#1Shellcode generation, encoding, obfuscation, and testing frameworks.
Kitploit recommended
g13net/lockjawModular Windows C2 framework with a Rust teamserver, Zig implant, indirect syscalls, AMSI bypass, reflective/PoolParty injection, in-memory BOF…
become-illusory/cve-2026-64560-a16CVE-2026-64560 toolkit: Go single-binary toolchain + realme RMX5010 (A16, SM8750) target port
voidsecsoftwares/voidsec-proxyMulti-module offensive security toolkit for SOCKS5 proxy chaining, port scanning, DNS enumeration, hash cracking, reverse shell generation,…
ccob/threadlessinjectThreadless Process Injection using remote function hooking.
nettitude/runpeC# Reflective loader for unmanaged binaries.
mgeeky/shellcodefluctuationAn advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents
rizinorg/rizinUNIX-like reverse engineering framework and command-line toolset.
keystone-engine/keystoneMulti-architecture assembler framework that converts assembly source into machine code for Arm, x86, MIPS, PowerPC, RISC-V, and more, with a…
watchtowrlabs/watchtowr-vs-citrix-netscaler-preauth-rce-cve-2026-8452CVE-2026-8452 PreAuth RCE
godoy-sec/cve-2017-14980Study of a classic stack-based buffer overflow vulnerability in a controlled lab environment for educational purposes.
bc-security/empireEmpire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
techryptic/pokemon-shellcode-loaderTired of looking at hex all day and popping '\x41's? Rather look at Lugia/Charmander? I have the solution for you.
daem0nc0re/tangledwinexecPoCs and tools for investigation of Windows process execution techniques
cybereason/siofraSimulates the Windows PE loader to identify DLL hijacking vulnerabilities, generates weaponized DLLs with shellcode payloads, and detects UAC…
d3lb3/keefarcerebornA standalone DLL that exports databases in cleartext once injected in the KeePass process.
deepinstinct/dirty-vanityA POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.html#dirty-vani…
netspooky/scareA multi-arch assembly REPL and emulator for your command line.
epi052/osed-scriptsbespoke tooling for offensive security's Windows Usermode Exploit Dev course (OSED)
