R

redteam

Sam The Butcher - Raw Disk Credential Extractor for Windows NTFS - Sam The Butcher is a single-file, standalone Windows executable that extracts credential hives (SAM, SYSTEM, SECURITY) and other locked files by reading the raw NTFS disk directly — bypassing file locks, EDR minifilters, and standard Windows access controls.

BloodyMary is an educational tool (trojan-virus or Ransomware) for training cybersecurity specialists, simulating realistic phishing attacks with social engineering elements. This project was created to raise awareness about cyber threats and demonstrate the consequences of running suspicious files.

Advanced Multi-Technology Stress Testing Framework Educational Cybersecurity Tool for High-Performance Network Testing

Open-source scanner called FleaMarket that finds exposed API keys in fresh GitHub repos. In a recent scan, it discovered live Google/Gemini keys in public .env files

RinHit - macOS ecosystem reconnaissance framework. Collects artifacts from the Apple ecosystem to build timelines of network activity, cross-device identity, and physical location correlation.

Kevlar Benchmark: OWASP Top 10 for Agentic Apps (AI-Agents) 2026 a Red Team Benchmark.

A diagnostic framework for measuring LLM vulnerability to Affective Contextual Erosion (ACE) and related liminal attack vectors. Delirium is not an exploitation tool. It is a standardized benchmark designed to detect the precise moment when a language model's attention weights shift from serving a system prompt to serving an emergent interpersonal pattern — before harm occurs.

SecurePath is an open-source, enterprise-grade framework for AI evaluation, red-teaming, and regulatory compliance. It provides sandboxed testing, policy-aligned metrics, multi-modal evaluation, training data sensitivity analysis, and historical compliance tracking, all while maintaining audit-ready logs and dashboards. Designed for organizations, enterprises, and research teams, SecurePath ensures AI safety, transparency, and regulatory assurance. https://roxanneardary.com/securepath/

Red Team AI Benchmark: Evaluating LLMs for authorized offensive-security tasks. Red Team AI Benchmark is a CLI model-evaluation benchmark. It measures how LLMs understand and respond to red-team questions and security scenarios; it is not a tool for carrying out those activities. Version 2 uses a rubric-based dataset instead of judging answers only against one golden response.

Copy Fail - CVE-2026-31431 - Hardened C implementation for redteam and authorized penetration testing operations. ⚠️ Legal Notice: This tool is intended solely for authorized security research, authorized penetration testing, and defensive analysis. Use on systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal.

Tomcat backdoor based on CS blog

Push notification demo based on malware seen in the wild.

USB Modem/IAX2 War Dialer

JA4 proxy tooling.

Canary Detection

Deployment scripts for automated labs.

C.A.R.P. is a pentest tool that delivers a remote, browser-in-the-browser experience for multi-campaign phishing, credential capture, and session hijacking (bypassing MFA). A target user visits a campaign URL they see a full-screen browser (noVNC + Firefox) that loads a target site you configure (e.g. a login page). Each visitor gets their own isolated Docker container, so sessions don’t mix. Keystrokes are logged per session, and you manage everything (campaigns, sessions, keylogs, idle timeouts) from a single Admin UI.

Pr0filer is a reconnaissance tool for browsers, implemented in JS and PHP. Its purpose is to gather information from the victim for further targeted attacks.

Lab environment for researching antivirus evasion using Shellter and PowerShell, including setup steps, documentation, and safe payload workflow.

Portable network scanner with some limited opsec capabilities.