oscp/Necronomicon/Resources/Repos.md

- Web Application Testing
	- https://github.com/almandin/fuxploider
	- https://github.com/jonaslejon/malicious-pdf
	- https://github.com/riramar/Web-Attack-Cheat-Sheet
	- https://github.com/m3n0sd0n4ld/GooFuzz
	- https://github.com/t3l3machus/toxssin
	- PHP web shell with nice appearance and multiple methods of executing commands to bypass disabled methods: https://github.com/flozz/p0wny-shell
- Active Directory
	- https://github.com/tevora-threat/SharpView
	- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md
	- https://github.com/ollypwn/Certipy
	- Customize Bloodhound: https://github.com/porterhau5/BloodHound-Owned
	- https://rohnspowershellblog.wordpress.com/2013/03/19/viewing-service-acls/
	- https://github.com/dirkjanm/adidnsdump - DNS enumeration
	- [ForgeCert](https://github.com/GhostPack/ForgeCert) - Forge certificates with compromised CA certificate and private key
	- [pre2k](https://github.com/garrettfoster13/pre2k) - Foothold via pre-Windows 2000 computer objects
	- [SilentHound](https://github.com/layer8secure/SilentHound) - Much quieter AD enumeration than BloodHound
	- [Linikatz](https://github.com/CiscoCXSecurity/linikatz)Toolkit for attacking AD on Linux
- Cobalt Strike
	- https://github.com/josephkingstone/cobalt_strike_extension_kit
	- https://github.com/ajpc500/BOFs
	- [PowerLessShell](https://github.com/Mr-Un1k0d3r/PowerLessShell) Aggressor script to execute PowerShell via MSBuild
	- [PowerLurk](https://github.com/Sw4mpf0x/PowerLurk) - PowerShell script for malicious WMI event subscriptions
	- [Rasta Misc Tools](https://github.com/rasta-mouse/MiscTools) - Various C# tools by Rasta
	- https://github.com/cobbr/SharpShell
	- https://github.com/Porchetta-Industries/pyMalleableC2
	- https://github.com/boku7/BokuLoader - UDRL
	- https://github.com/Cracked5pider/KaynStrike - UDRL
	- https://github.com/mgeeky/ElusiveMice - UDRL
	- https://github.com/netero1010/RDPHijack-BOF
	- [Nanodump](https://github.com/helpsystems/nanodump) - Sneaky memory dump BOF
- Social Engineering/Phishing
	- https://github.com/lockedbyte/CVE-2021-40444
	- Clone a website with 2FA - https://github.com/fireeye/ReelPhish
	- https://github.com/kgretzky/evilginx2 - Bypass MFA by MITMing login to actual website
	- https://github.com/fin3ss3g0d/evilgophish - Combine EvilNginx2 with GoPhish
- LDAP
	- - https://github.com/tomcarver16/ADSearch
- Local Enumeration
	- [DNSleuth](https://github.com/devanshbatham/DNSleuth)- Python script for spying on DNS queries being made by the machine
- OSINT/Recon
	- [Gotator](https://github.com/Josue87/gotator)- Generate DNS wordlists through permutations -- for brute force
	- [HTTPX](https://github.com/projectdiscovery/httpx)- Fast HTTP probing toolkit
	- [Katana](https://github.com/projectdiscovery/katana)- Crawling and spidering framework
	- [Nuclei](https://github.com/projectdiscovery/nuclei)- Open-source vulnerability scanner
	- [realm](https://github.com/devanshbatham/realm)- Tool for recursively traversing SSL/TLS certificates for DNS names
	- [GitLeaks](https://github.com/zricethezav/gitleaks/) - Tool for searching Github repos
	- [truffleHog](https://github.com/dxa4481/truffleHog/)- Another tool for searching Github repos
	- [LinkFinder](https://github.com/GerbenJavado/LinkFinder.git)- Scrape links out of JavaScript files
- Post-exploitation
	- https://github.com/nil0x42/phpsploit
	- https://github.com/sevagas/swap_digger
	- https://github.com/redcode-labs/Bashark
	- https://github.com/AlessandroZ/BeRoot
	- https://github.com/GhostPack
	- https://github.com/AdrianVollmer/PowerHub
	- https://github.com/Flangvik/SharpCollection
	- https://github.com/atn1ght/FakeAuth - Generate a fake login prompt to collect cleartext credentials
	- https://github.com/matterpreter/OffensiveCSharp - Really cool repo with a lot of interesting tools for a variety of purposes
	- [LaZagne](https://github.com/AlessandroZ/LaZagne) - Catch-all tool for gathering credentials during post-ex
	- [PPLDump](https://github.com/itm4n/PPLdump) - Exploit to bypass PPL (patched on most recent builds)
	- [Sapito](https://github.com/eldraco/Sapito) - mDNS sniffer/interpreter
- AV/EDR Evasion
	- https://github.com/optiv/ScareCrow
	- https://github.com/C-Sto/BananaPhone
	- https://github.com/TheWover/donut
	- https://github.com/danielbohannon/Invoke-Obfuscation
	- https://github.com/CCob/SharpBlock
	- https://github.com/StudyCat404/uuid_exec_shellcode
	- https://gist.github.com/xpn/fabc89c6dc52e038592f3fb9d1374673#file-unmanaged_dotnet_unhook_etw-c
	- https://github.com/GetRektBoy724/SharpUnhooker
	- https://github.com/icyguider/Nimcrypt2
	- https://github.com/mgeeky/Stracciatella
	- https://github.com/threatexpress/metatwin - Copy file metadata/signature
	- https://github.com/jfmaes/Invoke-DLLClone - Copy metadata and signature and exports
	- [ContainYourself](https://github.com/deepinstinct/ContainYourself)- EDR bypass via Windows containers
- Code Execution
	- https://github.com/Tylous/ZipExec - Code execution from within an encrypted zip
	- [micr0_shell](https://github.com/senzee1984/micr0_shell)- Python script for generating Windows x64 PIC reverse shell shellcode, with no null bytes. Smaller than msfvenom equivalents and without the sigs.
- Privilege Escalation
	- https://github.com/GhostPack/SharpUp
- UAC Bypass
	- https://github.com/hfiref0x/UACME
- Password Spraying/Brute Force/Password Cracking
	- https://github.com/J3rryBl4nks/PasswordCrackingMethodology
	- https://github.com/hashcat/kwprocessor
	- https://github.com/ustayready/fireprox - Use AWS API gateway to rotate source IPs during password spray/brute force
	- https://github.com/dafthack/MSOLSpray - Password spray Microsoft Online accounts/enumerate account and auth status
	- [HashMob](https://hashmob.net/)- Great password cracking resources--wordlists, rulesets, etc.
- Credential Harvesting
	- https://github.com/djhohnstein/SharpChromium
	- https://github.com/praetorian-inc/PortBender
	- https://gist.github.com/N4kedTurtle/8238f64d18932c7184faa2d0af2f1240
	- https://github.com/0x09AL/WordSteal - Create Word document with embedded UNC path image for harvesting hashes
- Connection
	- https://github.com/magic-wormhole/magic-wormhole - Encrypted file transfer
- Lateral Movement
	- https://github.com/FSecureLABS/SharpGPOAbuse
	- https://github.com/EmpireProject/Empire/blob/master/data/module_source/lateral_movement/Invoke-DCOM.ps1
	- https://gitlab.com/theepicpowner/dcom_av_exec
- Persistence
	- https://github.com/fireeye/SharPersist
	- https://github.com/HarmJ0y/DAMP
	- [RegReeper](https://github.com/tccontre/Reg-Restore-Persistence-Mole)- POC for setting registry keys using APIs not monitored by Sysmon
- Privesc
	- https://github.com/GhostPack/SharpUp
	- https://github.com/cube0x0/CVE-2021-1675
- Infrastructure
	- https://github.com/mdsecactivebreach/Chameleon - actively categorize domain
	- https://github.com/Flangvik/AzureC2Relay - Azure redirectors 
	- https://github.com/threatexpress/cs2modrewrite - Automatically generate mod_rewrite rules
- Purple Teaming
	- https://github.com/FortyNorthSecurity/Egress-Assess
- Kerberos
	- https://github.com/Zer1t0/ticket_converter
	- https://github.com/Zer1t0/cerbero#convert
- Cloud
	- https://github.com/hausec/PowerZure - PowerView but for Azure
	- [GitHub - mattrotlevi/lava: Microsoft Azure Exploitation Framework](https://github.com/mattrotlevi/lava) - Pacu, but for Azure
	- [Red-Kube](https://github.com/lightspin-tech/red-kube) - Generalized tool for all manner of Kubernetes attacks
	- [How to Hack Like a Ghost - Repo](https://github.com/sparcflow/HackLikeAGhost) - Scripts/code from the book, including POC C2 backdoors, etc.
	- [AWS Security Tools](https://github.com/toniblyx/my-arsenal-of-aws-security-tools/) - Compilation of tools used for testing AWS
- Dev
	- [corkami](https://github.com/corkami/) - A helpful repo containing visualizations of various file formats - helps with understanding their structure