bu-shuo

MalwareSourceCode

Collection of malware source code for a variety of platforms in an array of different programming languages.

AD-Attack-Defense

Attack and defend active directory using modern post exploitation adversary tradecraft activity

dot

The Deepfake Offensive Toolkit

my-re0-k8s-security

:atom: [WIP] 整理过去的分享，从零开始的Kubernetes攻防 🧐

vmprotect-3.5.1

EDR-Telemetry

This project aims to compare and evaluate the telemetry of various EDR products.

Shhhloader

Syscall Shellcode Loader (Work in Progress)

SigFlip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

Windows-Local-Privilege-Escalation-Cookbook

Windows Local Privilege Escalation Cookbook

SecBooks

安全类各家文库大乱斗

Windows10-CustomKernelSigners

Load self-signed drivers without TestSigning or disable DSE. Transferred from https://github.com/DoubleLabyrinth/Windows10-CustomKernelSigners

InsightEngineering

Hardcore Debugging

CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability

Microsoft-Outlook-Remote-Code-Execution-Vulnerability

LearnJavaMemshellFromZero

【三万字原创】完全零基础从0到1掌握Java内存马，公众号：追梦信安

OffensiveCpp

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

Banshee

Experimental Windows x64 Kernel Rootkit.

Sign-Sacker

Sign-Sacker(签名掠夺者)：一款数字签名复制器，可将其他官方exe中数字签名，图标，详细信息复制到没有签名的exe中，作为免杀，权限维持，伪装的一种小手段。

VectorKernel

PoCs for Kernelmode rootkit techniques research.

Marble

The CIA's Marble Framework is designed to allow for flexible and easy-to-use obfuscation when developing tools.

RandomTSScripts

Collection of random RedTeam scripts.

yafu

Automated integer factorization

EventLogCrasher

ssde

SSDE is a collection of utilities that help in having Windows load your custom signed kernel drivers when Secure Boot is on and you own the system's platform key, instead of using test mode.

ProcessStomping

A variation of ProcessOverwriting to execute shellcode on an executable's section

AutomatedEmulation

An automated Breach and Attack Simulation lab with terraform. Built for IaC stability, consistency, and speed.

Misc-Research

A collection of tools, scripts and personal research

adiskreader

Async Python library to parse local and remote disk images.

etwunhook

Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.

py-amsi

Scan strings or files for malware using the Windows Antimalware Scan Interface

CTF-writeups

Writeups for CTF challenges