wsummerhill

BloodHoundCustomQueries

My BloodHound custom queries

dploot

DPAPI looting remotely in Python

pyldapsearch

Tool for issuing manual LDAP queries which offers bofhound compatible output

siofra

Shellcode-Hide

This repo contains : simple shellcode Loader , Encoders (base64 - custom - UUID - IPv4 - MAC), Encryptors (AES), Fileless Loader (Winhttp, socket)

D1rkLdr

Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall instruction address resolving at run time

SharpWhispers

C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.

Inline-Execute-PE

Execute unmanaged Windows executables in CobaltStrike Beacons

CrossLinked

LinkedIn enumeration tool to extract valid employee names from an organization through search engine scraping

EDRSandblast

SQLRecon

A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

Alcatraz

x64 binary obfuscator

Snaffler

a tool for pentesters to help find delicious candy, by @l0ss and @Sh3r4 ( Twitter: @/mikeloss and @/sh3r4_hax )

PassTheChallenge

Recovering NTLM hashes from Credential Guard

sliver

Adversary Emulation Framework

BOFs

Collection of beacon object files for use with Cobalt Strike to facilitate 🐚.

CheckPlease

Sandbox evasion modules written in PowerShell, Python, Go, Ruby, C, C#, Perl, and Rust.

z85

ZeroMQ Base-85 Encoding library C/C++

FlavorTown

Various ways to execute shellcode

garble

Obfuscate Go builds

Shellcode-Injection-Techniques

A collection of C# shellcode injection techniques. All techniques use an AES encrypted meterpreter payload. I will be building this project up as I learn, discover or develop more techniques. Some techniques are better than others at bypassing AV.

RemotePatcher

Patch AMSI and ETW in remote process via direct syscall

SourcePoint

SourcePoint is a C2 profile generator for Cobalt Strike command and control servers designed to ensure evasion.

SigFlip

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

frostbyte

FrostByte is a POC project that combines different defense evasion techniques to build better redteam payloads

PackMyPayload

A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risks associated with container file formats. Supports: ZIP, 7zip, PDF, ISO, IMG, CAB, VHD, VHDX

SysWhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

SQLRecon

A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.

VX-API

Collection of various malicious functionality to aid in malware development

Awesome_Malware_Techniques

This is a repository of resource about Malware techniques