Tactical Exploitation

Modern tactical exploitation toolkit.
Alternatives To Tactical Exploitation
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
a day ago82JavaScript
The Browser Exploitation Framework Project
Active Directory Exploitation Cheat Sheet3,972
20 days ago4mit
A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.
4 days ago29bsd-3-clausePython
The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.
20 days ago30September 19, 202214apache-2.0Go
📦 Make security testing of K8s, Docker, and Containerd easier.
a month ago1Python
Hash collisions and exploitations
2 years ago15apache-2.0C
Interactive CTF Exploration Tool
a year ago63otherC
a VPN daemon
a month ago10otherPython
Network Attack Tool
Heap Exploitation1,192
8 months ago6C
This book on heap exploitation is a guide to understanding the internals of glibc's heap and various attacks possible on the heap structure.
12 days ago7Python
🕷️ A `.git` folder exploiting tool that is able to restore the entire Git repository, including stash, common branches, common tags.
Alternatives To Tactical Exploitation
Select To Compare

Alternative Project Comparisons


"The Other Way to Pen-Test"

-- HD Moore & Valsmith

I've always been a big proponent of a tactical approach to penetration testing that does not focus on exploiting known software vulnerabilities, but relies on old school techniques such as information gathering and brute force. While being able to appreciate the occasional usefulness of a well-timed 0day, as a veteran penetration tester I favor an exploit-less approach. Tactical exploitation provides a smoother and more reliable way of compromising targets by leveraging process vulnerabilities, while minimizing attack detection and other undesired side effects.

This repository aims to provide a tactical exploitation toolkit to assist penetration testers during their assignments. The tools currently released are described below. See also http://www.0xdeadbeef.info/ for some older tools and techniques.

Related blog posts:

These tools are proofs of concept. They are functional but may be buggy or incomplete. Use at your own risk.


Easywin is a Python script that provides a toolkit for exploit-less attacks aimed at Windows and Active Directory environments, by leveraging information gathering and brute force capabilities against the SMB protocol.


Letmein is a pure PowerShell implementation of the staging protocols used by the Metasploit Framework. Start an exploit/multi/handler (Generic Payload Handler) instance on your attack box configured to handle one of the supported Meterpreter payloads, run letmein.ps1 (ideally as Administrator) on a compromised Windows box, and wait for your session. This technique is quite effective in order to bypass the antivirus and obtain a Meterpreter shell on Windows. An alternative Python implementation is also provided for educational purposes, however its use is not recommended in the field.


Letme.go is a minimalistic Go implementation of the main staging protocols used by the Metasploit Framework. Start an exploit/multi/handler instance on the attack box configured to handle one of the supported Meterpreter payloads, run letme.exe on the target Windows system, and enjoy your session!


Poriluk is a helper script that provides a comfortable interface to exploit common information leakage vulnerabilities. At the moment, the following attacks are supported: dictionary-based user enumeration via SMTP VRFY/EXPN/RCPT and HTTP Apache mod_userdir.


Botshot is a Python script that captures screenshots of websites from the command line. It is useful to automate mapping of the web attack surface of large networks.


Verbal is a HTTP request method security scanner. It tries a series of interesting HTTP methods against a list of website paths, in order to determine which methods are available and accessible. The following HTTP methods are currently supported: GET, OPTIONS, TRACE, DEBUG, PUT.


Netdork is a Python script that uses the Google Custom Search Engine API to collect interesting information on public networks and stealthily map the available attack surface. The following attacks are supported: network search sweep based on target CIDRs and subdomain discovery via search engine.


Seitan is a Python script that uses the Shodan.io API search to collect open source intelligence on targets. The following attacks are currently supported: ipaddr (view all available information for an IP address) and domain (search services related to a domain or host name).

Popular Exploitation Projects
Popular Attack Projects
Popular Security Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.
Python Script
Penetration Testing
Brute Force
Active Directory
Information Gathering
Metasploit Framework