Open-source alternatives to MozDef

CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows.

Distributed & real time digital forensics at the speed of the cloud

PowerForensics provides an all in one platform for live disk forensic analysis

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

Digital Forensics Investigation Platform

HELK is a containerized security information and event management environment and threat hunting platform. It provides a security-focused deployment of the ELK stack, combining Elasticsearch, Logstash, and Kibana into a specialized platform for investigating logs and discovering hidden patterns in network and system security data. The project functions as a security data science suite, integrating interactive computational notebooks and distributed processing tools to run machine learning and graph analytics on security logs. This allows for the identification of hidden attack patterns and an

This project is an offensive security toolkit and development framework for creating memory-safe malware, network scanners, and payload generators. It provides a structured approach to developing exploits, shellcode, and remote access tools. The framework distinguishes itself through the use of no-standard-library environments to generate minimal standalone machine code and shellcode. It also supports the compilation of high-performance logic into WebAssembly for the creation of deceptive web interfaces used in social engineering. Capability areas cover automated vulnerability discovery via

This project is a curated collection of frameworks, libraries, and toolsets designed for social engineering and public data gathering. It aggregates specialized software and educational materials used to perform human-centric attacks during professional security engagements. The directory provides resources for gathering and visualizing open source intelligence to identify sensitive information leaks. It also includes a collection of methods and software for executing phishing campaigns to harvest credentials and session cookies. The repository further covers educational materials focused on

TheHive is a security incident response platform and multi-tenant case management system. It functions as a Security Orchestration, Automation, and Response (SOAR) tool and a threat intelligence platform designed to coordinate security investigations by managing alerts, cases, and observables. The platform is distinguished by its multi-tenant architecture, which isolates data across different organizations while supporting selective cross-tenant sharing. It features a SOAR automation engine capable of executing sandboxed JavaScript logic to automate workflows and trigger response actions thro

GHunt is a Google account investigator and open-source intelligence framework designed to retrieve publicly available information and metadata associated with Google accounts. It functions as an OSINT data extractor and offensive security framework used to identify user identities and uncover hidden metadata. The tool extracts public profile data from various Google services and exports the findings into structured JSON formats. This allows for the collection and analysis of digital footprints to support security research and reconnaissance.

Commando VM is a Windows-based penetration testing distribution and offensive security virtual machine. It serves as a toolset manager for deploying and maintaining a curated collection of security tools, scripts, and configurations designed for security auditing, red teaming, and adversary simulation. The project automates the provisioning of a specialized workstation by using PowerShell scripts and a modular repository to orchestrate the installation of offensive security software. It utilizes a community-driven package manager to handle dependency resolution and binary installations, ensur

Nishang is a PowerShell-based offensive security framework designed for red teaming and penetration testing on Windows targets. It functions as a post-exploitation toolkit and payload generator to automate attacks and manage remote targets. The project provides specialized capabilities for bypassing security controls, such as disabling the Antimalware Scan Interface and employing in-memory execution to avoid disk-based detection. It includes a variety of stealthy command and control mechanisms, utilizing non-standard channels like DNS TXT records, ICMP traffic, and webmail for communication a

1Remote is a portable remote desktop client that manages and launches remote sessions across multiple protocols from a single unified interface. It organizes servers using a flexible tagging system and stores all configuration in structured JSON files for easy backup and transfer between machines. The application supports launching RDP, SSH, VNC, Telnet, and other remote connections, and allows users to replace default protocol handlers with custom external programs that accept command-line arguments. It includes a bulk server editor for applying uniform changes to addresses, credentials, or

SuperDllHijack：A general DLL hijack technology, don't need to manually export the same function interface of the DLL, so easy! 一种通用Dll劫持技术，不再需要手工导出Dll的函数接口了

Awesome cloud enumerator

Linux pentest tools

Another Windows Local Privilege Escalation from Service Account to System

Extracting Clear Text Passwords from mstsc.exe using API Hooking.