Pure PowerShell port of PassTheCert tool to authenticate to an LDAP/S server with a certificate through Schannel
☆18May 22, 2026Updated 5 months ago
Alternatives and similar repositories for Invoke-PassTheCert
Users that are interested in Invoke-PassTheCert are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Pure PowerShell port of PassTheCert tool to authenticate to an LDAP/S server with a certificate through Schannel☆65Apr 13, 2025Updated last year
- ADAttributeHound is an OpenGraph extension for BloodHound that exports Active Directory custom attributes as node properties.☆24Jun 18, 2026Updated 4 months ago
- Dump TGTs remotely and convert Windows' klist binary output to ccache.☆104Aug 6, 2026Updated 2 months ago
- Steal Net-NTLMv1 hashes for logged on users without dumping LSASS☆16May 11, 2026Updated 5 months ago
- Pure-Go offensive-security primitives library: syscalls, evasion (AMSI/ETW/unhook/sleepmask), injection, PE packer, credentials, post-ex,…☆27Jul 13, 2026Updated 3 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Quick and dirty PowerShell script to abuse the overly permissive capabilities of the SYSTEM user in a child domain on the Public Key Serv…☆29Jul 25, 2023Updated 3 years ago
- DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will auto…☆15Apr 2, 2026Updated 6 months ago
- A comprehensive and hands-on workbook designed to sharpen your Active Directory penetration testing skills. Whether you're a red teamer, …☆19Feb 11, 2026Updated 8 months ago
- ☆57Nov 18, 2025Updated 11 months ago
- Python3 implementation of ADRecon with support for NTLM and Kerberos authentication querying LDAP. Generates individual CSV files and a s…☆68Jul 10, 2026Updated 3 months ago
- C2 Framework - Advanced Red Team Tool☆22Jun 1, 2026Updated 4 months ago
- A simple script to elevate current session to SYSTEM (needs to be run as Administrator)☆16Nov 11, 2024Updated last year
- ExchangeHound is a defensive BloodHound OpenGraph collector for on-prem Microsoft Exchange that maps mailbox delegation and Exchange priv…☆77Apr 17, 2026Updated 6 months ago
- ☆78Jun 17, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- The Kerberoasting / AD password-audit wordlist I use on engagements: priority-merged HashMob large list + The-Viper-One's kerberoast_pws,…☆16Oct 2, 2026Updated 3 weeks ago
- Evasive loader for .NET Framework assemblies☆53May 14, 2026Updated 5 months ago
- An implementation of PyADRecon using ADWS instead of LDAP. Generates individual CSV files and a single XSLX + HTML report about your AD d…☆54Jul 10, 2026Updated 3 months ago
- **(WIP)** Overthrone - The First All-Rust Active Directory exploitation framework. A single static binary that takes you from network acc…☆31Oct 23, 2026Updated last week
- A Ligolo-ng JavaScript agent working inside Chrome & Chromium-based browsers by leveraging Isolated Web Applications.☆139Mar 30, 2026Updated 6 months ago
- ☆15May 28, 2026Updated 5 months ago
- PowerShell implementation for AD CS☆163Jul 30, 2026Updated 3 months ago
- SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections.☆41Aug 3, 2026Updated 2 months ago
- This is an advanced ASMI bypass that is currently undetected by Windows Defender and all the Antivirus software's on virustotal.☆28Jun 10, 2025Updated last year
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Just a nice little shellcode loader using unconventional methods to avoid using signatured APIs☆30Jul 11, 2025Updated last year
- One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output.☆68Sep 17, 2026Updated last month
- Better version of SharpPick☆13Aug 29, 2025Updated last year
- Python tool to automatically perform SPN-less RBCD attacks.☆132Jan 7, 2026Updated 9 months ago
- Six Degrees of System Administrator☆26Jun 4, 2026Updated 4 months ago
- Burp Suite MCP Assistant in IDE Extension☆15Dec 31, 2025Updated 9 months ago
- Kerberos CNAME abuse PoC☆109Jan 27, 2026Updated 9 months ago
- A Python POC for CRED1 over SOCKS5☆171Oct 5, 2024Updated 2 years ago
- Modified BloodHound.py CE ingestor for red team use. Obfuscates LDAP through ldapx, paces LDAP searches and host RPC, and resumes a stopp…☆91Oct 10, 2026Updated 2 weeks ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- ☆25Sep 6, 2025Updated last year
- GetSystem-LCI is a PowerShell script to escalate privileges from Administrator to NT AUTHORITY\SYSTEM by abusing LanguageComponentsInstal…☆35Nov 24, 2024Updated last year
- List accounts with Service Principal Names (SPN) not linked to active dns records in an Active Directory Domain.☆47Oct 5, 2026Updated 3 weeks ago
- Python collector for adding SCCM attack paths to BloodHound with OpenGraph☆157Updated this week
- Fast-track Azure offensive security toolkit designed for CARTP certification and CTF competitions. Automated enumeration, credential extr…☆28Dec 5, 2025Updated 10 months ago
- NetExec MCP☆89Oct 18, 2026Updated last week
- Secrets Find0r is a multithreaded SMB share crawler that hunts for exposed credentials and secrets across Windows networks. It enumerates…☆71May 6, 2026Updated 5 months ago