Open-source alternatives to Checklists

BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise. The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hij

Mindmap is a cybersecurity knowledge base and reference library that organizes security tools, frameworks, and methodologies into a visual knowledge map. It functions as a curated directory of cheat sheets and command guides for offensive and defensive security operations, presented as a hierarchical interface with collapsible nodes. The project converts structured markdown files into navigable visual trees to facilitate the study of penetration testing workflows and DevOps learning roadmaps. It also serves as a security compliance framework, providing structured mappings of NIST and ISO 2700

This project is a collection of common Unix utilities compiled as statically linked binaries. It provides a portable Nix toolset and a bundle of POSIX utilities designed to run across different Linux distributions without requiring shared library dependencies. The collection focuses on cross-distribution compatibility and minimal environment setup. By utilizing a musl-based toolchain and static-link compilation, these utilities are distributed as standalone files that execute immediately without the need for a package manager or external system packages. The project covers a range of portabl

BeRoot(s) is a post exploitation tool to check common Windows misconfigurations to find a way to escalate our privilege. \ A compiled version is available here.

Another Windows Local Privilege Escalation from Service Account to System

The goal of this repository is to document the most common techniques to bypass AppLocker.

:palm_tree:Linux、macOS、Windows Kernel privilege escalation vulnerability collection, with compilation environment, demo GIF map, vulnerability details, executable file (提权漏洞合集)

Windows exploits, mostly precompiled. Not being updated. Check https://github.com/SecWiki/windows-kernel-exploits instead.

Search Exploitable Software on Linux

Windows Privilege Escalation from User to Domain Admin.

Tools & Interesting Things for RedTeam Ops

This project is a set of specialized utilities for Windows vulnerability assessment and patch management auditing. It functions as a vulnerability scanner and exploit suggester that analyzes installed updates to identify missing security patches and their corresponding known vulnerabilities. The system distinguishes itself by matching missing updates against a consolidated vulnerability database to recommend specific publicly available exploits. It maintains accuracy by synchronizing remote security bulletins into a local database and cross-referencing identified gaps against official update

articles

PEASS-ng is a Linux privilege escalation scanner and post-exploitation enumeration tool. It identifies security vulnerabilities and misconfigurations on Linux systems that could lead to unauthorized elevated access. The tool functions as a security audit utility that discovers system weaknesses and sensitive information after initial access is gained. It scans operating systems to identify specific privilege escalation paths. Findings are converted into structured security audit reports. The tool supports exporting scan results into JSON, HTML, and PDF formats for formal analysis and documen

This project is a post-exploitation framework and privilege escalation script suite designed to scan local system configurations for security gaps. It serves as a system enumeration toolset used to identify paths for gaining higher administrative privileges on a target host. The suite incorporates capabilities for security penetration testing and vulnerability assessment reporting. It uses shell-based system enumeration and pattern-based vulnerability matching to detect misconfigurations, while employing heuristic-based permission analysis to evaluate system flags. Findings are gathered thro

This project is a comprehensive, community-curated directory of cybersecurity resources, tools, and educational materials. It functions as a centralized index for researchers and students to discover frameworks and utilities across the entire security lifecycle, ranging from initial vulnerability assessment to post-exploitation analysis. The repository distinguishes itself through a hierarchical taxonomy that organizes diverse security disciplines into a searchable, version-controlled knowledge base. Rather than hosting software directly, it utilizes a decentralized aggregation model that lin

`` SweetPotato by @EthicalChaos Orignal RottenPotato code and exploit by @foxglovesec Weaponized JuciyPotato by @decoder_it and @Guitro along with BITS WinRM discovery PrintSpoofer discovery and original exploit by @itm4n EfsRpc built on EfsPotato by @zcgonvh and PetitPotam by @topotam -c,…

Lynis is an automated security auditing and system hardening framework designed for UNIX-based operating systems. It functions as a command-line utility that inspects local system configurations to identify security vulnerabilities, configuration weaknesses, and compliance gaps. By executing a series of modular tests, the tool generates actionable reports and remediation suggestions to assist in strengthening system defenses. The project distinguishes itself through a highly modular architecture that relies on shell-script-based execution and native system inspection. Users can define custom