Highlights
Stars
crypted admin shell: SSH-like strong crypto remote admin shell for Linux, BSD, Android, Solaris and OSX
Open repository for learning dynamic shellcode loading (sample in many programming languages)
Compile-time, Usermode + Kernelmode, safe and lightweight string crypter library for C++11+
Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+Bloc…
An even funnier way to disable windows defender. (through WSC api)
🧙♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications
A continuation of the famous quasar remote administration tool
Useful C2 techniques and cheatsheets learned from engagements
Windows Local Privilege Escalation from Service Account to System
A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager
(0day) Local Privilege Escalation in IObit Malware Fighter
Find possible locations of shadows around the world
A few examples of how to trap virtual memory access on Windows.
PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info
API documentation for Open Source Surveillance
A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
T-1 is a shellcode loader that leverages ML techniques to detect VM environments
AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses
lsassdump via RtlCreateProcessReflection and NanoDump
A collection of c++ programs that demonstrate common ways to detect the presence of an attached debugger.
An attack tool designed to remotely disable CCTV camera streams (like in spy movies)
Custom Selenium Chromedriver | Zero-Config | Passes ALL bot mitigation systems (like Distil / Imperva/ Datadadome / CloudFlare IUAM)