Skip to content

@NetSPI NetSPI

Change the repository type filter

All

    Repositories list

    150 repositories

    • gcpwn

      Public
      Pentesting framework for GCP & Google Workspace that enumerates/downloads data that feeds into a BloodHound Opengraph model. Includes credential management, wor…
      gcppentestinggoogleworkspace
      gcppentestinggoogleworkspacegcpwn
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •28•308•0•0•Updated Aug 18, 2026Aug 18, 2026

    • OCISigner

      Public
      A Burp Suite extension to sign OCI HTTP requests using all supported OCI authentication mechanisms including API keys, session tokens, instance principals, & re…
      Java
      •
      BSD 3-Clause "New" or "Revised" License
      •0•3•0•0•Updated Aug 18, 2026Aug 18, 2026

    • OCInferno

      Public
      A pentesting tool for enumeration/download/graphical analysis of OCI content. Includes an OpenGraph generator for Bloodhound-style analysis.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •2•21•1•2•Updated Aug 13, 2026Aug 13, 2026

    • oci-lexer-parser

      Public
      A utility to convert OCI IAM Policy Statements and Dynamic Group Matching Rules to serialized JSON output.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •0•3•2•0•Updated Aug 12, 2026Aug 12, 2026

    • AD-PathFinder

      Public
      Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data.
      active-directorybloodhoundsccm
      active-directorybloodhoundsccmmssqlkerberospentestingred-teamntdsadcs
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •9•97•1•0•Updated Aug 9, 2026Aug 9, 2026

    • BypassFuzzer-Burp

      Public
      The Java Burp Extension version of @intrudir's BypassFuzzer tool
      Java
      •
      MIT License
      •4•1•0•0•Updated Aug 1, 2026Aug 1, 2026

    • ForceHound

      Public
      Salesforce identity and permission graph collector for BloodHound CE. Maps users, profiles, permission sets, roles, groups, sharing rules, connected apps, and f…
      pythonsecurityidentity
      pythonsecurityidentitygraphpermissionsbloodhoundpenetration-testingsalesforceauraattack-path
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •3•47•0•1•Updated Jul 30, 2026Jul 30, 2026

    • burpcollaborator-docker

      Public
      A set of scripts to install a Burp Collaborator Server in a docker environment, using a LetsEncrypt wildcard certificate in as simple a process as possible
      Shell
      •44•0•0•0•Updated Jul 23, 2026Jul 23, 2026

    • confused

      Public
      Tool to check for dependency confusion vulnerabilities in multiple package management systems
      Go
      •
      MIT License
      •109•0•0•0•Updated Jul 8, 2026Jul 8, 2026

    • MicroBurst

      Public
      A collection of scripts for assessing Microsoft Azure security
      PowerShell
      •
      BSD 3-Clause "New" or "Revised" License
      •338•2.4k•3•2•Updated Jun 29, 2026Jun 29, 2026

    • AzurePentestingWiki

      Public
      This is a wiki for Azure pentesting techniques. Powered by Zensical and GitHub Pages
      HTML
      •
      BSD 3-Clause "New" or "Revised" License
      •0•1•0•0•Updated Jun 23, 2026Jun 23, 2026

    • OWASPJuiceShop

      Public
      Used for testing NetSPI Platform MCP. Can be deleted after July 2026.
      TypeScript
      •
      MIT License
      •19k•0•0•4•Updated Jun 21, 2026Jun 21, 2026

    • AutoDirbuster

      Public
      Automatically run and save ffuf scans for multiple IPs
      Python
      •
      Other
      •26•82•0•0•Updated Jun 5, 2026Jun 5, 2026

    • OOBRead_UEFI_Example

      Public
      Demonstrating UEFI emulation techniques for identifying security vulnerabilities in extracted firmware binaries.
      Python
      •0•0•0•0•Updated May 20, 2026May 20, 2026

    • efiSeek

      Public
      Ghidra analyzer for UEFI firmware.
      Java
      •
      Apache License 2.0
      •39•0•0•0•Updated Apr 27, 2026Apr 27, 2026

    • GoLegacySslTlsSupport

      Public
      Go
      •0•0•0•0•Updated Apr 3, 2026Apr 3, 2026

    • SQLInjectionWiki

      Public
      A wiki focusing on aggregating and documenting various SQL injection methods
      mysqlsqlwiki
      mysqlsqlwikiinjectionoraclesqlimssqlsqlservernetspi
      HTML
      •147•795•2•3•Updated Apr 1, 2026Apr 1, 2026

    • PowerShell

      Public
      NetSPI PowerShell Scripts
      PowerShell
      •108•344•0•1•Updated Feb 10, 2026Feb 10, 2026

    • BOF-PE

      Public
      An example reference design for a proposed BOF PE
      redteampost-ex
      redteampost-ex
      C++
      •
      BSD 3-Clause "New" or "Revised" License
      •34•238•0•2•Updated Jan 23, 2026Jan 23, 2026

    • bambdas

      Public
      Bambdas collection for Burp Suite Professional and Community.
      Java
      •
      GNU Lesser General Public License v3.0
      •86•0•0•1•Updated Dec 12, 2025Dec 12, 2025

    • NetSIP

      Public
      NetSIP is a Python-powered SIP repeater that lets you craft, replay, and inspect SIP traffic.
      Python
      •
      GNU General Public License v3.0
      •0•2•0•0•Updated Nov 6, 2025Nov 6, 2025

    • FuncoPop

      Public
      Tools for attacking Azure Function Apps
      PowerShell
      •
      Other
      •11•89•1•1•Updated Oct 28, 2025Oct 28, 2025

    • PXEThief

      Public
      PXEThief is a set of tooling that can extract passwords from the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager
      Python
      •
      GNU General Public License v3.0
      •71•0•0•0•Updated Oct 28, 2025Oct 28, 2025

    • PowerHuntShares

      Public
      PowerHuntShares is an audit script designed in inventory, analyze, and report excessive privileges configured on Active Directory domains.
      PowerShell
      •
      Other
      •116•1k•13•0•Updated Oct 15, 2025Oct 15, 2025

    • BurpExtractor

      Public
      A Burp extension for generic extraction and reuse of data within HTTP requests and responses.
      Java
      •34•100•8•3•Updated Oct 7, 2025Oct 7, 2025

    • whois-parser

      Public
      Whois parser for domain whois information parsing in Go(Golang).
      Go
      •
      Apache License 2.0
      •102•0•0•0•Updated Sep 25, 2025Sep 25, 2025

    • ATEAM

      Public
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •15•149•2•1•Updated Sep 9, 2025Sep 9, 2025

    • Snaffler

      Public
      a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )
      C#
      •
      GNU General Public License v3.0
      •282•1•0•0•Updated Sep 8, 2025Sep 8, 2025

    • egressTester

      Public
      Allows testing all egress ports, an updated version of egressbuster
      0•0•0•0•Updated Sep 4, 2025Sep 4, 2025

    • MSSQLHound

      Public
      PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph
      PowerShell
      •
      GNU General Public License v3.0
      •20•1•0•0•Updated Jul 30, 2025Jul 30, 2025
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.