一款轻量级、高性能、功能强大的内网穿透代理服务器。支持tcp、udp、socks5、http等几乎所有流量转发，可用来访问内网网站、本地支付接口调试、ssh访问、远程桌面，内网dns解析、内网socks5代理等等……，并带有功能强大的web管理端。a lightweight, high-performance, powerful intranet penetration proxy serv…

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the …

Find, verify, and analyze leaked credentials

GO Simple Tunnel - a simple tunnel written in golang

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。(An intranet comprehensive scanning tool, enabling one-click automated, all-round vulnerability scanning)

The Havoc Framework

Reconnaissance tool for GitHub organizations

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

Modlishka. Reverse Proxy.

Fetch all the URLs that the Wayback Machine knows about for a domain

An OOB interaction gathering server and client library

Pingtunnel is a tool that send TCP/UDP traffic over ICMP

EHole(棱洞)3.0 重构版-红队重点攻击系统指纹探测工具

A powerful browser crawler for web vulnerability scanners

无状态子域名爆破工具

Venom - A Multi-hop Proxy for Penetration Testers

Shikata ga nai (仕方がない) encoder ported into go with several improvements

边界打点后的自动化渗透工具

Ladon for Kali 全平台开源内网渗透扫描器,Windows/Linux/Mac/路由器内网渗透，使用它可轻松一键批量探测C段、B段、A段存活主机、高危漏洞检测MS17010、SmbGhost，远程执行SSH/Winrm，密码爆破SMB/SSH/FTP/Mysql/Mssql/Oracle/Winrm/HttpBasic/Redis，端口扫描服务识别PortScan指纹识别/Htt…

ServerScan一款使用Golang开发的高并发网络扫描、服务探测工具。

强大的内网渗透辅助工具集-让Yasso像风一样 支持rdp，ssh，redis，postgres，mongodb，mssql，mysql，winrm等服务爆破，快速的端口扫描，强大的web指纹识别，各种内置服务的一键利用（包括ssh完全交互式登陆，mssql提权，redis一键利用，mysql数据库查询，winrm横向利用，多种服务利用支持socks5代理执行）

傻瓜式漏洞PoC测试框架

x-crack - Weak password scanner, Support: FTP/SSH/SNMP/MSSQL/MYSQL/PostGreSQL/REDIS/ElasticSearch/MONGODB

A repository of Windows Shellcode runners and supporting utilities. The applications load and execute Shellcode using various API calls or techniques.

A toolkit to attack Office365

一款跨平台小巧的端口爆破工具，支持爆破FTP/SSH/SMB/MSSQL/MYSQL/POSTGRESQL/MONGOD / A cross-platform compact port blasting tool that supports blasting FTP/SSH/SMB/MSSQL/MYSQL/POSTGRESQL/MONGOD

An SSL Enabled Basic Auth Credential Harvester with a Word Document Template URL Injector

FOFAX是一个基于fofa.info的API命令行查询工具

An exquisite dns&http log server for verify SSRF/XXE/RFI/RCE vulnerability