Metasploit Framework is the world's most widely used penetration testing platform, with over 39,000 stars and 14,000 forks. It is a modular Ruby application that provides a comprehensive suite of exploit, auxiliary, post-exploitation, payload, encoder, and nop modules. The core architecture separates low-level networking and protocol handling (Rex library) from higher-level module logic, and includes a Rails-based web service layer offering REST and JSON-RPC APIs for remote control and automation. Key entry points include the console CLI (msfconsole), payload generator (msfvenom), and RPC daemon (msfrpcd). Production data flows involve user interaction via console or API, module execution against targets over protocols like HTTP, SMB, Kerberos, and LDAP, establishment of sessions (shell, meterpreter, etc.), and storage of results (credentials, loot, events) in a PostgreSQL database via ActiveRecord. External dependencies include Ruby 3.3.8, PostgreSQL, and optional tools like nmap, John the Ripper, and mingw-w64 for cross-compilation. The framework is actively maintained with daily commits, extensive CI/CD (GitHub Actions for lint, unit tests, acceptance tests), and a well-structured codebase with over 15,000 files.
Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
Mythic is a cross-platform, post-exploitation, red teaming command-and-control (C2) framework. It enables operators to manage remote agents (callbacks), generate payloads, issue tasks, exfiltrate files, harvest credentials, and automate workflows through an event-driven system. The architecture is a multi-container Docker deployment: a Go backend (using Gin, RabbitMQ, PostgreSQL, gRPC) handles agent communication, task orchestration, and data persistence; a React frontend (Material-UI, Apollo Client) provides a rich operator interface with real-time updates via GraphQL subscriptions (backed by Hasura); and a CLI tool (Mythic_CLI) manages container lifecycle, configuration, and service installation. Key entry points include the agent message webhook (HTTP POST/GET), web controllers for CRUD operations, and RabbitMQ RPC handlers for internal service communication. External dependencies include RabbitMQ, PostgreSQL, Hasura GraphQL engine, Docker, and gRPC. The system is designed for extensibility through payload type containers, C2 profiles, translation containers, and custom browser scripts.
This repository implements a Cobalt Strike Beacon Object File (BOF) that loads .NET assemblies directly into memory while employing hardware breakpoint-based techniques to bypass AMSI and ETW monitoring without patching memory. The core functionality resides in the C source file which handles .NET runtime initialization, assembly loading, and the innovative hardware breakpoint mechanism for security bypass. The project includes an Aggressor script for integration with Cobalt Strike's command framework. The code demonstrates advanced Windows API manipulation, COM interop for .NET hosting, and stealth techniques that avoid traditional memory patching detectable by EDR solutions.
Outpacket is a comprehensive cheatsheet/reference guide that maps traditional impacket penetration testing workflows to modern alternative tools like gopacket, Titanis, NetExec, and others. It serves as a static documentation resource for security professionals working with Windows environments, particularly Active Directory attacks. The repository contains only a single README.md file organized into sections covering authentication, remote execution, Kerberos operations, SMB/file operations, credential dumping, enumeration, AD/LDAP operations, auth coercion, certificate attacks, and exotic credential harvesting techniques. Each section provides command examples for multiple tools alongside explanatory notes about tool-specific behaviors and limitations.
DuplexSpyCS is a full-featured Remote Access Trojan (RAT) command-and-control (C2) framework written in C# (.NET WinForms). It consists of a server-side management console and multiple payload variants (winClient48, winClient48DLL, Tipoff, etc.) that provide comprehensive post-exploitation capabilities: file manager, remote desktop, keylogger, webcam/microphone streaming, registry editor, process/task manager, remote shell (including xterm via WebView2), SOCKS5 proxy, and a plugin system for credential theft (Chrome, Edge, Firefox, MobaXterm). Communication uses a custom binary protocol (clsDSP) over TCP, TLS, or HTTP with RSA-AES hybrid encryption. The payloads employ persistence via registry/startup, UAC bypass, process injection (APC, EarlyBird, CreateRemoteThread, etc.), and fileless execution. The codebase is extensive but exhibits significant code duplication across payload projects, many incomplete or stub features, and outdated dependencies (AForge, NAudio, SharpPcap). It is explicitly designed for offensive security research and learning, but carries high risk of misuse.
BYOB (Build Your Own Botnet) is an open-source post-exploitation framework that provides a command-and-control (C2) server, a custom payload generator, and a suite of post-exploitation modules. It is designed for security researchers and developers to simulate botnet operations for educational purposes. The system consists of a console-based C2 server (Python) and a Flask-based web GUI for managing sessions, payloads, and exfiltrated data. The architecture follows a classic botnet pattern: clients (reverse TCP shells) connect to the C2 server, authenticate via Diffie-Hellman key exchange with AES-256-CBC encryption, and receive tasks (modules) that are remotely loaded and executed. Modules include keylogging, screenshot capture, privilege escalation, packet sniffing, port scanning, persistence mechanisms, and interaction with iCloud/Outlook. The web GUI offers a dashboard, payload generator, terminal interface, and file management. The codebase shows signs of significant duplication (identical modules exist in both the core and web-gui directories) and relies on heavily outdated third-party frontend libraries (CKEditor 2013, FullCalendar 2014, CodeMirror addons). The project appears to be in a stale maintenance state with known incomplete features (e.g., unencrypted remote imports, limited transport types). While the core concepts (remote module loading, encrypted C2, cross-compilation) are technically interesting, the implementation quality is uneven, with Python 2/3 compatibility hacks, security-sensitive patterns (exec usage, SimpleHTTPServer without auth), and a large volume of unused/purely vendored assets inflating the repository. It is best treated as a reference architecture for botnet design rather than production-ready software.