v4nyl

windows

Windows inside a Docker container.

Checklists

Red Teaming & Pentesting checklists for various engagements

BadBlood

BadBlood by @davidprowe, Secframe.com, fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an understanding and prescribe to securing Active Directory. Each time this tool runs, it produces different results. The domain, users, groups, computers and permissions are different. Every. Single. Time.

drakvuf-sandbox

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

BlueSpy

PoC to record audio from a Bluetooth device

FullPowers

Recover the default privilege set of a LOCAL/NETWORK SERVICE account

GraphStrike

Cobalt Strike HTTPS beaconing over Microsoft Graph API

onionpipe

Onion addresses for anything.

ThievingFox

NativeDump

Dump lsass using only Native APIs by hand-crafting Minidump files (without MinidumpWriteDump!)

UAC-BOF-Bonanza

Collection of UAC Bypass Techniques Weaponized as BOFs

SpyGuard

SpyGuard is a forked and enhanced version of TinyCheck. SpyGuard's main objective is to detect signs of compromise by monitoring network flows transmitted by a device.

elastic-container

Stand up a simple Elastic container with Kibana, Fleet, and the Detection Engine

RemoteTLSCallbackInjection

Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process

AutoSmuggle

Utility to craft HTML or SVG smuggled files for Red Team engagements

cookie-monster

BOF to steal browser cookies & credentials

NoArgs

NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into Windows APIs to dynamically manipulate the Windows internals on the go. This allows NoArgs to alter process arguments discreetly.

SymProcAddress

Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids)

Handly

Abuse leaked token handles.

MultCheck

Identifies bad bytes from static analysis with any Anti-Virus scanner.

mydumbedr

pendulum

Linux Sleep Obfuscation

Fairplay

Artifact monitoring that ensures fairplay

unmanaged-dotnet-patch

Modify managed functions from unmanaged code

keebcap

Win32 keylogger that supports all (non-ime using) languages correctly

Proxy_Egress_Persistence

A post-exploitation strategy for persistence and egress from networks utilizing authenticated web proxies

SDD

Self Delete DLL

EnableWebDAVClient-BOF

Cobalt Strike Beacon Object File to enable the webdav client service on x64 windows hosts

LdapRelayScan

Check for LDAP protections regarding the relay of NTLM authentication

CattleStorm

Python wrapper script to interact with the BeEF (https://github.com/beefproject/beef) API and execute modules on all connected zombie browsers at the same time.