Skip to content

@NetSPI NetSPI

All

    Repositories list

    151 repositories

    • OCInferno

      Public
      A pentesting tool for enumeration/download/graphical analysis of OCI content. Includes an OpenGraph generator for Bloodhound-style analysis.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •2•22•1•2•Updated Sep 3, 2026Sep 3, 2026

    • OCISigner

      Public
      A Burp Suite extension to sign OCI HTTP requests using all supported OCI authentication mechanisms including API keys, session tokens, instance principals, & re…
      Java
      •
      BSD 3-Clause "New" or "Revised" License
      •0•6•0•1•Updated Sep 1, 2026Sep 1, 2026

    • BypassFuzzer-Burp

      Public
      The Java Burp Extension version of @intrudir's BypassFuzzer tool
      Java
      •
      MIT License
      •4•1•0•0•Updated Aug 28, 2026Aug 28, 2026

    • gcpwn

      Public
      Pentesting framework for GCP & Google Workspace that enumerates/downloads data that feeds into a BloodHound Opengraph model. Includes credential management, wor…
      gcppentestinggoogleworkspace
      gcppentestinggoogleworkspacegcpwn
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •29•309•0•3•Updated Aug 28, 2026Aug 28, 2026

    • BOFscale

      Public
      A collection of BOF-PE's that allow running tailscale from memory
      Go
      •
      BSD 3-Clause "New" or "Revised" License
      •18•132•1•1•Updated Aug 27, 2026Aug 27, 2026

    • oci-lexer-parser

      Public
      A utility to convert OCI IAM Policy Statements and Dynamic Group Matching Rules to serialized JSON output.
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •0•3•0•0•Updated Aug 12, 2026Aug 12, 2026

    • AD-PathFinder

      Public
      Attack path mapping for Active Directory, ADCS, SCCM, and MSSQL using BloodHound CE + OpenGraph data.
      active-directorybloodhoundsccm
      active-directorybloodhoundsccmmssqlkerberospentestingred-teamntdsadcs
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •20•199•1•0•Updated Aug 9, 2026Aug 9, 2026

    • ForceHound

      Public
      Salesforce identity and permission graph collector for BloodHound CE. Maps users, profiles, permission sets, roles, groups, sharing rules, connected apps, and f…
      pythonsecurityidentity
      pythonsecurityidentitygraphpermissionsbloodhoundpenetration-testingsalesforceauraattack-path
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •3•48•0•1•Updated Jul 30, 2026Jul 30, 2026

    • burpcollaborator-docker

      Public
      A set of scripts to install a Burp Collaborator Server in a docker environment, using a LetsEncrypt wildcard certificate in as simple a process as possible
      Shell
      •44•0•0•0•Updated Jul 23, 2026Jul 23, 2026

    • confused

      Public
      Tool to check for dependency confusion vulnerabilities in multiple package management systems
      Go
      •
      MIT License
      •109•1•0•0•Updated Jul 8, 2026Jul 8, 2026

    • MicroBurst

      Public
      A collection of scripts for assessing Microsoft Azure security
      PowerShell
      •
      BSD 3-Clause "New" or "Revised" License
      •340•2.4k•3•2•Updated Jun 29, 2026Jun 29, 2026

    • AzurePentestingWiki

      Public
      This is a wiki for Azure pentesting techniques. Powered by Zensical and GitHub Pages
      HTML
      •
      BSD 3-Clause "New" or "Revised" License
      •0•2•0•0•Updated Jun 23, 2026Jun 23, 2026

    • OWASPJuiceShop

      Public
      Used for testing NetSPI Platform MCP. Can be deleted after July 2026.
      TypeScript
      •
      MIT License
      •19k•0•0•4•Updated Jun 21, 2026Jun 21, 2026

    • AutoDirbuster

      Public
      Automatically run and save ffuf scans for multiple IPs
      Python
      •
      Other
      •26•82•0•0•Updated Jun 5, 2026Jun 5, 2026

    • OOBRead_UEFI_Example

      Public
      Demonstrating UEFI emulation techniques for identifying security vulnerabilities in extracted firmware binaries.
      Python
      •0•0•0•0•Updated May 20, 2026May 20, 2026

    • efiSeek

      Public
      Ghidra analyzer for UEFI firmware.
      Java
      •
      Apache License 2.0
      •40•0•0•0•Updated Apr 27, 2026Apr 27, 2026

    • GoLegacySslTlsSupport

      Public
      Go
      •0•0•0•0•Updated Apr 3, 2026Apr 3, 2026

    • SQLInjectionWiki

      Public
      A wiki focusing on aggregating and documenting various SQL injection methods
      mysqlsqlwiki
      mysqlsqlwikiinjectionoraclesqlimssqlsqlservernetspi
      HTML
      •148•800•2•3•Updated Apr 1, 2026Apr 1, 2026

    • PowerShell

      Public
      NetSPI PowerShell Scripts
      PowerShell
      •107•344•0•1•Updated Feb 10, 2026Feb 10, 2026

    • BOF-PE

      Public
      An example reference design for a proposed BOF PE
      redteampost-ex
      redteampost-ex
      C++
      •
      BSD 3-Clause "New" or "Revised" License
      •34•245•0•2•Updated Jan 23, 2026Jan 23, 2026

    • bambdas

      Public
      Bambdas collection for Burp Suite Professional and Community.
      Java
      •
      GNU Lesser General Public License v3.0
      •86•0•0•1•Updated Dec 12, 2025Dec 12, 2025

    • NetSIP

      Public
      NetSIP is a Python-powered SIP repeater that lets you craft, replay, and inspect SIP traffic.
      Python
      •
      GNU General Public License v3.0
      •0•2•0•0•Updated Nov 6, 2025Nov 6, 2025

    • FuncoPop

      Public
      Tools for attacking Azure Function Apps
      PowerShell
      •
      Other
      •11•89•1•1•Updated Oct 28, 2025Oct 28, 2025

    • PXEThief

      Public
      PXEThief is a set of tooling that can extract passwords from the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager
      Python
      •
      GNU General Public License v3.0
      •71•0•0•0•Updated Oct 28, 2025Oct 28, 2025

    • PowerHuntShares

      Public
      PowerHuntShares is an audit script designed in inventory, analyze, and report excessive privileges configured on Active Directory domains.
      PowerShell
      •
      Other
      •118•1.1k•13•0•Updated Oct 15, 2025Oct 15, 2025

    • BurpExtractor

      Public
      A Burp extension for generic extraction and reuse of data within HTTP requests and responses.
      Java
      •34•100•8•3•Updated Oct 7, 2025Oct 7, 2025

    • whois-parser

      Public
      Whois parser for domain whois information parsing in Go(Golang).
      Go
      •
      Apache License 2.0
      •105•0•0•0•Updated Sep 25, 2025Sep 25, 2025

    • ATEAM

      Public
      Python
      •
      BSD 3-Clause "New" or "Revised" License
      •15•149•2•1•Updated Sep 9, 2025Sep 9, 2025

    • Snaffler

      Public
      a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )
      C#
      •
      GNU General Public License v3.0
      •285•1•0•0•Updated Sep 8, 2025Sep 8, 2025

    • egressTester

      Public
      Allows testing all egress ports, an updated version of egressbuster
      0•0•0•0•Updated Sep 4, 2025Sep 4, 2025
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.