Tools

solomonsklash/sleepycrypt

A shellcode function to encrypt a running process image when sleeping.

codewhitesec/lastenzug

Socks4a proxy leveraging PIC, Websockets and static obfuscation on assembly level

daem0nc0re/tangledwinexec

PoCs and tools for investigation of Windows process execution techniques

secforce/sharpwhispers

C# porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub.

zimawhit3/bitmancer

Nim Library for Offensive Security Development

an00brektn/gopher47

A third-party Gopher Assassin for the Havoc Framework.

kudaes/split

Apply a divide and conquer approach to bypass EDRs

lloydlabs/ntqueueapcthreadex-ntdll-gadget-injection

This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret gadget can…

saadahla/d1rkldr

Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscall…

saadahla/shellcode-hide

This repo contains : simple shellcode Loader , Encoders (base64 - custom - UUID - IPv4 - MAC), Encryptors (AES), Fileless Loader (Winhttp, socket)

ps1337/lastenzug

Socks4a proxy leveraging PIC, Websockets and static obfuscation on assembly level

lsecqt/offensivecpp

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

airbus-cert/yara-ttd

Use YARA rules on Time Travel Debugging traces

tunnelgre/percino

Evasive Golang Loader

lleon1435/kernel_vadinjector

Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver

maldev-academy/christmas

PoC demonstrating a multi process injection chain aimed at remotely executing shellcode

florylsk/execit

Execute shellcode files with rundll32

nbaertsch/nimvoke

Indirect syscalls + DInvoke made simple.