PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph
https://github.com/SpecterOps/MSSQLHound

TAP SSH VPN - this will allow you to VPN your machine into the remote TAP device through a reverse SSH tunnel.

https://github.com/trustedsec/tap/blob/master/noscripts/ssh-tunnel.sh

Your template-based BloodHound terminal companion tool
https://github.com/fin3ss3g0d/cypherhound

Weaponize DLL hijacking easily. Backdoor any function in any DLL
https://github.com/Print3M/DllShimmer

you can call something like NtAllocateVirtualMemoryEx without ever touching ntdll!

https://github.com/whokilleddb/function-collections/blob/main/winapi_alternatives/NtAllocateMemoryEx/main.c

https://github.com/whokilleddb/hoontr

Group Policy Objects manipulation and exploitation framework
https://github.com/synacktiv/GroupPolicyBackdoor

Named in homage to pwndrop, pwnlift is a simple dotnet server application for uploading files from a desktop without the use of a C2. Useful if you have a console access to a machine and need to take files offline for analysis (such as Code Integrity Policy files).
https://github.com/rasta-mouse/pwnlift

Comprehensive Windows Syscall Extraction & Analysis Framework
https://github.com/xaitax/NTSleuth

Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130)

https://github.com/BitsByWill/ksmbd-n-day

EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state.
https://github.com/TwoSevenOneT/EDR-Freeze

Let's start 2026 with a major Responder update!
It now supports:
- CLDAP ping pong to SMB auth.
- SNMPv3 authentication and hashes.
- New rogue Kerberos server forcing AS-REQ when receiving TGS-REQ + support for Kerberos type 17/18 hashes.
- IMAP support for NTLM authentication.
- SMTP support for AUTH PLAIN LOGIN CRAM-MD5 DIGEST-MD5 NTLM authentication.
- DCE-RPC server now supports SAMR, SRVSVC, WKSSVC, WINREG, SVCCTL, ATSVC, DNSSERVER
- DNS server now supports SOA, MX, SRV, ANY, etc
-> SOA -> Appear as the authoritative DNS server
-> MX poisoning → Email client connects to rogue SMTP/IMAP → capture credentials
-> SRV poisoning → Domain services connect to rogue SMB/LDAP/Kerberos → capture NTLM/AS-REQ
- LDAP GSSAPI, GSS-SPNEGO, NTLM, DIGEST-MD5
https://github.com/lgandx/Responder