Hacked together script for feeding urls into Burp's Sitemap

A collection of templates for bug bounty reporting

Various Payload wordlists

Custom Queries - Brought Up to BH4.1 syntax

Random Shell Scripts and other ideas I have along the way

PowerShell implementation for AD CS

Note: Going through a full re-write of the tooling so the current versions in the repo do not work!

IP Rotation from different providers - Like FireProx but for GCP, Azure, Alibaba and CloudFlare

Various Tools and Docker Images

HoneyPoC: Proof-of-Concept (PoC) script to exploit SIGRed (CVE-2020-1350). Achieves Domain Admin on Domain Controllers running Windows Server 2000 up to Windows Server 2019.

Python based GUI for browsing LDAP

Static compiled binaries + scripts ready to use on systems

Curated list of public Beacon Object Files(BOFs) build in as submodules for easy cloning

Some settings stolen from multiple scripts @ZephrFish

Living off the land searches for explorer and sharepoint

A template for building your own AI/LLM harness

Collection of Azure Tools to Pull down for Attacking an Environment + quick tips and other useful information

Cross Site Scripting Payloads -- Variations

MDE/MDI Defender setup for Ludus

Exploit and Check Script for CVE 2022-1388

Clipboard for Command and Control between VDI, RDP and Others on Windows

Timestomp Tool to flatten MAC times with a specific timestamp

Scripts for Deploying new server

DO NOT RUN THIS.

PowerShell Implementation of ADFSDump to assist with GoldenSAML

No description.

A Dynamic MSBuild task to help with minor obfuscation of C# Binaries to evade static signatures on each compilation

AutoPoC Generator HoneyPoC

No description.

CVE-2023-20198 & 0Day Implant Scanner

PHP RCE PoC for CVE-2024-4577 written in bash, go, python and a nuclei template

Code for profiling sandboxes - Initially an idea to profile sandboxes, the code is written to take enviromental variables and send them back in a Base32 string over HTTP to an endpoint.

Research into WinSxS binaries and finding hijackable paths

CVE-2021-26855: PoC (Not a HoneyPoC for once!)

CVE-2026-63030, CVE-2026-60137, wp2shell scanner

Leverages B64 chunks to split files and save to clipboard

HoneyPoC 2.0: Proof-of-Concept (PoC) script to exploit IPv6 (CVE-2020-16898).

A repository with various tutorials on how to do things in Pentesting, setup environments and other things

Repo hacks

No description.

CVE-2023-34362: MOVEit Transfer Unauthenticated RCE

ToolShell scanner - CVE-2025-53770 and detection information

No description.

No description.

No description.

Nessus Preflight(NPF) Check for local and remote systems. Essentially sets three registry keys and restarts a service to allow nessus to scan a machine

Gets the name of all currently running process then checks them against a list of known defensive products such as AV's, EDR's and logging tools.

Ghidra launcher for MacOS as a .app file

No description.

No description.

Purple Team Workshop by @jorgeorchilles

A BOF for patching AMSI, ETW and NtTraceEvent aka Sysmon using Trampolines

Subdomain finder

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

A collection of XSS Attack vectors

NOPe - Testing some alternate NOP opcodes

BeEF-inspired XSS proxy service

Automated Screenshot Tool

A setup script for Plex, Sonarr, Radarr & Jackett

About ZephrFish | ZephrSec

Bug Bounty Dork

Python implementation for NotProxyShell aka CVE-2022-40140 & CVE-2022-41082

Commit Stomping is a technique in which Git commit timestamps are manipulated to obscure the true timing of changes.

A collection of tools Neil and Andy have been working on released in one place and interlinked with previous tools

Repository for Breaking into Information Security: Learning the Ropes 101 (https://leanpub.com/ltr101-breaking-into-infosec)

C# version of cmloot for SCCM Enumeration on Windows

An attempt at a Chrome Plugin that does IP Rotation using AWS API Gateways

No description.

PoC for an adaptive parallelised DNS prober

Useful scripts for labs

No description.

Sysadmin Tools

A shell script that bundles Eyewitness and Sublist3r to create a great fingerprinting tool

Complete list of LPE exploits for Windows (starting from 2023)

A collection of yara rules I've gathered over the years :-)

patched to work

Python Wrapper for sending email with mailgun

A list of various ways of injecting payloads for CSV Injection

LittleCorporal: A C# Automated Maldoc Generator

reNgine is an automated reconnaissance framework meant for gathering information during penetration testing of web applications. reNgine has customizable scan engines, which can be used to scan the websites, endpoints, and gather information.

A tiny, zero-dependency web app for reviewing Markdown reports and their attachments, with one-click copy and a themed viewer.

FAFO with WebSockets

Different Scripts for SSH hardening blog

Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime

Extracts Key Values from .keytab files

No description.

CVE-2021-22986 Checker Script in Python3

c++ fully undetected shellcode launcher ;)

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

A simple reference for all of my public talks

No description.

No description.

Visual Studio Code Plugin that decodes VBE files on the fly

No description.

zsec backup blog

No description.

Fork from github.com/klinix5/ReverseRDP_RCE

Deploy Wireguard to multiple cloud providers with TF and Python - 100% coded with Claude

Have we not learnt from HoneyPoC?

🧠 The ultimate, community-curated resource for Beacon Object Files (BOFs) — tutorials, how-tos, deep dives, and reference materials.

A scanner for the FortiNet vulnerability CVE-2025-64446

Cyber Security Challenge Cipher Challenge

Various write-ups from CTFs, fixes for things and others

An outline as to how to get the basics nailed down before approaching information security as a career

No description.

Evilginx Phishing Engagement Infrastructure Setup Guide

Demonstrates consuming from a SecurityTrace ETW session by consuming from the Threat-Intelligence ETW provider without a driver or PPL privilege.

No description.

ingress tooling

VPN Connection Menu Script, Created in Bash

Sysmon Config Pusher - Modernized

🟡👻 Turn your GitHub contribution graph into a Pac-Man SVG animation! Easy to integrate into your profile with GitHub Actions 🚀.

A prompt-based pipeline for finding, validating, and proving vulnerabilities using LLM sub-agents.

No description.

No description.

[GITLAB MIRROR] Ludus is a system to build easy to use cyber environments for testing and development.

Setup and Automation for new Mac setup, zsh, brew, application setup and more

Find your local MP in UK and Email them about OSA and Digital ID

Sysmon Template for Ludus

No description.

PoC that downloads an executable from a public SSL certificate

Deserialization payload generator for a variety of .NET formatters

Cyber Threat Intelligence Repository expressed in STIX 2.0

Ivanti Connect Secure IFT TLS Stack Overflow pre-auth RCE (CVE-2025-0282)

AI-based Ludus range configuration builder

Another subdomain bruteforcer

A python application that takes the Value of a Cineworld Unlimited card and then works out if it's worth while you getting one based upon your film choices

No description.

No description.

Epic Kali Script, oracle and other thinfs need to be added soon.

Hoff in Style

GhostDeployment Script for Debian

Find Subdomains MoFo - Burp Extension WIP

Provision Script for Debian on CAC

Check the boot speed of a windows machine

Spartacus DLL/COM Hijacking Toolkit

Autonomous Privilege Escalation using OpenAI

Free educational courses

Sleep obfuscation

Cobaltstrike Reflective Loader with Synthetic Stackframe

A robust tunelling solution written in golang

Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.

Use apcupsd as a network UPS monitor for Synology NAS.

Give it the date and it'll solve the wordle for said date

The Havoc Framework

Active Directory Password Auditor in Python

ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-object dumping to NDJSON.

No description.

a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )

No description.

No description.

No description.

Sheepl : Creating realistic user behaviour for supporting tradecraft development within lab environments

The Artie the Owl badge for BSIDES Leeds 2026!

A tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.

No description.

Shows how to publish packages to Buildkite Registries using an OIDC token.

[mirror] Go supplementary image libraries

zsh stuffs

An Ansible role that installs "The Elastic Container Project" on a Linux system.

Tool for Active Directory Certificate Services enumeration and abuse

Rewrite commit history with the power of automation

AI Local Code Agent similar to Claude Code

No description.

No description.

Python Canary Wrapper

This is the tool to dump the LSASS process on modern Windows 11

Trying to tame the three-headed dog.

LudusHound is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via Ludus for controlled testing.

POC

Parses cached certificate templates from a Windows Registry file and displays them in the same style as Certipy does

Updated version of a long known self deletion technique to work with 24H2.

An open framework for evaluating and certifying AI-based penetration testing tools, aligned with industry standards like PTES, OSSTMM, and CREST.

A basic python script that takes your weekly wage and works out how much tax you pay

No description.

No description.

An all-in-one Cobalt Strike BOF to patch, check and revert AMSI and ETW for x64 process. Both syscalls and dynamic resolve versions are available.

A tool to remotely detect unusual sessions opened on windows machines using RPC

CVE-2021-1675 Detection Info

A BOF to determine Windows Defender exclusions.

Retrieves exported functions from a legitimate DLL and generates a proxy DLL source code/template for DLL proxy loading or sideloading

Not The Hidden Wiki - The largest repository of links related to cybersecurity

Load a dynamic library from memory by modifying the native Windows loader

A python script that automates a C2 Profile build

A list of python tools to help create an OPSEC-safe Cobalt Strike profile.

SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.

Python interpreter for Cobalt Strike Malleable C2 Profiles. Allows you to parse, build and modify them programmatically.

No description.

No description.

Template file for new portainer setup [Portainer-CE]

Tool for viewing NTDS.dit

No description.

Tool designed to exfiltrate OneDrive Business OCR Data

No description.

Evade EDR's the simple way, by not touching any of the API's they hook.

No description.

Hashcat module that can crack a password used to derive an AES-128 key with CryptDeriveKey from CryptoAPI

Dumping SAM / SECURITY / SYSTEM registry hives with a Beacon Object File

No description.

No description.