How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
A post exploitation framework designed to operate covertly on heavily monitored environments
The main features of bats3c/shad0w are: Command and Control, Command And Control Frameworks, Post Exploitation Frameworks.
Open-source alternatives to bats3c/shad0w include: byt3bl33d3r/silenttrinity — An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR. ne0nd0g/merlin — Merlin is a cross-platform command and control framework and remote access tool. It provides a server and agent system… bishopfox/sliver — Sliver is a command and control framework designed for adversary emulation and security assessment operations. It… n1nj4sec/pupy — Pupy is a command and control framework and post-exploitation suite used for remote administration and system… bc-security/empire — Empire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and… nettitude/poshc2 — PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral…
An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
Sliver is a command and control framework designed for adversary emulation and security assessment operations. It provides a centralized platform for managing remote systems, enabling security professionals to coordinate multi-operator sessions and maintain persistent, secure communication channels across diverse network environments. The framework distinguishes itself through its focus on stealth and infrastructure flexibility. It utilizes dynamic payload obfuscation to generate unique binaries and supports in-memory execution to minimize disk artifacts. Communication is secured through mutu
Empire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and manages agents written in PowerShell, Python, C#, Go, and C across Windows, Linux, and macOS, using encrypted communication channels over HTTP, HTTPS, and SMB. The framework executes over 400 built-in modules for reconnaissance, privilege escalation, credential theft, and lateral movement, and provides a modular engine for authoring custom attack modules. What sets Empire apart is its multi-language agent deployment system, which allows operators to choose implants that suit each
Pupy is a command and control framework and post-exploitation suite used for remote administration and system management. It functions as a cross-platform tool for deploying payloads and controlling multiple remote agents through encrypted communication channels. The framework features a multi-platform payload generator that creates custom executable files using configurable network launchers. It employs a network traffic obfuscator that stacks encryption and obfuscation protocols to hide communication from observation. The system provides capabilities for in-memory code execution, remote pr