Curated list of resources about Rust language used for offensive security & red teaming.
List inspired by the awesome list thing.
- Coffee: A COFF loader made in Rust
- Rasta Mouse Custom Beacon Artifacts
- Writing Sliver C2 Extensions in Rust
- Black Hat Rust - Applied offensive security with Rust.
Boilerplates for Rust language used for offensive security & red teaming.
... Coming soon
- ADPT - DLL proxying for lazy people.
- DInvoke_rs - Dynamically invoke arbitrary unmanaged code.
- Dumpy - Reuse open handles to dynamically dump LSASS.
- Bin Finder - Detect EDR's exceptions by inspecting processes' loaded modules.
- Shelter - ROP-based sleep obfuscation to evade memory scanners.
- Unwinder - Call stack spoofing for Rust.
- RustChain - Hide memory artifacts using ROP and hardware breakpoints.
- CustomEntryPoint - Select any exported function in a dll as the new dll's entry point.
- Split - Apply a divide and conquer approach to bypass EDRs.
- Fiber - Using fibers to run in-memory code.
- EPI - Threadless Process Injection through entry point hijacking.
- RustHollow - Inject a shellcode in a remote process using Process Hollowing.
- Eagle-rs - Rusty Rootkit - Windows Kernel Rookit in Rust (Codename: Eagle).
- Illusion-rs - Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion).
- Matrix-rs - Rusty Hypervisor - Windows Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)
- Venom-rs - Rusty Injection - Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom).
- Arsenal-rs - Rusty Arsenal - A collection of experimental Process Injection and Post-Exploitation Techniques in Rust.
- Redlotus-rs - Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus).
- Crabby - WebShell for Red Teams, just easily.
- Cerbero - Kerberos protocol attacker.
- RustHound - Active Directory data collector for BloodHound written in Rust.
- Feroxbuster - A fast, simple, recursive content discovery tool written in Rust.
- Offensive Rust - A collection of offensive security tools written in Rust.
- OffensiveRust - Rust Weaponization for Red Team Engagements.
- RustRedOps - RustRedOps is a repository dedicated to gathering and sharing advanced techniques and offensive malware for Red Team, with a specific focus on the Rust programming language.
- RustScan - The Modern Port Scanner.
- Sniffglue - Secure multithreaded packet sniffer.
- Goblin - An impish, cross-platform binary parsing crate, written in Rust.
- Ripgrep - Ripgrep recursively searches directories for a regex pattern while respecting your gitignore.
- Rust for Malware Development - Rust for malware development and for low level stuffs.
- Moonwalk Back - Cover your tracks during Linux Exploitation by leaving zero traces on system logs and filesystem timestamps.
- Bore - bore is a simple CLI tool for making tunnels to localhost.
- Ppfuzz - A fast tool to scan client-side prototype pollution vulnerability written in Rust.
- Ripgen - Rust-based high performance domain permutation generator.
- Pyscan - Python dependency vulnerability scanner, written in Rust.
- Freeze.rs - Freeze.rs is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls written in RUST.
- Haylxon - Blazing-fast tool to grab screenshots of your domain list right from terminal.
- WStunnel - Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available.
- Hrekt - A really fast http prober.
- Qscan - Quick network scanner library.
- Osintui - OSINT from your favorite services in a friendly terminal user interface - integrations for Virustotal, Shodan, and Censys.
- Skanuvaty - Dangerously fast DNS/network/port scanner
- Noseyparker - Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history.
- Rusty Hog - A suite of secret scanners built in Rust for performance. Based on TruffleHog.
- Lorsrf - Fast CLI tool to find the parameters that can be used to find SSRF or Out-of-band resource load.
- Scrying - A tool for collecting RDP, web and VNC screenshots all in one place.
- X8 - Hidden parameters discovery suite
- Findomain - The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain monitoring, alerts via Discord, Slack and Telegram, multiple API Keys for sources and much more.
- Legba - A multiprotocol credentials bruteforcer / password sprayer and enumerator.
- Rust Syscall - Single stub direct and indirect syscalling with runtime SSN resolving for windows.
- GhostDriver - GhostDriver is a Rust-built AV killer tool using BYOVD.
- NovaLdr - Threadless Module Stomping In Rust with some features (In memory of those murdered in the Nova party massacre).
- Litcrypt - A Rust compiler plugin to encrypt string literal at compile time.
- LibAFL - Advanced Fuzzing Library - Slot your Fuzzer together in Rust! Scales across cores and machines. For Windows, Android, MacOS, Linux, no_std, ...
Found an awesome package, article, blog, video etc.? Send me a pull request! Just follow the guidelines. Thank you!
