// the take
A giant link dump of offensive security tools for Windows/AD red teaming and web pentesting, organized by attack phase (AMSI bypass, lateral movement, privilege escalation, C2, exfiltration, etc.). It's for red teamers and pentesters who want a jumping-off point to discover tools, not developers looking for something to run or integrate.
Covers the full attack chain end to end — recon, initial foothold, AD enumeration (BloodHound, PingCastle), privesc, lateral movement, C2 frameworks, and exfiltration — so it works as a mental map of what tooling exists at each stage. Grouping by technique (AMSI bypass, pivoting, LSASS dumping) rather than a flat alphabetical list makes it usable as a reference when you already know what you're trying to do.
It's pure link aggregation with zero original content, no usage notes, and no indication of which tools still work — several AMSI/AV bypasses listed here have been detected and patched for years. Last pushed August 2022, so anything time-sensitive (EDR evasion, malleable C2 profiles, AMSI bypass techniques) is stale and some linked repos are themselves abandoned or taken down. Heavy overlap with other awesome-lists it links to directly (infosecn1nja/Red-Teaming-Toolkit, S3cur3Th1sSh1t/Pentest-Tools), so it adds little beyond being one more copy of the same directory. No maintenance signal at all — no issues, no PRs being merged, just a static snapshot from 2022.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →