✨ Innovative and open-source visualization application that transforms various data formats, such as JSON, YAML, XML and CSV into interactive graphs.

rdpy. Remote Desktop Protocol in Twisted Python

SnaffPoint. A tool for pointesters to find candies in SharePoint

RedisHoneyPot. High Interaction Honeypot Solution for Redis protocol

Log4Pot. A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

ciscoasa_honeypot. A low interaction honeypot for the Cisco ASA component capable of detecting CVE-2018-0101, a DoS and remote code execution vulnerability.

CitrixHoneypot. Detect and log CVE-2019-19781 scan and exploitation attempts.