PT+ 3 · C2, Wireless & Stego Tools

Caldera

MITRE automated adversary emulation (uses ATT&CK technique IDs)

Atomic Red Team

Small self-contained tests, each mapped to an ATT&CK technique

Infection Monkey

Self-propagating breach-and-attack-simulation agent; tests segmentation

Mythic

Docker-based collaborative C2; macOS payloads Apfell and Poseidon

Empire

C2 framework deploying PowerShell/Python agents

Covenant

.NET/C# C2 with a web UI

airmon-ng

Aircrack-ng tool that puts a wireless adapter into monitor mode

airodump-ng

Aircrack-ng tool that captures raw 802.11 frames

aireplay-ng

Aircrack-ng tool that injects frames (deauth/replay)

aircrack-ng

Cracks captured WEP/WPA keys

Reaver

Brute-forces the WPS PIN

Wifite

Automates WEP/WPA/WPS attacks by driving other tools

Kismet

Passive wireless sniffer and IDS; finds hidden networks, no transmit

WiFi-Pumpkin

Rogue AP / evil-twin framework

EAPHammer

Attacks WPA2-Enterprise via rogue AP and fake RADIUS

Spooftooph

Spoofs or clones a Bluetooth device (needs root)

Bluestrike

Disrupts Bluetooth communication / disconnection attacks

SNOW

Hides data in whitespace and tabs of text

OpenStego

Hides messages in images; watermarking

Steghide

Image and audio steganography

Coagula

Turns an image into audio (shows in a spectrogram)

Alternate Data Streams (ADS)

NTFS feature that hides data in a named stream, invisible to normal dir listing