Christoph Hartmann chris-rock

Black Hat USA 2026 — Arsenal Tools

Every tool presented at Black Hat USA 2026 Arsenal, with its repository where one could be confirmed.

116 sessions presented 101 distinct tools once repeat time slots are deduplicated. 79 have a confirmed public GitHub repository. 22 do not.

	### Keybase proof

	I hereby claim:

	* I am chris-rock on github.
	* I am chrisrock (https://keybase.io/chrisrock) on keybase.
	* I have a public key ASDSA6iCyxpkFFeafVC-2zzyOKB4MGBVqbGlYB6Aa1QezAo

	To claim this, I am signing this object:

	<html>

	<head>
	<title>InSpec landing</title>
	</head>

	<body style="margin: 0;">
	<div class="container" style="background: linear-gradient(135deg, #5bc8a9 0%, #47b7d1 50%, #6063ef 100%);height: 100%;width: 100%;margin: 0;padding: 0;color: white;font-family: Muli, HelveticaNeue, Helvetica Neue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size: 6.25em;font-style: normal;font-weight: 200;">
	<div style="text-align: center;height: 280px;margin: 0 auto;width: 400px;position: relative;top: 150px;">Hello</div>
	<a href="https://www.inspec.io/" style="text-decoration: none;">

	<html>

	<head>
	<title>InSpec landing</title>
	</head>

	<body style="margin: 0;">
	<div class="container" style="background: linear-gradient(135deg, #5bc8a9 0%, #47b7d1 50%, #6063ef 100%);height: 100%;width: 100%;margin: 0;padding: 0;color: white;font-family: Muli, HelveticaNeue, Helvetica Neue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size: 6.25em;font-style: normal;font-weight: 200;">
	<div style="text-align: center;height: 280px;margin: 0 auto;width: 400px;position: relative;top: 150px;">Hello</div>
	<a href="https://www.inspec.io/" style="text-decoration: none;">

	// Author Christoph Hartmann
	// This is a simple test that tries to execute a simple binary that prints its uid:

	// package main
	//
	// import (
	// "fmt"
	// "os/user"
	// )
	//

	# Author: Christoph Hartmann
	# Target OS: Windows 2012+

	describe file('C:/Windows/explorer.exe') do
	it { should exist }
	it { should be_file }
	end

	describe user('Administrator') do
	it { should exist }

	# Author: Christoph Hartmann
	# Target OS: Windows 2012+

	# verify registry key entries
	describe registry_key('HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging') do
	it { should exist }
	its('EnableScriptBlockLogging') { should eq 0 }
	end

	# verify security policy configuration

	# Author: Christoph Hartmann
	# Target OS: Windows 2012 R2

	# Check that IIS is installed via Windows Features
	describe windows_feature('Webserver') do
	it { should be_installed }
	end

	# Ensure IIS Service is running
	describe service('W3SVC') do

	#!/bin/bash
	# this tool converts a .cab file to a zip file

	# check that we have an input parameter
	test -z "${1:-}" &&\
	echo "[ERROR] You need to pass a .cab file" &&\
	exit 1

	CURRENT_DIR=$(pwd)
	TMP=$(mktemp -d -t cab)