毛酷红队

gpt-5.6-instruct. A Codex jailbreak prompt and test pack for gpt-5.6-sol. 针对 gpt-5.6 系列的 Codex 破甲提示词与测试包。

Chrome-Browser-Stealer. Advanced Chrome v20 credential extractor (Chrome 127+). Extracts passwords from all profiles + cookies via lsass impersonation, DPAPI/CNG decryption. Exfiltrates ZIP to Discord. Authorized pentesting only.

WeChatDataAnalysis. 微信4.x数据解密并生成年度总结，高仿微信，实时更新，导出聊天记录，朋友圈，收藏等大量便捷功能

dingwave. 钉钉数据库解密工具，支持 WEB UI 展示 | DingTalk Database Decryption Tool with Web UI Visualization.

dufs. A file server that supports static serving, uploading, searching, accessing control, webdav...

orca. Orca is the ADE for working with a fleet of parallel agents. Run any coding agent with your own subscription. Available on desktop, mobile and VPS.

OperatorsKit. Collection of Beacon Object Files (BOF) for Cobalt Strike

Codex-X. Codex Switch & Instruct desktop manager

KSword. [Windows toolkit for ARK] KSword 5.1 is an open-source Windows toolkit for ARK, kernel debugging, and system forensics. KSword 5.1 是面向 Windows 的开源 ARK、内核调试与系统取证工具集。

CS-EDR-Enumeration. Cobalt Strike Aggressor Script for identifying security products on Windows hosts — six enumeration methods rated by noise level, from silent in-process BOF to full PowerShell/WMI.

windows-defender-remover. A tool which is uses to remove Windows Defender in Windows 8.x, Windows 10 (every version) and Windows 11.

wx_key. 获取微信4.0版本以上数据库密钥和图片密钥的工具 | A tool for obtaining database keys and image keys for WeChat versions 4.0 and above

mcp-windbg. Model Context Protocol for WinDbg.

WinKerDevBook1. Windows 系统安全：内核驱动开发

dnSpy.Extension.MCP. MCP extension for dnSpy.

wechatDownload. 微信公号文章下载工具

wechat-article-to-markdown. 微信公众号文章抓取 & Markdown 转换工具

KDU. Kernel Driver Utility

KslDump. KslDump — Why bring your own knife when Defender already left one in the kitchen?

SysWhispers4. AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64

windows-update-catalog-downloader. Windows Update Catalog Downloader

wxdown-service. 公众号文章下载网站 https://down.mptext.top 的增强服务

wechat-article-exporter. 一款在线的 微信公众号文章批量下载 工具，支持导出阅读量与评论数据，无需搭建任何环境，可通过 在线网站 使用，支持 docker 私有化部署和 Cloudflare 部署。 支持下载各种文件格式，其中 HTML 格式可100%还原文章排版与样式。

sub2api. Sub2API 一站式开源中转服务，让 Claude、Openai 、Gemini、Grok订阅统一接入，支持拼车共享，更高效分摊成本，原生工具无缝使用。

BYOVD. BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501).

UsingBYOVD. A C++ based BYOVD (Bring Your Own Vulnerable Driver) security research and testing project. It supports kernel-level operations including privilege escalation, physical memory R/W, and removing process protection via vulnerable drivers

code_review_agent. Go

Antivirus-Scan. What AV? 一款轻量级的杀软在线识别的项目，持续更新ing

knight-imagetopptx-skill. Semantic slide image to editable PPTX Codex skill

QDoctor. The first Computer Emergency Response (ARK) Tools for young people ;) 　　　　　　　　　　　　　　　　　　　　　　年轻人的第一款应急响应(ARK)工具 ；）

windows. Windows inside a Docker container.

ColdWer. Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass

CACM. Linux权限维持

AV-EDR-Killer. AV/EDR processes termination by exploiting a vulnerable driver (BYOVD)

CredsHunter. PoC for CVE-2026-3609 - XIGNCODE3 xhunter1.sys handle leak enabling PPL bypass and LSASS dumping

ppt-master. AI turns documents or topics into real, native PowerPoint decks—with native shapes, transitions and animations, data-backed charts and tables on demand, audio narration from speaker notes, and support for your own .pptx templates. · by Hugo He

binary_ninja_mcp. A Binary Ninja plugin containing an MCP server that enables seamless integration with your favorite LLM/MCP client.

ida-mcp-rs. Headless IDA Pro MCP Server

Tsec-Salon. 腾讯安全沙龙历届议题ppt，腾讯安全沙龙是由腾讯云鼎实验室主导运营的高端网络安全技术交流平台，是腾讯安全面向产学研各界打造的核心技术品牌之一。

Tsec-Hackathon. 腾讯云智能渗透黑客松 Official repository of Tencent Cloud Intelligent Penetration Hackathon. Showcasing top open-source projects of LLM-based autonomous penetration agents, including multi-agent collaboration, automated penetration, AI-driven offensive security, and intelligent attack-defense solutions.

chatgpt2api. ChatGPT官网接口纯协议的逆向实现，支持GPT-Image-2模型、文本模型，兼容OpenAI接口协议，在线批量生图/编辑图，号池管理，支持可编辑PPT/PSD文件逆向，支持导入CPA、sub2api号池 、支持接入Cherry Studio、New Api 等软件

superpowers. An agentic skills framework & software development methodology that works.

codex-session-patcher. A lightweight Python tool to clean AI refusal responses from Codex CLI session files

web-access. 给 Claude Code 装上完整联网能力的 skill：三层通道调度 + 浏览器 CDP + 并行分治

java-chains. Java Vulnerability Exploitation Platform

waoowaoo. 首家工业级全流程 AI 影视生产平台。Industry-first professional AI Agent platform for controllable film & video production. From shorts to live-action with Hollywood-standard workflows.

PPLrevenant. Bypass LSA protection using the BYODLL technique

Rikugan. A reverse-engineering agent for IDA Pro and Binary Ninja

garble. Obfuscate Go builds

Shell_Protect. VM一键加壳/脱壳，全压缩，反调试等

jar-obfuscator. Jar Obfuscator V2 - 一个 JAR 文件保护混淆工具，支持包名/类名/方法名/字段名/参数名引用分析和重命名混淆方式，支持字符串加密/整型异或混淆/垃圾代码花指令混淆/等方式，支持方法和字段的隐藏，支持 SpringBoot 和 war 包，配置简单，文档教程齐全，容易上手

APatch. The patching of Android kernel and Android system

eBPFDexDumper. eBPF-Based DexDumper for Android

oss-stinger. 利用oss实现http转发/cobalt strike上线

NETEMVocabulary. 考研词汇词频排序数据

opencode. The open source coding agent.

oh-my-openagent. omo/lazycodex: The coding agent for tokenmaxxers;the one and only agent harness for complex codebases. For your Codex, for your OpenCode

Aperant. Autonomous multi-session AI coding

skills. This repository contains a collection of Agent Skills developed by GudaStudio, enabling seamless collaboration between Claude and other AI models and tools.

vibe-kanban. Get 10X more out of Claude Code, Codex or any coding agent

OpenSpec. Spec-driven development (SDD) for AI coding assistants.

slidedeconstruct-ai. 针对当前 AI 生成 PPT 多为静态位图、难以二次编辑的痛点，本项目采用“识别+生成”双模型架构，实现了对静态演示文稿的深度重构与编辑。 SlideDeconstruct-AI 旨在让 AI 演示文稿从“一张死图”进化为真正可编辑、可交互的生产力工具。

wezterm-config. wezterm-config files

DAILA. A decompiler-agnostic plugin for interacting with AI in your decompiler. GPT-4, Claude, and local models supported!

goffloader. A Go implementation of Cobalt Strike style BOF/COFF loaders.

claude_codex_bridge. Visible multi-agent CLI workspace for mixing Codex, Claude, Gemini, Kimi, Qwen, Cursor, Copilot, Pi, OpenCode, and other AI coding agents

csbot. Golang Automation Framework for Cobalt Strike using the Rest API

chainlit. Build Conversational AI in minutes ⚡️

gemini-3-pro-image-preview. Gemini 3 Pro - AI 绘图工作台 (Web Client)

next-ai-draw-io. A next.js web application that integrates AI capabilities with draw.io diagrams. This app allows you to create, modify, and enhance diagrams through natural language commands and AI-assisted visualization.

banana-slides. 一个基于nano banana pro🍌的原生AI PPT生成应用，迈向＂Vibe PPT＂; 支持上传任意模板图片，上传任意素材&智能解析，一句话/大纲/页面描述自动生成PPT，口头修改指定区域、一键导出可编辑ppt - An AI-native slides generator based on nano banana pro🍌

RedInk. Red Ink - A one-stop Xiaohongshu image-and-text generator based on the 🍌Nano Banana Pro🍌, "One Sentence, One Image: Generate Xiaohongshu Text and Images."

LKY_OfficeTools. 一键自动化 下载、安装、激活 Office 的利器。

code-switch. Claude Code & Codex 多供应商代理与管理工具

cc-switch. A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io

hello-agents. 📚 《从零开始构建智能体》——从零开始的智能体原理与实践教程

HVNC. 基于Tinynuke修复得到的HVNC

KDemu. A Windows Kernel Driver Emulator base on Unicorn, Kernel Memory Dump and some of native environment

Beacon. 使用C简单重构Beacon，适配CobaltStrike客户端

Spark. ✨Spark is a web-based, cross-platform and full-featured Remote Administration Tool (RAT) written in Go that allows you control all your devices anywhere. Spark是一个Go编写的，网页UI、跨平台以及多功能的远程控制和监控工具，你可以随时随地监控和控制所有设备。

RedGuard. RedGuard is a C2 front flow control tool,Can avoid Blue Teams,AVs,EDRs check.

Rshell---A-Cross-Platform-C2. Rshell是一款开源的golang编写的支持多平台的C2框架，旨在帮助安服人员渗透测试、红蓝对抗。

PackMyPayload. A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX

LOLDrivers. Living Off The Land Drivers

BokuLoader. A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

NTR_loader. Loader Pre-Technology, Main thread hijacking without using API, get ntdll and kernel32 handle without peb. 加载器前置技术，不使用API进行主线程劫持，不使用PEB获取ntdll和kernel32的地址。

DockerHub. 2026年8月更新，目前国内可用Docker镜像源汇总，DockerHub国内镜像加速列表，🚀DockerHub镜像加速器

C2. C2-下一代RAT

alioss-stinger. 利用阿里云oss对象存储，来转发http流量实现（cs）Cobalt Strike、msf 上线等 这之间利用阿里云的相关域名进行通信。

SharpHunter. Automated Hosting Information Hunting Tool - Windows 主机信息自动化狩猎工具

yara. The pattern matching swiss knife

NoVmp. A static devirtualizer for VMProtect x64 3.x. powered by VTIL.

sgn. SGN — polymorphic binary encoder

chatlog. chat log tool, easily use your own chat data. 聊天记录工具，轻松使用自己的聊天数据

awesome-mcp-servers. A collection of MCP servers.

PoolParty. A set of fully-undetectable process injection techniques abusing Windows Thread Pools

defendnot. An even funnier way to disable windows defender. (through WSC api)

VMAware. Advanced VM detection library and tool

LoudSunRun. Stack Spoofing with Synthetic frames based on the work of namazso, SilentMoonWalk, and VulcanRaven

SilentMoonwalk. PoC Implementation of a fully dynamic call stack spoofer

AlternativeShellcodeExec. Alternative Shellcode Execution Via Callbacks

cola_dnslog. Cola Dnslog v1.3.2 更加强大的dnslog平台/无回显漏洞探测辅助平台 完全开源 dnslog httplog ldaplog rmilog 支持dns http ldap rmi等协议 提供API调用方式便于与其他工具结合 支持钉钉机器人、Bark等提醒 支持docker一键部署 后端完全使用python实现 前端基于vue-element-admin二开

ida-pro-mcp. AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

moneta. Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

anything-llm. Stop renting your intelligence. Own it with AnythingLLM. Everything you need for a powerful local-first agent experience

pyinstxtractor. PyInstaller Extractor

lessmsi. A tool to view and extract the contents of an Windows Installer (.msi) file.

simplewall. Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.

LECmd. Lnk Explorer Command line edition!!

llvm-project. The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.

SetIcon. Creates a windows icon file (.ico) from an image and sets it on an exe.

EDRs. C

Loki. 🧙‍♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications

RevokeMsgPatcher. :trollface: A hex editor for WeChat/QQ/TIM - PC版微信/QQ/TIM防撤回补丁（我已经看到了，撤回也没用了）

py. 飘云ark（pyark）

MonitorControl. 🖥 Control your display's brightness & volume on your Mac as if it was a native Apple Display. Use Apple Keyboard keys or custom shortcuts. Shows the native macOS OSDs.

WeChatTweak. A command-line tool for tweaking WeChat - 首款微信 macOS 客户端撤回拦截与多开 🔨

nanodump. The swiss army knife of LSASS dumping

RmTools. 蓝队应急工具

VirtualKD-Redux. VirtualKD-Redux - A revival and modernization of VirtualKD

PPLKiller. Protected Processes Light Killer

openedr. Open EDR public repository

Csgo-Full-kernel. csgo external running from kernelmode

kdmapper-1. 驱动加载器 -> 利用iqvw64e.sys映射驱动

DoH-ECH-Demo. 使用DoH + ECH实现的简单的Https和Websocket请求demo，可绕过GFW，用于研究流量隐藏技术

ObfuXtreme. ObfuXtreme is an advanced Python obfuscation tool for security research, reverse engineering education, and analysis of how obfuscation impacts static and signature-based detection.

CobaltStrikeDetected. 40行代码检测到大部分CobaltStrike的shellcode

ChatTTS-ui. 一个简单的本地网页界面，使用ChatTTS将文字合成为语音，同时支持对外提供API接口。A simple native web interface that uses ChatTTS to synthesize text into speech, along with support for external API interfaces.

md. ✍ WeChat Markdown Editor | 一款高度简洁的微信 Markdown 编辑器：支持 Markdown 语法、自定义主题样式、内容管理、多图床、AI 助手等特性

MultiTshProxy. tsh多终端代理通信

F5-TTS. Official code for "F5-TTS: A Fairytaler that Fakes Fluent and Faithful Speech with Flow Matching"

BlindEdr. A Blind EDR Project for Educational Purposes

Lamia-Syscall-Template. A generic x64 indirect syscall template for RED TEAM OPSEC

Spyndicapped. COM ViewLogger — new malware keylogging technique

kcp. :zap: KCP - A Fast and Reliable ARQ Protocol

telegram_info_export. 导出telegram信息到本地

hrtng. IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations

Adobe-Downloader. macOS Adobe apps download & installer

white_patch_detect. 通杀检测基于白文件patch黑代码的免杀技术的后门

Microsoft-Activation-Scripts. Open-source Windows and Office activator featuring HWID, Ohook, TSforge, and Online KMS activation methods, along with advanced troubleshooting.

gdb-dashboard. Modular visual interface for GDB in Python

shelf. Python library to convert elf to os-independent shellcodes

elf. small elf loader

loaders. Tiny loaders for various binary formats.

Supershell. Supershell C2 远控平台，基于反向SSH隧道获取完全交互式Shell

reverse_ssh. SSH based reverse shell

ReverseWidget. A lightweight GUI tool that implements some typical block cipher, coding, hashing, and multi-architecture assemble/disassembly framework, PE/AndroidAPP shell checker.

30dayMakeOS. 《30天自制操作系统》源码中文版。自己制作一个操作系统（OSASK）的过程

nt5src. Source code of Windows XP (NT5). Leaks are not from me. I just extracted the archive and cabinet files.

ShadowDumper. Shadow Dumper is a powerful tool used to dump LSASS memory, often needed in penetration testing and red teaming. It uses multiple advanced techniques to dump memory, allowing to access sensitive data in LSASS memory.

donut-decryptor. Retrieve inner payloads from Donut samples

CobaltStrike_OpenBeacon. Fully functional, from-scratch alternative to the Cobalt Strike Beacon (red teaming tool), offering transparency and flexibility for security professionals and enthusiasts.

mayfly-go. Browser-based management platform of machine, database (mysql pgsql oracle sqlserver Gauss sqlite), redis(standalone sentinel cluster), mongo, Es unified management and operation platform. (web版linux(终端 文件 脚本 进程)、数据库(mysql pgsql oracle sqlserver 高斯 达梦 sqlite)、数据同步、redis(单机 哨兵 集群)、mongo、Es统一管理操作平台)

Nimbo-C2. Nimbo-C2 is yet another (simple and lightweight) C2 framework

IOPaint. Image inpainting tool powered by SOTA AI Model. Remove any unwanted object, defect, people from your pictures or erase and replace(powered by stable diffusion) any thing on your pictures.

ComfyUI-Workflows-ZHO. 我的 ComfyUI 工作流合集 | My ComfyUI workflows collection

Pillager. Pillager是一个适用于后渗透期间的信息收集工具

LaZagne. Credentials recovery project

searchall. 强大的敏感信息搜索工具

EDRPrison. Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

RdpStrike. Positional Independent Code to extract clear text password from mstsc.exe using API Hooking via HWBP.

HackBrowserData. Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

Detect-It-Easy. Program for determining types of files for Windows, Linux and MacOS.

ChromeKatz. Dump cookies and credentials directly from Chrome/Edge process memory

LSTAR. LSTAR - CobaltStrike 综合后渗透插件

expandTextSection. A tool that expands the size of the text section in a PE file without loss, supporting both 32-bit and 64-bit programs.

Alcatraz. x64 binary obfuscator

Supernova. Shellcode encryptor & obfuscator tool

Conferences. Conference presentation slides

pystinger. Bypass firewall for traffic forwarding using webshell

SearchAvailableExe. 寻找可利用的白文件

DllMainHijacking. Resolve the issue of DLLmain function in white and black DLLs hanging when calling shellcode

Banshee. Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.

Maestro. Multilingual backdoor

SigFlip. SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

XiebroC2. 渗透测试C2、支持Lua插件扩展、域前置/CDN上线、自定义profile、前置sRDI、文件管理、进程管理、内存加载、截图、反向代理、分组管理

CS-Situational-Awareness-BOF. Situational Awareness commands implemented using Beacon Object Files

legba. The fastest and more comprehensive multiprotocol credentials bruteforcer / password sprayer and enumerator. 🥷

BOF.NET. A .NET Runtime for Cobalt Strike's Beacon Object Files

RealBlindingEDR. Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

raddebugger. A native, user-mode, multi-process, graphical debugger.

tsh. Tiny SHell is an open-source UNIX backdoor.

PPLdump. Dump the memory of a PPL with a userland exploit

Dumpert. LSASS memory dumper using direct system calls and API unhooking.

EDRSandblast. C

tiny-AES-c. Small portable AES128/192/256 in C

HEU_KMS_Activator.

CoercedPotato. C

BestEdrOfTheMarket. EDR Lab for Experimentation Purposes

Inline-Execute-PE. Execute unmanaged Windows executables in CobaltStrike Beacons

ILSpy. .NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

avList. avList - 杀软进程对应杀软名称

javascript-obfuscator. A powerful obfuscator for JavaScript and Node.js

link. link is a command and control framework written in rust

amber. Reflective PE packer.

PhishingBook. 红蓝对抗：钓鱼演练资源汇总&备忘录

self_delete_bof. BOF implementation of delete self poc that delete a locked executable or a currently running file from disk by its pid, path, or the current process.

adduserbysamr-bof. Cobalt Strike BOF that Add a user to localgroup by samr

PEASS-ng. PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

utils. Tools of util