Anonymous purple-team toolsmith. Single-file tooling and references for air-gapped, incident-response, and hardened environments — defense built on understanding offense.
No install. No dependencies. No agents. No telemetry.
Offensive techniques and the detections that catch them — two halves of one workflow.
- Purple by design — attack techniques paired with the telemetry and detections that expose them
- Single-file execution — one script (or one HTML), run and done
- No installation, no prerequisites, no admin infrastructure
- Air-gap friendly — works fully offline
- MITRE ATT&CK aligned — both findings and techniques mapped to tactics
- Dark HTML output — structured, self-contained, ready to share
Detection, triage, hardening and forensics. Built for SOC/DFIR work in real environments.
| Tool | Platform | Capability |
|---|---|---|
| ZavetSec-DLP | Windows / .NET 8 | Endpoint activity monitoring • keylogger • screenshots • clipboard • USB • DNS • network • web dashboard • EN/RU |
| Tool | Platform | Capability |
|---|---|---|
| Invoke-ZavetSecTriage | Windows / PS 5.1 | DFIR triage • 17 modules • MITRE ATT&CK |
| ZavetSec-EVTXHunter | Windows / PS 5.1 | EVTX threat hunting • file & live • 61 rules / 10 chains • entity risk scoring • MITRE ATT&CK |
| ZavetSec-Harden | Windows / PS 5.1 | Hardening baseline • CIS / DISA STIG • Audit / Apply / Rollback |
| ZLT | Linux / Bash | Linux triage • 12 modules • single command |
| Invoke-ADSecurityAudit | Windows / PS 5.1 | Active Directory audit • findings • remediation |
| ZavetSec-NetworkInventory | Windows / PS 5.1 | Network scanner • asset inventory • offline |
| ZavetSec-NetworkConnections | Windows / PS 5.1 | Live connections • GeoIP • process context • risk |
| ZavetSec-BrowserHistory | Windows / PS 5.1 | Browser forensics • all users • all browsers |
| Invoke-MBHashCheck | Windows / PS 5.1 | Hash lookup • MalwareBazaar • ThreatFox |
| ZavetSec-Vault | Any browser | Offline password manager • AES-256-GCM • no cloud |
| Tool | Platform | Capability |
|---|---|---|
| opsec-checklist | Any browser | OPSEC assessment framework • 70+ items • RU/CIS + US/EU editions |
The other half: a self-contained library of pentest references — built to understand the attacks worth defending against. Same design standard as the tooling: one HTML file per document, fully offline, zero dependencies, no trackers.
🌐 Live: zavetsec.github.io/pentestcodex · 📦 Repo: zavetsec/pentestcodex
| Document | Type | Contents |
|---|---|---|
| Pentest Codex | Reference | Full kill-chain • every tool explained • every command with flags • 16 sections |
| AD Attack Reference | Reference / AD | ADCS ESC1–ESC16 • delegation • RBCD • Shadow Credentials • ACL abuse • GPO/SCCM • MSSQL lateral |
| Pentest Path | Roadmap | Blue→Red progression • PNPT → OSCP → CRTO • labs • habit checklist |
| Arsenal | Cheat-sheet | Command-first reference across the attack phases |
| Kali Linux 2026 Guide | Distro | Install • metapackages • tooling by menu category |
| Parrot OS 7 Guide | Distro | Editions • AnonSurf / privacy • tooling • vs Kali |
Everything ZavetSec ships — tools and references alike — shares one output format:
#0a0d10dark background — readable in SOC environments at 3 AM#00ff88green accent — high contrast, low eye strain- JetBrains Mono for code and data, Rajdhani for headers
- Severity tag badges, MITRE ATT&CK references inline
- 100% self-contained HTML — one file, no CDN, no external requests
BLUE — Defensive Tooling
Endpoint Monitoring ZavetSec-DLP
Windows Triage Invoke-ZavetSecTriage
Event Log Hunting ZavetSec-EVTXHunter
Linux Triage ZLT
Active Directory Invoke-ADSecurityAudit
Network Discovery ZavetSec-NetworkInventory
Live Connections ZavetSec-NetworkConnections
Browser Forensics ZavetSec-BrowserHistory
Hash Intel Invoke-MBHashCheck
Hardening ZavetSec-Harden
Secure Storage ZavetSec-Vault
Personal OPSEC opsec-checklist
RED — Offensive Reference
Pentest Codex zavetsec.github.io/pentestcodex
Attack-informed defense. Detection-aware offense.
MIT Licensed — open, practical, unrestricted.