antonioCoco

PayloadsAllTheThings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

reactos

A free Windows-compatible Operating System

nishang

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

yara

The pattern matching swiss knife

UACME

Defeating Windows User Account Control

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

evil-winrm

The ultimate WinRM shell for hacking/pentesting

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

ScyllaHide

Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide

thc-tips-tricks-hacks-cheat-sheet

Various tips & tricks

PrivescCheck

Privilege Escalation Enumeration Script for Windows

HyperDbg

State-of-the-art native debugging tool

ReflectiveDLLInjection

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

InfinityHook

Hook system calls, context switches, page faults and more.

sandbox-attacksurface-analysis-tools

Set of tools to analyze Windows sandboxes for exposed attack surface.

PersistenceSniper

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made with ❤️ by @last0x00 and @dottor_morte

PrintSpoofer

Abusing impersonation privileges through the "Printer Bug"

Vanara

A set of .NET libraries for Windows implementing PInvoke calls to many native Windows APIs with supporting wrappers.

SysWhispers

AV/EDR evasion via direct system calls.

oleviewdotnet

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container

injdrv

proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC

VBA-RunPE

A VBA implementation of the RunPE technique or how to bypass application whitelisting.

Invoke-SocksProxy

Socks proxy, and reverse socks server using powershell.

LocalPotato

DetoursNT

Detours with just single dependency - NTDLL

PPLmedic

Dump the memory of any PPL with a Userland exploit chain

ATPMiniDump

Evading WinDefender ATP credential-theft

WinSpy

Enhanced version of the classic Spy++ tool

minidump

Custom implementation of DbgHelp's MiniDumpWriteDump function. Uses static syscalls to replace low-level functions like NtReadVirtualMemory.

authenticode-parser

Authenticode-parser is a simple C library for Authenticode format parsing using OpenSSL.