InjectSetConsole
twosevenonet/injectsetconsoleProof of Concept for Process Code Injection Without Using WriteProcessMemory
command-and-controlexploitationids-ips-evasion+7
160
twosevenonet/injectsetconsoleProof of Concept for Process Code Injection Without Using WriteProcessMemory
captmag/maldevCreation of multiple Malware tools consisting of evasion, enumeration and exploitation
nvisosecurity/cobaltwhispersCobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files (BOF) for Cobalt Strike to perform process injection,…
jimywork/cromosCromos is a tool for downloading legitimate extensions of the Chrome Web Store and inject codes in the background of the application.
s3n4t0r-0x0/rustywater-shellcode-dropperRustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks.
viralmaniar/phirauteeA proof of concept crypto virus to spread user awareness about attacks and implications of ransomwares. Phirautee is written purely using PowerShell…
thegeekht/loki.ratLoki.Rat is a fork of the Ares RAT, it integrates new modules, like recording , lockscreen , and locate options. Loki.Rat is a Python Remote Access…
kaandemir993/purerat-msbuild.exe--c2-extraction--net-evasion-analysisReverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and…
kaandemir993/advanced-loader-reverse-engineering"In-depth reverse engineering analysis of an advanced multi-phase loader targeting Shellhost.exe, amsi.dll, mstscax.dll, and clbcatq.dll using module…
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
atlasvector/kestra-cve-2026-53576End-to-end reproduction and cross-layer detection of CVE-2026-53576, the unauthenticated RCE in Kestra - taken past the base PoC to show how a common…
kaandemir993/vidar-stealer-reverse-engineering"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…
j4ck3lsyn-gen2/cve-2026-13768Azure IoT Hub where exposure of an owner-level Shared Access Key enables unauthenticated remote code execution (RCE) against connected IoT devices.…
dragon56yt/revshellA comprehensive educational repository demonstrating the evolution of a Windows reverse shell implant, from a simple proof‑of‑concept (v1.0) to a…
kaandemir993/-remcos-rat-fileless-svchost-injection-obfuscated-payload-analysis-"Reverse engineering analysis of a fileless Remcos RAT variant that injects into svchost.exe via Native API calls. Covers obfuscated payload…
kaandemir993/redline-stealer-c2-defender-bypass-payload-analysis"Reverse engineering analysis of RedLine Stealer, a .NET-based info-stealer that uses C2 domains (198.46.86.63, tempuri.org), Windows Defender…
r3dteam/casper-shellCasper@shell:~# is an enhanced, more user-friendly version of p0wny shell with many new features.
stonelinks/react-cve-2025-55182Analysis of malware found on a server compromised via CVE-2025-55182, including obfuscated dropper, C2 communication, persistence mechanisms, and…