Post-Exploitation
Arsenal of tools for ethical hacking and pentesting
PEASS-ng (LinPEAS / WinPEAS)
Post-ExploitationPrivilege escalation enumeration scripts for Linux, Windows and macOS.
NetExec
Post-ExploitationMaintained successor of CrackMapExec. Swiss army knife for Windows and Active Directory network pentesting.
Havoc C2
Post-ExploitationModern C2 framework with low barrier to entry. Active community development.
Empire C2
Post-ExploitationC2 framework with PowerShell, Python and C# agents. Large module library.
Mimikatz
Post-ExploitationLegendary tool for extracting Windows credentials. Dumps NTLM, Kerberos tickets.
Rubeus
Post-ExploitationC# tool for Kerberos abuse. Kerberoasting, AS-REP roasting and more.
BloodHound
Post-ExploitationTool for mapping Active Directory relationships and finding attack paths.
CrackMapExec
Post-ExploitationSwiss army knife for Windows network pentesting. Validates credentials, executes modules.
Impacket
Post-ExploitationCollection of Python classes for working with network protocols. Essential for AD attacks.
Evil-WinRM
Post-ExploitationWinRM shell for hacking. File upload, AMSI bypass, and more features.
Ligolo-ng
Post-ExploitationSimple and lightweight tunneling and pivoting tool based on TUN interface.
Chisel
Post-ExploitationFast TCP/UDP tunnel, transported over HTTP and secured via SSH.
Cobalt Strike
Post-ExploitationCommercial adversary simulation platform. Beacon implants with covert communications.
Sliver C2
Post-ExploitationOpen source cross-platform C2 framework. Implants for Windows, macOS and Linux.
pspy
Post-ExploitationMonitor Linux processes without root. Perfect for spotting cron jobs and other users' commands.
Certipy
Post-ExploitationEnumeration and abuse of Active Directory Certificate Services (ADCS): ESC1-ESC15.
Merlin C2
Post-ExploitationPost-exploitation C2 tool that uses HTTP/2 and HTTP/3 for communications.
Mythic C2
Post-ExploitationOpen source C2 framework with multiple agents and communication protocols.