cyber-security-resources/organized_tools/exploit-development_tools.md

Exploit Development Tools

The following tools are organized for this category:

---

• 403Fuzzer - Fuzz 403/401Ing Endpoints For Bypasses
• ADBSploit - A Python Based Tool For Exploiting And Managing Android Devices Via ADB
• ADFSRelay - Proof Of Concept Utilities Developed To Research NTLM Relaying Attacks Targeting ADFS
• ADenum - A Pentesting Tool That Allows To Find Misconfiguration Through The The Protocol LDAP And Exploit Some Of Those Weaknesses With Kerberos
• AFLTriage - Tool To Triage Crashing Input Files Using A Debugger
• APCLdr - Payload Loader With Evasion Features
• ARTi-C2 - A Post-Exploitation Framework Used To Execute Atomic Red Team Test Cases With Rapid Payload Deployment And Execution Capabilities Via .NET's DLR
• ATFuzzer - Dynamic Analysis Of AT Interface For Android Smartphones
• Aclpwn.Py - Active Directory ACL Exploitation With BloodHound
• Airopy - Get Clients And Access Points
• AlanFramework - A Post-Exploitation Framework
• Applepie - A Hypervisor For Fuzzing Built With WHVP And Bochs
• Auto-Elevate - Escalate From A Low-Integrity Administrator Account To NT AUTHORITY\SYSTEM Without An LPE Exploit By Combining A COM UAC Bypass And Token Impersonation
• AutoPWN Suite - Project For Scanning Vulnerabilities And Exploiting Systems Automatically
• AutoSploit v3.0 - Automated Mass Exploiter
• AutoSploit v4.0 - Automated Mass Exploiter
• Autobloody - Tool To Automatically Exploit Active Directory Privilege Escalation Paths Shown By BloodHound
• Autoharness - A Tool That Automatically Creates Fuzzing Harnesses Based On A Library
• Barq - The AWS Cloud Post Exploitation Framework!
• BeEF - The Browser Exploitation Framework Project
• BeatRev - POC For Frustrating/Defeating Malware Analysts
• Beebug - A Tool For Checking Exploitability
• BlackMamba - C2/post-exploitation Framework
• Bluffy - Convert Shellcode Into Different Formats!
• Boofuzz - Network Protocol Fuzzing for Humans
• BoomER - Framework For Exploiting Local Vulnerabilities
• Botb - A Container Analysis And Exploitation Tool For Pentesters And Engineers
• Bropper - An Automatic Blind ROP Exploitation Tool
• Brutality - A Fuzzer For Any GET Entries
• Brutus - An Educational Exploitation Framework Shipped On A Modular And Highly Extensible Multi-Tasking And Multi-Processing Architecture
• CANalyzat0r - Security Analysis Toolkit For Proprietary Car Protocols
• CAPEv2 - Malware Configuration And Payload Extraction
• CDF - Crypto Differential Fuzzing
• CHAOS Framework v3.0 - Generate Payloads And Control Remote Windows Systems
• CMSeeK v1.1.1 - CMS Detection And Exploitation Suite (Scan WordPress, Joomla, Drupal And 150 Other CMSs)
• CMSeeK v1.1.2 - CMS Detection And Exploitation Suite - Scan WordPress, Joomla, Drupal And Over 170 Other CMSs
• CSSG - Cobalt Strike Shellcode Generator
• CTF-Party - A Ruby Library To Enhance And Speed Up Script/Exploit Writing For CTF Players
• CVE-2020-0796 - CVE-2020-0796 Pre-Auth POC
• CVE-2020-0796 - Windows SMBv3 LPE Exploit #SMBGhost
• CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)
• CVE-2022-22963 - PoC Spring Java Framework 0-day Remote Code Execution Vulnerability
• CVE-2022-27254 - PoC For Vulnerability In Honda's Remote Keyless System
• CVE-Vulnerability-Information-Downloader - Downloads Information From NIST (CVSS), First.Org (EPSS), And CISA (Exploited Vulnerabilities) And Combines Them Into One List
• CWFF - Create Your Custom Wordlist For Fuzzing
• CamOver - A Camera Exploitation Tool That Allows To Disclosure Network Camera Admin Password
• CamRaptor - Tool That Exploits Several Vulnerabilities In Popular DVR Cameras To Obtain Network Camera Credentials
• Canadian Furious Beaver - A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities
• Catchyou - FUD Win32 Msfvenom Payload Generator
• Charlotte - C++ Fully Undetected Shellcode Launcher
• ClusterFuzzLite - Simple Continuous Fuzzing That Runs In CI
• Command Injection Payload List
• Commix v2.7 - Automated All-in-One OS Command Injection And Exploitation Tool
• Cooolis-ms - A Server That Supports The Metasploit Framework RPC
• CrossC2 - Generate CobaltStrike's Cross-Platform Payload
• DFSCoerce - PoC For MS-DFSNM Coerce Authentication Using NetrDfsRemoveStdRoot Method
• DInjector - Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL
• DLLHijackingScanner - This Is A PoC For Bypassing UAC Using DLL Hijacking And Abusing The "Trusted Directories" Verification
• DNSStager - Hide Your Payload In DNS
• DNSlivery - Easy Files And Payloads Delivery Over DNS
• Darksplitz - Exploit Framework
• DeathSleep - A PoC Implementation For An Evasion Technique To Terminate The Current Thread And Restore It Before Resuming Execution, While Implementing Page Protection Changes During No Execution
• DeimosC2 - A Golang Command And Control Framework For Post-Exploitation
• DetExploit - Software That Detect Vulnerable Applications, Not-Installed OS Updates And Notify To User
• Discover - Custom Bash Scripts Used To Automate Various Penetration Testing Tasks Including Recon, Scanning, Parsing, And Creating Malicious Payloads And Listeners With Metasploit
• Dora - Find Exposed API Keys Based On RegEx And Get Exploitation Methods For Some Of Keys That Are Found
• DragonCastle - A PoC That Combines AutodialDLL Lateral Movement Technique And SSP To Scrape NTLM Hashes From LSASS Process
• DropEngine - Malleable Payloads!
• EXOCET - AV-evading, Undetectable, Payload Delivery Tool
• EasySploit - Metasploit Automation (EASIER And FASTER Than EVER)
• Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode
• Emp3R0R - Linux Post-Exploitation Framework Made By Linux User
• Entropy Toolkit - A Set Of Tools To Exploit Netwave And GoAhead IP Webcams
• EntropyReducer - Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists
• EntropyReducer - Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists
• EternalBlueC - EternalBlue Suite Remade In C/C++ Which Includes: MS17-010 Exploit, EternalBlue Vulnerability Detector, DoublePulsar Detector And DoublePulsar Shellcode & DLL Uploader
• Evasor - A Tool To Be Used In Post Exploitation Phase For Blue And Red Teams To Bypass APPLICATIONCONTROL Policies
• Exploit_Mitigations - Knowledge Base Of Exploit Mitigations Available Across Numerous Operating Systems, Architectures And Applications And Versions
• Exrop - Automatic ROP Chain Generation
• FLUFFI (Fully Localized Utility For Fuzzing Instantaneously) - A Distributed Evolutionary Binary Fuzzer For Pentesters
• FUD-UUID-Shellcode - Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness
• Fastfuz-Chrome-Ext - Site Fast Fuzzing With Chorme Extension
• Fileless-Xec - Stealth Dropper Executing Remote Binaries Without Dropping Them On Disk
• FirmWire -b Full-System Baseband Firmware Emulation Platform For Fuzzing, Debugging, And Root-Cause Analysis Of Smartphone Baseband Firmwares
• Flashsploit - Exploitation Framework For ATtiny85 Based HID Attacks
• Forblaze - A Python Mac Steganography Payload Generator
• FormatFuzzer - A Framework For High-Efficiency, High-Quality Generation And Parsing Of Binary Inputs
• Fortiscan - A High Performance FortiGate SSL-VPN Vulnerability Scanning And Exploitation Tool
• Fpicker - A Frida-based Fuzzing Suite Supporting Various Modes (Including AFL++ In-Process Fuzzing)
• Frelatage - The Python Fuzzer That The World Deserves
• Frida API Fuzzer - This Experimetal Fuzzer Is Meant To Be Used For API In-Memory Fuzzing
• Frostbyte - FrostByte Is A POC Project That Combines Different Defense Evasion Techniques To Build Better Redteam Payloads
• FuzzBench - Fuzzer Benchmarking As A Service
• Fuzzilli - A JavaScript Engine Fuzzer
• Fuzzowski - The Network Protocol Fuzzer That We Will Want To Use
• Fuzztruction - Prototype Of A Fuzzer That Does Not Directly Mutate Inputs (As Most Fuzzers Do) But Instead Uses A So-Called Generator Application To Produce An Input For Our Fuzzing Target
• Fuzztruction - Prototype Of A Fuzzer That Does Not Directly Mutate Inputs (As Most Fuzzers Do) But Instead Uses A So-Called Generator Application To Produce An Input For Our Fuzzing Target
• Getdroid - FUD Android Payload And Listener
• Getwin - FUD Win32 Payload Generator And Listener
• Ghost Framework - An Android Post Exploitation Framework That Uses An Android Debug Bridge To Remotely Access A n Android Device
• Ghost Framework - An Android Post-Exploitation Framework That Exploits The Android Debug Bridge To R emotely Access An Android Device
• GhostDelivery - This Tool Creates A Obfuscated .vbs Script To Download A Payload Hosted On A Server To %TEMP% Directory, Execute Payload And Gain Persistence
• Git All The Payloads! A Collection Of Web Attack Payloads
• Go-Shellcode - A Repository Of Windows Shellcode Runners And Supporting Utilities
• GoPurple - Yet Another Shellcode Runner Consists Of Different Techniques For Evaluating Detection Capabilities Of Endpoint Security Solutions
• GodGenesis - A Python3 Based C2 Server To Make Life Of Red Teamer A Bit Easier. The Payload Is Capable To Bypass All The Known Antiviruses And Endpoints
• GodOfWar - Malicious Java WAR Builder With Built-In Payloads
• Gtfo - Search For Unix Binaries That Can Be Exploited To Bypass System Security Restrictions
• Gustave - Embedded OS kernel fuzzer
• Hades - Go Shellcode Loader That Combines Multiple Evasion Techniques
• Hades - Go Shellcode Loader That Combines Multiple Evasion Techniques
• Havoc - Modern and malleable post-exploitation command and control framework
• Heappy - A Happy Heap Editor To Support Your Exploitation Process
• Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types
• ISF - Industrial Control System Exploitation Framework
• Iblessing - An iOS Security Exploiting Toolkit, It Mainly Includes Application Information Collection, Static Analysis And Dynamic Analysis
• ImpulsiveDLLHijack - C# Based Tool Which Automates The Process Of Discovering And Exploiting DLL Hijacks In Target Binaries
• Injectus - CRLF And Open Redirect Fuzzer
• InlineExecute-Assembly - A PoC Beacon Object File (BOF) That Allows Security Professionals To Perform In Process .NET Assembly Execution
• Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux
• Iris - WinDbg Extension To Perform Basic Detection Of Common Windows Exploit Mitigations
• Ispy - Eternalblue (MS17-010) / Bluekeep (CVE-2019-0708) Scanner And Exploit
• JNDI-Injection-Exploit - A Tool Which Generates JNDI Links Can Start Several Servers To Exploit JNDI Injection Vulnerability
• JSONBee - A Ready To Use JSONP Endpoints/Payloads To Help Bypass Content Security Policy Of Different Websites
• JWT-Hack - Tool To En/Decoding JWT, Generate Payload For JWT Attack And Very Fast Cracking(Dict/Brutefoce)
• Jektor - A Windows User-Mode Shellcode Execution Tool That Demonstrates Various Techniques That Malware Uses
• Joern - Open-source Code Analysis Platform For C/C++/Java Based On Code Property Graphs
• Joy - A Package For Capturing And Analyzing Network Flow Data And Intraflow Data, For Network Research, Forensics, And Security Monitoring
• K55 - Linux X86_64 Process Injection Utility | Manipulate Processes With Customized Payloads
• Kage - Graphical User Interface For Metasploit Meterpreter And Session Handler
• Kage - Graphical User Interface For Metasploit Meterpreter And Session Handler
• Kaiten - A Undetectable Payload Generation
• Keylogger - Get Keyboard, Mouse, ScreenShot, Microphone Inputs From Target Computer And Send To Your Mail
• Kubestroyer - Kubernetes Exploitation Tool
• LAZYPARIAH - A Tool For Generating Reverse Shell Payloads On The Fly
• LibAFL - Advanced Fuzzing Library - Slot Your Fuzzer Together In Rust! Scales Across Cores And Machines. For Windows, Android, MacOS, Linux, No_Std, ...
• Liffy - Local File Inclusion Exploitation Tool
• LinPwn - Interactive Post Exploitation Tool
• Litefuzz - A Multi-Platform Fuzzer For Poking At Userland Binaries And Servers
• MOSE - Post Exploitation Tool For Configuration Management Servers.
• MSFPC - MSFvenom Payload Creator
• Mad-Metasploit - Metasploit Custom Modules, Plugins & Resource Scripts
• Manul - A Coverage-Guided Parallel Fuzzer For Open-Source And Blackbox Binaries On Windows, Linux And MacOS
• Metasploit 5.0 - The World’s Most Used Penetration Testing Framework
• Metasploit Cheat Sheet
• MeterPwrShell - Automated Tool That Generate The Perfect Powershell Payload
• Mikrot8Over - Fast Exploitation Tool For Mikrotik RouterOS
• Mimicry - Security Tool For Active Deception In Exploitation And Post-Exploitation
• Mimikatz v2.2.0 - A Post-Exploitation Tool to Extract Plaintexts Passwords, Hash, PIN Code from Memory
• Mole - A Framework For Identifying And Exploiting Out-Of-Band Application Vulnerabilities
• Monomorph - MD5-Monomorphic Shellcode Packer - All Payloads Have The Same MD5 Hash
• Moonwalk - Cover Your Tracks During Linux Exploitation By Leaving Zero Traces On System Logs And Filesystem Timestamps
• Mouse Framework - An iOS And macOS Post Exploitation Surveillance Framework That Gives You A Command Line Session With Extra Functionality Between You And A Target Machine Using Only A Simple Mouse Payload
• Mutiny Fuzzing Framework - Network Fuzzer That Operates By Replaying PCAPs Through A Mutational Fuzzer
• N1QLMap - The Tool Exfiltrates Data From Couchbase Database By Exploiting N1QL Injection Vulnerabilities
• Nautilus - A Grammar Based Feedback Fuzzer
• NekoBot - Auto Exploiter With 500+ Exploit 2000+ Shell
• Nim-Loader - WIP Shellcode Loader In Nim With EDR Evasion Techniques
• NimHollow - Nim Implementation Of Process Hollowing Using Syscalls (PoC)
• NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit
• Nimcrypt2 - .NET, PE, And Raw Shellcode Packer/Loader Written In Nim
• OSS-Fuzz - Continuous Fuzzing Of Open Source Software
• Obfuscator - The Program Is Designed To Obfuscate The Shellcode
• Onelinepy - Python Obfuscator To Generate One-Liners And FUD Payloads
• OpenRedireX - Asynchronous Open redirect Fuzzer for Humans
• OverRide - Binary Exploitation And Reverse-Engineering (From Assembly Into C)
• Ox4Shell - Deobfuscate Log4Shell Payloads With Ease
• PEzor - Open-Source Shellcode And PE Packer
• PPLdump - Dump The Memory Of A PPL With A Userland Exploit
• Packer-Fuzzer - A Fast And Efficient Scanner For Security Detection Of Websites Constructed By Javascript Module Bundler Such As Webpack
• PatrowlHears - PatrowlHears - Vulnerability Intelligence Center / Exploits
• Pe-Sieve - Recognizes And Dumps A Variety Of Potentially Malicious Implants (Replaced/Injected PEs, Shellcodes, Hooks, In-Memory Patches)
• Pentest Tools Framework - A Database Of Exploits, Scanners And Tools For Penetration Testing
• Perfusion - Exploit For The RpcEptMapper Registry Key Permissions Vulnerability (Windows 7 / 2088R2 / 8 / 2012)
• Phantom Evasion - Python AV Evasion Tool Capable To Generate FUD Executable Even With The Most Common 32 Bit Metasploit Payload (Exe/Elf/Dmg/Apk)
• Phirautee - A PoC Crypto Virus To Spread User Awareness About Attacks And Implications Of Ransomwares
• PhoneSploit - Using Open Adb Ports We Can Exploit A Devive
• PhoneSploit v1.2 - Using Open Adb Ports We Can Exploit A Andriod Device
• PhoneSploit-Pro - An All-In-One Hacking Tool To Remotely Exploit Android Devices Using ADB And Metasploit-Framework To Get A Meterpreter Session
• Php-Jpeg-Injector - Injects Php Payloads Into Jpeg Images
• PickleC2 - A Post-Exploitation And Lateral Movements Framework
• Pixload - Image Payload Creating/Injecting Tools
• Pocsploit - A Lightweight, Flexible And Novel Open Source Poc Verification Framework
• Pocsuite3 - An Open-Sourced Remote Vulnerability Testing Framework
• Pompem - Exploit and Vulnerability Finder
• PostShell - Post Exploitation Bind/Backconnect Shell
• PowerMeUp - A Small Library Of Powershell Scripts For Post Exploitation That You May Need Or Use!
• PowerSploit - A PowerShell Post-Exploitation Framework
• Powershell-Backdoor-Generator - Obfuscated Powershell Reverse Backdoor With Flipper Zero And USB Rubber Ducky Payloads
• Pown.js - A Security Testing An Exploitation Toolkit Built On Top Of Node.js And NPM
• Priv2Admin - Exploitation Paths Allowing You To (Mis)Use The Windows Privileges To Elevate Your Rights Within The OS
• ProjectOpal - Stealth Post-Exploitation Framework For Wordpress
• Proton Framework - A Windows Post Exploitation Framework Similar To Other Penetration Testing Tools Such As Meterpreter And Powershell Invader Framework
• ProxyLogon - PoC Exploit for Microsoft Exchange
• PwnKit-Exploit - Proof Of Concept (PoC) CVE-2021-4034
• PythonAESObfuscate - Obfuscates A Python Script And The Accompanying Shellcode
• QRLJacker v2.0 - QRLJacking Exploitation Framework
• QuadraInspect - Android Framework That Integrates AndroPass, APKUtil, And MobFS, Providing A Powerful Tool For Analyzing The Security Of Android Applications
• R00Kie-Kr00Kie - PoC Exploit For The CVE-2019-15126 Kr00K Vulnerability
• RMIScout - Wordlist And Bruteforce Strategies To Enumerate Java RMI Functions And Exploit RMI Parameter Unmarshalling Vulnerabilities
• RapidPayload - Metasploit Payload Generator
• Regexploit - Find Regular Expressions Which Are Vulnerable To ReDoS (Regular Expression Denial Of Service)
• Remot3d - An Simple Exploit for PHP Language
• RmiTaste - Allows Security Professionals To Detect, Enumerate, Interact And Exploit RMI Services By Calling Remote Methods With Gadgets From Ysoseria
• RomBuster - A Router Exploitation Tool That Allows To Disclosure Network Router Admin Password
• Ronin - A Ruby Platform For Vulnerability Research And Exploit Development
• Ropr - A Blazing Fast Multithreaded ROP Gadget Finder. Ropper / Ropgadget Alternative
• Router Exploit Shovel - Automated Application Generation For Stack Overflow Types On Wireless Routers
• Rpi-Hunter - Automate Discovering And Dropping Payloads On LAN Raspberry Pi's Via SSH
• RustChain - Hide Memory Artifacts Using ROP And Hardware Breakpoints
• SNOWCRASH - A Polyglot Payload Generator
• SNOWCRASH - A Polyglot Payload Generator
• SUDO_KILLER - A Tool To Identify And Exploit Sudo Rules Misconfigurations And Vulnerabilities Within Sudo
• SUDO_KILLER - A Tool To Identify And Exploit Sudo Rules' Misconfigurations And Vulnerabilities Within Sudo
• SUID3NUM - A Script Which Utilizes Python'S Built-In Modules To Find SUID Bins, Separate Default Bins From Custom Bins, Cross-Match Those With Bins In GTFO Bin's Repository & Auto-Exploit Those
• Sandfly-Entropyscan - Tool To Detect Packed Or Encrypt ed Binaries Related To Malware, Finds Malicious Files And Linux Processes And Gives Output With Cryptographic Hashes
• Satellite - Easy-To-Use Payload Hosting
• Scan4All - Vuls Scan: 15000+PoCs; 21 Kinds Of Application Password Crack; 7000+Web Fingerprints; 146 Protocols And 90000+ Rules Port Scanning; Fuzz, HW, Awesome BugBounty...
• ScareCrow - Payload Creation Framework Designed Around EDR Bypass
• Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes
• Scour - AWS Exploitation Framework
• Scout - Lightweight URL Fuzzer And Spider: Discover A Web Server'S Undisclosed Files, Directories And VHOSTs
• Server Side Template Injection Payloads
• Sh4D0Wup - Signing-key Abuse And Update Exploitation Framework
• SharpEventPersist - Persistence By Writing/Reading Shellcode From Event Log
• SharpImpersonation - A User Impersonation Tool - Via Token Or Shellcode Injection
• SharpStrike - A Post Exploitation Tool Written In C# Uses Either CIM Or WMI To Query Remote Systems
• Sharperner - Simple Executable Generator With Encrypted Shellcode
• Shellcode-Encryptor - A Simple Shell Code Encryptor/Decryptor/Executor To Bypass Anti Virus
• ShellcodeTemplate - An Easily Modifiable Shellcode Template For Windows X64/X86
• Shellcodetester - An Application To Test Windows And Linux Shellcodes
• Shellex - C-shellcode To Hex Converter, Handy Tool For Paste And Execute Shellcodes In Gdb, Windbg, Radare2, Ollydbg, X64Dbg, Immunity Debugger And 010 Editor
• Shennina - Automating Host Exploitation With AI
• Shhhloader - SysWhispers Shellcode Loader
• SilentMoonwalk - PoC Implementation Of A Fully Dynamic Call Stack Spoofer
• SneakyEXE - Embedding "UAC-Bypassing" Function Into Your Custom Payload
• Sploit - Go Package That Aids In Binary Analysis And Exploitation
• Spock SLAF - A Shared Library Application Firewall "SLAF"
• SpoolSploit - A Collection Of Windows Print Spooler Exploits Containerized With Other Utilities For Practical Exploitation
• Spring-Spel-0Day-Poc - Spring-Cloud / spring-cloud-function, spring.cloud.function.routing-expression, RCE, 0day, 0-day, POC, EXP
• Spring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit
• Spring4Shell-Poc - Spring Core RCE 0-day Vulnerability
• StandIn - A Small .NET35/45 AD Post-Exploitation Toolkit
• Storm-Breaker - Tool Social Engineering (Access Webcam, Microphone, OS Password Grabber And Location Finder) With Ngrok
• Stunner - Tool To Test And Exploit STUN, TURN And TURN Over TCP Servers
• Swift-Attack - Unit Tests For Blue Teams To Aid With Building Detections For Some Common macOS Post Exploitation Methods
• Tentacle - A POC Vulnerability Verification And Exploit Framework
• TerraLdr - A Payload Loader Designed With Advanced Evasion Features
• Theo - Ethereum Recon And Exploitation Tool
• Thoron Framework - Tool To Generate Simple Payloads To Provide Linux TCP Attack
• ThreadBoat - Program Uses Thread Execution Hijacking To Inject Native Shellcode Into A Standard Win32 Application
• ThreadStackSpoofer - PoC For An Advanced In-Memory Evasion Technique Allowing To Better Hide Injected Shellcode'S Memory Allocation From Scanners And Analysts
• ThunderCloud - Cloud Exploit Framework
• Thunderstorm - Modular Framework To Exploit UPS Devices
• TiEtwAgent - PoC Memory Injection Detection Agent Based On ETW, For Offensive And Defensive Research Purposes
• TokenBreaker - JSON RSA To HMAC And None Algorithm Vulnerability POC
• ToothPicker - An In-Process, Coverage-Guided Fuzzer For iOS
• Traitor - Automatic Linux Privesc Via Exploitation Of Low-Hanging Fruit E.G. GTFOBin
• TrustJack - Yet Another PoC For Hijacking DLLs in Windows
• UAC-A-Mola - Tool That Allows Security Researchers To Investigate New UAC Bypasses, In Addition To Detecting And Exploiting Known Bypasses
• UAFuzz - Binary-level Directed Fuzzing For Use-After-Free Vulnerabilities
• Urlbuster - Powerful Mutable Web Directory Fuzzer To Bruteforce Existing And/Or Hidden Files Or Directories
• Vaf - Very Advanced (Web) Fuzzer
• WEF - Wi-Fi Exploitation Framework
• WMEye - A Post Exploitation Tool That Uses WMI Event Filter And MSBuild Execution For Lateral Movement
• Watson - Enumerate Missing KBs And Suggest Exploits For Useful Privilege Escalation Vulnerabilities
• Wesng - Windows Exploit Suggester
• Wifi-Framework - Wi-Fi Framework For Creating Proof-Of-Concepts, Automated Experiments, Test Suites, Fuzzers, And More...
• WordListGen - Super Simple Python Word List Generator For Fuzzing And Brute Forcing In Python
• Wpgarlic - A Proof-Of-Concept WordPress Plugin Fuzzer
• Xeca - PowerShell Payload Generator
• Xeexe - Undetectable And XOR Encrypting With Custom KEY (FUD Metasploit RAT)
• Xori - An Automation-Ready Disassembly And Static Analysis Library For PE32, 32+ And Shellcode
• Zin - A Payload Injector For Bugbounties Written In Go
• Zuthaka - An Open Source Application Designed To Assist Red-Teaming Efforts, By Simplifying The Task Of Managing Different APTs And Other Post-Exploitation Tools
• autoPwn - Automate Repetitive Tasks For Fuzzing
• crauEmu - An uEmu Extension For Developing And Analyzing Payloads For Code-Reuse Attacks
• drAFL - AFL + DynamoRIO = Fuzzing Binaries With No Source Code On Linux
• hackerEnv - An Automation Tool That Quickly And Easily Sweep IPs And Scan Ports, Vulnerabilities And Exploit Them
• laZzzy - Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques
• noPac - Exploiting CVE-2021-42278 And CVE-2021-42287 To Impersonate DA From Standard Domain User
• truffleHog - Searches Through Git Repositories For High Entropy Strings And Secrets, Digging Deep Into Commit History
• uniFuzzer - A Fuzzing Tool For Closed-Source Binaries Based On Unicorn And LibFuzzer
• xShock - Shellshock Exploit