Christopher Maddalena

monarchmoneycommunity. Python API for Monarch Money

WalkingMate. Issue tracking and feature requests for WalkingMate - a macOS menu bar app for controlling your WalkingPad treadmill

skills-curated. Curated, community-vetted Claude Code plugin marketplace

grimmory. A self-hosted library for your ebooks, comics, and audiobooks

ghostbadger. A secure reporting extension for Ghostwriter that generates and delivers protected pentest deliverable PDFs through integrated vault storage.

home. Welcome to your Hackable Conference Badge

octolamp. A 3D printed, GitHub infused, smart light

LudusHound. LudusHound is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via Ludus for controlled testing.

terminal_sync. A standalone tool for logging shell commands to GhostWriter automatically

terraform-provider-ghostwriter. A terraform provider to manage resources in ghostwriter

go-dhparam. Pure Go implementation of OpenSSL dhparam generator

go-release-action. Automatically publish Go binaries to Github Release Assets through Github Action.

Mythic. A collaborative, multi-platform, red teaming framework

snapback. HTTP(s) Screenshots for Pen Testers Who Value Their Time

pycobalt. Cobalt Strike Python API

WebDavDelivery. A WebDAV PROPFIND covert channel to deliver payloads

autochrome. This tool downloads, installs, and configures a shiny new copy of Chromium.

shellen. :cherry_blossom: Interactive shellcoding environment to easily craft shellcodes

movfuscator. The single instruction C compiler

REpsych. Psychological warfare in reverse engineering

Automated-AD-Setup. A PowerShell script that aims to have a fully configured domain built in under 10 minutes, but also apply security configuration and hardening.

AutomatedLab. AutomatedLab is a provisioning solution and framework that lets you deploy complex labs on HyperV and Azure with simple PowerShell scripts. It supports all Windows operating systems from 2008 R2 to 2022, some Linux distributions and various products like AD, Exchange, PKI, IIS, etc.

aquatone. A Tool for Domain Flyovers

py-seccure. SECCURE compatible Elliptic Curve cryptography in Python

dirsearch. Web path scanner

vulscan. Advanced vulnerability scanning with Nmap NSE

SMBCrunch. 3 tools that work together to simplify reconaissance of Windows File Shares

Sherlock. PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities.

ScanCannon. A script for credentials-based attack surface enumeration and general reconnaissance of massive external networks

trufflehog. Find, verify, and analyze leaked credentials

bashbunny-payloads. The Official Bash Bunny Payload Repository

dnstwist. Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

pyflakes. A simple program which checks Python source files for errors

tweets_analyzer. Tweets metadata scraper & activity analyzer

alpha3. Alphanumeric shellcode encoder.

pupy. Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

pydbg. A pure-python win32 debugger interface.

wordpress-exploit-framework. A Ruby framework designed to aid in the penetration testing of WordPress systems.

wuzz. Interactive cli tool for HTTP inspection

BloodHound-Legacy. Six Degrees of Domain Admin

OSCE-Preparation. Any code for preparing for OSCE

FiercePhish. FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more.

eyephish. OpenCV based IDN option generator PoC

Wiegotcha. Wiegotcha: Long Range RFID Thief

awesome-osint. :scream: A curated list of amazingly awesome OSINT

uber-apk-signer. A cli tool that helps signing and zip aligning single or multiple Android application packages (APKs) with either debug or provided release certificates. It supports v1, v2 and v3 Android signing scheme has an embedded debug keystore and auto verifies after signing.

sign. Sign.jar automatically signs an apk with the Android test certificate.

tested-transcoder. Python

himawaripy. Set near-realtime picture of Earth as your desktop background

terminal-notifier. Send User Notifications on macOS from the command-line.

osint_tools_security_auditing. osint_tools_security_auditing

telnetlogger. Simulates enough of a Telnet connection in order to log failed login attempts.

pwndsh. Post-exploitation framework (and an interactive shell) developed in Bash shell scripting

mimikittenz. A post-exploitation powershell tool for extracting juicy info from memory.

ps1encode. Script used to generate and encode a PowerShell based Metasploit payloads.

Invoke-Obfuscation. PowerShell Obfuscator

Serpico. SimplE RePort wrIting and COllaboration tool

DefCon24. DefCon24

qemu-cgc. Official QEMU mirror. Please see http://wiki.qemu.org/Contribute/SubmitAPatch for how to submit changes to QEMU. Pull Requests are ignored.

afl. Unofficial American Fuzzy Lop repo

pcapquiz. Python

SecGen. Create randomly insecure VMs

BurpSmartBuster. A Burp Suite content discovery plugin that add the smart into the Buster!

unicorn-scroller. Scrolling information display for the Pimoroni Unicorn HAT/pHAT on Raspberry Pi

unicorn-hat. Python library for Unicorn pHAT and HAT. 32 or 64 blinding ws2812 pixels for your Raspberry Pi

Small_Tasks. Small scripts for doing repeatable tasks

gophish. Open-Source Phishing Toolkit

shodan-hq-nse. Shodan HQ nmap plugin - passively scan targets

Inspeckage. Android Package Inspector - dynamic analysis with api hooks, start unexported activities and more. (Xposed Module)

va-pt. The VAPT Toolkit provides a streamlined way to install, configure, and maintain a complete penetration testing environment with 50+ security tools and custom automation frameworks organized across multiple categories.

how2exploit_binary. An in depth tutorial on how to do binary exploitation

Portspoof. Portspoof

vulnerable-node. A very vulnerable web site written in NodeJS with the purpose of have a project with identified vulnerabilities to test the quality of security analyzers tools tools

Nosql-Exploitation-Framework. A Python Framework For NoSQL Scanning and Exploitation

pwnableweb. PwnableWeb is a suite of web applications for use in information security training.

ipwn. Python

AppTroy. An Online Analysis System for Packed Android Malware

backdoor-apk. backdoor-apk is a shell script that simplifies the process of adding a backdoor to any Android APK file. Users of this shell script should have working knowledge of Linux, Bash, Metasploit, Apktool, the Android SDK, smali, etc. This shell script is provided as-is without warranty of any kind and is intended for educational purposes only.

dtc2. Duct Tape Command and Control!

brutescrape. A web scraper for generating password files based on plain text found

metagoofil. Metadata harvester

scansploit. Exploit using barcodes, QRcodes, earn13, datamatrix

changeme. A default credential scanner.

Inveigh. .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers

PenTesting-Scripts. A ton of helpful tools

dnsrecon. DNS Enumeration Script

ip2dns. Python

pyssltest. A python multithreaded script to make use of Qualys ssllabs api to test SSL flaws

fb-sleep-stats. Use Facebook to track your friends’ sleeping habits

URLextractor. Information gathering & website reconnaissance | https://phishstats.info/

termpix. Display images in an ANSI terminal

firmwalker. Script for searching the extracted firmware file system for goodies!

WiFi-Pumpkin-deprecated. DEPRECATED, wifipumpkin3 -> https://github.com/P0cL4bs/wifipumpkin3

ssllabs. Python module for the Qualys SSL Labs Server Test

mhn. Modern Honey Network

lanmap2. builds database/visualizations of LAN structure from passively sifted information

pdfparser. PdfParser, a standalone PHP library, provides various tools to extract data from a PDF file.

osxlockdown. [No longer maintained] Apple OS X tool to audit for, and remediate, security configuration settings.

hosts. 🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.

SCADAPASS. SCADA StrangeLove Default/Hardcoded Passwords List

harbinger. Harbinger Threat Intelligence

scripts. Scripts I use during pentest engagements.

Sn1per. Automated penetration testing & attack surface management platform. Recon, scan, exploit, report — 600+ exploits, 90+ integrations, 10K+ detections.

bashscanner. A fast way to scan your server for outdated software and potential exploits.

awesome-pentest. A collection of awesome penetration testing resources, tools and other shiny things

commix. Automated All-in-One OS Command Injection Exploitation Tool

NfSpy. ID-spoofing NFS client

macOS-Security-and-Privacy-Guide. Community guide to securing and improving privacy on macOS.

gnmap-parser. Bash script to parse multiple Nmap (.gnmap) exports into various plain-text formats for easy analysis.

gitrob. Reconnaissance tool for GitHub organizations

Empire. Empire is a PowerShell and Python post-exploitation agent.

PoshSec. PoshSec PowerShell Module

reaver-wps-fork-t6x. C

dnsteal. DNS Exfiltration tool for stealthily sending files over DNS requests.

DNSSUB. Exfiltrate files over dns requests using Python and/or Bash

virtuaplant. VirtuaPlant is a Industrial Control Systems simulator which adds a “similar to real-world control logic” to the basic “read/write tags” feature of most PLC simulators.

Tango. Honeypot Intelligence with Splunk

DVWA. Damn Vulnerable Web Application (DVWA)

tbhm. The Bug Hunters Methodology

vcr. Vulnerability Compliance Report Tool used to parse Nessus files into html reports created by SynerComm, Inc.

weevely3. Weaponized web shell

DoFler. Dashboard of Fail. A application to carve out images/accounts/vulns on conference networks and display them for general entertainment.

msfpc. MSFvenom Payload Creator (MSFPC)

theHarvester. E-mails, subdomains and names Harvester - OSINT

SPF. SpeedPhishing Framework

phishing-frenzy. Ruby on Rails Phishing Framework

os-scripts. Personal Collection of Operating Systems Scripts

wifite. Python

SecLists. SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

Android-IMSI-Catcher-Detector. AIMSICD • Fight IMSI-Catcher, StingRay and silent SMS!

cymon-interceptor. Google Chrome extension to intercept web requests to malicious sources

ptf. The Penetration Testers Framework (PTF) is a way for modular support for up-to-date tools.

nessus_join. Join multiple Nessus reports into one

social-engineer-toolkit. The Social-Engineer Toolkit (SET) repository from TrustedSec - All new versions of SET will be deployed here.

Responder. Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

powershell_scripts. Powershell Scripts

random. Scripts that aren't PowerShell

PowerSploit. PowerSploit - A PowerShell Post-Exploitation Framework

scan-tools. Lua

peeping-tom. Websote Screenshot genetor based on qt-webkit

Veil-Catapult. Veil Catapult is no longer supported

Veil-Pillage. Veil-Pillage is a post-exploitation framework that integrates with Veil-Evasion.

PowerTools. PowerTools is a collection of PowerShell projects with a focus on offensive operations.

Veil-Evasion. Veil Evasion is no longer supported, use Veil 3.0!

smbexec. Ruby

discover. Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux and Ubuntu.

metasploit-framework. Metasploit Framework

rowhammer-test. Test DRAM for bit flips caused by the rowhammer problem

PoshSecFramework. A framework for PowerShell and PoshSec scripts for network management, security, and maintenance.

duo_confluence. Duo two-factor authentication for Confluence.

opensoc. OpenSOC Apache Hadoop Code

free-programming-books. :books: Freely available programming books