RTT | Red Team Tools and Techniques

Resource Development

68 items

AD Enumeration

1

bloodhound-cli

C2 Framework

16

AzureC2Relay

C2concealer

c2profiler

Cobalt Strike

convoC2

demon

iodine

Lodestar Forge

Meterpreter

Mythic

Nighthawk

PowerShell Empire

Sandman

SilentTrinity

Sliver

Terraform

Credential Abuse

1

Ssh-Keygen

Credential Harvester

1

hostapd

Data Staging

2

http.server

smbserver

Domain Infrastructure

1

dnsmasq

Google Cloud

1

Google Cloud CLI (gcloud)

In-Memory Execution

3

donut

DotNetToJScript

Nimcrypt2

Local Host Enumeration

4

https-listen

ntpdate

Python

rdate

LOLBin Abuse

1

msedge.exe

Network Scanner

1

wget

Obfuscation

1

Antiscan.me

OSINT

1

Chameleon

Password Sprayer

1

apimspray

Payload Generator

14

Aut2Exe.exe

bitpixie-build.sh

Demiguise

duck2spark

DuckEncoder

jar

lnk2pwn

Macrome

MacroPack

msfvenom

SharpShooter

upx

VBad

ysoserial

Phishing Framework

7

espoofer

EvilGophish

Gophish

Man-in-the-middle proxy

mip22

Modlishka

TokenFlare

Port Redirection & Proxy

7

certbot

cs2modrewrite

cs2webconfig

Netlify

openvpn

Proxifier

Squid Proxy

Reverse Proxy

5

Apache

nginx

NGINX Reverse Proxy

Node.js with http-proxy

Reverse proxy

Initial Access

52 items

Access Card Cloning

3

Chameleon Ultra

iCopy-X

Proxmark3

Azure Cloud

2

ROADtune

TeamFiltration

Build-System Compromise

1

Visual Studio

C2 Framework

4

Cobalt Strike

Metasploit

Meterpreter

Nighthawk

Credential Harvester

1

hostapd

Hardware Implant

6

BLEKey

Digispark

Eavesdropping device

Hardware implant

Hardware Keylogger

Rogue network bridge device

In-Memory Execution

1

GadgetToJScript

LOLBin Abuse

5

Bash

Bitsadmin

LOLBins

mshta.exe

Windows Script Host (WSH)

Macro Execution

6

Excel VBA

Microsoft Excel

Microsoft Word

Microsoft Word VBA Macro Execution

VBA macro

winword

NAC Bypass

1

SilentBridge

Network Scanner

1

wget

NTLM/Kerberos Relaying

1

SendMail

Password Sprayer

1

MFASweep

Payload Generator

2

duck2spark

SharpShooter

Phishing Framework

10

espoofer

EvilGinx

GitHub Pages

Gophish

Man-in-the-middle proxy

mip22

Modlishka

NexPhisher

TeamsPhisher

TokenFlare

Remote Access Tool

2

FortiClient

TeamViewer

SCCM/WSUS Abuse

1

SCCMSecrets

Social Engineering

1

Microsoft Teams

Web Exploitation

3

sqlmap

vSphere

Web Upload Service

Reconnaissance

127 items

AD Enumeration

3

enum4linux

ldapsearch

rpcclient

AWS Cloud

2

aws

boto3

Azure Cloud

6

AADInternals

AADOutsider-py

az

GraphAPI

onedrive enum

TeamFiltration

C2 Framework

1

Cobalt Strike

Cloud Data Collection

4

GraphRunner

Private GitHub

s3scanner

SharePoint

Credential Harvester

3

airodump-ng

Responder

trufflehog

Data Staging

1

openssl

Database Client Abuse

1

SQL Server

File Share Enumeration

1

showmount

Firmware Analysis

1

binwalk

Google Cloud

2

google

Google Cloud CLI (gcloud)

Hardware Key Extraction

1

DSLogic U3Pro16

Local Host Enumeration

6

dhcpcd

dumpbin

Kali Linux

ps

searchsploit

unsquashfs

LOLBin Abuse

2

assoc

Text Editor

Network Protocol Analyzer

2

tcpdump

Wireshark

NTLM/Kerberos Relaying

3

Coercer

LdapRelayScan.py

RelayKing

Obfuscation

1

PS>Attack

Password Cracking

1

Aircrack-ng

Password Sprayer

2

apimspray

TREVORspray

Phishing Framework

1

Phishious

Port Redirection & Proxy

1

nc

Remote Execution

2

CrackMapExec

p0wnedShell

SCCM/WSUS Abuse

1

MisconfigurationManager.ps1

Social Engineering

1

Social Networking Sites

Web Exploitation

2

Nextcloud

vSphere

Host Enumeration

135 items

AD Enumeration

6

bloodhound-python

ConfigManBearPig

GPRegistryPolicyParser

nxc

rpcclient

SharpView

AWS Cloud

1

aws

C2 Framework

4

Cobalt Strike

demon

Meterpreter

Nighthawk

Credential Dumping

1

SharpChromium

Credential Harvester

2

airodump-ng

GitLab

Database Client Abuse

4

HeidiSQL

neo4j-admin

Oracle Database

sqlcmd

File Share Enumeration

7

impacket-smbclient

MANSPIDER

Samba

SauronEye

SMB

smbmap

Snaffler

In-Memory Execution

1

Groovy

LOLBin Abuse

15

Add-Type

Bitsadmin

icacls

Microsoft Management Console (MMC)

net.exe

node.exe

PowerShell

reg.exe

regedit.exe

sc.exe

Tasklist

vssadmin.exe

Windows Subsystem for Linux (WSL)

WMI

wmic

Network Scanner

16

Advanced IP Scanner

arp-scan

GetWebDAVStatus

impacket-rpcmap

masscan

naabu

netdiscover

Network scanner

NMAP

OpenTest Asset Manager

ping

PsPing

rdp-sec-check

SNMP tool

VMware ESXi

webclientservicescanner

Port Redirection & Proxy

1

nc

Process Injector

1

Frida

Remote Execution

3

p0wnedShell

services.py

the-one-wsl-bof

SCCM/WSUS Abuse

3

MalSCCM

MisconfigurationManager.ps1

SCCMHunter

Scheduled Task Abuse

1

Windows Task Scheduler

Persistence

59 items

Account Manipulation

3

addcomputer

AddMachineAccount

Whisker

AD ACL Abuse

4

dsacls

pywhisker

SharpGPOAbuse

Sharpmad

AD Certificate Abuse

4

Certipy

certreq

ForgeCert

passthecert

AD Enumeration

3

Active Directory PowerShell module

dsconf (Red Hat Directory Server)

Powermad

Azure Cloud

1

az

Backdoor

3

Add-RemoteRegBackdoor

DAMP

SharPersist

Build-System Compromise

1

Jenkins

C2 Framework

5

Cobalt Strike

CobaltWhispers

demon

Nighthawk

Sandman

Cloud Data Collection

1

GraphRunner

Credential Harvester

2

Docker Compose

KeeThief

In-Memory Execution

1

GadgetToJScript

Local Host Enumeration

1

cygrunsrv

LOLBin Abuse

12

assoc

Dllhost.Exe

explorer.exe

net.exe

Notepad++

reg.exe

regedit.exe

Registry (Windows Registry tooling)

Registry Editor (regedit)

sc.exe

sdbinst

Windows Script Host (WSH)

Macro Execution

1

Microsoft Word

NTLM/Kerberos Relaying

1

Impacket rbcd

Obfuscation

2

PS>Attack

SharpHide.exe

Port Redirection & Proxy

1

PortBender

Remote Access Tool

3

Cobalt Strike TCP Beacon

TeamViewer

TeamViewer_Host_Setup

Remote Execution

5

ansible-playbook

Phantom

PsExec

ruler

ssh-host-config

SCCM/WSUS Abuse

1

SCCMHunter

Scheduled Task Abuse

3

Schtasks.Exe

Task Scheduler

Windows Task Scheduler

Web Exploitation

1

Apache Tomcat Manager

Privilege Escalation

73 items

Account Manipulation

2

addcomputer

ResetNightmare

AD ACL Abuse

1

SharpGPOAbuse

AD Certificate Abuse

1

certsync

AD Enumeration

1

rpcclient

Azure Cloud

1

az

C2 Framework

4

Cobalt Strike

Cobalt Strike Beacon

Metasploit

Meterpreter

Credential Abuse

1

mimikatz

Credential Dumping

1

SharpDPAPI

Database Client Abuse

1

PowerUpSQL

Kerberos Delegation Abuse

1

rbcd

Local Host Enumeration

6

kubectl

LinPEAS

MSI Installer

PowerUp

PrivescCheck

PrivKit

LOLBin Abuse

11

assoc

Dllhost.Exe

docker

icacls

less

msiexec

net.exe

Registry Editor (regedit)

runas

sc.exe

sdbinst

NTLM/Kerberos Relaying

5

DavRelayUp

KrbRelayUp

ntlmrelayx

Potato

Tater

Obfuscation

2

EDRSandblast

PS>Attack

Process Injector

1

Invoke-ReflectivePEInjection

Remote Execution

5

atexec.py

Gardener

p0wnedShell

PsExec

SharpNightmare

SCCM/WSUS Abuse

9

MisconfigurationManager.ps1

SCCM

sccm-http-looter

sccmhound

SCCMHunter

wsuks

Wsuspect

WSuspicious

wsuxploit

Scheduled Task Abuse

3

Schtasks.Exe

Task Scheduler

Windows Task Scheduler

Ticket Manipulation

3

KerberosAsk

noPac

pykek

Token Impersonation

6

getsystem

Incognito

JuicyPotato

PrintSpoofer

RoguePotato

SweetPotato

UAC Bypass

8

akag0th

bypassuac

CreateSymlink

elevate

eventvwr

fodhelper

RottenPotatoNG

SharpUp

Domain Enumeration

94 items

Account Manipulation

1

Whisker

AD ACL Abuse

2

Get-BadSuccessorOUPermissions.ps1

OpenLDAP

AD Certificate Abuse

2

Certify

Certipy

Azure Cloud

5

azurehound.exe

Entra ID

GraphAPI

Pytune

roadrecon

Cloud Data Collection

2

GraphRunner

PowerCLI

Credential Abuse

3

GetUserSPNs.py

GoldenGMSA

Local Administrator Password Solution (LAPS)

Credential Dumping

1

Get-GPPPassword

Credential Harvester

7

impacket-GetUserSPNs

Kerberoasting Tools

LAPS

MailSniper

ntdsxtract

SessionGopher

Timeroast

Database Client Abuse

1

PowerUpSQL

Exfiltration Channel

1

gsutil

File Share Enumeration

3

FindUncommonShares.py

SharpShares.exe

Snaffler

Google Cloud

1

gcloud

LOLBin Abuse

2

Microsoft Management Console (MMC)

net.exe

NTLM/Kerberos Relaying

2

LdapRelayScan.py

RelayKing

Obfuscation

1

PS>Attack

Password Sprayer

1

kerbrute

Remote Execution

4

msfconsole

NetExec

p0wnedShell

ruler

SCCM/WSUS Abuse

4

MisconfigurationManager.ps1

PowerSCCM

SCCMHunter

SharpSCCM

Social Engineering

1

Microsoft Teams

Ticket Manipulation

1

noPac

Lateral Movement

131 items

AD ACL Abuse

1

SharpGPOAbuse

AD Certificate Abuse

1

Certipy

C2 Framework

7

Cobalt Strike

Cobalt Strike Beacon

demon

dnscat2

Metasploit

Meterpreter

Nighthawk

Credential Abuse

4

InternalAllTheThings

mimikatz

n8n

zerologon_exploit.py

Data Staging

1

Impacket smbserver

Database Client Abuse

2

mssqlclient

PowerUpSQL

Exfiltration Channel

2

PSCP

scp

File Share Enumeration

3

impacket-smbclient

mount.cifs

smbmap

In-Memory Execution

1

GadgetToJScript

Kerberos Delegation Abuse

1

Rubeus

Local Host Enumeration

2

etherwake

vconfig

LOLBin Abuse

2

WMI

wmic

Macro Execution

1

ExecuteExcel4Macro

Network Protocol Analyzer

1

Impacket

Network Scanner

1

Advanced IP Scanner

NTLM/Kerberos Relaying

6

Impacket ntlmrelayx

krbrelayx

MITM6-Kerberos-CNAME-Abuse

MultiRelay

ntlmrelayx

smbrelayx

Port Redirection & Proxy

12

Chisel

nc

Netcat

Network Pivoting Tools

openvpn

PortBender

Proxychains

socat

socks

Squid Proxy

sshuttle

wstunnel

Remote Access Tool

12

AnyDesk

Cobalt Strike TCP Beacon

DSView

FreeRDP

PuTTY

Remote Desktop (RDP)

TeamViewer

TeamViewer_Host_Setup

VNC

vncviewer

wfica32

ZENworks Remote Management

SCCM/WSUS Abuse

12

MalSCCM

MisconfigurationManager.ps1

PowerSCCM

SCCM

sccm-http-looter

sccmhound

SCCMHunter

SCCMSecrets

SharpSCCM

SharpWSUS

System Center Configuration Manager (SCCM)

wsuxploit

Scheduled Task Abuse

1

Windows Task Scheduler

Ticket Manipulation

1

Kekeo

Credentials & User Impersonation

182 items

Access Card Cloning

2

Chameleon Ultra

Proxmark3

AD ACL Abuse

1

pywhisker

AD Certificate Abuse

4

Certify

Certipy

certreq

ForgeCert

Azure Cloud

3

az

Azure CLI

TeamFiltration

Backdoor

2

Add-RemoteRegBackdoor

DAMP

Build-System Compromise

1

Jenkins

C2 Framework

3

Cobalt Strike

demon

Terraform

Database Client Abuse

3

mssqlclient

SQL Server

SQL*Plus

Environment Variable Manipulation

1

faketime

File Share Enumeration

1

SauronEye

Google Cloud

1

google

Hardware Implant

2

BLEKey

Hardware Keylogger

Hardware Key Extraction

1

mfoc

In-Memory Execution

1

Groovy

Kerberos Delegation Abuse

3

getST.py

Rubeus

tgtdeleg

Local Host Enumeration

1

kubectl

LOLBin Abuse

2

less

runas

Network Protocol Analyzer

3

dsniff

Ettercap

Impacket

Network Scanner

1

BetterCap

NTLM/Kerberos Relaying

15

AtlasReaper

Coercer

dfcoerce

DFSCoerce

Impacket ntlmrelayx

Impacket rbcd

krbrelayx

mitm6

mitm6-cname.py

MultiRelay

ntlmrelayx

PetitPotam

printerbug

PrivExchange

smbrelayx

Obfuscation

2

EDRSandblast

PS>Attack

Password Cracking

8

Aircrack-ng

hashcat

john

John the Ripper

keepass2john

kirbi2john

ssh2john

tgsrepcrack

Password Sprayer

7

apimspray

kerbrute

MFASweep

MSOLSpray

Ncrack

SprayingToolkit

TREVORspray

Phishing Framework

6

EvilGinx

Man-in-the-middle proxy

mip22

Modlishka

NexPhisher

TokenFlare

Port Redirection & Proxy

2

PyRDP

sslstrip

Remote Access Tool

1

FortiClient

Remote Execution

4

evil-winrm

msfconsole

NetExec

p0wnedShell

SCCM/WSUS Abuse

3

SCCMHunter

SCCMSecrets

SharpSCCM

Social Engineering

1

toastnotify-bof

Ticket Manipulation

8

asktgs

Kekeo

KerberosAsk

kinit

klist

pykek

ticketConverter

ticketer

Token Impersonation

1

Incognito

Wireless Attacks

1

aireplay-ng

AD Misconfigurations

56 items

Account Manipulation

3

AddMachineAccount

ResetNightmare

Whisker

AD ACL Abuse

6

dsacls

OpenLDAP

pygpoabuse.py

pywhisker

SharpGPOAbuse

Sharpmad

AD Certificate Abuse

5

Certify

Certipy

certsync

ForgeCert

passthecert

AD Enumeration

5

bloodyAD

dsconf (Red Hat Directory Server)

PingCastle

Powermad

StandIn.exe

Credential Abuse

1

zerologon_exploit.py

Kerberos Delegation Abuse

2

rbcd

Rubeus

NTLM/Kerberos Relaying

6

DavRelayUp

Impacket rbcd

KrbRelayUp

krbrelayx

LdapRelayScan.py

ntlmrelayx

Remote Execution

1

msfconsole

Ticket Manipulation

3

Kekeo

KerberosAsk

noPac

Defense Evasion

122 items

AWS Cloud

1

AWS CLI

Backdoor

1

SystemBC

Build-System Compromise

1

Visual Studio

C2 Framework

11

C2concealer

Cobalt Strike

CobaltWhispers

CS-EXTC2-NTP

demon

DropSpawn

Havoc

Meterpreter

Nighthawk

Sliver

teamsc2

Code Signing Abuse

3

osslsigncode

signtool

SigThief

Credential Abuse

1

mimikatz

Credential Harvester

1

KeeThief

Data Staging

2

7-Zip

base64

Defense Impairment

2

CITool

KillDefender

Destructive Impact

2

LockBit

rm

In-Memory Execution

12

donut

execute-assembly

GadgetToJScript

Hollow

Inline Execution (PE)

Inline-Execute-PE

inlineExecute-Assembly

JScript

Nimcrypt2

PELoader

Shhhloader

ThreadStackSpoofer

Loader

2

CoffeeLdr

exec_dotnet

Local Host Enumeration

1

AppLocker PowerShell Module

Macro Execution

2

ExecuteExcel4Macro

Microsoft Word

NAC Bypass

2

macchanger

SilentBridge

OSINT

1

Chameleon

Payload Generator

4

Aut2Exe.exe

SysWhispers3

upx

VBad

Port Redirection & Proxy

3

divertTCPconn.exe

Proxifier

Proxychains

Process Injector

4

Frida

frida-python

Invoke-ReflectivePEInjection

sRDI

Remote Access Tool

1

Cobalt Strike TCP Beacon

Remote Execution

3

evil-winrm

p0wnedShell

the-one-wsl-bof

Reverse Proxy

3

nginx

Node.js with http-proxy

Reverse proxy

Ticket Manipulation

1

kdestroy

UAC Bypass

4

akag0th

bypassuac

eventvwr

fodhelper

Collection

93 items

AD Enumeration

1

ADExplorerSnapshot

Azure Cloud

1

GraphAPI

C2 Framework

2

Cobalt Strike

demon

Cloud Data Collection

11

Conf-thief

Confluence Cloud REST API

CS Browser

GraphRunner

Host-16.Lab.Local

Internal GitHub

KubeHound

PowerCLI

Private GitHub

SharePoint

Velero

Credential Dumping

2

DonPAPI

procdump.exe

Credential Harvester

10

arpspoof

Chrome DevTools Console

dnsspoof

HashiCorp Vault

Inveigh

InveighZero

Jira

KeeThief

Responder

SMB service (attacker-controlled)

Data Staging

11

7-Zip

base64

Compress-Archive

cp

gzip

http.server

jq

openssl

rar

Total Commander

zip

Database Client Abuse

9

HeidiSQL

mysqldump

neo4j-admin

Oracle Instant Client

osql

pg_dump

sql

SQL*Plus

sqlcmd

Destructive Impact

1

LockBit

Exfiltration Channel

1

GitHub

File Share Enumeration

7

impacket-smbclient

MANSPIDER

mount

Samba

SauronEye

smbmap

Snaffler

Hardware Implant

2

Eavesdropping device

Hardware Keylogger

Hardware Key Extraction

1

Saleae Logic

Local Host Enumeration

5

bhdump

Get-BrowserData

grep

strings

tail

LOLBin Abuse

3

CertUtil

less

Text Editor

Network Protocol Analyzer

4

dsniff

Ettercap

tcpdump

Wireshark

Network Scanner

6

curl

Git

OpenTest Asset Manager

SNMP tool

snmpwalk

Tcpdump (Packet Capture)

NTLM/Kerberos Relaying

3

AtlasReaper

Impacket ntlmrelayx

smbrelayx

Obfuscation

1

WinDbg

OSINT

1

Subversion (SVN)

Port Redirection & Proxy

3

mitmproxy

PyRDP

sslstrip

Process Injector

2

Frida

frida-trace

Remote Access Tool

1

HiddenDesktop

Screen Capture

2

ScreenshotBOF

SharpScreenshot.exe

Web Exploitation

3

git-dumper

Nextcloud

sqlmap

Impact

40 items

C2 Framework

3

Cobalt Strike

dnscat2

iodine

Cloud Data Collection

3

Conf-thief

GraphRunner

SharePoint

Database Client Abuse

2

osql

SQL*Plus

Destructive Impact

5

DragonForce encryptor

LockBit

mkfs.ext4

rm

shred

Environment Variable Manipulation

1

env

Exfiltration Channel

20

blat

Blomp

Dropbox

Edge

ffmpeg

File Sharing Service

gcloud storage

GitHub

Google BigQuery

Google Cloud Storage

gsutil

MEGA

OneDrive

OpenAI

ownCloud

PSCP

rclone

Rsync

scp

sftp

Hardware Implant

1

Hardware Keylogger

LOLBin Abuse

2

bcdedit.exe

vssadmin.exe

Obfuscation

1

PS>Attack

Remote Execution

1

evil-winrm

Screen Capture

1

ScreenshotBOF

Unspecified

2 items

Credential Dumping

1

Wbxdmsupload.Exe

Network Scanner

1