Projects sharing features with Modlishka

BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise. The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hij

Phishing Campaign Toolkit

CATPHISH project - For phishing and corporate espionage. Perfect for RED TEAM.

An SSL Enabled Basic Auth Credential Harvester with a Word Document Template URL Injector

This tool has been released along with a FireEye blog post. The blog post can be found at the following link: https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html

o365-attack-toolkit allows operators to perform oauth phishing attacks.

Responder is a man-in-the-middle framework and network protocol spoofing tool designed to intercept network name queries and impersonate requested resources. It functions as a poisoner for LLMNR, NBT-NS, and MDNS, redirecting network traffic from clients to a controlled listener. The project serves as a credential capture tool that runs rogue servers for SMB, HTTP, and LDAP to collect NTLM hashes and clear text credentials. It enables the harvesting of encrypted authentication tokens and the interception of usernames and passwords sent without encryption. Its broader capabilities include int

Caddy is an extensible, modular web server platform designed for high-performance traffic management and automated security. At its core, it functions as a dynamic HTTP gateway that handles request routing, static asset delivery, and reverse proxying through a chain of configurable handler modules. The system is built on a modular architecture that allows developers to extend server functionality by registering custom components, all managed through a unified lifecycle and provisioning framework. What distinguishes Caddy is its focus on automated infrastructure and zero-downtime operations. I

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

chat2api is a web-to-API bridge and proxy that converts web-based chat sessions into a standardized API format. This allows web accounts to be used programmatically within third-party client applications. The system includes a multi-account rotator that distributes requests across a pool of authentication tokens using random or sequential polling to bypass rate limits. It also functions as a multimodal API proxy, translating base64 or URL-encoded images and files into formats compatible with web-based chat interfaces. The project manages the full lifecycle of session tokens, featuring statef

Mimikatz is a security research suite designed for auditing Windows authentication and managing system security configurations. It provides a comprehensive framework for extracting sensitive credentials, manipulating process privileges, and managing digital identity assets directly from system memory or offline memory dumps. The project distinguishes itself through advanced system-level exploitation techniques, including runtime process injection, API hooking, and the ability to bypass cryptographic export restrictions. It features a specialized toolkit for Kerberos protocol operations, allow

AllHackingTools is a security tool orchestrator and suite designed to install, update, and manage a wide array of third-party hacking and security utilities from a single command interface. It functions as a centralized hub for network analysis, open source intelligence, penetration testing, and social engineering tools. The project provides specialized frameworks for gathering open source intelligence and searching for user profiles across social platforms. It includes toolkits for network reconnaissance, vulnerability scanning, and the execution of security exploits, as well as a social eng

Seeker is a social engineering location tool and browser geolocation capture system. It provides a framework for capturing precise GPS coordinates and device metadata by hosting deceptive webpages that prompt users for location permissions. The project includes an HTML phishing template engine for deploying custom or predefined website clones designed to trick users into granting sensitive permissions. It further utilizes a device fingerprinting tool to collect hardware specifications, operating system details, and screen resolution from visiting clients. The system incorporates network reco

This project is a curated collection of frameworks, libraries, and toolsets designed for social engineering and public data gathering. It aggregates specialized software and educational materials used to perform human-centric attacks during professional security engagements. The directory provides resources for gathering and visualizing open source intelligence to identify sensitive information leaks. It also includes a collection of methods and software for executing phishing campaigns to harvest credentials and session cookies. The repository further covers educational materials focused on

Laravel Boilerplate is a pre-built admin panel and application scaffolding for Laravel that provides a complete backend foundation including user management, role-based permissions, and a CoreUI interface. It serves as a starting point for web application development by bundling essential administrative features into a single, ready-to-use package. The project distinguishes itself through a comprehensive identity management system that combines multi-language support across over 20 locales with two-factor authentication and user impersonation capabilities. Its role-based access control system

Uncloud is a decentralized container orchestrator designed to deploy and manage applications across multiple servers without a central control plane. It functions as a peer-to-peer system and a Docker Compose cluster deployer, using SSH-based infrastructure management to coordinate operations across remote nodes. The project distinguishes itself by using a secure mesh network overlay to enable direct inter-container communication across different physical machines. It facilitates container image distribution by transferring missing layers directly from local environments to target nodes, bypa

DDEV is a container-based local development environment and project manager designed to bootstrap consistent web development stacks. It orchestrates Docker containers to provide isolated Linux environments, integrating web servers, databases, and language runtimes. The project distinguishes itself by automating the complexities of local networking and security, featuring a local HTTPS proxy for SSL certificate automation and wildcard DNS for hostname management. It further enables collaboration by exposing local environments to the internet through tunneling for external project sharing. The

This is a pre-built Laravel application scaffolding that provides a ready-to-use administration interface with user, role, and permission management out of the box. It serves as a foundation for building backend applications, offering an authorization system that assigns and restricts user actions through roles and permissions using a dedicated package. The boilerplate includes a multilingual interface with over 20 built-in language translations and timezone-aware date display for global audiences. It also provides a two-factor authentication implementation that adds an extra security layer d

Generate Gmail Emailing Keyloggers to Windows.

The OAuth Device Authorization flow is documented via: Device Authorization Flow via Auth0 v2 OAuth2 Device Code via Microsoft

Wifiphisher is a Python wireless attack framework and rogue access point toolkit designed for wireless network interception and the deployment of phishing gateways. It functions as a wireless deauthentication tool and a phishing system that serves deceptive web pages to capture user credentials. The framework is distinguished by a modular attack scenario system that allows the integration of custom Python modules to implement specialized phishing workflows. It employs adaptive phishing interfaces that use user-agent headers and environment data to render pages that mimic specific operating sy

This project is a Docker-based Nginx reverse proxy manager designed to automate the deployment of HTTPS for web applications. It functions as a gateway that acquires and renews security certificates via Let's Encrypt and proxies incoming traffic to backend services. The system distinguishes itself by automatically discovering web services running in Docker containers to eliminate manual domain configuration. It manages security certificates through an automated process and can expose these certificates to other applications via shared volumes. The tool covers traffic management through load

Authors Joe Vest (@joevest) & Andrew Chiles (@andrewchiles)

The Social-Engineer Toolkit is a social engineering framework and penetration testing suite designed to simulate human-centric security attacks. It serves as a phishing simulation tool and credential harvesting utility to evaluate personnel awareness and organizational resilience. The toolkit provides specialized tooling for phishing campaign testing and credential theft simulation. It enables the creation of deceptive emails and landing pages to identify vulnerabilities in how users handle sensitive account information. The system includes capabilities for security awareness training and br

Generate unicode domains for IDN Homograph Attack and detect them.