Bw3ll

ImmoralFiber

Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) PhantomThread (An evolved callstack-masking implementation)

ELFieScanner

A C++ tool for process memory scanning & suspicious telemetry generation that attempts to detect a number of malicious techniques used by threat actors & those which have been incorporated into open-source user-mode rootkits.

winbindex

An index of Windows binaries, including download links for executables such as exe, dll and sys files

SELKS

A Suricata based IDS/IPS/NSM distro

kestrel-lang

Kestrel threat hunting language: building reusable, composable, and shareable huntflows across different data sources and threat intel.

PyRIT

The Python Risk Identification Tool for generative AI (PyRIT) is an open access automation framework to empower security professionals and machine learning engineers to proactively find risks in their generative AI systems.

NimPlant

A light-weight first-stage C2 implant written in Nim.

CVE-Half-Day-Watcher

IDA_Plugin_AntiDebugSeeker

Automatically identify and extract potential anti-debugging techniques used by malware.

AegiScan

A Static Dataflow Analysis Framework for iOS Applications.

Win32_Offensive_Cheatsheet

Win32 and Kernel abusing techniques for pentesters

masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.

EMO

Emote Portrait Alive: Generating Expressive Portrait Videos with Audio2Video Diffusion Model under Weak Conditions

Fooocus

Focus on prompting and generating

search-by-image

Browser extension for reverse image search, available for Chrome, Edge and Safari

ROP_ROCKET

ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Syscalls attack, a novel Heaven's Gate, and "shellcodeless" ROP. The framework utilizes emulation and obfuscation to help expand the attack surface.

MORF

Mobile Reconnaissance Framework

pentest-muse-cli

secrets-patterns-db

Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.

sharem

SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.

weetabix

A C++ PoC implementation for enumerating Windows Fibers directly from memory

GhidraScripts

Scripts to run within Ghidra, maintained by the Trellix ARC team

syscall_api

Awesome-Red-Teaming

List of Awesome Red Teaming Resources

Awesome-Advanced-Windows-Exploitation-References

List of Awesome Advanced Windows Exploitation References

qsocket

SigFlip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

DotDumper

An automatic unpacker and logger for DotNet Framework targeting files

WindowsExploitationResources

Resources for Windows exploit development

de4dot

.NET deobfuscator and unpacker (with a control flow unflattener for DoubleZero added).