Join us at Black Hat 2025 for training, open-source tools, and insights in identity security. Learn More
Open Source Tools

Ghostwriter

Ghostwriter is an open-source platform that enhances offensive security operations by streamlining reporting, asset tracking, and assessment management. It provides tools for managing clients, developing findings in a library that can be used across multiple assessments, and organizing infrastructure and domains used during assessments. Ghostwriter’s powerful reporting engine includes collaborative writing features and customizable report templates, enabling teams to produce polished deliverables with minimal manual effort. Further, Ghostwriter supports integrations with tools like Mythic C2 and Cobalt Strike allow for automatic activity logging, role-based access controls, and single sign-on for authentication. These features make Ghostwriter an ideal centralized and collaborative environment for red teams and consultants to efficiently plan, execute, and document their assessments.

Download on GitHub
Ghostwriter

Explore other tools

BloodHound Community Edition

Manage Identity Attack Paths across your hybrid environment and remove the adversary’s favorite target.

BloodHound Community Edition

Read more

Mythic

Mythic is an open-source Command and Control (C2) framework designed around a microservice architecture.

Mythic

Read more

Nemesis 2.0

Nemesis 2.0 functions as an "offensive VirusTotal," automatically processing files collected during security assessments through an extensive pipeline of specialized analyzers.

Nemesis 2.0

Read more

Join the conversation

Learn from others and share your story on the BloodHoundGang Slack Community

Connect with us

You might also be interested in

Cover of the State of APM report
White Papers

The State of Attack Path Management

Our inaugural report highlights why Identity Security is increasingly complex, and why it's difficult to execute without Attack Path Management. We're shifting the conversation from static checklists to the dynamic attack graph.

Read more

Datasheets

Go Beyond Traditional Boundaries with Privilege Zones in BloodHound

Identity security practices have long supported a model of separating assets into secure management categories as part of a privileged access strategy, whether those be legacy directory services systems or modern hybrid or cloud environments. The most critical assets are often classified as Tier Zero (or the Control Plane).

Read more

Purple SpecterOps logo
White Papers

The Renaissance of NTLM Relay Attacks: Everything You Need to Know

NTLM relay attacks are still viable and more dangerous than ever, despite the common belief that the problem has been solved or minimized.

Read more