Open-source alternatives to Impacket

Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

Rubeus is a comprehensive Kerberos attack toolkit for Active Directory environments, written in C#. It provides a full suite of operations for manipulating Kerberos tickets, exploiting delegation configurations, and performing credential attacks against Windows domains. The toolkit enables ticket extraction from logon sessions and memory, with real-time monitoring via Event Tracing for Windows. It supports forging golden and silver tickets with arbitrary privileges, as well as the creation of forged delegation contexts. Delegation attacks include abuse of constrained and unconstrained delegat

CrackMapExec is a network penetration testing framework and automated security scanner designed to assess security postures across large IP ranges. It functions as a multi-protocol security scanner and network protocol auditor used to identify vulnerabilities and misconfigurations. The tool provides capabilities for Active Directory auditing to enumerate users and permissions, as well as post-exploitation enumeration to gather system metadata and discover lateral movement paths. It includes a framework for credential spraying and harvesting across various network services. The system utilize

This project is a technical guide and reference for internal network penetration testing. It serves as a collection of procedures for exploiting and navigating private corporate networks during security assessments. The repository provides specialized manuals and cheat sheets focused on active directory attacks, lateral movement, and privilege escalation. It includes a post-exploitation playbook for maintaining system persistence and clearing forensic traces. The documentation covers a broad range of security capabilities, including initial access, network pivoting and tunneling, and interna

This project provides a server-side language runtime and a standardized Docker image for deploying applications across different operating systems. It functions as an execution environment for generating dynamic HTML, JSON, and XML content, while also serving as a command line interface for automation scripts and background jobs. The runtime is designed for extensibility through a C-based extension architecture, allowing the loading of custom modules for specialized functionality. It supports multiple server application interfaces, including a FastCGI web interface for high-performance commun

The framework is a comprehensive penetration testing platform designed for the development, testing, and execution of security exploits. It serves as a research toolkit and automated assessment environment, enabling security professionals to identify and validate vulnerabilities within networked systems and infrastructure through repeatable, standardized procedures. The platform distinguishes itself through a modular architecture that supports reflective payload injection, allowing for the execution of code directly in memory without writing to disk. It utilizes an asynchronous event loop to

Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and dissecting network traffic. It functions as a framework for building custom network tools that interact directly with low-level packet headers and payloads, enabling users to perform security research and network diagnostics. The system distinguishes itself through a layer-based construction model that allows users to define protocols as stacked objects, which automatically handle checksums and field offsets. It utilizes dynamic field reflection to map packet structures to bin

Coost is a concurrent network framework and coroutine scheduler designed for building high-performance TCP, HTTP, and RPC services. It provides a set of tools for handling non-blocking IPv4 and IPv6 communication, integrating SSL encryption and a lightweight execution engine that manages concurrent tasks using shared stacks. The project features a specialized JSON RPC implementation for exchanging structured data over encrypted connections and a high-performance logging system. This logging infrastructure supports topic-based routing, frequency filtering, and automated stack trace capture for

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

Cellnet is a Go networking framework designed for building distributed systems and peer-to-peer networks. It provides a multi-protocol transport layer that standardizes message exchange across TCP, UDP, and WebSockets, utilizing a binary message codec system to map message types to unique identifiers for network transmission. The framework is distinguished by its remote procedure call library, which enables the execution of functions on remote peers using synchronous or asynchronous request patterns. It further differentiates itself with an asynchronous event dispatcher that processes network

This project is a comprehensive, community-curated directory of cybersecurity resources, tools, and educational materials. It functions as a centralized index for researchers and students to discover frameworks and utilities across the entire security lifecycle, ranging from initial vulnerability assessment to post-exploitation analysis. The repository distinguishes itself through a hierarchical taxonomy that organizes diverse security disciplines into a searchable, version-controlled knowledge base. Rather than hosting software directly, it utilizes a decentralized aggregation model that lin

libzmq is a C++ based asynchronous messaging engine and networking core designed for routing non-blocking messages between distributed nodes. It functions as a distributed message queue that implements the ZMTP wire-format framing protocol to standardize how data moves across different network transport layers. The library provides a multi-transport abstraction that allows a single interface to route data across TCP, IPC, and in-process memory. It incorporates a cryptographic layer to encrypt and authenticate transmissions between nodes and employs topology-based messaging patterns, such as p

This project is an open source discovery resource that provides curated lists of reusable code and libraries to help developers find technical solutions for specific tasks. It utilizes a category-based indexing system to organize diverse software tools by their functional capabilities. The repository is structured as a collection of markdown-based documentation and static content, serving as a directory for manual discovery and reference. The directory covers a wide range of capability areas, including cross-platform application development, cybersecurity tool creation, network protocol impl

Mimikatz is a security research suite designed for auditing Windows authentication and managing system security configurations. It provides a comprehensive framework for extracting sensitive credentials, manipulating process privileges, and managing digital identity assets directly from system memory or offline memory dumps. The project distinguishes itself through advanced system-level exploitation techniques, including runtime process injection, API hooking, and the ability to bypass cryptographic export restrictions. It features a specialized toolkit for Kerberos protocol operations, allow

This project is a memory-safe implementation of the QUIC transport protocol and HTTP/3, designed for high-throughput and efficient network communication. It provides a comprehensive toolkit for building secure, low-latency network applications by managing the full lifecycle of transport connections, including protocol negotiation, stream data exchange, and connection state management. The library distinguishes itself through a focus on performance and protocol integrity. It utilizes a formal state machine to enforce strict adherence to transport rules and employs zero-copy buffer management t

dnsguide is a software implementation of the DNS protocol designed to handle queries and responses between clients and nameservers. It functions as a recursive DNS server and network service tool for managing the resolution of domain names within local or wide area networks. The project provides a framework for building a custom DNS server, incorporating recursive resolution logic and stub resolver integration to translate hostnames into IP addresses. It is designed for implementing the DNS protocol from scratch to facilitate network protocol learning and custom name resolution. The implemen

Ladon is an internal network penetration scanner and vulnerability assessment tool designed to identify high-risk security flaws and assets across network segments. It operates as a fileless security scanner, executing its engine and modules directly in memory to avoid leaving a disk footprint on target systems. The project is distinguished by its integration as a plugin for command beacons, specifically within the Cobalt Strike framework. This allows for memory-resident network discovery and vulnerability detection. It further supports stealth operations through payload and script obfuscatio

Curl is a command-line tool and portable library for transferring data across a wide range of network protocols. It functions as a unified engine that abstracts diverse communication standards, allowing users and developers to move files and information between servers using a consistent interface. The project provides both a versatile command-line client for terminal-based automation and a stable programmatic interface for integrating complex network operations into applications. The system is distinguished by its protocol-agnostic core and its ability to manage both synchronous and asynchro

Dumping DPAPI credz remotely

Tool for Active Directory Certificate Services enumeration and abuse

netshell features all in version 2 powershell

BloodHound is a graph-based security analysis tool designed to map trust relationships and attack vectors within Active Directory environments. It functions as an attack path mapper and risk assessment system that uses graph theory to identify hidden relationships and paths leading to high-privilege accounts. The tool specializes in network attack surface mapping and privilege escalation pathfinding. It quantifies security risks by measuring the reliability of attack paths to critical targets, allowing for the prioritization of vulnerability elimination. The system provides capabilities for

Certbot is a command-line client designed to automate the lifecycle of digital security certificates. By implementing the ACME protocol, it manages the communication between a local server and a certificate authority to verify domain ownership and issue transport layer security certificates without manual intervention. The tool distinguishes itself through a modular plugin architecture that allows it to interact directly with various web server configurations and DNS providers. This framework enables the software to perform automated domain validation, modify server settings, and configure vi

RustScan is a high-speed network reconnaissance tool designed for automated port discovery and service enumeration. It functions as an automated vulnerability scanner that identifies open ports and active services across network environments, providing a foundation for mapping attack surfaces and gathering intelligence on target systems. The tool distinguishes itself through its ability to dynamically adjust scanning parameters and concurrency in real-time based on system feedback, ensuring efficient performance while preventing network congestion. It features an extensible architecture that

Mozilla HTTP Observatory

Kerberos relaying and unconstrained delegation abuse toolkit

Tools for Kerberos PKINIT and relaying to AD CS