bancomat1

PoolParty

A set of fully-undetectable process injection techniques abusing Windows Thread Pools

no-crt-template

simple c++ visual studio project that doesn't use the C/C++ runtime

EDR-Telemetry

This project aims to compare and evaluate the telemetry of various EDR products.

UltimateWDACBypassList

A centralized resource for previously documented WDAC bypass techniques

ThreadlessStompingKann

Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.

httpworker

A Flask-based HTTP(S) command and control (C2) framework with a web interface. Custom Windows EXE/DLL implants written in C++. For educational use only.

.NetConfigLoader

.net config loader

LdrLockLiberator

For when DLLMain is the only way

Win32_Offensive_Cheatsheet

Win32 and Kernel abusing techniques for pentesters

LatLoader

PoC module to demonstrate automated lateral movement with the Havoc C2 framework.

VX-API

Collection of various malicious functionality to aid in malware development

EDRSandblast-GodFault

EDRSandblast-GodFault

CallStackMasker

A PoC implementation for dynamically masking call stacks with timers.

EDRs

DEFCON-31-Syscalls-Workshop

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

ReflectiveNtdll

A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber

Ruy-Lopez

TimeException

A tool to find folders excluded from AV real-time scanning using a time oracle

AH2021Workshop

Malware development for red teaming workshop

ScareCrow

ScareCrow - Payload creation framework designed around EDR bypass.

RedWarden

Cobalt Strike C2 Reverse proxy that fends off Blue Teams, AVs, EDRs, scanners through packet inspection and malleable profile correlation

ProtectMyTooling

Multi-Packer wrapper letting us daisy-chain various packers, obfuscators and other Red Team oriented weaponry. Featured with artifacts watermarking, IOCs collection & PE Backdooring. You feed it with your implant, it does a lot of sneaky things and spits out obfuscated executable.

PackMyPayload

A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX

Penetration-Testing-Tools

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I've developed over years for Red Teaming/Pentesting/IT Security audits purposes.