+1 234-249-1337 
Red Siege builds and maintains a collection of free, open-source offensive security tools for penetration testers and red teamers. Every tool here comes straight from our real-world engagements — built to solve problems our consultants hit in the field, then shared with the community.
The tools below are organized by where they fit in an offensive engagement: external recon, command and control, malware development, persistence, internal recon, operations, exfiltration, and defensive use. Each links to its GitHub repository, and many include a deep-dive blog post. Have a question? Jump into the Red Siege Discord and ask us directly.
Tools of the Trade
In our “Tools of the Trade” SiegeCast, we showcase essential tools for penetration testing with real-world use cases and insights from the Red Siege team.
External Recon
EyeWitness
Quickly identify interesting websites and admin interfaces on large penetration tests.
Takes screenshots of websites, collects server header info, and identifies default credentials where possible. Feed it Nessus or Nmap XML (or a URL list) and it generates a fast, readable report so testers can spot the most interesting targets first. Written in Python with a C# assembly loadable into many C2 frameworks.
Just-Metadata
Passive intelligence gathering across large sets of IP addresses.
Gathers and analyzes metadata about IP addresses to surface relationships within a large dataset. “Gather” modules pull metadata from online resources; “analysis” modules find connections — common geolocations, timezones, country-specific searches, and IPs flagged by VirusTotal. Easily extended with new modules.
Command & Control (C2)
GraphStrike
Enables Beacons to use the Microsoft Graph API for HTTPS C2 communications.
A suite that lets Cobalt Strike’s HTTPS Beacon route C2 through the Microsoft Graph API. Beacon traffic is transmitted via two files in the attacker’s SharePoint site, with all communication routing to graph.microsoft.com.
AutoFunkt
Quickly set up a Cobalt Strike redirector and malleable C2 profile.
Python script for automating the creation of serverless cloud redirectors from Cobalt Strike malleable C2 profiles.
FunctionalC2
Relay C2 communications through Azure Functions.
A small proof-of-concept demonstrating the use of Azure Functions to relay communications.
C2concealer
Generate randomized malleable C2 profiles for Cobalt Strike.
A command-line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.
CIMplant
Query remote systems over CIM or WMI from C#.
A C# port of WMImplant that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user’s session.
WMImplant
Leverage WMI as both an action framework and a C2 channel.
A PowerShell-based tool that leverages WMI to perform actions against targeted machines and to act as the C2 channel for issuing commands and receiving results. Typically requires local administrator permissions on the target.
Malware Development
Delta Encoder
Obfuscate shellcode without common encryption or encoding methods.
Takes a binary shellcode file and generates an array of offsets (deltas) between each byte, breaking up detection signatures since all but the first byte changes within the loader. At runtime the code reconstitutes the original shellcode in memory, evading detection tuned to common encryption/encoding techniques.
Jigsaw
Obfuscate shellcode while avoiding common detection methods.
Generates a randomly shuffled array of shellcode bytes to break up the signature. It outputs an array of positions and an array of shuffled bytes, plus a loop that reverses the process to reconstitute the original shellcode.
Jargon
Translate shellcode bytes into words to evade entropy analysis.
Encryption raises the entropy of a loader, and some AV/EDR flag high-entropy binaries. Jargon encodes raw shellcode using a dictionary of words — English words, a Shakespearean text, or strings from a system DLL — requiring only 256+ unique entries valid as C/C++ string literals.
DigDug
Inflate an executable with dictionary words to evade AV/EDR that skips large files.
Increases the size of an executable to slip past engines that won’t analyze files over a certain threshold. It appends dictionary words (avoiding entropy or null-byte-padding inspection) and integrates SigThief functionality to transfer a digital signature onto the inflated executable.
EXCELntDonut
Generate XLM (Excel 4.0) macros from C# source.
An XLM (Excel 4.0) macro generator. Start with C# source code (EXE) and end with an Excel 4.0 macro that executes your code in memory; these macros can be saved in .XLS files.
Hot-Manchego
Generate macro-enabled Excel files (.xlsm) via the EPPlus library.
Creates macro-enabled Excel files using the third-party EPPlus library rather than Microsoft Office. Because the file structure varies significantly from Office-created documents, payloads often evade A/V that would catch a standard build.
Chromatophore
Offensive tooling for malware development workflows.
Description coming soon — see the GitHub repository for current details and usage.
Persistence
PersistAssist
Establish persistence during a test — and cleanly remove it afterward.
A fully modular persistence framework written in C#. Every technique includes a cleanup method to remove the persistence at the end of an engagement. The framework is designed so new techniques can be added simply by inheriting a class and adding the code.
Internal Recon
EDD — Enumerate Domain Data
Extract domain information useful to penetration testers and auditors.
A .NET tool similar in spirit to PowerView, built by combining functionality from a wide range of existing projects into one implementation. Written in C# and loadable into many C2 frameworks.
CredCheck
Test harvested credentials from C#, across multiple C2 frameworks.
A small .NET wrapper around LogonUserA to test the validity of harvested credentials within Cobalt Strike. Must be run within a domain context.
Operations
Hasher
Hash a string, or compare a hash to a plaintext value, locally.
Quickly hashes plaintext strings or compares hashed values to plaintext — without sending found hashes to an untrusted online “hash generator.” A safe, fast way to generate or verify hashes during an assessment.
Screenshooter
Capture a screenshot or screen-recording of a target desktop.
Run the file to create a screenshot or video, saved to the current user’s AppData\Roaming directory with a timestamped name. A flag lets you set a custom location and filename.
ProxmarkWrapper
Get alerted the moment an RFID card is captured.
A wrapper around the Proxmark3 client that sends a text alert (and optionally an email) when an RFID card is captured — useful for physical and badge-cloning engagements.
What-The-F
Execute F# code within an unmanaged process.
A proof-of-concept demonstrating how to execute F# code within an unmanaged process.
SqlClient
Access MSSQL database data through a Cobalt Strike beacon.
A proof-of-concept .NET MSSQL client for accessing database data through a Cobalt Strike beacon.
AggressorAssessor
Cobalt Strike Aggressor scripts for every phase of an engagement.
A collection of Cobalt Strike Aggressor scripts covering various phases of a penetration test or red team assessment.
CLM-Base64
Base64 encode/decode in PowerShell Constrained Language Mode.
Provides Base64 encoding and decoding functionality to PowerShell while running within Constrained Language Mode.
SharpCollectionTemplate
A starting template for building C# offensive tooling.
Description coming soon — see the GitHub repository for current details and usage.
Exfiltration
Egress-Assess
Test egress data-detection capabilities from inside a network.
Tests exfiltration over common protocols including HTTP, HTTPS, FTP, SMTP, ICMP, SMB, and DNS. It runs an internal client and an external server so data can be passed across the network boundary. Written in PowerShell and Python.
MiddleOut
Compress files for extraction via C2.
Compresses files from the command line and works with Cobalt Strike’s execute-assembly (and other C2 frameworks that run .NET assemblies). Pass in files directly or via a text file, with an optional password; UNC paths are also supported.
For Defenders
GPPDeception
Generate a “honeyfile” with a tantalizing GPP password to catch attackers.
Generates a groups.xml file that mimics a real GPP creating a new user on domain-joined computers. Blue teams can deploy it as a honeyfile — monitoring for access to detect testers or attackers scanning for GPP credentials — and monitor for use of the credentials as honeycreds.
Questions About Any of These Tools?
Jump into the Red Siege Discord to ask our consultants directly, or explore the “Tools of the Trade” SiegeCast series where we walk through real-world use cases.