k8gege/Ladon

Features

• Command and Control Plugin Integrations - Provides a specialized plugin for Cobalt Strike beacons to enable memory-resident network discovery and vulnerability detection.
• Command Beacon Integrations - Runs network discovery and vulnerability detection as a memory-resident plugin within a command beacon framework.
• Credential and Account Auditing - Tests for weak passwords across network services and extracts stored credentials from compromised hosts.
• Fileless Execution - Loads execution modules directly into memory to avoid leaving forensic artifacts on the physical disk.
• Lateral Movement - Provides capabilities to pivot between internal network systems using compromised credentials and remote execution.
• Active Vulnerability Scanning - Performs intrusive network probing to identify high-severity security flaws in middleware and hardware.
• Internal Network Penetration Testers - Scans internal network segments to discover live hosts, open services, and critical security vulnerabilities.
• Service Fingerprinting - Identifies running software and operating systems by analyzing network response banners and headers.
• Network Asset Discovery - Maps target environments by identifying hardware, middleware, and OS versions across multiple protocols.
• Network Asset Scanning - Identifies active hosts and open services using multiple protocols to bypass firewall restrictions.
• C2 Beacon Plugins - Acts as an extension for Cobalt Strike beacons to enable memory-loaded network scanning and vulnerability detection.
• Multi-Protocol Network Discovery - Identifies active hosts and services using diverse network protocols to bypass firewall restrictions.
• Operating System Detection - Analyzes network responses to determine the target operating system and version.
• Memory-Loaded Scanners - Executes scanning engines and modules in memory to avoid leaving disk footprints on target systems.
• C2 Framework Plugins - Integrates directly as a memory-resident plugin for command beacons within the Cobalt Strike framework.
• Credential Extraction - Implements techniques for retrieving stored passwords and authentication tokens from the local system.
• Privilege Escalation Techniques - Elevates process permissions to system level using a variety of exploit techniques.
• In-Memory Payload Execution - Executes scanning engines and modules directly in volatile memory to avoid leaving disk-based footprints.
• Network Vulnerability Scanning - Discovers network assets and identifies critical security weaknesses across internal network infrastructure.
• Post-Exploitation Frameworks - Provides a script-based framework for auditing credentials and escalating privileges on Windows systems.
• Windows Privilege Escalations - Escalates permissions from standard user to administrator using Windows-specific exploits and bypass techniques.
• Vulnerability Assessment Tools - Detects middleware flaws and executes exploits to achieve remote code execution.
• Service Fingerprinting - Detects specific software versions and hardware devices to determine the target technology stack.
• In-Memory Loading - Executes scanning engines and payloads directly from memory to avoid leaving a disk footprint.
• Proxy-Aware Routing - Directs network scanning traffic through intermediate proxies to enable pivoting and lateral movement.
• Script Obfuscation - Applies encoding and binary conversion to scripts to hide logic and bypass security software.
• Default Credential Auditing - Actively verifies network interfaces against databases of weak or default credentials.
• Domain Penetration - Executes Kerberos attacks and privilege escalation to compromise directory environments.
• Exploit Payload Deployments - Triggers specific vulnerability proofs of concept to achieve remote code execution or gain initial shells.
• Exploit Payload Generators - Creates customized payloads to extend scanning capabilities and automate the process of obtaining remote shells.
• Automated Kerberos Attacks - Automates Kerberos attacks including ticket requests and the creation of forged tickets.
• Payload Obfuscators - Transforms executables and scripts into different formats to evade antivirus and EDR detection.
• Reflective Memory Executions - Loads and executes binaries entirely in memory via reflective techniques to evade disk-based detection.
• Remote Command Execution Tools - Runs commands on target systems via remote protocols in both interactive and non-interactive modes.
• Remote System Exploitation - Deploys shells or executes commands on target systems to gain full system control.
• Reverse Shells - Establishes outbound network connections from targets to listeners to provide remote command-line access.
• EDR Evasion - Simulates human-like access patterns to circumvent endpoint detection and response security controls.
• Credential Brute-Forcing - Provides an automated engine for testing usernames and passwords against network protocols to evaluate security.
• Extensible Plugin Architectures - Loads external logic through assemblies or scripts to add custom proofs of concept and scanning modules.
• Plugin-Based Architectures - Implements a plugin-based architecture that allows the dynamic loading of external assemblies and scripts at runtime.
• Network Scanning - Multi-threaded, plugin-based network scanning and exploitation suite.
• Offensive Security Tools - Large-scale network scanner for internal penetration testing.
• Post Exploitation Frameworks - Large-scale network scanning and exploitation framework.

Star history