kaandemir993/rusty-stealer-keylogger-screen-streaming-service-persistence-defender-evasion-analysisReverse engineering Rusty Stealer: A Rust-based RAT featuring advanced keylogging, live screen streaming, and aggressive defense evasion (killing…
k4n3co/lab-rats-v1.6Lab-RATS is a powerful and lightweight Android Remote Administration Tool full of features that enables remote monitoring, management and interaction…
gmh5225/kprocterminatorWindows kernel driver designed for terminating specific processes on a system
g13net/lockjawModular Windows C2 framework with a Rust teamserver, Zig implant, indirect syscalls, AMSI bypass, reflective/PoolParty injection, in-memory BOF…
0x574r/darkcloakLinux process identity cloaking tool that spoofs comm, argv, cmdline, environ, exe path, and VMAs via an 11-phase prctl pipeline to impersonate…
kaandemir993/purerat-msbuild.exe--c2-extraction--net-evasion-analysisReverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and…
voidsecsoftwares/voidsyscallCross-platform syscall-powered implant & C2 — direct syscalls (Win), raw syscalls (Linux), HTTPS/DNS/ICMP channels. No winapi layer.
epsilonpoint88-glitch/epsilonpoint-Modular exploit framework targeting CVE-2026-23550 in WordPress, featuring mass exploitation, obfuscation, post-exploitation, and Docker-based C2…
eh-amish/windows-defender-security-auditor-cve-2026-50656-Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…
ignitetechnologies/mssql-pentest-cheatsheetPractical MSSQL penetration testing cheat sheet covering enumeration, linked-server pivoting, privilege escalation, persistence, and command…
yo-yo-yo-jbo/macos_app_structureEducational deep dive into macOS app bundles, plist files, and launchd process behavior, with offensive security notes on packaging payloads as .app…
integration-it/active-directory-exploitation-cheat-sheetA cheat sheet that contains common enumeration and attack methods for Windows Active Directory.
synacktiv/metamorphA command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.
blue0x1/sqlwindsSQLWinds - SQL Server Security Assessment & Post-Exploitation Toolkit
nicetop1027/cve-2026-discordCritical vulnerability report detailing zero-day Remote Debugging Port exposure in Discord macOS client leading to account takeover, spyware, worm…
0x09al/dns-persistDNS-Persist is a post-exploitation agent which uses DNS for command and control.
netspi/sqlc2SQLC2 is a PowerShell script for deploying and managing a command and control system that uses SQL Server as both the control server and the agent.
