Small, sharp tools for internal engagements, sysadmin work, and CTFs.
Built to run with no fuss: standard-library-first, Kali-friendly, and honest in their docs about the trade-offs they make.
| Repo | What it does | Stack |
|---|---|---|
scanner (tcpsweep) |
Dependency-free, single-file TCP connect sweeper — an nc -z-style port sweep with CIDR/range targets, threading, rate limiting, and nmap-style output formats. |
Python |
| smbex | Ranger-style TUI file explorer for SMB, SSH/SFTP, and FTP/FTPS — built for slow, unreliable links, with listing caches, background downloads, and optional on-box filename translation. | Python |
| scribe | Local-only shell wrapper that documents an interactive remote-shell session as you work it. | Python |
| Simple-ADExplorer | Lightweight viewer for Sysinternals ADExplorer snapshots and BOFHound output — browse Active Directory data without standing up the full stack. | Python |
| Simple-GPO-Explorer | Drop in a zip of Group Policy Objects and pull them apart fast — built with CTF-speed triage in mind. | Python |
| SCTFCM | Local web scratchpad for CTF credentials — usernames, passwords, hashes, and context — with search operators, password/hash reuse detection, and Markdown/Hashcat export. No encryption, so local/lab use only. | Python/JS |
| tmux-sessions | Simple tmux session manager. | Python |
| tiny_helpers | Grab-bag of small tools and configs for a more pleasant shell life. | Shell |
| vidsr | Multi-frame super-resolution for video — fuses many frames of one region (a plate, a sign, a badge) into one sharper image. Measurement-based, not generative. | Python |
| sshcatch | Userland SSH/SFTP Server to catch (reverse) connections - never opens a shell. | Python |
| socksscope | Wrap a Socks5 Proxy to restrict connections and adjust DNS requests through it (resolving and /etc/hosts like). | Python |
- Standard library first. Most tools install with zero or near-zero third-party dependencies, and several run straight from a single file if
pip/pipxisn't an option. - Kali-aware. Where it matters (
smbex), install paths coverapt-only boxes explicitly, not justpip. - Documented trade-offs, not hidden ones. Where a tool departs from "reference" protocol behavior (see
smbex's design notes on tree-connect churn, host-key trust, and FTPABORhandling), that's written down rather than left for someone to discover the hard way. - Data hygiene. Tools that write scan or session output do so to files scoped for the operator only (owner-readable,
.gitignore'd by default).
Everything here is intended for environments you own, or have explicit written permission to test — internal infrastructure, lab environments, and CTF ranges. Scanning, browsing, or documenting sessions against systems you don't have authorization for is not what these tools are for.
Most repos are pip/pipx-installable:
pipx install tcpsweep
pipx install smbexEach repo's own README has full install instructions (including apt-only paths for Kali where relevant), usage examples, and — where the tool touches a network protocol — notes on how it behaves compared to the reference client.
Simple-ADExplorer and GPO-Explorer are local web apps and also ship as container images, published via GitHub Actions on every tagged release:
docker pull ghcr.io/nm1ss/simple-adexplorer:latest
docker pull ghcr.io/bearlystable/gpo-explorer:latestBoth images are intended for local/internal use only — the apps they run can hold sensitive AD data (credentials, security descriptors, GPO contents), so don't expose the container to an untrusted network. Pin to a version tag (e.g.
:1.0.0) for anything beyond a quick look; each repo's README has the fulldocker run/docker composesetup, including persistent-volume and backup/restore instructions.
Repos are individually licensed — mostly MIT, with a couple under GPL-3.0 and one under AGPL-3.0. Check each repo for specifics.
A few of these repos note Claude Sonnet as an assistant in their development. Human-reviewed, human-shipped.
Questions, bugs, or ideas — open an issue on the relevant repo.
