#1Tools for bypassing Intrusion Detection and Prevention Systems (IDS/IPS) and network security controls.
Kitploit recommended
nsmfoo/antivmdetectionScript to create templates to use with VirtualBox to make vm detection harder
s12cybersecurity/windefenderkillerWindows Defender Killer | Registry-Based Disablement + BYOVD Process Termination (C++)
aetsu/offensivepipelineOfensivePipeline allows you to download and build C# tools, applying certain modifications in order to improve their evasion for Red Team exercises.
withsecurelabs/callstackspooferA PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)
malwaretech/edr-preloaderAn EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer
s4vitar/eviltrustHerramienta ideal para el despliegue automatizado de un Rogue AP con capacidad de selección de plantilla + 2FA. No requiere de conexión cableada.
idov31/cronosPoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.
flangvik/amsi.failC# Azure Function with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process.
pushpenderindia/thorseTHorse is a RAT (Remote Administrator Trojan) Generator for Windows/Linux systems written in Python 3.
bluscreenofjeff/malleable-c2-randomizerA script to randomize Cobalt Strike Malleable C2 profiles and reduce the chances of flagging signature-based detection controls
alirezaparsi/copgAdvanced per-app device / CPU / GPU spoofer for rooted Android — device profiles, per-app CPU models, prop & Android-ID spoofing, all driven by a…
waelmas/frameless-bitbA new approach to Browser In The Browser (BITB) without the use of iframes, allowing the bypass of traditional framebusters implemented by login…
rad9800/tamperingsyscallsC++ library that retrieves and spoofs Windows syscall arguments using hardware breakpoints and exception handlers to subvert EDR telemetry.
gellin/bantamA PHP backdoor management and generation tool/C2 featuring end to end encrypted payload streaming designed to bypass WAF, IDS, SIEM systems.
nccgroup/burpsuitehttpsmugglerA Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques
emptymonkey/mimicHide processes as a normal user in Linux.
sh4hin/gopurpleYet another shellcode runner consists of different techniques for evaluating detection capabilities of endpoint security solutions
