横向移动
========================================

域
----------------------------------------
- `adidnsdump <https://github.com/dirkjanm/adidnsdump>`_ Active Directory Integrated DNS dump tool
- `BloodHound <https://github.com/BloodHoundAD/BloodHound>`_ Six Degrees of Domain Admin
- `PlumHound <https://github.com/PlumHound/PlumHound>`_ Bloodhound for Blue and Purple Teams
- `windapsearch <https://github.com/ropnop/windapsearch>`_ Python script to enumerate users, groups and computers from a Windows domain through LDAP queries
- `ldapdomaindump <https://github.com/dirkjanm/ldapdomaindump>`_ Active Directory information dumper via LDAP 
- `Kerberoast <https://github.com/nidem/kerberoast>`_ a series of tools for attacking MS Kerberos implementations
- `ADRecon <https://github.com/sense-of-security/ADRecon>`_ Active Directory Recon
- `Creds <https://github.com/S3cur3Th1sSh1t/Creds>`_ Some usefull Scripts and Executables for Pentest & Forensics
- `Lithnet Password Protection for Active Directory <https://github.com/lithnet/ad-password-protection>`_ Active Directory password filter featuring breached password checking and custom complexity rules
- `ASREPRoast <https://github.com/HarmJ0y/ASREPRoast>`_ Project that retrieves crackable hashes from KRB5 AS-REP responses for users without kerberoast preauthentication enabled.

LDAP
----------------------------------------
- `SharpHound3 <https://github.com/BloodHoundAD/SharpHound3>`_ Data Collector for the BloodHound Project

容器
----------------------------------------
- `CDK <https://github.com/cdk-team/CDK>`_ an open-sourced container penetration toolkit, offering stable exploitation in different slimmed containers without any OS dependency

微软系产品利用
----------------------------------------
- `LyncSniper <https://github.com/mdsecresearch/LyncSniper>`_ A tool for penetration testing Skype for Business and Lync deployments
- `MSOLSpray <https://github.com/dafthack/MSOLSpray>`_ A password spraying tool for Microsoft Online accounts (Azure/O365)
- `MailSniper <https://github.com/dafthack/MailSniper>`_ MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms

Azure AD
----------------------------------------
- `ROADtools <https://github.com/dirkjanm/ROADtools>`_ Azure AD exploration framework

Exchange
----------------------------------------
- `ruler <https://github.com/sensepost/ruler>`_ A tool to abuse Exchange services
- `MailSniper <https://github.com/dafthack/MailSniper>`_
- `PrivExchange <https://github.com/dirkjanm/PrivExchange>`_  Exchange your privileges for Domain Admin privs by abusing Exchange

PowerShell
----------------------------------------
- `PowerShellMafia <https://github.com/PowerShellMafia>`_

内网信息收集
----------------------------------------
- `nbtscan <https://github.com/scallywag/nbtscan>`_ NetBIOS scanning tool
- `SharpShares <https://github.com/djhohnstein/SharpShares>`_ Quick and dirty binary to list network share information from all machines in the current domain and if they're readable
- `WinShareEnum <https://github.com/nccgroup/WinShareEnum>`_ Windows Share Enumerator
- `HackBrowserData <https://github.com/moonD4rk/HackBrowserData>`_ 全平台的浏览器数据导出工具

Kerberos
----------------------------------------
- `Rubeus <https://github.com/GhostPack/Rubeus>`_
- `kerbrute <https://github.com/ropnop/kerbrute>`_ A tool to perform Kerberos pre-auth bruteforcing
- `kerberoast <https://github.com/nidem/kerberoast>`_ A series of tools for attacking MS Kerberos implementations

自动化审计
----------------------------------------
- `Infection Monkey <https://github.com/guardicore/monkey>`_ Data center Security Testing Tool

绕过
----------------------------------------
- `SysWhispers <https://github.com/jthuraisamy/SysWhispers>`_ AV/EDR evasion via direct system calls
- `SysWhispers2 <https://github.com/jthuraisamy/SysWhispers2>`_ AV/EDR evasion via direct system calls
- `Dumpert <https://github.com/outflanknl/Dumpert>`_ LSASS memory dumper using direct system calls and API unhooking

内网扫描
----------------------------------------
- `InScan <https://github.com/inbug-team/InScan>`_ 边界打点后的自动化渗透工具
- `fscan <https://github.com/shadow1ng/fscan>`_ 一款内网综合扫描工具，方便一键自动化、全方位漏扫扫描。