Native Tailscale (and Headscale) on ESP32 as an ESPHome external component: the device joins your tailnet as a real node with its own 100.x address - WireGuard, DERP, DISCO, works without PSRAM on …

Open firmware for the Echo Show 5, 1st and 2nd gen: Alpine Linux instead of Android, no Alexa. A local Home Assistant voice satellite with its own touch screen, on-device wake word, SSH and A/B ove…

Interactive Active Directory shell and attack toolkit over LDAP(S) or ADWS (SOAP) written in Rust. 🦀

A raw dump of my Apple MacOS research. Some likely can be ported over to other Apple OSes. Alot of this should likely be patched, but I did not report many of these as they didnt meet the bar for a…

A centralized resource for previously documented WDAC bypass techniques

ASC is a super FAST and lightweight Android decompiler designed for Agents/Mobile Researchers.

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authenticat…

Wifite but USB-only & cross-platform.

Go-port of https://github.com/boydhacks/ntlmscout

Active Directory snapshots from Linux and macOS in the AD Explorer .dat format. Opens in AD Explorer, works with ADExplorerSnapshot.py and BOFHound.

Browse, search and audit AD Explorer snapshots offline in your browser: decoded attributes, LDAP filters, and reports for what BloodHound doesn't show (DNS, subnets, DFS, GPO links, LAPS, AD CS).

IoT static scanner for secrets, SBOM, CVEs and more.

IoT firmware identification and extraction

Tool to authenticate to an LDAP/S server with a certificate through Schannel written in Rust. 🦀

List of Awesome Red Team / Red Teaming Resources This list is for anyone wishing to learn about Red Teaming but do not have a starting point.

Volatility 3 ported to Rust. Same output, much faster.

Run iOS/ macOS in Qemu. Virtual iPhone 17, 16, 15, 14, 13, 12 and M5-M1 Apple Si Macs supported.

Extract PRT cookies remotely with InteractiveToken Scheduled Tasks

Passive backdoor implant that sniffs for a covert magic-packet trigger and runs tasks written in a custom 23-opcode bytecode command language.

A Tunnel which Improves your Network Quality on a High-latency Lossy Link by using Forward Error Correction, possible for All Traffics(TCP/UDP/ICMP)

A collection of BOF-PE's that allow running tailscale from memory

A X509 certificate chain cloning tool.

Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, WinVerifyTrust FinalPolic…

SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections.