Kevin Robertson

TangledWinExec. PoCs and tools for investigation of Windows process execution techniques

PPLmedic. Dump the memory of any PPL with a Userland exploit chain

Freeze. Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

Amsi-Killer. Lifetime AMSI bypass

PetitPotam. PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.

SharpSMBSpray. Spray a hash via smb to check for local administrator access

onedrive_user_enum. onedrive user enumeration - pentest tool to enumerate valid o365 users

OffensiveNim. My experiments in weaponizing Nim (https://nim-lang.org/)

openedr. Open EDR public repository

SharpSecDump. .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py

StandIn. StandIn is a small .NET35/45 AD post-exploitation toolkit

UltimateWDACBypassList. A centralized resource for previously documented WDAC bypass techniques

Sharp-Suite. Also known by Microsoft as Knifecoat :hot_pepper:

lsassy. Extract credentials from lsass remotely

DNSUpdate. A python based script to update DNS entries in ADIDNS

OffensiveCSharp. Collection of Offensive C# Tooling

SharpMove. .NET Project for performing Authenticated Remote Execution

SCShell. Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

Winshark. A wireshark plugin to instrument ETW

RequestAADRefreshToken. C#

SocksOverRDP. Socks5/4/4a Proxy support for Remote Desktop Protocol / Terminal Services / Citrix / XenApp / XenDesktop

SysWhispers. AV/EDR evasion via direct system calls.

rdp-rs. Remote Desktop Protocol in RUST

SharpHide. Tool to create hidden registry keys.

SharpChromium. .NET 4.0 CLR Project to retrieve Chromium data, such as cookies, history and saved logins.

DetectionLab. Automate the creation of a lab environment complete with security tooling and logging best practices

WindowsProtocolTestSuites. ⭐⭐ Join us at SambaXP for the SMB3 IO Lab (April 20-23, 2026), see upcoming Interoperability Events

Findomain. The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.

xolo. Tool to crawl, visualize and interact with SQL server links in a d3 graph to help in your red/blue/purple/.../risk assessments pentest hacking team exercises.

MobileHackingCheatSheet. Basics on commands/tools/info on how to assess the security of mobile applications

graftcp. A flexible tool for redirecting a program's TCP, UDP, and DNS traffic to SOCKS5 or HTTP proxies.

flamingo. Flamingo captures credentials sprayed across the network by various IT and security products.

Salsa-tools. Salsa Tools - ShellReverse TCP/UDP/ICMP/DNS/SSL/BINDTCP/Shellcode/SILENTTRINITY and AV bypass, AMSI patched

SharpRDP. Remote Desktop Protocol .NET Console Application for Authenticated Command Execution

MSBuildAPICaller. MSBuild Without MSBuild.exe

UACME. Defeating Windows User Account Control

Get-RBCD-Threaded. Tool to discover Resource-Based Constrained Delegation attack paths in Active Directory environments

sandbox-attacksurface-analysis-tools. Set of tools to analyze Windows sandboxes for exposed attack surface.

SMBLibrary. Free, Open Source, User-Mode SMB 1.0/CIFS, SMB 2.0, SMB 2.1 and SMB 3.0 server and client library

WitnessMe. Web Inventory tool, takes screenshots of webpages using Pyppeteer (headless Chrome/Chromium) and provides some extra bells & whistles to make life easier.

UhOh365. A script that can see if an email address is valid in Office365 (user/email enumeration). This does not perform any login attempts, is unthrottled, and is incredibly useful for social engineering assessments to find which emails exist and which don't.

Recon-AD. Recon-AD, an AD recon tool based on ADSI and reflective DLL’s

CarbonCopy. A tool which creates a spoofed certificate of any online website and signs an Executable for AV Evasion. Works for both Windows and Linux

minikerberos. Kerberos manipulation library in pure Python

ticket_converter. A little tool to convert ccache tickets into kirbi (KRB-CRED) and vice versa based on impacket.

Cloud-Security-Research. Cloud-related research releases from the Rhino Security Labs team.

ridrelay. Enumerate usernames on a domain where you have no creds by using SMB Relay with low priv.

Dumpert. LSASS memory dumper using direct system calls and API unhooking.

GTFOBins.github.io. GTFOBins is a curated list of Unix-like executables that can be used to bypass local security restrictions in misconfigured systems.

phantap. Phantom Tap (PhanTap) - an ‘invisible’ network tap aimed at red teams

WindowsTimeline. Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)

SharpGPOAbuse. SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

h8mail. Email OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related email

necrobrowser-old-go. Go

muraena. Muraena is an almost-transparent reverse proxy aimed at automating phishing and post-phishing activities.

VECTR. VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios

Check-LocalAdminHash. Check-LocalAdminHash is a PowerShell tool that attempts to authenticate to multiple hosts over either WMI or SMB using a password hash to determine if the provided credential is a local administrator. It's useful if you obtain a password hash for a user and want to see where they are local admin on a network. It is essentially a Frankenstein of two of my favorite tools along with some of my own code. It utilizes Kevin Robertson's (@kevin_robertson) Invoke-TheHash project for the credential checking portion. Additionally, the script utilizes modules from PowerView by Will Schroeder (@harmj0y) and Matt Graeber (@mattifestation) to enumerate domain computers to find targets for testing admin access against.

runzero-tools. Open source tools, libraries, and datasets related to the runZero product and associated research

fireprox. AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation

EWSToolkit. Abusing Exchange via EWS

SharpShooter. Payload Generation Framework

bta. Open source Active Directory security audit framework.

PayloadsAllTheThings. A list of useful payloads and bypass for Web Application Security and Pentest/CTF

Invoke-Clipboard. All of Your Copy/Paste Belong to Us: Stealing the clipboard and using it for C2 communications

Venom. Venom - A Multi-hop Proxy for Penetration Testers

shodan-python. The official Python library for Shodan

webxcel. 🤔 A REST backend built with plain VBA Microsoft Excel macros. Yes. Macros.

TikiTorch. Process Injection

krbrelayx. Kerberos relaying and unconstrained delegation abuse toolkit

sRDI. Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

git-history. Quickly browse the history of a file from any git repository

pingcastle. PingCastle - Get Active Directory Security at 80% in 20% of the time

Exchange2domain. CVE-2018-8581

PrivExchange. Exchange your privileges for Domain Admin privs by abusing Exchange

impacket_static_binaries. Standalone binaries for Linux/Windows of Impacket's examples

wsIPC. Working Set Page Cache side-channel IPC PoC

LOLBAS. Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

OffensiveDLR. Toolbox containing research notes & PoC code for weaponizing .NET's DLR

DCOMrade. Powershell script for enumerating vulnerable DCOM Applications

cloudgoat. CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

phishdetect. PhishDetect is a library to help identify phishing pages

RedTeamPowershellScripts. Various PowerShell scripts that may be useful during red team exercise

waybackurls. Fetch all the URLs that the Wayback Machine knows about for a domain

SharpCompile. SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime. This is a more slick approach than manually compiling an .NET assembly and loading it into Cobalt Strike. The project aims to make it easier to move away from adhoc PowerShell execution instead creating a temporary assembly and executing using beacon's 'execute-assembly' in seconds.

EmbedInHTML. Embed and hide any file in an HTML file

credgrap_ie_edge. Extract stored credentials from Internet Explorer and Edge

SlackExtract. A PowerShell script to download all files, messages and user profiles that a user has access to in slack.

ja3. JA3 is a standard for creating SSL client fingerprints in an easy to produce and shareable way.

keyring. Proper Payload Protection Prevents Poor Performance

keyserver. Easily serve HTTP and DNS keys for proper payload protection

joincap. Merge multiple pcap files together, gracefully.

trufflehog. Find, verify, and analyze leaked credentials

SharpSploit. SharpSploit is a .NET post-exploitation library written in C#

oleviewdotnet. A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container

datasploit. An #OSINT Framework to perform various recon techniques on Companies, People, Phone Number, Bitcoin Addresses, etc., aggregate all the raw data, and give data in multiple formats.

redteam-notebook. Collection of commands, tips and tricks and references I found useful during preparation for OSCP exam.

sectaskbars. Security Product Taskbar Icons (to identify from screenshots)

HELK. The Hunting ELK

shellen. :cherry_blossom: Interactive shellcoding environment to easily craft shellcodes

PCredz. This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.

pacu. The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

DivertTCPconn. A TCP packet diverter for Windows platform

WinDivert. WinDivert: Windows Packet Divert

MicroBurst. A collection of scripts for assessing Microsoft Azure security

Inception. Provides In-memory compilation and reflective loading of C# apps for AV evasion.

Red-Teaming-Toolkit. This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

Chiron. Chiron - An IPv6 Security Assessment framework with advanced IPv6 Extension Headers manipulation capabilities.

SharpCloud. Simple C# for checking for the existence of credential files related to AWS, Microsoft Azure, and Google Compute.

Security-Research. Exploits written by the Rhino Security Labs team

ethereum-bnb-mev-bot. 🔵 Ethereum and BNB (BSC) Mev bot - Arbitrage

MakeMeEnterpriseAdmin. PowerShell

Pause-Process. PowerShell script which allows pausing\unpausing Win32/64 exes

Sharp-WMIExec. C#

extractTVpasswords. tool to extract passwords from TeamViewer memory using Frida

BloodHound.py. A Python based ingestor for BloodHound

NTLMInjector. In case you didn't now how to restore the user password after a password reset (get the previous hash with DCSync)

Invoke-TmpDavFS. Memory Backed Powershell WebDav Server

detect-responder. Python

SQLC2. SQLC2 is a PowerShell script for deploying and managing a command and control system that uses SQL Server as both the control server and the agent.

UserEnum. Domain user enumeration tool

CloudScraper. CloudScraper: Tool to enumerate targets in search of cloud resources. S3 Buckets, Azure Blobs, Digital Ocean Storage Space.

GatherContacts. A Burp Suite Extension to pull Employee Names from Google and Bing LinkedIn Search Results

Worse-PDF. Turn a normal PDF file into malicious.Use to steal Net-NTLM Hashes from windows machines.

Seth. Perform a MitM attack and extract clear text credentials from RDP connections

LOLBAS. Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Bad-Pdf. Steal Net-NTLM Hash using Bad-PDF

ntlmv1-multi. NTLMv1 Multitool

goddi. goddi (go dump domain info) dumps Active Directory domain information

Invoke-DOSfuscation. Cmd.exe Command Obfuscation Generator & Detection Test Harness

PowerMeta. PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches. It then allows for the download of those files from the target domain. After retrieving the files, the metadata associated with them can be analyzed by PowerMeta. Some interesting things commonly found in metadata are usernames, domains, software titles, and computer names.

snallygaster. Tool to scan for secret files on HTTP servers

ODIN. Automated network asset, email, and social media profile discovery and cataloguing.

Internal-Monologue. Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

Tokenvator. A tool to elevate privilege with Windows Tokens

gitleaks. Find secrets with Gitleaks 🔑

AD-control-paths. Active Directory Control Paths auditing and graphing tools

nextnet. nextnet is a pivot point discovery tool written in Go.

idb. idb is a tool to simplify some common tasks for iOS pentesting and research

SomeStuff. Some PowerShell Stuff

Get-RBACGroupMemberReport.ps1. PowerShell script to report the membership of Exchange RBAC role groups

asatools. Main repository to pull all NCC Group Cisco ASA-related tool projects.

LAPSToolkit. Tool to audit and attack LAPS environments

ketshash. A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs.

ProcessHollowing. Simple Process Hollowing in C#

pwntools. CTF framework and exploit development library

moistpetal. Open source offensive security platform for red team, by red team.

InsecurePowerShell. InsecurePowerShell is PowerShell with some security features removed.

al-khaser. Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

merlin. Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

PSAmsi. PSAmsi is a tool for auditing and defeating AMSI signatures.

demiguise. HTA encryption tool for RedTeams

simplydomain. Subdomain brute force focused on speed and data serialization

Misc-Powershell-Scripts. Random Tools

Phant0m. Windows Event Log Killer

DotNetToJScript. A tool to create a JScript file which loads a .NET v2 assembly from memory.

nom. Rust parser combinator framework

Invoke-PSImage. Encodes a PowerShell script in the pixels of a PNG file and generates a oneliner to execute

PowerShellScripts. Collection of PowerShell scripts

Invoke-Piper. Forward local or remote tcp ports through SMB pipes.

Invoke-SocksProxy. Socks proxy, and reverse socks server using powershell.

LyncSniper. LyncSniper: A tool for penetration testing Skype for Business and Lync deployments

statistically-likely-usernames. Wordlists for creating statistically likely username lists for use in password attacks and security testing. Used for pentesting for over 10 years with amazing results.

SimplyEmail. Email recon made fast and easy, with a framework to build on

awesome-dotnet. A collection of awesome .NET libraries, tools, frameworks and software

AD-Pentest-Script. Active Directory pentest scripts

PenTesting-Scripts. A ton of helpful tools

PoSh-R2. PowerShell - Rapid Response... For the incident responder in you!

Sharpire. A C# implementation of the PowerShell Empire Agent

PowerProvider. PowerShell

WheresMyImplant. A Bring Your Own Land Toolkit that Doubles as a WMI Provider

atomic-red-team. Small and highly portable detection tests based on MITRE's ATT&CK.

ExternalC2. A library for integrating communication channels with the Cobalt Strike External C2 server

SharpSocks. Tunnellable HTTP/HTTPS socks4a proxy written in C# and deployable via PowerShell

peda. PEDA - Python Exploit Development Assistance for GDB

RsaCtfTool. RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

libc-database. Build a database of libc offsets to simplify exploitation

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

CredDefense. Credential and Red Teaming Defense for Windows Environments

Java-Deserialization-Cheat-Sheet. The cheat sheet about Java Deserialization vulnerabilities

Revoke-Obfuscation. PowerShell Obfuscation Detection Framework

RemoteRecon. Remote Recon and Collection

misc. JavaScript

PSReflect-Functions. Module to provide PowerShell functions that abstract Win32 API functions

RedTips. Red Team Tips as posted by @vysecurity on Twitter

StarFighters. A JavaScript and VBScript Based Empire Launcher, which runs within their own embedded PowerShell Host.

PowerLine. C#

PowEnum. Executes common PowerSploit Powerview functions then combines output into a spreadsheet for easy analysis.

SessionGopher. SessionGopher is a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.

Invoke-CradleCrafter. PowerShell Remote Download Cradle Generator & Obfuscator

manticore. Symbolic execution tool

ThreatHunter-Playbook. A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.

WMImplant. This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.

Sherlock. PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.

HostRecon. This function runs a number of checks on a system to help provide situational awareness to a penetration tester during the reconnaissance phase. It gathers information about the local system, users, and domain information. It does not use any 'net', 'ipconfig', 'whoami', 'netstat', or other system commands to help avoid detection.

ADAudit. Windows PowerShell module to help in the auditing of Active Directory environments.

ObfuscatedEmpire. ObfuscatedEmpire is a fork of Empire with Invoke-Obfuscation integrated directly into it's functionality.

domainhunter. Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names

Red-Team-Infrastructure-Wiki. Wiki to collect Red Team infrastructure hardening resources

FiercePhish. FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more.

ASREPRoast. Project that retrieves crackable hashes from KRB5 AS-REP responses for users without kerberoast preauthentication enabled.