HenryChanDC

HenryChanDC's starred repositories

BOF2shellcode

POC tool to convert CobaltStrike BOF files to raw shellcode

Language:CNOASSERTION17100

CS_Uploads_Tracker

Aggressor script add-in for CobaltStrike to track file uploads

GPL-3.03400

SeeProxy

Golang reverse proxy with CobaltStrike malleable profile validation.

Language:Go10700

Blocks EDR Telemetry by performing Person-in-the-Middle attack where network filtering is applied using iptables. The blocked destination IP addresses are parsed based on the server name in TLS Client Hello packet and the provided blocked server name (or blocked string) list in the file.

Language:PythonBSD-2-Clause5600

awesome-readme-generator-tools

收录了一些可以快速创建出精美readme.md的工具集合

MIT25800

BOFMask

11700

BOFRyptor

Language:Assembly10800

BokuLoader

A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!

Language:CMIT31500

pwcrack-framework

Password Crack Framework

Language:RubyGPL-3.049800

goreflect

Reflective DLL loading of your favorite Golang program

Language:C16300

LoginFish

通用登录页面安全控件钓鱼

Language:HTML18000

AmsiScanBufferBypass

Bypass AMSI by patching AmsiScanBuffer

Language:C#GPL-3.025000

dahuaExploitGUI

dahua综合漏洞利用工具

Language:Java16300

EDRPrison

Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

Language:C#23200

BOF.NET

A .NET Runtime for Cobalt Strike's Beacon Object Files

Language:C63900

ChromeExtensionInstall

Silently Install Chrome Extension For Persistence

Language:C#2600

kbtls

Establishes mutually trusted TLS connections based on a pre-shared connection key.

Language:GoMIT4600

Awesome-CobaltStrike-Defence

Defences against Cobalt Strike

MIT125900

TscanPlus

一款综合性网络安全检测和运维工具，旨在快速资产发现、识别、检测，构建基础资产信息库，协助甲方安全团队或者安全运维人员有效侦察和检索资产，发现存在的薄弱点和攻击面。

126700

Magic_C2

红队 C2 框架，使用 No X Loader 技术。Red Team C2 Framework, using No X Loader technology.

Language:C#13300

NacosExploit

NacosExploit 命令执行内存马等利用

Language:Java10100

wirez

redirect all TCP/UDP traffic of any program to SOCKS5 proxy

Language:GoMIT10900

pumpbin

🎃 PumpBin is an Implant Generation Platform.

Language:RustMIT19500

Voidgate

A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfvenom) by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that specific memory page.

Language:C++BSD-3-Clause40300