Alternatives and similar repositories for O365-Doppelganger

Users that are interested in O365-Doppelganger are comparing it to the libraries listed below

• pwn1sher / frostbyte

  View on GitHub
  FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads
  ☆386Apr 16, 2022Updated 3 years ago
• jfmaes / AmsiHooker

  View on GitHub
  Hookers are cooler than patches.
  ☆170Jan 21, 2022Updated 4 years ago
• Allevon412 / TeamsImplant

  View on GitHub
  ☆209Feb 24, 2022Updated 3 years ago
• puzzlepeaches / msprobe

  View on GitHub
  Finding all things on-prem Microsoft for password spraying and enumeration.
  ☆258May 17, 2022Updated 3 years ago
• hlldz / RefleXXion

  View on GitHub
  RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, …
  ☆502Jan 25, 2022Updated 4 years ago
• idnahacks / GoodHound

  View on GitHub
  Uses Sharphound, Bloodhound and Neo4j to produce an actionable list of attack paths for targeted remediation.
  ☆483Jul 9, 2024Updated last year
• cube0x0 / BofRoast

  View on GitHub
  Beacon Object Files for roasting Active Directory
  ☆235Feb 21, 2022Updated 3 years ago
• xforcered / InvisibilityCloak

  View on GitHub
  Proof-of-concept obfuscation toolkit for C# post-exploitation tools
  ☆430Jul 22, 2022Updated 3 years ago
• post-cyberlabs / Offensive_tools

  View on GitHub
  ☆412Dec 14, 2023Updated 2 years ago
• zblurx / certsync

  View on GitHub
  Dump NTDS with golden certificates and UnPAC the hash
  ☆647Mar 20, 2024Updated last year
• Dec0ne / ShadowSpray

  View on GitHub
  A tool to spray Shadow Credentials across an entire domain in hopes of abusing long forgotten GenericWrite/GenericAll DACLs over other ob…
  ☆482Oct 14, 2022Updated 3 years ago
• outflanknl / C2-Tool-Collection

  View on GitHub
  A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techni…
  ☆1,366Oct 27, 2023Updated 2 years ago
• mrd0x / EvilSelenium

  View on GitHub
  EvilSelenium is a tool that weaponizes Selenium to attack Chromium based browsers.
  ☆605Mar 19, 2022Updated 3 years ago
• preemptdev / bluffy

  View on GitHub
  Convert shellcode into different formats!
  ☆358Jan 24, 2023Updated 3 years ago
• mgeeky / AzureRT

  View on GitHub
  AzureRT - A Powershell module implementing various Azure Red Team tactics
  ☆233Jun 17, 2022Updated 3 years ago
• Octoberfest7 / XLL_Phishing

  View on GitHub
  XLL Phishing Tradecraft
  ☆438May 24, 2022Updated 3 years ago
• optiv / Ivy

  View on GitHub
  Ivy is a payload creation framework for the execution of arbitrary VBA (macro) source code directly in memory. Ivy’s loader does this by …
  ☆747Aug 18, 2023Updated 2 years ago
• rvrsh3ll / TokenTactics

  View on GitHub
  Azure JWT Token Manipulation Toolset
  ☆713Dec 6, 2024Updated last year
• Flangvik / TeamFiltration

  View on GitHub
  TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts
  ☆1,368Oct 22, 2025Updated 3 months ago
• med0x2e / NTLMRelay2Self

  View on GitHub
  An other No-Fix LPE, NTLMRelay2Self over HTTP (Webdav).
  ☆417Jan 27, 2024Updated 2 years ago
• pwn1sher / WMEye

  View on GitHub
  WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for lateral movement
  ☆369Dec 24, 2021Updated 4 years ago
• rvrsh3ll / Azure-App-Tools

  View on GitHub
  Collection of tools to use with Azure Applications
  ☆112Oct 13, 2023Updated 2 years ago
• med0x2e / vba2clr

  View on GitHub
  Running .NET from VBA
  ☆148Feb 11, 2023Updated 3 years ago
• Luct0r / KerberOPSEC

  View on GitHub
  OPSEC safe Kerberoasting in C#
  ☆198Jun 14, 2022Updated 3 years ago
• nettitude / SharpWSUS

  View on GitHub
  ☆477Nov 20, 2022Updated 3 years ago
• boku7 / azureOutlookC2

  View on GitHub
  Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for…
  ☆503May 16, 2023Updated 2 years ago
• optiv / Go365

  View on GitHub
  An Office365 User Attack Tool
  ☆645Mar 19, 2024Updated last year
• ralphte / build_a_phish

  View on GitHub
  Ansible playbook to deploy a phishing engagement in the cloud.
  ☆223May 19, 2022Updated 3 years ago
• xforcered / SQLRecon

  View on GitHub
  A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.
  ☆401Jan 10, 2025Updated last year
• Aetsu / OffensivePipeline

  View on GitHub
  OfensivePipeline allows you to download and build C# tools, applying certain modifications in order to improve their evasion for Red Team…
  ☆819Oct 27, 2023Updated 2 years ago
• nettitude / Aladdin

  View on GitHub
  ☆225Oct 22, 2023Updated 2 years ago
• Mayyhem / SharpSCCM

  View on GitHub
  A C# utility for interacting with SCCM
  ☆682Aug 20, 2025Updated 5 months ago
• RedSiege / EXCELntDonut

  View on GitHub
  Excel 4.0 (XLM) Macro Generator for injecting DLLs and EXEs into memory.
  ☆515Sep 23, 2020Updated 5 years ago
• mgeeky / msi-shenanigans

  View on GitHub
  Proof of Concept code and samples presenting emerging threat of MSI installer files.
  ☆90Dec 15, 2022Updated 3 years ago
• kyleavery / inject-assembly

  View on GitHub
  Inject .NET assemblies into an existing process
  ☆508Jan 19, 2022Updated 4 years ago
• zyn3rgy / LdapRelayScan

  View on GitHub
  Check for LDAP protections regarding the relay of NTLM authentication
  ☆532Nov 19, 2024Updated last year
• connormcgarr / LittleCorporal

  View on GitHub
  LittleCorporal: A C# Automated Maldoc Generator
  ☆229Jul 30, 2021Updated 4 years ago
• optiv / Dent

  View on GitHub
  A framework for creating COM-based bypasses utilizing vulnerabilities in Microsoft's WDAPT sensors.
  ☆297Aug 18, 2023Updated 2 years ago
• d3lb3 / KeeFarceReborn

  View on GitHub
  A standalone DLL that exports databases in cleartext once injected in the KeePass process.
  ☆302Mar 1, 2023Updated 2 years ago