This repository provides a native PHP implementation of enumeration types, offering base Enum class, EnumSet for efficient set operations, and EnumMap for mapping enum keys to values. The Enum class implements the singleton pattern for enum values, ensuring that equivalent enum values are identical instances, and includes features like lazy constant discovery, inheritance support, and proper comparison handling. The EnumSet component stands out for its innovative bit vector implementation that automatically switches between integer storage (for small sets) and binary string storage (for large sets) to optimize memory usage and performance. It provides standard set operations (union, intersection, difference, symmetric difference) through efficient bitwise operations, making it particularly valuable for applications requiring efficient set manipulation on enum values. The library is well-maintained with comprehensive test suites, benchmarks, and support for multiple PHP versions. It follows semantic versioning and includes development tools for code quality checking. While the EnumSerializableTrait provides serialization support with noted caveats, the core enum functionality is robust and suitable for use in production PHP applications requiring type-safe enumeration patterns.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository is the Python implementation of PowerView, a comprehensive Active Directory (AD) security assessment and exploitation tool. It provides a feature-rich CLI (with an interactive shell), a web-based UI (Flask + vanilla JS), and a Model Context Protocol (MCP) server for AI agent integration. The tool enumerates AD objects (users, groups, computers, GPOs, trusts, certificates, DNS, SMB shares, etc.), identifies security vulnerabilities (kerberoasting, AS-REP roasting, shadow credentials, ACL abuse, certificate template misconfigurations), and supports active exploitation (DACL modification, RBCD, coercion attacks, SMB file operations). It is designed for red team operations and AD security audits. The architecture is a monolith centered on a large `PowerView` class (in `powerview.py`) that orchestrates all commands and dispatches to specialized modules (e.g., `kerberoast.py`, `ca.py`, `exchange.py`, `ldapattack.py`). It supports both standard LDAP and a custom implementation of Microsoft's Active Directory Web Services (ADWS) protocol (SOAP over .NET Message Framing and NegotiateStream), enabling operations without conventional LDAP. The tool leverages Impacket for low-level Windows protocols (SMB, RPC, Kerberos) and includes a plugin system with decorator-based registration and before/after hooks. The web front-end offers interactive graph visualization, object exploration, and real-time command history, while the MCP server exposes AD operations to AI assistants. Key data flows involve LDAP/ADWS queries for object enumeration, SMB/RPC sessions for remote system interaction, and Kerberos tickets for authentication attacks. External dependencies include `ldap3` (forked), `impacket` (forked), `dsinternals`, `flask`, `werkzeug`, and client-side libraries (Cytoscape.js, Alpine.js, Tailwind CSS). The codebase is large and tightly coupled in places, but the custom ADWS implementation, plugin system, and vulnerability detection engine are notable achievements that could be extracted and reused.
This repository is a curated list of over 150 red teaming tools and resources, organized by MITRE ATT&CK categories (Reconnaissance, Resource Development, Initial Access, etc.). It contains no original source code; instead, it provides descriptions, installation instructions, usage examples, and links to external tools. The README is the sole deliverable, serving as a comprehensive reference for red team operators. While not a software application itself, it functions as a catalog of applications. The backlog file contains a few additional URLs and notes for future additions. The repository is well-maintained with active issue triage and recent commits, but its value lies in curation rather than code craftsmanship.