Awesome GitHub RepositoriesOffensive Security

This project is a comprehensive, community-sourced knowledge base designed for security professionals and researchers. It functions as a centralized repository of offensive security techniques, providing a structured collection of exploit payloads, attack vectors, and methodologies for conducting vulnerability assessments and penetration testing. The repository distinguishes itself through a cross-platform payload taxonomy that categorizes exploitation methods by vulnerability type and target environment, enabling rapid lookup during security assessments. It maintains high standards of data i

The Social-Engineer Toolkit is a social engineering framework and penetration testing suite designed to simulate human-centric security attacks. It serves as a phishing simulation tool and credential harvesting utility to evaluate personnel awareness and organizational resilience. The toolkit provides specialized tooling for phishing campaign testing and credential theft simulation. It enables the creation of deceptive emails and landing pages to identify vulnerabilities in how users handle sensitive account information. The system includes capabilities for security awareness training and br

XSStrike is an automated security scanning engine designed for web application discovery, input

BeEF is a modular security testing environment designed for browser exploitation and web application auditing. It functions as a platform for security professionals to evaluate client-side defenses by injecting persistent scripts into web browsers, establishing a bidirectional communication channel for remote command execution and data exfiltration. The framework distinguishes itself through its ability to use compromised browser sessions as proxies to conduct internal network reconnaissance, effectively bypassing perimeter security controls. It utilizes an event-driven control interface and

ExploitDB is a curated archive of exploit code and vulnerability data designed for penetration testing and security research. It serves as an offensive security knowledge base and a repository of publicly available proof-of-concept code used to validate software flaws. The project provides a searchable collection of historical and current exploit vectors. It supports security threat intelligence by tracking public releases and aids in vulnerability research by providing a reference library for analyzing how specific systems can be compromised. The archive is managed through a curated input p

Empire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and manages agents written in PowerShell, Python, C#, Go, and C across Windows, Linux, and macOS, using encrypted communication channels over HTTP, HTTPS, and SMB. The framework executes over 400 built-in modules for reconnaissance, privilege escalation, credential theft, and lateral movement, and provides a modular engine for authoring custom attack modules. What sets Empire apart is its multi-language agent deployment system, which allows operators to choose implants that suit each

Covenant, रेड टीम ऑपरेशंस और एडवर्सरी सिमुलेशन के लिए डिज़ाइन किया गया एक .NET-आधारित कमांड एंड कंट्रोल फ्रेमवर्क है। यह सुरक्षा असेसमेंट के समन्वय, रिमोट इम्प्लांट्स को मैनेज करने, और एक सेंट्रलाइज्ड सर्वर के माध्यम से समझौता किए गए सिस्टम पर कार्यों को निष्पादित करने के लिए एक सहयोगी प्लेटफॉर्म के रूप में कार्य करता है। यह प्रोजेक्ट अपने डायनामिक पेलोड जनरेटर द्वारा प्रतिष्ठित है, जो डिटेक्शन को बायपास करने के लिए एग्जीक्यूटेबल बाइनरीज और स्क्रिप्ट्स को ऑन-द-फ्लाई कंपाइल और ऑबफस्केट (obfuscate) करता है। यह एक सहयोगी वातावरण के माध्यम से खुद को अलग करता है जो कई प्रमाणित ऑपरेटरों को एक सिंक्रोनाइज़्ड स्टेट साझा करने, परिचालन संकेतकों को ट्रैक करने, और एक ही इंटरफेस के भीतर संयुक्त जुड़ाव को मैनेज करने की अनुमति देता है। यह फ्रेमवर्क ट्रैफिक ऑबफस्केशन के लिए व्यापक क्षमताएं प्रदान करता है, जिसमें कस्टम नेटवर्क प्रोफाइल्स, डेटा ट्रांसफॉर्मेशन पाइपलाइन्स, और संचार को मास्क करने के लिए ब्रिज-आधारित प्रोटोकॉल ट्रांसलेशन का उपयोग शामिल है। यह रिमोट फाइल रिट्रीवल, सेंट्रलाइज्ड क्रेडेंशियल कलेक्शन, और प्लग-इन एक्सटेंशन मॉडल का उपयोग करके कस्टम रिमोट टास्क मॉड्यूल्स के विकास जैसी पोस्ट-एक्सप्लॉइटेशन आवश्यकताओं को भी कवर करता है। यह सिस्टम फॉरवर्ड सीक्रेसी सुनिश्चित करने के लिए SSL सर्टिफिकेट पिनिंग और एन्क्रिप्टेड की-एक्सचेंज का उपयोग करके सर्वर और एजेंट्स के बीच संचार को सुरक्षित करता है।

Phishing Campaign Toolkit

XSS'OR - Hack with JavaScript.

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

This project is a centralized repository and research database dedicated to the collection of technical documentation and source code concerning offensive security, malware development, and system exploitation. It serves as an archive for security professionals and researchers to study threat actor methodologies and historical security research. The repository functions as a static, version-controlled archive that organizes research papers and code samples into a flat-file directory structure. This approach ensures long-term availability and offline access to the materials, while a decentrali

ebpfkit is a rootkit powered by eBPF

A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29

JShell - Get a JavaScript shell with XSS.

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

A curated list of resources (books, tutorials, courses, tools and vulnerable applications) for learning about Exploit Development