Fluxay123

Blackbone

Windows memory hacking library

Cheatsheet-God

Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

hollows_hunter

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

injection

Windows process injection methods

Koppeling

Adaptive DLL hijacking / dynamic export forwarding

malware-research

OffensiveNim

My experiments in weaponizing Nim (https://nim-lang.org/)

pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

pe_to_shellcode

Converts PE into a shellcode

CobaltStrike

CobaltStrike's source code

ReflectiveDLLInjection

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

Rubeus

Trying to tame the three-headed dog.

SafetyKatz

SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

Seatbelt

Seatbelt is a C# project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensive security perspectives.

SharpDPAPI

SharpDPAPI is a C# port of some Mimikatz DPAPI functionality.

SharpUp

SharpUp is a C# port of various PowerUp functionality.

shellcode

Shellcodes for Windows/Linux/BSD running on x86, AMD64, ARM, ARM64

sRDI

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

vCloak

Virtualization and Unikernels cloaked malware PoC

vxhunter

ToolSet for VxWorks Based Embedded Device Analyses