Powershell Toolkit Collection

• PowerMemory: https://github.com/giMini/PowerMemory
  Exploit the credentials present in files and memory
• ReflectiveDLLInjection: https://github.com/stephenfewer/ReflectiveDLLInjection
  Reflective DLL injection is a library injection technique that is primarily used to perform the loading of a library from memory to host processes. The library should therefore be able to load itself by implementing a minimal PE file loader, managed with minimal interaction between the host system and processes.
• ThrowbackLP: https://github.com/silentbreaksec/ThrowbackLP
  Monitor station reverse injection
• Throwback: https://github.com/silentbreaksec/Throwback
  HTTP/S Beaconing Implant
• CrackMapExec: https://github.com/byt3bl33d3r/CrackMapExec
  A swiss army knife for pentesting Windows/Active Directory environments
• nishang: https://github.com/samratashok/nishang
  Nishang is a PowerShell-based penetration testing tool. Integration of frameworks, scripts and various payloads. These scripts are written by Nishang’s author in the real penetration testing process, with actual combat value. Including the download and execution, keyboard records, dns, delay commands and other scripts.
• UnmanagedPowerShell: https://github.com/leechristensen/UnmanagedPowerShell
  Executes PowerShell from an unmanaged process. With a few modifications, these same techniques can be used when injecting into different processes (i.e. you can cause any process to execute PowerShell if you want).
• Empire: https://github.com/powershellempire/empire
  Empire is a PowerShell and Python post-exploitation agent. http://www.powershellempire.com/
• Unicorn: https://github.com/trustedsec/unicorn
  Unicorn is a simple tool for PowerShell downgrade attacks and direct injection of shellcode into memory.
• PowerShell: https://github.com/clymb3r/PowerShell
  The tools in this directory are part of PowerSploit and are being maintained there. They are preserved here for legacy, but any bug fixes should be checked in to PowerSploit.
• PSRecon: https://github.com/gfoss/PSRecon
  PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
• PowerShell: https://github.com/MikeFal/PowerShell
  Powershell scripts for SQL Server database administration
• PowerTools Tools: https//github.com/PowerShellEmpire/PowerTools
  
  PowerTools is a collection of PowerShell projects with a focus on offensive operations.
• PowerShellArsenal: https://github.com/mattifestation/PowerShellArsenal
  PowerShell module for reverse engineering, can be disassembled hosting and unmanaged code, for. NET malware analysis, analysis of memory, parsing file formats and memory structure, access to internal system information.
• PowerShell API Manual: http://www.pinvoke.net/
  PInvoke.net is primarily a wiki that allows developers to find, edit, and add PInvoke’s * signatures, user-defined types, and any other information associated with calling managed code for Win32 and other unmanaged APIs.
• The AD-Recon-PowerShell: https://github.com/PyroTek3/PowerShell-AD-Recon
  A useful PowerShell script
• The PowerCat: https://github.com/secabstraction/PowerCat
  PowerShell TCP / IP Swiss Army Knife for Netcat & Ncat.
• Honeyport: https://github.com/Pwdrkeg/honeyport
  A PowerShell script for creating Windows honeyport
• PowerShellMafia: https://github.com/PowerShellMafia/PowerSploit
  PowerSploit is the set of PowerShell modules in Microsoft that can help Infiltrators evaluate at all stages.
• Secmod-Posh: https://github.com/darkoperator/Posh-SecMod
  PowerShell Module with Security cmdlets for security work
• Harness: https://github.com/Rich5/Harness
  Interactive remote PowerShell Payload