Beast code in Giters

Lee Baird's starred repositories

drawio-desktop

Official electron build of draw.io

Language:JavaScriptApache-2.047551 523 1402

donut

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

Language:CBSD-3-Clause3325 82 102

NetExec

The Network Execution Tool

Language:PythonBSD-2-Clause2473 22 109

pwndrop

Self-deployable file hosting service for red teamers, allowing to easily upload and share payloads over HTTP and WebDAV.

Language:JavaScriptGPL-3.01915 44 44

HiddenDesktop

HVNC for Cobalt Strike

Language:CMIT1120 15 4

Red-Teaming-TTPs

Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike!

1045 200

TeamsPhisher

Send phishing messages and attachments to Microsoft Teams users

Language:Python982 10 27

MANSPIDER

Spider entire networks for juicy files sitting on SMB shares. Search filenames or file content - regex supported!

Language:PythonGPL-3.0947 21 29

weirdAAL

WeirdAAL (AWS Attack Library)

Language:Python762 26 55

PurpleSharp

PurpleSharp is a C# adversary simulation tool that executes adversary techniques with the purpose of generating attack telemetry in monitored Windows environments

Language:C#BSD-3-Clause751 31 6

Freeze.rs

Freeze.rs is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls written in RUST

Language:RustMIT704 18 7

ADCSKiller

An ADCS Exploitation Automation Tool Weaponizing Certipy and Coercer

Language:PythonMIT685 6 8

Killer

Killer tool is designed to bypass AV/EDR security tools using various evasive techniques.

Language:C++676 7 3

proxycannon-ng

A private botnet using multiple cloud environments for pentesters and red teamers. - Built by the community during a hackathon at the WWHF 2018 security conference

Language:Shell593 30 12

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

Language:CMIT483 10 1

windows-coerced-authentication-methods

A list of methods to coerce a windows machine to authenticate to an attacker-controlled machine through a Remote Procedure Call (RPC) with various protocols.

Language:Python471 10 2

RedTeam-Physical-Tools

Red Team Toolkit - A curated list of tools that are commonly used in the field for Physical Security, Red Teaming, and Tactical Covert Entry.

MIT444 100

UAC-BOF-Bonanza

Collection of UAC Bypass Techniques Weaponized as BOFs

Language:CGPL-3.0355 8 1

PrivKit

PrivKit is a simple beacon object file that detects privilege escalation vulnerabilities caused by misconfigurations on Windows OS.

Language:CGPL-3.0336 50

hades

Go shellcode loader that combines multiple evasion techniques

Language:GoGPL-3.0329 7 1

LightsOut

Generate an obfuscated DLL that will disable AMSI & ETW

Language:PythonGPL-3.0308 6 1

Caro-Kann

Encrypted shellcode Injection to avoid Kernel triggered memory scans

Language:C308 5 4

Proxy-DLL-Loads

A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.

Language:CMIT300 7 4

PowershellKerberos

Some scripts to abuse kerberos using Powershell

Language:PowerShell298 4 1

lnkbomb

Malicious shortcut generator for collecting NTLM hashes from insecure file shares.

Language:PythonMIT284 6 1

GregsBestFriend

GregsBestFriend process injection code created from the White Knight Labs Offensive Development course

Language:C++MIT154 30

Direct-Syscalls-A-journey-from-high-to-low

Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low level).

Language:C121 2 1

evilginx2-TTPs

Reverse engineered to remove IOCs, added Exchange Online Protection IP blacklist and bing-bot user-agent blocking, DNS configuration and notes on usage.

Language:GoGPL-3.061 40

donut-demos

Demos of Donut used in conferences, etc. Mostly for my use, but free for others to use as a reference.

29 40

Athena

Dehashed API CLI

Language:Python1700

leebaird