This is a great tool for pivoting in a Windows/Active Directory environment using credential pairs (username:password, username:hash). It...

WMIOps (WMI remote commands) PowerLessShell (Remote PowerShell without PowerShell) PsExec (Light-weight telnet-replacement) LiquidSnake...

Scavenger is a multi-threaded post-exploitation scanning tool for scavenging systems, finding most frequently used files and folders as...

A tool to quickly bruteforce and enumerate valid Active Directory accounts through Kerberos Pre-Authentication. Install: (Go) go get...

By default any user in Active Directory can enumerate all DNS records in the Domain or Forest DNS zones, similar to a zone transfer. This...

Great tool for gathering information about a victim's Microsoft Active Directory (AD) environment, with support for Excel outputs. It can...

Seatbelt is a useful tool for gathering detailed information about the security posture of a target Windows machine in order to identify...

Ping Castle is a tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a...

This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP,...

PingCastle ( Active directory assessor) Seatbelt (Local vulnerability scanner) ADRecon (Active directory recon) adidnsdump (Active...

LaZagne (Local password extractor) hashcat (Password hash cracking) John the Ripper (Password hash cracking) SCOMDecrypt (SCOM...

DPAPI (Data Protection Application Programming Interface) provides a set of APIs to encrypt and decrypt data where a user password is...

SharpChromium is a .NET 4.0+ CLR project to retrieve data from Google Chrome, Microsoft Edge, and Microsoft Edge Beta. Currently, it can...

MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords,...

Simple tool to automatically download and parse configuration files from Cisco phone systems searching for SSH credentials. Will also...