kleiton0x00

SC

shell code example

SharpADWS

Active Directory reconnaissance and exploitation for Red Teams via the Active Directory Web Services (ADWS).

gimmick

Section-based payload obfuscation technique for x64

EDRSnowblast

This project is an EDRSandblast fork, adding some features and custom pieces of code.

RdpStrike

Positional Independent Code to extract clear text password from mstsc.exe using API Hooking via HWBP.

AllAboutBugBounty

All about bug bounty (bypasses, payloads, and etc)

Voidgate

A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfvenom) by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that specific memory page.

PsMapExec

A PowerShell tool that takes strong inspiration from CrackMapExec / NetExec

XSRFProbe

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

RflDllOb

Reflective DLL Injection Made Bella

Chisel-Strike

A .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities.

xyrella

PoC XLL builder in Python/Nim

SWAPPALA

In-memory hiding technique

ModifyExports

Research of modifying exported function names at runtime (C/C++, Windows)

RtlClone

OdinLdr

Cobaltstrike UDRL with memory evasion

wifipassdump

dump wifi passwords using win32 api

DLL-Hollow-PoC

DLL Hollowing PoC - Remote and Self shellcode injection

GhostlyHollowingViaTamperedSyscalls

Implementing the ghostly hollowing PE injection technique using tampered syscalls.

AMSI_VEH

A Powershell AMSI Bypass technique via Vectored Exception Handler (VEH). This technique does not perform assembly instruction patching, function hooking or Import Address Table (IAT) modification.

no-defender

A slightly more fun way to disable windows defender + firewall. (through the WSC api)

domloggerpp

A browser extension that allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations.

ETWInspector

DV_NEW

This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)

obfus.h

Macro-header for compile-time C obfuscation (tcc, win x86/x64)

Process_Ghosting

Process Ghosting is a technique in which a process is created from a delete pending file. This means the created process is not backed by a file. This is an evasion technique.

Learning-EDR-and-EDR_Evasion

I will be uploading all the codes which I created with the help either opensource projects or blogs. This is a step by step EDR learning path for me.

SAMLRaider

SAML2 Burp Extension

DllNotificationInjection

A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes.

PartyLoader

Threadless shellcode injection tool