v4nyl

kernel-hardening-checker

A tool for checking the security hardening options of the Linux kernel

msi-search

SignToolEx

Patching "signtool.exe" to accept expired certificates for code-signing.

Marble

The CIA's Marble Framework is designed to allow for flexible and easy-to-use obfuscation when developing tools.

pre2k

CrossC2Kit

CrossC2 developed based on the Cobalt Strike framework can be used for other cross-platform system control. CrossC2Kit provides some interfaces for users to call to manipulate the CrossC2 Beacon session, thereby extending the functionality of Cobalt Strike.

NGLite

A major platform RAT Tool based by Blockchain/P2P.Now support Windows/Linux/MacOS

PEAs

perfect-dll-proxy

Perfect DLL Proxying using forwards with absolute paths.

IoDllProxyLoad

DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly

Jigsaw

Hide shellcode by shuffling bytes into a random array and reconstruct at runtime

SpawnWith

hayabusa

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Shoggoth

Shoggoth: Asmjit Based Polymorphic Encryptor

ssp_dump_lsass

RPC 调用添加ssp扩展dump lsass

arsenal

Arsenal is just a quick inventory and launcher for hacking programs

fuegoshell

Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445

PingRAT

PingRAT secretly passes C2 traffic through firewalls using ICMP payloads.

ItWasAllADream

A PrintNightmare (CVE-2021-34527) Python Scanner. Scan entire subnets for hosts vulnerable to the PrintNightmare RCE

CVE-2021-1675

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

ETWInspector

ADPT

DLL proxying for lazy people

msldap

LDAP library for auditing MS AD

ldapper

ELFieScanner

A C++ tool for process memory scanning & suspicious telemetry generation that attempts to detect a number of malicious techniques used by threat actors & those which have been incorporated into open-source user-mode rootkits.

proxybroker2

The New (auto rotate) Proxy [Finder | Checker | Server]. HTTP(S) & SOCKS :performing_arts:

Invoke-RunAsWithCert

A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.

TrollDump

ttyinject

Get root via TTY / TIOCSTI stuffing

PassDetective

PassDetective is a command-line tool that scans shell command history to detect mistakenly written passwords, API keys, and secrets. Using regular expressions, it helps prevent accidental exposure of sensitive information in your command history.