Kernel mode WinDbg extension and PoCs for token privilege investigation.

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.

Active Directory ACL Visualizer - who's really Domain Admin?

For when DLLMain is the only way

Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).

New generation of wmiexec.py

Signing-key abuse and update exploitation framework

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Generate BloodHound compatible JSON from logs written by ldapsearch BOF, pyldapsearch and Brute Ratel's LDAP Sentinel

Attempt at Obfuscated version of SharpCollection

A Golang Discord C2 unlike any other. DCVC2 uses RTP packets over a voice channel to transmit all data leaving no operational traces in text chats.

PoCs and tools for investigation of Windows process execution techniques

Kernel rk

Simple (relatively) things allowing you to dig a bit deeper than usual.

DNS Enumeration Script

Flutter Reverse Engineering Framework

Mythic C2 agent targeting Linux and Windows hosts written in Rust

Real fucking shellcode encryption tool.

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

GTFOArgs is a curated list of programs and their associated arguments that can be exploited to gain privileged access or execute arbitrary commands, using argument injection.

IDA plugin for UEFI firmware analysis and reverse engineering automation

A python tool to automate KeePass discovery and secret extraction.

DPAPI looting remotely in Python

Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

Expose USB activity on the fly

Select any exported function in a dll as the new dll's entry point.

A collaborative, multi-platform, red teaming framework

Linux/Windows post-exploitation framework made by linux user