Stars
This a method of using WorkItem API to queue them to load a module. This version was modified to support string hashing via CRC32B.
The LLVM Project is a collection of modular and reusable compiler and toolchain technologies.
SysWhispers on Steroids - AV/EDR evasion via direct system calls.
Inline syscalls made easy for windows on clang
A modern c++ implementation of windows heavens gate
PoC: Rebuild A New Path Back to the Heaven's Gate (HITB 2021)
ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Windows syscalls. ShellWasp is built for 32-bit, WoW64. ShellWas…
A library for detecting known secrets across many web frameworks
A technique to run binaries filelessly and stealthily on Linux by "overwriting" the shell's process with another.
Circumventing "noexec" mount flag to execute arbitrary linux binaries by ptrace-less process injection
Go ransomware util AB83 ising ChaCha20 and ECIES encryption.
🧙♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications
GO Simple Tunnel - a simple tunnel written in golang
A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process
Reflective x64 PE/DLL Loader implemented using Dynamic Indirect Syscalls
Sign-Sacker(签名掠夺者)：一款数字签名复制器，可将其他官方exe中数字签名，图标，详细信息复制到没有签名的exe中，作为免杀，权限维持，伪装的一种小手段。
This comprehensive process injection series is crafted for cybersecurity enthusiasts, researchers, and professionals who aim to stay at the forefront of the field. It serves as a central repository…
Quick python utility I wrote to turn HTTP requests from burp suite into Cobalt Strike Malleable C2 profiles
Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.
Vim-fork focused on extensibility and usability