Stars
🗂️A file list/WebDAV program that supports multiple storages, powered by Gin and Solidjs. / 一个支持多存储的文件列表/WebDAV程序，使用 Gin 和 Solidjs。
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, high-performance, powerful intranet penetration proxy serv…
Autoswagger by Intruder - detect API auth weaknesses
Red Teaming Tradecraft
ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-object dumping to NDJSON.
A tool which bypasses AMSI (AntiMalware Scan Interface) and PowerShell CLM (Constrained Language Mode) and gives you a FullLanguage PowerShell reverse shell.
A repository of tools for pentesting of restricted and isolated environments.
Checklist of the most important security countermeasures when designing, testing, and releasing your API
AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses
Repo for ADACLScan.ps1 - Your number one script for ACL's in Active Directory
A security assessment tool for analyzing Active Directory Group Policy Objects (GPOs) to identify misconfigurations and vulnerabilities
Tool for Active Directory Certificate Services enumeration and abuse
Set of Mindmaps providing a detailed overview of the different #Microsoft auditing capacities for Windows, Exchange, Azure,...
AADInternals PowerShell module for administering Azure AD and Office 365
Cobalt Strike Beacon configuration extractor and parser.
Audit tool for Active Directory. Automates a lot of checks from a pentester perspective.
Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance.
Some notes and examples for cobalt strike's functionality
Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing and C2 domain names
The Business Email Compromise Guide sets out to describe 10 steps for performing a Business Email Compromise (BEC) investigation in an Office 365 environment. Each step is intended to guide the pro…
Custom scripts for the PIPER Burp extensions.
KQL Queries. Microsoft Defender, Microsoft Sentinel
Documentation and scripts to properly enable Windows event logs.