
MESH
Encrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…

Encrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

Tunna is a set of tools which will wrap and tunnel any TCP communication over HTTP. It can be used to bypass network restrictions in fully firewalled…

Tool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

Layer 2 network attack framework for exploiting STP and CDP protocols, enabling DoS, root role hijacking, and memory exhaustion attacks on Cisco…

Phantom Tap (PhanTap) - an ‘invisible’ network tap aimed at red teams

Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan

SilentButDeadly is a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using…

Automated Wi-Fi deauthentication tool that continuously scans for clients on a target SSID and kicks non-whitelisted devices. Features whitelist…

A tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.

Malformed ZIP archive that evades antivirus detection by declaring Method=0 (stored) while containing DEFLATE-compressed payload.

Redirects EDR working folders using a Bind Filter (bindflt.sys) to bypass endpoint detection, corrupt EDR services, or replace with…

Reverse shell that can bypass windows defender detection

Tool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access (for Windows only)

BYOVD: Use 360 WFP driver to block EDR/XDR network connection.

🌒 Shell command obfuscation to avoid detection systems

A Poc on blocking Procmon from monitoring network events