Offline-first, searchable arsenal for pentesting & bug bounty: payloads, a click-to-build command generator, GTFOBins, wordlists, embedded CyberChef, reverse shells, checklists & an engagement tracker.
☆186Jul 9, 2026Updated 3 months ago
Alternatives and similar repositories for Arsenal
Users that are interested in Arsenal are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A modern Python-based Red Team Operations Workbench for managing engagements, intelligence, evidence, and reporting.☆16Aug 26, 2026Updated 2 months ago
- A small Windows local-privilege-escalation (LPE) misconfiguration auditor with a terminal UI, built with C++20 and FTXUI☆23Oct 23, 2026Updated last week
- ☆16Jan 26, 2023Updated 3 years ago
- JSHawk is a powerful, context-aware JavaScript security scanner that hunts for exposed credentials, API keys, and sensitive information i…☆17Apr 13, 2026Updated 6 months ago
- High-assurance, artifact-agnostic prompt for authorized security labs, exploit-chain research, PoC validation, and evidence-led reporting…☆45Aug 1, 2026Updated 3 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- CVE-2026-42978 — Use-After-Free race condition in Windows Push Notifications (WpnService). Patch diff, root cause analysis, TOCTOU lab, S…☆28Jun 23, 2026Updated 4 months ago
- MIT license BRS-XSS is a modular Python CLI scanner for XSS vulnerabilities. Features context-aware payloads, WAF evasion, DOM analysis v…☆34Jan 12, 2026Updated 9 months ago
- GhostHound is a BloodHound OpenGraph extension that surfaces Active Directory tombstone reanimation as a first-class attack path, enumera…☆47Aug 9, 2026Updated 2 months ago
- Comprehensive, data-driven security assessment checklists across 23 platforms web, API, mobile, cloud, Active Directory, Kubernetes, LLM,…☆89Sep 16, 2026Updated last month
- Extract DPAPI CREDHIST and Masterkey hashes☆23May 28, 2026Updated 5 months ago
- Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go bin…☆34Oct 16, 2026Updated 2 weeks ago
- A shellcode loader generator with support for multiple injection techniques, built for red team engagements.☆104Jul 1, 2026Updated 3 months ago
- KHAOS is a modern C2 framework that routes agent traffic through cloud services already trusted by enterprise networks.☆250Sep 15, 2026Updated last month
- Smuggling C2 comms through links previews☆19Jun 17, 2026Updated 4 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Automatically deploying Mythic C2 in Azure using Terraform☆25Jul 3, 2026Updated 3 months ago
- A PoC Cobalt Strike UDRL written in Rust☆34Sep 12, 2026Updated last month
- Generate Caddy redirector configs from Cobalt Strike or Sliver C2 profiles.☆25Jul 11, 2026Updated 3 months ago
- Find Windows RWX Memory Regions depending on the memory space needed☆18Nov 26, 2023Updated 2 years ago
- NØW is a word-based shellcode encoding and obfuscation tool that transforms raw shellcode bytes into natural-looking English prose.☆92Jun 24, 2026Updated 4 months ago
- This PoC demonstrates a race condition in the Windows kernel leading to a double-free vulnerability, allowing local privilege escalation …☆21Nov 18, 2025Updated 11 months ago
- Code and data for our paper "Onelogon: Taking over Active Directory Accounts via Netlogon" (WOOT’26).☆129Sep 1, 2026Updated 2 months ago
- CVE-2026-48909 PoC☆24Jul 7, 2026Updated 3 months ago
- This repository contains the research tool presented at x33fcon 2026, along with the associated presentation slides. The content is made …☆66Jun 15, 2026Updated 4 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Credential and sensitive-data exposure triage for file shares☆16Aug 8, 2026Updated 2 months ago
- A stealthy and modular Windows loader designed to bypass modern EDR solutions using Module Stomping, Stack Duplication, and Advanced Slee…☆113Jul 26, 2026Updated 3 months ago
- Group3r but in Python☆64Oct 11, 2026Updated 3 weeks ago
- File hosting and scripted web delivery service extender for AdaptixC2. Host files over HTTP/HTTPS, generate one-liner payloads across 17 …☆39Aug 24, 2026Updated 2 months ago
- A Python-based backdoor and server communication tool for ethical hacking and reverse shell practice using socket programming.☆29May 21, 2025Updated last year
- Crystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants☆48Aug 20, 2026Updated 2 months ago
- Modified version of PEAS client for offensive operations☆50May 18, 2026Updated 5 months ago
- Red Team Operations Architecture Map Comprehensive Operator Reference — From Infrastructure to Impact☆37Sep 15, 2026Updated last month
- Manage Shadows Copies via the VSS API using C#, C++, Crystal or Python. Working on Windows 11☆88Jan 26, 2026Updated 9 months ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions.☆12Jul 8, 2026Updated 3 months ago
- Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advance…☆119Sep 17, 2026Updated last month
- ☆55Jul 6, 2025Updated last year
- Mythic C2 MSTeams Communication Channel☆40Sep 13, 2026Updated last month
- COM Windows Persistence Technique☆91Apr 27, 2026Updated 6 months ago
- Active Directory Vulnerability Scanner☆483Mar 3, 2026Updated 7 months ago
- Fully local vulnerability research pipeline - 14B code-specialized LLM reviews every source file exhaustively.☆173Sep 5, 2026Updated last month