Projects sharing features with Mythic

Merlin is a cross-platform command and control framework and remote access tool. It provides a server and agent system for post-exploitation coordination, utilizing an HTTP/2 framework for secure communication and the execution of commands across multiple operating systems. The project features an in-memory code execution engine that runs assemblies and shellcode directly within a process to avoid writing files to disk. It implements a decentralized communication architecture through a peer-to-peer network, allowing agents to exchange data via direct bind or reverse connections. To evade det

Empire is a post-exploitation command-and-control (C2) framework designed for red team operations. It deploys and manages agents written in PowerShell, Python, C#, Go, and C across Windows, Linux, and macOS, using encrypted communication channels over HTTP, HTTPS, and SMB. The framework executes over 400 built-in modules for reconnaissance, privilege escalation, credential theft, and lateral movement, and provides a modular engine for authoring custom attack modules. What sets Empire apart is its multi-language agent deployment system, which allows operators to choose implants that suit each

BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise. The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hij

This project is a post-exploitation framework and command and control platform designed for security research and penetration testing. It functions as a remote access tool consisting of a central command server and encrypted executable payloads that establish reverse shell connections. The system utilizes a web-based dashboard for multi-client administration, allowing for remote host monitoring and direct shell access through an in-browser terminal. It generates cross-platform, encrypted binaries that employ a multi-stage delivery chain and a key exchange mechanism to secure communications.

An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR

A post exploitation framework designed to operate covertly on heavily monitored environments

PoshC2 is a proxy aware C2 framework used to aid penetration testers with red teaming, post-exploitation and lateral movement.

Pupy is a command and control framework and post-exploitation suite used for remote administration and system management. It functions as a cross-platform tool for deploying payloads and controlling multiple remote agents through encrypted communication channels. The framework features a multi-platform payload generator that creates custom executable files using configurable network launchers. It employs a network traffic obfuscator that stacks encryption and obfuscation protocols to hide communication from observation. The system provides capabilities for in-memory code execution, remote pr

Monkey is an adversary emulation platform and breach and attack simulation tool designed to test network defenses through automated lateral movement and exploit delivery. It functions as a network security testing system that evaluates security posture by attempting to propagate through vulnerabilities and extract sensitive system credentials. The platform distinguishes itself by simulating specific real-world attacker behaviors, such as ransomware encryption, cryptojacking, and the theft of browser-stored credentials and secure shell keys. It utilizes binary hash randomization to evade antiv

EmDash is an open-source content management system built on Astro that combines a visual admin panel with a plugin-driven architecture and server-side rendering. It provides a complete content management system with structured content modeling, a rich text editor using Portable Text format, and a TypeScript API for type-safe content queries. The system supports authentication through passkeys, OAuth 2.1, and external providers, with role-based access control and fine-grained permission scopes. What distinguishes EmDash is its plugin development framework, which supports both native plugins ru

This project is a collection of management interfaces and platforms for network-connected hardware. It functions as a firmware extension platform, a network storage operating system manager, and a network routing administrator. The system enables the installation of open-source plugins and third-party add-ons to expand device capabilities. It provides a management interface for network attached storage, allowing for remote file management and peer-to-peer media streaming. Broad capabilities cover network routing configuration through policy-based routing and dynamic DNS, as well as firmware

RuneLite is an open-source game client for OldSchool RuneScape. It serves as a community-driven alternative to the official software, functioning as a modified client that allows for deep customization and feature extension. The project provides a programmable game plugin system that enables the development and injection of custom tools directly into the running game environment. This framework allows for the creation of interface enhancements and the integration of custom logic to modify client behavior. The system also includes a game cache data manager for reading and manipulating local a

Atomic Red Team is an adversary simulation tool and detection validation suite designed to emulate attacker behaviors. It functions as a security control testing framework that uses a library of portable tests to verify if security monitoring and alerting systems correctly identify specific malicious techniques. The project serves as a MITRE ATT&CK emulation framework, mapping individual test executions to a standardized industry taxonomy of adversary behaviors. This mapping allows for the validation of security controls against the MITRE ATT&CK matrix to identify gaps in detection and respon

This project is a collection of technical resources, blueprints, and guides for building resilient and stealthy red team infrastructure. It provides a comprehensive framework for designing offensive security environments that resist detection and remain operational throughout security engagements. The repository distinguishes itself through detailed playbooks for adversary simulation and hardening manuals. It covers advanced obfuscation techniques such as domain fronting, the use of platform-as-a-service redirectors, and the leveraging of third-party content sites to inherit domain reputation

Caldera is an adversary emulation platform and command and control framework designed to simulate cyber attack patterns. It functions as an automated red team tool and threat framework orchestrator, executing attack sequences based on standardized cybersecurity threat frameworks to validate security defenses and detection capabilities. The platform distinguishes itself through the dynamic compilation of customized executable payloads and the use of framework-mapped adversary modeling to structure attack techniques. It manages asynchronous agents on targeted endpoints via a central server acce

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

Ryven is a flow-based programming framework and visual scripting editor for Python. It provides a node-based graphical interface for designing and executing logic by connecting discrete functional nodes to build executable data pipelines. The system functions as an extensible visual logic tool, allowing for the development of custom Python nodes and the integration of interactive GUI widgets to expand scripting capabilities. It includes a node graph engine that supports both visual editing and headless execution, enabling scripts to run without a graphical user interface. The platform covers

Xplorer is an AI-powered desktop file manager designed for navigating local and remote filesystems. It integrates large language model capabilities to provide file analysis, document summarization, and contextual explanations directly within the navigation interface. The application distinguishes itself through a plugin-based extensibility model and specialized integrations. It features a secure shell client for managing remote servers as local directories, a version control interface for visualizing Git commit graphs and branches, and a semantic search system that locates files based on mean

Blade is a lightweight Java MVC web framework built on an embedded Netty server. It packages the entire web application into a single executable JAR that starts the server on launch, following the MVC pattern with fast request routing and minimal configuration. The framework supports plugin-based extensibility, allowing third-party modules to add features like template rendering and static asset serving. The framework distinguishes itself through lambda-style route registration, where routes are defined using lambda expressions that map HTTP methods and URL patterns directly to handler functi

EasyBangumi is an anime streaming management application for Android that aggregates content from multiple external sources into a single interface. It enables users to search for titles, manage a personal library of favorite series, and stream video content from various third-party providers. The application features a plugin-based extension system that allows for the integration of external media providers via repository links or dedicated installation files. This architecture enables the addition of new content sources and capabilities without modifying the core binary. The platform inclu

This project is a JetBrains IDE theme plugin and color scheme pack that implements a Material Design UI theme. It provides a comprehensive interface overhaul that replaces standard editor colors and icons with Material Design aesthetics. The plugin focuses on developer workspace personalization by allowing users to apply a consistent visual language to JetBrains development environments. It enables the customization of the IDE appearance through a collection of customizable palettes for code highlighting and user interface elements.

Trumbowyg is a lightweight JavaScript WYSIWYG editor used to create and format rich-text and HTML content directly within a web browser. It serves as a client-side tool for generating semantic HTML markup and authoring web content. The project features a modular, plugin-based architecture that allows for the addition of new formatting commands and toolbar buttons. It provides a configurable interface where the toolbar layout can be customized via a predefined array and labels can be translated through localization files. The editor covers a wide range of content manipulation capabilities, in

Sonar is a mobile app debugging platform and extensible toolkit that allows developers to inspect the internal state, network traffic, and system logs of mobile devices via a desktop interface. It functions as a centralized system for monitoring application behavior and troubleshooting logic and performance issues. The platform is distinguished by a plugin-based extension system that enables the development of custom debugging tools. These plugins can visualize specific application data and facilitate event exchange between a mobile device and a computer. The toolkit covers several core obse

This project is a PHP-based digital product automation platform designed for the sale and instant delivery of digital goods and software licenses. It functions as an automated storefront engine that manages inventory, flash sales, and the delivery of account keys. The platform is delivered as a dockerized e-commerce environment, packaging the application, database, and cache layers into containers for consistent deployment. It features a plugin-based architecture for integrating multiple payment gateways and a multi-level affiliate system for tracking referrals and distributing recruitment co