jonaslejon / malicious-pdf

💀 Generate malicious PDF test files for testing phone-home callbacks, SSRF, XSS, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh

genotrance / px

An HTTP proxy server to automatically authenticate through an NTLM proxy

ADScanPro / Claude-AD

Active Directory pentest methodology for Claude Code: skills, agents and slash commands for internal AD red-team work (Kerberoasting, ADCS ESC1-17, DCSync, ACL abuse, NTLM relay, delegation), with per-technique OPSEC/telemetry notes. Drives netexec, impacket, certipy, bloodyAD, BloodHound CE.

nikaiw / VMkatz

Extract Windows credentials directly from VM memory snapshots and virtual disks

goshs-labs / goshs

Feature-rich single-binary file server for red teamers and developers. HTTP/S · WebDAV · FTP/SFTP · SMB · LDAP/S · NTLM hash capture · DNS/SMTP callbacks · TLS · Auth · Share links. A powerful python3 -m http.server replacement.

trustedsec / Titanis

Windows protocol library, including SMB and RPC implementations, among others.

ADScanPro / adscan

Free Active Directory pentesting tool for Linux, macOS and Windows. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin. NIS2 / ISO 27001 reports.

Waffle / waffle

Enable drop-in Windows Single Sign On for popular Java web servers.

outflanknl / ntlmrain

Recover NT hashes from NetNTLMv1 responses using local WebGPU computation and local/remote table lookup

bl4ckarch / go-responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

boydhacks / ntlmscout

—

mverschu / SOCKSRelayd

SOCKS-focused NTLM relay with persistent session packages and a long-lived SessionBank that owns authenticated TCP connections.