tstck builds advanced offensive tooling for red teams, pentesters and security researchers — and runs the engagements that put it to work. Built to go deeper, expose weaknesses, and break through the layers.
The tools we build come out of the engagements we run, and the engagements go further because of the tools. Each one sharpens the other.
Scanners, exploitation frameworks, patch-diffing and cracking utilities. Some of it is open source and published under GPL‑3.0. Other work is closed source, available exclusively to governments and law enforcement agencies.
See the toolsFrom first foothold to final objective. We run engagements built around how capable adversaries think, move, and pursue their objectives — combining deep technical analysis with our own offensive tooling.
How we operateThree published tools, each aimed at a layer most scanners stop short of — the plugin, the patch, the password. Plus the work we do not publish.
Not published. Not for sale. Some of what we build is never released publicly. Access is limited to government and law enforcement agencies, subject to vetting, jurisdiction and a written agreement.
One bad plugin. Total compromise. A WordPress exploitation framework for authorized testing — 334 exploit modules, a stack-fingerprinting scanner and a terminal cockpit for chaining them from auth to payload.
Find the fix. Find the bug. Patch diffing for vulnerability research: feed it two releases and it isolates what actually changed, filters out the noise and hands you a reviewable repo of both states.
When swapping characters is a must. A multi-threaded candidate generator for rule-based cracking, covering the partial character substitutions hashcat and John cannot express without a rule explosion.
We look at how weaknesses connect. An exposed service can become a foothold. A misplaced permission can unlock greater access. A trusted connection can open the next layer.
We follow those opportunities toward agreed objectives, challenging your organisation’s ability to detect, investigate and respond as the attack develops.
We find the way through. You gain the insight to close it.
Tell us what matters most in your environment. We will come back with a scope, a realistic set of objectives and a plan for getting there.
Red team engagements, scoping questions and timelines. Tell us what you want tested and what success looks like.
contact@tstck.ioBugs, feature requests and contributions for our published tools go through the repositories, where the work happens in the open.
github.com/etragardhGovernment and law enforcement enquiries about our restricted tooling. Expect a vetting process before anything is discussed in detail.
contact@tstck.io