itaymigdal

Heroinn

A cross platform C2/post-exploitation framework.

CallStackMasker

A PoC implementation for dynamically masking call stacks with timers.

RdpThief

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

RdpStrike

Positional Independent Code to extract clear text password from mstsc.exe using API Hooking via HWBP.

Packer_Development

Slides & Code snippets for a workshop held @ x33fcon 2024

pe-union

Crypter, binder & downloader with native & .NET stub, evasive by design, user friendly UI

PWA-Phishing

Voidgate

A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfvenom) by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that specific memory page.

kdmapper-rs

Rust port of kdmapper

Invoke-DumpMDEConfig

PowerShell script to dump Microsoft Defender Config, protection history and Exploit Guard Protection History (no admin privileges required )

WALK_WebAssembly_Lure_Krafter

A web assembly (WASM) phishing lure generator based on pre-built templates and written in Rust with some GenAI assistance. W.A.L.K. aims at aiding with initial access during red teams and phishing exercises leveraging WASM smuggling techniques.

tabby

Self-hosted AI coding assistant

TotalRecall

This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots.

hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

MDE_Enum

comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reduction (ASR) rules without Admin privileges

psgetsystem

getsystem via parent process using ps1 & embeded c#

mimiRust

All credits to: github.com/ThottySploity/mimiRust (Original author deleted account so I uploaded for community use)

houdini

A rust library that allows you to delete your executable while it's running.

rust-windows-shellcode

Windows shellcode development in Rust

hashcat

World's fastest and most advanced password recovery utility

SharpADWS

Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS).

smbclient-ng

smbclient-ng, a fast and user friendly way to interact with SMB shares.

InfinityHook_latest

etw hook (syscall/infinity hook) compatible with the latest Windows version of PG

CallMon

CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers

snafflepy

Snaffler reimplementation in Python - https://github.com/SnaffCon/Snaffler

coffee

A COFF loader made in Rust

msg-extractor

Extracts emails and attachments saved in Microsoft Outlook's .msg files

AMSI_VEH

A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification.

PPLSystem

cantordust

Public repository for Cantordust Ghidra plugin.