
TitanHide
Windows kernel driver that hooks Nt* SSDT functions to hide debuggers and processes from anti-debug checks, with an x64dbg plugin for stealth…

Windows kernel driver that hooks Nt* SSDT functions to hide debuggers and processes from anti-debug checks, with an x64dbg plugin for stealth…

Creation of multiple Malware tools consisting of evasion, enumeration and exploitation

Linux post-exploitation C2 framework with gossip mesh networking, memory-only operations, modular payloads, and OPSEC-focused transport for red team…

Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

THorse is a RAT (Remote Administrator Trojan) Generator for Windows/Linux systems written in Python 3.

Redirects EDR working folders using a Bind Filter (bindflt.sys) to bypass endpoint detection, corrupt EDR services, or replace with…

PostShell - Post Exploitation Bind/Backconnect Shell

Permanently disable EDRs as local admin


Windows kernel driver designed for terminating specific processes on a system

A framework that create an advanced stealthy dropper that bypass most AVs and have a lot of tricks

Post-exploitation framework for automated network authentication testing, credential harvesting, and lateral movement across Windows/AD environments…

Automated DLL Hijacking Discovery, Validation, and Confirmation. Turning local misconfigurations into weaponized, confirmed attack paths.

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

Automated AWS security assessment CLI with 30 modules covering IAM privilege escalation, S3 exposure, compute, network, logging and misconfiguration…

CVE-2026-33017 exploitation tool for Langflow <1.9.0. Features reverse shells, command execution, file operations, persistence, and automated…

TCL 50C721 (RTD1319 / Mali-G31) root toolkit — autonomous CVE-2022-22706 exploit chain

Toolbox containing research notes & PoC code for weaponizing .NET's DLR