Skip to content
View Real-Fruit-Snacks's full-sized avatar
2 followers · 0 following

Block or report Real-Fruit-Snacks

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don't include any personal information such as legal names or email addresses. Markdown supported. This note will be visible to only you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Real-Fruit-Snacks/README.md

Real-Fruit-Snacks

Building offensive security tools — one wave at a time

Python Go C Assembly JavaScript TypeScript Shell

Featured Projects


Siphon

Lightweight C2 — ECDH P-256 forward secrecy, AES-256-GCM encryption, uTLS fingerprinting

Docs Go


Aquifer

Linux post-exploitation — kernel namespace isolation, polymorphic beacons, 36 stealth modules

Docs Go


Riptide

Collaborative browser terminal — real-time sync, credential vault, variable substitution

Docs JS


Vapor

Encrypted reverse shell + Hell's Gate process injector in pure x86_64 NASM assembly

Docs ASM

Streak

C2 & Post-Exploitation

Tool What It Does Language
Flux Swiss Army Netcat — replaces nc/ncat/socat/pwncat. TLS + Noise encryption, auto-PTY shells, file transfer with SHA256, SOCKS5 pivoting, TCP scanning. Single static binary. Rust
Conduit SOCAT relay with kernel-level process masquerading — prctl/setproctitle stealth, argument hiding, 50+ channel types C
Aquifer Linux post-exploitation — kernel namespace isolation, multi-channel C2, polymorphic beacons, 36 stealth modules Go
Siphon Lightweight C2 — ECDH P-256 forward secrecy, AES-256-GCM transport, uTLS Chrome fingerprinting Go
Wellspring Payload delivery server — 12 delivery methods, token-gated access, AES-256-GCM at rest, memory zeroing. Single binary. Go
Spillway Reverse/bind/dormant FUSE mount — browse remote filesystems locally over TLS 1.3 with mutual PSK auth Go
Undertow Static SSH server — reverse/bind shells, SFTP, port forwarding, TLS wrapping with SNI spoofing. Under 1.5 MB. Go
Slipstream Drop-in SSH wrapper — tunnel management, file transfers, passive filesystem mapping, per-command logging, fingerprint identity Rust
Depth Full SSH-2.0 in pure assembly — ChaCha20-Poly1305, Ed25519, X25519, SFTP, PTY, port forwarding. 94 KB static ELF, no libc. ASM

Shells & Implants

Tool What It Does Language
Vapor Encrypted reverse shell + process injector in pure x86_64 NASM — ChaCha20-Poly1305 AEAD, Hell's Gate syscalls, zero deps ASM
Grotto Encrypted netcat in pure assembly — ChaCha20-Poly1305, Linux ELF + Windows PE, ~8 KB, zero dependencies ASM
Dew HTTPS reverse shell — XChaCha20-Poly1305 over TLS, ~37 KB binary, zero dependencies C
Droplet HTTPS reverse shell for Windows — ~50 KB C implant, AES-256 encryption, interactive Python listener C
Undercurrent io_uring stealth loader in pure assembly — ChaCha20-Poly1305, ~4.2 KB, invisible to syscall monitoring ASM

Enumeration & Exploitation

Tool What It Does Language
Riptide Collaborative browser terminal — real-time sync, credential vault, variable substitution, session recording, playbook workspace JS
Runoff AD security audit — extract quick wins, attack paths, and misconfigurations from BloodHound CE Python
Maelstrom NetExec wrapper — 35+ AD enumeration modules in one command, multi-target scanning, actionable recommendations Python
Rapids Credential spraying framework — 28 native protocol modules, adaptive skipping, pass-the-hash support Python
Seep Windows privesc enumeration — 16 checks, 97 tools, MITRE ATT&CK mapping, fileless agent, single-file HTML reports Python
Whirlpool Privesc reasoning engine — parses LinPEAS/WinPEAS output, generates ranked exploitation playbooks Python

Reference & Environments

Tool What It Does Language
Shallows Browser-native Linux terminals — x86 emulation in the browser. No servers, no installs, no accounts. JS
Ripple Browser-based Vim editor — full keybindings via CodeMirror 6, split panes, tabs, virtual filesystem, zero dependencies JS
Deluge Nmap & RustScan parser — color-coded terminal reports, multi-format export, interactive scanning, Catppuccin styling Python
Surge Markdown-to-command-reference — fuzzy search, variable substitution, offline-first PWA, Catppuccin themes JS
Fathom Offline man pages browser — TLDR summaries, instant search, Catppuccin themes. PWA, works without internet. JS
Cascade Native markdown editor — real-time collaboration, live preview, wiki-links, canvas whiteboard, 21+ themes. Tauri + Rust. TS
Sunken-Archive Personal knowledge base — digital garden with interconnected notes, graph view, full-text search. Built on Quartz. TS
HydroShot Screenshot capture & annotation — region select, drawing tools, copy/save. Built with Rust, winit, tiny-skia. Rust
Tidepool Interactive terminal portfolio — explore a developer profile through real shell commands in the browser via xterm.js JS
Deadwater Research publication platform — index, search, and serve computational papers. Full-text search, citation graph, API. TS

AI & Enterprise

Tool What It Does Language
armsforge AI-powered security platform — intelligent automation, Claude Code integration, workflow orchestration for offensive operations TS

Utilities

Tool What It Does Language
Tidemark Obsidian plugin — variable substitution in markdown via YAML frontmatter. Copy, replace, rename in one command. TS
LigoloSupport One-command ligolo-ng setup — auto-downloads binaries, configures TUN, guides pivoting. Zero to tunneling in 30 seconds. Shell

Snake

Followers Repos Focus

All tools are built for authorized security testing and educational purposes.

Popular repositories Loading

  1. Riptide Riptide Public

    Collaborative browser-based terminal and playbook workspace for penetration testing, CTF competitions, and red team operations — real-time sync, credential vault, variable substitution, output pars…

    JavaScript 4 1

  2. Siphon Siphon Public

    Lightweight C2 framework for red team operations — ECDH P-256 forward secrecy, AES-256-GCM encryption, uTLS Chrome fingerprinting

    Go 4 1

  3. LigoloSupport LigoloSupport Public

    One-command ligolo-ng tunnel setup — auto-downloads binaries, configures TUN interface, guides pivoting. Zero to tunneling in 30 seconds.

    Shell 1

  4. Deluge Deluge Public

    Advanced parser and formatter for Nmap and RustScan outputs — color-coded terminal reports, multi-format exports, interactive scanning with Catppuccin styling

    Python 1

  5. Whirlpool Whirlpool Public

    Privilege escalation reasoning engine — parses LinPEAS/WinPEAS output and generates ranked exploitation playbooks

    Python 1

  6. Rapids Rapids Public

    Modular credential spraying tool for authorized security testing — 28 native Python protocol modules, automatic port scanning, adaptive skipping, pass-the-hash support

    Python