Red-Teaming-Toolkit for mapping the open-source adversary emulation landscape

A curated, GPL-3.0-licensed index that organizes hundreds of offensive security tools across the full kill chain, giving red teamers and threat hunters a shared catalog for adversary simulation planning.

Tool	infosecn1nja/Red-Teaming-Toolkit — a curated catalog of open-source security tools organized by offensive kill-chain phase
Category	curated tool list / adversary emulation reference
Primary Use	Planning authorized adversary simulations: selecting OSINT, reconnaissance, post-exploitation, and C2 tooling mapped to phases like Reconnaissance, Lateral Movement, and Exfiltration
Safe Use	Reference material for authorized red team engagements, lab-based training, and threat hunting detection engineering on systems you own or have written permission to test
Telemetry Note	The list itself leaves no telemetry; defenders should study it because the README explicitly warns these tools are misused by APT and Human-Operated Ransomware actors, making it a detection-intel source

Red-Teaming-Toolkit is not an executable tool at all but a heavily starred curated repository — over ten thousand stars under the infosecn1nja account, licensed GPL-3.0 — that catalogs open-source security tools (OST) across the complete adversary kill chain. The README opens with a framing that is unusually honest for this space: it states outright that the listed tools could be misused by threat actors such as APT groups and Human-Operated Ransomware (HumOR) operators, and positions the catalog as equally useful for threat hunters building detection and prevention controls. That dual framing — offensive capability on one side, detection intel on the other — defines how the repository should be read by professionals.

Structurally, the repository is a table of contents mapped to offensive phases: Reconnaissance, Initial Access, Delivery, Situational Awareness, Credential Dumping, Privilege Escalation, Defense Evasion, Persistence, Lateral Movement, Exfiltration, and Miscellaneous. Each section is a Markdown table with three columns — name, description, and upstream GitHub URL — which makes the repo function less like documentation and more like an index you navigate to reach the actual primary sources. The phase taxonomy loosely mirrors the MITRE ATT&CK model, which is worth noting because it lets an operator or a hunter translate the catalog directly into technique coverage planning.

The Reconnaissance section is the largest and the most defensively benign. It covers external attack surface mapping with Amass from OWASP, fast port discovery with RustScan, and multi-cloud enumeration via cloud_enum and S3Scanner for AWS, Azure, and Google Cloud exposure. OSINT heavyweights like SpiderFoot, Recon-ng, and the newer BBOT recursive scanner sit alongside narrower utilities such as buster for email reconnaissance, linkedin2username and LinkedInt for corporate username enumeration, pagodo for automated Google dorking against the GHDB, and spoofcheck from BishopFox which audits SPF and DMARC records for spoofing-weak configurations — itself a straightforward defensive mail-hardening check.

One notable inclusion in the recon table is Gato, the GitHub Attack Toolkit from praetorian-inc, described as letting both blue teamers and offensive practitioners enumerate pipeline vulnerabilities across an organization's repositories. Its presence here signals that the catalog is not frozen in time; CI/CD attack surface has become a first-class recon category, and supply-chain exposures in GitHub Actions workflows are now treated as initial-access-relevant terrain during scoping of an authorized engagement.

The Initial Access section splits into two subcategories: Brute Force and Payload Development. The spraying entries — SprayingToolkit, o365recon, and CredMaster with its FireProx-based IP rotation — are exactly the class of tooling that password-throttling and conditional-access policies are designed to blunt, and a defender reading this section gets a direct map of what Azure AD and O365 hardening should be measured against. The payload development subsection is far larger and more aggressive in nature, listing frameworks like Ivy, PEzor, Donut, ScareCrow, Freeze, Shhhloader, and ProtectMyTooling.

It is worth pausing on what that payload list reveals about modern tradecraft. The recurring themes are in-memory execution, position-independent shellcode, direct syscalls, and D/Invoke style API invocation — RuralBishop is explicitly described as a rewrite of UrbanBishop replacing P/Invoke with D/Invoke, and InlineWhispers exists specifically for direct system calls in Cobalt Strike Beacon Object Files. Office-document tooling forms another cluster: EvilClippy for VBA stomping via P-Code, OfficePurge from FireEye for removing P-code from module streams, xlsGen for Excel 4.0 macro generation, and macro_pack for obfuscated document generation. None of this is a how-to — the catalog gives one-line descriptions only — but the density of EDR-evasion entries is itself a signal about where endpoint detection effort should concentrate.

The Delivery section focuses on phishing infrastructure, and the selection is informative because it mixes offensive and defensive-purpose projects. Gophish is explicitly framed as a toolkit for businesses running security awareness training, while Evilginx2 and Modlishka are reverse-proxy credential and session-cookie interception frameworks, and PwnAuth from FireEye targets OAuth abuse campaigns. BeEF rounds out the section under watering-hole style browser exploitation. For defenders, this is effectively a checklist of adversary-in-the-middle phishing techniques that phishing-resistant authentication (FIDO2, hardware keys) is specifically engineered to defeat.

The command-and-control subsection is where the catalog crosses from open source into commercial territory. Empire 5 from BC-SECURITY and PoshC2 from Nettitude are open-source post-exploitation frameworks, merlin is a Go-based cross-platform C2, and Koadic operates through JScript via COM. But Cobalt Strike, Brute Ratel C4, and SpecterInsight are commercial products listed with vendor URLs rather than repositories. The inclusion of SpecterInsight is interesting because its description emphasizes JSON output exported to ELK for operational analysis — even commercial C2 vendors now assume operators will instrument their own engagements for after-action reporting.

Because the README truncates after the C2 table in the provided context, the later sections — Situational Awareness, Credential Dumping, Privilege Escalation, Defense Evasion, Persistence, Lateral Movement, and Exfiltration — are present in the table of contents but their contents cannot be verified here. What can be said is that the same curatorial pattern presumably continues: named tools, one-line descriptions, and upstream links, with community contributions accepted via pull request as the README states. That contribution model is the repository's maintenance mechanism, and it explains both the breadth of the catalog and the occasional inconsistency in entry quality.

For an authorized operator, the practical value of Red-Teaming-Toolkit is scoping and tool selection: before an engagement, you walk the phase you need, evaluate candidate tools from their primary repositories, and validate them in a lab. The catalog deliberately does not chain anything together — there are no recipes, no command sequences, no configurations — so it functions as a map rather than a weapon. For a threat hunter, the same map read backwards is a detection backlog: every entry in Defense Evasion is a technique your EDR should be tested against, every phishing framework is a scenario for your mail gateway and awareness program, and the README's own warning about APT and HumOR misuse tells you which sections threat actors are reading too.

Caveats worth applying: a curated list inevitably ages, and several entries in any list of this size will be abandoned upstream, so always check the primary repository's commit history and issues before adopting anything. The list also mixes maturity levels indiscriminately — a hardened industry standard like Amass or gitleaks sits in the same table as proof-of-concept obfuscation tooling, and the README gives no quality signals to distinguish them. Treat every entry as a starting point for your own due diligence, run everything in an isolated lab first, and confine all of it to environments where you have explicit authorization.

As a piece of the security ecosystem, Red-Teaming-Toolkit occupies the same niche as a field guide: it tells you what exists, organized by where it fits in an attack lifecycle, and leaves execution entirely to the reader's judgment and authorization. Its ten-thousand-plus stars reflect how much the community values that organization. Read it as an operator to plan, as a hunter to prioritize detections, and as a student to understand the shape of the modern adversary toolbox — but always as a catalog of capabilities that demand a scoped, permissioned, and documented engagement before anything in it touches a real system.

Official project repository for infosecn1nja/Red-Teaming-Toolkit.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.