MODULE CATALOG

139 Ready-to-Use Modules

Every tool you need for authorised security audits — in one framework, browser-operated, no thick client required.

139Total Modules
12Categories
108User-Level
31Admin-Level
C2 — Command & Control Agent-server connection management, health monitoring and core control. 10 modules
!check
User Silent

Agent health check — version, sessions, loaded modules, background jobs

!exit
User Silent

Gracefully stops the agent and disconnects from C2

!help
User Silent

Lists all modules with metadata; filterable by category or name

!jobs
User Silent

Shows all active background job (runspace) statuses

!jobkill
User Silent

Terminates a specific background job by ID

!kill_switch
User Medium

Emergency cleanup: temp files, background jobs, disconnect

!relay
User Medium

P2P agent relay over Named Pipe for internet-less internal agents

!reload
User Silent

Downloads and reloads changed modules from server (SHA-256 diff)

!restart
User Silent

Restarts agent in a fresh PS session, auto-reconnects to C2

!exfil_icmp
User Medium

Exfiltrates data via ICMP echo request payloads where TCP/UDP is blocked

Collection File collection, screenshots, keylogging and communication content harvesting. 14 modules
!backup
User Medium

Collects files by pattern into an in-memory ZIP archive (max 1 GB)

!batchdownload
User Medium

Downloads multiple files matching glob patterns at once

!clipboard
User Silent

Retrieves current Windows clipboard — no disk or event log trace

!collect_browser_history
User Low

Collects browsing history, bookmarks and URLs from all installed browsers

!collect_keylog
User High

In-memory keylogger using Win32 input API; no disk writes

!collect_mail
User Medium

Reads emails and attachments from Outlook COM or .ost/.pst files

!collect_ntfs
User Low

Finds and reads NTFS Alternate Data Streams (hidden files/metadata)

!collect_shadow
Admin Medium

Reads locked/protected files (SAM, NTDS.dit) via VSS shadow copies

!collect_teams
User Medium

Extracts messages, files and auth tokens from Teams LevelDB cache

!download
User Medium

Streams a file or full directory to the C2 server with gzip+HTTP/2

!exfil_dns_txt
User Medium

Exfiltrates data in DNS TXT record queries (base64 chunks)

!loot_browsers
User Low

Full browser loot: passwords, cookies, history, autofill, cards, extensions

!screen
User Low

Takes PNG screenshot of all monitors and downloads to C2

!upload
User Medium

Uploads a file from C2 server inbox to the agent target path

Credentials Extract usernames, passwords, tokens and cryptographic keys from every available source. 20 modules
!admin-harvester
Admin High

Fake update popup (Windows/Adobe/Chrome) captures admin creds via social engineering

!cookie_dumper
Admin High

Reads Chrome session cookies directly from process memory via ReadProcessMemory

!cred_asreproast
User Low

AS-REP Roasting: finds accounts without Kerberos pre-auth, extracts crackable hashes

!cred_azure_token
User Low

Harvests Azure AD/M365 OAuth tokens from az cli, PS Az, Teams, WAM, .NET user-secrets

!cred_browser
User Low

Saved logins from all major browsers — DPAPI + AES-GCM v10/v20 decryption

!cred_cert_store
User Low

Full Windows certificate store audit; exports certs with private keys (PFX)

!cred_cloud
User Low

Unified cloud credential harvester: AWS, Azure, GCP, Terraform, Docker, K8s, GitHub CLI

!cred_codesign
User Low

Finds code signing and EV/driver certificates with exportable private keys

!cred_dpapi_blob
User Low

Decrypts DPAPI-protected blobs for Chrome, Edge, IE, RDP Manager, Credential Store

!cred_iis_appcmd
Admin Medium

Extracts IIS app pool identities and web.config secrets (connection strings, API keys)

!cred_keepass
Admin Low

Finds KeePass databases; memory-scans running KeePass for master key material

!cred_kerberoast
User Medium

Requests TGS tickets for SPN accounts; exports hashcat-compatible $krb5tgs$ hashes

!cred_lsa_secrets
Admin Low

Extracts LSA secrets: service account passwords, DefaultPassword, NL$KM, DPAPI_SYSTEM

!cred_lsass_minidump
Admin High

Creates LSASS memory dump via MiniDumpWriteDump or PssCaptureSnapshot

!cred_ntds_dit
Admin High

Extracts NTDS.dit from DC via VSS or ntdsutil for full domain hash dump

!cred_ssh_keys
User Low

Collects SSH private keys, PuTTY sessions, WinSCP and FileZilla credentials

!cred_vault_credman
User Low

Enumerates and extracts all Windows Credential Manager (Vault) entries

!cred_veeam
Admin Medium

Extracts Veeam Backup target credentials from SQL Express (DPAPI-decrypted)

!cred_wifi
Admin Low

Extracts WPA2-PSK passwords for all saved WiFi profiles in plaintext

!wifi
User Low

Simplified WiFi credential harvester runnable without admin rights

Discovery System, network, domain and security configuration reconnaissance. 26 modules
!ad_wmi
User Low

Full AD enumeration via LDAP: users, groups, computers, DCs, GPOs, OUs

!ca_enum
User Low

ADCS audit: finds all CAs, certificate templates and ESC1–ESC4 vulnerabilities

!deleg_enum
User Low

Finds all Kerberos delegation accounts: unconstrained, constrained, RBCD

!disco_gpp_cpassword
User Low

Finds and decrypts GPP cpassword entries in SYSVOL (MS14-025)

!discover_applocker
User Low

AppLocker policy audit: enforced rules, bypass paths, WDAC/HVCI status

!drives
User Silent

Lists all drives with type, free/total space and volume label

!env
User Silent

Lists all environment variables; finds API keys, tokens, proxy settings

!event_logs
Admin Medium

Queries Windows Security/System/Application event logs; filterable by event ID

!gpo_enum
User Low

Enumerates GPOs and highlights security-relevant settings: scripts, drive maps

!info
User Medium

Comprehensive system info: OS, hardware, network, user, AV, patch level

!installed
User Low

Lists installed software from registry (name, version, publisher, date)

!laps_enum
User Low

Checks for LAPS deployment; reads ms-Mcs-AdmPwd if read access is granted

!patches
User Low

Lists installed hotfixes and KB numbers; identifies missing security patches

!permissions
User Low

Lists and modifies file/folder ACLs (DACL ACEs); takeown and grant ops

!position
User Medium

IP-based geolocation + Windows Location API for physical location estimation

!processes
User Silent

Lists all running processes with PID, user, memory and command line

!rdp
User Low

Shows RDP config: enabled, NLA, port, active sessions, Remote Desktop Users

!scheduled_tasks
User Low

Lists all scheduled tasks with status, trigger, command and run-as account

!scout
User Medium

Quick security recon: AV/EDR, firewall, UAC level, Defender exclusions, quick wins

!services
User Medium

Lists all Windows services with status, startup type and run-as account

!session_enum
User Medium

Enumerates active logged-in users via qwinsta and NetWkstaUserEnum WMI

!spn_scan
User Low

LDAP SPN scan: finds user/computer accounts for Kerberoast and delegation abuse

!startup
User Low

Lists all auto-start entries: Run keys, Startup folders, WMI subscriptions, logon scripts

!tokens
User Silent

Shows current process token: SIDs, groups, privileges, integrity level

!users
User Low

Lists local user accounts (last logon, password expiry) and group memberships

!whoami
User Silent

Current user context: SID, UPN, domain membership, Kerberos tickets, integrity level

Domain Domain controller-specific, high-value domain-level attack modules. 1 modules
!dc_sync
Admin High

Checks DCSync rights (DS-Replication-Get-Changes); lists all principals with replication permission

Evasion Detection avoidance, forensic trace minimization and security tool neutralization. 11 modules
!cleanup
Admin High

Clears forensic traces: PSReadLine, event log entries (4688/4103/4104), temp files, prefetch

!defender_check
User Low

Checks Windows Defender and all AV/EDR status; lists exclusions

!evade_amsi
User Medium

Patches AmsiScanBuffer in current PS session memory to disable AMSI

!evade_etw
User Medium

Patches EtwEventWrite in ntdll.dll to suppress ETW telemetry from process

!evade_parent_spoof
User High

Spawns a new process with spoofed PPID via UpdateProcThreadAttribute

!evade_sandbox
User Silent

Detects sandbox environments: CPUID, VM artifacts, process count, user interaction

!evade_scriptblock
User Low

Disables PS Script Block Logging (Event 4104) via in-memory automation cache patch

!evade_sleep_obf
User High

XOR-encrypts agent memory during C2 sleep intervals to evade memory IOC scanners

!evade_timestomp
User Medium

Modifies NTFS timestamps to match a legitimate file or a set/random date

!evade_vm
User Silent

Detects VM environments: CPUID hypervisor bit, SMBIOS data, VM drivers

!evasion
User High

Evasion status dashboard: AMSI patch, ETW block, Script Block Logging state

Execution Run commands, .NET assemblies, BOFs and shellcode locally and on remote machines. 10 modules
!asm
User High

Reflective .NET assembly loading and execution in memory via Assembly.Load()

!bof
User Low

Executes COFF x64 BOF files in memory with CS-compatible BeaconOutput API

!exec
User Variable

Executes arbitrary PowerShell commands and returns output to C2

!lat_dcomexec
Admin Medium

DCOM lateral movement via MMC20.Application, ShellBrowserWindow or ShellWindows

!lat_psexec
Admin High

PSExec-style lateral movement: creates temp Windows service on target via SMB

!lat_schedtask
Admin Medium

Remote scheduled task creation for lateral movement; task deleted after execution

!lat_smbexec
Admin High

Fileless SMB service command chaining; no PE written to disk

!lat_winrmexec
User Medium

WinRM/PS Remoting lateral movement via Invoke-Command

!migrate
Admin Critical

Injects shellcode into target process memory or fully migrates the agent

!powershell
User Medium

Spawns a detached hidden PowerShell process; fire-and-forget execution

Impact Business impact demonstration for authorized security audits. 1 modules
!audit
Admin High

Ransomware simulation (dry-run/live) with reversible RSA+AES hybrid encryption; tiers: full/large/smart

Navigation File system browsing and navigation on the target machine. 7 modules
!cd
User Silent

Changes the agent's current working directory

!ls
User Silent

Lists directory contents with size, date, attributes and hidden files

!netshares
User Low

Discovers mapped network drives, SMB mappings and UNC paths

!pwd
User Silent

Prints the agent's current working directory

!recent_files
User Low

Lists recently accessed files from Recent folder, MRU registry and Jump Lists

!search
User Low

Recursive file search by name pattern or extension; --content for grep-style search

!tree
User Silent

Displays directory tree with optional depth limit and size totals

Network Network communication, lateral movement infrastructure and pivot tunneling. 17 modules
!arp
User Silent

Shows ARP table (IP-MAC pairs); --scan for active ARP scan of subnet

!dns
User Medium

DNS server config, local cache contents, name resolution test and cache flush

!dns_c2
User High

DNS C2 channel: polls commands via TXT queries, exfiltrates via A record queries

!firewall
User Medium

Shows Windows Firewall profiles, all rules and open/blocked port summary

!interfaces
User Silent

Detailed network interface config: IP, MAC, gateway, DNS, DHCP, type

!lat_rdp
Admin Medium

RDP management: enable/disable, firewall rule, backdoor user, Restricted Admin, NLA

!lat_winrm
Admin Medium

WinRM full toolkit: check, test, remote exec with alt credentials, /24 subnet scan

!netstat
User Silent

Lists active TCP/UDP connections and listening ports with process name

!ping_sweep
User Medium

ICMP or TCP SYN subnet sweep; --tcp 445 for SMB-reachable targets

!pivot
User Medium

Port forwarding through agent to internal targets not reachable from C2

!portscan
User Medium

Fast TCP port scan; supports port list, top 20 or top 100 common ports

!responder_poison
Admin High

Pure-PS Responder: LLMNR/NBT-NS/mDNS poisoning to capture NTLMv2 hashes

!routes
User Silent

Shows Windows routing table (IPv4/IPv6): destination, gateway, interface, metric

!smb_pipe
User High

SMB Named Pipe C2 relay for agents in internet-isolated segments

!smbshares
User Medium

Lists SMB shares on local or remote host; --access tests actual read access

!socks5
User Medium

Starts SOCKS5 proxy on target for proxychains/Burp/Metasploit tunneling

!wmi_exec
Admin Medium

Remote command execution via WMI Win32.Process.Create (no SMB service creation)

Persistence Ensure the agent survives reboots using multiple complementary techniques. 4 modules
!persist
User High

Smart persistence manager: Run key, Startup folder, scheduled task (user); service + WMI (admin)

!persist_lsa
Admin High

Registers LSA SSP DLL that loads into LSASS on every boot and intercepts cleartext creds

!persist_service
Admin Medium

Creates auto-start Windows service (SYSTEM); supports service binary path hijacking

!persist_wmi
Admin High

WMI event subscription persistence (startup/time/process/logon); undetectable by disk scans

Privilege Escalation Obtain local administrator rights and manipulate process tokens. 18 modules
!auto_elevate
User High

UAC bypass via fodhelper.exe autoelevate (HKCU ms-settings shell hijack)

!elevate
User High

UAC bypass via cmstp.exe autoelevate binary (INF file execution)

!ppid
User High

Spawns process with spoofed parent PID via UpdateProcThreadAttribute API

!privesc
User Low

PrivEsc scanner: UAC bypass applicability, vulnerable services, token privs, AlwaysInstallElevated

!priv_alwaysinstall
Admin Medium

Exploits AlwaysInstallElevated to run commands as SYSTEM via MSI installer

!priv_backup
User Medium

Exploits SeBackupPrivilege to read any file without DACL check (SAM, NTDS.dit)

!priv_migrate
User High

Migrates agent to another process via token steal or PPID-spoofed PS spawn

!priv_namedpipe
User High

Named pipe impersonation: waits for privileged process to connect, steals its token

!priv_potato
Admin Medium

Potato-style SYSTEM token via SeImpersonatePrivilege + Named Pipe impersonation

!priv_restore
User High

Exploits SeRestorePrivilege to write any file without DACL check (service DLL swap)

!priv_sam_copy
Admin High

Copies SAM/SYSTEM/SECURITY hives via reg.exe save for offline NTLM hash extraction

!priv_services
Admin Low

Service misconfiguration scanner: unquoted paths, writable binaries, weak registry ACLs

!priv_token_theft
Admin Medium

Lists process tokens; steals selected PID token to spawn commands in that context

!priv_tok_impersonate
User High

Thread-level token impersonation from privileged processes; --user SYSTEM targeting

!priv_uac_computerdefaults
User Medium

UAC bypass via computerdefaults.exe (ms-settings shell hijack, Win10/11)

!priv_uac_eventvwr
User Medium

UAC bypass via eventvwr.exe MSC file hijack (Win7–10 classic technique)

!priv_uac_sdclt
User Medium

UAC bypass via sdclt.exe IsolatedCommand registry value (Win10)

!priv_uac_wsreset
User Medium

UAC bypass via wsreset.exe (AppX shell command hijack, Win10 1803+/Win11)

Ready to get started?

Start a 14-day free trial.

View Pricing Talk to Us