Windows security testing,
focused.
WinRaider 2.0 is a Python-based Windows security assessment and penetration-testing toolkit for authorized testing, research, and educational lab environments.
One CLI. Seven services.
WinRaider combines service discovery, authenticated assessment, vulnerability checks, credential auditing, and optional Metasploit integration.
Network scanning
Scans ports 445, 3389, 5985, 5986, 139, 135, and 22 across common Windows/network services.
Authenticated testing
Supports authorized SMB file access, RDP GUI, WinRM shell, and SSH shell testing with supplied credentials.
Vulnerability assessment
Checks for EternalBlue/MS17-010, BlueKeep/CVE-2019-0708, SMBGhost/CVE-2020-0796, WinRM weaknesses, NetBIOS disclosure, and SSH vulnerabilities.
Credential testing
Accepts username and password wordlists for controlled credential-security assessments.
Metasploit integration
Can integrate with a locally available msfconsole for supported security-testing workflows.
Professional CLI
Banner, quiet mode, verbose mode, target parsing, credentials, wordlists, logging, reports, and Metasploit configuration.
Install locally.
Windows + Python 3.x are required. Metasploit is optional.
git clone https://github.com/Nullit13/winraider/
cd winraider
python -m venv .venv
.venv\Scripts\Activate.ps1
pip install -r requirements.txt
python main.py --helpCommand-line workflows.
The examples below use documentation IP space and are intended for an isolated authorized lab.
.\winraider.exe -t 192.0.2.10
.\winraider.exe -t 192.0.2.10 -v
.\winraider.exe -t 192.0.2.10 -q
.\winraider.exe -t 192.0.2.10 -u administrator -p "<PASSWORD>"
.\winraider.exe -t 192.0.2.10 --users users.txt -w passwords.txt
.\winraider.exe -t 192.0.2.10 --msfpath "C:\path\to\msfconsole.exe"Every flag at a glance.
-t, --targetRequired target IP address for target-based operations.
--discoverDiscover Windows devices on the local network.
-u, --usernameUsername for authenticated testing.
-p, --passwordPassword for authenticated testing.
-w, --wordlistPassword wordlist. Defaults to wordlists/passwords.txt.
--usersUsername wordlist. Defaults to wordlists/users.txt.
--threadsNumber of threads used by credential-testing workflows. Default: 10.
--msfpathPath to Metasploit msfconsole.
--lhostLocal host IP for supported Metasploit workflows.
-v, --verboseVerbose output.
-q, --quietQuiet mode with minimal output.
--logWrite activity to winraider.log.
--reportSave assessment results to a report file.
--scanRun port scanning only.
--zeroRun vulnerability checks without credentials.
--credsRun authorized testing with supplied credentials.
--bruteRun authorized credential wordlist testing.
Supported ports.
| Port | Service | Assessment types |
|---|---|---|
| 445 | SMB | Discovery · authenticated access · SMB vulnerability checks · credential testing |
| 3389 | RDP | Discovery · authenticated RDP testing · BlueKeep assessment · credential testing |
| 5985 | WinRM HTTP | Discovery · authentication testing · configuration/security checks |
| 5986 | WinRM HTTPS | Discovery · authenticated WinRM testing · configuration/security checks |
| 139 | NetBIOS | Discovery · information-disclosure assessment · credential testing |
| 135 | MSRPC | Discovery · RPC-related security assessment |
| 22 | SSH | Discovery · authenticated SSH testing · SSH security/vulnerability checks · credential testing |
Plain text. One entry per line.
WinRaider accepts simple text wordlists. Avoid blank lines and keep credential testing within your authorization scope.
users.txt
administrator
admin
guest
test
userpasswords.txt
password123
Password123!
Winter2026!
ExamplePasswordUse an isolated lab.
For development and education, dedicate virtual machines to testing and isolate them from networks you do not control.
┌───────────────────────┐
│ WinRaider Host │
│ Windows │
└───────────┬───────────┘
│
Isolated Lab Network
│
┌───────────▼───────────┐
│ Windows Test VM │
│ SMB · RDP · WinRM │
│ NetBIOS · MSRPC · SSH│
└───────────────────────┘Legal disclaimer.
WinRaider is intended strictly for authorized security testing, education, research, and defensive security assessment. You are solely responsible for ensuring that your use complies with applicable laws, regulations, contracts, and organizational policies. Do not use WinRaider to access systems without authorization, attack third-party infrastructure, obtain unauthorized credentials, disrupt systems or networks, deploy exploits without explicit permission, or circumvent security controls without authorization. The author and contributors are not responsible for misuse, damage, data loss, unauthorized access, or other consequences resulting from use.
What changed in v2.0.
Discovery
Windows device discovery is available through --discover for local authorized lab networks.
Assessment modes
Separate scan, vulnerability, authenticated, and credential-testing modes make workflows easier to control.
Reporting
Activity logging and report output can be enabled with --log and --report.
MIT License.
WinRaider is released under the MIT License. Keep the repository's LICENSE file alongside the project.
MIT License
Copyright (c) 2026 Abed (Nullit13)
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files, to deal in the Software
without restriction, subject to the conditions of the MIT License.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.