Russel Van Tuyl

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.

Post-exploitation agent for Merlin

A PoC package for hosting the CLR and executing .NET from Go

No description.

A tool to evaluate the password health of Active Directory accounts.

Automated Security Assessment Reporting Tool

Load and execute a common object file format (COFF) in the current process

gRPC client for the Merlin Server

A library to make HTTP requests with the Windows winhttp API

Slack/Microsoft Teams notification for new Empire/Meterpreter checkins

Miscellaneous for various things

A collection of open source and commercial tools that aid in red team operations.

automated penetration toolkit

Official Black Hat Arsenal Security Tools Repository

Base Docker container image for Merlin

No description.

Network Infrastructure Penetration Testing Tool

Merlin C2 Documentation Repository for https://merlin-c2.readthedocs.io

Open-Source Phishing Toolkit

Impersonating JA3 signatures

Collection of Aggressor scripts for Cobalt Strike 3.0+ pulled from multiple sources

Directory/file & DNS busting tool written in Go

Messages exchanged between a Merlin Server and Agent

A Windows named pipe implementation written in pure Go.

No description.

Slides and Code for the BHUSA 2019 talk: Flying a False Flag

Implant framework

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

GoLang package for creating Mythic Payload Types, C2 Profiles, Translation Services, WebHook listeners, and Loggers

SpecterOps Presentations

Go implementation of OPAQUE (hidden password user registration and auth)

Open Source - Common Findings DataBase (JSON & MD)

Personal AI Infrastructure for upgrading humans.

A simple POC to expose Mythic as a MCP server

Dockerfile for the Merlin container on the Mythic platform

Templates and code for Dockerfiles with images hosted at https://hub.docker.com/u/itsafeaturemythic

No description.

A Go-lang interface to the linux kernel keyring api

Donut Injector ported to pure Go. For use with https://github.com/TheWover/donut

Red Team's SIEM - tool for Red Teams used for tracking and alarming about Blue Team activities as well as better usability in long term operations.

A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool.

No description.

A Hashcat wrapper for distributed hashcracking

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

An information security preparedness tool to do adversarial simulation.

Empire is a PowerShell and Python post-exploitation agent.