xct

sRDI

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

graftcp

A flexible tool for redirecting a given program's TCP traffic to SOCKS5 or HTTP proxy.

Nidhogg

Nidhogg is an all-in-one simple to use rootkit.

SysWhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

CS-Situational-Awareness-BOF

Situational Awareness commands implemented using Beacon Object Files

HiddenDesktop

HVNC for Cobalt Strike

TeamFiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts

LocalPotato

sccmhunter

pywhisker

Python version of the C# tool for "Shadow Credentials" attacks

DavRelayUp

DavRelayUp - a universal no-fix local privilege escalation in domain-joined windows workstations where LDAP signing is not enforced (the default settings).

KRBUACBypass

UAC Bypass By Abusing Kerberos Tickets

ldeep

In-depth ldap enumeration utility

resocks

mTLS-Encrypted Back-Connect SOCKS5 Proxy

Farmer

cracken

a fast password wordlist generator, Smartlist creation and password hybrid-mask analysis tool written in pure safe Rust

PassTheChallenge

Recovering NTLM hashes from Credential Guard

DInvoke_rs

Dynamically invoke arbitrary unmanaged code

Split

Apply a divide and conquer approach to bypass EDRs

CobaltWhispers

CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls (SysWhispers2) to bypass EDR/AV

WSPCoerce

PoC to coerce authentication from Windows hosts using MS-WSP

Lastenzug

Socks4a proxy leveraging PIC, Websockets and static obfuscation on assembly level

family-of-client-ids-research

Research into Undocumented Behavior of Azure AD Refresh Tokens

SeeYouCM-Thief

OktaPostExToolkit

SharpLink

Create file system symbolic links from low privileged user accounts within PowerShell

bbs

bbs is a router for SOCKS and HTTP proxies. It exposes a SOCKS5 (or HTTP CONNECT) service and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script (if built with PAC support), or through a JSON file.

CVE-2023-36723

bloodhound-convert

Python based Bloodhound data converter from the legacy pre 4.1 format to 4.1+ format

ttd2mdmp

Extract data of TTD trace file to a minidump